Audit 6574

Finding 2023-001 – Enrollment Reporting Repeat Finding: Yes Federal Program Title – U.S. Department of Education Student Financial Assistance Cluster Federal Pell Grant Program: 84.063 Federal Direct Student Loans: 84.268 Federal Award Year 2022-2023 Condition For four out of sixty students tested (7%) who withdrew from City Colleges, the students’ withdrawal date reported to the National Student Loan Data System (NSLDS) for campus level and program level did not match the institution’s records. Criteria CFR section 685.309 and 690.83(b)(2) requires City Colleges to notify the NSLDS within 30 days of a change in student status or include the change in status in a response to an enrollment reporting roster within 60 days of the student’s date of determination of withdrawal. 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure accurate reporting of enrollment status changes. Questioned Costs There were no questioned costs related to testing of enrollment reporting. Cause The financial aid office does not have an effective system in place to ensure all official student status changes are reported to the lender accurately. Prevalence Infrequent. Four out of sixty students selected for testing. Effect Failure to report status changes timely is noncompliance with Federal regulation and could result in loss of future funding. Recommendation We recommend City Colleges implement monitoring procedures which will promptly notify the financial aid office of any student status changes. A system of monitoring procedures and/or controls will ensure the College is reporting any status changes to the lender accurately. City Colleges should implement a review process to ensure all status changes are addressed by the financial aid office. Views of responsible officials We agree with this finding. See corrective action plan.

Finding 2023-001 – Enrollment Reporting Repeat Finding: Yes Federal Program Title – U.S. Department of Education Student Financial Assistance Cluster Federal Pell Grant Program: 84.063 Federal Direct Student Loans: 84.268 Federal Award Year 2022-2023 Condition For four out of sixty students tested (7%) who withdrew from City Colleges, the students’ withdrawal date reported to the National Student Loan Data System (NSLDS) for campus level and program level did not match the institution’s records. Criteria CFR section 685.309 and 690.83(b)(2) requires City Colleges to notify the NSLDS within 30 days of a change in student status or include the change in status in a response to an enrollment reporting roster within 60 days of the student’s date of determination of withdrawal. 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure accurate reporting of enrollment status changes. Questioned Costs There were no questioned costs related to testing of enrollment reporting. Cause The financial aid office does not have an effective system in place to ensure all official student status changes are reported to the lender accurately. Prevalence Infrequent. Four out of sixty students selected for testing. Effect Failure to report status changes timely is noncompliance with Federal regulation and could result in loss of future funding. Recommendation We recommend City Colleges implement monitoring procedures which will promptly notify the financial aid office of any student status changes. A system of monitoring procedures and/or controls will ensure the College is reporting any status changes to the lender accurately. City Colleges should implement a review process to ensure all status changes are addressed by the financial aid office. Views of responsible officials We agree with this finding. See corrective action plan.

Finding 2023-002– Short-Term Program Completion and Placement Rates Repeat Finding: Yes Federal Program Title – U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal Award Year 2022-2023 Condition The College did not achieve the required 70% completion rate for a short-term program. The College cannot demonstrate compliance with the gainful employment placement rate calculation for a short-term program. Criteria For the Direct Loan Program, short-term eligible programs at a postsecondary vocational institution must be between 300 - 599 clock hours. They must have been provided for at least one year and must have a substantiated completion and placement rate of at least 70 percent for the most recently completed award year. 34 CFR Section 668.8(f) and (g) requires the college to have documentation supporting its placement rates for each student showing that the student obtained gainful employment in the recognized occupation for which he or she was trained or in a related comparable recognized occupation. 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure compliance with completion and placement rate calculations for short-term programs. Questioned Costs There were no questioned costs with respect to this finding. Cause The financial aid office did not follow-up on the gainful employment of students. Prevalence Frequent. Two out of two students who completed the program did not have sufficient support for the placement rate calculation. Five out of seven students tested did not successfully complete the programs resulting in a completion rate below 70%. Effect Failure to calculate the placement data for each student or achievement of the required completion rate is noncompliance with Federal regulation and could result in loss of future funding Recommendation We recommend City Colleges enhance their policies and procedures to ensure that calculation of placement rates is being maintained and that completion rates are being monitored for compliance. Views of responsible officials We agree with this finding. See corrective action plan.

Finding 2023-003– Common Origination and Disbursement (COD) Reporting Repeat Finding: No Federal Program Title – U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal Pell Grant Program: 84.063 Federal Award Year 2022-2023 Condition For ten out of forty students tested (25%), the College did not report certain disbursements of financial aid to COD within the require fifteen days from the date of disbursement. In all instances, the disbursements were reported one day late. Criteria For the Direct Loan and Pell Grant Programs, Institutions must report student disbursement data to COD within 15 calendar days after the institution makes a disbursement or becomes aware of the need to make an adjustment to previously reported student disbursement data or expected student disbursement data. Institutions may do this by reporting once every 15 calendar days, bi-weekly or weekly, or may set up their own system to ensure that changes are reported in a timely manner. 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure timeliness of transmission of disbursement records to COD. Questioned Costs There were no questioned costs with respect to this finding. Cause The financial aid office inadvertently miscalculated the reporting date. Prevalence Frequent. Ten out of forty students selected for testing. Effect Failure to report disbursement records to COD could result in loss of future funding. Recommendation We recommend City Colleges enhance their policies and procedures to ensure COD disbursement records are transmitted to COD within the required timeframe. Views of responsible officials We agree with this finding. See corrective action plan.

Finding 2023-003– Common Origination and Disbursement (COD) Reporting Repeat Finding: No Federal Program Title – U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal Pell Grant Program: 84.063 Federal Award Year 2022-2023 Condition For ten out of forty students tested (25%), the College did not report certain disbursements of financial aid to COD within the require fifteen days from the date of disbursement. In all instances, the disbursements were reported one day late. Criteria For the Direct Loan and Pell Grant Programs, Institutions must report student disbursement data to COD within 15 calendar days after the institution makes a disbursement or becomes aware of the need to make an adjustment to previously reported student disbursement data or expected student disbursement data. Institutions may do this by reporting once every 15 calendar days, bi-weekly or weekly, or may set up their own system to ensure that changes are reported in a timely manner. 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure timeliness of transmission of disbursement records to COD. Questioned Costs There were no questioned costs with respect to this finding. Cause The financial aid office inadvertently miscalculated the reporting date. Prevalence Frequent. Ten out of forty students selected for testing. Effect Failure to report disbursement records to COD could result in loss of future funding. Recommendation We recommend City Colleges enhance their policies and procedures to ensure COD disbursement records are transmitted to COD within the required timeframe. Views of responsible officials We agree with this finding. See corrective action plan.

Finding 2023-004– Cash Management – Excess Cash Repeat Finding: No Federal Program Title – U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal Pell Grant Program: 84.063 Federal Award Year 2022-2023 Condition During our cash management testing, we identified the following instances of excess cash: • Kennedy King College had excess cash for the Pell Grant Program ranging from $34,408 to $175,609 during the period of November 14, 2022 through January 31, 2023. In these situations, the excess cash exceeded one percent of total prior year drawdowns and amounts were not returned within a seven day period, as outlined below. • Kennedy King College had excess cash for the Direct Loan Program ranging from $1,349 to $4,318 during the period of November 29, 2022 through December 13, 2022, from $1,508 to $3,948 during the period of January 6, 2023 through January 16, 2023 and from $3,207 to $5,137 during the period of June 15, 2023 through June 29, 2023. In these situations, the excess cash did not exceed one percent of total prior year drawdowns, however, amounts were not returned within a seven day period, as outlined below. • Truman College had excess cash for the Pell Grant Program ranging from $164,625 to $262,034 during the period of November 14, 2022 through January 31, 2023. In these situations, the excess cash exceeded one percent of total prior year drawdowns and amounts were not returned within a seven day period, as outlined below. • Truman College had excess cash for the Direct Loan Program ranging from $2,731 to $8,669 during the period of January 20, 2023 through February 16, 2023 and from $752 to $10,028 during the period of April 28, 2023 through June 29, 2023. In these situations, the excess cash did not exceed one percent of total prior year drawdowns, however, amounts were not returned within a seven day period, as outlined below. Criteria Uniform Grant Guidance (34 CFR 668.166) states the Secretary considers excess cash to be any amount of title IV, HEA program funds, other than Federal Perkins Loan program funds, that an institution does not disburse to students by the end of the third business day following the date the institution (1) received those funds from the Secretary; or (2) deposited or transferred to its depository account previously disbursed title IV, HEA program funds, such as those resulting from awards adjustments, recoveries, or cancellations. An institution may maintain for up to seven days an amount of excess cash that does not exceed one percent of the total amount of funds the institution drew down in the prior award year. The institution must return immediately to the Secretary any amount of excess cash over the one-percent tolerance and any amount of excess cash remaining in its account after the seven-day tolerance period. Uniform Grant Guidance (2 CFR 200.303) requires nonfederal entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure excess cash is properly handled. Questioned Costs Questioned costs would be those in excess of the one percent threshold. Questioned costs for the Kennedy King College Pell Grant Program excess cash ranged from $486 to $133,996. Questioned costs for Truman College Grant Program excess cash ranged from $108,399 to $205,809. Cause The College drew down funds available in the G5 system as opposed to drawing down expected student disbursement amounts. Effect Excess cash is noncompliance with Federal regulation and could result in the loss of future funding and the return of additional funds. Recommendation We recommend City Colleges review current processes for monitoring cash management and implement procedures that eliminate excess cash. Views of responsible officials We agree with this finding. See corrective action plan.

