Corrective Action Plans

Finding: The Department of Children, Youth, and Families did not have adequate internal controls to ensure a child is eligible and group care facility employees and adults residing in prospective caregivers’ households had cleared background checks before having unsupervised access to children. Questioned Costs: Assistance Listing # 93.658 93.658 COVID-19 Status: Corrective action complete Corrective Action: The Department is committed to strengthening internal controls and complying with grant requirements. For the specific exceptions identified in the finding, the Department has taken the following actions: Individuals: • Updated the source of funds in the FamLink application for the child identified in the audit exception to ensure future payments would be made with state funds. • Researched all payments made on behalf of the child and returned the federal portion to the grantor. • Updated the peer review process to ensure that a sample of cases are reviewed quarterly and all documentation is properly retained. Background Checks: • In January 2024, the Department increased its use of National Crime Information Center (NCIC) background checks to ensure all individuals required to complete fingerprint-based checks are compliant prior to a child’s placement. • The Department continues to use the Plan, Do, Check, Act (continuous quality improvement process) to communicate changes and provide additional training to staff as needed to ensure compliance with the background check requirement. The conditions noted in this finding were previously reported in findings 2023-068 and 2022-050. Completion Date: January 2024 Agency Contact: Stefanie Niemela Audit Liaison PO Box 40970 Olympia, WA 98504-0970 (360) 725-4402 stefanie.niemela@dcyf.wa.gov

Finding: The Department of Children, Youth, and Families did not have adequate internal controls to ensure monthly foster care maintenance payments to children’s caregivers were adequate and accurate for the Foster Care program. Questioned Costs: Assistance Listing # 93.658 93.658 COVID-19 Status: Corrective action complete Corrective Action: The Department is committed to strengthening internal controls and complying with grant requirements. As stated in the finding’s Cause of Condition, the Department did not fully implement the prior year’s corrective action plan during the audit period and did not have the reporting capabilities to track rate setting reviews for the entire audit period. To strengthen internal controls and documentation, and as part of the implementation of the new rate assessment process, the Department took the following corrective actions: • Published a new report in FamLink to assist rate assessors in identifying: o Six-month reviews that have not been performed timely. o Cases with upcoming rate assessments and due dates for reviews. • Implemented monthly tracking by supervisors to assist with internal controls and compliance. The Department continues to use the Plan, Do, Check, Act (continuous quality improvement process) to improve the accuracy of the new reports and provide additional training to staff as needed to ensure compliance with the requirement of performing six-month reviews of the reimbursement rates. The conditions noted in this finding were previously reported in finding 2023-067. Completion Date: June 2024 Agency Contact: Stefanie Niemela Audit Liaison PO Box 40970 Olympia, WA 98504-0970 (360) 725-4402 stefanie.niemela@dcyf.wa.gov

Finding: The Department of Children, Youth, and Families did not have adequate internal controls to ensure payments to providers for travel and family visits were allowable and adequately supported for the Foster Care program. Questioned Costs: Assistance Listing # 93.658 93.658 COVID-19 Status: Corrective action in progress Corrective Action: The Department is committed to strengthening internal controls and complying with grant requirements. In response to the prior year audit finding, the Department has taken the following actions: • Between April and December 2023: o Filled two vacant contract staff positions dedicated to reviewing child welfare contracts to include family time visit payments. o Developed compliance audit plans for child welfare contracts and began fiscal monitoring of family time visit payments. o Implemented a new process for creating Sprout invoices from family time activity data to include the following:  Utilizing algorithms to identify reimbursements outside of reasonable amounts.  Requiring providers to submit additional documentation or explanation for flagged invoices.  Identifying duplicate billings using a re-run process.  Performing additional review and approval of invoices of the Network Administrator in Eastern Washington prior to release of payment. • Between January and March 2024: o Identified and implemented regional program approvals for Western Washington providers. o Implemented fiscal monitoring controls to ensure payments to providers for travel and family visits are allowable and adequately supported. o Utilized the Plan, Do, Check, Act (continuous quality improvement process) to add additional steps to the process to ensure payments were accurate. In response to the State Auditor’s Office (SAO) recommendations, the Department will: • Reconcile the identified payment exceptions and take appropriate action. • Review the implemented invoice and payment process and update training resources as needed. • Refine the compliance audit plans and update documentation for the contract monitoring process to ensure that SAO can review documentation for monitoring tasks completed. The conditions noted in this finding were previously reported in findings 2023-066, 2022-048, and 2021-040. Completion Date: Estimated July 2025 Agency Contact: Stefanie Niemela Audit Liaison PO Box 40970 Olympia, WA 98504-0970 (360) 725-4402 stefanie.niemela@dcyf.wa.gov

