2023–001 GLBA Risk Assessment Requirements
Federal Agency: U.S. Department of Education
Federal Program Name: Student Financial Aid Cluster
Assistance Listing Number: 84.007, 84.033, 84.063, 84.268
Federal Award Identification Number and Year: P007A234487-2023, P268K242432-2023, P063P222432-2023, P033A224487-2023
Award Period: August 1, 2022 to July 31, 2023
Type of Finding:
• Significant Deficiency in Internal Control over Compliance
• Other Matters
Criteria or specific requirement: The Gramm-Leach-Bliley Act (GLBA) provides for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The eight minimum safeguards that the written information security program must address are summarized as follows:
• Implement and periodically review access controls.
• Conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted.
• Encrypt customer information on the institution’s system and when it’s in transit.
• Assess apps developed by the institution
• Implement multi-factor authentication for anyone accessing customer information on the institution’s system
• Dispose of customer information securely
• Anticipate and evaluate changes to the information system or network.
• Maintain a log of authorized users’ activity and keep an eye out for unauthorized access.
• Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)).
• Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)).
• Addresses how the institution will oversee its information system service providers (16 CFR 314.4(f)).
• Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)).
Condition: Upon reviewing the GLBA policies and procedures it was noted that University did not include the following required components as required in the stated criteria:
• Multi-factor authentication,
• Security program including vendor due diligence.
Questioned costs: None noted.
Context: The noncompliance with the stated criteria was identified in conjunction with our review of the GLBA policies and procedures manual and related supporting documentation.
Cause: The University failed to include the multi-factor authentication and the security program including vendor due diligence in its GLBA policy and procedures manual and related supporting documentation.
Effect: The University does not comply with certain requirements of the GLBA, as noted in the condition, which governs the treatment of nonpublic personal information about consumers.
Repeat Finding: No
Recommendation: We recommend that the University consider any modifications to the GLBA policy and procedures manual and related supporting documentation to ensure compliance with the stated criteria.
Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: U.S. Department of Education
Federal Program Name: Student Financial Aid Cluster
Assistance Listing Number: 84.063, 84.268
Federal Award Identification Number and Year: P268K242432-2023, P063P222432-2023
Award Period: August 1, 2022 to July 31, 2023
Type of Finding:
• Material Weakness in Internal Control over Compliance
• Material Noncompliance (Modified Opinion)
Criteria or specific requirement: Institutions are required to report enrollment information under the Pell grant and the Direct and FFEL loan programs via the NSLDS (OMB No. 1845-0035), although FFEL loans are no longer made or a part of the SFA Cluster, a student may have a FFEL loan from previous years that would require enrollment reporting for that student (Pell, 34 CFR 690.83(b)(2); FFEL, 34 CFR 682.610; Direct Loan, 34 CFR 685.309). The administration of the Title IV programs depends heavily on the accuracy and timeliness of the enrollment information reported by institutions. Institutions must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website which the financial aid administrator can access for the auditor. The data on the institution’s Enrollment Reporting Roster, or Enrollment Maintenance page, is what NSLDS has as the most recently certified enrollment information. There are two categories of enrollment information, “Campus Level” and “Program Level,” both of which need to be reported accurately and have separate record types. The NSLDS Enrollment Reporting Guide provides the requirements and guidance for reporting enrollment details using the NSLDS Enrollment Reporting Process.
Condition: The University could not provide documentation that the enrollment status reported in NSLDS was in agreement with the University’s records.
Questioned costs: There are no questioned costs.
Context: The University is in the process of winding down operations, and is no longer providing educational services, and no longer has access to the NSLDS system.
Cause: The University no longer has access to the NSLDS system, and therefore could not provide documentation that the enrollment status reported in NSLDS was supported by the University’s records.
Effect: The University failed to comply with the stated criteria.
Repeat Finding: No
Recommendation: We recommend that the University consider any NSLDS access and documentation requirements necessary to ensure compliance with the stated criteria.
Views of responsible officials: There is no disagreement with the audit finding.
2023–001 GLBA Risk Assessment Requirements
Federal Agency: U.S. Department of Education
Federal Program Name: Student Financial Aid Cluster
Assistance Listing Number: 84.007, 84.033, 84.063, 84.268
Federal Award Identification Number and Year: P007A234487-2023, P268K242432-2023, P063P222432-2023, P033A224487-2023
Award Period: August 1, 2022 to July 31, 2023
Type of Finding:
• Significant Deficiency in Internal Control over Compliance
• Other Matters
Criteria or specific requirement: The Gramm-Leach-Bliley Act (GLBA) provides for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The eight minimum safeguards that the written information security program must address are summarized as follows:
• Implement and periodically review access controls.
• Conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted.
• Encrypt customer information on the institution’s system and when it’s in transit.
• Assess apps developed by the institution
• Implement multi-factor authentication for anyone accessing customer information on the institution’s system
• Dispose of customer information securely
• Anticipate and evaluate changes to the information system or network.
