2022 ? 002 Gramm-Leach-Bliley Act Federal agency: Department of Education Federal program title: Student Financial Aid ALN Numbers: Student Financial Aid Cluster Award Period: June 01, 2021 through May 31, 2022 Type of Finding: - Significant Deficiency in Internal Control over Compliance - Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as ?financial institutions? and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution?s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the College/University did not perform a risk assessment that addresses the three areas noted in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The organization did not perform an IT risk assessment tailored specifically to the organization, identify risks or address risks identified as required by the Gramm-Leach-Bliley Act. Effect: The student personal information could be vulnerable. Repeat Finding: Yes Recommendation: We recommend that the College engage a third party or perform the risk assessment for the three areas required by the Gramm-Leach-Bliley Act and ensure that there are documented safeguards for identified risks. Views of responsible officials: There is no disagreement with the audit finding.
2022-004 Perkins Promissory Notes Federal Agency: U.S. Department of Education Federal Program Title: Higher Education Emergency Relief Funds ALN Number: 84.038 Award Period: June 01, 2021 through May 31, 2022 Type of Finding: - Significant Deficiency in Internal Control over Compliance - Other Matters Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 674.16 states that before an institution makes its first disbursement to a student, the student shall sign the promissory note. Condition: Perkins Promissory Note - During our testing of the Student Financial Aid Cluster, we noted that 13 student out of 34 tested in the Perkins loan program could not be supported as having completed a promissory note. Questioned Costs: None Context: Many of the missing promissory notes were old and could not be located in paper or electronic files. Cause: The College did not have a process in place to ensure promissory notes were appropriately retained either in paper or electronic format. Effect: The College cannot provide documentation showing proper completion of promissory note as required by DOE requirements. Repeat finding: No Recommendation: We recommend that the College put a procedure in place to ensure that all students have a promissory note prior to disbursing of funds. Also recommend a procedure be put in place to ensure proper record retention documenting the completion of promissory note. Views of responsible officials: There is no disagreement with the audit finding.
2022 ? 002 Gramm-Leach-Bliley Act Federal agency: Department of Education Federal program title: Student Financial Aid ALN Numbers: Student Financial Aid Cluster Award Period: June 01, 2021 through May 31, 2022 Type of Finding: - Significant Deficiency in Internal Control over Compliance - Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as ?financial institutions? and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution?s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the College/University did not perform a risk assessment that addresses the three areas noted in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The organization did not perform an IT risk assessment tailored specifically to the organization, identify risks or address risks identified as required by the Gramm-Leach-Bliley Act. Effect: The student personal information could be vulnerable. Repeat Finding: Yes Recommendation: We recommend that the College engage a third party or perform the risk assessment for the three areas required by the Gramm-Leach-Bliley Act and ensure that there are documented safeguards for identified risks. Views of responsible officials: There is no disagreement with the audit finding.
2022-004 Perkins Promissory Notes Federal Agency: U.S. Department of Education Federal Program Title: Higher Education Emergency Relief Funds ALN Number: 84.038 Award Period: June 01, 2021 through May 31, 2022 Type of Finding: - Significant Deficiency in Internal Control over Compliance - Other Matters Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 674.16 states that before an institution makes its first disbursement to a student, the student shall sign the promissory note. Condition: Perkins Promissory Note - During our testing of the Student Financial Aid Cluster, we noted that 13 student out of 34 tested in the Perkins loan program could not be supported as having completed a promissory note. Questioned Costs: None Context: Many of the missing promissory notes were old and could not be located in paper or electronic files. Cause: The College did not have a process in place to ensure promissory notes were appropriately retained either in paper or electronic format. Effect: The College cannot provide documentation showing proper completion of promissory note as required by DOE requirements. Repeat finding: No Recommendation: We recommend that the College put a procedure in place to ensure that all students have a promissory note prior to disbursing of funds. Also recommend a procedure be put in place to ensure proper record retention documenting the completion of promissory note. Views of responsible officials: There is no disagreement with the audit finding.
