Audit 364132

2024-002 — IT – Material Weakness in Internal Control Over Compliance and Noncompliance (Repeat of finding 2023-003) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; Education Stabilization Fund; and SFA Cluster- Pell Grant Program ALN Number: 15.027, 84.031, 84.425, and 84.063 Award years: Various Criteria: Without strong information technology internal controls and established policies and procedures, there is the potential for integrity of financial records, the confidentiality, integrity and/or availability of data to be compromised. This compromise could be by an internal user of the system, by an external source (hacker) and could be intentional or unintentional. Condition: The College’s IT control environment is lacking certain key controls. There are currently no formalized IT policies and procedures, sufficient data backup processes, or a formalized disaster recovery plan. IT controls are not in place to ensure non-authorized individuals are restricted from adding new vendors, recording journal entries, and making/or changes to employee pay records. Questioned Costs: N/A Cause: The IT controls have not been properly designed and implemented. Effect: The College is exposed to many risks regarding the integrity of the financial records, confidentiality, integrity, and/or availability of its data. It is possible that their data could be compromised. Compromise could be by an internal user of the system, by an external source (hacker) and could be intentional or unintentional. Additionally, during fiscal year 2024, the College experienced an outage which resulted in a loss of data. As no backup procedures were in place, amounts had to be restored in the system using other financial source data. Auditor’s Recommendations: Establishing IT controls, policies and procedures, off-site electronic data backups, and a disaster recovery plan would better prepare the College for technology related issues, system crashes, or data breaches. Management’s Response: The College is implementing policies and procedures.

2024-002 — IT – Material Weakness in Internal Control Over Compliance and Noncompliance (Repeat of finding 2023-003) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; Education Stabilization Fund; and SFA Cluster- Pell Grant Program ALN Number: 15.027, 84.031, 84.425, and 84.063 Award years: Various Criteria: Without strong information technology internal controls and established policies and procedures, there is the potential for integrity of financial records, the confidentiality, integrity and/or availability of data to be compromised. This compromise could be by an internal user of the system, by an external source (hacker) and could be intentional or unintentional. Condition: The College’s IT control environment is lacking certain key controls. There are currently no formalized IT policies and procedures, sufficient data backup processes, or a formalized disaster recovery plan. IT controls are not in place to ensure non-authorized individuals are restricted from adding new vendors, recording journal entries, and making/or changes to employee pay records. Questioned Costs: N/A Cause: The IT controls have not been properly designed and implemented. Effect: The College is exposed to many risks regarding the integrity of the financial records, confidentiality, integrity, and/or availability of its data. It is possible that their data could be compromised. Compromise could be by an internal user of the system, by an external source (hacker) and could be intentional or unintentional. Additionally, during fiscal year 2024, the College experienced an outage which resulted in a loss of data. As no backup procedures were in place, amounts had to be restored in the system using other financial source data. Auditor’s Recommendations: Establishing IT controls, policies and procedures, off-site electronic data backups, and a disaster recovery plan would better prepare the College for technology related issues, system crashes, or data breaches. Management’s Response: The College is implementing policies and procedures.

2024-002 — IT – Material Weakness in Internal Control Over Compliance and Noncompliance (Repeat of finding 2023-003) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; Education Stabilization Fund; and SFA Cluster- Pell Grant Program ALN Number: 15.027, 84.031, 84.425, and 84.063 Award years: Various Criteria: Without strong information technology internal controls and established policies and procedures, there is the potential for integrity of financial records, the confidentiality, integrity and/or availability of data to be compromised. This compromise could be by an internal user of the system, by an external source (hacker) and could be intentional or unintentional. Condition: The College’s IT control environment is lacking certain key controls. There are currently no formalized IT policies and procedures, sufficient data backup processes, or a formalized disaster recovery plan. IT controls are not in place to ensure non-authorized individuals are restricted from adding new vendors, recording journal entries, and making/or changes to employee pay records. Questioned Costs: N/A Cause: The IT controls have not been properly designed and implemented. Effect: The College is exposed to many risks regarding the integrity of the financial records, confidentiality, integrity, and/or availability of its data. It is possible that their data could be compromised. Compromise could be by an internal user of the system, by an external source (hacker) and could be intentional or unintentional. Additionally, during fiscal year 2024, the College experienced an outage which resulted in a loss of data. As no backup procedures were in place, amounts had to be restored in the system using other financial source data. Auditor’s Recommendations: Establishing IT controls, policies and procedures, off-site electronic data backups, and a disaster recovery plan would better prepare the College for technology related issues, system crashes, or data breaches. Management’s Response: The College is implementing policies and procedures.

2024-002 — IT – Material Weakness in Internal Control Over Compliance and Noncompliance (Repeat of finding 2023-003) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; Education Stabilization Fund; and SFA Cluster- Pell Grant Program ALN Number: 15.027, 84.031, 84.425, and 84.063 Award years: Various Criteria: Without strong information technology internal controls and established policies and procedures, there is the potential for integrity of financial records, the confidentiality, integrity and/or availability of data to be compromised. This compromise could be by an internal user of the system, by an external source (hacker) and could be intentional or unintentional. Condition: The College’s IT control environment is lacking certain key controls. There are currently no formalized IT policies and procedures, sufficient data backup processes, or a formalized disaster recovery plan. IT controls are not in place to ensure non-authorized individuals are restricted from adding new vendors, recording journal entries, and making/or changes to employee pay records. Questioned Costs: N/A Cause: The IT controls have not been properly designed and implemented. Effect: The College is exposed to many risks regarding the integrity of the financial records, confidentiality, integrity, and/or availability of its data. It is possible that their data could be compromised. Compromise could be by an internal user of the system, by an external source (hacker) and could be intentional or unintentional. Additionally, during fiscal year 2024, the College experienced an outage which resulted in a loss of data. As no backup procedures were in place, amounts had to be restored in the system using other financial source data. Auditor’s Recommendations: Establishing IT controls, policies and procedures, off-site electronic data backups, and a disaster recovery plan would better prepare the College for technology related issues, system crashes, or data breaches. Management’s Response: The College is implementing policies and procedures.

2024-002 — IT – Material Weakness in Internal Control Over Compliance and Noncompliance (Repeat of finding 2023-003) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; Education Stabilization Fund; and SFA Cluster- Pell Grant Program ALN Number: 15.027, 84.031, 84.425, and 84.063 Award years: Various Criteria: Without strong information technology internal controls and established policies and procedures, there is the potential for integrity of financial records, the confidentiality, integrity and/or availability of data to be compromised. This compromise could be by an internal user of the system, by an external source (hacker) and could be intentional or unintentional. Condition: The College’s IT control environment is lacking certain key controls. There are currently no formalized IT policies and procedures, sufficient data backup processes, or a formalized disaster recovery plan. IT controls are not in place to ensure non-authorized individuals are restricted from adding new vendors, recording journal entries, and making/or changes to employee pay records. Questioned Costs: N/A Cause: The IT controls have not been properly designed and implemented. Effect: The College is exposed to many risks regarding the integrity of the financial records, confidentiality, integrity, and/or availability of its data. It is possible that their data could be compromised. Compromise could be by an internal user of the system, by an external source (hacker) and could be intentional or unintentional. Additionally, during fiscal year 2024, the College experienced an outage which resulted in a loss of data. As no backup procedures were in place, amounts had to be restored in the system using other financial source data. Auditor’s Recommendations: Establishing IT controls, policies and procedures, off-site electronic data backups, and a disaster recovery plan would better prepare the College for technology related issues, system crashes, or data breaches. Management’s Response: The College is implementing policies and procedures.

2024-002 — IT – Material Weakness in Internal Control Over Compliance and Noncompliance (Repeat of finding 2023-003) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; Education Stabilization Fund; and SFA Cluster- Pell Grant Program ALN Number: 15.027, 84.031, 84.425, and 84.063 Award years: Various Criteria: Without strong information technology internal controls and established policies and procedures, there is the potential for integrity of financial records, the confidentiality, integrity and/or availability of data to be compromised. This compromise could be by an internal user of the system, by an external source (hacker) and could be intentional or unintentional. Condition: The College’s IT control environment is lacking certain key controls. There are currently no formalized IT policies and procedures, sufficient data backup processes, or a formalized disaster recovery plan. IT controls are not in place to ensure non-authorized individuals are restricted from adding new vendors, recording journal entries, and making/or changes to employee pay records. Questioned Costs: N/A Cause: The IT controls have not been properly designed and implemented. Effect: The College is exposed to many risks regarding the integrity of the financial records, confidentiality, integrity, and/or availability of its data. It is possible that their data could be compromised. Compromise could be by an internal user of the system, by an external source (hacker) and could be intentional or unintentional. Additionally, during fiscal year 2024, the College experienced an outage which resulted in a loss of data. As no backup procedures were in place, amounts had to be restored in the system using other financial source data. Auditor’s Recommendations: Establishing IT controls, policies and procedures, off-site electronic data backups, and a disaster recovery plan would better prepare the College for technology related issues, system crashes, or data breaches. Management’s Response: The College is implementing policies and procedures.

2024-003 — Single Audit Report Submission – Material Weakness in Internal Control Over Compliance and Noncompliance (Repeat of finding 2023-005, 2022-003, and 2021-001) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; Education Stabilization Fund; and SFA Cluster- Pell Grant Program ALN Number: 15.027, 84.031, 84.425, and 84.063 Award years: Various Criteria: The Uniform Guidance 2 CFR 200.512 (a) requires the audit package and data collection from be submitted 30 days after receipt of the auditor’s report or 9 months after the end of the fiscal year, whichever comes first. Condition: The College’s fiscal year 2024 single audit reporting package was not submitted within nine months after the end of the audit period. Questioned Costs: N/A Cause: The College did not have appropriate internal control policies and procedures in place to ensure accounting records and financial statements were reconciled timely and the audit conducted to meet compliance requirements. Effect: The single audit reporting package was submitted after the required reporting time period. Auditor’s Recommendations: To ensure compliance with the Uniform Guidance, the College should prepare accurate, complete, and timely financial statements and ensure an audit is performed to ensure the timely submission of the single audit reporting package. Management’s Response: The College had plan to remain current with submitting its annual report.

