2025-003 Special Tests and Provisions Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing No. 84.063, 84.268 Federal Award Identification Number and Year: P063P248567 – 2025, P268K258567 – 2025, P268K256514 - 2025 Award Periods: July 1, 2024 through June 30, 2025 Type of Finding: Significant Deficiency in Internal Control Over Compliance Other Matters Criteria or specific requirement: Per Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. The Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Changes to said status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days. The Code of Federal Regulations, 34 CFR 685.309(b), states the school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date. Condition: The University did not properly report student enrollment changes for students who received federal student aid to the National Student Loan Data System (NSLDS). Questioned Costs: None Context: During our testing of 17 students, we identified 1 student whose enrollment status change was not reported, 2 students with incorrect status changes reported for program-level reporting, 2 students with an incorrect effective date reported, and 9 students whose status changes were not reported in a timely manner. We also identified that for all 17 of the selected students, enrollment status was not certified every 60 days. Additionally. the University did not document any evidence of review over enrollment reporting. Cause: The University did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: The University was not in compliance with the requirements to properly report student enrollment data correctly. Incorrect dates submitted to NSLDS may be used to determine the grace period for the repayment and interest of outstanding Title IV student loans. Repeat findings: 2024-004 Recommendation: We recommend the University review current processes for reporting to NSLDS and implement procedures to ensure submissions are reported timely and accurately. Views of Responsible Officials: There is no disagreement with the audit finding.
2025-004 Special Tests and Provisions Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing No. 84.063, 84.268 Federal Award Identification Number and Year: P063P248567 – 2025, P268K258567 – 2025, P268K256514 - 2025 Award Periods: July 1, 2024 through June 30, 2025 Type of Finding: Significant Deficiency in Internal Control Over Compliance Other Matters Criteria or specific requirement: 34 CFR 668.21(a) states that the institution must return all title IV, HEA program funds that were credited to the student's account at the institution or disbursed directly to the student for the payment period. The institution must return those funds no later than 30 days after the date that the institution becomes aware that the student will not or has not begun attendance. Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University did not properly evaluate students in need of Return of Title IV (R2T4) calculations. Questioned Costs: None Context: During our testing of 5 R2T4 calculations, we identified 2 students with no R2T4 calculation performed. These students attended more than 60% of the term and did not require returned funds. Additionally, we identified 3 R2T4 calculations that did not have documentation of review. Cause: The University did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: The University could return incorrect amounts based off of their calculations and incorrect calculations could effect student repayment amounts based off of amount earned. Repeat findings: 2024-005 Recommendation: We recommend that the University review policies and procedures related to R2T4 calculations to ensure calculations are performed accurately. Views of Responsible Officials: There is no disagreement with the audit finding.
2025-005 Special Tests and Provisions Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing No. 84.063, 84.268 Federal Award Identification Number and Year: P063P248567 – 2025, P268K258567 – 2025, P268K256514 - 2025 Award Periods: July 1, 2024 through June 30, 2025 Type of Finding: Significant Deficiency in Internal Control Over Compliance Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The regulation states that the college must designate a qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program. (16 CFR 314.4(a)). The entity shall have a Written Information Security Program (WISP) that outlines the design and implementation of the risk assessment procedures. (16 CFR 314.4(b)). At a minimum, the institution's written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University has a Written Information Security Program; however, the University did not meet the minimum requirements stated in the Gramm-Leach-Bliley Act. Additionally, we were unable to observe evidence that the WISP was formally reviewed and approved. Questioned Costs: None Context: The WISP was missing the element discussing the secure disposal of customer information. Additionally, there was not an observable formal review or authorization.. Cause: The University did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: There is a risk the University’s information and systems could be vulnerable to attacks or intrusions, and these attacks may not be detected in a timely manner. Repeat findings: 2024-006 Recommendation: We recommend that the University review the GLBA requirements and ensure their WISP includes all required elements. Views of Responsible Officials: There is no disagreement with the audit finding.
