Audit 5899

2023 – 002 Internal Controls Federal Agency: Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: Per federal regulations 200.303, a non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. In addition, per the student financial aid handbook, a school must ensure that its administrative procedures for the FSA programs include an adequate system of internal controls or checks and balances. Condition: During our compliance testing for eligibility, we noted there is not an individual review of students' award packages; however, we noted there were some mitigating controls within the student information system as well as monthly reconciliations that may catch various issues. In addition, we noted there is no review for return of title IV calculations. There is one individual performing these calculations. Lastly, we noted there is only one individual who is processing and reviewing professional judgment cases. Questioned costs: None Context: During our audit procedures, it was noted there are not sufficient checks and balances in place over a few compliance requirements. Cause: The University has not historically had review procedures in place. Effect: While we found no compliance errors in our samples, there is a risk of human error causing future compliance errors. Repeat finding: No Recommendation: We recommend the University review their internal control procedures over awarding, return of title IV calculations, and professional judgment and implement a formally documented review process. Views of responsible officials: There is no disagreement with the audit finding.

2023 – 002 Internal Controls Federal Agency: Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: Per federal regulations 200.303, a non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. In addition, per the student financial aid handbook, a school must ensure that its administrative procedures for the FSA programs include an adequate system of internal controls or checks and balances. Condition: During our compliance testing for eligibility, we noted there is not an individual review of students' award packages; however, we noted there were some mitigating controls within the student information system as well as monthly reconciliations that may catch various issues. In addition, we noted there is no review for return of title IV calculations. There is one individual performing these calculations. Lastly, we noted there is only one individual who is processing and reviewing professional judgment cases. Questioned costs: None Context: During our audit procedures, it was noted there are not sufficient checks and balances in place over a few compliance requirements. Cause: The University has not historically had review procedures in place. Effect: While we found no compliance errors in our samples, there is a risk of human error causing future compliance errors. Repeat finding: No Recommendation: We recommend the University review their internal control procedures over awarding, return of title IV calculations, and professional judgment and implement a formally documented review process. Views of responsible officials: There is no disagreement with the audit finding.

2023 – 002 Internal Controls Federal Agency: Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: Per federal regulations 200.303, a non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. In addition, per the student financial aid handbook, a school must ensure that its administrative procedures for the FSA programs include an adequate system of internal controls or checks and balances. Condition: During our compliance testing for eligibility, we noted there is not an individual review of students' award packages; however, we noted there were some mitigating controls within the student information system as well as monthly reconciliations that may catch various issues. In addition, we noted there is no review for return of title IV calculations. There is one individual performing these calculations. Lastly, we noted there is only one individual who is processing and reviewing professional judgment cases. Questioned costs: None Context: During our audit procedures, it was noted there are not sufficient checks and balances in place over a few compliance requirements. Cause: The University has not historically had review procedures in place. Effect: While we found no compliance errors in our samples, there is a risk of human error causing future compliance errors. Repeat finding: No Recommendation: We recommend the University review their internal control procedures over awarding, return of title IV calculations, and professional judgment and implement a formally documented review process. Views of responsible officials: There is no disagreement with the audit finding.

2023 – 002 Internal Controls Federal Agency: Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: Per federal regulations 200.303, a non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. In addition, per the student financial aid handbook, a school must ensure that its administrative procedures for the FSA programs include an adequate system of internal controls or checks and balances. Condition: During our compliance testing for eligibility, we noted there is not an individual review of students' award packages; however, we noted there were some mitigating controls within the student information system as well as monthly reconciliations that may catch various issues. In addition, we noted there is no review for return of title IV calculations. There is one individual performing these calculations. Lastly, we noted there is only one individual who is processing and reviewing professional judgment cases. Questioned costs: None Context: During our audit procedures, it was noted there are not sufficient checks and balances in place over a few compliance requirements. Cause: The University has not historically had review procedures in place. Effect: While we found no compliance errors in our samples, there is a risk of human error causing future compliance errors. Repeat finding: No Recommendation: We recommend the University review their internal control procedures over awarding, return of title IV calculations, and professional judgment and implement a formally documented review process. Views of responsible officials: There is no disagreement with the audit finding.