2024-003 — Single Audit Report Submission – Material Weakness in Internal Control Over Compliance and Noncompliance (Repeat of finding 2023-005, 2022-003, and 2021-001) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; Education Stabilization Fund; and SFA Cluster- Pell Grant Program ALN Number: 15.027, 84.031, 84.425, and 84.063 Award years: Various Criteria: The Uniform Guidance 2 CFR 200.512 (a) requires the audit package and data collection from be submitted 30 days after receipt of the auditor’s report or 9 months after the end of the fiscal year, whichever comes first. Condition: The College’s fiscal year 2024 single audit reporting package was not submitted within nine months after the end of the audit period. Questioned Costs: N/A Cause: The College did not have appropriate internal control policies and procedures in place to ensure accounting records and financial statements were reconciled timely and the audit conducted to meet compliance requirements. Effect: The single audit reporting package was submitted after the required reporting time period. Auditor’s Recommendations: To ensure compliance with the Uniform Guidance, the College should prepare accurate, complete, and timely financial statements and ensure an audit is performed to ensure the timely submission of the single audit reporting package. Management’s Response: The College had plan to remain current with submitting its annual report.

2024-003 — Single Audit Report Submission – Material Weakness in Internal Control Over Compliance and Noncompliance (Repeat of finding 2023-005, 2022-003, and 2021-001) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; Education Stabilization Fund; and SFA Cluster- Pell Grant Program ALN Number: 15.027, 84.031, 84.425, and 84.063 Award years: Various Criteria: The Uniform Guidance 2 CFR 200.512 (a) requires the audit package and data collection from be submitted 30 days after receipt of the auditor’s report or 9 months after the end of the fiscal year, whichever comes first. Condition: The College’s fiscal year 2024 single audit reporting package was not submitted within nine months after the end of the audit period. Questioned Costs: N/A Cause: The College did not have appropriate internal control policies and procedures in place to ensure accounting records and financial statements were reconciled timely and the audit conducted to meet compliance requirements. Effect: The single audit reporting package was submitted after the required reporting time period. Auditor’s Recommendations: To ensure compliance with the Uniform Guidance, the College should prepare accurate, complete, and timely financial statements and ensure an audit is performed to ensure the timely submission of the single audit reporting package. Management’s Response: The College had plan to remain current with submitting its annual report.

2024-003 — Single Audit Report Submission – Material Weakness in Internal Control Over Compliance and Noncompliance (Repeat of finding 2023-005, 2022-003, and 2021-001) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; Education Stabilization Fund; and SFA Cluster- Pell Grant Program ALN Number: 15.027, 84.031, 84.425, and 84.063 Award years: Various Criteria: The Uniform Guidance 2 CFR 200.512 (a) requires the audit package and data collection from be submitted 30 days after receipt of the auditor’s report or 9 months after the end of the fiscal year, whichever comes first. Condition: The College’s fiscal year 2024 single audit reporting package was not submitted within nine months after the end of the audit period. Questioned Costs: N/A Cause: The College did not have appropriate internal control policies and procedures in place to ensure accounting records and financial statements were reconciled timely and the audit conducted to meet compliance requirements. Effect: The single audit reporting package was submitted after the required reporting time period. Auditor’s Recommendations: To ensure compliance with the Uniform Guidance, the College should prepare accurate, complete, and timely financial statements and ensure an audit is performed to ensure the timely submission of the single audit reporting package. Management’s Response: The College had plan to remain current with submitting its annual report.

2024-003 — Single Audit Report Submission – Material Weakness in Internal Control Over Compliance and Noncompliance (Repeat of finding 2023-005, 2022-003, and 2021-001) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; Education Stabilization Fund; and SFA Cluster- Pell Grant Program ALN Number: 15.027, 84.031, 84.425, and 84.063 Award years: Various Criteria: The Uniform Guidance 2 CFR 200.512 (a) requires the audit package and data collection from be submitted 30 days after receipt of the auditor’s report or 9 months after the end of the fiscal year, whichever comes first. Condition: The College’s fiscal year 2024 single audit reporting package was not submitted within nine months after the end of the audit period. Questioned Costs: N/A Cause: The College did not have appropriate internal control policies and procedures in place to ensure accounting records and financial statements were reconciled timely and the audit conducted to meet compliance requirements. Effect: The single audit reporting package was submitted after the required reporting time period. Auditor’s Recommendations: To ensure compliance with the Uniform Guidance, the College should prepare accurate, complete, and timely financial statements and ensure an audit is performed to ensure the timely submission of the single audit reporting package. Management’s Response: The College had plan to remain current with submitting its annual report.

2024-003 — Single Audit Report Submission – Material Weakness in Internal Control Over Compliance and Noncompliance (Repeat of finding 2023-005, 2022-003, and 2021-001) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; Education Stabilization Fund; and SFA Cluster- Pell Grant Program ALN Number: 15.027, 84.031, 84.425, and 84.063 Award years: Various Criteria: The Uniform Guidance 2 CFR 200.512 (a) requires the audit package and data collection from be submitted 30 days after receipt of the auditor’s report or 9 months after the end of the fiscal year, whichever comes first. Condition: The College’s fiscal year 2024 single audit reporting package was not submitted within nine months after the end of the audit period. Questioned Costs: N/A Cause: The College did not have appropriate internal control policies and procedures in place to ensure accounting records and financial statements were reconciled timely and the audit conducted to meet compliance requirements. Effect: The single audit reporting package was submitted after the required reporting time period. Auditor’s Recommendations: To ensure compliance with the Uniform Guidance, the College should prepare accurate, complete, and timely financial statements and ensure an audit is performed to ensure the timely submission of the single audit reporting package. Management’s Response: The College had plan to remain current with submitting its annual report.

2024-004 — Equipment and Real Property Management – Significant Deficiency in Internal Control Over Compliance and Noncompliance Federal program information: Funding agencies: U.S. Department of Education Titles: Higher Education Institutional Aid ALN Number: 84.031 Award years: Various Criteria: 2 CFR 200.313(c) through (e), requires that equipment be used in federal programs for which it was acquired for, when appropriate, other federal programs. Equipment records shall be maintained including required elements, a physical inventory of equipment be taken at least once every 2 years and reconciled to the equipment records, an appropriate control system shall be used to safeguard equipment, and equipment shall be adequately maintained. Condition: The College has not completed a physical inventory within the previous two fiscal years as required. In addition, the records were not detailed enough that program management is able to adequately and efficiently identify and locate any and all items. Questioned Costs: None Cause: The College is not enforcing their procedures to verify that the capital assets inventory has been taken annually and reconciled to the general ledger. Effect: Without a physical inventory, there is an increase in the probability that the capital asset listing will be incorrect, or assets listed may not exist. Auditor’s Recommendations: Enforce internal control procedures and complete an inventory of the school’s capital assets annually. Management’s Response: The College will take an inventory of its capital assets as required by policies.

2024-004 — Equipment and Real Property Management – Significant Deficiency in Internal Control Over Compliance and Noncompliance Federal program information: Funding agencies: U.S. Department of Education Titles: Higher Education Institutional Aid ALN Number: 84.031 Award years: Various Criteria: 2 CFR 200.313(c) through (e), requires that equipment be used in federal programs for which it was acquired for, when appropriate, other federal programs. Equipment records shall be maintained including required elements, a physical inventory of equipment be taken at least once every 2 years and reconciled to the equipment records, an appropriate control system shall be used to safeguard equipment, and equipment shall be adequately maintained. Condition: The College has not completed a physical inventory within the previous two fiscal years as required. In addition, the records were not detailed enough that program management is able to adequately and efficiently identify and locate any and all items. Questioned Costs: None Cause: The College is not enforcing their procedures to verify that the capital assets inventory has been taken annually and reconciled to the general ledger. Effect: Without a physical inventory, there is an increase in the probability that the capital asset listing will be incorrect, or assets listed may not exist. Auditor’s Recommendations: Enforce internal control procedures and complete an inventory of the school’s capital assets annually. Management’s Response: The College will take an inventory of its capital assets as required by policies.

2024-005 — Procurement – Material Weakness in Internal Control Over Compliance and Noncompliance (Repeat of Finding 2023-006 and 2022-004) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; and Education Stabilization Fund ALN Number: 15.027, 84.031, and 84.425 Award years: Various Criteria: According to 2 CFR Section 200.318i, the recipient or subrecipient must maintain records sufficient to detail the history of each procurement transaction. These records must include the rationale for the procurement method, contract type selection, contractor selection or rejection, and the basis for the contract price. According to 2 CFR Section 0200.319a, all procurement transactions under the federal award must be conducted in a manner that provides full and open competition. Condition: The College did not maintain records sufficient to detail the history of each procurement transaction for the nine procurements contracts tested. Cause: The College did not have sufficient procedures in place to ensure that procurement records are maintained. Effect: The College is not in compliance with procurement requirements. Questioned Costs: None Context: Procurement documents were not retained for nine out of nine transactions tested. Recommendation: Formally document and enforce policies and procedures that will promote adequate monitoring of the procurement and bidding process. Ensure that any contract over the College’s threshold ($150,000) follow the sealed bid requirements listed in 2 CFR Section 200.320b1. Management’s Response: The College will follow its policies as required.

