Finding 2025-001: Internal controls within the Student Financial Assistance (SFA) IT Systems | Identification of the Federal Program: Federal Agency: United States Department of Education. Federal Cluster: Student Financial Assistance Cluster. Assistance Listing No.: 84.268 Federal Direct Student Loans (Direct Loans) and 84.063 Federal Pell Grant Program. Award Periods: July 1, 2024 through June 30, 2025; July 1, 2025 through June 30, 2026. Section III – Federal Award Findings and Questioned Costs (continued). Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Atrium Health CMHA has two primary student financial assistance (SFA) information technology (IT) systems and related applications that are used to process student financial assistance eligibility and disbursements as well as various other special tests and provisions required by the United States Department of Education. Internal controls over the accuracy and completeness of the data and applications within the SFA IT systems at Atrium Health CMHA were not evaluated for fiscal year 2025. Cause: Internal controls over the accuracy and completeness of the data and applications within the SFA IT systems at Atrium Health CMHA were not evaluated for fiscal year 2025. Effect or Potential Effect: The data used within the IT systems and applications may not be complete or accurate or the applications may not function as intended. Section III – Federal Award Findings and Questioned Costs (continued). Questioned Costs: None. Context: Total federal expenditures for the Student Financial Assistance Cluster recorded on the Schedule of Expenditures of Federal Awards (Schedule) totaled $3,348,141 for the year ended December 31, 2025. Identification as a Repeat Finding, if Applicable: This finding is a repeat finding of 2024-001 from the prior year. Recommendation: Atrium Health CMHA should implement internal controls to ensure the IT systems are tested or implement compensating controls to ensure the data is accurate and complete. Views of Responsible Officials: Management agrees with the finding and has developed a plan to correct the finding.
Finding 2025-002: SFA Review and Approval Internal Controls | Identification of the Federal Program: Federal Agency: United States Department of Education. Federal Cluster: Student Financial Assistance Cluster. Section III – Federal Award Findings and Questioned Costs (continued). Assistance Listing No.: 84.268 Federal Direct Student Loans (Direct Loans) and 84.063 Federal Pell Grant Program. Award Periods: July 1, 2024 through June 30, 2025; July 1 2025 through June 30, 2026. Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Atrium Health CMHA does not have review and approval internal controls or policies in place over the following compliance requirements: • Cash management • Eligibility • NSLDS Reporting. Cause: While Atrium Health CMHA has procedures in place to process and record student financial assistance transactions, internal controls are not in place to review and approve the underlying transactions, reports and policies. Section III – Federal Award Findings and Questioned Costs (continued). Effect or Potential Effect: The underlying data may not be complete and accurate resulting in Atrium Health CMHA being noncompliant with the applicable compliance requirements. Reports may not be complete and accurate. Policies may not be up to date with the Department of Education requirements. Questioned Costs: None. Context: Total federal expenditures for the Student Financial Assistance Cluster recorded on the Schedule totaled $3,348,141 for the year ended December 31, 2025. Identification as a Repeat Finding, if Applicable: This finding is a repeat finding of 2024-002 from the prior year. Recommendation: Atrium Health CMHA should develop and implement internal controls related to each of the compliance requirements to ensure the completeness and accuracy of the underlying data. Views of Responsible Officials: Management agrees with the finding and has developed a plan to correct the finding.
Finding 2025-003: Notification of Disbursements to or on Behalf of Students | Identification of the federal program: Federal Agency: United States Department of Education. Federal Cluster: Student Financial Assistance Cluster. Assistance Listing No.: 84.268 Federal Direct Student Loans (Direct Loans) and 84.063 Federal Pell Grant Program. Award Periods: July 1, 2024 through June 30, 2025; July 1, 2025 through June 30, 2026. Criteria or specific requirement (including statutory, regulatory or other citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” 34 CFR 668.165(a)(1) – Before an institution disburses title IV, HEA program funds for any award year, the institution must notify a student of the amount of funds that the student or his or her parent can expect to receive under each title IV, HEA program, and how and when those funds will be disbursed. If those funds include Direct Loan program funds, the notice must indicate which funds are from subsidized loans, which are from unsubsidized loans, and which are from PLUS loans. Condition: When Direct Loans are being credited to a student’s account, an institution must notify the student, or parent, in writing of (1) the date and amount of the disbursement; (2) the student’s right, or parent’s right, to cancel all or a portion of that loan or loan disbursement and have the loan proceeds returned to the holder of that loan; and (3) the procedure and time by which the student or parent must notify the institution that he or she wishes to cancel the loan. Atrium Health CMHA was unable to provide the notification letters sent to the student as they are not maintained.. Cause: The current IT system does not allow for the letters sent to be saved. Effect or potential effect: The disbursement notification letters may not have been sent in accordance with the regulations. Questioned costs: None. Context: Total expenditures for the Student Financial Assistance Cluster were $3,348,141 for the year ended December 31, 2025. We selected a sample of 40 disbursements and identified 40 that did not have notification of disbursement. Identification as a repeat finding, if applicable: This finding is a repeat finding of 2024-003 from the prior year. Recommendation: Atrium Health CMHA should implement internal controls to retain all disbursement notification letters sent to students. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.
