2022-002 ? Gramm-Leach-Bliley Act (GLBA) Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: 84.007, 84.033, 84.038, 84.063, and 84.268 Award Period: 7/1/2021 ? 6/30/2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: In accordance with the Gramm-Leach-Bliley Act and the Code of Federal Regulations 16 CFR 314.4(e), the University is required to implement policies and procedures to ensure that personnel are able to enact you information security program by providing personnel with security awareness training that is updated as necessary to reflect the identified risk by the risk assessment. Condition: The University risk assessment did not include security awareness training. Questioned costs: None. Context: During our testing of the University?s risk assessment, it was noted that security awareness training was not identified. Cause: The University did not have all required elements of GLBA documented in their risk assessment. Effect: Noncompliance with GLBA requirements. Repeat finding: No. Recommendation: We recommend the University evaluate its procedures and policies around their risk assessment under the requirements of GLBA. Views of responsible officials: Management agrees with the finding.
2022-002 ? Gramm-Leach-Bliley Act (GLBA) Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: 84.007, 84.033, 84.038, 84.063, and 84.268 Award Period: 7/1/2021 ? 6/30/2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: In accordance with the Gramm-Leach-Bliley Act and the Code of Federal Regulations 16 CFR 314.4(e), the University is required to implement policies and procedures to ensure that personnel are able to enact you information security program by providing personnel with security awareness training that is updated as necessary to reflect the identified risk by the risk assessment. Condition: The University risk assessment did not include security awareness training. Questioned costs: None. Context: During our testing of the University?s risk assessment, it was noted that security awareness training was not identified. Cause: The University did not have all required elements of GLBA documented in their risk assessment. Effect: Noncompliance with GLBA requirements. Repeat finding: No. Recommendation: We recommend the University evaluate its procedures and policies around their risk assessment under the requirements of GLBA. Views of responsible officials: Management agrees with the finding.
2022-001 ? Perkins Loan Recordkeeping and Record Retention Federal Agency: U.S. Department of Education Federal Program Title: Federal Perkins Loan Program Federal Assistance Listing Number: 84.038 Award Period: 7/1/2021 ? 6/30/2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: An institution shall keep original promissory notes and repayment schedules until Perkins loans are satisfied. If required to release original documents in order to enforce the loan, the institution must retain certified true copies of those documents. An institution shall keep the original paper promissory note or original paper MPN and repayment schedules in a locked, fireproof container (34 CFR 674.19(e)(4)). Condition: Original promissory notes were unable to be located. Questioned costs: None. Context: During our testing, we noted 7 instances out of 40 open Perkins loans tested where the University was unable to locate the original promissory note. Cause: The University did not have the appropriate policies and procedures in place when Perkins loans were awarded to students in order to ensure that recordkeeping and retention regulations were being followed. Effect: Open loan balances for these loans are not supported by an original promissory note. Repeat finding: No. Recommendation: We recommend the University evaluate its procedures and policies around recordkeeping and record retention. Views of responsible officials: Management agrees with the finding.
2022-002 ? Gramm-Leach-Bliley Act (GLBA) Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: 84.007, 84.033, 84.038, 84.063, and 84.268 Award Period: 7/1/2021 ? 6/30/2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: In accordance with the Gramm-Leach-Bliley Act and the Code of Federal Regulations 16 CFR 314.4(e), the University is required to implement policies and procedures to ensure that personnel are able to enact you information security program by providing personnel with security awareness training that is updated as necessary to reflect the identified risk by the risk assessment. Condition: The University risk assessment did not include security awareness training. Questioned costs: None. Context: During our testing of the University?s risk assessment, it was noted that security awareness training was not identified. Cause: The University did not have all required elements of GLBA documented in their risk assessment. Effect: Noncompliance with GLBA requirements. Repeat finding: No. Recommendation: We recommend the University evaluate its procedures and policies around their risk assessment under the requirements of GLBA. Views of responsible officials: Management agrees with the finding.