2024-005 — Procurement – Material Weakness in Internal Control Over Compliance and Noncompliance (Repeat of Finding 2023-006 and 2022-004) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; and Education Stabilization Fund ALN Number: 15.027, 84.031, and 84.425 Award years: Various Criteria: According to 2 CFR Section 200.318i, the recipient or subrecipient must maintain records sufficient to detail the history of each procurement transaction. These records must include the rationale for the procurement method, contract type selection, contractor selection or rejection, and the basis for the contract price. According to 2 CFR Section 0200.319a, all procurement transactions under the federal award must be conducted in a manner that provides full and open competition. Condition: The College did not maintain records sufficient to detail the history of each procurement transaction for the nine procurements contracts tested. Cause: The College did not have sufficient procedures in place to ensure that procurement records are maintained. Effect: The College is not in compliance with procurement requirements. Questioned Costs: None Context: Procurement documents were not retained for nine out of nine transactions tested. Recommendation: Formally document and enforce policies and procedures that will promote adequate monitoring of the procurement and bidding process. Ensure that any contract over the College’s threshold ($150,000) follow the sealed bid requirements listed in 2 CFR Section 200.320b1. Management’s Response: The College will follow its policies as required.

2024-005 — Procurement – Material Weakness in Internal Control Over Compliance and Noncompliance (Repeat of Finding 2023-006 and 2022-004) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; and Education Stabilization Fund ALN Number: 15.027, 84.031, and 84.425 Award years: Various Criteria: According to 2 CFR Section 200.318i, the recipient or subrecipient must maintain records sufficient to detail the history of each procurement transaction. These records must include the rationale for the procurement method, contract type selection, contractor selection or rejection, and the basis for the contract price. According to 2 CFR Section 0200.319a, all procurement transactions under the federal award must be conducted in a manner that provides full and open competition. Condition: The College did not maintain records sufficient to detail the history of each procurement transaction for the nine procurements contracts tested. Cause: The College did not have sufficient procedures in place to ensure that procurement records are maintained. Effect: The College is not in compliance with procurement requirements. Questioned Costs: None Context: Procurement documents were not retained for nine out of nine transactions tested. Recommendation: Formally document and enforce policies and procedures that will promote adequate monitoring of the procurement and bidding process. Ensure that any contract over the College’s threshold ($150,000) follow the sealed bid requirements listed in 2 CFR Section 200.320b1. Management’s Response: The College will follow its policies as required.

2024-005 — Procurement – Material Weakness in Internal Control Over Compliance and Noncompliance (Repeat of Finding 2023-006 and 2022-004) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; and Education Stabilization Fund ALN Number: 15.027, 84.031, and 84.425 Award years: Various Criteria: According to 2 CFR Section 200.318i, the recipient or subrecipient must maintain records sufficient to detail the history of each procurement transaction. These records must include the rationale for the procurement method, contract type selection, contractor selection or rejection, and the basis for the contract price. According to 2 CFR Section 0200.319a, all procurement transactions under the federal award must be conducted in a manner that provides full and open competition. Condition: The College did not maintain records sufficient to detail the history of each procurement transaction for the nine procurements contracts tested. Cause: The College did not have sufficient procedures in place to ensure that procurement records are maintained. Effect: The College is not in compliance with procurement requirements. Questioned Costs: None Context: Procurement documents were not retained for nine out of nine transactions tested. Recommendation: Formally document and enforce policies and procedures that will promote adequate monitoring of the procurement and bidding process. Ensure that any contract over the College’s threshold ($150,000) follow the sealed bid requirements listed in 2 CFR Section 200.320b1. Management’s Response: The College will follow its policies as required.

2024-005 — Procurement – Material Weakness in Internal Control Over Compliance and Noncompliance (Repeat of Finding 2023-006 and 2022-004) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; and Education Stabilization Fund ALN Number: 15.027, 84.031, and 84.425 Award years: Various Criteria: According to 2 CFR Section 200.318i, the recipient or subrecipient must maintain records sufficient to detail the history of each procurement transaction. These records must include the rationale for the procurement method, contract type selection, contractor selection or rejection, and the basis for the contract price. According to 2 CFR Section 0200.319a, all procurement transactions under the federal award must be conducted in a manner that provides full and open competition. Condition: The College did not maintain records sufficient to detail the history of each procurement transaction for the nine procurements contracts tested. Cause: The College did not have sufficient procedures in place to ensure that procurement records are maintained. Effect: The College is not in compliance with procurement requirements. Questioned Costs: None Context: Procurement documents were not retained for nine out of nine transactions tested. Recommendation: Formally document and enforce policies and procedures that will promote adequate monitoring of the procurement and bidding process. Ensure that any contract over the College’s threshold ($150,000) follow the sealed bid requirements listed in 2 CFR Section 200.320b1. Management’s Response: The College will follow its policies as required.

2024-006 —Reporting – Significant Deficiency in Internal Control Over Compliance and Noncompliance (Repeat of Finding 2023-007, 2022-005, 2021-002, and 2020-004) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; and Education Stabilization Fund ALN Number: 15.027, 84.031, 84.425 Award years: Various Criteria: According to 2 CFR Section 200.328, nonfederal entities may be required to submit performance reports at least annually as required by the terms of the federal award. In addition, ALN 84.425 requires quarterly expenditure and budget reports. Condition: The College did not submit annual performance reports on time for three programs. The annual report for ALN 84.031 was inaccurate. In addition, two quarterly financial reports required for ALN 84.425 were not submitted timely. Cause: The College did not have sufficient procedures in place to ensure that the reports were completed timely and accurately. Effect: The three annual reports and two quarterly reports examined were submitted after the required time and one report was inaccurate. Questioned Costs: None Context: The annual reports and two quarterly reports were not submitted timely, and one report was not accurate. Recommendation: The College should ensure that all grant reports are prepared in a timely manner and are accurate. Management’s Response: The College will submit annual performance reports in a timely manner.

2024-006 —Reporting – Significant Deficiency in Internal Control Over Compliance and Noncompliance (Repeat of Finding 2023-007, 2022-005, 2021-002, and 2020-004) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; and Education Stabilization Fund ALN Number: 15.027, 84.031, 84.425 Award years: Various Criteria: According to 2 CFR Section 200.328, nonfederal entities may be required to submit performance reports at least annually as required by the terms of the federal award. In addition, ALN 84.425 requires quarterly expenditure and budget reports. Condition: The College did not submit annual performance reports on time for three programs. The annual report for ALN 84.031 was inaccurate. In addition, two quarterly financial reports required for ALN 84.425 were not submitted timely. Cause: The College did not have sufficient procedures in place to ensure that the reports were completed timely and accurately. Effect: The three annual reports and two quarterly reports examined were submitted after the required time and one report was inaccurate. Questioned Costs: None Context: The annual reports and two quarterly reports were not submitted timely, and one report was not accurate. Recommendation: The College should ensure that all grant reports are prepared in a timely manner and are accurate. Management’s Response: The College will submit annual performance reports in a timely manner.

2024-006 —Reporting – Significant Deficiency in Internal Control Over Compliance and Noncompliance (Repeat of Finding 2023-007, 2022-005, 2021-002, and 2020-004) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; and Education Stabilization Fund ALN Number: 15.027, 84.031, 84.425 Award years: Various Criteria: According to 2 CFR Section 200.328, nonfederal entities may be required to submit performance reports at least annually as required by the terms of the federal award. In addition, ALN 84.425 requires quarterly expenditure and budget reports. Condition: The College did not submit annual performance reports on time for three programs. The annual report for ALN 84.031 was inaccurate. In addition, two quarterly financial reports required for ALN 84.425 were not submitted timely. Cause: The College did not have sufficient procedures in place to ensure that the reports were completed timely and accurately. Effect: The three annual reports and two quarterly reports examined were submitted after the required time and one report was inaccurate. Questioned Costs: None Context: The annual reports and two quarterly reports were not submitted timely, and one report was not accurate. Recommendation: The College should ensure that all grant reports are prepared in a timely manner and are accurate. Management’s Response: The College will submit annual performance reports in a timely manner.

2024-006 —Reporting – Significant Deficiency in Internal Control Over Compliance and Noncompliance (Repeat of Finding 2023-007, 2022-005, 2021-002, and 2020-004) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; and Education Stabilization Fund ALN Number: 15.027, 84.031, 84.425 Award years: Various Criteria: According to 2 CFR Section 200.328, nonfederal entities may be required to submit performance reports at least annually as required by the terms of the federal award. In addition, ALN 84.425 requires quarterly expenditure and budget reports. Condition: The College did not submit annual performance reports on time for three programs. The annual report for ALN 84.031 was inaccurate. In addition, two quarterly financial reports required for ALN 84.425 were not submitted timely. Cause: The College did not have sufficient procedures in place to ensure that the reports were completed timely and accurately. Effect: The three annual reports and two quarterly reports examined were submitted after the required time and one report was inaccurate. Questioned Costs: None Context: The annual reports and two quarterly reports were not submitted timely, and one report was not accurate. Recommendation: The College should ensure that all grant reports are prepared in a timely manner and are accurate. Management’s Response: The College will submit annual performance reports in a timely manner.

2024-006 —Reporting – Significant Deficiency in Internal Control Over Compliance and Noncompliance (Repeat of Finding 2023-007, 2022-005, 2021-002, and 2020-004) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; and Education Stabilization Fund ALN Number: 15.027, 84.031, 84.425 Award years: Various Criteria: According to 2 CFR Section 200.328, nonfederal entities may be required to submit performance reports at least annually as required by the terms of the federal award. In addition, ALN 84.425 requires quarterly expenditure and budget reports. Condition: The College did not submit annual performance reports on time for three programs. The annual report for ALN 84.031 was inaccurate. In addition, two quarterly financial reports required for ALN 84.425 were not submitted timely. Cause: The College did not have sufficient procedures in place to ensure that the reports were completed timely and accurately. Effect: The three annual reports and two quarterly reports examined were submitted after the required time and one report was inaccurate. Questioned Costs: None Context: The annual reports and two quarterly reports were not submitted timely, and one report was not accurate. Recommendation: The College should ensure that all grant reports are prepared in a timely manner and are accurate. Management’s Response: The College will submit annual performance reports in a timely manner.