2023 – 002 Internal Controls Federal Agency: Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: Per federal regulations 200.303, a non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. In addition, per the student financial aid handbook, a school must ensure that its administrative procedures for the FSA programs include an adequate system of internal controls or checks and balances. Condition: During our compliance testing for eligibility, we noted there is not an individual review of students' award packages; however, we noted there were some mitigating controls within the student information system as well as monthly reconciliations that may catch various issues. In addition, we noted there is no review for return of title IV calculations. There is one individual performing these calculations. Lastly, we noted there is only one individual who is processing and reviewing professional judgment cases. Questioned costs: None Context: During our audit procedures, it was noted there are not sufficient checks and balances in place over a few compliance requirements. Cause: The University has not historically had review procedures in place. Effect: While we found no compliance errors in our samples, there is a risk of human error causing future compliance errors. Repeat finding: No Recommendation: We recommend the University review their internal control procedures over awarding, return of title IV calculations, and professional judgment and implement a formally documented review process. Views of responsible officials: There is no disagreement with the audit finding.

2023 – 002 Internal Controls Federal Agency: Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: Per federal regulations 200.303, a non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. In addition, per the student financial aid handbook, a school must ensure that its administrative procedures for the FSA programs include an adequate system of internal controls or checks and balances. Condition: During our compliance testing for eligibility, we noted there is not an individual review of students' award packages; however, we noted there were some mitigating controls within the student information system as well as monthly reconciliations that may catch various issues. In addition, we noted there is no review for return of title IV calculations. There is one individual performing these calculations. Lastly, we noted there is only one individual who is processing and reviewing professional judgment cases. Questioned costs: None Context: During our audit procedures, it was noted there are not sufficient checks and balances in place over a few compliance requirements. Cause: The University has not historically had review procedures in place. Effect: While we found no compliance errors in our samples, there is a risk of human error causing future compliance errors. Repeat finding: No Recommendation: We recommend the University review their internal control procedures over awarding, return of title IV calculations, and professional judgment and implement a formally documented review process. Views of responsible officials: There is no disagreement with the audit finding.

2023 – 003 Gramm-Leach-Bliley Act Federal Agency: Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted the University did not properly document safeguards for the identified risks in their risk assessment over the following areas in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures. Cause: The University was not aware of the Gramm-Leach-Bliley Act requirements to document safeguards. Effect: The student personal information could be vulnerable. Repeat finding: No Recommendation: We recommend the University review their documentation and ensure that there are documented safeguards for identified risks. We also recommend reviewing the changes in the Gramm-Leach-Bliley Act regulations that were required to be implemented as of June 9, 2023. Views of responsible officials: There is no disagreement with the audit finding.

2023 – 003 Gramm-Leach-Bliley Act Federal Agency: Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted the University did not properly document safeguards for the identified risks in their risk assessment over the following areas in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures. Cause: The University was not aware of the Gramm-Leach-Bliley Act requirements to document safeguards. Effect: The student personal information could be vulnerable. Repeat finding: No Recommendation: We recommend the University review their documentation and ensure that there are documented safeguards for identified risks. We also recommend reviewing the changes in the Gramm-Leach-Bliley Act regulations that were required to be implemented as of June 9, 2023. Views of responsible officials: There is no disagreement with the audit finding.

2023 – 003 Gramm-Leach-Bliley Act Federal Agency: Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted the University did not properly document safeguards for the identified risks in their risk assessment over the following areas in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures. Cause: The University was not aware of the Gramm-Leach-Bliley Act requirements to document safeguards. Effect: The student personal information could be vulnerable. Repeat finding: No Recommendation: We recommend the University review their documentation and ensure that there are documented safeguards for identified risks. We also recommend reviewing the changes in the Gramm-Leach-Bliley Act regulations that were required to be implemented as of June 9, 2023. Views of responsible officials: There is no disagreement with the audit finding.

