Corrective Action Plans

Department of Education Student Financial Assistance Cluster – Assistance Listing No. 84.063, 84.007, 84.268, 84.379 & 84.033 Recommendation: We recommend that the University ensure proper support and approval is maintained for all Title IV drawdowns. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: Approval is documented via email and retained in department files prior to completion of a Title IV drawdown. Name(s) of the contact person(s) responsible for corrective action: Lynda Buzzard, Vice President, Finance & Administration Planned completion date for corrective action plan: Corrective action plan has already been implemented.

Condition: The College utilizes a third-party service provider for Perkins Loan servicing. Federal regulations require the institution to perform due diligence on the third-party servicer to ensure they are following federal regulations. The College did not perform their due diligence for fiscal year 2023. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action in Response to Finding: The College typically receives its third-party servicer’s compliance report to meet our due diligence obligations. For Fiscal Year 2023, the third-party servicer’s compliance report was delayed and was not received in time for the College’s audit deadlines. In future years, we will request the compliance report by December 31. We will then develop a cost-effective alternative plan for performing due diligence over the third-party servicer if the compliance report is not received by that date. Name of the contact person responsible for corrective action: Amy Ingalsbe, Student Accounts Manager Planned completion date for corrective action plan: December 31, 2024

Condition: During testing of underlying enrollment information, we identified the following: • One student’s status change was not submitted to the NSLDS within 60 days. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action in Response to Finding: The College will coordinate with their third-party servicer to identify the underlying cause and identify remediation to prevent this reporting error going forward. Name of the contact person responsible for corrective action: Phillip Apodaca, Registrar Planned completion date for corrective action plan: June 30, 2024

Condition: One of forty students tested was under-awarded Pell grant funds. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action in Response to Finding: The College developed a task within Financial Aid software that will flag locked Pell awards for review. Name of the contact person responsible for corrective action: Erica Shafer, Associate Director, Financial Aid Systems & Compliance Co-Interim Director of Financial Aid, and Abby Wilson, Financial Aid Counselor. Planned completion date for corrective action plan: November 15, 2023

TOCC RESPONSE TO 2023-001 (Significant Deficiency) Tohono O'odham Community College’s written information security program will be amended immediately to require multi-factor authentication for Jenzabar, the College’s data management system, and for PowerFAIDS, the student financial aid software. Multi-Factor Authentication, now available through Jenzabar’s “Jenzabar 1” upgrade, which is in the cloud, and which TOCC transitioned to in January and February 2024, will be implemented by June 30, 2024. Multi-factor authentication for Jenzabar will be set up using the Microsoft Hybrid Identity Services within the Microsoft Azure Cloud Architecture. In addition, not later than June 30, 2024, PowerFAIDS software, currently the “desktop” edition, will be transitioned to the cloud-based product that accommodates MFA. Dean for Sustainability Dr. Mario Montes-Helu, is responsible for implementation of this plan.

Department of Education 2023-014 Return of Title IV Funds, Assistance Listing No. 84.063, 84.268 Condition: The return of funds was calculated improperly. Auditors’ Recommendation: During CLA testing of Special Tests and Provisions. CLA noted that the university was not in compliance with federal financial aid regulations when a recipient of Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the recipient began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student’s withdrawal date (34CFR section 668.22). We recommend the university review the R2T4 requirements and implement procedures to ensure the R2T4 calculations are using the correct amount of term days and are accurately completed. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to the finding: The R2T4 process has been updated to include placing the requirement for exit counseling as a condition for submission of the withdrawal form. An additional notification will be sent after the R2T4 process has been completed. Name(s) of the contact person(s) responsible for corrective action: Ozie Ratcliff – Director of Financial Aid Planned completion date for a corrective action plan: The updated process will begin on 3/25/2024. If the Department of Education has questions regarding this plan, please contact Ozie Ratcliff at 601-979-3347.

