2025-003 — IT – Material Weakness in Internal Control Over Compliance and Noncompliance (Repeat of Finding 2024-002, 2023-003) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid; and SFA Cluster ALN Number: 15.027, 84.031, 84.063 and 84.007 Award years: Various Criteria: Without strong information technology internal controls and established policies and procedures, there is the potential for integrity of financial records, the confidentiality, integrity and/or availability of data to be compromised. This compromise could be by an internal user of the system, by an external source (hacker) and could be intentional or unintentional. Condition: The College’s IT control environment is lacking certain key controls. For the majority of the audit period there were no formalized IT policies and procedures, sufficient data backup processes, or a formalized disaster recovery plan. IT controls are not in place to ensure nonauthorized individuals are restricted from adding new vendors, recording journal entries, and making/or changes to employee pay records. The College began implementing new policies and procedures in May of 2025. Questioned Costs: None. Cause: The IT controls have not been properly designed and implemented. Effect: The College is exposed to many risks regarding the integrity of the financial records, confidentiality, integrity, and/or availability of its data. It is possible that their data could be compromised. Compromise could be by an internal user of the system, by an external source (hacker) and could be intentional or unintentional. Auditor’s Recommendations: Establishing IT controls, policies and procedures, off-site electronic data backups, and a disaster recovery plan would better prepare the College for technology related issues, system crashes, or data breaches. Management’s Response: The College concurs with the finding, and the following IT and DATA governance policies have been implemented as of 2-26-26. 1. Data Privacy Statement 2. Institutional Data Governance Policy 3. IT Acceptable Use Policy Additionally, data backup processes have been implemented, and a Disaster Recovery Plan is being developed.
2025-004 — Equipment and Real Property Management – Significant Deficiency in Internal Control Over Compliance and Noncompliance (Repeat of Finding 2024-004) Federal program information: Funding agencies: U.S. Department of Education Titles: Higher Education Institutional Aid ALN Number: 84.031 Award years: Various Criteria: 2 CFR 200.313(c) through (e), requires that equipment be used in federal programs for which it was acquired for, when appropriate, other federal programs. Equipment records shall be maintained including required elements, a physical inventory of equipment be taken at least once every 2 years and reconciled to the equipment records, an appropriate control system shall be used to safeguard equipment, and equipment shall be adequately maintained. Condition: The College has not completed a physical inventory within the previous two fiscal years as required. In addition, the records were not detailed enough that program management is able to adequately and efficiently identify and locate any and all items. Questioned Costs: None. Cause: The College is not enforcing their procedures to verify that the capital assets inventory has been taken annually and reconciled to the general ledger. Effect: Without a physical inventory, there is an increase in the probability that the capital asset listing will be incorrect, or assets listed may not exist. Auditor’s Recommendations: Enforce internal control procedures and complete an inventory of the College’s capital assets annually. Management’s Response: The College concurs with the finding. Management will conduct an inventory to include location, funding source and required maintenance records.
2025-005 — Procurement – Material Weakness in Internal Control Over Compliance and Noncompliance (Repeat of Finding 2024-005, 2023-006 and 2022-004) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges and Higher Education Institutional Aid ALN Number: 15.027 and 84.031 Award years: Various Criteria: According to 2 CFR Section 200.318i, the recipient or subrecipient must maintain records sufficient to detail the history of each procurement transaction. These records must include the rationale for the procurement method, contract type selection, contractor selection or rejection, and the basis for the contract price. According to 2 CFR Section 0200.319a, all procurement transactions under the federal award must be conducted in a manner that provides full and open competition. Condition: The College did not maintain records sufficient to detail the history of each procurement transaction for the procurement contracts tested. Cause: The College did not have sufficient procedures in place to ensure that procurement records are maintained. Effect: The College is not in compliance with procurement requirements. Questioned Costs: None. Context: Procurement documents were not retained for transactions tested. Recommendation: Formally document and enforce policies and procedures that will promote adequate monitoring of the procurement and bidding process. Ensure that any contract over the College’s threshold ($150,000) follows the sealed bid requirements listed in 2 CFR Section 200.320b1. Management’s Response: The College concurs with the finding. Management will follow procedures as outlined in its policies and procedures to ensure all stages of the process adequately conducted and documented.