A user guide will be reviewed by the Registrar describing the steps to assemble the academic year in Banner system. This document will outline all the validation tables managed at the registrar’s office that have an impact on financial aid office procedures. In a coordinated effort with the financial aid office, a review process will be conducted for cases involving total withdrawal transactions. A report will be created to ensure the accuracy of the information and to identify any discrepancies. To provide a comprehensive analysis, the report will help identify the cases that impact the return of Title IV funds.

General Background During the 2023-2024 award year, Hult International Business School, Inc.’s (“Hult”) financial aid department faced a convergence of challenges that led to the findings noted in this audit. These included the transition to the Regent Education system, unexpected staff turnover - including the departure of the Director and subsequently, remaining team - complications stemming from the Department of Education’s FAFSA simplification rollout, and a transition to a new third-party servicer. While these disruptions created a challenging environment in AY23–24, they do not reflect Hult’s current or ongoing ability to effectively manage Title IV funds. Each of the former mitigating issues have since been addressed and resolved, and Hult took steps to significantly limit how students were impacted during this transitional period. Following the departure of key personnel in Spring 2024, we identified gaps in oversight and internal controls that warranted further attention. In response, we immediately removed the individual who had been responsible for oversight of the Financial Aid team and launched a cross-functional committee to conduct an internal audit and process overhaul. Our goal was not only to correct past mistakes but to build a stronger, more resilient foundation moving forward. Key corrective actions include: • Contracting Financial Aid Solutions (FAS) to manage core Title IV functions, including awarding, disbursement, and cash management activities for immediate compliance support, while we rebuilt our internal capacity • Conducting a full review and overhaul of our processes, procedures, and Regent system configuration to align with business needs and Title IV compliance • Hiring and training a qualified, in-house financial aid team, with a focus on cross-training and succession planning, to ensure continuity and operational stability • Revising our existing internal controls managed by the financial aid team, and implementing new internal controls, independently managed by our central finance team, to ensure data accuracy, monitor for discrepancies, and enable prompt resolution of any identified issues • Committing dedicated project management resources to identify process gaps, streamline operations, and optimize our use of system tools These measures represent a deep and sustained investment in the integrity, compliance, and effectiveness of our Title IV operations. We take full responsibility for the instances raised and addressed in this report and are fully committed to preventing their recurrence. With these systems now in place, we are confident in our ability to maintain high-quality, compliant financial aid administration moving forward. Corrective Action Plan - Finding 2024-002 The twenty impacted students noted in Finding 2024-002 were tied to just two disbursement batches - dated September 28, 2023, and February 28, 2024 — not twenty separate events. In both cases, disbursements were accurately recorded in COD, funds were available to students on time, and G-5 draws were eventually completed (during year-end reconciliation) in September 2024. Since the majority of the funds in these disbursement batches were FSEOG, there was not a significant impact on ED Title IV accounting due to FSEOG budgets being predetermined and capped. Additionally, the amounts of these disbursements were credited to students’ accounts, so they were not disadvantaged by this administrative delay. As with the instances in Finding 1 these delays resulted from administrative oversight and human error. While disbursements were initiated in Regent, the full-step process not properly completed, and the managing staff failed to conduct a timely review that would have identified that funds were requested but never received. These issues occurred during periods of major administrative transitions—first, during the initial implementation of Regent in the fall, and then in the spring, during the departure of the former Financial Aid Director and the handoff between third-party servicers. These were isolated incidents caused by temporary disruptions to our internal controls, not indicators of systemic risk. All underlying conditions have since been fully resolved. In response, as outlined in our response to Finding 1, we conducted a full review and overhaul of our Title IV processes. As of Spring 2024, Financial Aid Solutions (FAS) has assumed direct management of awarding, disbursement, and cash management for the 2024–25 academic year. This support has enabled us to fully leverage Regent’s compliance features, enforce strict reconciliation protocols through FAS, and add real-time oversight by Hult’s central finance team. Specifically, to ensure timely and accurate G-5 draws: • FAS manages Title IV disbursements, including the G5 draw downs and reconciliations with COD • All disbursement process steps are actioned within the same business day to reduce errors • Hult has implemented internal controls to reconcile Title IV cash transactions against student ledgers within 1-2 business days • Hult’s revised the monthly bank reconciliation of the federal account to specifically capture unfunded disbursements These measures have established strong safeguards for the Title IV cash management operations. With these protocols in place, we are confident that delayed G-5 draws will not recur in the 2024-2025 award year or beyond.