2023 – 003 Gramm-Leach-Bliley Act Federal Agency: Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted the University did not properly document safeguards for the identified risks in their risk assessment over the following areas in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures. Cause: The University was not aware of the Gramm-Leach-Bliley Act requirements to document safeguards. Effect: The student personal information could be vulnerable. Repeat finding: No Recommendation: We recommend the University review their documentation and ensure that there are documented safeguards for identified risks. We also recommend reviewing the changes in the Gramm-Leach-Bliley Act regulations that were required to be implemented as of June 9, 2023. Views of responsible officials: There is no disagreement with the audit finding.

2023 – 003 Gramm-Leach-Bliley Act Federal Agency: Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted the University did not properly document safeguards for the identified risks in their risk assessment over the following areas in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures. Cause: The University was not aware of the Gramm-Leach-Bliley Act requirements to document safeguards. Effect: The student personal information could be vulnerable. Repeat finding: No Recommendation: We recommend the University review their documentation and ensure that there are documented safeguards for identified risks. We also recommend reviewing the changes in the Gramm-Leach-Bliley Act regulations that were required to be implemented as of June 9, 2023. Views of responsible officials: There is no disagreement with the audit finding.

2023 – 003 Gramm-Leach-Bliley Act Federal Agency: Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted the University did not properly document safeguards for the identified risks in their risk assessment over the following areas in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures. Cause: The University was not aware of the Gramm-Leach-Bliley Act requirements to document safeguards. Effect: The student personal information could be vulnerable. Repeat finding: No Recommendation: We recommend the University review their documentation and ensure that there are documented safeguards for identified risks. We also recommend reviewing the changes in the Gramm-Leach-Bliley Act regulations that were required to be implemented as of June 9, 2023. Views of responsible officials: There is no disagreement with the audit finding.

2023 – 002 Internal Controls Federal Agency: Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: Per federal regulations 200.303, a non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. In addition, per the student financial aid handbook, a school must ensure that its administrative procedures for the FSA programs include an adequate system of internal controls or checks and balances. Condition: During our compliance testing for eligibility, we noted there is not an individual review of students' award packages; however, we noted there were some mitigating controls within the student information system as well as monthly reconciliations that may catch various issues. In addition, we noted there is no review for return of title IV calculations. There is one individual performing these calculations. Lastly, we noted there is only one individual who is processing and reviewing professional judgment cases. Questioned costs: None Context: During our audit procedures, it was noted there are not sufficient checks and balances in place over a few compliance requirements. Cause: The University has not historically had review procedures in place. Effect: While we found no compliance errors in our samples, there is a risk of human error causing future compliance errors. Repeat finding: No Recommendation: We recommend the University review their internal control procedures over awarding, return of title IV calculations, and professional judgment and implement a formally documented review process. Views of responsible officials: There is no disagreement with the audit finding.

2023 – 002 Internal Controls Federal Agency: Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: Per federal regulations 200.303, a non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. In addition, per the student financial aid handbook, a school must ensure that its administrative procedures for the FSA programs include an adequate system of internal controls or checks and balances. Condition: During our compliance testing for eligibility, we noted there is not an individual review of students' award packages; however, we noted there were some mitigating controls within the student information system as well as monthly reconciliations that may catch various issues. In addition, we noted there is no review for return of title IV calculations. There is one individual performing these calculations. Lastly, we noted there is only one individual who is processing and reviewing professional judgment cases. Questioned costs: None Context: During our audit procedures, it was noted there are not sufficient checks and balances in place over a few compliance requirements. Cause: The University has not historically had review procedures in place. Effect: While we found no compliance errors in our samples, there is a risk of human error causing future compliance errors. Repeat finding: No Recommendation: We recommend the University review their internal control procedures over awarding, return of title IV calculations, and professional judgment and implement a formally documented review process. Views of responsible officials: There is no disagreement with the audit finding.

