Corrective Action Plans

2023-001 US Department of Education Student Financial Assistance Cluster - Assistance Listing No. 84.063 Recommendation: We recommend that the student financial aid department work to ensure disbursements are reported to COD within 15 days of the disbursement date. Explanation of disagreement with audit finding: As a standard, regular practice, communicates disbursement information for Federal Pell and Federal loans to COD no less than once per week; therefore, we believe we have an adequate way to report disbursements to COD within 15 days of the disbursement date. MACC transitioned to new financial aid processing software (Jenzabar Financial Aid - JFA) in summer 2022 while other areas of the college were still using the "old" system (Jenzabar CX). We experienced a glitch during the transition in which the files did not update as expected, we worked with our software vendor to correct the issue. Below is the timeline of action taken:This finding pertains to one student with Sub and Unsub Loans. We posted aid and sent the original batch on Friday, 07/15/2022; we discovered the issue on Wednesday, 07/20/2022, and reached out to Jenzabar immediately; we followed up with Jenzabar on Thursday, 07/28/2022 because the records were not updated; the records were updated on Monday, August 1. Action taken in response to finding: MACC continues to submit disbursement information at least once per week and review student details for posting accuracy. We took the necessary steps to fix the issue. Name(s) of the contact person(s) responsible for corrective action: Amy Hager Planned completion date for corrective action plan: We believe this finding was an anomaly due to the system conversion. We have no evidence of this happening since.

2023-003 US Department of Education Student Financial Assistance Cluster - Assistance Listing No. 84.007, 84.033, 84.063, 84.268 Recommendation: We recommend the College review current processes for reporting to NSLDS and implement procedures to ensure submissions are reported timely and accurately. Explanation of disagreement with audit finding: There is no disagreement with the audit finding, but we offer the following explanation: Identification of Errors and Corrections to New SIS: • Conversion to a new SIS (Jenzabar - Jl) was effective November 2022, and forced subsequent Fall 2022 NSC Enrollment Transmittal Files to be created in the new system mid-term. The concern of enrollment report timing was brought to the vendor multiple times before the transition. However, due to scheduling limitations on the vendor's end, the transition to the new system had to be completed mid-term. • In late May/early June we began end of term processing and reconciliations, and we identified that student status changes were not properly pulling the correct enrollment status information through the vendor's enrollment report creation process. • Support tickets were sent to the vendor immediately to address the problems with the system process that creates NSC Transmittal Files. • System configuration changes were made as recommended by the vendor to properly update enrollment status changes. • Through the investigation of these configuration changes, additional system errors were identified that were not allowing some enrolled students to be properly pulled to the enrollment files. • Support engagements continued with the vendor throughout July and August to identify and correct the system configuration to correctly pull enrolled students into the NSC Transmittal File. This was completed by the end of summer term, and the final summer enrollment file contained the correct number of students enrolled with the correct final enrollment status. • Internal validation reports were created and executed to ensure that correct student data was transmitted on the Fall first of Term reports. We believe this transmission contained the correct number of students and the correct status. These internal validation reports will be conducted prior to all NSC submissions. Creation of new/additional reports will be conducted as necessary. • We have been able to verify that the Fall 2023 subsequent term enrollment file did contain accurate status change information, and this issue is now resolved. • By correcting status change configurations, we have also identified that program begin dates converted from the old SIS to the new SIS were incorrectly mapped. • We are currently in the process of identifying the ID#s with incorrect program begin dates and making manual updates to the students' record in the new SIS environment. The vendor has not provided a clear path to programmatically correct this in bulk, so this record validation is being completed one-by-one manually. We project to have this completed for currently enrolled students by the final fall 2023 enrollment submission. Correcting previously submitted data: • We reached out to our Data Analyst, Elizabeth Fennessy, with the National Student Clearinghouse, to begin working on a corrective action for the missing status change data. • Elizabeth consulted with the NSC Audit Resource Team, and the following plan was recommended to MACC: • For students Less Than Half Time Spring 2023 or Withdrawn Spring 2023 that re-enrolled Summer 2023, these would be a manual update in NSLDS for Title IV students in these scenarios using NSLDS site 'Enrollment History Update.' • Later in Clearinghouse, the same update can be reflected using Clearinghouse site 'Student Look-Up' to bring the record current with updated enrollment reflected Spring 2023. By updating NSLDS first, that will avoid an NSLDS error "certification date out of sync" (error code 32). • MACC prepared reports to retrieve students meeting the criteria identified above. • These students' enrollment statuses for Spring 2023 and Summer 2023 have been manually updated in NSLDS Enrollment History Update and in NSC Student Look-up to bring these enrollment statuses up to date; this has been a long and time-consuming process. • We are also currently working on reports to identify students that were enrolled in spring 2023 but missed when the NSC Enrollment Transmittal File was created. We believe that students missed in Summer 2023 have been brought up to date through the submission of the corrected final Summer 2023 Enrollment File (to include students that were also enrolled in Spring 2023). Any student that was inadvertently excluded from the Spring 2023 and has not been brought up to date through subsequent corrected submissions, will be manually corrected through NSC Student Look-Up, and NSLDS Enrollment History Update if necessary. • We also reached out to l<athy Feith, Branch Chief, l<C School Participation Division, Federal Student Aid, U.S. Department of Education; she is aware of our issues. She recommended making enrollment changes directly in NSLDS for students who withdrew. Action taken in response to finding: The following is our Corrective Action Plan. • The Registrar will review data in J1 and submit enrollment records to NSC each month. o The Registrar will also work with the Director of Administrative Computing to ensure program information and other vital data are reported correctly. o MACC will continue to work with Jenzabar for a solution for reporting last dates of attendance for students who are withdrawn from all classes. • After the enrollment file is accepted by NSC, 20 randomly selected students will be verified for accuracy. • The selection will be made by the Director of FA and/or Registrar. • The selection will include students who have withdrawn from all classes and had an R2T4 calculation performed. • The Registrar, or designee, will review the data in NSC. • The Associate Director of Financial Aid, or designee, will review the data in NSLDS. • Discrepancies will be addressed between the Registrar and Financial Aid Offices immediately; and will utilize the Director of Administrative Computing to assist with configuration changes and data clean-up. • The records will be maintained in a designated Teams folder. Name(s) of the contact person(s) responsible for corrective action: Amy Hager and Amy See (Registrar). Planned completion date for corrective action plan: We expect the plan will be an ongoing effort to ensure compliance.