• Maintain a log of authorized users’ activity and keep an eye out for unauthorized access.
• Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)).
• Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)).
• Addresses how the institution will oversee its information system service providers (16 CFR 314.4(f)).
• Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)).
Condition: Upon reviewing the GLBA policies and procedures it was noted that University did not include the following required components as required in the stated criteria:
• Multi-factor authentication,
• Security program including vendor due diligence.
Questioned costs: None noted.
Context: The noncompliance with the stated criteria was identified in conjunction with our review of the GLBA policies and procedures manual and related supporting documentation.
Cause: The University failed to include the multi-factor authentication and the security program including vendor due diligence in its GLBA policy and procedures manual and related supporting documentation.
Effect: The University does not comply with certain requirements of the GLBA, as noted in the condition, which governs the treatment of nonpublic personal information about consumers.
Repeat Finding: No
Recommendation: We recommend that the University consider any modifications to the GLBA policy and procedures manual and related supporting documentation to ensure compliance with the stated criteria.
Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: U.S. Department of Education
Federal Program Name: Student Financial Aid Cluster
Assistance Listing Number: 84.063, 84.268
Federal Award Identification Number and Year: P268K242432-2023, P063P222432-2023
Award Period: August 1, 2022 to July 31, 2023
Type of Finding:
• Material Weakness in Internal Control over Compliance
• Material Noncompliance (Modified Opinion)
Criteria or specific requirement: Institutions are required to report enrollment information under the Pell grant and the Direct and FFEL loan programs via the NSLDS (OMB No. 1845-0035), although FFEL loans are no longer made or a part of the SFA Cluster, a student may have a FFEL loan from previous years that would require enrollment reporting for that student (Pell, 34 CFR 690.83(b)(2); FFEL, 34 CFR 682.610; Direct Loan, 34 CFR 685.309). The administration of the Title IV programs depends heavily on the accuracy and timeliness of the enrollment information reported by institutions. Institutions must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website which the financial aid administrator can access for the auditor. The data on the institution’s Enrollment Reporting Roster, or Enrollment Maintenance page, is what NSLDS has as the most recently certified enrollment information. There are two categories of enrollment information, “Campus Level” and “Program Level,” both of which need to be reported accurately and have separate record types. The NSLDS Enrollment Reporting Guide provides the requirements and guidance for reporting enrollment details using the NSLDS Enrollment Reporting Process.
Condition: The University could not provide documentation that the enrollment status reported in NSLDS was in agreement with the University’s records.
Questioned costs: There are no questioned costs.
Context: The University is in the process of winding down operations, and is no longer providing educational services, and no longer has access to the NSLDS system.
Cause: The University no longer has access to the NSLDS system, and therefore could not provide documentation that the enrollment status reported in NSLDS was supported by the University’s records.
Effect: The University failed to comply with the stated criteria.
Repeat Finding: No
Recommendation: We recommend that the University consider any NSLDS access and documentation requirements necessary to ensure compliance with the stated criteria.
Views of responsible officials: There is no disagreement with the audit finding.
2023–001 GLBA Risk Assessment Requirements
Federal Agency: U.S. Department of Education
Federal Program Name: Student Financial Aid Cluster
Assistance Listing Number: 84.007, 84.033, 84.063, 84.268
Federal Award Identification Number and Year: P007A234487-2023, P268K242432-2023, P063P222432-2023, P033A224487-2023
Award Period: August 1, 2022 to July 31, 2023
Type of Finding:
• Significant Deficiency in Internal Control over Compliance
• Other Matters
Criteria or specific requirement: The Gramm-Leach-Bliley Act (GLBA) provides for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The eight minimum safeguards that the written information security program must address are summarized as follows:
• Implement and periodically review access controls.
• Conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted.
• Encrypt customer information on the institution’s system and when it’s in transit.
• Assess apps developed by the institution
• Implement multi-factor authentication for anyone accessing customer information on the institution’s system
• Dispose of customer information securely
• Anticipate and evaluate changes to the information system or network.
• Maintain a log of authorized users’ activity and keep an eye out for unauthorized access.
• Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)).
• Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)).
• Addresses how the institution will oversee its information system service providers (16 CFR 314.4(f)).
• Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)).
Condition: Upon reviewing the GLBA policies and procedures it was noted that University did not include the following required components as required in the stated criteria:
• Multi-factor authentication,
• Security program including vendor due diligence.
Questioned costs: None noted.
Context: The noncompliance with the stated criteria was identified in conjunction with our review of the GLBA policies and procedures manual and related supporting documentation.
Cause: The University failed to include the multi-factor authentication and the security program including vendor due diligence in its GLBA policy and procedures manual and related supporting documentation.
Effect: The University does not comply with certain requirements of the GLBA, as noted in the condition, which governs the treatment of nonpublic personal information about consumers.
Repeat Finding: No
Recommendation: We recommend that the University consider any modifications to the GLBA policy and procedures manual and related supporting documentation to ensure compliance with the stated criteria.
Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: U.S. Department of Education
Federal Program Name: Student Financial Aid Cluster
Assistance Listing Number: 84.063, 84.268
Federal Award Identification Number and Year: P268K242432-2023, P063P222432-2023
Award Period: August 1, 2022 to July 31, 2023
Type of Finding:
• Material Weakness in Internal Control over Compliance
• Material Noncompliance (Modified Opinion)
Criteria or specific requirement: Institutions are required to report enrollment information under the Pell grant and the Direct and FFEL loan programs via the NSLDS (OMB No. 1845-0035), although FFEL loans are no longer made or a part of the SFA Cluster, a student may have a FFEL loan from previous years that would require enrollment reporting for that student (Pell, 34 CFR 690.83(b)(2); FFEL, 34 CFR 682.610; Direct Loan, 34 CFR 685.309). The administration of the Title IV programs depends heavily on the accuracy and timeliness of the enrollment information reported by institutions. Institutions must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website which the financial aid administrator can access for the auditor. The data on the institution’s Enrollment Reporting Roster, or Enrollment Maintenance page, is what NSLDS has as the most recently certified enrollment information. There are two categories of enrollment information, “Campus Level” and “Program Level,” both of which need to be reported accurately and have separate record types. The NSLDS Enrollment Reporting Guide provides the requirements and guidance for reporting enrollment details using the NSLDS Enrollment Reporting Process.
Condition: The University could not provide documentation that the enrollment status reported in NSLDS was in agreement with the University’s records.
Questioned costs: There are no questioned costs.
Context: The University is in the process of winding down operations, and is no longer providing educational services, and no longer has access to the NSLDS system.
Cause: The University no longer has access to the NSLDS system, and therefore could not provide documentation that the enrollment status reported in NSLDS was supported by the University’s records.
Effect: The University failed to comply with the stated criteria.
Repeat Finding: No
Recommendation: We recommend that the University consider any NSLDS access and documentation requirements necessary to ensure compliance with the stated criteria.
Views of responsible officials: There is no disagreement with the audit finding.
2023–001 GLBA Risk Assessment Requirements
Federal Agency: U.S. Department of Education
Federal Program Name: Student Financial Aid Cluster
Assistance Listing Number: 84.007, 84.033, 84.063, 84.268
Federal Award Identification Number and Year: P007A234487-2023, P268K242432-2023, P063P222432-2023, P033A224487-2023
Award Period: August 1, 2022 to July 31, 2023
Type of Finding:
• Significant Deficiency in Internal Control over Compliance
• Other Matters
Criteria or specific requirement: The Gramm-Leach-Bliley Act (GLBA) provides for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The eight minimum safeguards that the written information security program must address are summarized as follows:
• Implement and periodically review access controls.
• Conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted.
• Encrypt customer information on the institution’s system and when it’s in transit.
• Assess apps developed by the institution
• Implement multi-factor authentication for anyone accessing customer information on the institution’s system
• Dispose of customer information securely
• Anticipate and evaluate changes to the information system or network.
• Maintain a log of authorized users’ activity and keep an eye out for unauthorized access.
• Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)).
• Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)).
• Addresses how the institution will oversee its information system service providers (16 CFR 314.4(f)).
• Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)).
Condition: Upon reviewing the GLBA policies and procedures it was noted that University did not include the following required components as required in the stated criteria:
• Multi-factor authentication,
• Security program including vendor due diligence.
Questioned costs: None noted.
Context: The noncompliance with the stated criteria was identified in conjunction with our review of the GLBA policies and procedures manual and related supporting documentation.
Cause: The University failed to include the multi-factor authentication and the security program including vendor due diligence in its GLBA policy and procedures manual and related supporting documentation.
Effect: The University does not comply with certain requirements of the GLBA, as noted in the condition, which governs the treatment of nonpublic personal information about consumers.
Repeat Finding: No
Recommendation: We recommend that the University consider any modifications to the GLBA policy and procedures manual and related supporting documentation to ensure compliance with the stated criteria.
Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: U.S. Department of Education
Federal Program Name: Student Financial Aid Cluster
Assistance Listing Number: 84.063, 84.268
Federal Award Identification Number and Year: P268K242432-2023, P063P222432-2023
Award Period: August 1, 2022 to July 31, 2023
Type of Finding:
• Material Weakness in Internal Control over Compliance
• Material Noncompliance (Modified Opinion)
Criteria or specific requirement: Institutions are required to report enrollment information under the Pell grant and the Direct and FFEL loan programs via the NSLDS (OMB No. 1845-0035), although FFEL loans are no longer made or a part of the SFA Cluster, a student may have a FFEL loan from previous years that would require enrollment reporting for that student (Pell, 34 CFR 690.83(b)(2); FFEL, 34 CFR 682.610; Direct Loan, 34 CFR 685.309). The administration of the Title IV programs depends heavily on the accuracy and timeliness of the enrollment information reported by institutions. Institutions must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website which the financial aid administrator can access for the auditor. The data on the institution’s Enrollment Reporting Roster, or Enrollment Maintenance page, is what NSLDS has as the most recently certified enrollment information. There are two categories of enrollment information, “Campus Level” and “Program Level,” both of which need to be reported accurately and have separate record types. The NSLDS Enrollment Reporting Guide provides the requirements and guidance for reporting enrollment details using the NSLDS Enrollment Reporting Process.