2024-007 —Financial Reporting– Significant Deficiency in Internal Control Over Compliance and Noncompliance Federal program information: Funding agencies: U.S. Department of Education Titles: SFA Cluster-Federal Pell Grant Program ALN Number: 84.063 Award years: 2024 Criteria: According to 2 CFR Section 200.328, nonfederal entities may be required to submit financial reports at least annually as required by the terms of the federal award. In addition, the grant requires origination and disbursement records be submitted to the Common Origination and Disbursement (COD) system. Condition: The College did not submit disbursement records for students as required. Cause: The College was affected by a ransomware attack that restricted access from their system in order to submit the disbursement records to the COD system. Effect: The College is not in compliance with reporting requirements. Questioned Costs: None Context: Disbursement records were not reported for fall 2023 to the COD system. Recommendation: Work with Department of Education to report the disbursement records for the time period not reported to the COD system. Management’s Response: The College will submit disbursement records to the COD system as required.

2024-008 — Disbursements to or on Behalf of Students (Special Test #3) – Material Weakness in Internal Control Over Compliance and Noncompliance Federal program information: Funding agencies: U.S. Department of Education Titles: SFA Cluster-Federal PELL Grant Program ALN Number: 84.063 Award years: Various Criteria: According to 34 CFR Section 668.165(a)(1), prior to make a disbursement, the school must notify students of the amount and type of Title IV funds (PELL grants) they are expected to receive, and how and when those disbursements will be made. Condition: The College did not have documentation of notification of disbursements. Cause: The College was affected by a ransomware attack that restricted access from their system in order to notify the students individually, as such the College notified the students verbally at a campus meeting. Effect: The College is not in compliance with Special Test Requirements of notification of disbursements. Questioned Costs: None Context: Disbursement notification documentation was not maintained for fall 2023. Recommendation: The College should comply with grant requirements and maintain documentation of compliance. Management’s Response: The College will document notifications of disbursement as required.

2024-009 — Return of Title IV Funds (Special Test #5)– Material Weakness in Internal Control Over Compliance and Noncompliance Federal program information: Funding agencies: U.S. Department of Education Titles: SFA Cluster-Federal PELL Grant Program ALN Number: 84.063 Award years: Various Criteria: According to 34 CFR Section 668.22(a)(1) through (a)(5), when a recipient of Title IV grant (PELL grants) withdraws from an institution during a payment period or period of enrollment in with the recipient began attendance, the institution must determine the amount of aid earned by the student as of the student’s withdrawal date. If the total amount of assistance earned by the student is less than the amount disbursed to the student, the difference must be returned to the Title IV program as outlined in the requirements. Condition: The College uses credit hours for measurement of the program as such, the amount of aid earned by the student is required to be determined by dividing the total number of calendar days in the enrollment period into the number of days completed in that period as of the student’s withdrawal date. The College was determining the amount of funds earned by the amount of credit hours the student was still enrolled in. Additionally, the timing of the withdrawals was incorrect in the calculations. Cause: The College was unaware of the percentage earned calculation and forms were not being submitted timely to the financial aid office to indicate student attendance. Effect: Return of funds were incorrectly calculated resulting in over and underpayments to students. Questioned Costs: $40,368 Context: The College did not properly calculate and return Title IV funds for students who withdrew. Recommendation: The College should comply with grant requirements for calculation of determining funds earned and those that need to be returned. Management’s Response: The College will return unearned Pell grant funds and properly determine unearned scholarship awards.

2024-010 — Enrollment Reporting (Special Test #6)– Material Weakness in Internal Control Over Compliance and Noncompliance Federal program information: Funding agencies: U.S. Department of Education Titles: SFA Cluster-Federal PELL Grant Program ALN Number: 84.063 Award years: Various Criteria: According to 34 CFR Section 690.83(b)(2), institutions are required to report enrollment information under the Pell grant via the NSLDS. Condition: The College failed to report enrollment data during the audit period. Cause: Due to staffing issues the College did not complete the submission. Effect: The enrollment information that appears on the NSLDS Professional Access website which the administration of the Title IV program depends on heavily to be accurate and up to date is missing information from the College. Questioned Costs: None Context: The College did not accurately report enrollment information for the PELL grant. Recommendation: The College should comply with grant requirements and submit Enrollment Reporting. Management’s Response: The College will accurately report enrollment information.

2024-011 — Gramm-Leach-Bliley Act- Student Information Security (Special Test #11)– Material Weakness in Internal Control Over Compliance and Noncompliance Federal program information: Funding agencies: U.S. Department of Education Titles: SFA Cluster-Federal PELL Grant Program ALN Number: 84.063 Award years: Various Criteria: According to 16 CFR 314. The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information sharing practices to their customers and to safeguard sensitive data. The Federal Trade Commission considers Title IV-eligible institutions that participate in the Title IV Education Assistance programs as “financial institutions” and subject to the GLBA. Institutions must protect student financial aid information, with particular attention to information. Condition: Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts and includes specific elements. The College did not have a comprehensive information security program in place, written or otherwise, that met the specific elements. Cause: The College’s IT control environment is lacking certain key controls. There are currently no formalized IT policies and procedures, sufficient data backup processes, or a formalized disaster recovery plan. IT controls are not in place to ensure non-authorized individuals are restricted from adding new vendors, recording journal entries, and making/or changes to employee pay records. Effect: The College is not in compliance with the requirements of the program and student data may be compromised without policies in place to ensure otherwise. Questioned Costs: None Context: The College is not in compliance with the GLBA requirements. Recommendation: The College should comply with grant requirements and develop, implement, and maintain a comprehensive security program that includes the specific elements required. Management’s Response: The College is in process of developing policies for the GLBA

2024-012 — Maintenance of Payroll Records- Significant Deficiency in Internal Control Over Compliance Federal program information: Funding agencies: U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid ALN Number: 15.027 and 84.031 Award years: Various Criteria: The College is required to process payroll in accordance with its financial policies and procedures, grant requirements and federal regulations and guidelines. Payroll disbursements require authorized supporting documentation such as cancelled checks, time and attendance records, authorized personnel action forms, etc. Condition: Payroll records, such as personnel action forms, were either missing or did not agree with the amount of wages paid through the payroll system. Cause: Policies and Procedures regarding the review and maintenance of the College’s payroll records and supporting documentation are not being consistently maintained. Effect: The College may not be able to demonstrate that the costs charged to federal programs are allowable. Questioned Costs: Undeterminable. Context: Of the 25 payroll transactions tested, 9 personnel action forms could not be located. Auditor’s Recommendations: Enforce policies and procedures to ensure adequate supporting documentation is maintained for all payroll transactions. Management’s Response: The College will enforce its payroll documentation policies.

2024-012 — Maintenance of Payroll Records- Significant Deficiency in Internal Control Over Compliance Federal program information: Funding agencies: U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid ALN Number: 15.027 and 84.031 Award years: Various Criteria: The College is required to process payroll in accordance with its financial policies and procedures, grant requirements and federal regulations and guidelines. Payroll disbursements require authorized supporting documentation such as cancelled checks, time and attendance records, authorized personnel action forms, etc. Condition: Payroll records, such as personnel action forms, were either missing or did not agree with the amount of wages paid through the payroll system. Cause: Policies and Procedures regarding the review and maintenance of the College’s payroll records and supporting documentation are not being consistently maintained. Effect: The College may not be able to demonstrate that the costs charged to federal programs are allowable. Questioned Costs: Undeterminable. Context: Of the 25 payroll transactions tested, 9 personnel action forms could not be located. Auditor’s Recommendations: Enforce policies and procedures to ensure adequate supporting documentation is maintained for all payroll transactions. Management’s Response: The College will enforce its payroll documentation policies.

2024-012 — Maintenance of Payroll Records- Significant Deficiency in Internal Control Over Compliance Federal program information: Funding agencies: U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid ALN Number: 15.027 and 84.031 Award years: Various Criteria: The College is required to process payroll in accordance with its financial policies and procedures, grant requirements and federal regulations and guidelines. Payroll disbursements require authorized supporting documentation such as cancelled checks, time and attendance records, authorized personnel action forms, etc. Condition: Payroll records, such as personnel action forms, were either missing or did not agree with the amount of wages paid through the payroll system. Cause: Policies and Procedures regarding the review and maintenance of the College’s payroll records and supporting documentation are not being consistently maintained. Effect: The College may not be able to demonstrate that the costs charged to federal programs are allowable. Questioned Costs: Undeterminable. Context: Of the 25 payroll transactions tested, 9 personnel action forms could not be located. Auditor’s Recommendations: Enforce policies and procedures to ensure adequate supporting documentation is maintained for all payroll transactions. Management’s Response: The College will enforce its payroll documentation policies.

2024-012 — Maintenance of Payroll Records- Significant Deficiency in Internal Control Over Compliance Federal program information: Funding agencies: U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid ALN Number: 15.027 and 84.031 Award years: Various Criteria: The College is required to process payroll in accordance with its financial policies and procedures, grant requirements and federal regulations and guidelines. Payroll disbursements require authorized supporting documentation such as cancelled checks, time and attendance records, authorized personnel action forms, etc. Condition: Payroll records, such as personnel action forms, were either missing or did not agree with the amount of wages paid through the payroll system. Cause: Policies and Procedures regarding the review and maintenance of the College’s payroll records and supporting documentation are not being consistently maintained. Effect: The College may not be able to demonstrate that the costs charged to federal programs are allowable. Questioned Costs: Undeterminable. Context: Of the 25 payroll transactions tested, 9 personnel action forms could not be located. Auditor’s Recommendations: Enforce policies and procedures to ensure adequate supporting documentation is maintained for all payroll transactions. Management’s Response: The College will enforce its payroll documentation policies.