Federal Program Title: Student Financial Aid Cluster (SFA), 240-day limitation on checks ALN Number: 84.007, 84.033, 84.063, 84.268 Condition: Connors State College had 7 instance of Title IV refund checks to students that were outstanding longer than 240 days as of June 30, 2023 Recommendation: We recommend that the College start to reconcile stale checks to student disbursement info by check number. Explanation if disagreement with audit finding: There is no disagreement with the audit finding. Action planned/taken in response to finding: Checks will only be re-issued for up to 180 days. A joint effort between the Bursar, Accounting and Financial Aid offices to reach the students via email, phone, and text before the 180-day deadline. After 180 days the check will be voided, and the funds returned. Name(s) of the contact person(s) responsible for corrective action: Mattie Keys, mattie.keys@connorsstate.edu Planned completion date for corrective action plan: Dec 31, 2023

Federal Program Title: Student Financial Aid Cluster (SFA), COD posting and reconciling. ALN Number: 84.007, 84.033, 84.063, 84.268 Condition: We noted 1 out of 40 COD disbursements tested, were not reported within the required 15 days to COD. Context: 1 of the 40 COD disbursements had applied dates greater than 15 days from the disbursement dates. Recommendation: We recommend that the student financial aid department works to ensure disbursements are reported to COD within 15 days of the disbursement date. Explanation if disagreement with audit finding: There is no disagreement with the audit finding. Action planned/taken in response to finding: Students identified in the weekly reconciliation that have not posted to COD will be highlighted. In the subsequent reconciliation if student still has not been posted in COD the Financial Aid Director will manually post the student to COD as well as fix any errors so that if can be posted. Name(s) of the contact person(s) responsible for corrective action: Mattie Keys, mattie.keys@connorsstate.edu Planned completion date for corrective action plan: Dec 31, 2023