General Background During the 2023-2024 award year, Hult International Business School, Inc.’s (“Hult”) financial aid department faced a convergence of challenges that led to the findings noted in this audit. These included the transition to the Regent Education system, unexpected staff turnover - including the departure of the Director and subsequently, remaining team - complications stemming from the Department of Education’s FAFSA simplification rollout, and a transition to a new third-party servicer. While these disruptions created a challenging environment in AY23–24, they do not reflect Hult’s current or ongoing ability to effectively manage Title IV funds. Each of the former mitigating issues have since been addressed and resolved, and Hult took steps to significantly limit how students were impacted during this transitional period. Following the departure of key personnel in Spring 2024, we identified gaps in oversight and internal controls that warranted further attention. In response, we immediately removed the individual who had been responsible for oversight of the Financial Aid team and launched a cross-functional committee to conduct an internal audit and process overhaul. Our goal was not only to correct past mistakes but to build a stronger, more resilient foundation moving forward. Key corrective actions include: • Contracting Financial Aid Solutions (FAS) to manage core Title IV functions, including awarding, disbursement, and cash management activities for immediate compliance support, while we rebuilt our internal capacity • Conducting a full review and overhaul of our processes, procedures, and Regent system configuration to align with business needs and Title IV compliance • Hiring and training a qualified, in-house financial aid team, with a focus on cross-training and succession planning, to ensure continuity and operational stability • Revising our existing internal controls managed by the financial aid team, and implementing new internal controls, independently managed by our central finance team, to ensure data accuracy, monitor for discrepancies, and enable prompt resolution of any identified issues • Committing dedicated project management resources to identify process gaps, streamline operations, and optimize our use of system tools These measures represent a deep and sustained investment in the integrity, compliance, and effectiveness of our Title IV operations. We take full responsibility for the instances raised and addressed in this report and are fully committed to preventing their recurrence. With these systems now in place, we are confident in our ability to maintain high-quality, compliant financial aid administration moving forward. Corrective Action Plan - Finding 2024-001 Hult acknowledges that Title IV funds were returned outside the 45-day window in three instances, two of which were identified during the course of this audit preparation. These delays, caused by human errors from former staff who failed to follow timely reconciliation procedures and follow through on system-initiated returns, have since been corrected and all ineligible funds have been returned in full. At this time, Hult was transitioning to a new Regent Education platform under two successive, financial aid directors. The second, despite claiming expertise with Regent, lacked the operational understanding needed for effective implementation and ongoing oversight of this system. While the individuals responsible for these occurrences are no longer with Hult, we accept full accountability for the errors and are committed to ensuring consistent, Title IV compliance moving forward. Following the departure of our most recent director in late Spring 2024, we undertook a thorough review of our financial aid operations. This assessment identified key areas for administrative improvement, which we addressed immediately by engaging Financial Aid Solutions (FAS) to reinforce our compliance functions and provide us with interim, expert support. Throughout Summer 2024, Hult implemented a comprehensive set of corrective actions to strengthen our internal controls and safeguard against future errors. These include: • Extensively redeveloped and tested our Regent infrastructure – in close collaboration with Regent and FAS – to ensure the system operates effectively with Hult’s academic structure, ensures the accuracy of data outputs, and maintains compliance with Title IV regulations • Hired a qualified, experienced, in-house financial aid team of three. We have and continue to prioritize cross-training and succession planning to ensure operational continuity • Implemented a dual-review process for all Title IV awards, with FAS processing calculations in Regent and Hult staff independently verifying them before disbursing funds • Introduced independent, recurring reconciliations of Title IV transactions by Hult’s central finance team, to ensure record accuracy and promptly resolve any issues identified These ongoing efforts have established a more resilient and accountable operational framework. We are confident that with these controls in place, Hult will remain fully compliant with Title IV regulations, and there will be no repeat instances of late returns in the 2024–25 award year.