Finding 2025-004: Gramm-Leach-Bliley Act (GLBA) – Student Information Security Controls | Identification of the Federal Program: Federal Agency: United States Department of Education. Federal Cluster: Student Financial Assistance Cluster. Assistance Listing No.: 84.268 Federal Direct Student Loans (Direct Loans) and 84.063 Federal Pell Grant Program. Award Periods: July 1, 2024 through June 30, 2025; July 1, 2025 through June 30, 2026. Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. Condition: Atrium Health CMHA did not have adequate internal controls in place surrounding the Information Security Program to ensure all required elements were in place. During our testing, we noted there was one element of the Information Security Program that was not in place during the year. Cause: Atrium Health CMHA did not implement one element of the Information Security Program during the year. Effect or Potential Effect: The Written Information Security Program is not compliant with federal regulations. Questioned Costs: None. Context: Total federal expenditures for the Student Financial Assistance Cluster recorded on the Schedule of Expenditures of Federal Awards (Schedule) totaled $3,348,141 for the year ended December 31, 2025. Identification as a Repeat Finding, if Applicable: This finding is a repeat finding of 2024-004 from the prior year. Recommendation: Atrium Health CMHA should design and implement internal controls over the Information Security Program to ensure all requirements of the GLBA are included in the written Information Security Program appropriately and operating. Views of Responsible Officials: Management agrees with the finding and has developed a plan to correct the finding.
Finding 2025-005: Fiscal Operations Report and Application to Participate (FISAP) Reporting | Identification of the Federal Program: Federal Agency: United States Department of Education. Federal Cluster: Student Financial Assistance Cluster. Assistance Listing No.: 84.268 Federal Direct Student Loans (Direct Loans) and 84.063 Federal Pell Grant Program. Award Periods: July 1, 2024 through June 30, 2025; July 1, 2025 through June 30, 2024. Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): Section 200.303 of Title 2 U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) states the following regarding internal control: “The non-Federal entity must: Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).Section 200.508 of Title U.S. Code of Federal Regulations Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) state the following: “The auditee must: (d) Provide the auditor access to personnel, accounts, books, records, supporting documentation, and any other information needed for the auditor to perform the audit required by this part. Condition: Atrium Health CMHA did not have adequate internal controls in place to retain supporting documentation in regards to Section D. Information on Enrollment and Section F. Information on Eligible Aid Applicants Enrolled in Your School for Award Year 2024-2025 of the FISAP. Cause: Atrium Health CMHA did not retain sufficient documentation to support the count of students used in Section D. Information on Enrollment and Section F. Information on Eligible Aid Applicants Enrolled in Your School for Award Year 2024-2025. Effect or Potential Effect: Incorrect information could be reported to the Department of Education. Questioned Costs: None. Context: Total federal expenditures for the Student Financial Assistance Cluster recorded on the Schedule of Expenditures of Federal Awards (Schedule) totaled $3,348,141 for the year ended December 31, 2025. Identification as a Repeat Finding, if Applicable: This finding is a repeat finding of 2024-005 from the prior year. Recommendation: Atrium Health CMHA should design and implement internal controls over FISAP reporting to ensure supporting documentation is maintained. Views of Responsible Officials: Management agrees with the finding and has developed a plan to correct the finding.
Finding 2025-006 | Information on the Federal Program: Federal Agency: Department of Homeland Security. Assistance Listing No.: 97.036 COVID-19 Disaster Grants – Public Assistance (Presidentially Declared Disasters) (FEMA). Pass-Through: North Carolina Department of Public Safety. Pass-Through Award Number: N/A. Pass-Through Award Period of Performance: 1/1/2021 through 7/1/22 and 7/2/22 through 5/11/23. Criteria or Specific Requirement (Including Statutory, Regulatory or Other Citation): Section 200.303 of the Uniform Guidance states the following regarding internal control: “The non-Federal entity must: (a) Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control-Integrated Framework” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Atrium Health CMHA’s internal controls were not suitably designed to retain all supporting documentation over their review and approval of FEMA federal expenditures. Cause: Atrium Health CMHA’s management designed a process to accumulate and review expenditures related to the FEMA award; however, for certain components of the review and approval the supporting documentation was not retained to evidence that the internal review was sufficiently designed and operating effectively throughout the process. Effect or Potential Effect: The amounts submitted for reimbursement and the FEMA reports submitted could be inaccurate or incomplete. Questioned Costs: None. Context: Atrium Health CMHA developed protocols of what expenses should be charged to the Presidentially Declared Disaster grant and communicated these protocols to the appropriate levels of management. Management then developed a process to review the costs and determine which ones were applicable to the Presidentially Declared Disaster grant. However, management did not maintain evidence supporting the approval of expenses under the Presidentially Declared Disaster grant terms. Total federal expenditures for Assistance Listing 97.036 recorded on the Schedule totaled $17,296,769 for the year ended December 31, 2025. Identification as a Repeat Finding, if Applicable: This is a repeat finding of 2024-006 from the previous year. Recommendation: Atrium Health CMHA should design and implement internal controls that are sufficiently precise and require supporting documentation be retained over the review and approval of FEMA expenses. Section III – Federal Award Findings and Questioned Costs (continued). Views of Responsible Officials: Management agrees with the finding and has developed a plan to correct the finding.