Federal Program Title: Student Financial Aid Cluster (SFA), 60-day status reporting ALN Number: 84.007, 84.033, 84.063, 84.268 Condition: Fifteen exceptions were observed during Enrollment Reporting testing. The fifteen exceptions were reported beyond the sixty-day allowable timeframe. Context: 15 of the 40 enrollment changes were reported to NSLDS greater than 60 days from the change Recommendation: CLA recommends implementing a formal review process that involves footing the report to verify clerical accuracy and detect errors during the preparation of the report. Explanation if disagreement with audit finding: There is no disagreement with the audit finding. Action planned/taken in response to finding: At the end of each semester a listing of all graduates will be given to the Financial Aid Office from the Registrar. Financial Aid will then go into NSLDS to manually update graduates status. This process will be done in conjunction with the submittion of graduates to the National Clearinghouse by the Registrar. Name(s) of the contact person(s) responsible for corrective action: Mattie Keys, mattie.keys@connorsstate.edu Planned completion date for corrective action plan: Dec 31, 2023

2023-001 - U.S. Department of Education Student Financial Assistance Cluster- Special Tests and Provisions: Return of Title IV Funds The Financial Aid staff will immediately implement a training and approval process including the following steps: 1. Financial Aid staff will complete online training modules concerning the Return to Title IV (R2T4) calculation worksheet. 2. Financial Aid staff will conduct a full research and review of the current USDOE regulations concerning Withdrawals and the Return of Title IV Funds according to the Federal Student Aid Handbook, Volume 5 - Withdrawals and the Return of Title IV Funds. 3. Financial Aid staff will be required to submit the R2T4 calculation worksheet for review and approval by the Financial Aid Director or executive administrator of Financial Aid prior to submitting the worksheet in COD and before requesting that the Chief Financial Officer submits a return of the funds. Implementation ohhis training and approval process will begin no later than November 1, 2023, and be completed no later than January 1, 2024.

Finding number 2023-002 – Eligibility-Significant Deficiency Over Internal Controls Over Compliance Contact person responsible for corrective action: Sue Gosney, Chief Financial Officer, (213) 356-5330 Expected date of corrective action: The corrective action will be implemented in January 2024. The school's management agrees with the finding and has implemented procedure whereby the Financial Aid department will include the Student Identification and Expected Family Contribution (EFC) on the Work Study log to monitor awards against the student’s EFC.

Finding number 2023-001 – Special Tests and Provisions-Enrollment Reporting-Significant Deficiency Over Internal Controls Over Compliance Contact person responsible for corrective action: Sue Gosney, Chief Financial Officer, (213) 356-5330 Expected date of corrective action: The corrective action was implemented in December 2023. The school's management agrees with the finding and has implemented procedure whereby changes in enrollment status reported to the National Student Clearinghouse will be sample reviewed by the Registrar within NSLDS five business days following the reporting date to ensure the accuracy of the information. As an additional layer, the Financial Aid Manager will also calendar a review reminder. Permanent address changes will be reported on a six-week cycle after the add/drop period each term. Address changes will also be sample reviewed to ensure accuracy within NSLDS.

Department of Education 2023-002 Student Financial Assistance – Assistance Listing No. Various Recommendation: We recommend the University reevaluate its procedures and review policies surrounding reporting status changes to NSLDS to put a process in place to ensure the student status changes are being reported timely. Explanation of disagreement with audit finding: There is no disagreement with the auditfinding. Action taken in response to finding: Auditors identified five students where the change in enrollment status was not reported in a timely manner. It was noted that we identified the status changes while there was a cybersecurity breach within the file transfer system used by the National Student Clearinghouse (NSC), our third-party servicer. As a result, our reporting was delayed. We received notice of the incident from the NSC on June 16, 2023. Our next planned transmission was scheduled for June 28. We postponed our regular reporting schedule for one week while we reset our secure FTP password with NSC, initialized our account in their updated system, and while our ITS security officer evaluated the risk. We ended up submitting the file to the NSC on July 5. As a result of this incident, we remain vigilant for external factors that may impact our reporting schedule. We will address them as quickly as possible to avoid reporting delays. Names of the contact persons responsible for corrective action: Gwenn Sherburne, Registrar Planned completion date for corrective action plan: By first reporting date for 2023-2024 academic year in early September 2023.