Department of Education 2023-012 Direct Loan Exit Counseling Student Financial Aid Cluster – Assistance Listing No. 84.268 Auditors' Recommendation: During CLA testing of Eligibility. CLA noted that the University was not in compliance with the federal financial aid regulations all schools that participate in the Federal Student Aid programs are required to provide exit counseling to student borrowers who withdraw from school. This requirement is outlined in 34 CFR section 685.304. Specifically, exit counseling must be provided within 30 days after the school learns that the student borrower has withdrawn from school. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The R2T4 process has been updated to include better communication between the Director of Financial Aid and the University Registrar to monitor enrollment status changes and ensure that the information used for the R2T4 calculations is accurate. The Director of Financial Aid will review the staff members' processing of R2T4 calculations to ensure accuracy. Name of the contact person responsible for corrective action: Ozie Ratcliff – Director of Financial Aid Planned completion date for corrective action plan: Updated process will begin 3/25/2024. If the Department of Education has questions regarding this plan, please contact Ozie Ratcliff at 601-979-3347.

Department of Education 2023–011 Outstanding Student Refund Checks Student Financial Aid Cluster – Assistance Listing No. 84.007, 84.033, 84.063, 84.268 Auditors’ Recommendation: During CLA testing of Special Tests and Provisions. CLA noted that the University was not in compliance with the federal financial aid regulations requirement that any Title IV federal funds disbursed to a student or parent that have not received or negotiated must be returned to the appropriated federal financial aid program no later than 240 days after the check or electronic fund transfer (EFT) was issued. CLA recommends that the University review the requirement and implement a monitoring control to monitor the checks throughout the year. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: Create a policy to address the following: Returned or unclaimed Title IV Refunds will be successfully delivered to recipients (students or parents) or returned to the appropriate federal agency after 180 days outstanding. Additional attempts may be made to contact recipients; however, all unclaimed funds will be returned to the appropriate aid program no later than 240 days after the initial disbursement. The Accounting Office will maintain an “Outstanding Title IV Refund Checks/EFT Returns” list that will be provided to the Bursar’s Office every month. The Bursar’s Office will review the “Outstanding Title IV Refund Checks/EFT Returns” list every month and follow the procedures below regarding the outstanding checks/EFT returns.  The Bursar’s Office will use all reasonable means to locate the student or parent whose Title IV refund checks or returns have become 120 days old.  If all attempts are not successful, any outstanding Title IV refunds checks that have become stale dated (over 180 days) will be voided. The Bursar’s Office will make an entry, after a check has been voided, debiting the student account, and crediting a designated account that the Accounting’s Office will specify. This entry will then be interfaced to the Finance General Ledger debiting Student AR and crediting “Unclaimed Title IV Account”.  The Bursar’s Office will then send an e-mail notice to the Financial Aid Office containing the student’s name, student ID number, Title IV program(s), aid year and dollar amount that has been credited to the “Unclaimed Title IV Account”.  Based on the information provided, funds will be returned to the appropriate aid program within 210 – 240 days.  The Financial Aid Office will make the appropriate change(s) to the Fiscal Operations Report and Application to Participate (FISAP).  The Accounting’s Office will reconcile the “Unclaimed Title IV Account” every month. Name(s) of the contact person(s) responsible for corrective action: Charlette Mock, Director of Accounting and Lucreta Tribune, Associate Vice President for Finance Planned completion date for corrective action plan: This plan will be implemented no later than April 2024, with ongoing review of the process. This process should be completely in effect by the end of the current fiscal year, June 30, 2024. If the U.S. Department of Education has questions regarding these plans, please call Juanita Edwards at 601-877-6672.

