Audit 381755

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2024 – May 31, 2025 Type of Finding: • Material Weakness in Internal Control over Financial Reporting • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. This includes the enrollment effective date and related enrollment status, which must be reported for both the Campus Level and the Program Level. In addition, at a minimum, schools are required to certify enrollment every 60 days and respond within 15 days of the date that NSLDS sends a Roster file to the school or its third-party servicer. Condition: During our testing, we noted 33 out of the 60 students tested did not have enrollment data certified every 60 days. In 7 of the 60 students tested, the students’ status per the institution's records did not match what was reported to NSLDS. Furthermore, 24 out of the 60 students had an incorrect enrollment effective date. Questioned Costs: N/A Context: During our testing, it was noted the University does not have adequate processes in place to ensure timeliness and accuracy of NSLDS reporting. Cause: The University’s processes and controls did not ensure that student status changes were properly reported to NSLDS in a timely manner. Effect: The University did not comply with Department of Education (ED) regulations by reporting student enrollment status changes timely. Repeat Finding: Yes, finding 2024-002 Recommendation: We recommend the University review its reporting procedures to ensure that students’ statuses are accurately and timely reported to NSLDS as required by regulations. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2024 – May 31, 2025 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 16 CFR 314.4(a), states that the first element an institution's written information security program must address is the designation of an individual with responsibility for implementing and enforcing an institution’s written information security program. The regulations refer to this individual as the Qualified Individual. If an institution has not designated a Qualified Individual, it is not in compliance with the GLBA requirements. The Qualified Individual has ultimate responsibility and accountability for implementing and enforcing the institution’s information security program. As well, the regulations do provide for an institution to use a service provider as the Qualified Individual. In cases where an institution uses a service provider as the Qualified Individual, the institution must: • Retain responsibility for compliance with GLBA; • Designate a senior member of its personnel responsible for direction and oversight of the Qualified Individual; and • Require the service provider or affiliate to maintain an information security program that protects the institution in accordance with the requirements of the regulations at 16 CFR Part 314(a)(1) through (3). The Code of Federal Regulations, 16 CFR 314.4(g), states that there must be an evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact on the institution's information security program. Condition: During our testing, we noted that the University does not have a designated WISP compliance officer or Qualified Individual. We also noted that Bethel has not reviewed or updated any GLBA policies since 2023. Questioned Costs: N/A Context: During our testing, it was noted the University did not address the designated WISP compliance officer requirement. The University did not have adequate processes in place to ensure that GLBA safeguards were being following and operating effectively. Cause: The University’s processes and controls did not ensure that GLBA safeguards were effective and running properly. Effect: The University did not comply with GLBA safeguard rules by failing to have a WISP officer or Qualified Individual in place. Also, the University did not comply with GLBA safeguard rules by not reviewing or updating GLBA policies since 2023. Repeat Finding: No Recommendation: CLA recommends reviewing and updating key IT/financially relevant organization-wide policies and procedures on an annual basis. CLA also recommends the Organization review the institution's written information security program and ensure that a qualified individual (i.e. CIO, CISO, ISO) has been identified to enforce and monitor GLBA compliance. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding