Finding 2024-001: Internal controls within the Student Financial Assistance (SFA). IT Systems. Identification of the Federal Program: Federal Agency: United States Department of Education Federal Cluster: Student Financial Assistance Cluster. Assistance Listing No.: 84.268 Federal Direct Student Loans (Direct Loans), 84.063 Federal Pell Grant Program, 84.007 Federal Supplemental Education Opportunity Grant Program. Award Periods: July 1, 2023 through June 30, 2024; July 1, 2024 through June 30, 2025. Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation):. Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must:Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Atrium Health CMHA has two primary student financial assistance (SFA) information technology (IT) systems and related applications that are used to process student financial assistance eligibility and disbursements as well as various other special tests and provisions required by the United States Department of Education. Internal controls over the accuracy and completeness of the data and applications within the SFA IT systems at Atrium Health CMHA were not evaluated for fiscal year 2024. Cause: Internal controls over the accuracy and completeness of the data and applications within the SFA IT systems at Atrium Health CMHA were not evaluated for fiscal year 2024. Effect or Potential Effect: The data used within the IT systems and applications may not be complete or accurate or the applications may not function as intended. Questioned Costs: None. Context: Total federal expenditures for the Student Financial Assistance Cluster recorded on the Schedule of Expenditures of Federal Awards (Schedule) totaled $2,876,252 for the year ended December 31, 2024. Identification as a Repeat Finding, if Applicable: This finding is a repeat finding of 2023-002 from the prior year. Recommendation: Atrium Health CMHA should implement internal controls to ensure the IT systems are tested or implement compensating controls to ensure the data is accurate and complete. Views of Responsible Officials: Due to operational management turnover and restructuring experienced in 2024 and 2025, this corrective action plan has been delayed. Atrium Health CMHA management has engaged with outside consultants in the third quarter of 2025 to examine and redesign the reporting structures, process work flows, and procedures within the Student Financial Aid (SFA) office, the Business office, and Student Services specifically as those areas relate to student status and records. It is expected this engagement will ensure that the internal controls within the entire SFA office will improve, including that the SFA IT Systems are documented and tested and that any compensating controls identified as needed are implemented.
Finding 2024-002: SFA Review and Approval Internal ControlsIdentification of the Federal Program: Federal Agency: United States Department of Education. Federal Cluster: Student Financial Assistance Cluster. Assistance Listing No.: 84.268 Federal Direct Student Loans (Direct Loans), 84.063 Federal Pell Grant Program, 84.007 Federal Supplemental Education Opportunity Grant Program. Award Periods: July 1, 2023 through June 30, 204; July 1 2024 through June 30, 20250Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:“The non-Federal entity must:Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).”Condition:Atrium Health CMHA does not have review and approval internal controls or policies in place over the following compliance requirements:• Cash management• Eligibility• Verification• Enrollment Reporting• Incentive Compensation. Cause:While Atrium Health CMHA has procedures in place to process and record student financial assistance transactions, internal controls are not in place to review and approve the underlying transactions, reports and policies. Effect or Potential Effect:The underlying data may not be complete and accurate resulting in Atrium Health CMHA being noncompliant with the applicable compliance requirements. Reports may not be complete and accurate. Policies may not be up to date with the Department of Education requirements.Questioned Costs:None. Context:Total federal expenditures for the Student Financial Assistance Cluster recorded on the Schedule totaled $2,876,252 for the year ended December 31, 2024.Identification as a Repeat Finding, if Applicable:This finding is a repeat finding of 2023-003 from the prior year.Recommendation:Atrium Health CMHA should develop and implement internal controls related to each of the compliance requirements to ensure the completeness and accuracy of the underlying data. Views of Responsible Officials: Due to operational management turnover and restructuring experienced in 2024 and 2025, this corrective action plan has been delayed. Atrium Health CMHA management has engaged with outside consultants in the third quarter of 2025 to examine and redesign various processes and work flows. This project is expected to address the gap in SFA transactional review and approval internal controls that are arising due to the SFA program size, limited number of subject matter experts, and the management turn; and result in mitigating controls and policies being implemented to ensure the accuracy and completeness of all SFA transactions.