2022-002 ? Gramm-Leach-Bliley Act (GLBA) Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: 84.007, 84.033, 84.038, 84.063, and 84.268 Award Period: 7/1/2021 ? 6/30/2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: In accordance with the Gramm-Leach-Bliley Act and the Code of Federal Regulations 16 CFR 314.4(e), the University is required to implement policies and procedures to ensure that personnel are able to enact you information security program by providing personnel with security awareness training that is updated as necessary to reflect the identified risk by the risk assessment. Condition: The University risk assessment did not include security awareness training. Questioned costs: None. Context: During our testing of the University?s risk assessment, it was noted that security awareness training was not identified. Cause: The University did not have all required elements of GLBA documented in their risk assessment. Effect: Noncompliance with GLBA requirements. Repeat finding: No. Recommendation: We recommend the University evaluate its procedures and policies around their risk assessment under the requirements of GLBA. Views of responsible officials: Management agrees with the finding.
2022-003 ? National Student Loan Data System (NSLDS) Reporting Federal Agency: U.S. Department of Education Federal Program Title: Federal Pell Grant Program; Federal Direct Loan Program Federal Assistance Listing Number: 84.063 and 84.268 Award Period: 7/1/2021 ? 6/30/2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Per U.S. Department of Education (ED) regulations, all schools participating (or approved to participate) in the Federal Student Aid programs must have an arrangement to report student enrollment data to the NSLDS through a roster file. The school is required to report enrollment status at both the school and program level. The school is required to report changes in the student?s enrollment status, the effective date of the status and an anticipated completion date. An academic program is defined as the combination of the school?s Office of Postsecondary Education Identification (OPEID) number and the program?s Classification of Instructional Program (CIP) code, credential level, and published program length. ED requires the University to report changes in enrollment status and indicate the date that the changes occurred (34 CFR 685.309). Changes in enrollment status must be reported within 30 days. However, if a roster file is expected within 60 days, you may provide the date on that roster file. In addition, regulations require that an institution make necessary corrections and return the records within 10 days for any roster files that don?t pass the NSLDS enrollment reporting edits. ED requires the University to report changes in enrollment status within 30 or 60 days that the University determined the changes occurred (34 CFR 682.610). Condition: Certain students? enrollment information was not reported accurately or timely to the NSLDS. Questioned costs: None. Context: During our testing, we noted: ? 1 student out of a sample of 40 students tested was reported to the NSLDS with an enrollment status of Withdraw but was never updated subsequently to an enrollment status of Graduated for graduating from the University. This effected both the campus-level and program-level records in the NSLDS. ? 16 students out of the sample of 40 students tested were reported to the NSLDS with the incorrect effective date on the campus-level and program-level in NSLDS. ? 2 students out of a sample of 40 students tested were not reported to the campus-level record in the NSLDS in a timely manner. Cause: The University's system for which the information is pulled and sent to the NSLDS was not updated for the proper enrollment information per the University's records that are outside of the system. Effect: Inaccurate reporting to the NSLDS can result in incorrect determination of when the students? grace period should begin. Repeat finding: Yes, 2021-001. Recommendation: We recommend the University review its policies and procedures on reporting enrollment information to the NSLDS to ensure that all relevant information is being captured accurately and reported timely in accordance with applicable regulations. Views of responsible officials: Management agrees with the finding.
2022-002 ? Gramm-Leach-Bliley Act (GLBA) Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: 84.007, 84.033, 84.038, 84.063, and 84.268 Award Period: 7/1/2021 ? 6/30/2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: In accordance with the Gramm-Leach-Bliley Act and the Code of Federal Regulations 16 CFR 314.4(e), the University is required to implement policies and procedures to ensure that personnel are able to enact you information security program by providing personnel with security awareness training that is updated as necessary to reflect the identified risk by the risk assessment. Condition: The University risk assessment did not include security awareness training. Questioned costs: None. Context: During our testing of the University?s risk assessment, it was noted that security awareness training was not identified. Cause: The University did not have all required elements of GLBA documented in their risk assessment. Effect: Noncompliance with GLBA requirements. Repeat finding: No. Recommendation: We recommend the University evaluate its procedures and policies around their risk assessment under the requirements of GLBA. Views of responsible officials: Management agrees with the finding.