Student Financial Aid Cluster – Assistance Listing 84.063 and 84.268 Recommendation: The College should review their reporting internal controls and procedures to ensure that they require students' statuses to be reported timely to NSLDS as required by federal regulations. Explanation of disagreement with audit finding: There is no disagreement with the audit finding. Action taken in response to finding: We believe that the recent implementation of registration codes for attendance confirmation, along with updates to the eligibility status codes for unofficial and midpoint withdrawals, will effectively reduce delays in reporting enrollment status moving forward. Additionally, we will work closely with the Registrar’s Office and ITS to ensure alignment on their timeline for reporting monthly enrollment status to Clearinghouse. Name(s) of the contact person(s) responsible for corrective action: Patricia Noren Planned completion date for corrective action plan: FY25 If the Department of Education has questions regarding this plan, please call Antoinette Brown 516-572-7743 x24404.

Institutional Comments on Findings and Recommendations: The institution is fully aware of the Enrollment Reporting requirements and deadlines. The institution agrees with the auditor that there were two (2) cases where the enrollment status was reported late and three (3) cases where the auditors were unable to verify that changes in student status were reported. The institution informed the auditors that its current policy and procedure is to report all changes to student status monthly instead of every two months as established by the NSLDS reporting schedule to avoid cases on non or late reporting. Since the institution does not maintain copies of the report of enrollment changes that it submits to NSLDS and since the current NSLDS database does not maintain students that are inactive, it was unable to evidence the changes or updates that were made for these students to the auditors. Actions Taken or Planned: The institution has already discussed this issue as observed by the auditors with the officer in charge ofNDSLS Enrollment reporting. The institution would continue with its policy to submit Enrollment Reports monthly to update and notify changes to student's enrollment status more effectively and to avoid cases of late or non-compliance. Status of Corrective Actions on Prior Findings: Some of the issues related to this finding occurred in the past audit.

The monthly student reconciliations for the Direct Loan programs, including the SAS files, have resumed starting with the October 2024 SAS file. These reconciliations will continue on a monthly basis by the financial aid office, as required, and will be conducted without interruption. The reconciliation process will be closely monitored, reviewed, and approved monthly by management to ensure ongoing compliance. The loan processing team has been trained on the SAS file import process and direct loan reconciliation. They have also been provided with the necessary system resources to identify variances between Common Origination and Disbursement (COD) and Banner at the student level. Additionally, the direct loan reconciliation process documentation will undergo continuous review and monitoring by the loan processing team, with oversight from the Director of Student Financial Aid and Scholarships, to ensure accuracy and adherence to established policies with each new academic year. The loan processing team will have annual refresher training at the beginning of each academic year. Confirmation of employees, date of training, and current training process will be documented.

On July 29, 2024, Georgia State University (GSU) was made aware of a National Student Loan Data System (NSLDS) reporting defect in our student information system related to program level reporting. A system correction was installed on November 25, 2024. GSU will enhance monitoring procedures to ensure discrepancies in reporting to the NSLDS are identified and corrected in a timely manner.

The student in question had a lengthy break in enrollment (2015-2024). When the student returned, CGTC’s Banner rules differed from his previous enrollment and his status was not accurately updated within the correct term. To correct the issue, CGTC has worked with colleagues at the Technical College System of Georgia to identify and correct any discrepancies in the Banner rules for the Satisfactory Academic Progress (SAP) process to prevent future occurrences of this issue. The College’s Financial Aid office has identified the “cutoff” year for changes in SAP rules and has developed a procedure to manually review any students with long breaks in enrollment whose last enrollment occurred prior to the identified cutoff. This review process will help to ensure that students’ SAP status is accurately updated in the correct term.