Department of Education 2023-010 NSLDS Enrollment Reporting (ASU) Student Financial Aid Cluster – Assistance Listing No. 84.007, 84.033, 84.063, 84.268 Auditors’ Recommendation: During CLA testing of Special Tests and Provisions. CLA noted that the University was not in compliance with the federal financial aid regulations. The school is required to report changes in the student’s enrollment status, the effective date of the status and an anticipated completion date. Changes in enrollment to less than half-time, graduated, or withdrawn status must be reported within 30 days. However, if a Roster file is expected within 60 days, you may provide the data on that Roster file (34CFR section 682.610). Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: We have made significant changes during fiscal year 2024 in the Office of Student Records to address controlled and non-compliance Title IV regulations. While significant changes were made, we recognize that additional improvements are needed. The Registrar will implement internal controls to ensure all Title IV requirements are met regarding enrollment reporting. In addition, the Registrar will create a student enrollment procedures manual and implement a monitoring process to ensure that enrollment statuses are reported accurately and timely to NSLDS. Name(s) of the contact person(s) responsible for corrective action: Kisha Bond Planned completion date for corrective action plan: The planned completion date for this corrective action will be August 2024. If the U.S. Department of Education has questions regarding these plans, please call Juanita Edwards at 601-877-6672. 2023-010 NSLDS Enrollment Reporting (JSU) Student Financial Aid Cluster – Assistance Listing No. 84.007, 84.033, 84.063, 84.268 Auditors’ Recommendation: During CLA testing of Special Tests and Provisions. CLA noted that the University was not in compliance with the federal financial aid regulations the school is required to report changes in the student’s enrollment status, the effective date of the status and an anticipated completion date. Changes in enrollment to less than half-time, graduated, or withdrawn status must be reported within 30 days. However, if a Roster file is expected within 60 days, you may provide the data on that Roster file (34CFR section 682.610). Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: Jackson State University has an established and published academic calendar which guides the day-to-day academic operations and functions of the University. In some instances, the census and financial purge deadlines are extended to ensure students complete their registration requirements. When extensions are provided, the enrollment file is unable to be submitted timely and also causes delays in processing the Enrollment Error report. To alleviate the untimely submission of the Enrollment Report, different practices have been established to aid students in completing their registration before the published deadline and subsequently ensuring the Enrollment file is submitted by the deadline. The University will adhere to published deadlines to prevent delays in reporting and error resolution. The University will enhance semester onboarding by: • Begin purge process earlier in the semester to ensure timely enrollment verification for each semester. • Increase communications between Office of the Registrar and Office of Financial Aid to weekly checks to discover and resolve resolutions within a 5-day window. This ensures we will meet the 10-day resolution deadline. Name(s) of the contact person(s) responsible for corrective action: Ozie Ratcliff, Director of Financial Aid and Lekesha Tubbs, University Registrar. Planned completion date for corrective action plan: Updated process will begin 3/25/2024. If the U.S. Department of Education has questions regarding these plans, please call Ozie Ratcliff at 601-979-3347. 2023-010 NSLDS Enrollment Reporting (UMMC) Student Financial Aid Cluster – Assistance Listing No. 84.007, 84.033, 84.063, 84.268 Auditors’ Recommendation: During CLA testing of Special Tests and Provisions. CLA noted that the University was not in compliance with the federal financial aid regulations the school is required to report changes in the student’s enrollment status, the effective date of the status and an anticipated completion date. Changes in enrollment to less than half-time, graduated, or withdrawn status must be reported within 30 days. However, if a Roster file is expected within 60 days, you may provide the data on that Roster file (34CFR section 682.610). Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The Office of Enrollment Management worked with DIS to create a supplement report (UMC RPT ST Student Academic Program Status Withdrawn, Dismissed or LOA-V2) to capture students whose enrollment status changes but is not picked up through monthly clearinghouse submissions. This report will run in tandem with our monthly clearinghouse report and any student with a status change not pulled on the clearinghouse report will be manually updated within the National Student Clearinghouse database by our Associate Director of Enrollment Services. These updates will then be reported to NSLDS, along with our monthly enrollment report. Name of the contact person responsible for corrective action: Dr. Emily Cole, Executive Director of Enrollment Management Planned completion date for corrective action plan: Effective immediately. The Office of Enrollment Management will begin utilizing the new report with the March enrollment file submitted to clearinghouse. If the U.S. Department of Education has questions regarding these plans, please call Julie Schwindt at 601-984-1058.

