Finding 2025-002: Documentation of Internal Controls over Compliance Material Weakness Material Weakness Federal Program: Student Financial Assistance Cluster Federal Agency: Department of Education Federal Award Year: August 1, 2024–July 31, 2025 Criteria: In accordance with Uniform Guidance (2 CFR §200.303), nonfederal entities are required to establish and maintain effective internal controls over federal programs that provide reasonable assurance of compliance with applicable laws, regulations, and the terms and conditions of federal awards. Effective internal control over compliance includes: • Documented policies and procedures addressing applicable compliance requirements; and • Control activities that are properly designed, implemented and documented, including evidence of review to demonstrate performance of controls. Condition: We noted that controls identified by management over all material compliance requirements lack sufficient documentation to conclude application of controls is in place. Cause: Employee turnover and lack of documented control policies around student financial aid compliance requirements. Effect or Potential Effect: Ineffective internal control procedures and no physical indication of review or an audit trail that indicates that the identified control took place could result in instances of noncompliance with Department of Education and federal regulations. Questioned Costs: None Context: During our testing of material compliance requirements under the student financial aid cluster, RSM could not sight any indication of controls in place for the following direct and material compliance requirements: • Cash management • Reporting • Eligibility • Special tests and provisions—disbursements to students • Special tests and provisions—credit balances • Special tests and provisions— National Student Loan Data System (NSLDS) reporting • Special tests and provisions—Gramm-Leach-Bliley Act (GLBA) (Student Information Security) Repeat Finding: Yes—see Finding 2024-003. Recommendation: We recommend that management perform a comprehensive review of the Student Financial Assistance (SFA) Cluster compliance requirements related to the Direct Loan Program and develop and implement formal, written policies and procedures addressing the processes and controls designed to ensure compliance with those requirements. Strengthening formal documentation and ensuring evidence of review will enhance the organization’s control environment and support the effective operation of internal controls over compliance, reducing the risk that noncompliance with Direct Loan requirements is not prevented or detected in a timely manner. Views of Responsible Officials: Management agrees with the finding. See corrective action plan.
Finding 2025-003: Special Tests and Provisions—NSLDS Enrollment Reporting Noncompliance Material Weakness and Material Noncompliance Federal Program: Student Financial Assistance Cluster Federal Agency: Department of Education Federal Award Year: August 1, 2024–July 31, 2025 Criteria: Auditee requirements contained in Title 2 U.S. Code of Federal Regulations (2 CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, requires the auditee to comply with federal statues, regulations, terms and conditions of federal awards that may have a direct and material effect on each of its major programs. The NSLDS enrollment reporting compliance requirement, which falls under special tests and provisions, requires the Institute to certify enrollment information under the Direct loan programs every 60 days. Condition: Instances of noncompliance have been identified where student enrollment changes were not reported to the NSLDS within the 60-day requirement. Cause: The cause is due to a lack of sufficient internal control procedures in place to ensure compliance. Effect: The Institute has material noncompliance with NSLDS enrollment reporting compliance requirements. Repeat finding: Yes—see Finding 2024-002. Questioned costs: None. Context: The condition was identified through testing of the NSLDS enrollment reporting (special tests and provisions) compliance requirement. All four of four students tested (100%) had enrollment status changes that were reported to NSLDS outside of the required 60-day time frame. Recommendation: We recommend that the Institute strengthen internal controls over NSLDS enrollment reporting compliance within the Student Financial Assistance Cluster to ensure that all required enrollment status changes are reported within the mandated 60-day time frame. Specifically, management should: • Develop and implement formal, written policies and procedures governing NSLDS enrollment reporting, clearly outlining timelines, requirements and responsible personnel. • Establish control activities to ensure timely identification and reporting of enrollment status changes, including defined processes for tracking report due dates and submission status. • Implement monitoring controls (e.g., periodic reconciliation of enrollment records to NSLDS submissions) to identify any missed or delayed reporting. • Require documented evidence of review, such as signed and dated reports or system-based approval logs, to demonstrate that submissions are reviewed for completeness and timeliness prior to certification. Strengthening these controls will help ensure compliance with NSLDS reporting requirements, reduce the risk of future instances of noncompliance, and address the recurrence of this finding. Views of Responsible Officials: Management agrees with the finding. See corrective action plan.
Finding 2025-004: Reconciliation Between Common Origination and Disbursement (COD) System and The Institute’s Internal Records Material Weakness Federal Program: Student Financial Assistance Cluster Federal Agency: Department of Education Federal Award Year: August 1, 2024–July 31, 2025 Criteria: Auditee requirements contained in 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, requires the auditee to comply with Federal statues, regulations, terms, and conditions of Federal awards that may have a direct and material effect on each of its major programs. Under the Student Financial Assistance Cluster, Institutions are expected to perform regular reconciliations between institutional records and COD data to ensure completeness and accuracy of reported information. Condition: During our testing of the Student Financial Assistance Cluster, we noted that the Institute did not perform monthly reconciliations between its internal records and COD system data. Cause: The cause is due to a lack of sufficient internal control procedures in place to ensure compliance. Effect:. The Institute is at risk of inaccurate or unsupported COD reporting, as discrepancies may not be identified and corrected in a timely manner without reconciliation procedures. In addition, the lack of reconciliations increases the risk that errors or additional instances of noncompliance may not be prevented, or detected and corrected, on a timely basis. Repeat finding: No. Questioned costs: None. Context: The condition was identified through testing of reporting (COD submission) compliance requirements where there was no evidence that could be provided of monthly reconciliations between the COD system data and the Institute’s internal records. Recommendation: We recommend that management: • Implement a process to perform monthly reconciliations between institutional records, general ledger activity, and COD system data. • Maintain documentation evidencing preparation and review of reconciliations and COD reporting activities. Views of Responsible Officials: Management agrees with the finding. See corrective action plan.