2022-003 ? National Student Loan Data System (NSLDS) Reporting Federal Agency: U.S. Department of Education Federal Program Title: Federal Pell Grant Program; Federal Direct Loan Program Federal Assistance Listing Number: 84.063 and 84.268 Award Period: 7/1/2021 ? 6/30/2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Per U.S. Department of Education (ED) regulations, all schools participating (or approved to participate) in the Federal Student Aid programs must have an arrangement to report student enrollment data to the NSLDS through a roster file. The school is required to report enrollment status at both the school and program level. The school is required to report changes in the student?s enrollment status, the effective date of the status and an anticipated completion date. An academic program is defined as the combination of the school?s Office of Postsecondary Education Identification (OPEID) number and the program?s Classification of Instructional Program (CIP) code, credential level, and published program length. ED requires the University to report changes in enrollment status and indicate the date that the changes occurred (34 CFR 685.309). Changes in enrollment status must be reported within 30 days. However, if a roster file is expected within 60 days, you may provide the date on that roster file. In addition, regulations require that an institution make necessary corrections and return the records within 10 days for any roster files that don?t pass the NSLDS enrollment reporting edits. ED requires the University to report changes in enrollment status within 30 or 60 days that the University determined the changes occurred (34 CFR 682.610). Condition: Certain students? enrollment information was not reported accurately or timely to the NSLDS. Questioned costs: None. Context: During our testing, we noted: ? 1 student out of a sample of 40 students tested was reported to the NSLDS with an enrollment status of Withdraw but was never updated subsequently to an enrollment status of Graduated for graduating from the University. This effected both the campus-level and program-level records in the NSLDS. ? 16 students out of the sample of 40 students tested were reported to the NSLDS with the incorrect effective date on the campus-level and program-level in NSLDS. ? 2 students out of a sample of 40 students tested were not reported to the campus-level record in the NSLDS in a timely manner. Cause: The University's system for which the information is pulled and sent to the NSLDS was not updated for the proper enrollment information per the University's records that are outside of the system. Effect: Inaccurate reporting to the NSLDS can result in incorrect determination of when the students? grace period should begin. Repeat finding: Yes, 2021-001. Recommendation: We recommend the University review its policies and procedures on reporting enrollment information to the NSLDS to ensure that all relevant information is being captured accurately and reported timely in accordance with applicable regulations. Views of responsible officials: Management agrees with the finding.
2022-002 ? Gramm-Leach-Bliley Act (GLBA) Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: 84.007, 84.033, 84.038, 84.063, and 84.268 Award Period: 7/1/2021 ? 6/30/2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: In accordance with the Gramm-Leach-Bliley Act and the Code of Federal Regulations 16 CFR 314.4(e), the University is required to implement policies and procedures to ensure that personnel are able to enact you information security program by providing personnel with security awareness training that is updated as necessary to reflect the identified risk by the risk assessment. Condition: The University risk assessment did not include security awareness training. Questioned costs: None. Context: During our testing of the University?s risk assessment, it was noted that security awareness training was not identified. Cause: The University did not have all required elements of GLBA documented in their risk assessment. Effect: Noncompliance with GLBA requirements. Repeat finding: No. Recommendation: We recommend the University evaluate its procedures and policies around their risk assessment under the requirements of GLBA. Views of responsible officials: Management agrees with the finding.
2022-002 ? Gramm-Leach-Bliley Act (GLBA) Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: 84.007, 84.033, 84.038, 84.063, and 84.268 Award Period: 7/1/2021 ? 6/30/2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: In accordance with the Gramm-Leach-Bliley Act and the Code of Federal Regulations 16 CFR 314.4(e), the University is required to implement policies and procedures to ensure that personnel are able to enact you information security program by providing personnel with security awareness training that is updated as necessary to reflect the identified risk by the risk assessment. Condition: The University risk assessment did not include security awareness training. Questioned costs: None. Context: During our testing of the University?s risk assessment, it was noted that security awareness training was not identified. Cause: The University did not have all required elements of GLBA documented in their risk assessment. Effect: Noncompliance with GLBA requirements. Repeat finding: No. Recommendation: We recommend the University evaluate its procedures and policies around their risk assessment under the requirements of GLBA. Views of responsible officials: Management agrees with the finding.
