Audit 396779

FY End
2025-06-30
Total Expended
$9.79M
Findings
8
Programs
7
Organization: Cornell College (IA)
Year: 2025 Accepted: 2026-03-31

Organization Exclusion Status:

Checking exclusion status...

Findings

ID Ref Severity Repeat Requirement
1205102 2025-001 Material Weakness Yes N
1205103 2025-001 Material Weakness Yes N
1205104 2025-001 Material Weakness Yes N
1205105 2025-001 Material Weakness Yes N
1205106 2025-001 Material Weakness Yes N
1205107 2025-001 Material Weakness Yes N
1205108 2025-001 Material Weakness Yes N
1205109 2025-001 Material Weakness Yes N

Programs

Contacts

Name Title Type
ET4AQ6MDU1L7 Robert Levis Auditee
3198954334 Daniel Persaud Auditor
No contacts on file

Notes to SEFA

The accompanying schedule of expenditures of federal awards (the Schedule) includes the federal award activity of the College under programs of the federal government for the year ended June 30, 2025. The information in this Schedule is presented in accordance with the requirements of 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance). Because the Schedule presents only a selected portion of the operations of the College, it is not intended to, and does not, present the financial position, changes in net assets, or cash flows of the College.
Outstanding balance of Perkins loans administered by Cornell College at June 30, 2025 and loans advanced during the year were as follows: Loan Loans Balance Advanced Federal Perkins Loan Program (CFDA #84.038) $102,231 $-
The College is in compliance with the following institutional and program eligibility requirements under the Higher Education Act of 1965 and Federal regulations under 34 CFR 668.23: • Correspondence courses the institution offers under 34 CFR 600.7(b) and (g); • Regular students that enroll in correspondence courses under 34 CFR 600.7(b) and (g); • Institution’s regular students that are incarcerated under 34 CFR 600.7(c) and (g); • Completion rates for confined or incarcerated individuals enrolled in non-degree programs at nonprofit institutions under 34 CFR 600.7(c)(3)(ii) and (g); • Institution’s regular students that lack a high university diploma or its equivalent under 34 CFR 600.7(d) and (g); • Completion rates for short-term programs under 34 CFR 668.8(f) and (g); • Placement rates for short-term programs under https://www.ecfr.gov/current/title-34/subtitle-B/chapter-VI/part-668/subpart-A/section-668.8 34 CFR 668.8(e)(2).

Finding Details

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Various Award Period: July 1, 2024 through June 30, 2025 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The written information security program (WISP) for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its written information security program are at 16 CFR 314.4. At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Condition: Under a College’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the College did not have documented in its Written Information Security Program the need for periodic reviews of user access controls. In addition, there was no evidence that the Written Information Security Program was evaluated and adjusted based on monitoring results, risk assessments and penetration tests within the audit period. Cause: There was turnover with the information technology department at the College and as such certain items were missed as it relates to the GLBA requirements. Effect: The student personal information could be vulnerable. Repeat Finding: Yes