Department of Education 2023–009 Common Origination and Disbursement (COD) Student Financial Aid Cluster – Assistance Listing No. 84.007, 84.033, 84.063, 84.268 Condition: The Fall 2022 and Spring 2023 disbursement dates in COD for Parent Plus Direct Loans did not match the disbursement date on the student ledgers. Auditors’ Recommendation: During CLA testing of Eligibility. CLA noted that the University was not in compliance with the federal financial aid regulations COD reporting requirements, including reporting disbursements, adjustments, and cancellations in a timely and accurate manner. CLA recommend that the entity strengthen its internal controls to ensure that all disbursement dates are reported to COD correctly. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The financial aid office will conduct bi-weekly reviews of enrollment changes, including university withdrawals. In addition, bi- weekly reviews of adjustment completion will be done to ensure banner adjustments are sent to COD within 10-14 business days. Name of the contact person responsible for corrective action: Ozie Ratcliff – Director of Financial Aid Planned completion date for corrective action plan: Updated process will begin 3/25/2024. If the Department of Education has questions regarding this plan, please call Ozie Ratcliff at 601-979-3347.

Views of Responsible Officials and Planned Corrective Action: We agree with the auditor’s finding and recommendations, and the following corrective action will be taken to improve the situation: • The Director of Computing Services will oversee the review subsections of 16 CFR 314 to ensure compliance with requirements. o Perform a more thorough GLBA Risk Assessment, which will be used to improve the institution’s security policy and posture. This is outlined in 16 CFR 314(b). o Improve safeguards and more frequent testing to improve system security and threat transparency will be added, including email security and log file monitoring, in addition to other controls as outlined in 16 CFR 314(c) and (d). Several quotes have been acquired and are in the process of being reviewed. o Conduct a review of policies and training, as outlined in 16 CFR 314(e), and mitigate deficiencies in awareness training and policies. o Improve documentation around third-party service providers to ensure compliance with 16 CFR 314(f). o All response plans are to be reviewed and improved as needed because of the Risk Assessment and other monitoring activities to ensure appropriate activities are included and tested at regular intervals. o The institution will develop a compliance document to record efforts according to each section of 16 CFR 314, including those areas that are already compliant. It is the goal of SEARK College to remain in a state of continuous improvement and in compliance with required regulations. The Director of Computing Services will work with the Senior Leadership Team to ensure that appropriate resources are made available, and that activities occur in a timely manner. Anticipated Completion Date: The indicated reviews and assessments are already in progress, with a goal of June 30, 2024, to have fully integrated the stated improvements into our systems and procedures. Contact Person: Name: JoAnn Dupra Title: Director of Computing Services Agency: Southeast Arkansas College Address: 1900 Hazel St City, State, Zip: Pine Bluff, AR 71603 Phone Number: (870) 543-5993 Email Address: jdupra@seark.edu