2022 ? 002 Gramm-Leach-Bliley Act Federal agency: Department of Education Federal program title: Student Financial Aid ALN Numbers: Student Financial Aid Cluster Award Period: June 01, 2021 through May 31, 2022 Type of Finding: - Significant Deficiency in Internal Control over Compliance - Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as ?financial institutions? and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution?s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the College/University did not perform a risk assessment that addresses the three areas noted in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The organization did not perform an IT risk assessment tailored specifically to the organization, identify risks or address risks identified as required by the Gramm-Leach-Bliley Act. Effect: The student personal information could be vulnerable. Repeat Finding: Yes Recommendation: We recommend that the College engage a third party or perform the risk assessment for the three areas required by the Gramm-Leach-Bliley Act and ensure that there are documented safeguards for identified risks. Views of responsible officials: There is no disagreement with the audit finding.
2022 ? 002 Gramm-Leach-Bliley Act Federal agency: Department of Education Federal program title: Student Financial Aid ALN Numbers: Student Financial Aid Cluster Award Period: June 01, 2021 through May 31, 2022 Type of Finding: - Significant Deficiency in Internal Control over Compliance - Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as ?financial institutions? and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution?s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the College/University did not perform a risk assessment that addresses the three areas noted in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The organization did not perform an IT risk assessment tailored specifically to the organization, identify risks or address risks identified as required by the Gramm-Leach-Bliley Act. Effect: The student personal information could be vulnerable. Repeat Finding: Yes Recommendation: We recommend that the College engage a third party or perform the risk assessment for the three areas required by the Gramm-Leach-Bliley Act and ensure that there are documented safeguards for identified risks. Views of responsible officials: There is no disagreement with the audit finding.
2022 ? 002 Gramm-Leach-Bliley Act Federal agency: Department of Education Federal program title: Student Financial Aid ALN Numbers: Student Financial Aid Cluster Award Period: June 01, 2021 through May 31, 2022 Type of Finding: - Significant Deficiency in Internal Control over Compliance - Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as ?financial institutions? and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution?s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the College/University did not perform a risk assessment that addresses the three areas noted in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The organization did not perform an IT risk assessment tailored specifically to the organization, identify risks or address risks identified as required by the Gramm-Leach-Bliley Act. Effect: The student personal information could be vulnerable. Repeat Finding: Yes Recommendation: We recommend that the College engage a third party or perform the risk assessment for the three areas required by the Gramm-Leach-Bliley Act and ensure that there are documented safeguards for identified risks. Views of responsible officials: There is no disagreement with the audit finding.
2022 ? 002 Gramm-Leach-Bliley Act Federal agency: Department of Education Federal program title: Student Financial Aid ALN Numbers: Student Financial Aid Cluster Award Period: June 01, 2021 through May 31, 2022 Type of Finding: - Significant Deficiency in Internal Control over Compliance - Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as ?financial institutions? and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution?s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the College/University did not perform a risk assessment that addresses the three areas noted in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The organization did not perform an IT risk assessment tailored specifically to the organization, identify risks or address risks identified as required by the Gramm-Leach-Bliley Act. Effect: The student personal information could be vulnerable. Repeat Finding: Yes Recommendation: We recommend that the College engage a third party or perform the risk assessment for the three areas required by the Gramm-Leach-Bliley Act and ensure that there are documented safeguards for identified risks. Views of responsible officials: There is no disagreement with the audit finding.
2022 ? 002 Gramm-Leach-Bliley Act Federal agency: Department of Education Federal program title: Student Financial Aid ALN Numbers: Student Financial Aid Cluster Award Period: June 01, 2021 through May 31, 2022 Type of Finding: - Significant Deficiency in Internal Control over Compliance - Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as ?financial institutions? and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution?s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the College/University did not perform a risk assessment that addresses the three areas noted in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The organization did not perform an IT risk assessment tailored specifically to the organization, identify risks or address risks identified as required by the Gramm-Leach-Bliley Act. Effect: The student personal information could be vulnerable. Repeat Finding: Yes Recommendation: We recommend that the College engage a third party or perform the risk assessment for the three areas required by the Gramm-Leach-Bliley Act and ensure that there are documented safeguards for identified risks. Views of responsible officials: There is no disagreement with the audit finding.
