Audit 397139

Return of Title IV Funds (R2T4) – Untimely Return of Unearned Title IV Funds. Recommendation We recommend that management strengthen controls over the Return of Title IV Funds process by implementing procedures to ensure that required returns are submitted within the 45-day regulatory timeframe. This may include formal tracking of withdrawal determination dates, periodic supervisory review of pending R2T4 returns, and documented follow-up procedures to ensure timely submission. Federal Program Student Financial Aid Cluster Federal Supplemental Educational Opportunity Grant (ALN 84.007) Federal Pell Grant Program (ALN 84.063) Federal Direct Student Loans (ALN 84.268) Compliance Requirement Return of Title IV Funds (R2T4) Criteria Federal regulations require that when a Title IV recipient withdraws from an institution prior to completing the payment period or period of enrollment, the institution must return any unearned Title IV funds no later than 45 days after the date the institution determines that the student withdrew (34 CFR §668.22(j)). Institutions are required to establish internal controls to ensure withdrawals are identified timely, R2T4 calculations are accurate, and required returns are made within prescribed timeframes. Condition During our testing of compliance with the Return of Title IV Funds requirements, we identified that required returns of unearned Title IV funds were not made within the 45-day regulatory timeframe. Specifically, for all 7 students who withdrew during the audit period and were selected for testing, the institution returned unearned Title IV funds between 69 and 118 days after the withdrawal determination date. While the institution accurately identified withdrawals, correctly determined withdrawal dates, and accurately calculated the amount of Title IV aid earned and unearned, returns were consistently processed after the required deadline. Cause The institution did not have effective controls in place to ensure that R2T4 returns were processed and submitted within the required 45-day timeframe. Although R2T4 calculations were prepared and reviewed, the control procedures did not include adequate monitoring or escalation to ensure timely submission of required returns. Effect Failure to return unearned Title IV funds within required timeframes constitutes noncompliance with federal regulations. Although all required funds were ultimately returned and no calculation errors were identified, untimely returns increase the risk of improper retention of federal funds and may subject the institution to administrative action or penalties by the U.S. Department of Education. Questioned Costs None. All unearned Title IV funds were ultimately returned, and no amounts were identified as ineligible or improperly calculated.

Federal Program Student Financial Aid Cluster Federal Supplemental Educational Opportunity Grant (ALN 84.007) Federal Pell Grant Program (ALN 84.063) Federal Direct Student Loans (ALN 84.268) Compliance Requirement Special Tests and Provisions – Information Security Criteria The GLBA Safeguards Rule requires covered institutions to develop, implement, and maintain a written information security program containing administrative, technical, and physical safeguards to protect customer information. [ftc.gov], [ecfr.gov] Condition VEEB is subject to the requirements of the Gramm-Leach-Bliley Act (GLBA) Safeguards Rule. During the audit, it was noted that VEEB does not have a written information security program as required by 16 CFR Part 314. While certain informal information security practices may be in place, the absence of a formally documented program does not meet GLBA requirements. Cause Management has not formalized information security policies and procedures into a written information security program. Effect Without a written information security program, VEEB is not in full compliance with GLBA requirements applicable to its participation in federal student financial assistance programs. This increases the risk that sensitive student information may not be adequately safeguarded. Questioned Costs None. Recommendation We recommend that management develop, implement, and maintain a written information security program that complies with the GLBA Safeguards Rule, including documented administrative, technical, and physical safeguards appropriate to the size and complexity of the organization.