2025-006 — Reporting – Significant Deficiency in Internal Control Over Compliance and Noncompliance (Repeat of Finding 2024-006, 2023-007, 2022-005, 2021-002, and 2020-004) Federal program information: Funding agencies: U.S. Department of Interior and U.S. Department of Education Titles: Assistance to Tribally Controlled Community Colleges; Higher Education Institutional Aid ALN Number: 15.027 and 84.031 Award years: Various Criteria: According to 2 CFR Section 200.328, nonfederal entities may be required to submit performance reports at least annually as required by the terms of the federal award. Condition: The College did not submit annual performance reports on time for the programs. Additionally, the annual report submitted for the ALN 15.027 was submitted with inaccurate information. Cause: The College did not have sufficient procedures in place to ensure that the reports were completed timely and accurately. Effect: Submitting inaccurate and untimely reports is noncompliance with grant requirements and could lead to decreased or loss of funding. Questioned Costs: None. Context: The annual reports were not submitted timely, and one report was not accurate. Recommendation: The College should ensure that all grant reports are prepared in a timely manner and are accurate. Management’s Response: The College concurs with the finding. Annual performance reports will be submitted on time as required by the funding agency. Management has developed a comprehensive listing of all reporting requirements and will utilize this information to ensure all reporting requirements are met.
2025-007 — Eligibility – Significant Deficiency in Internal Control Over Compliance and Noncompliance Federal program information: Funding agencies: U.S. Department of Education Titles: SFA Cluster ALN Number: 84.063 and 84.007 Award years: 2025 Criteria: Per 34 CFR 690.63, Pell Grant awards must be calculated based on the student’s eligibility as determined by information reported on the Institutional Student Information Record (ISIR). The annual maximum award is permitted only for students meeting specified eligibility requirements, and over-awarding is expressly prohibited. Condition: The College incorrectly determined certain students eligibility and awarded funds in excess of what they were eligible for. Cause: The over-awards were the result of errors in the Pell Grant calculation process. The College’s financial aid system or review controls did not ensure that each student’s award matched the amount for which they were eligible based on their ISIR data. Effect: Federal funds were disbursed in excess of the eligible Pell Grant amount for these students. This could lead to required repayment to the U.S. Department of Education and may affect the College’s compliance record. Likely Questioned Costs: $20,100. Context: During Pell Grant eligibility testing, we noted that two students were awarded the maximum Pell Grant award, although their ISIRs indicated they did not qualify for the maximum. Instead, these students qualified for the SAI-Calculated Pell Award. As a result, $878.25 and $1,500 were over-awarded to these two students, respectively. Recommendation: We recommend the College strengthen its financial aid award review procedures to ensure Pell Grant calculations are accurate and are based on each student’s ISIR data and eligibility. The College should promptly research and correct any over-awarded amounts and provide staff training on Pell Grant calculation and eligibility verification. Management’s Response: The College concurs with the finding. Management will provide additional resources to the Financial Aid department to include training and assistance and will implement verification procedures to ensure that amounts awarded are accurate.