2022-003 Reporting Federal Agency: U.S. Department of Education Federal Program Title: Higher Education Emergency Relief Funds ALN Number: 84.425 Award Period: June 01, 2021 through May 31, 2022 Type of Finding: - Significant Deficiency in Internal Control over Compliance - Other Matters Criteria or specific requirement: Per Uniform Guidance 2 CFR 200.303, federal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations and program compliance requirements. The initial reporting for this grant requires the report to be submitted to the college or university?s website within 30 days of the signed Certification Agreement or 30 days after the electronic announcement dated May 6, whichever is later. Colleges and universities were then required to update their websites every 45 days after initial upload. This was changed to quarterly on August 31, 2020. In addition, an annual report is required. Condition: During our testing, we noted the student, institutional, and annual reports did not have documentation of their review prior to submission. Questioned Costs: None Context: A control system to prevent and detect errors in the reporting process was not created at the time the reports were filed and the College did not have a process to track the reporting requirements. In addition, there was a general lack of guidance from ED on reporting requirements. Cause: The College did not have a process in place to ensure reports were reviewed and documentation of review was maintained. Effect: The College did not comply with ED regulations by retaining support for the information reported to ensure accuracy. Repeat finding: No Recommendation: We recommend the College review their reporting procedures to ensure all required steps are included as well as the supporting documentation to prepare the report is retained. The reports should be reviewed by someone other than the preparer of the report and this review should be documented. Views of responsible officials: There is no disagreement with the audit finding.
2022-003 Reporting Federal Agency: U.S. Department of Education Federal Program Title: Higher Education Emergency Relief Funds ALN Number: 84.425 Award Period: June 01, 2021 through May 31, 2022 Type of Finding: - Significant Deficiency in Internal Control over Compliance - Other Matters Criteria or specific requirement: Per Uniform Guidance 2 CFR 200.303, federal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations and program compliance requirements. The initial reporting for this grant requires the report to be submitted to the college or university?s website within 30 days of the signed Certification Agreement or 30 days after the electronic announcement dated May 6, whichever is later. Colleges and universities were then required to update their websites every 45 days after initial upload. This was changed to quarterly on August 31, 2020. In addition, an annual report is required. Condition: During our testing, we noted the student, institutional, and annual reports did not have documentation of their review prior to submission. Questioned Costs: None Context: A control system to prevent and detect errors in the reporting process was not created at the time the reports were filed and the College did not have a process to track the reporting requirements. In addition, there was a general lack of guidance from ED on reporting requirements. Cause: The College did not have a process in place to ensure reports were reviewed and documentation of review was maintained. Effect: The College did not comply with ED regulations by retaining support for the information reported to ensure accuracy. Repeat finding: No Recommendation: We recommend the College review their reporting procedures to ensure all required steps are included as well as the supporting documentation to prepare the report is retained. The reports should be reviewed by someone other than the preparer of the report and this review should be documented. Views of responsible officials: There is no disagreement with the audit finding.
2022-003 Reporting Federal Agency: U.S. Department of Education Federal Program Title: Higher Education Emergency Relief Funds ALN Number: 84.425 Award Period: June 01, 2021 through May 31, 2022 Type of Finding: - Significant Deficiency in Internal Control over Compliance - Other Matters Criteria or specific requirement: Per Uniform Guidance 2 CFR 200.303, federal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations and program compliance requirements. The initial reporting for this grant requires the report to be submitted to the college or university?s website within 30 days of the signed Certification Agreement or 30 days after the electronic announcement dated May 6, whichever is later. Colleges and universities were then required to update their websites every 45 days after initial upload. This was changed to quarterly on August 31, 2020. In addition, an annual report is required. Condition: During our testing, we noted the student, institutional, and annual reports did not have documentation of their review prior to submission. Questioned Costs: None Context: A control system to prevent and detect errors in the reporting process was not created at the time the reports were filed and the College did not have a process to track the reporting requirements. In addition, there was a general lack of guidance from ED on reporting requirements. Cause: The College did not have a process in place to ensure reports were reviewed and documentation of review was maintained. Effect: The College did not comply with ED regulations by retaining support for the information reported to ensure accuracy. Repeat finding: No Recommendation: We recommend the College review their reporting procedures to ensure all required steps are included as well as the supporting documentation to prepare the report is retained. The reports should be reviewed by someone other than the preparer of the report and this review should be documented. Views of responsible officials: There is no disagreement with the audit finding.