The Financial Aid Office has worked with the Registrar's Office to streamline the collection, review and processing of student who are unofficial withdrawals. Streamlining the unofficial withdrawal process will allow for timely and accurate reporting, return to title IV, and reconciliation of funds between Lanier Technical College and Common Origination and Disbursement (COD).

The University of Georgia acknowledges the need for increased monitoring over the return to Title IV aid for students withdrawn from the University. UGA has taken immediate corrective action and has filled key staffing vacancies and implemented additional internal controls to monitor and ensure compliance. A self-audit of Fall 2024 revealed no non-compliance issues.

To prevent future errors, staff will undergo training to ensure accurate processing of withdrawals that occur after the term has ended. Both official and unofficial withdrawals will be evaluated based on the student's last date of attendance when the withdrawal date is after the end of term. While the Financial Aid Office (FAO) staff have adhered to the current withdrawal procedures, we recognize the need for an update to address instances when the date a student initiates the official withdrawal process is earlier than when the withdrawal is completed. To address this, we will adopt the date the student begins the withdrawal process as the official withdrawal date, if this date precedes the completion of the withdrawal form. Additionally, we will implement automated and electronic system controls to ensure withdrawals are processed accurately and within the required timelines by monitoring the full withdrawal cycle. The withdrawal policy and administrative procedures documentation will be updated to reflect these changes. Staff will have annual refresher training at the beginning of each academic year. Confirmation of employees, date of training, and training process will be documented.

Georgia State University (GSU) will ensure all team members are appropriately trained related to the return to title IV process. Procedures have been enhanced to ensure that unearned funds required to be returned to the program due to return to title IV calculations are immediately reconciled and returned during the required window. GSU has established an Assistant Director over Electronic Processing to carry out these procedures.

Georgia State University (GSU) will ensure all team members are appropriately trained related to the process for locking student financial aid records and completing verifications after the term ends. Additionally, GSU has enhanced monitoring procedures to identify changes to institutional student information records after term ends with a verification indicator to ensure these accounts are resolved in a timely manner.

The University concurs with the recommendation. The University will further review and refine the policies and procedures to strengthen internal controls and to ensure the timely and accurate reporting to NSLDS.

2024-002 – Enrollment Reporting (Significant Deficiency) Department of Education, SFA Cluster; Compliance Requirement Affected – Special Tests and Provisions Condition: The University did not report student enrollment data to the National Student Clearinghouse accurately and within minimum required timeframe. Criteria: Based on requirements set forth by 34 CFR 685.309(b)(2), the University is responsible for notifying the National Student Loan Data System (NSLDS) to changes to student’s enrollment data within minimum required timeframes. Cause: The University does not have adequate procedures in place to ensure changes in students’ enrollment statuses are identified and reported in a timely manner. Effect: Enrollment data was not reported timely or accurately to the Department of Education thus, the Department could not properly service the student’s loans. The accuracy of Title IV student loan records depends heavily on the accuracy of the enrollment information reported by institutions. Context: A sample of nine official and unofficial student withdrawals was selected for audit from a population of 63. The test found three student withdrawals that were not in compliance with timely enrollment reporting in NSLDS, the enrollment status for one student was not updated after the student was no longer enrolled on at least a half-time basis, and one student’s enrollment status date reported to NSLDS did not agree to date of withdraw reported on the R2T4 form. Repeat Finding: No. Recommendation: We recommend that the University put procedures in place to ensure that student enrollment statuses are updated in a timely manner. Management Response: The University has modified its withdrawal procedures and instructions related to the requirements set forth by 34 CFR 685.309(b)(2). Related to the findings above, due to staffing turnover, the appropriate test of controls needed to identify changes in a student’s enrollment status was not run in a timely manner. Going forward, the University has informed related staff that the aforementioned test of controls needs to be run at the end of each semester, and upon completion, staff must notify the NSLDS within the required timeframe. If the Federal Audit Clearinghouse has questions regarding this plan, please call Brad Sheriff, PhD, MBA, CMA, Interim Chief Financial Officer at (540) 887-7285. Brad Sheriff, PhD, MBA, CMA, Interim Chief Financial Officer, Mary Baldwin University, 540-887-7285