2022-001 ? Perkins Loan Recordkeeping and Record Retention Federal Agency: U.S. Department of Education Federal Program Title: Federal Perkins Loan Program Federal Assistance Listing Number: 84.038 Award Period: 7/1/2021 ? 6/30/2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: An institution shall keep original promissory notes and repayment schedules until Perkins loans are satisfied. If required to release original documents in order to enforce the loan, the institution must retain certified true copies of those documents. An institution shall keep the original paper promissory note or original paper MPN and repayment schedules in a locked, fireproof container (34 CFR 674.19(e)(4)). Condition: Original promissory notes were unable to be located. Questioned costs: None. Context: During our testing, we noted 7 instances out of 40 open Perkins loans tested where the University was unable to locate the original promissory note. Cause: The University did not have the appropriate policies and procedures in place when Perkins loans were awarded to students in order to ensure that recordkeeping and retention regulations were being followed. Effect: Open loan balances for these loans are not supported by an original promissory note. Repeat finding: No. Recommendation: We recommend the University evaluate its procedures and policies around recordkeeping and record retention. Views of responsible officials: Management agrees with the finding.
2022-002 ? Gramm-Leach-Bliley Act (GLBA) Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: 84.007, 84.033, 84.038, 84.063, and 84.268 Award Period: 7/1/2021 ? 6/30/2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: In accordance with the Gramm-Leach-Bliley Act and the Code of Federal Regulations 16 CFR 314.4(e), the University is required to implement policies and procedures to ensure that personnel are able to enact you information security program by providing personnel with security awareness training that is updated as necessary to reflect the identified risk by the risk assessment. Condition: The University risk assessment did not include security awareness training. Questioned costs: None. Context: During our testing of the University?s risk assessment, it was noted that security awareness training was not identified. Cause: The University did not have all required elements of GLBA documented in their risk assessment. Effect: Noncompliance with GLBA requirements. Repeat finding: No. Recommendation: We recommend the University evaluate its procedures and policies around their risk assessment under the requirements of GLBA. Views of responsible officials: Management agrees with the finding.
2022-002 ? Gramm-Leach-Bliley Act (GLBA) Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: 84.007, 84.033, 84.038, 84.063, and 84.268 Award Period: 7/1/2021 ? 6/30/2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: In accordance with the Gramm-Leach-Bliley Act and the Code of Federal Regulations 16 CFR 314.4(e), the University is required to implement policies and procedures to ensure that personnel are able to enact you information security program by providing personnel with security awareness training that is updated as necessary to reflect the identified risk by the risk assessment. Condition: The University risk assessment did not include security awareness training. Questioned costs: None. Context: During our testing of the University?s risk assessment, it was noted that security awareness training was not identified. Cause: The University did not have all required elements of GLBA documented in their risk assessment. Effect: Noncompliance with GLBA requirements. Repeat finding: No. Recommendation: We recommend the University evaluate its procedures and policies around their risk assessment under the requirements of GLBA. Views of responsible officials: Management agrees with the finding.
2022-003 ? National Student Loan Data System (NSLDS) Reporting Federal Agency: U.S. Department of Education Federal Program Title: Federal Pell Grant Program; Federal Direct Loan Program Federal Assistance Listing Number: 84.063 and 84.268 Award Period: 7/1/2021 ? 6/30/2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Per U.S. Department of Education (ED) regulations, all schools participating (or approved to participate) in the Federal Student Aid programs must have an arrangement to report student enrollment data to the NSLDS through a roster file. The school is required to report enrollment status at both the school and program level. The school is required to report changes in the student?s enrollment status, the effective date of the status and an anticipated completion date. An academic program is defined as the combination of the school?s Office of Postsecondary Education Identification (OPEID) number and the program?s Classification of Instructional Program (CIP) code, credential level, and published program length. ED requires the University to report changes in enrollment status and indicate the date that the changes occurred (34 CFR 685.309). Changes in enrollment status must be reported within 30 days. However, if a roster file is expected within 60 days, you may provide the date on that roster file. In addition, regulations require that an institution make necessary corrections and return the records within 10 days for any roster files that don?t pass the NSLDS enrollment reporting edits. ED requires the University to report changes in enrollment status within 30 or 60 days that the University determined the changes occurred (34 CFR 682.610). Condition: Certain students? enrollment information was not reported accurately or timely to the NSLDS. Questioned costs: None. Context: During our testing, we noted: ? 1 student out of a sample of 40 students tested was reported to the NSLDS with an enrollment status of Withdraw but was never updated subsequently to an enrollment status of Graduated for graduating from the University. This effected both the campus-level and program-level records in the NSLDS. ? 16 students out of the sample of 40 students tested were reported to the NSLDS with the incorrect effective date on the campus-level and program-level in NSLDS. ? 2 students out of a sample of 40 students tested were not reported to the campus-level record in the NSLDS in a timely manner. Cause: The University's system for which the information is pulled and sent to the NSLDS was not updated for the proper enrollment information per the University's records that are outside of the system. Effect: Inaccurate reporting to the NSLDS can result in incorrect determination of when the students? grace period should begin. Repeat finding: Yes, 2021-001. Recommendation: We recommend the University review its policies and procedures on reporting enrollment information to the NSLDS to ensure that all relevant information is being captured accurately and reported timely in accordance with applicable regulations. Views of responsible officials: Management agrees with the finding.