2024-002 — IT – Material Weakness in Internal Control Over Compliance and Noncompliance (Repeat of finding 2023-003) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; Education Stabilization Fund; and SFA Cluster- Pell Grant Program ALN Number: 15.027, 84.031, 84.425, and 84.063 Award years: Various Criteria: Without strong information technology internal controls and established policies and procedures, there is the potential for integrity of financial records, the confidentiality, integrity and/or availability of data to be compromised. This compromise could be by an internal user of the system, by an external source (hacker) and could be intentional or unintentional. Condition: The College’s IT control environment is lacking certain key controls. There are currently no formalized IT policies and procedures, sufficient data backup processes, or a formalized disaster recovery plan. IT controls are not in place to ensure non-authorized individuals are restricted from adding new vendors, recording journal entries, and making/or changes to employee pay records. Questioned Costs: N/A Cause: The IT controls have not been properly designed and implemented. Effect: The College is exposed to many risks regarding the integrity of the financial records, confidentiality, integrity, and/or availability of its data. It is possible that their data could be compromised. Compromise could be by an internal user of the system, by an external source (hacker) and could be intentional or unintentional. Additionally, during fiscal year 2024, the College experienced an outage which resulted in a loss of data. As no backup procedures were in place, amounts had to be restored in the system using other financial source data. Auditor’s Recommendations: Establishing IT controls, policies and procedures, off-site electronic data backups, and a disaster recovery plan would better prepare the College for technology related issues, system crashes, or data breaches. Management’s Response: The College is implementing policies and procedures.

2024-002 — IT – Material Weakness in Internal Control Over Compliance and Noncompliance (Repeat of finding 2023-003) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; Education Stabilization Fund; and SFA Cluster- Pell Grant Program ALN Number: 15.027, 84.031, 84.425, and 84.063 Award years: Various Criteria: Without strong information technology internal controls and established policies and procedures, there is the potential for integrity of financial records, the confidentiality, integrity and/or availability of data to be compromised. This compromise could be by an internal user of the system, by an external source (hacker) and could be intentional or unintentional. Condition: The College’s IT control environment is lacking certain key controls. There are currently no formalized IT policies and procedures, sufficient data backup processes, or a formalized disaster recovery plan. IT controls are not in place to ensure non-authorized individuals are restricted from adding new vendors, recording journal entries, and making/or changes to employee pay records. Questioned Costs: N/A Cause: The IT controls have not been properly designed and implemented. Effect: The College is exposed to many risks regarding the integrity of the financial records, confidentiality, integrity, and/or availability of its data. It is possible that their data could be compromised. Compromise could be by an internal user of the system, by an external source (hacker) and could be intentional or unintentional. Additionally, during fiscal year 2024, the College experienced an outage which resulted in a loss of data. As no backup procedures were in place, amounts had to be restored in the system using other financial source data. Auditor’s Recommendations: Establishing IT controls, policies and procedures, off-site electronic data backups, and a disaster recovery plan would better prepare the College for technology related issues, system crashes, or data breaches. Management’s Response: The College is implementing policies and procedures.

2024-002 — IT – Material Weakness in Internal Control Over Compliance and Noncompliance (Repeat of finding 2023-003) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; Education Stabilization Fund; and SFA Cluster- Pell Grant Program ALN Number: 15.027, 84.031, 84.425, and 84.063 Award years: Various Criteria: Without strong information technology internal controls and established policies and procedures, there is the potential for integrity of financial records, the confidentiality, integrity and/or availability of data to be compromised. This compromise could be by an internal user of the system, by an external source (hacker) and could be intentional or unintentional. Condition: The College’s IT control environment is lacking certain key controls. There are currently no formalized IT policies and procedures, sufficient data backup processes, or a formalized disaster recovery plan. IT controls are not in place to ensure non-authorized individuals are restricted from adding new vendors, recording journal entries, and making/or changes to employee pay records. Questioned Costs: N/A Cause: The IT controls have not been properly designed and implemented. Effect: The College is exposed to many risks regarding the integrity of the financial records, confidentiality, integrity, and/or availability of its data. It is possible that their data could be compromised. Compromise could be by an internal user of the system, by an external source (hacker) and could be intentional or unintentional. Additionally, during fiscal year 2024, the College experienced an outage which resulted in a loss of data. As no backup procedures were in place, amounts had to be restored in the system using other financial source data. Auditor’s Recommendations: Establishing IT controls, policies and procedures, off-site electronic data backups, and a disaster recovery plan would better prepare the College for technology related issues, system crashes, or data breaches. Management’s Response: The College is implementing policies and procedures.

2024-002 — IT – Material Weakness in Internal Control Over Compliance and Noncompliance (Repeat of finding 2023-003) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; Education Stabilization Fund; and SFA Cluster- Pell Grant Program ALN Number: 15.027, 84.031, 84.425, and 84.063 Award years: Various Criteria: Without strong information technology internal controls and established policies and procedures, there is the potential for integrity of financial records, the confidentiality, integrity and/or availability of data to be compromised. This compromise could be by an internal user of the system, by an external source (hacker) and could be intentional or unintentional. Condition: The College’s IT control environment is lacking certain key controls. There are currently no formalized IT policies and procedures, sufficient data backup processes, or a formalized disaster recovery plan. IT controls are not in place to ensure non-authorized individuals are restricted from adding new vendors, recording journal entries, and making/or changes to employee pay records. Questioned Costs: N/A Cause: The IT controls have not been properly designed and implemented. Effect: The College is exposed to many risks regarding the integrity of the financial records, confidentiality, integrity, and/or availability of its data. It is possible that their data could be compromised. Compromise could be by an internal user of the system, by an external source (hacker) and could be intentional or unintentional. Additionally, during fiscal year 2024, the College experienced an outage which resulted in a loss of data. As no backup procedures were in place, amounts had to be restored in the system using other financial source data. Auditor’s Recommendations: Establishing IT controls, policies and procedures, off-site electronic data backups, and a disaster recovery plan would better prepare the College for technology related issues, system crashes, or data breaches. Management’s Response: The College is implementing policies and procedures.

2024-002 — IT – Material Weakness in Internal Control Over Compliance and Noncompliance (Repeat of finding 2023-003) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; Education Stabilization Fund; and SFA Cluster- Pell Grant Program ALN Number: 15.027, 84.031, 84.425, and 84.063 Award years: Various Criteria: Without strong information technology internal controls and established policies and procedures, there is the potential for integrity of financial records, the confidentiality, integrity and/or availability of data to be compromised. This compromise could be by an internal user of the system, by an external source (hacker) and could be intentional or unintentional. Condition: The College’s IT control environment is lacking certain key controls. There are currently no formalized IT policies and procedures, sufficient data backup processes, or a formalized disaster recovery plan. IT controls are not in place to ensure non-authorized individuals are restricted from adding new vendors, recording journal entries, and making/or changes to employee pay records. Questioned Costs: N/A Cause: The IT controls have not been properly designed and implemented. Effect: The College is exposed to many risks regarding the integrity of the financial records, confidentiality, integrity, and/or availability of its data. It is possible that their data could be compromised. Compromise could be by an internal user of the system, by an external source (hacker) and could be intentional or unintentional. Additionally, during fiscal year 2024, the College experienced an outage which resulted in a loss of data. As no backup procedures were in place, amounts had to be restored in the system using other financial source data. Auditor’s Recommendations: Establishing IT controls, policies and procedures, off-site electronic data backups, and a disaster recovery plan would better prepare the College for technology related issues, system crashes, or data breaches. Management’s Response: The College is implementing policies and procedures.

2024-002 — IT – Material Weakness in Internal Control Over Compliance and Noncompliance (Repeat of finding 2023-003) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; Education Stabilization Fund; and SFA Cluster- Pell Grant Program ALN Number: 15.027, 84.031, 84.425, and 84.063 Award years: Various Criteria: Without strong information technology internal controls and established policies and procedures, there is the potential for integrity of financial records, the confidentiality, integrity and/or availability of data to be compromised. This compromise could be by an internal user of the system, by an external source (hacker) and could be intentional or unintentional. Condition: The College’s IT control environment is lacking certain key controls. There are currently no formalized IT policies and procedures, sufficient data backup processes, or a formalized disaster recovery plan. IT controls are not in place to ensure non-authorized individuals are restricted from adding new vendors, recording journal entries, and making/or changes to employee pay records. Questioned Costs: N/A Cause: The IT controls have not been properly designed and implemented. Effect: The College is exposed to many risks regarding the integrity of the financial records, confidentiality, integrity, and/or availability of its data. It is possible that their data could be compromised. Compromise could be by an internal user of the system, by an external source (hacker) and could be intentional or unintentional. Additionally, during fiscal year 2024, the College experienced an outage which resulted in a loss of data. As no backup procedures were in place, amounts had to be restored in the system using other financial source data. Auditor’s Recommendations: Establishing IT controls, policies and procedures, off-site electronic data backups, and a disaster recovery plan would better prepare the College for technology related issues, system crashes, or data breaches. Management’s Response: The College is implementing policies and procedures.

2024-003 — Single Audit Report Submission – Material Weakness in Internal Control Over Compliance and Noncompliance (Repeat of finding 2023-005, 2022-003, and 2021-001) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; Education Stabilization Fund; and SFA Cluster- Pell Grant Program ALN Number: 15.027, 84.031, 84.425, and 84.063 Award years: Various Criteria: The Uniform Guidance 2 CFR 200.512 (a) requires the audit package and data collection from be submitted 30 days after receipt of the auditor’s report or 9 months after the end of the fiscal year, whichever comes first. Condition: The College’s fiscal year 2024 single audit reporting package was not submitted within nine months after the end of the audit period. Questioned Costs: N/A Cause: The College did not have appropriate internal control policies and procedures in place to ensure accounting records and financial statements were reconciled timely and the audit conducted to meet compliance requirements. Effect: The single audit reporting package was submitted after the required reporting time period. Auditor’s Recommendations: To ensure compliance with the Uniform Guidance, the College should prepare accurate, complete, and timely financial statements and ensure an audit is performed to ensure the timely submission of the single audit reporting package. Management’s Response: The College had plan to remain current with submitting its annual report.