Finding 2024-003: Notification of Disbursements to or on Behalf of StudentsIdentification of the federal program: Federal Agency: United States Department of Education. Federal Cluster: Student Financial Assistance Cluster. Assistance Listing No.: 84.268 Federal Direct Student Loans (Direct Loans), 84.063 Federal Pell Grant Program, 84.007 Federal Supplemental Education Opportunity Grant Program. Award Periods: July 1, 2023 through June 30, 2024; July 1, 2024 through June 30, 2025. Criteria or specific requirement (including statutory, regulatory or other citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:“The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).”34 CFR 668.165(a)(1) – Before an institution disburses title IV, HEA program funds for any award year, the institution must notify a student of the amount of funds that the student or his or her parent can expect to receive under each title IV, HEA program, and how and when those funds will be disbursed. If those funds include Direct Loan program funds, the notice must indicate which funds are from subsidized loans, which are from unsubsidized loans, and which are from PLUS loans. Condition:When Direct Loans are being credited to a student’s account, an institution must notify the student, or parent, in writing of (1) the date and amount of the disbursement; (2) the student’s right, or parent’s right, to cancel all or a portion of that loan or loan disbursement and have the loan proceeds returned to the holder of that loan; and (3) the procedure and time by which the student or parent must notify the institution that he or she wishes to cancel the loan. Atrium Health CMHA was unable to provide the notification letters sent to the student as they are not maintained. Further, there were three instances where student disbursements were not made timely and one instance where a disbursement resulted in a credit that was not returned timely. Cause:The current IT system does not allow for the letters sent to be saved.Effect or potential effect: The disbursement notification letters may not have be sent in accordance with the regulations.Questioned costs:None.Context:Total expenditures for the Student Financial Assistance Cluster were $2,876,252 for the year ended December 31, 2024. We selected a sample of 40 disbursements and identified 33 that did not have notification of disbursement and one disbursement that resulted in a credit that was not refunded within the time frame.Identification as a repeat finding, if applicable:This finding is a repeat finding of 2023-004 from the prior year. Recommendation:Atrium Health CMHA should implement internal controls to retain all disbursement notification letters sent to students.Views of responsible officials:Atrium Health CMHA management, as part of the 2025 process and procedures consulting engagement, will develop a plan to ensure that the IT systems are changed such that notification letters can be retained or a control exists whereby hard-copies of notification letters are maintained.
Finding 2024-004: Gramm-Leach-Bliley Act (GLBA) – Student Information Security Controls. Identification of the Federal Program:Federal Agency: United States Department of Education. Federal Cluster: Student Financial Assistance Cluster. Assistance Listing No.: 84.268 Federal Direct Student Loans (Direct Loans), 84.063 Federal Pell Grant Program, 84.007 Federal Supplemental Education Opportunity Grant ProgramAward Periods: July 1, 2023 through June 30, 2024; July 1, 2024 through June 30, 2025. Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:“The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).”The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314).Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. Condition:Atrium Health CMHA did not have adequate internal controls in place surrounding the Information Security Program. During our testing, we noted there was no documentation retained to evidence that a review of certain elements of the Information Security Program was performed to ensure compliance with federal regulations. Additionally, the written Information Security Program did not address certain required elements per 16 CFR 314.4 to ensure compliance with federal regulations.Cause:Atrium Health CMHA did not retain sufficient documentation of their review procedures over certain elements of the Information Security Program. Atrium Health CMHA did not include certain required elements within its Information Security Program. Effect or Potential Effect:The written Information Security Program is not compliant with federal regulations. Questioned Costs:None. Context:Total federal expenditures for the Student Financial Assistance Cluster recorded on the Schedule of Expenditures of Federal Awards (Schedule) totaled $2,876,252 for the year ended December 31, 2024.Identification as a Repeat Finding, if Applicable:This finding is a repeat finding of 2023-005 from the prior year. Recommendation:Atrium Health CMHA should design and implement internal controls over the Information Security Program to ensure all requirements of the GLBA are included in the written Information Security Program appropriately.Views of Responsible Officials:Atrium Health CMHA management, as part of the 2025 process and procedures consulting engagement, will ensure that all GLBA requirements over the Information Security Program are both documented completely and inclusive in scope of both general CMHA IT systems as well as IT systems specific to the SFA program.