Condition: The University could not provide documentation that the enrollment status reported in NSLDS was in agreement with the University’s records.
Questioned costs: There are no questioned costs.
Context: The University is in the process of winding down operations, and is no longer providing educational services, and no longer has access to the NSLDS system.
Cause: The University no longer has access to the NSLDS system, and therefore could not provide documentation that the enrollment status reported in NSLDS was supported by the University’s records.
Effect: The University failed to comply with the stated criteria.
Repeat Finding: No
Recommendation: We recommend that the University consider any NSLDS access and documentation requirements necessary to ensure compliance with the stated criteria.
Views of responsible officials: There is no disagreement with the audit finding.
2023–001 GLBA Risk Assessment Requirements
Federal Agency: U.S. Department of Education
Federal Program Name: Student Financial Aid Cluster
Assistance Listing Number: 84.007, 84.033, 84.063, 84.268
Federal Award Identification Number and Year: P007A234487-2023, P268K242432-2023, P063P222432-2023, P033A224487-2023
Award Period: August 1, 2022 to July 31, 2023
Type of Finding:
• Significant Deficiency in Internal Control over Compliance
• Other Matters
Criteria or specific requirement: The Gramm-Leach-Bliley Act (GLBA) provides for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The eight minimum safeguards that the written information security program must address are summarized as follows:
• Implement and periodically review access controls.
• Conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted.
• Encrypt customer information on the institution’s system and when it’s in transit.
• Assess apps developed by the institution
• Implement multi-factor authentication for anyone accessing customer information on the institution’s system
• Dispose of customer information securely
• Anticipate and evaluate changes to the information system or network.
• Maintain a log of authorized users’ activity and keep an eye out for unauthorized access.
• Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)).
• Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)).
• Addresses how the institution will oversee its information system service providers (16 CFR 314.4(f)).
• Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)).
Condition: Upon reviewing the GLBA policies and procedures it was noted that University did not include the following required components as required in the stated criteria:
• Multi-factor authentication,
• Security program including vendor due diligence.
Questioned costs: None noted.
Context: The noncompliance with the stated criteria was identified in conjunction with our review of the GLBA policies and procedures manual and related supporting documentation.
Cause: The University failed to include the multi-factor authentication and the security program including vendor due diligence in its GLBA policy and procedures manual and related supporting documentation.
Effect: The University does not comply with certain requirements of the GLBA, as noted in the condition, which governs the treatment of nonpublic personal information about consumers.
Repeat Finding: No
Recommendation: We recommend that the University consider any modifications to the GLBA policy and procedures manual and related supporting documentation to ensure compliance with the stated criteria.
Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: U.S. Department of Education
Federal Program Name: Student Financial Aid Cluster
Assistance Listing Number: 84.063, 84.268
Federal Award Identification Number and Year: P268K242432-2023, P063P222432-2023
Award Period: August 1, 2022 to July 31, 2023
Type of Finding:
• Material Weakness in Internal Control over Compliance
• Material Noncompliance (Modified Opinion)
Criteria or specific requirement: Institutions are required to report enrollment information under the Pell grant and the Direct and FFEL loan programs via the NSLDS (OMB No. 1845-0035), although FFEL loans are no longer made or a part of the SFA Cluster, a student may have a FFEL loan from previous years that would require enrollment reporting for that student (Pell, 34 CFR 690.83(b)(2); FFEL, 34 CFR 682.610; Direct Loan, 34 CFR 685.309). The administration of the Title IV programs depends heavily on the accuracy and timeliness of the enrollment information reported by institutions. Institutions must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website which the financial aid administrator can access for the auditor. The data on the institution’s Enrollment Reporting Roster, or Enrollment Maintenance page, is what NSLDS has as the most recently certified enrollment information. There are two categories of enrollment information, “Campus Level” and “Program Level,” both of which need to be reported accurately and have separate record types. The NSLDS Enrollment Reporting Guide provides the requirements and guidance for reporting enrollment details using the NSLDS Enrollment Reporting Process.
Condition: The University could not provide documentation that the enrollment status reported in NSLDS was in agreement with the University’s records.
Questioned costs: There are no questioned costs.
Context: The University is in the process of winding down operations, and is no longer providing educational services, and no longer has access to the NSLDS system.
Cause: The University no longer has access to the NSLDS system, and therefore could not provide documentation that the enrollment status reported in NSLDS was supported by the University’s records.
Effect: The University failed to comply with the stated criteria.
Repeat Finding: No
Recommendation: We recommend that the University consider any NSLDS access and documentation requirements necessary to ensure compliance with the stated criteria.
Views of responsible officials: There is no disagreement with the audit finding.