We concur with the condition noted above. Management believes that the controls in place are appropriately designed to prevent and or detect errors. This instance was isolated and resulted from a coding error related to incorrectly keying the accounting string into our accounting system, which went undetected. Management reassessed the controls over reporting and compliance with laws and regulations. The following steps have been taken to strengthen controls: • Implement enhanced management tools i.e. ERP and shared weekly ledger reports • Staff training in accounts payable to identify and correct errors • Develop operating procedures requiring weekly budget monitoring and updates for program managers

Finding 2023-001 - Special Tests and Provisions – Gramm-Leach-Bliley Act Responsible Individuals – Director of Computer Services and Vice President for Finance & Risk Management. Finding Summary: During testing of Gramm-Leach-Bliley Act and inquiry with management, it was determined that the University does not have a written comprehensive information security program in place. Corrective Action Planned: Dordt will be working with an external organization familiar with the policy requirements of the Gramm-Leach-Bliley Act to take existing procedures and incorporate them into a formal written information security policy that addresses the key areas of the Gramm-Leach-Bliley Act. Anticipated Completion Date: June 30, 2024.

The College will implement procedures to ensure accurate, timely, and complete data is submitted. As an added layer of data validation and verification, the reports required for the Clearinghouse and generated through the college’s student information system will be converted to Excel format (from Notepad) with the help of the Institutional Research office to ensure that data meets the criteria required by the clearinghouse and is free of errors. The responsibility to ensure that data submitted to the National Clearinghouse and NSLDS remains with the Registrar’s office at CCSJ. The Registrar’s office at CCSJ will review data for accuracy, timeliness, and completeness before uploading to the FTP Clearinghouse site. Furthermore, the Director of Student Financial Services has been added as a secondary administrator to the college’s FTP clearinghouse account in which he and the Registrar will receive alerts generated through the Clearinghouse when reports have been uploaded to the site. The Registrar is the primary party responsible for clearing alerts, but the Director of Student Financial Services will verify that the alerts have been cleared. Responsible officers: Marlena Avalos, Assistant Vice President of Academic Affairs (mavalos@ccsj.edu); Derek Shouba, Vice President of Academic Affairs Estimated completion date: March 31, 2024

Finding – Special Tests and Provisions: Enrollment Reporting – Federal Direct Student Loan Program, Assistance Listing Number 84.268; June 30, 2023 Award Year; U.S. Department of Education Criteria or Specific Requirement Enrollment information, including the effective date of separation from the institution, must be accurately reported within 30 days whenever attendance changes for a student, unless a roster will be submitted within 60 days. The changes include reductions or increases in attendance levels, withdrawals, graduations, and approved leaves-of absence. It is the institution’s responsibility, as a participant in the Title IV aid programs, to monitor and report these changes to the National Student Loan Data System (“NSLDS”). (NSLDS Enrollment Reporting Guide November 2022, and 34 CFR 685.309(b)) Condition Of the 40 students selected for enrollment reporting testing, three students were reported to NSLDS outside the maximum 60-day window. This was not a statistically valid sample. Views of Responsible Officials and Planned Corrective Actions The University concurs with the finding. The University will continue to remain vigilant in its oversight over timely communication of enrollment reporting detail to NSC and from NSC to NSLDS, utilizing enhanced exception reporting and a structured process to identify any discrepancies in the data. Names of Contact Persons Responsible for Corrective Action: Nadira Dookharan, Registrar and Anne-Marie Caruso, Associate Vice President, Student Financial Services Anticipated Completion Date: November 30, 2023

Finding – Eligibility – Federal Direct Student Loan Program, Assistance Listing Number 84.268 and Federal Pell Grant Program, Assistance Listing Number 84.063; June 30, 2023 Award Year; U.S. Department of Education Criteria or Specific Requirement The amount of a student's Pell Grant for an academic year is based upon the payment and disbursement schedules published by the Secretary for each award year (34 CFR Section 690.62(a)).The annual maximum loan amount an undergraduate student may receive must be prorated when the borrower is enrolled in a program that is shorter than a full academic year; or enrolled in a program that is one academic year or more in length, but is in a remaining period of study that is shorter than a full academic year. (2022 - 2023 Student Financial Aid Bank Book, Volume 3, Chapter 5, 34 CFR 685.203(a),(b),(c)) Condition Of the 40 students selected for eligibility testing, two students were incorrectly awarded student financial assistance; one student was incorrectly under-awarded a Pell Grant and the other student was over-awarded a Direct Loan. This was not a statistically valid sample. Views of Responsible Officials and Planned Corrective Actions The University concurs with the finding. The University will implement regular periodic quality control checks, utilizing enhanced reporting and dedicated staff resources to ensure student aid is being appropriately calculated and awarded based upon relevant student enrollment and financial information. Names of Contact Persons Responsible for Corrective Action: Anne-Marie Caruso, Associate Vice President, Student Financial Services Anticipated Completion Date: November 30, 2023