Finding 2024-005: Fiscal Operations Report and Application to Participate (FISAP) Reporting. Identification of the Federal Program:Federal. Agency: United States Department of Education. Federal Cluster: Student Financial Assistance Cluster. Assistance Listing No.: 84.268 Federal Direct Student Loans (Direct Loans), 84.063 Federal Pell Grant Program, 84.007 Federal Supplemental Education Opportunity Grant ProgramAward Periods: July 1, 2023 through June 30, 2024; July 1, 2024 through June 30, 2025. Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation):Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control:“The non-Federal entity must:(a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).”Section 200.508 of Title U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) state the following: “The auditee must:(d) Provide the auditor access to personnel, accounts, books, records, supporting documentation, and any other information needed for the auditor to perform the audit required by this part. Condition:Atrium Health CMHA did not have adequate internal controls in place to retain supporting documentation in regards to Section F. Information on Eligible Aid Applicants Enrolled in Your School for Award Year 2023-2024 of the FISAP.Cause:Atrium Health CMHA did not retain sufficient documentation to support the count of students used in Section F. Information on Eligible Aid Applicants Enrolled in Your School for Award Year 2023-2024. Effect or Potential Effect:Incorrect information could be reported to the Department of Education. Questioned Costs:None. Context:Total federal expenditures for the Student Financial Assistance Cluster recorded on the Schedule of Expenditures of Federal Awards (Schedule) totaled $2,876,252 for the year ended December 31, 2024.Identification as a Repeat Finding, if Applicable:This finding is not a repeat finding from the prior year. Recommendation:Atrium Health CMHA should design and implement internal controls over FISAP reporting to ensure supporting documentation is maintained. Views of Responsible Officials:Atrium Health CMHA management, as part of the 2025 process and procedure consulting engagement, will ensure that appropriate training and process design for Jenzabar Financial Aid (JFA) system are implemented to accurately capture and retain all data required for FISAP reporting.
Finding 2024-006 Information on the Federal Program:Federal. Agency: Department of Homeland SecurityAssistance Listing No.: 97.036 COVID-19 Disaster Grants – Public Assistance (Presidentially Declared Disasters) (FEMA)Pass-Through: North Carolina Department of Public Safety. Pass-Through Award Number: N/APass-Through Award Period of Performance: 1/1/2021 through 7/1/22 and 7/2/22 through 5/11/23Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation):Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).”Condition:Atrium Health CMHA’s internal controls were not suitably designed to retain all supporting documentation over their review and approval of FEMA federal expenditures. Cause:Atrium Health CMHA’s management designed a process to accumulate and review expenditures related to the FEMA award; however, for certain components of the review and approval the supporting documentation was not retained to evidence that the internal review was sufficiently designed and operating effectively throughout the process. Questioned Costs:None. Context:Atrium Health CMHA developed protocols of what expenses should be charged to the Presidentially Declared Disaster grant and communicated these protocols to the appropriate levels of management. Management then developed a process to review the costs and determine which ones were applicable to the Presidentially Declared Disaster grant. However, management did not maintain evidence supporting the approval of expenses under the Presidentially Declared Disaster grant terms.Total federal expenditures for Assistance Listing 97.036 recorded on the Schedule totaled $257,938,430 for the year ended December 31, 2024. Effect or Potential Effect:The amounts submitted for reimbursement and the FEMA reports submitted could be inaccurate or incomplete.Identification as a Repeat Finding, if Applicable:This is not a repeat finding from the previous year. Recommendation:Atrium Health CMHA should design and implement internal controls that are sufficiently precise and require supporting documentation be retained over the review and approval of FEMA expenses. Views of Responsible Officials:Atrium Health CMHA management in the future will ensure that all correspondence, including notes from review meetings and approvals of key decisions, will be documented and retained as part of the support records for FEMA related awards. Atrium Health CMHA should design and implement internal controls over FISAP reporting to ensure supporting documentation is maintained. Views of Responsible Officials:Atrium Health CMHA management, as part of the 2025 process and procedure consulting engagement, will ensure that appropriate training and process design for Jenzabar Financial Aid (JFA) system are implemented to accurately capture and retain all data required for FISAP reporting.