2023–001 GLBA Risk Assessment Requirements
Federal Agency: U.S. Department of Education
Federal Program Name: Student Financial Aid Cluster
Assistance Listing Number: 84.007, 84.033, 84.063, 84.268
Federal Award Identification Number and Year: P007A234487-2023, P268K242432-2023, P063P222432-2023, P033A224487-2023
Award Period: August 1, 2022 to July 31, 2023
Type of Finding:
• Significant Deficiency in Internal Control over Compliance
• Other Matters
Criteria or specific requirement: The Gramm-Leach-Bliley Act (GLBA) provides for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The eight minimum safeguards that the written information security program must address are summarized as follows:
• Implement and periodically review access controls.
• Conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted.
• Encrypt customer information on the institution’s system and when it’s in transit.
• Assess apps developed by the institution
• Implement multi-factor authentication for anyone accessing customer information on the institution’s system
• Dispose of customer information securely
• Anticipate and evaluate changes to the information system or network.
• Maintain a log of authorized users’ activity and keep an eye out for unauthorized access.
• Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)).
• Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)).
• Addresses how the institution will oversee its information system service providers (16 CFR 314.4(f)).
• Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)).
Condition: Upon reviewing the GLBA policies and procedures it was noted that University did not include the following required components as required in the stated criteria:
• Multi-factor authentication,
• Security program including vendor due diligence.
Questioned costs: None noted.
Context: The noncompliance with the stated criteria was identified in conjunction with our review of the GLBA policies and procedures manual and related supporting documentation.
Cause: The University failed to include the multi-factor authentication and the security program including vendor due diligence in its GLBA policy and procedures manual and related supporting documentation.
Effect: The University does not comply with certain requirements of the GLBA, as noted in the condition, which governs the treatment of nonpublic personal information about consumers.
Repeat Finding: No
Recommendation: We recommend that the University consider any modifications to the GLBA policy and procedures manual and related supporting documentation to ensure compliance with the stated criteria.
Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: U.S. Department of Education
Federal Program Name: Student Financial Aid Cluster
Assistance Listing Number: 84.063, 84.268
Federal Award Identification Number and Year: P268K242432-2023, P063P222432-2023
Award Period: August 1, 2022 to July 31, 2023
Type of Finding:
• Material Weakness in Internal Control over Compliance
• Material Noncompliance (Modified Opinion)
Criteria or specific requirement: Institutions are required to report enrollment information under the Pell grant and the Direct and FFEL loan programs via the NSLDS (OMB No. 1845-0035), although FFEL loans are no longer made or a part of the SFA Cluster, a student may have a FFEL loan from previous years that would require enrollment reporting for that student (Pell, 34 CFR 690.83(b)(2); FFEL, 34 CFR 682.610; Direct Loan, 34 CFR 685.309). The administration of the Title IV programs depends heavily on the accuracy and timeliness of the enrollment information reported by institutions. Institutions must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website which the financial aid administrator can access for the auditor. The data on the institution’s Enrollment Reporting Roster, or Enrollment Maintenance page, is what NSLDS has as the most recently certified enrollment information. There are two categories of enrollment information, “Campus Level” and “Program Level,” both of which need to be reported accurately and have separate record types. The NSLDS Enrollment Reporting Guide provides the requirements and guidance for reporting enrollment details using the NSLDS Enrollment Reporting Process.
Condition: The University could not provide documentation that the enrollment status reported in NSLDS was in agreement with the University’s records.
Questioned costs: There are no questioned costs.
Context: The University is in the process of winding down operations, and is no longer providing educational services, and no longer has access to the NSLDS system.
Cause: The University no longer has access to the NSLDS system, and therefore could not provide documentation that the enrollment status reported in NSLDS was supported by the University’s records.
Effect: The University failed to comply with the stated criteria.
Repeat Finding: No
Recommendation: We recommend that the University consider any NSLDS access and documentation requirements necessary to ensure compliance with the stated criteria.
Views of responsible officials: There is no disagreement with the audit finding.
2023–001 GLBA Risk Assessment Requirements
Federal Agency: U.S. Department of Education
Federal Program Name: Student Financial Aid Cluster
Assistance Listing Number: 84.007, 84.033, 84.063, 84.268
Federal Award Identification Number and Year: P007A234487-2023, P268K242432-2023, P063P222432-2023, P033A224487-2023
Award Period: August 1, 2022 to July 31, 2023
Type of Finding:
• Significant Deficiency in Internal Control over Compliance
• Other Matters
Criteria or specific requirement: The Gramm-Leach-Bliley Act (GLBA) provides for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The eight minimum safeguards that the written information security program must address are summarized as follows:
• Implement and periodically review access controls.
• Conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted.
• Encrypt customer information on the institution’s system and when it’s in transit.
• Assess apps developed by the institution
• Implement multi-factor authentication for anyone accessing customer information on the institution’s system
• Dispose of customer information securely
• Anticipate and evaluate changes to the information system or network.