2025-008 — Financial Reporting– Significant Deficiency in Internal Control Over Compliance and Noncompliance (Repeat of Finding 2024-007) Federal program information: Funding agencies: U.S. Department of Education Titles: SFA Cluster ALN Number: 84.063 and 84.007 Award years: 2025 Criteria: According to 34 CFR 690.83(b), institutions must report accurate and timely information to the Common Origination and Disbursement (COD) system for each Pell Grant recipient. Required data includes award amounts, disbursement amounts and dates, student personal and enrollment information, verification status, changes in enrollment intensity and withdrawal status, and other pertinent data. Institutions must ensure that student information in their internal systems matches what is reported to COD. Condition: The College did not submit or update disbursement records for students as required. Cause: These reporting issues resulted from insufficient review and reconciliation procedures between the College’s internal system and COD, manual data entry errors, and lack of automated controls for updating and transmitting accurate student data. Additionally, the College has not implemented robust processes for handling student status changes and ensuring all required data elements are properly reported. Effect: Student records reported to COD are not consistently accurate, complete, or up-to-date for Pell Grant recipients. This increases the risk of administrative errors, federal compliance findings, possible questioned costs, and impacts on federal funding and student eligibility. Questioned Costs: None. Context: During our testwork we compared the origination and disbursement records in the College’s records to the COD System, we identified multiple issues indicating inaccurate or incomplete information including discrepancies in the award amounts, disbursement amounts, changes in enrollment differences, and enrollment dates. Recommendation: We recommend that the College enhance its internal controls over COD reporting by implementing regular reconciliations between their information and the COD system, establishing formal procedures to review data for accuracy and completeness prior to transmission, automating relevant data updates where possible, and training staff on reporting requirements and system functionality. Additionally, management should conduct periodic reviews of key COD data fields and student status changes to ensure timely and accurate reporting. Management’s Response: The College concurs with the finding. Management will implement formal procedures to review data and provide additional resources to the Financial Aid department to include training and assistance. Management will implement verification procedures to ensure that amounts reported to COD are accurate, complete, and up to date.
2025-009 — Disbursements to or on Behalf of Students (Special Test #3) – Material Weakness in Internal Control Over Compliance and Noncompliance (Repeat of Finding 2024-008) Federal program information: Funding agencies: U.S. Department of Education Titles: SFA Cluster ALN Number: 84.063 and 84.007 Award years: 2025 Criteria: Per 34 CFR 668.165(a), institutions are required to notify students of each Title IV fund disbursement. The notification must include the amount and type of aid credited, and, for certain types of aid, information regarding their right to cancel all or a portion of a loan or other disbursement. Institutions must retain documentation evidence that such notifications were provided. Condition: The College was unable to provide documentation demonstrating that students were notified of Pell Grant disbursements for the Fall 2024 and Spring 2025 semesters. Cause: The College does not have adequate procedures to ensure that notifications of Title IV disbursements are documented and retained in accordance with federal requirements. Effect: The College cannot demonstrate compliance with the federal requirement to notify students of Pell Grant disbursements. This increases the risk that students were not properly informed of their aid and that the College may not be able to respond to federal audits or program reviews. Questioned Costs: None. Context: During our testwork we selected a random sample of students that were disbursed funds, the College was unable to provide notification that included all the required elements for all of the sample items. Recommendation: The College should establish procedures to ensure that documentation of Title IV disbursement notifications is consistently created and retained. Relevant staff should be trained in notification and record retention requirements, and management should periodically review notification processes to ensure ongoing compliance. Management’s Response: The College concurs with this finding. Management will implement procedures to notify students of Pell Grant disbursements. College will provide training to relevant staff on notification and record retention requirements. Management will periodically review processes to ensure ongoing compliance.
2025-010 — Return of Title IV Funds (Special Test #5)– Material Weakness in Internal Control Over Compliance and Noncompliance (Repeat of Finding 2024-009) Federal program information: Funding agencies: U.S. Department of Education Titles: SFA Cluster ALN Number: 84.063 and 84.007 Award years: 2025 Criteria: Under 34 CFR 668.22, when a student who has received Title IV funds withdraws before completing a payment period or period of enrollment, the institution must determine the amount of Title IV funds that must be returned (“Return of Title IV Funds” or “R2T4”). Calculations must use accurate academic dates, correct student and institution portions, and returns must be made to the U.S. Department of Education (ED) within 45 days of the school’s determination that a student has withdrawn. The school must retain documentation supporting both the calculation and the timeliness of returns. Condition: The College failed to complete R2T4 calculations as required for recipients that ceased