2023 – 002 Internal Controls Federal Agency: Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: Per federal regulations 200.303, a non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. In addition, per the student financial aid handbook, a school must ensure that its administrative procedures for the FSA programs include an adequate system of internal controls or checks and balances. Condition: During our compliance testing for eligibility, we noted there is not an individual review of students' award packages; however, we noted there were some mitigating controls within the student information system as well as monthly reconciliations that may catch various issues. In addition, we noted there is no review for return of title IV calculations. There is one individual performing these calculations. Lastly, we noted there is only one individual who is processing and reviewing professional judgment cases. Questioned costs: None Context: During our audit procedures, it was noted there are not sufficient checks and balances in place over a few compliance requirements. Cause: The University has not historically had review procedures in place. Effect: While we found no compliance errors in our samples, there is a risk of human error causing future compliance errors. Repeat finding: No Recommendation: We recommend the University review their internal control procedures over awarding, return of title IV calculations, and professional judgment and implement a formally documented review process. Views of responsible officials: There is no disagreement with the audit finding.

2023 – 002 Internal Controls Federal Agency: Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: Per federal regulations 200.303, a non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. In addition, per the student financial aid handbook, a school must ensure that its administrative procedures for the FSA programs include an adequate system of internal controls or checks and balances. Condition: During our compliance testing for eligibility, we noted there is not an individual review of students' award packages; however, we noted there were some mitigating controls within the student information system as well as monthly reconciliations that may catch various issues. In addition, we noted there is no review for return of title IV calculations. There is one individual performing these calculations. Lastly, we noted there is only one individual who is processing and reviewing professional judgment cases. Questioned costs: None Context: During our audit procedures, it was noted there are not sufficient checks and balances in place over a few compliance requirements. Cause: The University has not historically had review procedures in place. Effect: While we found no compliance errors in our samples, there is a risk of human error causing future compliance errors. Repeat finding: No Recommendation: We recommend the University review their internal control procedures over awarding, return of title IV calculations, and professional judgment and implement a formally documented review process. Views of responsible officials: There is no disagreement with the audit finding.

2023 – 002 Internal Controls Federal Agency: Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: Per federal regulations 200.303, a non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. In addition, per the student financial aid handbook, a school must ensure that its administrative procedures for the FSA programs include an adequate system of internal controls or checks and balances. Condition: During our compliance testing for eligibility, we noted there is not an individual review of students' award packages; however, we noted there were some mitigating controls within the student information system as well as monthly reconciliations that may catch various issues. In addition, we noted there is no review for return of title IV calculations. There is one individual performing these calculations. Lastly, we noted there is only one individual who is processing and reviewing professional judgment cases. Questioned costs: None Context: During our audit procedures, it was noted there are not sufficient checks and balances in place over a few compliance requirements. Cause: The University has not historically had review procedures in place. Effect: While we found no compliance errors in our samples, there is a risk of human error causing future compliance errors. Repeat finding: No Recommendation: We recommend the University review their internal control procedures over awarding, return of title IV calculations, and professional judgment and implement a formally documented review process. Views of responsible officials: There is no disagreement with the audit finding.

2023 – 002 Internal Controls Federal Agency: Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: Per federal regulations 200.303, a non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. In addition, per the student financial aid handbook, a school must ensure that its administrative procedures for the FSA programs include an adequate system of internal controls or checks and balances. Condition: During our compliance testing for eligibility, we noted there is not an individual review of students' award packages; however, we noted there were some mitigating controls within the student information system as well as monthly reconciliations that may catch various issues. In addition, we noted there is no review for return of title IV calculations. There is one individual performing these calculations. Lastly, we noted there is only one individual who is processing and reviewing professional judgment cases. Questioned costs: None Context: During our audit procedures, it was noted there are not sufficient checks and balances in place over a few compliance requirements. Cause: The University has not historically had review procedures in place. Effect: While we found no compliance errors in our samples, there is a risk of human error causing future compliance errors. Repeat finding: No Recommendation: We recommend the University review their internal control procedures over awarding, return of title IV calculations, and professional judgment and implement a formally documented review process. Views of responsible officials: There is no disagreement with the audit finding.