FINDING 2023-003 – CONTROLS AND NONCOMPLIANCE OVER SPECIAL TESTS AND PROVISIONS – RETURN OF FUNDS Management’s Response The College accepts this finding and has implemented the corrective plan below to reinforce established policies and procedures to ensure file documentation would identify students in the return funds population. Plan South Suburban College has already established a control process to assist with remaining in compliance as stated in the Single Audit Report Finding 2023-003 Recommendation section. Previously, South Suburban College Financial Aid Department used Business Objects reports to retrieve the college Return of Title IV funding (R2T4) population, it was found that the reporting process was insufficient, therefore the Director of Financial Aid decided to develop an R2T4 tracking process to maintain accurate return of funds calculations. The R2T4 student tracking process is reviewed by the Financial Aid Coordinator and verified by the Financial Aid Manager every week. The Director of Financial Aid will continue to work with South Suburban College Information Technology Department to enhance the retrieval of the Return of Title IV funding student populations reporting process through Ellucian Colleague per 34 CFR 668.22(a)(1) through (a)(5). *This corrective plan has been implemented. Anticipated Date of Completion 1/24/24 Name of Contact Person Avianca Taylor, MBA

FINDING 2023-002 – CONTROLS AND NONCOMPLIANCE OVER SPECIAL TESTS AND PROVISIONS – NATIONAL STUDENT LOAN DATA SYSTEM Management’s Response The College accepts this finding and has implemented the corrective plan below to reinforce established policies and procedures to ensure SSCR information is remitted timely as well as properly reviewed and approved. Plan South Suburban College's Financial Aid Director will work in conjunction with the Director of Registration to review and verify the Student Status Change Report (SSCR) submitted to the Clearinghouse is cross-referenced with the Title IV students in the National Student Loan Data System (NSLDS). To administer this process control the Financial Aid Director will establish a monthly meeting with the Director of Registration to ensure that student status changes are being accurately reported from the Clearinghouse database to the NSLDS. If corrections are needed within the 30-day window the Financial Aid Director will notify the Financial Aid Manager to work with the registration department to reconcile and update any student status changes. Maintaining the control implemented will allow South Suburban College to remain in compliance with the Uniform Guidance in the Compliance Supplement. This was also identified during the audit request. Documentation was provided that the National Student Loan Data System was having issues with their system reporting accurate student status changes during that timeframe. *This corrective plan has been implemented. Anticipated Date of Completion 1/24/24 Name of Contact Person Avianca Taylor, MBA

FINDING 2023-001 – CONTROLS AND NONCOMPLIANCE OVER-REPORTING – PELL COMMON ORIGINATION AND DISBURSEMENT Management’s Response The College accepts this finding and has implemented the corrective plan below to reinforce established policies and procedures regarding timely submission of COD information. Plan South Suburban College Financial Aid Department has implemented cross-training between the Financial Aid Manager, Financial Aid Coordinator, and Financial Aid Advisor to reinforce in the case of possible turnover the established controls for processing Pell Common Origination and Disbursement payments within the 15 days of submission window per the required Uniform Guidance in the Compliance Supplement. For instance, the control will consist of one of the designated staff members listed to process the batches weekly. This will allow all batches to be processed within 7 days assuring that the 15-day submission period is within compliance. In addition, the Director of Financial Aid has added a weekly calendar reminder for all trained staff to avoid missing batch processes due to personnel being out of the office or working from home. This control process was executed after positions were successfully filled and staff trained, in the Fall 2022 term. The process has been accomplished in Spring 2023. *The corrective action plan has been implemented. Anticipated Date of Completion 1/24/24 Name of Contact Person Avianca Taylor, MBA

We discovered the program was only reporting students as lessthan- half-time (“L”), half-time (“H”), and full-time (“F”). We have already adjusted the enrollment reporting program to properly report students who are enrolled at a ¾-time (“Q”) level. We will also work with the National Student Clearinghouse to ensure the enrollment effective dates are correctly reported for both the campus and program levels. Contact person: Tom Ochsner, Director of Scholarships and Financial Aid Planned completion date for corrective action plan: October 2023 If the Department of Education has questions regarding this plan, please call Tom Ochsner at (402) 465- 2212.