Views of Responsible Officials and Planned Corrective Action: Management understands the recommendations provided in the finding. We are planning on updating our 2021 Risk Assessment with our campus community in the near future. In accordance with ALA's recommendation, we will focus on GLBA 16 CFR 314 elements and financial aid data. As with our 2021 Risk Assessment, our plan will be reviewed and accepted by our Chancellor. We intend to have the Risk Assessment updated and reviewed by June 30, 2024. We will also coordinate the risks identified with the extensive list of controls and policies that currently protect student’s financial aid information. These include: Acceptable Use Policy_V7_3.pdf Antivirus and Malware Policy_V2_1.pdf Cloud Services Policy_V1_2.pdf Confluence Screenshots Of Contact Information For Critical Systems (1).pdf Data Classification Policy_V1_2.pdf Data Encryption Policy_V7_1.pdf Data Management Use Protection Policy_V7_2.pdf Data Protection Policy_V7_2 Data Protection Policy_V7_2.pdf Disaster Recovery Business Continuity System Recovery Prioritization List_V1_2.pdf Disaster Recovery Procedure_V1_5.pdf Drive Data Deletion Policy_V7_2.pdf E-Learning Policies_V7_1.pdf Email and Digital Communication Policy_V8_2.pdf Email and Digital Communication Policy_V8_2.pdf Employee Data Deletion Policy_V7_2.pdf Encryption of Sensitive Data on Transmission Policy_V7_2.pdf Faculty Senate Legislation Reference_V6.1.pdf Firewall Blacklist and Whitelist Policy_V7_2.pdf Firewall Management Procedure_V7_2.pdf GLBA Risk assessment.docx Incident Response and Forensic Analysis Procedures_V7_5.pdf IT Employee Departure Procedures_V7_2.pdf IT Security Awareness and Competencies Policy_V1_5.pdf IT Services System Administration Privileged Access Management Policy_V7_2.pdf IT System Backup Procedures_V7_2.pdf IT System Patching Process_V7_3.pdf Lab / Classroom Administrative Rights Exception Request_V6_1.pdf Local Firewall Procedures for Workstations and Mobile Devices_V7_2.pdf Log Review Policy_V2_1.pdf Mobile Device Security - Remote Email Destruction Process_V1_1.pdf Mobile Device Security Policy_V2_1.pdf Multi-factor Authentication - Information Technology Services - UA Little Rock.pdf Network Patching Process_V1_1.pdf PCI Compliance _ Training Policy_V7_2.pdf Physical Security Policy_V1_3.pdf Retention of Records Policies_V7_2.pdf Security and Incident Response Team Policy_V1_3.pdf Security and IT System Access Policy_V1_2.pdf Student Account Deletion Policy_V7_2.pdf System Log Requirements_V8_2.pdf UALR Change Management Policy 2.2.pdf Vendor Remote Access Policy_V1_1.pdf Vulnerability Scan Policy_V7_2.pdf Wireless Network Guest Security Policy_V1_1.pdf Wireless Security Policy_V1_2.pdf Workstation Administrative Rights Exception Request_V6_1.pdf Anticipated Completion Date: June 30, 2024 Contact Person: Name: Gerald J. Ganz, Jr. Title: Vice Chancellor for Finance & Administration Agency: University of Arkansas at Little Rock Address: 2801 S. University Avenue City, State, Zip: Little Rock, AR, 72204 Phone Number: 501-916-5622 Email Address: GJGanz@ualr.edu

Management agrees with the recommendation. Corrective action by Associate VP of Enrollment Services and University Registrar is as follows: The Office of Enrollment Services has a supplemental procedure in place to capture students who graduate after the initial file submission to the National Student Clearinghouse. To avoid any oversight in the future, the Office of Enrollment Services will enhance the edit report process and frequency. Effective immediately, the edit report will be generated every thirty days by the Compliance Officers to ensure all manual updates to a prior graduation are captured within the sixty-day requirement.

Recommendation: We recommend that the University put a process in place to refund student credit balances that arose from federal funds within 14 days. We also recommend that postings to student accounts of institutional charges for each payment period be posted and dated prior to disbursing federal funds to limit the number of refund checks. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: Student refunds will be processed weekly allowing enough time to correct any errors before the end of the 14 day period. Name(s) of the contact person(s) responsible for corrective action: Mutale Sokoni, Associate Vice President for Finance, 703-284-1496 Planned completion date for corrective action plan: March 2024