2023 – 003 Gramm-Leach-Bliley Act Federal Agency: Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted the University did not properly document safeguards for the identified risks in their risk assessment over the following areas in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures. Cause: The University was not aware of the Gramm-Leach-Bliley Act requirements to document safeguards. Effect: The student personal information could be vulnerable. Repeat finding: No Recommendation: We recommend the University review their documentation and ensure that there are documented safeguards for identified risks. We also recommend reviewing the changes in the Gramm-Leach-Bliley Act regulations that were required to be implemented as of June 9, 2023. Views of responsible officials: There is no disagreement with the audit finding.

2023 – 003 Gramm-Leach-Bliley Act Federal Agency: Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted the University did not properly document safeguards for the identified risks in their risk assessment over the following areas in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures. Cause: The University was not aware of the Gramm-Leach-Bliley Act requirements to document safeguards. Effect: The student personal information could be vulnerable. Repeat finding: No Recommendation: We recommend the University review their documentation and ensure that there are documented safeguards for identified risks. We also recommend reviewing the changes in the Gramm-Leach-Bliley Act regulations that were required to be implemented as of June 9, 2023. Views of responsible officials: There is no disagreement with the audit finding.

2023 – 003 Gramm-Leach-Bliley Act Federal Agency: Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted the University did not properly document safeguards for the identified risks in their risk assessment over the following areas in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures. Cause: The University was not aware of the Gramm-Leach-Bliley Act requirements to document safeguards. Effect: The student personal information could be vulnerable. Repeat finding: No Recommendation: We recommend the University review their documentation and ensure that there are documented safeguards for identified risks. We also recommend reviewing the changes in the Gramm-Leach-Bliley Act regulations that were required to be implemented as of June 9, 2023. Views of responsible officials: There is no disagreement with the audit finding.

2023 – 003 Gramm-Leach-Bliley Act Federal Agency: Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted the University did not properly document safeguards for the identified risks in their risk assessment over the following areas in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures. Cause: The University was not aware of the Gramm-Leach-Bliley Act requirements to document safeguards. Effect: The student personal information could be vulnerable. Repeat finding: No Recommendation: We recommend the University review their documentation and ensure that there are documented safeguards for identified risks. We also recommend reviewing the changes in the Gramm-Leach-Bliley Act regulations that were required to be implemented as of June 9, 2023. Views of responsible officials: There is no disagreement with the audit finding.

2023 – 003 Gramm-Leach-Bliley Act Federal Agency: Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted the University did not properly document safeguards for the identified risks in their risk assessment over the following areas in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures. Cause: The University was not aware of the Gramm-Leach-Bliley Act requirements to document safeguards. Effect: The student personal information could be vulnerable. Repeat finding: No Recommendation: We recommend the University review their documentation and ensure that there are documented safeguards for identified risks. We also recommend reviewing the changes in the Gramm-Leach-Bliley Act regulations that were required to be implemented as of June 9, 2023. Views of responsible officials: There is no disagreement with the audit finding.

2023 – 003 Gramm-Leach-Bliley Act Federal Agency: Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: Various Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted the University did not properly document safeguards for the identified risks in their risk assessment over the following areas in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures. Cause: The University was not aware of the Gramm-Leach-Bliley Act requirements to document safeguards. Effect: The student personal information could be vulnerable. Repeat finding: No Recommendation: We recommend the University review their documentation and ensure that there are documented safeguards for identified risks. We also recommend reviewing the changes in the Gramm-Leach-Bliley Act regulations that were required to be implemented as of June 9, 2023. Views of responsible officials: There is no disagreement with the audit finding.