Audit 397241

2025-101 Funds to be Returned Worksheets Not Documented as Being Independently Reviewed Assistance Listing Number: 84.063 Program Title: Federal Pell Grant Program Compliance Requirement: Special Tests and Provisions – Return of Title IV Funds Federal Agency: United States Department of Education FAIN and year: P063P203385, 2024-2025 Finding Type: Material Weakness in Internal Control Known Questioned Costs: $0 Criteria: 2 CFR section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Condition: Return of Funds R2T4 and Pell Grant Early Completer Re-Proration worksheets were calculated and funds properly returned, however the worksheets to determine the return of the funds were not signed off as having been independently reviewed and approved. While calculations are reviewed by someone other than the preparer, no documentation of the review is evident. Cause: Haney Technical School (School) staff review the worksheets but have not set up a formal policy where the independent reviewer signs off and dates the review of the worksheet. Effect: Incorrect amounts could be returned in error. Recommendation: The School should set up a formal policy where worksheets for the return of Title IV funds should include a signature and date of both the preparer and the reviewer. Management Response: See attached Corrective Action Plan.

2025-102 Return of Title IV Funds Not Made Within the Required Timeline Assistance Listing Number: 84.063 Program Title: Federal Pell Grant Program Compliance Requirement: Special Tests and Provisions – Return of Title IV Funds Federal Agency: United States Department of Education FAIN and year: P063P203385, 2024-2025 Finding Type: Significant Deficiency in Internal Control Known Questioned Costs: $0 Criteria: 2 CFR section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. Awards. Institutions are responsible for returning funds to students and Title IV programs as appropriate if students withdraw, drop out or are expelled from their program of study within a 45-day period from the date of withdrawal. Condition: Title IV funds for two of the nine students selected for testing for the return of Title IV funds were returned to the Department of Education after the 45-day time period. Cause: Human error resulted in delays in returning funds to the Department of Education. The controls in place are manual only and did not operate to prevent the late returns. Effect: Noncompliance with the return of funds could result in future loss of Pell Award funding. Recommendation: The School should implement a process possibly with the use of a software program that would identify when funds are due back based on the student’s withdrawal date. Management Response: See attached Corrective Action Plan.

2025-103 Multi-factor Authentication Not Required When Accessing Student Information Assistance Listing Number: 84.063 Program Title: Federal Pell Grant Program Compliance Requirement: Special Tests and Provisions – Gramm-Leach Bliley Act- Student Information Security Federal Agency: United States Department of Education FAIN and year: P063P203385, 2024-2025 Finding Type: Material Weakness in Internal Control Known Questioned Costs: $0 Criteria: 2 CFR section 200.303 requires that nonfederal entities receiving federal awards establish and maintain internal control over the federal awards that provides reasonable assurance that the nonfederal entity is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards. The institution’s written information security policy must address the implementation of safeguards identified in 16 CFR 314.4(c) which includes the implementation of multi-factor authentication for anyone accessing student information on the institution’s system. Condition: Multi-factor authentication has not been implemented on the District’s system in regards to access of student information. Cause: The security parameters for accessing student information do not include multi-factor authentication in conjunction with passwords when accessing student information from the District’s information system. Effect: Student information could be inappropriately accessed. Recommendation: The requirement for multi-factor authentication policy should be put in place. Management Response: See attached Corrective Action Plan.