to be enrolled prior to the end of the period of enrollment. Additionally, the College was unable to provide documentation that returns were sent to the Department of ED; thus, REDW was unable to determine if returns completed as required within the 45-day required timeframe. Cause: These errors were caused by a lack of adequate controls and procedures for ensuring the completion and accuracy of R2T4 calculations, including proper identification of withdrawal dates, and timely return and documentation of Title IV funds. Additionally, there was insufficient staff training and oversight in the R2T4 process. Effect: Title IV funds were not calculated for all recipients who ceased to be enrolled as required and returns were not completed as required leading to noncompliance with grant requirements. Noncompliance exposes the College to audit findings, potential liabilities, and the risk of further federal sanctions as well as possible overpayment of fund recipients. Known Questioned Costs: $11,007. Likely Questioned Costs: $25,968. Total Questioned Costs: $36,975. Context: We selected a sample out of Pell recipients that withdrew during the audit period. We reviewed support and determined if the College accurately calculated the return of Title IV funds, allocated the returns as required, returned the funds timely and followed requirements for post-withdrawal disbursements. During our testing, we determined that the College did not calculate the return of funds as required for 5 out of 12 individuals. Additionally, the College was unable to provide documentation of returns sent to the Department of ED, thus, REDW was unable to determine if returns were completed. Recommendation: We recommend that the College implement enhanced controls for the Return of Title IV Funds process, including; proper identification of student withdrawals, verification of calculation accuracy, and procedures to ensure the return of funds within the required timeframe. The College should also retain detailed documentation of all returns and the corresponding dates. Staff should receive formal training on R2T4 requirements and managers should periodically review R2T4 calculations and records for ongoing compliance. Management’s Response: The College concurs with this finding. Management will implement adequate controls to ensure completion and accuracy of R2T4 calculations, including proper identification of withdrawal date, and timely return and documentation of Title IV funds. Management will provide training to relevant staff to ensure all processes including return of Title IV funds are accurate and timely.
2025-011 — Enrollment Reporting (Special Test #6)– Material Weakness in Internal Control Over Compliance and Noncompliance (Repeat of Finding 2024-010) Federal program information: Funding agencies: U.S. Department of Education Titles: SFA Cluster ALN Number: 84.063 and 84.007 Award years: 2025 Criteria: According to 34 CFR Section 690.83(b)(2), institutions are required to report enrollment information under the Pell Grant via the NSLDS. Condition: The College failed to report enrollment data during the audit period. Cause: Due to staffing issues, the College did not complete the submission. Effect: The enrollment information that appears on the NSLDS Professional Access website which the administration of the Title IV program depends on heavily to be accurate and up to date is missing information from the College. Questioned Costs: None. Context: The College did not accurately report enrollment information for the Pell Grant. Recommendation: The College should comply with grant requirements and submit Enrollment Reporting. Management’s Response: The College concurs with this finding. The College will ensure that NSLDS reporting is completed accurately and timely.
2025-012 — Gramm-Leach-Bliley Act - Student Information Security (Special Test #11) – Material Weakness in Internal Control Over Compliance and Noncompliance (Repeat of Finding 2024-011) Federal program information: Funding agencies: U.S. Department of Education Titles: SFA Cluster ALN Number: 84.063 and 84.007 Award years: 2025 Criteria: According to 16 CFR 314. The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information sharing practices to their customers and to safeguard sensitive data. The Federal Trade Commission considers Title IV-eligible institutions that participate in the Title IV Education Assistance programs as “financial institutions” and subject to the GLBA. Institutions must protect student financial aid information, with particular attention to information. Condition: Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts and includes specific elements. The College did not have a comprehensive information security program in place, written or otherwise, that met the specific elements. Cause: The College’s IT control environment is lacking certain key controls. There are currently no formalized IT policies and procedures, sufficient data backup processes, or a formalized disaster recovery plan. IT controls are not in place to ensure nonauthorized individuals are restricted from adding new vendors, recording journal entries, and making/or changes to employee pay records. Effect: The College is not in compliance with the requirements of the program and student data may be compromised without policies in place to ensure otherwise. Questioned Costs: None. Context: The College is not in compliance with the GLBA requirements. Recommendation: The College should comply with grant requirements and develop, implement, and maintain a comprehensive security program that includes the specific elements required. Management’s Response: The College concurs with this finding. Management is in process of developing, implementing, and maintaining a comprehensive information security program and a formalized disaster recovery plan as required by the GLBA. IT controls will be implemented to ensure nonauthorized individuals are restricted from adding new vendors, recording journal entries, and making/or changes to employee pay records.