Recommendation: We recommend the University review its reporting procedures to ensure that enrollment and program information is accurately reported to NSLDS as required by regulations. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The findings were a result of data entry or date errors. Moving forward the Registrar's Office will have a second staff member review files prior to submission to ensure the accuracy of the submission to the National Student Clearinghouse. The Registrar's Office will notify Financial Aid of NSC submission dates so the FA team can verify accuracy in NSLDS. Name(s) of the contact person(s) responsible for corrective action: Dr. Meghan Arias, University Registrar, 703-284-1526 Planned completion date for corrective action plan: 3/24/24 - date of next file submission

Recommendation: We recommend that the University engage a third party or perform the risk assessment for the areas required by the Gramm-Leach-Bliley Act and ensure that there are documented safeguards for identified risks. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: Acquired Isora GRC, a software tool to facilitate and document compliance with GLBA requirements and the corresponding NIST 800-171 information security framework. Management has also created an Enterprise Risk Management Committee which will incorporate compliance with GLBA as a top priority. Name(s) of the contact person(s) responsible for corrective action: Carl Whitman, Associate Vice President and Chief Information Officer (703-526-6901) Planned completion date for corrective action plan: Action plan by June 1, 2024, including decision regarding use of a third party or in-house resources to perform the risk assessment. Completion of 90% of action plan items within one year.

Student Financial Assistance Cluster – Assistance Listing No. Various Recommendation: We recommend the University review their reporting procedures to ensure that students’ statuses are accurately and timely reported to the National Student Loan Data System (NSLDS) within the appropriate timeframe as required by regulations. University of Maine Condition: During our testing of 40 students, we noted that seven of the 17 University of Maine (UM) students tested had changes in enrollment status that were not reported in a timely manner. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: The University will update its protocols for post-term reporting to the National Student Clearinghouse (NSC) each academic term to ensure students who have applied for graduation, and are pending final eligibility review, are assigned a withdrawn status until such time their degree(s) are conferred or they are reported as enrolled in a future term. Guidance received from the NSC School Operations team has been forwarded to UMS:IT, and steps to identify (or develop) and deploy the necessary reports are underway. The first round of updated reporting protocols are planned to take place in May 2024, for Spring 2024 graduation applicants. Name(s) of the contact person(s) responsible for corrective action: W. Sam Carrell, Registrar for the University of Maine Connie Smith, Director of Financial Aid for the University of Maine Planned completion date for corrective action plan: May 2024

Management acknowledges the finding. The finding was a result of a counselor not performing their tasks timely at a specific time period. Since the finding there is a new student financial aid director and counselor. Additionally, as this deficiency was restricted to WP online programs, the University has expanded staffing in that area to better coincide with an expanding population of students and to further ensure timely processing. The University identified the issue and put procedures in place to ensure that these dates will be met on an ongoing basis prior to the audit review.

Finding 2023-002 – Enrollment Reporting Condition: The College did not notify the National Student Loan Data System (NSLDS) in a timely manner for 1 student with a status change out of a sample of 25 tested. Management Response: Management concurs with the finding. Views of Responsible Officials and Corrective Action Plan: Lebanon Valley College uses the National Student Clearinghouse (NSC) to transmit enrollment information to the National Student Loan Data System (NSLDS). The College has verified that the student status changes were correctly submitted to the NSC, however the campus and program level information was not properly reflected in NSLDS and did not appear on the error report. This appears to be connected to the outages experienced by NSLDS. The College’s Financial Aid Office, along with the Registrar’s office will begin verifying the number of students on the NSLDS student roster each semester. The roster number will be compared to the number of students expected to be on the roster per Financial Aid data. Any discrepancies in this number will be researched and the discovery of any that did not reach NSLDS will be corrected in conjunction with the NSC and NSLDS. Anticipate Completion Date: April 1, 2024 Name of Responsible Person: Christopher Hanlon, Director of Financial Aid chanlon@lvc.edu