2025-006 Eligibility Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing No. 84.063, 84.268 Federal Award Identification Number and Year: P063P248567 – 2025, P268K258567 – 2025, P268K256514 - 2025 Award Periods: July 1, 2024 through June 30, 2025 Type of Finding: Significant Deficiency in Internal Control Over Compliance Other Matters Criteria or specific requirement: Per Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Per 34 CFR 690.62 states the Pell grant for an academic year is based upon the payment and disbursement schedule published by the Secretary for each award year. 34 CFR 690.80(b)(1)) states if the student’s enrollment status changes from one academic term to another within the same award year, the institution shall recalculate the Federal Pell Grant award for the new payment period taking into account any changes in the cost of attendance. Condition: The University used a third-party servicer to perform key controls, but did not have documented review of the work performed by their third-party servicer. Additionally, the University incorrectly disbursed Pell funds for 10 students. Questioned Costs: $12,949 Context: During our eligibility testing of 60 students, we identified that the University did not document evidence of review for controls over award packaging performed by their third party servicer. Additionally, out of 43 students receiving Pell, 10 were under awarded. Cause: The University did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: Without proper controls the University risks being out of compliance with federal laws and regulations, as well as program compliance requirements. Repeat findings: 2024-007 Recommendation: We recommend the University review its current procedures for awarding Title IV funds and implement any changes necessary to ensure federal funds are awarded and disbursed in accordance with federal regulations. Views of Responsible Officials: There is no disagreement with the audit finding.
2025-007 Special Tests and Provisions Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing No. 84.063, 84.268 Federal Award Identification Number and Year: P063P248567 – 2025, P268K258567 – 2025, P268K256514 - 2025 Award Periods: July 1, 2024 through June 30, 2025 Type of Finding: Significant Deficiency in Internal Control Over Compliance Other Matters Criteria or specific requirement: Per Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University was unable to provide documentation of review for controls surrounding credit balance disbursements. Questioned Costs: None Context: The University did not have documented review of controls to ensure credit balance funds that were not successfully disbursed to the student were returned to the Department of Education after 240 days. Cause: The University did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: Without proper controls the University risks being out of compliance with federal laws and regulations, as well as program compliance requirements. Repeat findings: No Recommendation: We recommend the University design controls to ensure an adequate review process is in place to ensure compliance over stale checks that need to be returned to the Department of Education after 240 days. Views of Responsible Officials: There is no disagreement with the audit finding.
2025-008 Cash Management Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing No. 84.063, 84.268 Federal Award Identification Number and Year: P063P248567 – 2025, P268K258567 – 2025, P268K256514 - 2025 Award Periods: July 1, 2024 through June 30, 2025 Type of Finding: Significant Deficiency in Internal Control Over Compliance Other Matters Criteria or specific requirement: Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University did not have documentation that Direct Loan Reconciliations or Pell Reconciliations prepared by third-party servicer were reviewed. Additionally, we were unable to observe evidence that the University reviewed cash drawdowns prepared by the third party processor. Questioned Costs: None Context: During our testing, we reviewed 4 months of direct loan reconciliations that the University's third party servicer prepares; however, Urshan was unable to provide documentation of review for these reconciliations. Additionally, during our testing of 5 draws, we identified that all 5 draws did not have documented evidence of review. Cause: The University did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: Without proper controls the University risks being out of compliance with federal laws and regulations, as well as program compliance requirements. Repeat findings: 2024-009 Recommendation: We recommend that the University should implement formal review procedures to document that the Cash Management reconciliation and drawdown reviews are being performed to correct errors in a timely manner and to minimize the likelihood of errors going undetected. Views of Responsible Officials: There is no disagreement with the audit finding.
2025-009 Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing No. 84.063, 84.268 Federal Award Identification Number and Year: P063P248567 – 2025, P268K258567 – 2025, P268K256514 - 2025 Award Periods: July 1, 2024 through June 30, 2025 Type of Finding: Significant Deficiency in Internal Control Over Compliance Other Matters Criteria or specific requirement: Per Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University used a third-party servicer to perform key controls, but did not have documented review of the work performed by their third-party servicer. Additionally, 1 disbursement was incorrectly reported to COD. Questioned Costs: None Context: During our testing of 60 COD disbursements, we noted 1 disbursement that was incorrectly reported. We also noted that the University did not have documentation of review for COD disbursements. Cause: This discrepancy resulted from the student being initially packaged by Campus Ivy using the 01 ISIR transaction, which reflected an SAI of -1500. Subsequent ISIR transactions that significantly impacted eligibility were not identified prior to packaging. These discrepancies were later identified during the University’s internal HCM2 reconciliation process in collaboration with FA Solutions, resulting in a mismatch between awarded aid and COD records. Effect: Without proper controls the University risks being out of compliance with federal laws and regulations, as well as program compliance requirements. Repeat findings: No Recommendation: We recommend the University design controls to ensure an adequate review process is in place to ensure compliance with reporting requirements. Views of Responsible Officials: There is no disagreement with the audit finding.