• Maintain a log of authorized users’ activity and keep an eye out for unauthorized access.
• Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)).
• Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)).
• Addresses how the institution will oversee its information system service providers (16 CFR 314.4(f)).
• Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)).
Condition: Upon reviewing the GLBA policies and procedures it was noted that University did not include the following required components as required in the stated criteria:
• Multi-factor authentication,
• Security program including vendor due diligence.
Questioned costs: None noted.
Context: The noncompliance with the stated criteria was identified in conjunction with our review of the GLBA policies and procedures manual and related supporting documentation.
Cause: The University failed to include the multi-factor authentication and the security program including vendor due diligence in its GLBA policy and procedures manual and related supporting documentation.
Effect: The University does not comply with certain requirements of the GLBA, as noted in the condition, which governs the treatment of nonpublic personal information about consumers.
Repeat Finding: No
Recommendation: We recommend that the University consider any modifications to the GLBA policy and procedures manual and related supporting documentation to ensure compliance with the stated criteria.
Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: U.S. Department of Education
Federal Program Name: Student Financial Aid Cluster
Assistance Listing Number: 84.063, 84.268
Federal Award Identification Number and Year: P268K242432-2023, P063P222432-2023
Award Period: August 1, 2022 to July 31, 2023
Type of Finding:
• Material Weakness in Internal Control over Compliance
• Material Noncompliance (Modified Opinion)
Criteria or specific requirement: Institutions are required to report enrollment information under the Pell grant and the Direct and FFEL loan programs via the NSLDS (OMB No. 1845-0035), although FFEL loans are no longer made or a part of the SFA Cluster, a student may have a FFEL loan from previous years that would require enrollment reporting for that student (Pell, 34 CFR 690.83(b)(2); FFEL, 34 CFR 682.610; Direct Loan, 34 CFR 685.309). The administration of the Title IV programs depends heavily on the accuracy and timeliness of the enrollment information reported by institutions. Institutions must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website which the financial aid administrator can access for the auditor. The data on the institution’s Enrollment Reporting Roster, or Enrollment Maintenance page, is what NSLDS has as the most recently certified enrollment information. There are two categories of enrollment information, “Campus Level” and “Program Level,” both of which need to be reported accurately and have separate record types. The NSLDS Enrollment Reporting Guide provides the requirements and guidance for reporting enrollment details using the NSLDS Enrollment Reporting Process.
Condition: The University could not provide documentation that the enrollment status reported in NSLDS was in agreement with the University’s records.
Questioned costs: There are no questioned costs.
Context: The University is in the process of winding down operations, and is no longer providing educational services, and no longer has access to the NSLDS system.
Cause: The University no longer has access to the NSLDS system, and therefore could not provide documentation that the enrollment status reported in NSLDS was supported by the University’s records.
Effect: The University failed to comply with the stated criteria.
Repeat Finding: No
Recommendation: We recommend that the University consider any NSLDS access and documentation requirements necessary to ensure compliance with the stated criteria.
Views of responsible officials: There is no disagreement with the audit finding.
2023–001 GLBA Risk Assessment Requirements
Federal Agency: U.S. Department of Education
Federal Program Name: Student Financial Aid Cluster
Assistance Listing Number: 84.007, 84.033, 84.063, 84.268
Federal Award Identification Number and Year: P007A234487-2023, P268K242432-2023, P063P222432-2023, P033A224487-2023
Award Period: August 1, 2022 to July 31, 2023
Type of Finding:
• Significant Deficiency in Internal Control over Compliance
• Other Matters
Criteria or specific requirement: The Gramm-Leach-Bliley Act (GLBA) provides for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The eight minimum safeguards that the written information security program must address are summarized as follows:
• Implement and periodically review access controls.
• Conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted.
• Encrypt customer information on the institution’s system and when it’s in transit.
• Assess apps developed by the institution
• Implement multi-factor authentication for anyone accessing customer information on the institution’s system
• Dispose of customer information securely
• Anticipate and evaluate changes to the information system or network.
• Maintain a log of authorized users’ activity and keep an eye out for unauthorized access.
• Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)).
• Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)).
• Addresses how the institution will oversee its information system service providers (16 CFR 314.4(f)).
• Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)).
Condition: Upon reviewing the GLBA policies and procedures it was noted that University did not include the following required components as required in the stated criteria:
• Multi-factor authentication,
• Security program including vendor due diligence.
Questioned costs: None noted.
Context: The noncompliance with the stated criteria was identified in conjunction with our review of the GLBA policies and procedures manual and related supporting documentation.
Cause: The University failed to include the multi-factor authentication and the security program including vendor due diligence in its GLBA policy and procedures manual and related supporting documentation.
Effect: The University does not comply with certain requirements of the GLBA, as noted in the condition, which governs the treatment of nonpublic personal information about consumers.
Repeat Finding: No
Recommendation: We recommend that the University consider any modifications to the GLBA policy and procedures manual and related supporting documentation to ensure compliance with the stated criteria.
Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: U.S. Department of Education
Federal Program Name: Student Financial Aid Cluster
Assistance Listing Number: 84.063, 84.268
Federal Award Identification Number and Year: P268K242432-2023, P063P222432-2023
Award Period: August 1, 2022 to July 31, 2023
Type of Finding:
• Material Weakness in Internal Control over Compliance
• Material Noncompliance (Modified Opinion)
Criteria or specific requirement: Institutions are required to report enrollment information under the Pell grant and the Direct and FFEL loan programs via the NSLDS (OMB No. 1845-0035), although FFEL loans are no longer made or a part of the SFA Cluster, a student may have a FFEL loan from previous years that would require enrollment reporting for that student (Pell, 34 CFR 690.83(b)(2); FFEL, 34 CFR 682.610; Direct Loan, 34 CFR 685.309). The administration of the Title IV programs depends heavily on the accuracy and timeliness of the enrollment information reported by institutions. Institutions must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website which the financial aid administrator can access for the auditor. The data on the institution’s Enrollment Reporting Roster, or Enrollment Maintenance page, is what NSLDS has as the most recently certified enrollment information. There are two categories of enrollment information, “Campus Level” and “Program Level,” both of which need to be reported accurately and have separate record types. The NSLDS Enrollment Reporting Guide provides the requirements and guidance for reporting enrollment details using the NSLDS Enrollment Reporting Process.
Condition: The University could not provide documentation that the enrollment status reported in NSLDS was in agreement with the University’s records.
Questioned costs: There are no questioned costs.
Context: The University is in the process of winding down operations, and is no longer providing educational services, and no longer has access to the NSLDS system.
Cause: The University no longer has access to the NSLDS system, and therefore could not provide documentation that the enrollment status reported in NSLDS was supported by the University’s records.
Effect: The University failed to comply with the stated criteria.
Repeat Finding: No
Recommendation: We recommend that the University consider any NSLDS access and documentation requirements necessary to ensure compliance with the stated criteria.
Views of responsible officials: There is no disagreement with the audit finding.
2023–001 GLBA Risk Assessment Requirements
Federal Agency: U.S. Department of Education
Federal Program Name: Student Financial Aid Cluster
Assistance Listing Number: 84.007, 84.033, 84.063, 84.268
Federal Award Identification Number and Year: P007A234487-2023, P268K242432-2023, P063P222432-2023, P033A224487-2023
Award Period: August 1, 2022 to July 31, 2023
Type of Finding:
• Significant Deficiency in Internal Control over Compliance
• Other Matters
Criteria or specific requirement: The Gramm-Leach-Bliley Act (GLBA) provides for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The eight minimum safeguards that the written information security program must address are summarized as follows:
• Implement and periodically review access controls.
• Conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted.
• Encrypt customer information on the institution’s system and when it’s in transit.
• Assess apps developed by the institution
• Implement multi-factor authentication for anyone accessing customer information on the institution’s system
• Dispose of customer information securely
• Anticipate and evaluate changes to the information system or network.
• Maintain a log of authorized users’ activity and keep an eye out for unauthorized access.
• Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)).
• Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)).
• Addresses how the institution will oversee its information system service providers (16 CFR 314.4(f)).
• Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)).
Condition: Upon reviewing the GLBA policies and procedures it was noted that University did not include the following required components as required in the stated criteria:
• Multi-factor authentication,
• Security program including vendor due diligence.
Questioned costs: None noted.
Context: The noncompliance with the stated criteria was identified in conjunction with our review of the GLBA policies and procedures manual and related supporting documentation.
Cause: The University failed to include the multi-factor authentication and the security program including vendor due diligence in its GLBA policy and procedures manual and related supporting documentation.
Effect: The University does not comply with certain requirements of the GLBA, as noted in the condition, which governs the treatment of nonpublic personal information about consumers.
Repeat Finding: No
Recommendation: We recommend that the University consider any modifications to the GLBA policy and procedures manual and related supporting documentation to ensure compliance with the stated criteria.
Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: U.S. Department of Education
Federal Program Name: Student Financial Aid Cluster
Assistance Listing Number: 84.063, 84.268
Federal Award Identification Number and Year: P268K242432-2023, P063P222432-2023
Award Period: August 1, 2022 to July 31, 2023
Type of Finding:
• Material Weakness in Internal Control over Compliance
• Material Noncompliance (Modified Opinion)
Criteria or specific requirement: Institutions are required to report enrollment information under the Pell grant and the Direct and FFEL loan programs via the NSLDS (OMB No. 1845-0035), although FFEL loans are no longer made or a part of the SFA Cluster, a student may have a FFEL loan from previous years that would require enrollment reporting for that student (Pell, 34 CFR 690.83(b)(2); FFEL, 34 CFR 682.610; Direct Loan, 34 CFR 685.309). The administration of the Title IV programs depends heavily on the accuracy and timeliness of the enrollment information reported by institutions. Institutions must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website which the financial aid administrator can access for the auditor. The data on the institution’s Enrollment Reporting Roster, or Enrollment Maintenance page, is what NSLDS has as the most recently certified enrollment information. There are two categories of enrollment information, “Campus Level” and “Program Level,” both of which need to be reported accurately and have separate record types. The NSLDS Enrollment Reporting Guide provides the requirements and guidance for reporting enrollment details using the NSLDS Enrollment Reporting Process.