2022 ? 002 Gramm-Leach-Bliley Act Federal agency: Department of Education Federal program title: Student Financial Aid ALN Numbers: Student Financial Aid Cluster Award Period: June 01, 2021 through May 31, 2022 Type of Finding: - Significant Deficiency in Internal Control over Compliance - Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as ?financial institutions? and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution?s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the College/University did not perform a risk assessment that addresses the three areas noted in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The organization did not perform an IT risk assessment tailored specifically to the organization, identify risks or address risks identified as required by the Gramm-Leach-Bliley Act. Effect: The student personal information could be vulnerable. Repeat Finding: Yes Recommendation: We recommend that the College engage a third party or perform the risk assessment for the three areas required by the Gramm-Leach-Bliley Act and ensure that there are documented safeguards for identified risks. Views of responsible officials: There is no disagreement with the audit finding.
2022-004 Perkins Promissory Notes Federal Agency: U.S. Department of Education Federal Program Title: Higher Education Emergency Relief Funds ALN Number: 84.038 Award Period: June 01, 2021 through May 31, 2022 Type of Finding: - Significant Deficiency in Internal Control over Compliance - Other Matters Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 674.16 states that before an institution makes its first disbursement to a student, the student shall sign the promissory note. Condition: Perkins Promissory Note - During our testing of the Student Financial Aid Cluster, we noted that 13 student out of 34 tested in the Perkins loan program could not be supported as having completed a promissory note. Questioned Costs: None Context: Many of the missing promissory notes were old and could not be located in paper or electronic files. Cause: The College did not have a process in place to ensure promissory notes were appropriately retained either in paper or electronic format. Effect: The College cannot provide documentation showing proper completion of promissory note as required by DOE requirements. Repeat finding: No Recommendation: We recommend that the College put a procedure in place to ensure that all students have a promissory note prior to disbursing of funds. Also recommend a procedure be put in place to ensure proper record retention documenting the completion of promissory note. Views of responsible officials: There is no disagreement with the audit finding.
2022 ? 002 Gramm-Leach-Bliley Act Federal agency: Department of Education Federal program title: Student Financial Aid ALN Numbers: Student Financial Aid Cluster Award Period: June 01, 2021 through May 31, 2022 Type of Finding: - Significant Deficiency in Internal Control over Compliance - Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as ?financial institutions? and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution?s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the College/University did not perform a risk assessment that addresses the three areas noted in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The organization did not perform an IT risk assessment tailored specifically to the organization, identify risks or address risks identified as required by the Gramm-Leach-Bliley Act. Effect: The student personal information could be vulnerable. Repeat Finding: Yes Recommendation: We recommend that the College engage a third party or perform the risk assessment for the three areas required by the Gramm-Leach-Bliley Act and ensure that there are documented safeguards for identified risks. Views of responsible officials: There is no disagreement with the audit finding.
2022-004 Perkins Promissory Notes Federal Agency: U.S. Department of Education Federal Program Title: Higher Education Emergency Relief Funds ALN Number: 84.038 Award Period: June 01, 2021 through May 31, 2022 Type of Finding: - Significant Deficiency in Internal Control over Compliance - Other Matters Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 674.16 states that before an institution makes its first disbursement to a student, the student shall sign the promissory note. Condition: Perkins Promissory Note - During our testing of the Student Financial Aid Cluster, we noted that 13 student out of 34 tested in the Perkins loan program could not be supported as having completed a promissory note. Questioned Costs: None Context: Many of the missing promissory notes were old and could not be located in paper or electronic files. Cause: The College did not have a process in place to ensure promissory notes were appropriately retained either in paper or electronic format. Effect: The College cannot provide documentation showing proper completion of promissory note as required by DOE requirements. Repeat finding: No Recommendation: We recommend that the College put a procedure in place to ensure that all students have a promissory note prior to disbursing of funds. Also recommend a procedure be put in place to ensure proper record retention documenting the completion of promissory note. Views of responsible officials: There is no disagreement with the audit finding.