Finding 2025-005: Special Tests and Provisions—Credit Balances Noncompliance Material Weakness and Material Noncompliance Federal Program: Student Financial Assistance Cluster Federal Agency: Department of Education Federal Award Year: August 1, 2024–July 31, 2025 Criteria: Auditee requirements contained in 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, requires the auditee to comply with Federal statues, regulations, terms, and conditions of Federal awards that may have a direct and material effect on each of its major programs. Under 34 CFR § 668.164, institutions must refund Title IV credit balances within 14 days. Condition: During our testing of the Student Financial Assistance Cluster, we identified an instance in which the Institute did not refund a Title IV credit balance within the required 14-day time frame. Cause: The condition is due to a lack of sufficient internal control procedures in place to ensure timely identification and refunding of Title IV credit balances in accordance with program requirements. Effect: As a result, the Institute is not in compliance with Title IV credit balance requirements, and there is an increased risk that students may not receive funds to which they are entitled in a timely manner, and additional instances of noncompliance may occur and not be detected promptly. Repeat finding: No. Questioned costs: None. Context: The condition was identified through testing of the Title IV credit balance special test and provisions compliance requirement. The exception noted (1 of 8 items tested) indicates that the Institute did not consistently comply with required timelines for refunding credit balances to students. Recommendation: We recommend that management implement procedures to ensure: • Title IV credit balances are identified and tracked timely; • Refunds are issued to students within the required 14-day time frame; and • Processes are in place to monitor compliance with refund timing requirements on an ongoing basis. Views of Responsible Officials: Management agrees with the finding. See corrective action plan.
Finding 2025-006: Special Tests and Provisions—GLBA Noncompliance Material Weakness and Material Noncompliance Federal Program: Student Financial Assistance Cluster Federal Agency: Department of Education Federal Award Year: August 1, 2024–July 31, 2025 Criteria: Auditee requirements contained in 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, requires the auditee to comply with federal statues, regulations, terms and conditions of federal awards that may have a direct and material effect on each of its major programs. The Gramm-Leach-Bliley Act over student information security, requires the Institute to have a written information security program that addresses seven specific required elements. Condition: The Institute does not have a written information security program that addresses the seven required elements under the GLBA. Cause: The condition was identified through testing of the GLBA student information security compliance requirement. While the Institute has an existing written information security program, our review determined that the program does not address all required elements, as it omits certain key components, including risk assessment and ongoing monitoring activities. Effect: The Institute is not in compliance with the GLBA. Repeat finding: Yes—see finding 2024-002. Questioned costs: None. Context: While the Institute has a written information security program, it does not include the required seven elements which includes risk assessment and monitoring. Recommendation: We recommend that the Institute develop and implement a comprehensive, formalized written information security program that fully addresses all required elements under the GLBA for student information security. Specifically, management should: • Review current GLBA requirements to ensure the program incorporates all required elements applicable to the safeguarding of student information. • Update the existing information security program to include key components such as risk assessment, identification of foreseeable risks, implementation of safeguards, and ongoing monitoring of controls. Views of Responsible Officials: Management agrees with the finding. See corrective action plan.
Finding 2025-007: 2024 Data Collection Form (DCF) Late Filing Material Weakness and Other Matter Noncompliance Federal Program: Student Financial Assistance Cluster Federal Agency: Department of Education Federal Award Year: August 1, 2024–July 31, 2025 Criteria: In accordance with 2 CFR § 200.512, the auditee is required to electronically submit the DCF and reporting package to the Federal Audit Clearinghouse (FAC). Additionally, Uniform Guidance requires the reporting package to be submitted the earlier of 30 calendar days after receipt of the auditor’s reports or nine months after the end of the audit period. Condition: The Institute did not submit the fiscal year 2024 DCF and related reporting package to the Federal Audit Clearinghouse within the required time frame. Cause: The delay in submission was due to inadequate processes and controls to ensure timely completion, review, and certification of the DCF and reporting package prior to the filing deadline. Effect: Failure to submit the DCF within the required time frame results in noncompliance with federal reporting requirements, which may impact federal oversight and could subject the auditee to increased scrutiny from federal agencies or pass-through entities. Repeat finding: No. Questioned costs: None. Context: Based on review of the submission records, the reporting package, including the DCF, was submitted after the required deadline, resulting in noncompliance with Uniform Guidance reporting requirements. Recommendation: We recommend that management strengthen the control environment over Uniform Guidance compliance by establishing clear accountability for the timely completion of audit requests, preparation and review of the reporting package, and submission of the DCF. Formalized responsibilities, documented review procedures, and management oversight should be implemented to ensure compliance requirements are completed accurately and within required deadlines. Views of Responsible Officials: Management agrees with the finding. See corrective action plan.