Audit 382495

Finding No. 2024-002 Special Tests: Enrollment Reporting and Gramm-Leach-Bliley Act Compliance / Material Weakness in Internal Controls over Compliance Federal Program – Student Financial Aid Cluster – Federal Direct Student Loans (ALN 84.268), U.S. Department of Education Criteria – Auditee requirements contained in Title 2 U.S. Code of Federal Regulations (2 CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, requires the auditee to comply with Federal statues, regulations, terms, and conditions of Federal awards that may have a direct and material effect on each of its major programs. The enrollment reporting compliance requirement, which falls under special tests, requires the Institute to certify enrollment information under the Direct loan programs every 60 days. The Gramm-Leach-Bliley Act over student information security, which falls under special tests, requires the Institute to have a written information security program that addresses seven specific required elements. Condition – Instances of noncompliance have been identified around major compliance requirements Gramm-Leach-Bliley Act, which is part of special tests identified in the 2024 Compliance Supplement. Cause – The cause is due to a lack of sufficient internal control procedures in place to ensure compliance with material compliance requirements in the 2024 Compliance Supplement for its federal award. Effect – The Institute is not in compliance with the Gramm-Leach-Bliley Act or the enrollment reporting requirements. Questioned Costs – None Context – The Institute’s graduate enrollment information was not reported within the 60-day requirement for 4 of 8 sample students tested. In addition, the Institute does not have a formalized written information security program in place that addresses the required elements in the 2024 Compliance Supplement. Repeat Finding – Repeat finding of prior year finding 2023-002. Recommendation – We recommend the Institute review the most recent Compliance Supplement, which outlines all compliance requirements for Direct loans under the Student Financial Assistance federal program to ensure all compliance requirements are being met. We encourage the Institute to monitor for any updates to the Compliance Supplement annually. The Institute should review and put in place the required minimum elements as described in 16 CFR 314.4 (b). Views of Responsible Officials – Management agrees with the finding. See Corrective Action Plan.

Finding No. 2024-003 – Documentation of Internal Controls over Compliance Material Weakness Federal Program – Student Financial Aid Cluster – Federal Direct Student Loans (ALN 84.268), U.S. Department of Education Criteria – Auditee requirements contained in Title 2 U.S. Code of Federal Regulations (2 CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, Subpart D – Post Federal Award Requirements, Section 200.303 – Internal Controls, requires the auditee to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with a framework such as the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (“COSO”). Condition – We noted that controls identified by management over material compliance requirements lacked sufficient documentation to conclude application of controls is in place. Cause – The cause is due to ineffective internal control procedures with no physical indication of review or an audit trail that indicates that the identified control took place. Effect – Ineffective internal control procedures resulted in compliance findings. See Finding No. 2024-002. Reportable Questioned Costs: None Context – Internal controls in place over material compliance requirements identified by management had no documentation in place to demonstrate application of controls. Repeat Finding – This is a repeat finding of 2023-003. Recommendation – We recommend the Institute ensures all internal control procedures in place include documentation that demonstrates application of controls. Views of Responsible Officials – Management agrees with the finding. See Corrective Action Plan.