Audit 411931

Identification of the Federal Program: U.S. Department of Education Federal Pell Grant Program (ALN: 84.063) and Federal Direct Stafford Loans (ALN: 84.268) Criteria: N. Special Tests and Provisions - The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the GLBA because they appear to be significantly engaged in wiring funds to consumers. Under an institution’s Program Participation Agreement with the Department of Education (ED) and the GLBA, institutions must protect student financial aid information, with particular attention to information provided to institutions by ED or otherwise obtained in support of the administration of the federal student financial aid programs. Accordingly, institutions are required to develop, implement, and maintain a written comprehensive information security program. Condition: During our audit procedures, we noted that Centra’s written information security program did not entirely meet all minimum requirements of the GLBA and therefore was not fully in compliance with the requirement. Cause: Insufficient internal controls and administrative oversight with respect to the Special tests and provisions (N) compliance requirement. Effect or Potential Effect: Centra is not fully in compliance with the GLBA requirement for the year ended December 31, 2025. Questioned costs: None Context: Centra had designated a qualified individual responsible for overseeing and implementing and enforcing an information security program (16 CFR 314.4(a)) and have completed the risk assessment (16 CFR 314.4(b)), as required by the GLBA. However, three of the seven GLBA Safeguards Rule elements set forth in 16 CFR 314.4(c), (d), and (g) were still in process of being fully implemented as of December 31, 2025. Repeat finding: This is a repeat of prior year finding 2024-001. Recommendation: We recommend that Centra maintain appropriate internal controls and administrative oversight in order to fully comply with the GLBA requirements of 16 CFR 314.4(c), (d), and (g). Such would include (i) design and implementation of safeguards, (ii) regularly test and monitor the safeguards, and, (iii) adjust the program in light of results of testing and monitoring. View of Responsible Officials: Centra management agrees with this finding and is in process of implementing a corrective action plan. Management indicated that the institution was fully compliant with 11 of the 15 required security controls and partially compliant with the remaining four controls. Management further indicated that mitigating measures had been established for the four controls not yet fully implemented and that efforts were underway to expand those measures to achieve full compliance. Additionally, one additional control is expected to be finalized by the end of July 2026, the remaining applicable controls are expected to be addressed by the end of September 2026, and one control will continue to be addressed through a mitigating measure until the Student Information System (SIS) is replaced.

Identification of the Federal Program: U.S. Department of Education Federal Pell Grant Program (ALN: 84.063) and Federal Direct Stafford Loans (ALN: 84.268) Criteria: As per the OMB Compliance Supplement (N. Special Tests and Provisions - 6. National Student Loan Data System (NSLDS) Reporting), institutions are responsible for accurately reporting all Campus-Level Record data elements. One of these data elements is the certification date. The certification date is the date the enrollment was certified by the institution. At a minimum, institutions are required to certify enrollment every 60-days or every other month. Condition: During our testing of Campus-level enrollment reporting, we noted that 1 of the 11 sampled student’s enrollment was not reported to NSLDS within the required 60-day timeframe. Cause: Insufficient internal controls and administrative oversight with respect to the Special tests and provisions (N) compliance requirement. Effect or Potential Effect: Centra is not fully in compliance with one of the NSLDS Reporting requirements for the year ended December 31, 2025. Questioned costs: None Context: We tested a sample of 11 students at the Campus-level enrollment reporting requirements and found exceptions as noted in the condition. This is a condition identified per review of the Centra’s compliance with specified requirements using a statistically valid sample. Repeat finding: No Recommendation: We recommend that Centra maintain appropriate internal controls and administrative oversight in order to fully comply with the NSLDS reporting requirements. View of Responsible Officials: Centra’s management stated that the exception resulted from a combination of process transition, limited formal training on NSLDS reporting requirements and internal procedures during the transition period, and program-specific reporting practices related to summer enrollment. Management indicated that a qualified individual was designated in 2025 to oversee the reporting process; however, during the period under audit, the processes in place did not identify all students for reporting within the required timeframe. Management further stated that, after the matter was identified, the Financial Aid and Compliance Officer took steps to enhance her understanding of applicable NSLDS reporting requirements and implemented improved tracking procedures intended to support more complete and timely reporting going forward.