Finding 2023-004– Cash Management – Excess Cash Repeat Finding: No Federal Program Title – U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal Pell Grant Program: 84.063 Federal Award Year 2022-2023 Condition During our cash management testing, we identified the following instances of excess cash: • Kennedy King College had excess cash for the Pell Grant Program ranging from $34,408 to $175,609 during the period of November 14, 2022 through January 31, 2023. In these situations, the excess cash exceeded one percent of total prior year drawdowns and amounts were not returned within a seven day period, as outlined below. • Kennedy King College had excess cash for the Direct Loan Program ranging from $1,349 to $4,318 during the period of November 29, 2022 through December 13, 2022, from $1,508 to $3,948 during the period of January 6, 2023 through January 16, 2023 and from $3,207 to $5,137 during the period of June 15, 2023 through June 29, 2023. In these situations, the excess cash did not exceed one percent of total prior year drawdowns, however, amounts were not returned within a seven day period, as outlined below. • Truman College had excess cash for the Pell Grant Program ranging from $164,625 to $262,034 during the period of November 14, 2022 through January 31, 2023. In these situations, the excess cash exceeded one percent of total prior year drawdowns and amounts were not returned within a seven day period, as outlined below. • Truman College had excess cash for the Direct Loan Program ranging from $2,731 to $8,669 during the period of January 20, 2023 through February 16, 2023 and from $752 to $10,028 during the period of April 28, 2023 through June 29, 2023. In these situations, the excess cash did not exceed one percent of total prior year drawdowns, however, amounts were not returned within a seven day period, as outlined below. Criteria Uniform Grant Guidance (34 CFR 668.166) states the Secretary considers excess cash to be any amount of title IV, HEA program funds, other than Federal Perkins Loan program funds, that an institution does not disburse to students by the end of the third business day following the date the institution (1) received those funds from the Secretary; or (2) deposited or transferred to its depository account previously disbursed title IV, HEA program funds, such as those resulting from awards adjustments, recoveries, or cancellations. An institution may maintain for up to seven days an amount of excess cash that does not exceed one percent of the total amount of funds the institution drew down in the prior award year. The institution must return immediately to the Secretary any amount of excess cash over the one-percent tolerance and any amount of excess cash remaining in its account after the seven-day tolerance period. Uniform Grant Guidance (2 CFR 200.303) requires nonfederal entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure excess cash is properly handled. Questioned Costs Questioned costs would be those in excess of the one percent threshold. Questioned costs for the Kennedy King College Pell Grant Program excess cash ranged from $486 to $133,996. Questioned costs for Truman College Grant Program excess cash ranged from $108,399 to $205,809. Cause The College drew down funds available in the G5 system as opposed to drawing down expected student disbursement amounts. Effect Excess cash is noncompliance with Federal regulation and could result in the loss of future funding and the return of additional funds. Recommendation We recommend City Colleges review current processes for monitoring cash management and implement procedures that eliminate excess cash. Views of responsible officials We agree with this finding. See corrective action plan.

Finding 2023-005– Student Financial Assistance Cluster Internal Control over Compliance Repeat Finding: No Federal Program Title – U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal Pell Grant Program: 84.063 Federal Work-Study Program: 84.033 Federal Supplemental Educational Opportunity Grants: 84.007 Federal Award Year 2022-2023 Condition City Colleges did not have sufficient documentation that internal controls were in place and operating effectively relative to the following areas: • Allowable Activities: For each of the seven campuses, City Colleges did not have sufficient supporting evidence that review controls were performed over the transfer, carryforward, carryback, and administrative cost calculations in the Fiscal Operations Report and Application to Participate (FISAP) for award year July 1, 2021 through June 30, 2022 submitted during fiscal year 2023. • Reporting: For each of the seven campuses, City Colleges did not have sufficient supporting evidence that secondary review controls were performed over FISAP data for award year July 1, 2021 through June 30, 2022 submitted during fiscal year 2023. Criteria 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure the review and approval controls over allowable activities, eligibility and reporting compliance requirements are sufficiently documented. Questioned Costs There were no questioned costs with respect to this finding. Cause City Colleges did not formally document the additional reviews and approvals over the department’s review of the FISAP. Effect For allowable activities, the lack of properly documented reviews in carryforward, carryback, and administrative cost calculations could result in errors that would impact future funding determinations. For eligibility, the lack of properly documented reviews could result in over or under awards to students which could result in loss of future funding. For reporting, the lack of properly documented reviews over the FISAP, could result in loss of future funding. Recommendation We recommend City Colleges implement controls to ensure that sufficient documentation is maintained over review control associated with eligibility, allowable costs and reporting. Views of responsible officials We agree with this finding. See corrective action plan.

Finding 2023-005– Student Financial Assistance Cluster Internal Control over Compliance Repeat Finding: No Federal Program Title – U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal Pell Grant Program: 84.063 Federal Work-Study Program: 84.033 Federal Supplemental Educational Opportunity Grants: 84.007 Federal Award Year 2022-2023 Condition City Colleges did not have sufficient documentation that internal controls were in place and operating effectively relative to the following areas: • Allowable Activities: For each of the seven campuses, City Colleges did not have sufficient supporting evidence that review controls were performed over the transfer, carryforward, carryback, and administrative cost calculations in the Fiscal Operations Report and Application to Participate (FISAP) for award year July 1, 2021 through June 30, 2022 submitted during fiscal year 2023. • Reporting: For each of the seven campuses, City Colleges did not have sufficient supporting evidence that secondary review controls were performed over FISAP data for award year July 1, 2021 through June 30, 2022 submitted during fiscal year 2023. Criteria 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure the review and approval controls over allowable activities, eligibility and reporting compliance requirements are sufficiently documented. Questioned Costs There were no questioned costs with respect to this finding. Cause City Colleges did not formally document the additional reviews and approvals over the department’s review of the FISAP. Effect For allowable activities, the lack of properly documented reviews in carryforward, carryback, and administrative cost calculations could result in errors that would impact future funding determinations. For eligibility, the lack of properly documented reviews could result in over or under awards to students which could result in loss of future funding. For reporting, the lack of properly documented reviews over the FISAP, could result in loss of future funding. Recommendation We recommend City Colleges implement controls to ensure that sufficient documentation is maintained over review control associated with eligibility, allowable costs and reporting. Views of responsible officials We agree with this finding. See corrective action plan.

Finding 2023-005– Student Financial Assistance Cluster Internal Control over Compliance Repeat Finding: No Federal Program Title – U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal Pell Grant Program: 84.063 Federal Work-Study Program: 84.033 Federal Supplemental Educational Opportunity Grants: 84.007 Federal Award Year 2022-2023 Condition City Colleges did not have sufficient documentation that internal controls were in place and operating effectively relative to the following areas: • Allowable Activities: For each of the seven campuses, City Colleges did not have sufficient supporting evidence that review controls were performed over the transfer, carryforward, carryback, and administrative cost calculations in the Fiscal Operations Report and Application to Participate (FISAP) for award year July 1, 2021 through June 30, 2022 submitted during fiscal year 2023. • Reporting: For each of the seven campuses, City Colleges did not have sufficient supporting evidence that secondary review controls were performed over FISAP data for award year July 1, 2021 through June 30, 2022 submitted during fiscal year 2023. Criteria 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure the review and approval controls over allowable activities, eligibility and reporting compliance requirements are sufficiently documented. Questioned Costs There were no questioned costs with respect to this finding. Cause City Colleges did not formally document the additional reviews and approvals over the department’s review of the FISAP. Effect For allowable activities, the lack of properly documented reviews in carryforward, carryback, and administrative cost calculations could result in errors that would impact future funding determinations. For eligibility, the lack of properly documented reviews could result in over or under awards to students which could result in loss of future funding. For reporting, the lack of properly documented reviews over the FISAP, could result in loss of future funding. Recommendation We recommend City Colleges implement controls to ensure that sufficient documentation is maintained over review control associated with eligibility, allowable costs and reporting. Views of responsible officials We agree with this finding. See corrective action plan.

Finding 2023-005– Student Financial Assistance Cluster Internal Control over Compliance Repeat Finding: No Federal Program Title – U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal Pell Grant Program: 84.063 Federal Work-Study Program: 84.033 Federal Supplemental Educational Opportunity Grants: 84.007 Federal Award Year 2022-2023 Condition City Colleges did not have sufficient documentation that internal controls were in place and operating effectively relative to the following areas: • Allowable Activities: For each of the seven campuses, City Colleges did not have sufficient supporting evidence that review controls were performed over the transfer, carryforward, carryback, and administrative cost calculations in the Fiscal Operations Report and Application to Participate (FISAP) for award year July 1, 2021 through June 30, 2022 submitted during fiscal year 2023. • Reporting: For each of the seven campuses, City Colleges did not have sufficient supporting evidence that secondary review controls were performed over FISAP data for award year July 1, 2021 through June 30, 2022 submitted during fiscal year 2023. Criteria 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure the review and approval controls over allowable activities, eligibility and reporting compliance requirements are sufficiently documented. Questioned Costs There were no questioned costs with respect to this finding. Cause City Colleges did not formally document the additional reviews and approvals over the department’s review of the FISAP. Effect For allowable activities, the lack of properly documented reviews in carryforward, carryback, and administrative cost calculations could result in errors that would impact future funding determinations. For eligibility, the lack of properly documented reviews could result in over or under awards to students which could result in loss of future funding. For reporting, the lack of properly documented reviews over the FISAP, could result in loss of future funding. Recommendation We recommend City Colleges implement controls to ensure that sufficient documentation is maintained over review control associated with eligibility, allowable costs and reporting. Views of responsible officials We agree with this finding. See corrective action plan.

Finding 2023-006– Gramm-Leach Bliley Act—Student Information Security Repeat Finding: No Federal Program Title – U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal Pell Grant Program: 84.063 Federal Work-Study Program: 84.033 Federal Supplemental Educational Opportunity Grants: 84.007 Federal Award Year 2022-2023 Condition City Colleges did not have a documented policy to address a required safeguard for one of the eight required elements under the Gramm-Leach Bliley Act (GLBA). Specifically, the City Colleges did not conduct a periodic inventory of data, nothing where it’s collected, stored or transmitted. Criteria In accordance with 16 CFR 314.4(c), an institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). This includes the following: (1) implement and periodically review access controls, (2) conduct a periodic inventory of data, noting where it’s collected, stored or transmitted, (3) encrypt customer information on the institution’s system and when it’s in transit, (4) assess apps developed by the institution, (5) implement multi-factor authentication for anyone accessing customer information on the institution’s system, (6) dispose of customer information securely, (7) anticipate and evaluate changes to the information system or network, and (8) maintain a log of authorized users’ activity and keep an eye out for unauthorized users. 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure that reviews are being completed over information security policies and that they are in compliance with GLBA requirements. Questioned Costs There were no questioned costs with respect to this finding. Cause City Colleges does not have a periodic data inventory in place. The policy is under development with an expected completion date of Spring 2024. Effect Failure to meet the minimum requirements of the GLBA act is noncompliance and increases the risk of unauthorized disclosure, misuse, alteration, destruction, or other comprise of student information. Recommendation We recommend City Colleges implement controls to ensure that GLBA requirements are reviewed and addressed in a formally documented policy. Views of responsible officials We agree with this finding. See corrective action plan.

Finding 2023-006– Gramm-Leach Bliley Act—Student Information Security Repeat Finding: No Federal Program Title – U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal Pell Grant Program: 84.063 Federal Work-Study Program: 84.033 Federal Supplemental Educational Opportunity Grants: 84.007 Federal Award Year 2022-2023 Condition City Colleges did not have a documented policy to address a required safeguard for one of the eight required elements under the Gramm-Leach Bliley Act (GLBA). Specifically, the City Colleges did not conduct a periodic inventory of data, nothing where it’s collected, stored or transmitted. Criteria In accordance with 16 CFR 314.4(c), an institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). This includes the following: (1) implement and periodically review access controls, (2) conduct a periodic inventory of data, noting where it’s collected, stored or transmitted, (3) encrypt customer information on the institution’s system and when it’s in transit, (4) assess apps developed by the institution, (5) implement multi-factor authentication for anyone accessing customer information on the institution’s system, (6) dispose of customer information securely, (7) anticipate and evaluate changes to the information system or network, and (8) maintain a log of authorized users’ activity and keep an eye out for unauthorized users. 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure that reviews are being completed over information security policies and that they are in compliance with GLBA requirements. Questioned Costs There were no questioned costs with respect to this finding. Cause City Colleges does not have a periodic data inventory in place. The policy is under development with an expected completion date of Spring 2024. Effect Failure to meet the minimum requirements of the GLBA act is noncompliance and increases the risk of unauthorized disclosure, misuse, alteration, destruction, or other comprise of student information. Recommendation We recommend City Colleges implement controls to ensure that GLBA requirements are reviewed and addressed in a formally documented policy. Views of responsible officials We agree with this finding. See corrective action plan.

Finding 2023-006– Gramm-Leach Bliley Act—Student Information Security Repeat Finding: No Federal Program Title – U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal Pell Grant Program: 84.063 Federal Work-Study Program: 84.033 Federal Supplemental Educational Opportunity Grants: 84.007 Federal Award Year 2022-2023 Condition City Colleges did not have a documented policy to address a required safeguard for one of the eight required elements under the Gramm-Leach Bliley Act (GLBA). Specifically, the City Colleges did not conduct a periodic inventory of data, nothing where it’s collected, stored or transmitted. Criteria In accordance with 16 CFR 314.4(c), an institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). This includes the following: (1) implement and periodically review access controls, (2) conduct a periodic inventory of data, noting where it’s collected, stored or transmitted, (3) encrypt customer information on the institution’s system and when it’s in transit, (4) assess apps developed by the institution, (5) implement multi-factor authentication for anyone accessing customer information on the institution’s system, (6) dispose of customer information securely, (7) anticipate and evaluate changes to the information system or network, and (8) maintain a log of authorized users’ activity and keep an eye out for unauthorized users. 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure that reviews are being completed over information security policies and that they are in compliance with GLBA requirements. Questioned Costs There were no questioned costs with respect to this finding. Cause City Colleges does not have a periodic data inventory in place. The policy is under development with an expected completion date of Spring 2024. Effect Failure to meet the minimum requirements of the GLBA act is noncompliance and increases the risk of unauthorized disclosure, misuse, alteration, destruction, or other comprise of student information. Recommendation We recommend City Colleges implement controls to ensure that GLBA requirements are reviewed and addressed in a formally documented policy. Views of responsible officials We agree with this finding. See corrective action plan.

Finding 2023-006– Gramm-Leach Bliley Act—Student Information Security Repeat Finding: No Federal Program Title – U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal Pell Grant Program: 84.063 Federal Work-Study Program: 84.033 Federal Supplemental Educational Opportunity Grants: 84.007 Federal Award Year 2022-2023 Condition City Colleges did not have a documented policy to address a required safeguard for one of the eight required elements under the Gramm-Leach Bliley Act (GLBA). Specifically, the City Colleges did not conduct a periodic inventory of data, nothing where it’s collected, stored or transmitted. Criteria In accordance with 16 CFR 314.4(c), an institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). This includes the following: (1) implement and periodically review access controls, (2) conduct a periodic inventory of data, noting where it’s collected, stored or transmitted, (3) encrypt customer information on the institution’s system and when it’s in transit, (4) assess apps developed by the institution, (5) implement multi-factor authentication for anyone accessing customer information on the institution’s system, (6) dispose of customer information securely, (7) anticipate and evaluate changes to the information system or network, and (8) maintain a log of authorized users’ activity and keep an eye out for unauthorized users. 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure that reviews are being completed over information security policies and that they are in compliance with GLBA requirements. Questioned Costs There were no questioned costs with respect to this finding. Cause City Colleges does not have a periodic data inventory in place. The policy is under development with an expected completion date of Spring 2024. Effect Failure to meet the minimum requirements of the GLBA act is noncompliance and increases the risk of unauthorized disclosure, misuse, alteration, destruction, or other comprise of student information. Recommendation We recommend City Colleges implement controls to ensure that GLBA requirements are reviewed and addressed in a formally documented policy. Views of responsible officials We agree with this finding. See corrective action plan.

Finding 2023-007 – COVID-19 Education Stabilization Fund: Higher Education Emergency Relief Fund Annual Reporting Repeat Finding: Partial Federal Program Title – U.S. Department of Education COVID-19 Education Stabilization Fund Higher Education Emergency Relief Fund (HEERF) COVID-19: HEERF Institutional Portion 84.425F Federal Award Year 2022-2023 Condition City Colleges did not accurately report certain information required in the calendar year 2022 annual report. The following instances of noncompliance were identified: • HEERF Institutional Portion: City Colleges submitted the annual report for Olive Harvey for the period of January 1, 2022 – December 31, 2022 which did not reconcile to the underlying expense detail as of the date of the report. The difference was $234,118 which was a result of a figure being double counted in the total. • HEERF Institutional Portion: City Colleges submitted the annual report for Malcolm X for the period of January 1, 2022 – December 31, 2022 which did not reconcile to the underlying expense detail as of the date of the report. The difference was $5,580,216 which was a result of a figure being double counted in the total. Criteria The Department of Education requires the submission of a “Higher Education Emergency Relief Fund (HEERF) I, II, & III Annual Performance Report” to be submitted on a calendar year basis. The third annual report covered the period of January 1, 2022 – December 31, 2022 and was due in March 2023. 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure the timely and accurate posting of reports. Questioned Costs There were no questioned costs with respect to this finding. Cause City Colleges did not have effective internal controls in place to ensure reports were submitted accurately. Reports were reviewed prior to submission but those reviews were not precise enough. Prevalence Infrequent. 35 reports were required to be submitted in fiscal year 2023 relative to HEERF Student, Institutional, MSI and Annual reporting. 2 reports contained 1 field that was inaccurate. Effect The submission of inaccurate reports is noncompliance with the requirements of the grant award and could result in other penalties. Recommendation We recommend City Colleges implement internal controls to ensure reports are submitted accurately for the final annual report that is anticipated to be due in early 2024. Views of responsible officials We agree with this finding. See corrective action plan.

Finding 2023-008 – Student Financial Assistance Cluster – Fraudulent Enrollment Repeat Finding: No Federal Program Title – U.S. Department of Education Student Financial Assistance Cluster Federal Pell Grant Program: 84.063 Federal Work-Study Program: 84.033 Federal Supplemental Educational Opportunity Grants: 84.007 Federal Direct Student Loans: 84.268 Federal Award Year 2022-2023 Condition City Colleges did not timely report information regarding potential fraudulent student enrollments to the Department of Education’s Office of Inspector General (OIG). City Colleges identified a total of 23 students where the Enrollment and Admissions Departments discovered submission of fraudulent documents to verify residency. City Colleges performed a thorough investigation of student enrollment and verified that no aid was disbursed for these identified fraudulent enrollments. Criteria In accordance with Chapter 3 “FSA Administrative and Related Requirements” of the Federal Student Aid Handbook, the Department of Education requires that “a school must refer any credible information indicating that an applicant for federal student aid may have engaged in fraud or other criminal misconduct in connection with his or her application.” 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure all Department of Education requirements are followed. Questioned Costs There were no questioned costs with respect to this finding. Cause City Colleges experienced turnover in the Admissions Department and was training a new employee. The new employee did not have enough training or experience to identify fraudulent documents when the students enrolled with the college and registered for classes. City Colleges was not aware that this issue was required to be reported to the Department of Education. Prevalence Infrequent. 23 fraudulent applications were identified. Effect The inability to identify fraudulent documents could result in the incorrect distribution of student financial aid. Recommendation We recommend City Colleges increase training around reporting requirements to the U.S. Department of Education when fraudulent student enrollments occur. Views of responsible officials We agree with this finding. See corrective action plan.

Finding 2023-008 – Student Financial Assistance Cluster – Fraudulent Enrollment Repeat Finding: No Federal Program Title – U.S. Department of Education Student Financial Assistance Cluster Federal Pell Grant Program: 84.063 Federal Work-Study Program: 84.033 Federal Supplemental Educational Opportunity Grants: 84.007 Federal Direct Student Loans: 84.268 Federal Award Year 2022-2023 Condition City Colleges did not timely report information regarding potential fraudulent student enrollments to the Department of Education’s Office of Inspector General (OIG). City Colleges identified a total of 23 students where the Enrollment and Admissions Departments discovered submission of fraudulent documents to verify residency. City Colleges performed a thorough investigation of student enrollment and verified that no aid was disbursed for these identified fraudulent enrollments. Criteria In accordance with Chapter 3 “FSA Administrative and Related Requirements” of the Federal Student Aid Handbook, the Department of Education requires that “a school must refer any credible information indicating that an applicant for federal student aid may have engaged in fraud or other criminal misconduct in connection with his or her application.” 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure all Department of Education requirements are followed. Questioned Costs There were no questioned costs with respect to this finding. Cause City Colleges experienced turnover in the Admissions Department and was training a new employee. The new employee did not have enough training or experience to identify fraudulent documents when the students enrolled with the college and registered for classes. City Colleges was not aware that this issue was required to be reported to the Department of Education. Prevalence Infrequent. 23 fraudulent applications were identified. Effect The inability to identify fraudulent documents could result in the incorrect distribution of student financial aid. Recommendation We recommend City Colleges increase training around reporting requirements to the U.S. Department of Education when fraudulent student enrollments occur. Views of responsible officials We agree with this finding. See corrective action plan.

Finding 2023-008 – Student Financial Assistance Cluster – Fraudulent Enrollment Repeat Finding: No Federal Program Title – U.S. Department of Education Student Financial Assistance Cluster Federal Pell Grant Program: 84.063 Federal Work-Study Program: 84.033 Federal Supplemental Educational Opportunity Grants: 84.007 Federal Direct Student Loans: 84.268 Federal Award Year 2022-2023 Condition City Colleges did not timely report information regarding potential fraudulent student enrollments to the Department of Education’s Office of Inspector General (OIG). City Colleges identified a total of 23 students where the Enrollment and Admissions Departments discovered submission of fraudulent documents to verify residency. City Colleges performed a thorough investigation of student enrollment and verified that no aid was disbursed for these identified fraudulent enrollments. Criteria In accordance with Chapter 3 “FSA Administrative and Related Requirements” of the Federal Student Aid Handbook, the Department of Education requires that “a school must refer any credible information indicating that an applicant for federal student aid may have engaged in fraud or other criminal misconduct in connection with his or her application.” 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure all Department of Education requirements are followed. Questioned Costs There were no questioned costs with respect to this finding. Cause City Colleges experienced turnover in the Admissions Department and was training a new employee. The new employee did not have enough training or experience to identify fraudulent documents when the students enrolled with the college and registered for classes. City Colleges was not aware that this issue was required to be reported to the Department of Education. Prevalence Infrequent. 23 fraudulent applications were identified. Effect The inability to identify fraudulent documents could result in the incorrect distribution of student financial aid. Recommendation We recommend City Colleges increase training around reporting requirements to the U.S. Department of Education when fraudulent student enrollments occur. Views of responsible officials We agree with this finding. See corrective action plan.

Finding 2023-008 – Student Financial Assistance Cluster – Fraudulent Enrollment Repeat Finding: No Federal Program Title – U.S. Department of Education Student Financial Assistance Cluster Federal Pell Grant Program: 84.063 Federal Work-Study Program: 84.033 Federal Supplemental Educational Opportunity Grants: 84.007 Federal Direct Student Loans: 84.268 Federal Award Year 2022-2023 Condition City Colleges did not timely report information regarding potential fraudulent student enrollments to the Department of Education’s Office of Inspector General (OIG). City Colleges identified a total of 23 students where the Enrollment and Admissions Departments discovered submission of fraudulent documents to verify residency. City Colleges performed a thorough investigation of student enrollment and verified that no aid was disbursed for these identified fraudulent enrollments. Criteria In accordance with Chapter 3 “FSA Administrative and Related Requirements” of the Federal Student Aid Handbook, the Department of Education requires that “a school must refer any credible information indicating that an applicant for federal student aid may have engaged in fraud or other criminal misconduct in connection with his or her application.” 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure all Department of Education requirements are followed. Questioned Costs There were no questioned costs with respect to this finding. Cause City Colleges experienced turnover in the Admissions Department and was training a new employee. The new employee did not have enough training or experience to identify fraudulent documents when the students enrolled with the college and registered for classes. City Colleges was not aware that this issue was required to be reported to the Department of Education. Prevalence Infrequent. 23 fraudulent applications were identified. Effect The inability to identify fraudulent documents could result in the incorrect distribution of student financial aid. Recommendation We recommend City Colleges increase training around reporting requirements to the U.S. Department of Education when fraudulent student enrollments occur. Views of responsible officials We agree with this finding. See corrective action plan.

Finding 2023-001 – Enrollment Reporting Repeat Finding: Yes Federal Program Title – U.S. Department of Education Student Financial Assistance Cluster Federal Pell Grant Program: 84.063 Federal Direct Student Loans: 84.268 Federal Award Year 2022-2023 Condition For four out of sixty students tested (7%) who withdrew from City Colleges, the students’ withdrawal date reported to the National Student Loan Data System (NSLDS) for campus level and program level did not match the institution’s records. Criteria CFR section 685.309 and 690.83(b)(2) requires City Colleges to notify the NSLDS within 30 days of a change in student status or include the change in status in a response to an enrollment reporting roster within 60 days of the student’s date of determination of withdrawal. 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure accurate reporting of enrollment status changes. Questioned Costs There were no questioned costs related to testing of enrollment reporting. Cause The financial aid office does not have an effective system in place to ensure all official student status changes are reported to the lender accurately. Prevalence Infrequent. Four out of sixty students selected for testing. Effect Failure to report status changes timely is noncompliance with Federal regulation and could result in loss of future funding. Recommendation We recommend City Colleges implement monitoring procedures which will promptly notify the financial aid office of any student status changes. A system of monitoring procedures and/or controls will ensure the College is reporting any status changes to the lender accurately. City Colleges should implement a review process to ensure all status changes are addressed by the financial aid office. Views of responsible officials We agree with this finding. See corrective action plan.

Finding 2023-001 – Enrollment Reporting Repeat Finding: Yes Federal Program Title – U.S. Department of Education Student Financial Assistance Cluster Federal Pell Grant Program: 84.063 Federal Direct Student Loans: 84.268 Federal Award Year 2022-2023 Condition For four out of sixty students tested (7%) who withdrew from City Colleges, the students’ withdrawal date reported to the National Student Loan Data System (NSLDS) for campus level and program level did not match the institution’s records. Criteria CFR section 685.309 and 690.83(b)(2) requires City Colleges to notify the NSLDS within 30 days of a change in student status or include the change in status in a response to an enrollment reporting roster within 60 days of the student’s date of determination of withdrawal. 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure accurate reporting of enrollment status changes. Questioned Costs There were no questioned costs related to testing of enrollment reporting. Cause The financial aid office does not have an effective system in place to ensure all official student status changes are reported to the lender accurately. Prevalence Infrequent. Four out of sixty students selected for testing. Effect Failure to report status changes timely is noncompliance with Federal regulation and could result in loss of future funding. Recommendation We recommend City Colleges implement monitoring procedures which will promptly notify the financial aid office of any student status changes. A system of monitoring procedures and/or controls will ensure the College is reporting any status changes to the lender accurately. City Colleges should implement a review process to ensure all status changes are addressed by the financial aid office. Views of responsible officials We agree with this finding. See corrective action plan.

Finding 2023-002– Short-Term Program Completion and Placement Rates Repeat Finding: Yes Federal Program Title – U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal Award Year 2022-2023 Condition The College did not achieve the required 70% completion rate for a short-term program. The College cannot demonstrate compliance with the gainful employment placement rate calculation for a short-term program. Criteria For the Direct Loan Program, short-term eligible programs at a postsecondary vocational institution must be between 300 - 599 clock hours. They must have been provided for at least one year and must have a substantiated completion and placement rate of at least 70 percent for the most recently completed award year. 34 CFR Section 668.8(f) and (g) requires the college to have documentation supporting its placement rates for each student showing that the student obtained gainful employment in the recognized occupation for which he or she was trained or in a related comparable recognized occupation. 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure compliance with completion and placement rate calculations for short-term programs. Questioned Costs There were no questioned costs with respect to this finding. Cause The financial aid office did not follow-up on the gainful employment of students. Prevalence Frequent. Two out of two students who completed the program did not have sufficient support for the placement rate calculation. Five out of seven students tested did not successfully complete the programs resulting in a completion rate below 70%. Effect Failure to calculate the placement data for each student or achievement of the required completion rate is noncompliance with Federal regulation and could result in loss of future funding Recommendation We recommend City Colleges enhance their policies and procedures to ensure that calculation of placement rates is being maintained and that completion rates are being monitored for compliance. Views of responsible officials We agree with this finding. See corrective action plan.

Finding 2023-003– Common Origination and Disbursement (COD) Reporting Repeat Finding: No Federal Program Title – U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal Pell Grant Program: 84.063 Federal Award Year 2022-2023 Condition For ten out of forty students tested (25%), the College did not report certain disbursements of financial aid to COD within the require fifteen days from the date of disbursement. In all instances, the disbursements were reported one day late. Criteria For the Direct Loan and Pell Grant Programs, Institutions must report student disbursement data to COD within 15 calendar days after the institution makes a disbursement or becomes aware of the need to make an adjustment to previously reported student disbursement data or expected student disbursement data. Institutions may do this by reporting once every 15 calendar days, bi-weekly or weekly, or may set up their own system to ensure that changes are reported in a timely manner. 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure timeliness of transmission of disbursement records to COD. Questioned Costs There were no questioned costs with respect to this finding. Cause The financial aid office inadvertently miscalculated the reporting date. Prevalence Frequent. Ten out of forty students selected for testing. Effect Failure to report disbursement records to COD could result in loss of future funding. Recommendation We recommend City Colleges enhance their policies and procedures to ensure COD disbursement records are transmitted to COD within the required timeframe. Views of responsible officials We agree with this finding. See corrective action plan.

Finding 2023-003– Common Origination and Disbursement (COD) Reporting Repeat Finding: No Federal Program Title – U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal Pell Grant Program: 84.063 Federal Award Year 2022-2023 Condition For ten out of forty students tested (25%), the College did not report certain disbursements of financial aid to COD within the require fifteen days from the date of disbursement. In all instances, the disbursements were reported one day late. Criteria For the Direct Loan and Pell Grant Programs, Institutions must report student disbursement data to COD within 15 calendar days after the institution makes a disbursement or becomes aware of the need to make an adjustment to previously reported student disbursement data or expected student disbursement data. Institutions may do this by reporting once every 15 calendar days, bi-weekly or weekly, or may set up their own system to ensure that changes are reported in a timely manner. 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure timeliness of transmission of disbursement records to COD. Questioned Costs There were no questioned costs with respect to this finding. Cause The financial aid office inadvertently miscalculated the reporting date. Prevalence Frequent. Ten out of forty students selected for testing. Effect Failure to report disbursement records to COD could result in loss of future funding. Recommendation We recommend City Colleges enhance their policies and procedures to ensure COD disbursement records are transmitted to COD within the required timeframe. Views of responsible officials We agree with this finding. See corrective action plan.

Finding 2023-004– Cash Management – Excess Cash Repeat Finding: No Federal Program Title – U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal Pell Grant Program: 84.063 Federal Award Year 2022-2023 Condition During our cash management testing, we identified the following instances of excess cash: • Kennedy King College had excess cash for the Pell Grant Program ranging from $34,408 to $175,609 during the period of November 14, 2022 through January 31, 2023. In these situations, the excess cash exceeded one percent of total prior year drawdowns and amounts were not returned within a seven day period, as outlined below. • Kennedy King College had excess cash for the Direct Loan Program ranging from $1,349 to $4,318 during the period of November 29, 2022 through December 13, 2022, from $1,508 to $3,948 during the period of January 6, 2023 through January 16, 2023 and from $3,207 to $5,137 during the period of June 15, 2023 through June 29, 2023. In these situations, the excess cash did not exceed one percent of total prior year drawdowns, however, amounts were not returned within a seven day period, as outlined below. • Truman College had excess cash for the Pell Grant Program ranging from $164,625 to $262,034 during the period of November 14, 2022 through January 31, 2023. In these situations, the excess cash exceeded one percent of total prior year drawdowns and amounts were not returned within a seven day period, as outlined below. • Truman College had excess cash for the Direct Loan Program ranging from $2,731 to $8,669 during the period of January 20, 2023 through February 16, 2023 and from $752 to $10,028 during the period of April 28, 2023 through June 29, 2023. In these situations, the excess cash did not exceed one percent of total prior year drawdowns, however, amounts were not returned within a seven day period, as outlined below. Criteria Uniform Grant Guidance (34 CFR 668.166) states the Secretary considers excess cash to be any amount of title IV, HEA program funds, other than Federal Perkins Loan program funds, that an institution does not disburse to students by the end of the third business day following the date the institution (1) received those funds from the Secretary; or (2) deposited or transferred to its depository account previously disbursed title IV, HEA program funds, such as those resulting from awards adjustments, recoveries, or cancellations. An institution may maintain for up to seven days an amount of excess cash that does not exceed one percent of the total amount of funds the institution drew down in the prior award year. The institution must return immediately to the Secretary any amount of excess cash over the one-percent tolerance and any amount of excess cash remaining in its account after the seven-day tolerance period. Uniform Grant Guidance (2 CFR 200.303) requires nonfederal entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure excess cash is properly handled. Questioned Costs Questioned costs would be those in excess of the one percent threshold. Questioned costs for the Kennedy King College Pell Grant Program excess cash ranged from $486 to $133,996. Questioned costs for Truman College Grant Program excess cash ranged from $108,399 to $205,809. Cause The College drew down funds available in the G5 system as opposed to drawing down expected student disbursement amounts. Effect Excess cash is noncompliance with Federal regulation and could result in the loss of future funding and the return of additional funds. Recommendation We recommend City Colleges review current processes for monitoring cash management and implement procedures that eliminate excess cash. Views of responsible officials We agree with this finding. See corrective action plan.

Finding 2023-004– Cash Management – Excess Cash Repeat Finding: No Federal Program Title – U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal Pell Grant Program: 84.063 Federal Award Year 2022-2023 Condition During our cash management testing, we identified the following instances of excess cash: • Kennedy King College had excess cash for the Pell Grant Program ranging from $34,408 to $175,609 during the period of November 14, 2022 through January 31, 2023. In these situations, the excess cash exceeded one percent of total prior year drawdowns and amounts were not returned within a seven day period, as outlined below. • Kennedy King College had excess cash for the Direct Loan Program ranging from $1,349 to $4,318 during the period of November 29, 2022 through December 13, 2022, from $1,508 to $3,948 during the period of January 6, 2023 through January 16, 2023 and from $3,207 to $5,137 during the period of June 15, 2023 through June 29, 2023. In these situations, the excess cash did not exceed one percent of total prior year drawdowns, however, amounts were not returned within a seven day period, as outlined below. • Truman College had excess cash for the Pell Grant Program ranging from $164,625 to $262,034 during the period of November 14, 2022 through January 31, 2023. In these situations, the excess cash exceeded one percent of total prior year drawdowns and amounts were not returned within a seven day period, as outlined below. • Truman College had excess cash for the Direct Loan Program ranging from $2,731 to $8,669 during the period of January 20, 2023 through February 16, 2023 and from $752 to $10,028 during the period of April 28, 2023 through June 29, 2023. In these situations, the excess cash did not exceed one percent of total prior year drawdowns, however, amounts were not returned within a seven day period, as outlined below. Criteria Uniform Grant Guidance (34 CFR 668.166) states the Secretary considers excess cash to be any amount of title IV, HEA program funds, other than Federal Perkins Loan program funds, that an institution does not disburse to students by the end of the third business day following the date the institution (1) received those funds from the Secretary; or (2) deposited or transferred to its depository account previously disbursed title IV, HEA program funds, such as those resulting from awards adjustments, recoveries, or cancellations. An institution may maintain for up to seven days an amount of excess cash that does not exceed one percent of the total amount of funds the institution drew down in the prior award year. The institution must return immediately to the Secretary any amount of excess cash over the one-percent tolerance and any amount of excess cash remaining in its account after the seven-day tolerance period. Uniform Grant Guidance (2 CFR 200.303) requires nonfederal entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure excess cash is properly handled. Questioned Costs Questioned costs would be those in excess of the one percent threshold. Questioned costs for the Kennedy King College Pell Grant Program excess cash ranged from $486 to $133,996. Questioned costs for Truman College Grant Program excess cash ranged from $108,399 to $205,809. Cause The College drew down funds available in the G5 system as opposed to drawing down expected student disbursement amounts. Effect Excess cash is noncompliance with Federal regulation and could result in the loss of future funding and the return of additional funds. Recommendation We recommend City Colleges review current processes for monitoring cash management and implement procedures that eliminate excess cash. Views of responsible officials We agree with this finding. See corrective action plan.

Finding 2023-005– Student Financial Assistance Cluster Internal Control over Compliance Repeat Finding: No Federal Program Title – U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal Pell Grant Program: 84.063 Federal Work-Study Program: 84.033 Federal Supplemental Educational Opportunity Grants: 84.007 Federal Award Year 2022-2023 Condition City Colleges did not have sufficient documentation that internal controls were in place and operating effectively relative to the following areas: • Allowable Activities: For each of the seven campuses, City Colleges did not have sufficient supporting evidence that review controls were performed over the transfer, carryforward, carryback, and administrative cost calculations in the Fiscal Operations Report and Application to Participate (FISAP) for award year July 1, 2021 through June 30, 2022 submitted during fiscal year 2023. • Reporting: For each of the seven campuses, City Colleges did not have sufficient supporting evidence that secondary review controls were performed over FISAP data for award year July 1, 2021 through June 30, 2022 submitted during fiscal year 2023. Criteria 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure the review and approval controls over allowable activities, eligibility and reporting compliance requirements are sufficiently documented. Questioned Costs There were no questioned costs with respect to this finding. Cause City Colleges did not formally document the additional reviews and approvals over the department’s review of the FISAP. Effect For allowable activities, the lack of properly documented reviews in carryforward, carryback, and administrative cost calculations could result in errors that would impact future funding determinations. For eligibility, the lack of properly documented reviews could result in over or under awards to students which could result in loss of future funding. For reporting, the lack of properly documented reviews over the FISAP, could result in loss of future funding. Recommendation We recommend City Colleges implement controls to ensure that sufficient documentation is maintained over review control associated with eligibility, allowable costs and reporting. Views of responsible officials We agree with this finding. See corrective action plan.

Finding 2023-005– Student Financial Assistance Cluster Internal Control over Compliance Repeat Finding: No Federal Program Title – U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal Pell Grant Program: 84.063 Federal Work-Study Program: 84.033 Federal Supplemental Educational Opportunity Grants: 84.007 Federal Award Year 2022-2023 Condition City Colleges did not have sufficient documentation that internal controls were in place and operating effectively relative to the following areas: • Allowable Activities: For each of the seven campuses, City Colleges did not have sufficient supporting evidence that review controls were performed over the transfer, carryforward, carryback, and administrative cost calculations in the Fiscal Operations Report and Application to Participate (FISAP) for award year July 1, 2021 through June 30, 2022 submitted during fiscal year 2023. • Reporting: For each of the seven campuses, City Colleges did not have sufficient supporting evidence that secondary review controls were performed over FISAP data for award year July 1, 2021 through June 30, 2022 submitted during fiscal year 2023. Criteria 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure the review and approval controls over allowable activities, eligibility and reporting compliance requirements are sufficiently documented. Questioned Costs There were no questioned costs with respect to this finding. Cause City Colleges did not formally document the additional reviews and approvals over the department’s review of the FISAP. Effect For allowable activities, the lack of properly documented reviews in carryforward, carryback, and administrative cost calculations could result in errors that would impact future funding determinations. For eligibility, the lack of properly documented reviews could result in over or under awards to students which could result in loss of future funding. For reporting, the lack of properly documented reviews over the FISAP, could result in loss of future funding. Recommendation We recommend City Colleges implement controls to ensure that sufficient documentation is maintained over review control associated with eligibility, allowable costs and reporting. Views of responsible officials We agree with this finding. See corrective action plan.

Finding 2023-005– Student Financial Assistance Cluster Internal Control over Compliance Repeat Finding: No Federal Program Title – U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal Pell Grant Program: 84.063 Federal Work-Study Program: 84.033 Federal Supplemental Educational Opportunity Grants: 84.007 Federal Award Year 2022-2023 Condition City Colleges did not have sufficient documentation that internal controls were in place and operating effectively relative to the following areas: • Allowable Activities: For each of the seven campuses, City Colleges did not have sufficient supporting evidence that review controls were performed over the transfer, carryforward, carryback, and administrative cost calculations in the Fiscal Operations Report and Application to Participate (FISAP) for award year July 1, 2021 through June 30, 2022 submitted during fiscal year 2023. • Reporting: For each of the seven campuses, City Colleges did not have sufficient supporting evidence that secondary review controls were performed over FISAP data for award year July 1, 2021 through June 30, 2022 submitted during fiscal year 2023. Criteria 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure the review and approval controls over allowable activities, eligibility and reporting compliance requirements are sufficiently documented. Questioned Costs There were no questioned costs with respect to this finding. Cause City Colleges did not formally document the additional reviews and approvals over the department’s review of the FISAP. Effect For allowable activities, the lack of properly documented reviews in carryforward, carryback, and administrative cost calculations could result in errors that would impact future funding determinations. For eligibility, the lack of properly documented reviews could result in over or under awards to students which could result in loss of future funding. For reporting, the lack of properly documented reviews over the FISAP, could result in loss of future funding. Recommendation We recommend City Colleges implement controls to ensure that sufficient documentation is maintained over review control associated with eligibility, allowable costs and reporting. Views of responsible officials We agree with this finding. See corrective action plan.

Finding 2023-005– Student Financial Assistance Cluster Internal Control over Compliance Repeat Finding: No Federal Program Title – U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal Pell Grant Program: 84.063 Federal Work-Study Program: 84.033 Federal Supplemental Educational Opportunity Grants: 84.007 Federal Award Year 2022-2023 Condition City Colleges did not have sufficient documentation that internal controls were in place and operating effectively relative to the following areas: • Allowable Activities: For each of the seven campuses, City Colleges did not have sufficient supporting evidence that review controls were performed over the transfer, carryforward, carryback, and administrative cost calculations in the Fiscal Operations Report and Application to Participate (FISAP) for award year July 1, 2021 through June 30, 2022 submitted during fiscal year 2023. • Reporting: For each of the seven campuses, City Colleges did not have sufficient supporting evidence that secondary review controls were performed over FISAP data for award year July 1, 2021 through June 30, 2022 submitted during fiscal year 2023. Criteria 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure the review and approval controls over allowable activities, eligibility and reporting compliance requirements are sufficiently documented. Questioned Costs There were no questioned costs with respect to this finding. Cause City Colleges did not formally document the additional reviews and approvals over the department’s review of the FISAP. Effect For allowable activities, the lack of properly documented reviews in carryforward, carryback, and administrative cost calculations could result in errors that would impact future funding determinations. For eligibility, the lack of properly documented reviews could result in over or under awards to students which could result in loss of future funding. For reporting, the lack of properly documented reviews over the FISAP, could result in loss of future funding. Recommendation We recommend City Colleges implement controls to ensure that sufficient documentation is maintained over review control associated with eligibility, allowable costs and reporting. Views of responsible officials We agree with this finding. See corrective action plan.

Finding 2023-006– Gramm-Leach Bliley Act—Student Information Security Repeat Finding: No Federal Program Title – U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal Pell Grant Program: 84.063 Federal Work-Study Program: 84.033 Federal Supplemental Educational Opportunity Grants: 84.007 Federal Award Year 2022-2023 Condition City Colleges did not have a documented policy to address a required safeguard for one of the eight required elements under the Gramm-Leach Bliley Act (GLBA). Specifically, the City Colleges did not conduct a periodic inventory of data, nothing where it’s collected, stored or transmitted. Criteria In accordance with 16 CFR 314.4(c), an institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). This includes the following: (1) implement and periodically review access controls, (2) conduct a periodic inventory of data, noting where it’s collected, stored or transmitted, (3) encrypt customer information on the institution’s system and when it’s in transit, (4) assess apps developed by the institution, (5) implement multi-factor authentication for anyone accessing customer information on the institution’s system, (6) dispose of customer information securely, (7) anticipate and evaluate changes to the information system or network, and (8) maintain a log of authorized users’ activity and keep an eye out for unauthorized users. 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure that reviews are being completed over information security policies and that they are in compliance with GLBA requirements. Questioned Costs There were no questioned costs with respect to this finding. Cause City Colleges does not have a periodic data inventory in place. The policy is under development with an expected completion date of Spring 2024. Effect Failure to meet the minimum requirements of the GLBA act is noncompliance and increases the risk of unauthorized disclosure, misuse, alteration, destruction, or other comprise of student information. Recommendation We recommend City Colleges implement controls to ensure that GLBA requirements are reviewed and addressed in a formally documented policy. Views of responsible officials We agree with this finding. See corrective action plan.

Finding 2023-006– Gramm-Leach Bliley Act—Student Information Security Repeat Finding: No Federal Program Title – U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal Pell Grant Program: 84.063 Federal Work-Study Program: 84.033 Federal Supplemental Educational Opportunity Grants: 84.007 Federal Award Year 2022-2023 Condition City Colleges did not have a documented policy to address a required safeguard for one of the eight required elements under the Gramm-Leach Bliley Act (GLBA). Specifically, the City Colleges did not conduct a periodic inventory of data, nothing where it’s collected, stored or transmitted. Criteria In accordance with 16 CFR 314.4(c), an institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). This includes the following: (1) implement and periodically review access controls, (2) conduct a periodic inventory of data, noting where it’s collected, stored or transmitted, (3) encrypt customer information on the institution’s system and when it’s in transit, (4) assess apps developed by the institution, (5) implement multi-factor authentication for anyone accessing customer information on the institution’s system, (6) dispose of customer information securely, (7) anticipate and evaluate changes to the information system or network, and (8) maintain a log of authorized users’ activity and keep an eye out for unauthorized users. 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure that reviews are being completed over information security policies and that they are in compliance with GLBA requirements. Questioned Costs There were no questioned costs with respect to this finding. Cause City Colleges does not have a periodic data inventory in place. The policy is under development with an expected completion date of Spring 2024. Effect Failure to meet the minimum requirements of the GLBA act is noncompliance and increases the risk of unauthorized disclosure, misuse, alteration, destruction, or other comprise of student information. Recommendation We recommend City Colleges implement controls to ensure that GLBA requirements are reviewed and addressed in a formally documented policy. Views of responsible officials We agree with this finding. See corrective action plan.

Finding 2023-006– Gramm-Leach Bliley Act—Student Information Security Repeat Finding: No Federal Program Title – U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal Pell Grant Program: 84.063 Federal Work-Study Program: 84.033 Federal Supplemental Educational Opportunity Grants: 84.007 Federal Award Year 2022-2023 Condition City Colleges did not have a documented policy to address a required safeguard for one of the eight required elements under the Gramm-Leach Bliley Act (GLBA). Specifically, the City Colleges did not conduct a periodic inventory of data, nothing where it’s collected, stored or transmitted. Criteria In accordance with 16 CFR 314.4(c), an institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). This includes the following: (1) implement and periodically review access controls, (2) conduct a periodic inventory of data, noting where it’s collected, stored or transmitted, (3) encrypt customer information on the institution’s system and when it’s in transit, (4) assess apps developed by the institution, (5) implement multi-factor authentication for anyone accessing customer information on the institution’s system, (6) dispose of customer information securely, (7) anticipate and evaluate changes to the information system or network, and (8) maintain a log of authorized users’ activity and keep an eye out for unauthorized users. 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure that reviews are being completed over information security policies and that they are in compliance with GLBA requirements. Questioned Costs There were no questioned costs with respect to this finding. Cause City Colleges does not have a periodic data inventory in place. The policy is under development with an expected completion date of Spring 2024. Effect Failure to meet the minimum requirements of the GLBA act is noncompliance and increases the risk of unauthorized disclosure, misuse, alteration, destruction, or other comprise of student information. Recommendation We recommend City Colleges implement controls to ensure that GLBA requirements are reviewed and addressed in a formally documented policy. Views of responsible officials We agree with this finding. See corrective action plan.

Finding 2023-006– Gramm-Leach Bliley Act—Student Information Security Repeat Finding: No Federal Program Title – U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal Pell Grant Program: 84.063 Federal Work-Study Program: 84.033 Federal Supplemental Educational Opportunity Grants: 84.007 Federal Award Year 2022-2023 Condition City Colleges did not have a documented policy to address a required safeguard for one of the eight required elements under the Gramm-Leach Bliley Act (GLBA). Specifically, the City Colleges did not conduct a periodic inventory of data, nothing where it’s collected, stored or transmitted. Criteria In accordance with 16 CFR 314.4(c), an institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). This includes the following: (1) implement and periodically review access controls, (2) conduct a periodic inventory of data, noting where it’s collected, stored or transmitted, (3) encrypt customer information on the institution’s system and when it’s in transit, (4) assess apps developed by the institution, (5) implement multi-factor authentication for anyone accessing customer information on the institution’s system, (6) dispose of customer information securely, (7) anticipate and evaluate changes to the information system or network, and (8) maintain a log of authorized users’ activity and keep an eye out for unauthorized users. 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure that reviews are being completed over information security policies and that they are in compliance with GLBA requirements. Questioned Costs There were no questioned costs with respect to this finding. Cause City Colleges does not have a periodic data inventory in place. The policy is under development with an expected completion date of Spring 2024. Effect Failure to meet the minimum requirements of the GLBA act is noncompliance and increases the risk of unauthorized disclosure, misuse, alteration, destruction, or other comprise of student information. Recommendation We recommend City Colleges implement controls to ensure that GLBA requirements are reviewed and addressed in a formally documented policy. Views of responsible officials We agree with this finding. See corrective action plan.

Finding 2023-007 – COVID-19 Education Stabilization Fund: Higher Education Emergency Relief Fund Annual Reporting Repeat Finding: Partial Federal Program Title – U.S. Department of Education COVID-19 Education Stabilization Fund Higher Education Emergency Relief Fund (HEERF) COVID-19: HEERF Institutional Portion 84.425F Federal Award Year 2022-2023 Condition City Colleges did not accurately report certain information required in the calendar year 2022 annual report. The following instances of noncompliance were identified: • HEERF Institutional Portion: City Colleges submitted the annual report for Olive Harvey for the period of January 1, 2022 – December 31, 2022 which did not reconcile to the underlying expense detail as of the date of the report. The difference was $234,118 which was a result of a figure being double counted in the total. • HEERF Institutional Portion: City Colleges submitted the annual report for Malcolm X for the period of January 1, 2022 – December 31, 2022 which did not reconcile to the underlying expense detail as of the date of the report. The difference was $5,580,216 which was a result of a figure being double counted in the total. Criteria The Department of Education requires the submission of a “Higher Education Emergency Relief Fund (HEERF) I, II, & III Annual Performance Report” to be submitted on a calendar year basis. The third annual report covered the period of January 1, 2022 – December 31, 2022 and was due in March 2023. 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure the timely and accurate posting of reports. Questioned Costs There were no questioned costs with respect to this finding. Cause City Colleges did not have effective internal controls in place to ensure reports were submitted accurately. Reports were reviewed prior to submission but those reviews were not precise enough. Prevalence Infrequent. 35 reports were required to be submitted in fiscal year 2023 relative to HEERF Student, Institutional, MSI and Annual reporting. 2 reports contained 1 field that was inaccurate. Effect The submission of inaccurate reports is noncompliance with the requirements of the grant award and could result in other penalties. Recommendation We recommend City Colleges implement internal controls to ensure reports are submitted accurately for the final annual report that is anticipated to be due in early 2024. Views of responsible officials We agree with this finding. See corrective action plan.

Finding 2023-008 – Student Financial Assistance Cluster – Fraudulent Enrollment Repeat Finding: No Federal Program Title – U.S. Department of Education Student Financial Assistance Cluster Federal Pell Grant Program: 84.063 Federal Work-Study Program: 84.033 Federal Supplemental Educational Opportunity Grants: 84.007 Federal Direct Student Loans: 84.268 Federal Award Year 2022-2023 Condition City Colleges did not timely report information regarding potential fraudulent student enrollments to the Department of Education’s Office of Inspector General (OIG). City Colleges identified a total of 23 students where the Enrollment and Admissions Departments discovered submission of fraudulent documents to verify residency. City Colleges performed a thorough investigation of student enrollment and verified that no aid was disbursed for these identified fraudulent enrollments. Criteria In accordance with Chapter 3 “FSA Administrative and Related Requirements” of the Federal Student Aid Handbook, the Department of Education requires that “a school must refer any credible information indicating that an applicant for federal student aid may have engaged in fraud or other criminal misconduct in connection with his or her application.” 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure all Department of Education requirements are followed. Questioned Costs There were no questioned costs with respect to this finding. Cause City Colleges experienced turnover in the Admissions Department and was training a new employee. The new employee did not have enough training or experience to identify fraudulent documents when the students enrolled with the college and registered for classes. City Colleges was not aware that this issue was required to be reported to the Department of Education. Prevalence Infrequent. 23 fraudulent applications were identified. Effect The inability to identify fraudulent documents could result in the incorrect distribution of student financial aid. Recommendation We recommend City Colleges increase training around reporting requirements to the U.S. Department of Education when fraudulent student enrollments occur. Views of responsible officials We agree with this finding. See corrective action plan.

Finding 2023-008 – Student Financial Assistance Cluster – Fraudulent Enrollment Repeat Finding: No Federal Program Title – U.S. Department of Education Student Financial Assistance Cluster Federal Pell Grant Program: 84.063 Federal Work-Study Program: 84.033 Federal Supplemental Educational Opportunity Grants: 84.007 Federal Direct Student Loans: 84.268 Federal Award Year 2022-2023 Condition City Colleges did not timely report information regarding potential fraudulent student enrollments to the Department of Education’s Office of Inspector General (OIG). City Colleges identified a total of 23 students where the Enrollment and Admissions Departments discovered submission of fraudulent documents to verify residency. City Colleges performed a thorough investigation of student enrollment and verified that no aid was disbursed for these identified fraudulent enrollments. Criteria In accordance with Chapter 3 “FSA Administrative and Related Requirements” of the Federal Student Aid Handbook, the Department of Education requires that “a school must refer any credible information indicating that an applicant for federal student aid may have engaged in fraud or other criminal misconduct in connection with his or her application.” 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure all Department of Education requirements are followed. Questioned Costs There were no questioned costs with respect to this finding. Cause City Colleges experienced turnover in the Admissions Department and was training a new employee. The new employee did not have enough training or experience to identify fraudulent documents when the students enrolled with the college and registered for classes. City Colleges was not aware that this issue was required to be reported to the Department of Education. Prevalence Infrequent. 23 fraudulent applications were identified. Effect The inability to identify fraudulent documents could result in the incorrect distribution of student financial aid. Recommendation We recommend City Colleges increase training around reporting requirements to the U.S. Department of Education when fraudulent student enrollments occur. Views of responsible officials We agree with this finding. See corrective action plan.

Finding 2023-008 – Student Financial Assistance Cluster – Fraudulent Enrollment Repeat Finding: No Federal Program Title – U.S. Department of Education Student Financial Assistance Cluster Federal Pell Grant Program: 84.063 Federal Work-Study Program: 84.033 Federal Supplemental Educational Opportunity Grants: 84.007 Federal Direct Student Loans: 84.268 Federal Award Year 2022-2023 Condition City Colleges did not timely report information regarding potential fraudulent student enrollments to the Department of Education’s Office of Inspector General (OIG). City Colleges identified a total of 23 students where the Enrollment and Admissions Departments discovered submission of fraudulent documents to verify residency. City Colleges performed a thorough investigation of student enrollment and verified that no aid was disbursed for these identified fraudulent enrollments. Criteria In accordance with Chapter 3 “FSA Administrative and Related Requirements” of the Federal Student Aid Handbook, the Department of Education requires that “a school must refer any credible information indicating that an applicant for federal student aid may have engaged in fraud or other criminal misconduct in connection with his or her application.” 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure all Department of Education requirements are followed. Questioned Costs There were no questioned costs with respect to this finding. Cause City Colleges experienced turnover in the Admissions Department and was training a new employee. The new employee did not have enough training or experience to identify fraudulent documents when the students enrolled with the college and registered for classes. City Colleges was not aware that this issue was required to be reported to the Department of Education. Prevalence Infrequent. 23 fraudulent applications were identified. Effect The inability to identify fraudulent documents could result in the incorrect distribution of student financial aid. Recommendation We recommend City Colleges increase training around reporting requirements to the U.S. Department of Education when fraudulent student enrollments occur. Views of responsible officials We agree with this finding. See corrective action plan.

Finding 2023-008 – Student Financial Assistance Cluster – Fraudulent Enrollment Repeat Finding: No Federal Program Title – U.S. Department of Education Student Financial Assistance Cluster Federal Pell Grant Program: 84.063 Federal Work-Study Program: 84.033 Federal Supplemental Educational Opportunity Grants: 84.007 Federal Direct Student Loans: 84.268 Federal Award Year 2022-2023 Condition City Colleges did not timely report information regarding potential fraudulent student enrollments to the Department of Education’s Office of Inspector General (OIG). City Colleges identified a total of 23 students where the Enrollment and Admissions Departments discovered submission of fraudulent documents to verify residency. City Colleges performed a thorough investigation of student enrollment and verified that no aid was disbursed for these identified fraudulent enrollments. Criteria In accordance with Chapter 3 “FSA Administrative and Related Requirements” of the Federal Student Aid Handbook, the Department of Education requires that “a school must refer any credible information indicating that an applicant for federal student aid may have engaged in fraud or other criminal misconduct in connection with his or her application.” 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure all Department of Education requirements are followed. Questioned Costs There were no questioned costs with respect to this finding. Cause City Colleges experienced turnover in the Admissions Department and was training a new employee. The new employee did not have enough training or experience to identify fraudulent documents when the students enrolled with the college and registered for classes. City Colleges was not aware that this issue was required to be reported to the Department of Education. Prevalence Infrequent. 23 fraudulent applications were identified. Effect The inability to identify fraudulent documents could result in the incorrect distribution of student financial aid. Recommendation We recommend City Colleges increase training around reporting requirements to the U.S. Department of Education when fraudulent student enrollments occur. Views of responsible officials We agree with this finding. See corrective action plan.