Audit 375827

Finding 2025-001: Significant Deficiency - Return of Title IV Funds Program: Student Financial Assistance Cluster Assistance Listing Number (ALN): Various Federal Agency: U.S. Department of Education Federal Award Identification Number: N/A Federal Award Year: June 30, 2025 Criteria: Title IV regulations (34 CFR 668.22) require the University to return the unearned portion of grants or loans to the Title IV program within 45 days after a student withdraws. Additionally, The U.S. Department of Education (ED) requires that an institution must ensure that its administrative procedures for the FSA programs include an adequate system of internal controls or checks and balances to ensure compliance with FSA laws and regulations including the return of Title IV funds. Condition/Context: The auditor noted that the University did not have evidence or documentation available to support the control/review process for return of Title IV calculations. Cause: The University did not have a formal documented review process for returns of Title IV calculations. Effect: The University could have incorrect return of Title IV calculations and return incorrect amounts to students and/or the ED. Questioned costs: Not applicable. Recommendation: The University should adhere to its procedures for refunding awards and implement a more formal documented review process/control to ensure refunds are calculated correctly and timely and any returns are made within the required timeframe. Management's Response: The University agrees with the finding. The University has begun formally documenting the weekly review of return of Title IV calculation.

Finding 2025-002: Significant Deficiency - Enrollment Reporting Program: Student Financial Assistance Cluster Assistance Listing Number (ALN): Various Federal Agency: U.S. Department of Education Federal Award Identification Number: N/A Federal Award Year: June 30, 2025 Criteria: Title IV regulations (34 CFR 685.309(b)) require that upon receipt of an enrollment report from the Secretary, institutions must update all information included in the report and return the report to the Secretary: (i) in the manner and format prescribed by the Secretary; and (ii) within the timeframe prescribed by the Secretary. Unless it expects to submit its next updated enrollment report to the Secretary within the next 60 days, an institution must notify the Secretary within 30 days after the date the institution discovers that: (i) a loan under Title IV of the Act was made to or on behalf of a student who was enrolled or accepted for enrollment at the institution, and the student has ceased to be enrolled on at least a half-time basis or failed to enroll on at least a half-time basis for the period for which the loan was intended; or (ii) a student who is enrolled at the institution and who received a loan under Title IV of the Act has changed his or her permanent address. Condition: For 5 of 25 students tested in the sample, the student’s status was reported late to the National Student Loan Data System (NSLDS). The sample was not a statistically valid sample. Cause/Context: The University noted that some system changes/issues occurred that resulted in disruptions and delays in reporting timely and accurate files to NSLDS. Effect: Student status changes were reported late to NSLDS and could result in incorrect interest or loan repayment actions by ED. Questioned costs: Not applicable Recommendation: It is recommended that the University review its systems and procedures to ensure NSLDS enrollment reporting is completed accurately and timely for all status changes and all students. Management's Response: The University agrees with the finding. The University has reviewed and updated its NSLDS reporting process.

Finding 2025-003: Gramm-Leach-Bliley Act Security Policy Program: Student Financial Assistance Cluster Assistance Listing Number (ALN): Various Federal Agency: U.S. Department of Education Federal Award Identification Number: N/A Federal Award Year: June 30, 2025 Repeat Finding: 2024-001 Criteria: The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). In 2021, the Federal Trade Commission issued final regulations that altered the current required elements of an information security program and added several new elements. Under the regulations, institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The written information security program for institutions must address all elements that apply. The elements for the information security programs set forth in this section 16 CFR 314.4 are high-level principles that set forth basic issues the programs must address, and do not prescribe how they will be addressed. Condition/Context: The University did not have updated procedures and processes in place specific to all the required GLBA elements. The GLBA policy review and updates are still in process. Cause: The University noted that several items required are in process or only partially completed. Effect: Failure to comply with the requirements of GLBA standards puts the University out of compliance with requirements and potentially at risk of compromising consumer, nonpublic personal information. Questioned costs: Not applicable Recommendation: It is recommended that the University update its written GLBA security policy to address all the required elements. At a minimum, the University should address each of the required minimum elements noted in the GLBA regulations (16 CFR 314.4). Management's Response: The University agrees with the finding. The University notes that several items required are in process or being developed to comply with the requirements.