Audit 389269

2025-001—Error in Reporting for National Student Loan Data System (NSLDS) U.S. Department of Education Student Financial Assistance Programs Cluster (Direct) Federal Direct Loan Program (84.268) Federal Award Year: 2024-2025 Repeat Finding: Yes Criteria The Code of Federal Regulations (34 CFR 685.309) requires enrollment status changes for students be reported to NSLDS within 30 days or within 60 days if the student with the status change will be reported on a scheduled transmission within 60 days of the change in status. Regulations require the status include an accurate effective date. According to the NSLDS Enrollment Reporting Guide, a student’s Program-Level enrollment status should be reported with the same enrollment status as that student’s campus-level enrollment status for all programs the student is enrolled in at that location, even if the student is not currently taking coursework that applies to a particular program. If the student has withdrawn or graduated from an academic program, a “terminal enrollment status” of ‘W’ or ‘G,’ as appropriate, should be reported for that program, even if the student is still taking coursework applicable to other programs in which the student is enrolled. Uniform Grant Guidance (2 CFR 200.303) requires nonfederal entities receiving federal awards establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure enrollment reporting is completed properly. Condition The College did not properly report the student enrollment change for students who received federal student aid to the NSLDS. The College did not timely report three students’ Program-Level or Campus-Level enrollment status change to NSLDS. Out of the 25 students tested, we noted 3 students (12%) whose status change at the Program-Level and Campus-Level was not timely reported to NSLDS. Cause The College did not have adequate controls related to the process of enrollment reporting, which is required under Uniform Grant Guidance. An additional submission to the NSLDS was required for two students who withdrew and one student who was incorrectly marked as not reportable to NSLDS. Both changes were reported outside the allowable window of reporting noted above. Effect Noncompliance with federal regulations could result in the loss of future federal funding. Context We tested 25 students who received federal student aid with enrollment changes. For each student tested, management provided documentation from NSLDS showing when the student’s status changed, and when it was reported. Out of the 25 students tested, we noted 3 students (12%) whose status change at the Program-Level and Campus-Level was not timely reported to NSLDS. Questioned costs There were no questioned costs with respect to this finding. Recommendation We recommend the College review current processes and implement updated processes and controls for reporting to NSLDS, implementing procedures to ensure submissions are reported timely and accurately. Views of responsible officials Management agrees with this finding. See corrective action plan.

2025-002—Disbursements to or on Behalf of Students (Credit Balances) U.S. Department of Education Student Financial Assistance Programs Cluster (Direct) Federal Direct Loan Program (84.268) Federal Pell Grant Program (84.063) Federal Work Study (84.033) Federal Award Year: 2024-2025 Repeat Finding: Yes Criteria The Code of Federal Regulations (34 CFR 668.164(h)(2)) requires that Title IV credit balance must be paid directly to the student or parent as soon as possible, but no later than (i) Fourteen (14) days after the balance occurred if the credit balance occurred after the first day of class of a payment period; or (ii) Fourteen (14) days after the first day of class of a payment period if the credit balance occurred on or before the first day of class of that payment period. Condition The College did not pay the Title IV credit balances to the students directly within the required timeline noted above. Out of the 40 students tested, we noted 2 students (5%) whose credit balances were not paid directly to the students within the required timeframe noted above. The incorrect timing did not have an effect on the total award given to students (timing only). The College did not have formally documented controls related to the process associated with disbursements to or on behalf of students (credit balances), which is required under Uniform Grant Guidance. Cause A refund to the students were required to be made within the required timeframe and were done outside the required timeframe. Effect Noncompliance with federal regulations could result in the loss of future federal funding. Questioned costs There were no questioned costs with respect to this finding. Context We tested 40 students who had a credit balance of Title IV funds during the fiscal year ended June 30, 2025. For each student tested, management provided documentation from their student information system, showing the when the student was in a credit balance, and when the credit balance was disbursed to the student. Out of the 40 students tested, we noted 2 students (5%) whose credit balances were not timely refunded. Recommendation We recommend the College review current processes and implement updated processes and controls for timely student credit balance refunds. Views of responsible officials Management agrees with this finding. See corrective action plan.

2025-003—Graham Leach Bliley Act – Student Information Security U.S. Department of Education Student Financial Assistance Programs Cluster (Direct) Federal Work Study Program (84.003) Federal Pell Grant Program (84.063) Federal Perkins Loan Program (84.038) Federal Supplemental Educational Opportunity Grants (84.007) Federal Direct Loan Program (84.268) Federal Award Year: 2024-2025 Repeat Finding: Yes Criteria The Code of Federal Regulations (2 CFR 200.303(a)) requires that the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in Standards for Internal Control in the Federal Government issued by the Comptroller General of the United States or the Internal Control Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission. The Program Participation Agreement (PPA) with the U.S. Department of Education requires the institution to comply with the Standards for Safeguarding Customer Information as described in 16 CFR Part 314 which includes the development of a comprehensive written security program that includes the following parts: • 16 CFR 314.4(a) requires institutions to designate a qualified individual responsible for overseeing and implementing the institution’s information security program and enforcing the information security program. • 16 CFR 314.4(b) requires institutions to provide for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality and integrity of customer information (as the term customer information applies to the institution) that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks. • 16 CFR 314.4(c) requires institutions to provide for the design and implementation of safeguards to control the risks the institution provides through its risk assessment • 16 CFR 314.4(d) requires institutions to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented. • 16 CFR 314.4(e) requires institutions to develop policies and procedures to ensure that personnel are able to enact the information security program. • 16 CFR 314.4(f) requires institutions to develop policies and procedures to oversee its information system service providers. Condition The College’s written information security program did not include the following elements required by regulation as agreed to in the PPA: • The College has performed a risk assessment utilizing internal resources but has not fully integrated the information security program on the results of this assessment, nor has the College included all required elements of internal and external risks to the security, confidentiality or integrity of customer information. The College’s risk assessment is in the process of implementing an inventory of IT systems that process and store customer information and the compliance with information security elements related to multifactor authentication, access control, change management, logging and alerting and encryption. • The College has not identified, designed or implemented safeguards for all of the risks identified in the risk assessment. The safeguards do not include the identification of security events the detection and response capabilities to support incident response is still being developed. • The College has not been able to test safeguards because safeguards have not been fully designed or implemented in response to the risk assessment. • The College has not developed written policies and procedures to ensure that personnel are able to enact the information security program. There is a lack of evidence of leadership being required to report to the board or an appropriate supervisory council to ensure those charged with governance are informed on the current state of the information security program. Cause The College’s information security policy did not include all of the required elements, in line with the Gramm-Leach-Bliley Act. Effect Noncompliance with federal regulations could result in the loss of future federal funding. Questioned costs There were no questioned costs with respect to this finding. Context Under a College’s PPA with the U.S. Department of Education, institutions must protect student financial aid information, with particular attention to information provided to institutions by the U.S. Department of Education or otherwise obtained in support of the administration of federal student financial aid programs Recommendation We recommend the College complete these requirements, in order to be compliance with the Gramm-Leach-Bliley Act. Views of responsible officials Management agrees with this finding. See corrective action plan.