2024-003 — Single Audit Report Submission – Material Weakness in Internal Control Over Compliance and Noncompliance (Repeat of finding 2023-005, 2022-003, and 2021-001) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; Education Stabilization Fund; and SFA Cluster- Pell Grant Program ALN Number: 15.027, 84.031, 84.425, and 84.063 Award years: Various Criteria: The Uniform Guidance 2 CFR 200.512 (a) requires the audit package and data collection from be submitted 30 days after receipt of the auditor’s report or 9 months after the end of the fiscal year, whichever comes first. Condition: The College’s fiscal year 2024 single audit reporting package was not submitted within nine months after the end of the audit period. Questioned Costs: N/A Cause: The College did not have appropriate internal control policies and procedures in place to ensure accounting records and financial statements were reconciled timely and the audit conducted to meet compliance requirements. Effect: The single audit reporting package was submitted after the required reporting time period. Auditor’s Recommendations: To ensure compliance with the Uniform Guidance, the College should prepare accurate, complete, and timely financial statements and ensure an audit is performed to ensure the timely submission of the single audit reporting package. Management’s Response: The College had plan to remain current with submitting its annual report.

2024-003 — Single Audit Report Submission – Material Weakness in Internal Control Over Compliance and Noncompliance (Repeat of finding 2023-005, 2022-003, and 2021-001) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; Education Stabilization Fund; and SFA Cluster- Pell Grant Program ALN Number: 15.027, 84.031, 84.425, and 84.063 Award years: Various Criteria: The Uniform Guidance 2 CFR 200.512 (a) requires the audit package and data collection from be submitted 30 days after receipt of the auditor’s report or 9 months after the end of the fiscal year, whichever comes first. Condition: The College’s fiscal year 2024 single audit reporting package was not submitted within nine months after the end of the audit period. Questioned Costs: N/A Cause: The College did not have appropriate internal control policies and procedures in place to ensure accounting records and financial statements were reconciled timely and the audit conducted to meet compliance requirements. Effect: The single audit reporting package was submitted after the required reporting time period. Auditor’s Recommendations: To ensure compliance with the Uniform Guidance, the College should prepare accurate, complete, and timely financial statements and ensure an audit is performed to ensure the timely submission of the single audit reporting package. Management’s Response: The College had plan to remain current with submitting its annual report.

2024-003 — Single Audit Report Submission – Material Weakness in Internal Control Over Compliance and Noncompliance (Repeat of finding 2023-005, 2022-003, and 2021-001) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; Education Stabilization Fund; and SFA Cluster- Pell Grant Program ALN Number: 15.027, 84.031, 84.425, and 84.063 Award years: Various Criteria: The Uniform Guidance 2 CFR 200.512 (a) requires the audit package and data collection from be submitted 30 days after receipt of the auditor’s report or 9 months after the end of the fiscal year, whichever comes first. Condition: The College’s fiscal year 2024 single audit reporting package was not submitted within nine months after the end of the audit period. Questioned Costs: N/A Cause: The College did not have appropriate internal control policies and procedures in place to ensure accounting records and financial statements were reconciled timely and the audit conducted to meet compliance requirements. Effect: The single audit reporting package was submitted after the required reporting time period. Auditor’s Recommendations: To ensure compliance with the Uniform Guidance, the College should prepare accurate, complete, and timely financial statements and ensure an audit is performed to ensure the timely submission of the single audit reporting package. Management’s Response: The College had plan to remain current with submitting its annual report.

2024-003 — Single Audit Report Submission – Material Weakness in Internal Control Over Compliance and Noncompliance (Repeat of finding 2023-005, 2022-003, and 2021-001) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; Education Stabilization Fund; and SFA Cluster- Pell Grant Program ALN Number: 15.027, 84.031, 84.425, and 84.063 Award years: Various Criteria: The Uniform Guidance 2 CFR 200.512 (a) requires the audit package and data collection from be submitted 30 days after receipt of the auditor’s report or 9 months after the end of the fiscal year, whichever comes first. Condition: The College’s fiscal year 2024 single audit reporting package was not submitted within nine months after the end of the audit period. Questioned Costs: N/A Cause: The College did not have appropriate internal control policies and procedures in place to ensure accounting records and financial statements were reconciled timely and the audit conducted to meet compliance requirements. Effect: The single audit reporting package was submitted after the required reporting time period. Auditor’s Recommendations: To ensure compliance with the Uniform Guidance, the College should prepare accurate, complete, and timely financial statements and ensure an audit is performed to ensure the timely submission of the single audit reporting package. Management’s Response: The College had plan to remain current with submitting its annual report.

2024-003 — Single Audit Report Submission – Material Weakness in Internal Control Over Compliance and Noncompliance (Repeat of finding 2023-005, 2022-003, and 2021-001) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; Education Stabilization Fund; and SFA Cluster- Pell Grant Program ALN Number: 15.027, 84.031, 84.425, and 84.063 Award years: Various Criteria: The Uniform Guidance 2 CFR 200.512 (a) requires the audit package and data collection from be submitted 30 days after receipt of the auditor’s report or 9 months after the end of the fiscal year, whichever comes first. Condition: The College’s fiscal year 2024 single audit reporting package was not submitted within nine months after the end of the audit period. Questioned Costs: N/A Cause: The College did not have appropriate internal control policies and procedures in place to ensure accounting records and financial statements were reconciled timely and the audit conducted to meet compliance requirements. Effect: The single audit reporting package was submitted after the required reporting time period. Auditor’s Recommendations: To ensure compliance with the Uniform Guidance, the College should prepare accurate, complete, and timely financial statements and ensure an audit is performed to ensure the timely submission of the single audit reporting package. Management’s Response: The College had plan to remain current with submitting its annual report.

2024-004 — Equipment and Real Property Management – Significant Deficiency in Internal Control Over Compliance and Noncompliance Federal program information: Funding agencies: U.S. Department of Education Titles: Higher Education Institutional Aid ALN Number: 84.031 Award years: Various Criteria: 2 CFR 200.313(c) through (e), requires that equipment be used in federal programs for which it was acquired for, when appropriate, other federal programs. Equipment records shall be maintained including required elements, a physical inventory of equipment be taken at least once every 2 years and reconciled to the equipment records, an appropriate control system shall be used to safeguard equipment, and equipment shall be adequately maintained. Condition: The College has not completed a physical inventory within the previous two fiscal years as required. In addition, the records were not detailed enough that program management is able to adequately and efficiently identify and locate any and all items. Questioned Costs: None Cause: The College is not enforcing their procedures to verify that the capital assets inventory has been taken annually and reconciled to the general ledger. Effect: Without a physical inventory, there is an increase in the probability that the capital asset listing will be incorrect, or assets listed may not exist. Auditor’s Recommendations: Enforce internal control procedures and complete an inventory of the school’s capital assets annually. Management’s Response: The College will take an inventory of its capital assets as required by policies.

2024-004 — Equipment and Real Property Management – Significant Deficiency in Internal Control Over Compliance and Noncompliance Federal program information: Funding agencies: U.S. Department of Education Titles: Higher Education Institutional Aid ALN Number: 84.031 Award years: Various Criteria: 2 CFR 200.313(c) through (e), requires that equipment be used in federal programs for which it was acquired for, when appropriate, other federal programs. Equipment records shall be maintained including required elements, a physical inventory of equipment be taken at least once every 2 years and reconciled to the equipment records, an appropriate control system shall be used to safeguard equipment, and equipment shall be adequately maintained. Condition: The College has not completed a physical inventory within the previous two fiscal years as required. In addition, the records were not detailed enough that program management is able to adequately and efficiently identify and locate any and all items. Questioned Costs: None Cause: The College is not enforcing their procedures to verify that the capital assets inventory has been taken annually and reconciled to the general ledger. Effect: Without a physical inventory, there is an increase in the probability that the capital asset listing will be incorrect, or assets listed may not exist. Auditor’s Recommendations: Enforce internal control procedures and complete an inventory of the school’s capital assets annually. Management’s Response: The College will take an inventory of its capital assets as required by policies.

2024-005 — Procurement – Material Weakness in Internal Control Over Compliance and Noncompliance (Repeat of Finding 2023-006 and 2022-004) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; and Education Stabilization Fund ALN Number: 15.027, 84.031, and 84.425 Award years: Various Criteria: According to 2 CFR Section 200.318i, the recipient or subrecipient must maintain records sufficient to detail the history of each procurement transaction. These records must include the rationale for the procurement method, contract type selection, contractor selection or rejection, and the basis for the contract price. According to 2 CFR Section 0200.319a, all procurement transactions under the federal award must be conducted in a manner that provides full and open competition. Condition: The College did not maintain records sufficient to detail the history of each procurement transaction for the nine procurements contracts tested. Cause: The College did not have sufficient procedures in place to ensure that procurement records are maintained. Effect: The College is not in compliance with procurement requirements. Questioned Costs: None Context: Procurement documents were not retained for nine out of nine transactions tested. Recommendation: Formally document and enforce policies and procedures that will promote adequate monitoring of the procurement and bidding process. Ensure that any contract over the College’s threshold ($150,000) follow the sealed bid requirements listed in 2 CFR Section 200.320b1. Management’s Response: The College will follow its policies as required.

2024-005 — Procurement – Material Weakness in Internal Control Over Compliance and Noncompliance (Repeat of Finding 2023-006 and 2022-004) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; and Education Stabilization Fund ALN Number: 15.027, 84.031, and 84.425 Award years: Various Criteria: According to 2 CFR Section 200.318i, the recipient or subrecipient must maintain records sufficient to detail the history of each procurement transaction. These records must include the rationale for the procurement method, contract type selection, contractor selection or rejection, and the basis for the contract price. According to 2 CFR Section 0200.319a, all procurement transactions under the federal award must be conducted in a manner that provides full and open competition. Condition: The College did not maintain records sufficient to detail the history of each procurement transaction for the nine procurements contracts tested. Cause: The College did not have sufficient procedures in place to ensure that procurement records are maintained. Effect: The College is not in compliance with procurement requirements. Questioned Costs: None Context: Procurement documents were not retained for nine out of nine transactions tested. Recommendation: Formally document and enforce policies and procedures that will promote adequate monitoring of the procurement and bidding process. Ensure that any contract over the College’s threshold ($150,000) follow the sealed bid requirements listed in 2 CFR Section 200.320b1. Management’s Response: The College will follow its policies as required.

2024-005 — Procurement – Material Weakness in Internal Control Over Compliance and Noncompliance (Repeat of Finding 2023-006 and 2022-004) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; and Education Stabilization Fund ALN Number: 15.027, 84.031, and 84.425 Award years: Various Criteria: According to 2 CFR Section 200.318i, the recipient or subrecipient must maintain records sufficient to detail the history of each procurement transaction. These records must include the rationale for the procurement method, contract type selection, contractor selection or rejection, and the basis for the contract price. According to 2 CFR Section 0200.319a, all procurement transactions under the federal award must be conducted in a manner that provides full and open competition. Condition: The College did not maintain records sufficient to detail the history of each procurement transaction for the nine procurements contracts tested. Cause: The College did not have sufficient procedures in place to ensure that procurement records are maintained. Effect: The College is not in compliance with procurement requirements. Questioned Costs: None Context: Procurement documents were not retained for nine out of nine transactions tested. Recommendation: Formally document and enforce policies and procedures that will promote adequate monitoring of the procurement and bidding process. Ensure that any contract over the College’s threshold ($150,000) follow the sealed bid requirements listed in 2 CFR Section 200.320b1. Management’s Response: The College will follow its policies as required.

2024-005 — Procurement – Material Weakness in Internal Control Over Compliance and Noncompliance (Repeat of Finding 2023-006 and 2022-004) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; and Education Stabilization Fund ALN Number: 15.027, 84.031, and 84.425 Award years: Various Criteria: According to 2 CFR Section 200.318i, the recipient or subrecipient must maintain records sufficient to detail the history of each procurement transaction. These records must include the rationale for the procurement method, contract type selection, contractor selection or rejection, and the basis for the contract price. According to 2 CFR Section 0200.319a, all procurement transactions under the federal award must be conducted in a manner that provides full and open competition. Condition: The College did not maintain records sufficient to detail the history of each procurement transaction for the nine procurements contracts tested. Cause: The College did not have sufficient procedures in place to ensure that procurement records are maintained. Effect: The College is not in compliance with procurement requirements. Questioned Costs: None Context: Procurement documents were not retained for nine out of nine transactions tested. Recommendation: Formally document and enforce policies and procedures that will promote adequate monitoring of the procurement and bidding process. Ensure that any contract over the College’s threshold ($150,000) follow the sealed bid requirements listed in 2 CFR Section 200.320b1. Management’s Response: The College will follow its policies as required.

2024-005 — Procurement – Material Weakness in Internal Control Over Compliance and Noncompliance (Repeat of Finding 2023-006 and 2022-004) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; and Education Stabilization Fund ALN Number: 15.027, 84.031, and 84.425 Award years: Various Criteria: According to 2 CFR Section 200.318i, the recipient or subrecipient must maintain records sufficient to detail the history of each procurement transaction. These records must include the rationale for the procurement method, contract type selection, contractor selection or rejection, and the basis for the contract price. According to 2 CFR Section 0200.319a, all procurement transactions under the federal award must be conducted in a manner that provides full and open competition. Condition: The College did not maintain records sufficient to detail the history of each procurement transaction for the nine procurements contracts tested. Cause: The College did not have sufficient procedures in place to ensure that procurement records are maintained. Effect: The College is not in compliance with procurement requirements. Questioned Costs: None Context: Procurement documents were not retained for nine out of nine transactions tested. Recommendation: Formally document and enforce policies and procedures that will promote adequate monitoring of the procurement and bidding process. Ensure that any contract over the College’s threshold ($150,000) follow the sealed bid requirements listed in 2 CFR Section 200.320b1. Management’s Response: The College will follow its policies as required.

2024-006 —Reporting – Significant Deficiency in Internal Control Over Compliance and Noncompliance (Repeat of Finding 2023-007, 2022-005, 2021-002, and 2020-004) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; and Education Stabilization Fund ALN Number: 15.027, 84.031, 84.425 Award years: Various Criteria: According to 2 CFR Section 200.328, nonfederal entities may be required to submit performance reports at least annually as required by the terms of the federal award. In addition, ALN 84.425 requires quarterly expenditure and budget reports. Condition: The College did not submit annual performance reports on time for three programs. The annual report for ALN 84.031 was inaccurate. In addition, two quarterly financial reports required for ALN 84.425 were not submitted timely. Cause: The College did not have sufficient procedures in place to ensure that the reports were completed timely and accurately. Effect: The three annual reports and two quarterly reports examined were submitted after the required time and one report was inaccurate. Questioned Costs: None Context: The annual reports and two quarterly reports were not submitted timely, and one report was not accurate. Recommendation: The College should ensure that all grant reports are prepared in a timely manner and are accurate. Management’s Response: The College will submit annual performance reports in a timely manner.

2024-006 —Reporting – Significant Deficiency in Internal Control Over Compliance and Noncompliance (Repeat of Finding 2023-007, 2022-005, 2021-002, and 2020-004) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; and Education Stabilization Fund ALN Number: 15.027, 84.031, 84.425 Award years: Various Criteria: According to 2 CFR Section 200.328, nonfederal entities may be required to submit performance reports at least annually as required by the terms of the federal award. In addition, ALN 84.425 requires quarterly expenditure and budget reports. Condition: The College did not submit annual performance reports on time for three programs. The annual report for ALN 84.031 was inaccurate. In addition, two quarterly financial reports required for ALN 84.425 were not submitted timely. Cause: The College did not have sufficient procedures in place to ensure that the reports were completed timely and accurately. Effect: The three annual reports and two quarterly reports examined were submitted after the required time and one report was inaccurate. Questioned Costs: None Context: The annual reports and two quarterly reports were not submitted timely, and one report was not accurate. Recommendation: The College should ensure that all grant reports are prepared in a timely manner and are accurate. Management’s Response: The College will submit annual performance reports in a timely manner.

2024-006 —Reporting – Significant Deficiency in Internal Control Over Compliance and Noncompliance (Repeat of Finding 2023-007, 2022-005, 2021-002, and 2020-004) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; and Education Stabilization Fund ALN Number: 15.027, 84.031, 84.425 Award years: Various Criteria: According to 2 CFR Section 200.328, nonfederal entities may be required to submit performance reports at least annually as required by the terms of the federal award. In addition, ALN 84.425 requires quarterly expenditure and budget reports. Condition: The College did not submit annual performance reports on time for three programs. The annual report for ALN 84.031 was inaccurate. In addition, two quarterly financial reports required for ALN 84.425 were not submitted timely. Cause: The College did not have sufficient procedures in place to ensure that the reports were completed timely and accurately. Effect: The three annual reports and two quarterly reports examined were submitted after the required time and one report was inaccurate. Questioned Costs: None Context: The annual reports and two quarterly reports were not submitted timely, and one report was not accurate. Recommendation: The College should ensure that all grant reports are prepared in a timely manner and are accurate. Management’s Response: The College will submit annual performance reports in a timely manner.

2024-006 —Reporting – Significant Deficiency in Internal Control Over Compliance and Noncompliance (Repeat of Finding 2023-007, 2022-005, 2021-002, and 2020-004) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; and Education Stabilization Fund ALN Number: 15.027, 84.031, 84.425 Award years: Various Criteria: According to 2 CFR Section 200.328, nonfederal entities may be required to submit performance reports at least annually as required by the terms of the federal award. In addition, ALN 84.425 requires quarterly expenditure and budget reports. Condition: The College did not submit annual performance reports on time for three programs. The annual report for ALN 84.031 was inaccurate. In addition, two quarterly financial reports required for ALN 84.425 were not submitted timely. Cause: The College did not have sufficient procedures in place to ensure that the reports were completed timely and accurately. Effect: The three annual reports and two quarterly reports examined were submitted after the required time and one report was inaccurate. Questioned Costs: None Context: The annual reports and two quarterly reports were not submitted timely, and one report was not accurate. Recommendation: The College should ensure that all grant reports are prepared in a timely manner and are accurate. Management’s Response: The College will submit annual performance reports in a timely manner.

2024-006 —Reporting – Significant Deficiency in Internal Control Over Compliance and Noncompliance (Repeat of Finding 2023-007, 2022-005, 2021-002, and 2020-004) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; and Education Stabilization Fund ALN Number: 15.027, 84.031, 84.425 Award years: Various Criteria: According to 2 CFR Section 200.328, nonfederal entities may be required to submit performance reports at least annually as required by the terms of the federal award. In addition, ALN 84.425 requires quarterly expenditure and budget reports. Condition: The College did not submit annual performance reports on time for three programs. The annual report for ALN 84.031 was inaccurate. In addition, two quarterly financial reports required for ALN 84.425 were not submitted timely. Cause: The College did not have sufficient procedures in place to ensure that the reports were completed timely and accurately. Effect: The three annual reports and two quarterly reports examined were submitted after the required time and one report was inaccurate. Questioned Costs: None Context: The annual reports and two quarterly reports were not submitted timely, and one report was not accurate. Recommendation: The College should ensure that all grant reports are prepared in a timely manner and are accurate. Management’s Response: The College will submit annual performance reports in a timely manner.