Condition: The University did not timely notify student or parent within 30 days of crediting the student’s account with FDL. Planned Corrective Action: When posting direct loans to the student’s account, we add a touchpoint to the student’s record. This automatically sends an email to the student. We will mail a notification to the parent in the case of a Parent PLUS loan. Contact person responsible for corrective action: Nicole Neal Anticipated Completion Date: 11/01/2023

Condition: Shawnee State University did not report student status changes timely and accurately for certain students who withdrew during the year. Planned Corrective Action: Shawnee State University will perform a comprehensive review of reporting procedures (including review of reporting process, personnel responsibilities, system modifications) and make revisions to workflow to prevent future occurrence of this finding. A review of activity prior to implementation of revised procedures will be conducted and any exceptions will be documented and corrected. Contact person responsible for corrective action: James Farmer, Chief Enrollment Officer and Greg Ballengee, Chief Financial Officer Anticipated Completion Date: 12/31/2023

Condition: The University did not return Title IV funds to the Department of Education within the required time frame for certain students who required a return of funds, and it did not initially identify all students who required a return of Title IV funds. Planned Corrective Action: Shawnee State University will perform a comprehensive review of financial aid procedures (including review of financial aid processing, personnel responsibilities, system modifications) and make revisions to workflow to prevent future occurrence of this finding. A review of activity prior to implementation of revised procedures will be conducted and any exceptions will be documented and corrected. Contact person responsible for corrective action: James Farmer, Chief Enrollment Officer and Greg Ballengee, Chief Financial Officer Anticipated Completion Date: 12/31/2023

The District has taken responsibility for providing the Department of Education with the website link and will provide that going forward. Personnel Responsible for Implementation: Nyame-Tease Prempeh Position of Responsible Personnel: Assistant Director of Accounting Expected Date of Implementation: November 1, 2023

A. Formally Establish and Document Risk Acceptance Process Requirements for risk assessments and risk acceptance processes to comply with GLBA were expanded in June of 2023. The District engaged a third-party consultant to conduct a GLBA-compliant risk assessment and advise on recommended changes to the District’s Written Information Security Plan (WISP) to comply with the new requirements. The findings and recommendations were presented to the District in October of 2023 and are currently under review. The District will initiate a project to formalize risk acceptance by December 31st, 2023, and implement the risk acceptance process by June 30, 2024. B. Perform Regular Backup Restoration Tests The District has engaged with a third party to build a testing environment to physically test restoration of the SIS environment. Initiation of the project is pending processing of the Purchase Order. The District anticipates completion of the restoration by December 31st, 2023. With respect to SAP, the District is currently engaged in an effort to migrate the SAP database to HANA. When this project is complete, the same test environment will be capable of performing physical recovery tests for SAP. The HANA migration is estimated to be completed on February 28th, 2024. C. Perform Timely Access Revocation and Regular Access Reviews With respect to the District’s Single Sign-On (ADFS or SSO) environments, the District engaged professional services consultants to address this item by automating the disablement of employee accounts based upon the termination of assignment. The work is currently underway. The target completion of the process is December 15, 2023. With respect to the SAP environment, the District has engaged with a vendor to implement Multifactor Authentication (MFA) in the SAP environment. Work will begin upon processing the Purchase Order. Once both efforts are complete, disabling employee accounts in SSO, SIS and SAP will be performed automatically based upon the termination of assignments according to criteria established by Human Resources. With respect to access reviews of SIS and SAP, the District is currently researching the export of user audit logs to the District’s analysis environment to enable regular reviews. The new target to perform regular access reviews for SAP and SIS is the end of Q1 2024. With respect to physical access reviews, the District Information Security Team will perform an annual review of relevant operational protocols for data center access with the appropriate internal teams and perform an audit of data access at a minimum of once per year. The first annual protocol review will be completed by December 1st, 2023. The first annual audit will commence no later than March 1st, 2024. D. Perform Necessary Due Diligence to Regularly Evaluate All Third-party Safeguards To prevent recurrence, the LACCD Information Security Team will coordinate an annual review of Administrative Protocol 3723A: Information Security Evaluation of Third-Party Providers with District Financial Aid, Procurement and Educational Programming and Institutional Effectiveness (EPIE) leadership teams to help assure future relevant contracts are provided to the Information Security Team prior to renewal to allow for timely security review. E. Maintain and Review Logs of Users’ Activity for both SAP and PS SIS The District is currently researching the export of user audit logs to the District’s analysis environment to enable regular reviews. The new target to perform regular access reviews for SAP and SIS is the end of Q1 2024. F. Implement data encryption for Devices Storing Customer Data The District engaged a third-party consultant to perform a comprehensive review of PeopleSoft security controls, including the implementation of encryption of financial aid data within PeopleSoft. The results are pending. Based upon those recommendations, the District will work with encryption providers to develop and implement field-level encryption of financial aid data in SIS as appropriate. With respect to end-user devices storing sensitive data, the District recently adopted workstation hardening requirements that include whole-disk encryption for desktop and laptop computers used by personnel who routinely access sensitive information, including financial aid data. The District will implement the standards on workstations used by employees in financial aid and institutional research by June 30, 2024. Once this is complete, additional workstations will be encrypted in order of potential risk. G. Strictly Implement Processes and Control for Direct Changes in the SAP Production Environment The requests for direct changes in SAP production will be tracked and included in our help desk requests so that an auditable trail can be created leading to the purpose and completion of the production changes. Additionally, direct production change requests will be reviewed and approved following the LACCD Change Control process. Minor updates that do not fall within the change control guidelines will require managerial approval within the help desk system. Personnel Responsible for Implementation: Carmen V. Lidz Position of Responsible Personnel: Vice Chancellor & Chief Information Officer

A. Incorrect Calculation of Return to Title IV Funds East Los Angeles College The corrective action plan that will be put in place is to develop a chart with a predetermined number of days based on the enrollment period. This will avoid the manual counting of the number of days for each student. We also trained an additional staff member to help with the workload. This will ensure that errors will be caught before the completion of the review process. Implementation will begin in Spring 2024. Staff is currently being trained. Personnel Responsible for Implementation: Gavino Herrera Position of Responsible Personnel: Financial Aid Supervisor Expected Date of Implementation: Spring 2024 Los Angeles Southwest College The corrective action that we are implementing to remediate this finding is to move the campus return to Title IV processing to the “R2T4 Unit” at the District Office. Personnel Responsible for Implementation: Muniece R. Bruton Position of Responsible Personnel: Financial Aid Manager Expected Date of Implementation: December 1, 2023 B. Untimely Notification of Grant Overpayment to Students and Secretary East Los Angeles College The Corrective Action plan is being implemented by providing an additional staff member to assist with the return to Title IV process along with helping with the validation to ensure calculation, notification, and reporting to NSLDS will be completed on a timely basis. A reminder is set in the Financial Aid Technician Outlook calendar to help remind them to help meet the deadline of the reporting requirement. Personnel Responsible for Implementation: Gavino Herrera Position of Responsible Personnel: Financial Aid Supervisor Expected Date of Implementation: Fall 2023 C. Distance Education Courses – Lack of Formal Process to Determine Accuracy of Student Withdrawal Date In the fall 2022 term, the District implemented training for all Distance Education (DE) faculty members to reduce the risk of data entry errors. DE faculty receive follow-up notifications at the beginning of every term). In addition, the District attempted to conduct random sampling to ensure the accuracy of the data entry. However, the District did not have the authorization or resources to perform sampling during the audit period. As a result, the corrective action plan (CAP) was only partially implemented during fiscal year 2023. In fall 2023, the District secured the human resources and required authorizations to conduct random sampling of the faculty data entry. The District’s Internal Audit Department (IAD) is performing random sampling of all campuses. As of fall 2023, all corrective actions have been fully implemented. Personnel Responsible for Implementation: Steve Giorgi, Betsy Regalado, Keyna Crenshaw Position of Responsible Personnel: Financial Aid Manager, Associate Vice Chancellor of Educational Programs and Institutional Effectiveness, LACCD Supervising Auditor) Expected Date of Implementation: Fall 2023

The District believes this error was an isolated incident and the effect is minimal as we performed an extensive review of all nine campuses’ Pell grant award disbursements for the term and found that this was the only similar award. The District will monitor disbursements and will perform reconciliation on a monthly basis. Personnel Responsible for Implementation: FA Office and the Central Financial Aid Unit. Position of Responsible Personnel: FA Managers Expected Date of Implementation: Already Implemented