2022-002 ? Gramm-Leach-Bliley Act (GLBA) Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: 84.007, 84.033, 84.038, 84.063, and 84.268 Award Period: 7/1/2021 ? 6/30/2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: In accordance with the Gramm-Leach-Bliley Act and the Code of Federal Regulations 16 CFR 314.4(e), the University is required to implement policies and procedures to ensure that personnel are able to enact you information security program by providing personnel with security awareness training that is updated as necessary to reflect the identified risk by the risk assessment. Condition: The University risk assessment did not include security awareness training. Questioned costs: None. Context: During our testing of the University?s risk assessment, it was noted that security awareness training was not identified. Cause: The University did not have all required elements of GLBA documented in their risk assessment. Effect: Noncompliance with GLBA requirements. Repeat finding: No. Recommendation: We recommend the University evaluate its procedures and policies around their risk assessment under the requirements of GLBA. Views of responsible officials: Management agrees with the finding.
2022-003 ? National Student Loan Data System (NSLDS) Reporting Federal Agency: U.S. Department of Education Federal Program Title: Federal Pell Grant Program; Federal Direct Loan Program Federal Assistance Listing Number: 84.063 and 84.268 Award Period: 7/1/2021 ? 6/30/2022 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matters Criteria or specific requirement: Per U.S. Department of Education (ED) regulations, all schools participating (or approved to participate) in the Federal Student Aid programs must have an arrangement to report student enrollment data to the NSLDS through a roster file. The school is required to report enrollment status at both the school and program level. The school is required to report changes in the student?s enrollment status, the effective date of the status and an anticipated completion date. An academic program is defined as the combination of the school?s Office of Postsecondary Education Identification (OPEID) number and the program?s Classification of Instructional Program (CIP) code, credential level, and published program length. ED requires the University to report changes in enrollment status and indicate the date that the changes occurred (34 CFR 685.309). Changes in enrollment status must be reported within 30 days. However, if a roster file is expected within 60 days, you may provide the date on that roster file. In addition, regulations require that an institution make necessary corrections and return the records within 10 days for any roster files that don?t pass the NSLDS enrollment reporting edits. ED requires the University to report changes in enrollment status within 30 or 60 days that the University determined the changes occurred (34 CFR 682.610). Condition: Certain students? enrollment information was not reported accurately or timely to the NSLDS. Questioned costs: None. Context: During our testing, we noted: ? 1 student out of a sample of 40 students tested was reported to the NSLDS with an enrollment status of Withdraw but was never updated subsequently to an enrollment status of Graduated for graduating from the University. This effected both the campus-level and program-level records in the NSLDS. ? 16 students out of the sample of 40 students tested were reported to the NSLDS with the incorrect effective date on the campus-level and program-level in NSLDS. ? 2 students out of a sample of 40 students tested were not reported to the campus-level record in the NSLDS in a timely manner. Cause: The University's system for which the information is pulled and sent to the NSLDS was not updated for the proper enrollment information per the University's records that are outside of the system. Effect: Inaccurate reporting to the NSLDS can result in incorrect determination of when the students? grace period should begin. Repeat finding: Yes, 2021-001. Recommendation: We recommend the University review its policies and procedures on reporting enrollment information to the NSLDS to ensure that all relevant information is being captured accurately and reported timely in accordance with applicable regulations. Views of responsible officials: Management agrees with the finding.