2022 ? 002 Gramm-Leach-Bliley Act Federal agency: Department of Education Federal program title: Student Financial Aid ALN Numbers: Student Financial Aid Cluster Award Period: June 01, 2021 through May 31, 2022 Type of Finding: - Significant Deficiency in Internal Control over Compliance - Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as ?financial institutions? and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution?s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the College/University did not perform a risk assessment that addresses the three areas noted in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The organization did not perform an IT risk assessment tailored specifically to the organization, identify risks or address risks identified as required by the Gramm-Leach-Bliley Act. Effect: The student personal information could be vulnerable. Repeat Finding: Yes Recommendation: We recommend that the College engage a third party or perform the risk assessment for the three areas required by the Gramm-Leach-Bliley Act and ensure that there are documented safeguards for identified risks. Views of responsible officials: There is no disagreement with the audit finding.
2022 ? 002 Gramm-Leach-Bliley Act Federal agency: Department of Education Federal program title: Student Financial Aid ALN Numbers: Student Financial Aid Cluster Award Period: June 01, 2021 through May 31, 2022 Type of Finding: - Significant Deficiency in Internal Control over Compliance - Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as ?financial institutions? and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution?s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the College/University did not perform a risk assessment that addresses the three areas noted in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The organization did not perform an IT risk assessment tailored specifically to the organization, identify risks or address risks identified as required by the Gramm-Leach-Bliley Act. Effect: The student personal information could be vulnerable. Repeat Finding: Yes Recommendation: We recommend that the College engage a third party or perform the risk assessment for the three areas required by the Gramm-Leach-Bliley Act and ensure that there are documented safeguards for identified risks. Views of responsible officials: There is no disagreement with the audit finding.
2022 ? 002 Gramm-Leach-Bliley Act Federal agency: Department of Education Federal program title: Student Financial Aid ALN Numbers: Student Financial Aid Cluster Award Period: June 01, 2021 through May 31, 2022 Type of Finding: - Significant Deficiency in Internal Control over Compliance - Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as ?financial institutions? and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution?s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the College/University did not perform a risk assessment that addresses the three areas noted in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The organization did not perform an IT risk assessment tailored specifically to the organization, identify risks or address risks identified as required by the Gramm-Leach-Bliley Act. Effect: The student personal information could be vulnerable. Repeat Finding: Yes Recommendation: We recommend that the College engage a third party or perform the risk assessment for the three areas required by the Gramm-Leach-Bliley Act and ensure that there are documented safeguards for identified risks. Views of responsible officials: There is no disagreement with the audit finding.
2022 ? 002 Gramm-Leach-Bliley Act Federal agency: Department of Education Federal program title: Student Financial Aid ALN Numbers: Student Financial Aid Cluster Award Period: June 01, 2021 through May 31, 2022 Type of Finding: - Significant Deficiency in Internal Control over Compliance - Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as ?financial institutions? and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution?s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the College/University did not perform a risk assessment that addresses the three areas noted in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The organization did not perform an IT risk assessment tailored specifically to the organization, identify risks or address risks identified as required by the Gramm-Leach-Bliley Act. Effect: The student personal information could be vulnerable. Repeat Finding: Yes Recommendation: We recommend that the College engage a third party or perform the risk assessment for the three areas required by the Gramm-Leach-Bliley Act and ensure that there are documented safeguards for identified risks. Views of responsible officials: There is no disagreement with the audit finding.
2022 ? 002 Gramm-Leach-Bliley Act Federal agency: Department of Education Federal program title: Student Financial Aid ALN Numbers: Student Financial Aid Cluster Award Period: June 01, 2021 through May 31, 2022 Type of Finding: - Significant Deficiency in Internal Control over Compliance - Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as ?financial institutions? and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution?s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the College/University did not perform a risk assessment that addresses the three areas noted in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The organization did not perform an IT risk assessment tailored specifically to the organization, identify risks or address risks identified as required by the Gramm-Leach-Bliley Act. Effect: The student personal information could be vulnerable. Repeat Finding: Yes Recommendation: We recommend that the College engage a third party or perform the risk assessment for the three areas required by the Gramm-Leach-Bliley Act and ensure that there are documented safeguards for identified risks. Views of responsible officials: There is no disagreement with the audit finding.
