Audit 409730

Finding: 2025-002 U.S. Department of Education Student Financial Assistance Cluster Gramm Leach Bliley Act (GLBA) Criteria Institutions participating in the Student Financial Assistance (SFA) program are required to comply with GLBA. Context Based on review of the College's information security program and related documentation, it was identified that multiple required elements of the GLBA were not implemented or documented. Condition The College has implemented certain information security policies and procedures; however, several key requirements of the GLBA have not been met or are not regularly updated. Specifically, the College has not performed a documented risk assessment and its written information security program has not been updated in multiple years and does not include all of the eight minimum safeguards. In addition, the College does not perform documented monitoring or testing of security safeguards, and it has not established a formal vendor management program in accordance with GLBA. Cause The College has not established formal policies to ensure compliance with the GLBA requirements. Resource constraints and competing priorities were contributing factors. Effect The College is not fully compliant with GLBA requirements. Questioned Costs Not applicable because the finding consisted solely of noncompliance with the reporting type of compliance requirements. Recommendation We recommend that the College develop and implement formal written policies for all minimum elements required by GLBA. Views of Responsible Officials The College acknowledges the recommendation and is committed to implementing formal written policies for all minimum elements required by GLBA.

Finding: 2025-003 U.S. Department of Education Student Financial Assistance Cluster National Student Loan Data System (NSLDS) Reporting Criteria The federal government requires the College to report student enrollment data to the U.S. Department of Education’s National Student Loan Data System (NSLDS) system at least every 60 days, and to certify the enrollment status of the students as submitted. Enrollment status changes such as withdrawals must be submitted at a minimum during this 60-day certification process, but may report at more frequent intervals to capture more current enrollment status changes. Condition During testing of enrollment reporting, it was noted that enrollment status changes for certain students were not reported to NSLDS within the required timeframe. Context During testing of enrollment reporting, it was identified that for three of four students selected for testing, the student’s withdrawal information was not reported within the required timeframe. Cause Turnover within the Registrar's Office and the transition of enrollment reporting responsibilities resulted in gaps in the enrollment reporting process, causing student status changes to not be reported to NSLDS within the required 60-day timeframe. Effect Failure to timely report enrollment status changes may result in inaccurate student loan records within NSLDS and could delay changes to borrowers' loan repayment status, resulting in noncompliance with federal enrollment reporting requirements. Questioned Costs Not applicable because the finding consisted solely of noncompliance with the reporting type of compliance requirements. Recommendation We recommend that the College develop and implement formal policies and procedures for monitoring and reporting enrollment status changes to NSLDS. These procedures should clearly assign reporting responsibilities, establish timelines and review controls, and provide for supervisory oversight to ensure enrollment changes are identified and reported within required timeframes. Additionally, the College should implement cross-training and succession planning measures to reduce the risk of reporting delays resulting from staff turnover or personnel changes. Views of Responsible Officials The College acknowledges the recommendation and has established appropriate policies and procedures for reporting enrollment status changes to NSLDS.