2024-001 – Return of Title IV Funds (Significant Deficiency)Department of Education, SFA Cluster; Compliance Requirement Affected – Special Tests and Provisions Condition: Return of Title IV funds occurred untimely for three students, exceeding 45 days as required, when considering the University’s date of determination as reported on R2T4 forms. Criteria: Returns of Title IV funds are required to be deposited or transferred into the SFA account or electronic funds transfers initiated to the Department of Education as soon as possible, but no later than 45 days after the date the institution determines that the student withdrew in accordance with 34 CFR 668.173(b). Cause: The University does not have adequate procedures in place to ensure students’ Title IV funds are returned timely. R2T4 forms improperly reported the date of determination the same as the student withdraw date. Effect: The University failed to return Title IV funds to the Department of Education within 45 days of the students’ date of determination as reported on the R2T4 forms. Context: A sample of nine official and unofficial student withdrawals was selected for audit from a population of 63. The test found three student withdrawals that were not in compliance with timely return of funds. Repeat Finding: No. Recommendation: We recommend that the University implement procedures to ensure that R2T4 forms are filed timely and properly reflect the University’s date of determination for all student withdrawals. Management Response: The University concedes that the R2T4 forms improperly reported the date of determination as the same date reported for the student’s date of withdrawal and the University has modified its withdrawal procedures and processes to reflect separate dates when necessary for date of determination and date of withdrawal. Instructions related to R2T4 requirements and timeliness of return of funds will be triggered from the appropriate date of determination. Related to the findings above, the University failed to accurately report the date of determination on R2T4 documentation, causing the return of funds to be out of the window for timely return. Although the funds were returned in a timely manner, the recordkeeping of the determination date was not documented properly. The University has since clarified for staff the importance of this documentation and change in process. Additionally, the university has identified the appropriate test of controls needed to accurately identify the student withdrawal date. This test of controls will be run at the end of each semester, and upon completion, the date the report is run will be used as the correct date of determination. If the Federal Audit Clearinghouse has questions regarding this plan, please call Brad Sheriff, PhD, MBA, CMA, Interim Chief Financial Officer at (540) 887-7285. Brad Sheriff, PhD, MBA, CMA, Interim Chief Financial Officer, Mary Baldwin University, 540-887-7285

Finding 2024-005 Enrollment Reporting: (Significant Deficiency) Federal Agency: Department of Education Program: Federal Direct Student Loans, Pell Grants AL #: 84.268, 84.063 Award Year: 2023-2024 Condition: Nine out of eighteen Enrollment Reporting rosters received were returned back after 15 days. Corrective Action Planned: The late Enrollment Reporting was a result of the significant turnover in the Registrar's office. The University formed an oversight committee outside of the Registrar's office that corrected inaccurate reporting and worked through the backlog to meet reporting requirements. The experienced oversight committee will train the Registrar's office in continuing this timely compliance process for Enrollment Reporting and can backstop if any future personnel turnover or other event could negatively impact timely reporting. Responsible Party: Mark Messingschlager, Director of Financial Aid Anticipated Completion Date: Immediately

Finding 2024-004 Notices and Authorizations: (Significant Deficiency) Federal Agency: Department of Education Program: Federal Direct Student Loans AL #: 84.268 Award Year: 2023-2024 Condition: The written notifications were not provided to students for the periods October 2, 2023 through October 26, 2023 and December 19, 2023 through February 9, 2024. Corrective Action Planned: Corrective actions were taken to resolve the automated notification process. Additional failures were discovered, which led to these deficiencies, and subsequent corrections were made to the system. Based on the possibility of future failures in the automatic process, an additional safeguard procedure has been added to the Financial Aid Office at two levels to verify that the required notices are communicated timely. Responsible Party: Mark Messingschlager, Director of Financial Aid Anticipated Completion Date: Immediately