2022-003 Reporting Federal Agency: U.S. Department of Education Federal Program Title: Higher Education Emergency Relief Funds ALN Number: 84.425 Award Period: June 01, 2021 through May 31, 2022 Type of Finding: - Significant Deficiency in Internal Control over Compliance - Other Matters Criteria or specific requirement: Per Uniform Guidance 2 CFR 200.303, federal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations and program compliance requirements. The initial reporting for this grant requires the report to be submitted to the college or university?s website within 30 days of the signed Certification Agreement or 30 days after the electronic announcement dated May 6, whichever is later. Colleges and universities were then required to update their websites every 45 days after initial upload. This was changed to quarterly on August 31, 2020. In addition, an annual report is required. Condition: During our testing, we noted the student, institutional, and annual reports did not have documentation of their review prior to submission. Questioned Costs: None Context: A control system to prevent and detect errors in the reporting process was not created at the time the reports were filed and the College did not have a process to track the reporting requirements. In addition, there was a general lack of guidance from ED on reporting requirements. Cause: The College did not have a process in place to ensure reports were reviewed and documentation of review was maintained. Effect: The College did not comply with ED regulations by retaining support for the information reported to ensure accuracy. Repeat finding: No Recommendation: We recommend the College review their reporting procedures to ensure all required steps are included as well as the supporting documentation to prepare the report is retained. The reports should be reviewed by someone other than the preparer of the report and this review should be documented. Views of responsible officials: There is no disagreement with the audit finding.
2022-003 Reporting Federal Agency: U.S. Department of Education Federal Program Title: Higher Education Emergency Relief Funds ALN Number: 84.425 Award Period: June 01, 2021 through May 31, 2022 Type of Finding: - Significant Deficiency in Internal Control over Compliance - Other Matters Criteria or specific requirement: Per Uniform Guidance 2 CFR 200.303, federal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations and program compliance requirements. The initial reporting for this grant requires the report to be submitted to the college or university?s website within 30 days of the signed Certification Agreement or 30 days after the electronic announcement dated May 6, whichever is later. Colleges and universities were then required to update their websites every 45 days after initial upload. This was changed to quarterly on August 31, 2020. In addition, an annual report is required. Condition: During our testing, we noted the student, institutional, and annual reports did not have documentation of their review prior to submission. Questioned Costs: None Context: A control system to prevent and detect errors in the reporting process was not created at the time the reports were filed and the College did not have a process to track the reporting requirements. In addition, there was a general lack of guidance from ED on reporting requirements. Cause: The College did not have a process in place to ensure reports were reviewed and documentation of review was maintained. Effect: The College did not comply with ED regulations by retaining support for the information reported to ensure accuracy. Repeat finding: No Recommendation: We recommend the College review their reporting procedures to ensure all required steps are included as well as the supporting documentation to prepare the report is retained. The reports should be reviewed by someone other than the preparer of the report and this review should be documented. Views of responsible officials: There is no disagreement with the audit finding.
2022-003 Reporting Federal Agency: U.S. Department of Education Federal Program Title: Higher Education Emergency Relief Funds ALN Number: 84.425 Award Period: June 01, 2021 through May 31, 2022 Type of Finding: - Significant Deficiency in Internal Control over Compliance - Other Matters Criteria or specific requirement: Per Uniform Guidance 2 CFR 200.303, federal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations and program compliance requirements. The initial reporting for this grant requires the report to be submitted to the college or university?s website within 30 days of the signed Certification Agreement or 30 days after the electronic announcement dated May 6, whichever is later. Colleges and universities were then required to update their websites every 45 days after initial upload. This was changed to quarterly on August 31, 2020. In addition, an annual report is required. Condition: During our testing, we noted the student, institutional, and annual reports did not have documentation of their review prior to submission. Questioned Costs: None Context: A control system to prevent and detect errors in the reporting process was not created at the time the reports were filed and the College did not have a process to track the reporting requirements. In addition, there was a general lack of guidance from ED on reporting requirements. Cause: The College did not have a process in place to ensure reports were reviewed and documentation of review was maintained. Effect: The College did not comply with ED regulations by retaining support for the information reported to ensure accuracy. Repeat finding: No Recommendation: We recommend the College review their reporting procedures to ensure all required steps are included as well as the supporting documentation to prepare the report is retained. The reports should be reviewed by someone other than the preparer of the report and this review should be documented. Views of responsible officials: There is no disagreement with the audit finding.