Condition: The University did not accurately report the effective date of student's status change to the NSLDS. Of the 40 students selected for enrollment reporting testing, the effective date of the status change for 12 students was not accurately reported. Planned Corrective Action: The cause of the error has been found to be a software issue and the University is actively working with the vendor to determine the ultimate solution. The University has implemented additional controls to ensure that the accurate effective date is reported to the NSLDS in a timely manner. Contact person responsible for corrective action: Diane M. Praet, Associate Vice President and University Registrar Anticipated Completion Date: 3/31/2024

Response to Finding 2023-001: Status Changes Management Response Saint Vincent College concurs with the finding of delays in reporting changes of student enrollment status to the National Student Loan Data System (NSLDS) and attributes the delays to 1.) the first cohort of a joint program with another institution reaching completion 2.) a data breach reported by National Student Clearinghouse (NSC) in June 2023. All students identified as being reported outside of the required time period are enrolled in the joint Bachelor of Science degree in Nursing between Saint Vincent College and Carlow University that began in Fall 2019. Under the agreement for this program, the Registrar’s office of Saint Vincent College reports enrollment to the NSLDS via the NSC. Students graduate with a Carlow University degree. Saint Vincent College is to report program completers as withdrawn at the end of the final enrollment period and Carlow University is to report the students as graduated. The first cohort through this arrangement completed the program requirements in May of 2023. The students in this cohort were not included with the other student enrollment status changes reported in May 2023 following the end of the semester/graduation. While Saint Vincent did ultimately report the cohort as withdrawn, it occurred outside of the required time frame. Saint Vincent’s primary method of reporting status changes to the NSLDS is through the NSC. The NSC reported a data breach on June 26, 2023, at which point the College’s IT department instructed the Registrar to immediately stop sending data to the NSC. The resulted in the aforementioned cohort of students not being reported to the NSC or NSLDS until September 2023 when the College’s IT department provided approval for the Registrar to resume sending data to the NSC. Corrective Action Beginning March 1, 2024, Saint Vincent College’s Financial Aid Office in conjunction with Registrar’s office has implemented a 45-day report to verify that all withdrawals and completions have reached NSLDS via the National Student Clearinghouse. The discovery of any that did not reach NSLDS will be manually reported directly on the NSLDS platform to avoid being outside of the 60-day requirement. Further, during any period of known issues/outages of NSC, the College will report status changes directly to NSLDS. Conclusion The College deems that the corrective action steps outlined above will sufficiently resolve the findings and prevent any future instances of untimely reporting of enrollment data to the NSLDS. Responsible Party, Joshua A. Guiser, CPA. Vice President for Finance and Treasurer Chief Financial Officer

Finding Number: 2023-001 Condition: The University did not report the status changes of certain students to the NSLDS in an accurate and timely manner during the fiscal year. Planned Corrective Action: Campus wide operational operation software (Workday) has already implemented software updates fixing this issue. The software upgrade occurred March 24, 2023, and was operational for the 23-24 academic year. Contact person responsible for corrective action: Not applicable Anticipated Completion Date: Not applicable

Name Connie Joseph Title Controller Phone (662) 562-3292 Email cjoseph@northwestms.edu Finding 2023-001: U.S. Department of Education-Student Financial Assistance Management is in the process of developing a written information security program. Anticipated Completion Date: Prior to June 30, 2024

Internal control procedures will be strengthened between Financial Aid, the Registrar’s Office, and the Bursar’s Office.

During the year-end audit testing phase, the Financial Aid office was notified in August 2023 of the deficiencies noted on this finding. The Financial Aid office immediately took action to implement the recommendations in August 2023. The District established effective controls in August 2023 to ensure the return of funds occurs within 45 days from the date the institution determines the student withdrew from all classes and that the withdrawal determination is performed within the required timeframe. Additionally, the District implemented procedures in August 2023 to ensure that the academic calendar loaded in the financial aid software is accurate and based on the most up to date information. The District implemented procedures in August 2023 to ensure that the correct student status is utilized in the calculation of Return to Title IV.