Condition: The School does not have a documented Direct Loan quality assurance program. Planned Corrective Action: The Iliff School of Theology has contracted with a professional, third-party processing company to administer its student aid programs. The school will coordinate with this third-party processor to ensure that there is a documented quality assurance program that is regularly exercised for compliance purposes. All documentation will be maintained. Contact person responsible for corrective action: Jason Warr, VP for Business, Controller Anticipated Completion Date: June 2024

Condition: The School submitted a FISAP to the U.S. Department of Education that reported inaccurate information in several data fields within the report. In addition, there was no evidence that an individual other than the preparer reviewed the report. Planned Corrective Action: The Iliff School of Theology has contracted with a professional, third-party processing company to administer its student aid programs. Preparation and submission of the FISAP will be completed with coordination between the VP of Business and the third-party processor. This includes a quality review process for accuracy. Contact person responsible for corrective action: Jason Warr, VP for Business, Controller Anticipated Completion Date: June 2024

Condition: Our audit procedures identified instances of untimely reporting of enrollment information to NSLDS. Planned Corrective Action: The Iliff School of Theology has contracted with a professional, third-party processing company to administer its student aid programs. The School has also ensured that this third-party processor is properly coordinated with the registrar’s office to meet federal requirements for NSLDS enrollment reporting. Contact person responsible for corrective action: Jason Warr, VP for Business, Controller Anticipated Completion Date: June 2024

U.S. Department of Education Year ended June 30, 2024 Student Financial Assistance Cluster: Federal Pell Grant Program (Assistance Listing #84.063) Federal Direct Student Loans (Assistance Listing #84.268) Compliance Requirement: Special Tests and Provisions Criteria: The Gramm-Leach-Bliley Act (Public Law 106-102) (GLBA) requires the BOCES, on an annual basis, to identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer (student) information that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assess the sufficiency of any safeguards in place to control these risks. At a minimum, the GLBA risk assessment should include consideration of risk in each relevant area of operations, including: 􀀄 Employee training and management. 􀀄 Information systems, including network and software design, as well as information processing, storage, transmission, and disposal. 􀀄 Detecting, preventing, and responding to attacks, intrusions, or other system failures. Condition: During our testing, we noted the following: 􀀄 A periodic inventory of data, noting where it is collected, stored, and transmitted was not performed. 􀀄 Vulnerability scanning and penetration testing is not completed annually. 􀀄 A written information security program is not fully in place. Policies surrounding risk management have not been implemented. 􀀄 Unsupported operating systems in use. Cause: The expected documentation supporting the required controls to adequately confirm compliance with GLBA safeguards was not complete. Effect: Without demonstrable, documented controls supporting compliance with the GLBA standards for safeguarding the protected data, compliance with the law and the requirements in the federal PPA may not be assured. Context: Inquiry and observation of the information received from the BOCES related to compliance with GLBA. Auditor’s Recommendation: The BOCES should review the GLBA safeguarding rules and as soon as practical implement and document the controls necessary for compliance with the rule, focusing on the completion of a documented, thorough, and standardized risk assessment and management reporting framework. The BOCES should perform comprehensive risk assessments on a regular basis, which is suggested to be at least annually, and at any significant change in infrastructure or business process. Contact Period Responsible for Corrective Action Plan: Warren Taylor, Chief Financial Officer Corrective Action Plan and Timing of Planned Corrective Action Plan: The BOCES is actively engaged in a formal Request for Proposals (RFP) process to procure a qualified vendor for the design and implementation of a comprehensive Information Security Program aligned with GLBA requirements. The selected vendor will conduct a full assessment of existing controls, help develop required policies and procedures, and assist in ensuring full compliance with GLBA mandates, including employee training, information systems safeguards, and incident response protocols. This process will be completed by December 2025. As part of the upcoming vendor engagement, a complete data inventory and structured risk assessment will be conducted. This will identify where sensitive data is collected, stored, transmitted, and processed, and will form the basis for implementing technical and administrative safeguards. This process will be completed by March 2026. In the past several years the BOCES has reviewed several student systems and was unable to identify a system that met all of their needs due to the differences between requirements applicable to school districts and those appropriate to the unique needs of a BOCES. The organization is on track to discontinue the use of all unsupported operating systems by June 30, 2026.