Condition: The University could not provide documentation that the enrollment status reported in NSLDS was in agreement with the University’s records.
Questioned costs: There are no questioned costs.
Context: The University is in the process of winding down operations, and is no longer providing educational services, and no longer has access to the NSLDS system.
Cause: The University no longer has access to the NSLDS system, and therefore could not provide documentation that the enrollment status reported in NSLDS was supported by the University’s records.
Effect: The University failed to comply with the stated criteria.
Repeat Finding: No
Recommendation: We recommend that the University consider any NSLDS access and documentation requirements necessary to ensure compliance with the stated criteria.
Views of responsible officials: There is no disagreement with the audit finding.
2023–001 GLBA Risk Assessment Requirements
Federal Agency: U.S. Department of Education
Federal Program Name: Student Financial Aid Cluster
Assistance Listing Number: 84.007, 84.033, 84.063, 84.268
Federal Award Identification Number and Year: P007A234487-2023, P268K242432-2023, P063P222432-2023, P033A224487-2023
Award Period: August 1, 2022 to July 31, 2023
Type of Finding:
• Significant Deficiency in Internal Control over Compliance
• Other Matters
Criteria or specific requirement: The Gramm-Leach-Bliley Act (GLBA) provides for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The eight minimum safeguards that the written information security program must address are summarized as follows:
• Implement and periodically review access controls.
• Conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted.
• Encrypt customer information on the institution’s system and when it’s in transit.
• Assess apps developed by the institution
• Implement multi-factor authentication for anyone accessing customer information on the institution’s system
• Dispose of customer information securely
• Anticipate and evaluate changes to the information system or network.
• Maintain a log of authorized users’ activity and keep an eye out for unauthorized access.
• Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)).
• Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)).
• Addresses how the institution will oversee its information system service providers (16 CFR 314.4(f)).
• Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)).
Condition: Upon reviewing the GLBA policies and procedures it was noted that University did not include the following required components as required in the stated criteria:
• Multi-factor authentication,
• Security program including vendor due diligence.
Questioned costs: None noted.
Context: The noncompliance with the stated criteria was identified in conjunction with our review of the GLBA policies and procedures manual and related supporting documentation.
Cause: The University failed to include the multi-factor authentication and the security program including vendor due diligence in its GLBA policy and procedures manual and related supporting documentation.
Effect: The University does not comply with certain requirements of the GLBA, as noted in the condition, which governs the treatment of nonpublic personal information about consumers.
Repeat Finding: No
Recommendation: We recommend that the University consider any modifications to the GLBA policy and procedures manual and related supporting documentation to ensure compliance with the stated criteria.
Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: U.S. Department of Education
Federal Program Name: Student Financial Aid Cluster
Assistance Listing Number: 84.063, 84.268
Federal Award Identification Number and Year: P268K242432-2023, P063P222432-2023
Award Period: August 1, 2022 to July 31, 2023
Type of Finding:
• Material Weakness in Internal Control over Compliance
• Material Noncompliance (Modified Opinion)
Criteria or specific requirement: Institutions are required to report enrollment information under the Pell grant and the Direct and FFEL loan programs via the NSLDS (OMB No. 1845-0035), although FFEL loans are no longer made or a part of the SFA Cluster, a student may have a FFEL loan from previous years that would require enrollment reporting for that student (Pell, 34 CFR 690.83(b)(2); FFEL, 34 CFR 682.610; Direct Loan, 34 CFR 685.309). The administration of the Title IV programs depends heavily on the accuracy and timeliness of the enrollment information reported by institutions. Institutions must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website which the financial aid administrator can access for the auditor. The data on the institution’s Enrollment Reporting Roster, or Enrollment Maintenance page, is what NSLDS has as the most recently certified enrollment information. There are two categories of enrollment information, “Campus Level” and “Program Level,” both of which need to be reported accurately and have separate record types. The NSLDS Enrollment Reporting Guide provides the requirements and guidance for reporting enrollment details using the NSLDS Enrollment Reporting Process.
Condition: The University could not provide documentation that the enrollment status reported in NSLDS was in agreement with the University’s records.
Questioned costs: There are no questioned costs.
Context: The University is in the process of winding down operations, and is no longer providing educational services, and no longer has access to the NSLDS system.
Cause: The University no longer has access to the NSLDS system, and therefore could not provide documentation that the enrollment status reported in NSLDS was supported by the University’s records.
Effect: The University failed to comply with the stated criteria.
Repeat Finding: No
Recommendation: We recommend that the University consider any NSLDS access and documentation requirements necessary to ensure compliance with the stated criteria.
Views of responsible officials: There is no disagreement with the audit finding.