2024-007 —Financial Reporting– Significant Deficiency in Internal Control Over Compliance and Noncompliance Federal program information: Funding agencies: U.S. Department of Education Titles: SFA Cluster-Federal Pell Grant Program ALN Number: 84.063 Award years: 2024 Criteria: According to 2 CFR Section 200.328, nonfederal entities may be required to submit financial reports at least annually as required by the terms of the federal award. In addition, the grant requires origination and disbursement records be submitted to the Common Origination and Disbursement (COD) system. Condition: The College did not submit disbursement records for students as required. Cause: The College was affected by a ransomware attack that restricted access from their system in order to submit the disbursement records to the COD system. Effect: The College is not in compliance with reporting requirements. Questioned Costs: None Context: Disbursement records were not reported for fall 2023 to the COD system. Recommendation: Work with Department of Education to report the disbursement records for the time period not reported to the COD system. Management’s Response: The College will submit disbursement records to the COD system as required.

2024-008 — Disbursements to or on Behalf of Students (Special Test #3) – Material Weakness in Internal Control Over Compliance and Noncompliance Federal program information: Funding agencies: U.S. Department of Education Titles: SFA Cluster-Federal PELL Grant Program ALN Number: 84.063 Award years: Various Criteria: According to 34 CFR Section 668.165(a)(1), prior to make a disbursement, the school must notify students of the amount and type of Title IV funds (PELL grants) they are expected to receive, and how and when those disbursements will be made. Condition: The College did not have documentation of notification of disbursements. Cause: The College was affected by a ransomware attack that restricted access from their system in order to notify the students individually, as such the College notified the students verbally at a campus meeting. Effect: The College is not in compliance with Special Test Requirements of notification of disbursements. Questioned Costs: None Context: Disbursement notification documentation was not maintained for fall 2023. Recommendation: The College should comply with grant requirements and maintain documentation of compliance. Management’s Response: The College will document notifications of disbursement as required.

2024-009 — Return of Title IV Funds (Special Test #5)– Material Weakness in Internal Control Over Compliance and Noncompliance Federal program information: Funding agencies: U.S. Department of Education Titles: SFA Cluster-Federal PELL Grant Program ALN Number: 84.063 Award years: Various Criteria: According to 34 CFR Section 668.22(a)(1) through (a)(5), when a recipient of Title IV grant (PELL grants) withdraws from an institution during a payment period or period of enrollment in with the recipient began attendance, the institution must determine the amount of aid earned by the student as of the student’s withdrawal date. If the total amount of assistance earned by the student is less than the amount disbursed to the student, the difference must be returned to the Title IV program as outlined in the requirements. Condition: The College uses credit hours for measurement of the program as such, the amount of aid earned by the student is required to be determined by dividing the total number of calendar days in the enrollment period into the number of days completed in that period as of the student’s withdrawal date. The College was determining the amount of funds earned by the amount of credit hours the student was still enrolled in. Additionally, the timing of the withdrawals was incorrect in the calculations. Cause: The College was unaware of the percentage earned calculation and forms were not being submitted timely to the financial aid office to indicate student attendance. Effect: Return of funds were incorrectly calculated resulting in over and underpayments to students. Questioned Costs: $40,368 Context: The College did not properly calculate and return Title IV funds for students who withdrew. Recommendation: The College should comply with grant requirements for calculation of determining funds earned and those that need to be returned. Management’s Response: The College will return unearned Pell grant funds and properly determine unearned scholarship awards.

2024-010 — Enrollment Reporting (Special Test #6)– Material Weakness in Internal Control Over Compliance and Noncompliance Federal program information: Funding agencies: U.S. Department of Education Titles: SFA Cluster-Federal PELL Grant Program ALN Number: 84.063 Award years: Various Criteria: According to 34 CFR Section 690.83(b)(2), institutions are required to report enrollment information under the Pell grant via the NSLDS. Condition: The College failed to report enrollment data during the audit period. Cause: Due to staffing issues the College did not complete the submission. Effect: The enrollment information that appears on the NSLDS Professional Access website which the administration of the Title IV program depends on heavily to be accurate and up to date is missing information from the College. Questioned Costs: None Context: The College did not accurately report enrollment information for the PELL grant. Recommendation: The College should comply with grant requirements and submit Enrollment Reporting. Management’s Response: The College will accurately report enrollment information.

2024-011 — Gramm-Leach-Bliley Act- Student Information Security (Special Test #11)– Material Weakness in Internal Control Over Compliance and Noncompliance Federal program information: Funding agencies: U.S. Department of Education Titles: SFA Cluster-Federal PELL Grant Program ALN Number: 84.063 Award years: Various Criteria: According to 16 CFR 314. The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information sharing practices to their customers and to safeguard sensitive data. The Federal Trade Commission considers Title IV-eligible institutions that participate in the Title IV Education Assistance programs as “financial institutions” and subject to the GLBA. Institutions must protect student financial aid information, with particular attention to information. Condition: Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts and includes specific elements. The College did not have a comprehensive information security program in place, written or otherwise, that met the specific elements. Cause: The College’s IT control environment is lacking certain key controls. There are currently no formalized IT policies and procedures, sufficient data backup processes, or a formalized disaster recovery plan. IT controls are not in place to ensure non-authorized individuals are restricted from adding new vendors, recording journal entries, and making/or changes to employee pay records. Effect: The College is not in compliance with the requirements of the program and student data may be compromised without policies in place to ensure otherwise. Questioned Costs: None Context: The College is not in compliance with the GLBA requirements. Recommendation: The College should comply with grant requirements and develop, implement, and maintain a comprehensive security program that includes the specific elements required. Management’s Response: The College is in process of developing policies for the GLBA

2024-012 — Maintenance of Payroll Records- Significant Deficiency in Internal Control Over Compliance Federal program information: Funding agencies: U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid ALN Number: 15.027 and 84.031 Award years: Various Criteria: The College is required to process payroll in accordance with its financial policies and procedures, grant requirements and federal regulations and guidelines. Payroll disbursements require authorized supporting documentation such as cancelled checks, time and attendance records, authorized personnel action forms, etc. Condition: Payroll records, such as personnel action forms, were either missing or did not agree with the amount of wages paid through the payroll system. Cause: Policies and Procedures regarding the review and maintenance of the College’s payroll records and supporting documentation are not being consistently maintained. Effect: The College may not be able to demonstrate that the costs charged to federal programs are allowable. Questioned Costs: Undeterminable. Context: Of the 25 payroll transactions tested, 9 personnel action forms could not be located. Auditor’s Recommendations: Enforce policies and procedures to ensure adequate supporting documentation is maintained for all payroll transactions. Management’s Response: The College will enforce its payroll documentation policies.

2024-012 — Maintenance of Payroll Records- Significant Deficiency in Internal Control Over Compliance Federal program information: Funding agencies: U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid ALN Number: 15.027 and 84.031 Award years: Various Criteria: The College is required to process payroll in accordance with its financial policies and procedures, grant requirements and federal regulations and guidelines. Payroll disbursements require authorized supporting documentation such as cancelled checks, time and attendance records, authorized personnel action forms, etc. Condition: Payroll records, such as personnel action forms, were either missing or did not agree with the amount of wages paid through the payroll system. Cause: Policies and Procedures regarding the review and maintenance of the College’s payroll records and supporting documentation are not being consistently maintained. Effect: The College may not be able to demonstrate that the costs charged to federal programs are allowable. Questioned Costs: Undeterminable. Context: Of the 25 payroll transactions tested, 9 personnel action forms could not be located. Auditor’s Recommendations: Enforce policies and procedures to ensure adequate supporting documentation is maintained for all payroll transactions. Management’s Response: The College will enforce its payroll documentation policies.

2024-012 — Maintenance of Payroll Records- Significant Deficiency in Internal Control Over Compliance Federal program information: Funding agencies: U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid ALN Number: 15.027 and 84.031 Award years: Various Criteria: The College is required to process payroll in accordance with its financial policies and procedures, grant requirements and federal regulations and guidelines. Payroll disbursements require authorized supporting documentation such as cancelled checks, time and attendance records, authorized personnel action forms, etc. Condition: Payroll records, such as personnel action forms, were either missing or did not agree with the amount of wages paid through the payroll system. Cause: Policies and Procedures regarding the review and maintenance of the College’s payroll records and supporting documentation are not being consistently maintained. Effect: The College may not be able to demonstrate that the costs charged to federal programs are allowable. Questioned Costs: Undeterminable. Context: Of the 25 payroll transactions tested, 9 personnel action forms could not be located. Auditor’s Recommendations: Enforce policies and procedures to ensure adequate supporting documentation is maintained for all payroll transactions. Management’s Response: The College will enforce its payroll documentation policies.

2024-012 — Maintenance of Payroll Records- Significant Deficiency in Internal Control Over Compliance Federal program information: Funding agencies: U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid ALN Number: 15.027 and 84.031 Award years: Various Criteria: The College is required to process payroll in accordance with its financial policies and procedures, grant requirements and federal regulations and guidelines. Payroll disbursements require authorized supporting documentation such as cancelled checks, time and attendance records, authorized personnel action forms, etc. Condition: Payroll records, such as personnel action forms, were either missing or did not agree with the amount of wages paid through the payroll system. Cause: Policies and Procedures regarding the review and maintenance of the College’s payroll records and supporting documentation are not being consistently maintained. Effect: The College may not be able to demonstrate that the costs charged to federal programs are allowable. Questioned Costs: Undeterminable. Context: Of the 25 payroll transactions tested, 9 personnel action forms could not be located. Auditor’s Recommendations: Enforce policies and procedures to ensure adequate supporting documentation is maintained for all payroll transactions. Management’s Response: The College will enforce its payroll documentation policies.