Corrective Action Plans

Federal Program Title: Student Financial Aid Cluster (SFA), 240-day limitation on checks ALN Number: 84.007, 84.033, 84.063, 84.268 Condition: Connors State College had 7 instance of Title IV refund checks to students that were outstanding longer than 240 days as of June 30, 2023 Recommendation: We recommend that the College start to reconcile stale checks to student disbursement info by check number. Explanation if disagreement with audit finding: There is no disagreement with the audit finding. Action planned/taken in response to finding: Checks will only be re-issued for up to 180 days. A joint effort between the Bursar, Accounting and Financial Aid offices to reach the students via email, phone, and text before the 180-day deadline. After 180 days the check will be voided, and the funds returned. Name(s) of the contact person(s) responsible for corrective action: Mattie Keys, mattie.keys@connorsstate.edu Planned completion date for corrective action plan: Dec 31, 2023

Federal Program Title: Student Financial Aid Cluster (SFA), COD posting and reconciling. ALN Number: 84.007, 84.033, 84.063, 84.268 Condition: We noted 1 out of 40 COD disbursements tested, were not reported within the required 15 days to COD. Context: 1 of the 40 COD disbursements had applied dates greater than 15 days from the disbursement dates. Recommendation: We recommend that the student financial aid department works to ensure disbursements are reported to COD within 15 days of the disbursement date. Explanation if disagreement with audit finding: There is no disagreement with the audit finding. Action planned/taken in response to finding: Students identified in the weekly reconciliation that have not posted to COD will be highlighted. In the subsequent reconciliation if student still has not been posted in COD the Financial Aid Director will manually post the student to COD as well as fix any errors so that if can be posted. Name(s) of the contact person(s) responsible for corrective action: Mattie Keys, mattie.keys@connorsstate.edu Planned completion date for corrective action plan: Dec 31, 2023

Federal Program Title: Student Financial Aid Cluster (SFA), 60-day status reporting ALN Number: 84.007, 84.033, 84.063, 84.268 Condition: Fifteen exceptions were observed during Enrollment Reporting testing. The fifteen exceptions were reported beyond the sixty-day allowable timeframe. Context: 15 of the 40 enrollment changes were reported to NSLDS greater than 60 days from the change Recommendation: CLA recommends implementing a formal review process that involves footing the report to verify clerical accuracy and detect errors during the preparation of the report. Explanation if disagreement with audit finding: There is no disagreement with the audit finding. Action planned/taken in response to finding: At the end of each semester a listing of all graduates will be given to the Financial Aid Office from the Registrar. Financial Aid will then go into NSLDS to manually update graduates status. This process will be done in conjunction with the submittion of graduates to the National Clearinghouse by the Registrar. Name(s) of the contact person(s) responsible for corrective action: Mattie Keys, mattie.keys@connorsstate.edu Planned completion date for corrective action plan: Dec 31, 2023

2023-001 - U.S. Department of Education Student Financial Assistance Cluster- Special Tests and Provisions: Return of Title IV Funds The Financial Aid staff will immediately implement a training and approval process including the following steps: 1. Financial Aid staff will complete online training modules concerning the Return to Title IV (R2T4) calculation worksheet. 2. Financial Aid staff will conduct a full research and review of the current USDOE regulations concerning Withdrawals and the Return of Title IV Funds according to the Federal Student Aid Handbook, Volume 5 - Withdrawals and the Return of Title IV Funds. 3. Financial Aid staff will be required to submit the R2T4 calculation worksheet for review and approval by the Financial Aid Director or executive administrator of Financial Aid prior to submitting the worksheet in COD and before requesting that the Chief Financial Officer submits a return of the funds. Implementation ohhis training and approval process will begin no later than November 1, 2023, and be completed no later than January 1, 2024.

Finding number 2023-002 – Eligibility-Significant Deficiency Over Internal Controls Over Compliance Contact person responsible for corrective action: Sue Gosney, Chief Financial Officer, (213) 356-5330 Expected date of corrective action: The corrective action will be implemented in January 2024. The school's management agrees with the finding and has implemented procedure whereby the Financial Aid department will include the Student Identification and Expected Family Contribution (EFC) on the Work Study log to monitor awards against the student’s EFC.

Finding number 2023-001 – Special Tests and Provisions-Enrollment Reporting-Significant Deficiency Over Internal Controls Over Compliance Contact person responsible for corrective action: Sue Gosney, Chief Financial Officer, (213) 356-5330 Expected date of corrective action: The corrective action was implemented in December 2023. The school's management agrees with the finding and has implemented procedure whereby changes in enrollment status reported to the National Student Clearinghouse will be sample reviewed by the Registrar within NSLDS five business days following the reporting date to ensure the accuracy of the information. As an additional layer, the Financial Aid Manager will also calendar a review reminder. Permanent address changes will be reported on a six-week cycle after the add/drop period each term. Address changes will also be sample reviewed to ensure accuracy within NSLDS.

Department of Education 2023-002 Student Financial Assistance – Assistance Listing No. Various Recommendation: We recommend the University reevaluate its procedures and review policies surrounding reporting status changes to NSLDS to put a process in place to ensure the student status changes are being reported timely. Explanation of disagreement with audit finding: There is no disagreement with the auditfinding. Action taken in response to finding: Auditors identified five students where the change in enrollment status was not reported in a timely manner. It was noted that we identified the status changes while there was a cybersecurity breach within the file transfer system used by the National Student Clearinghouse (NSC), our third-party servicer. As a result, our reporting was delayed. We received notice of the incident from the NSC on June 16, 2023. Our next planned transmission was scheduled for June 28. We postponed our regular reporting schedule for one week while we reset our secure FTP password with NSC, initialized our account in their updated system, and while our ITS security officer evaluated the risk. We ended up submitting the file to the NSC on July 5. As a result of this incident, we remain vigilant for external factors that may impact our reporting schedule. We will address them as quickly as possible to avoid reporting delays. Names of the contact persons responsible for corrective action: Gwenn Sherburne, Registrar Planned completion date for corrective action plan: By first reporting date for 2023-2024 academic year in early September 2023.

We concur with the condition noted above. Management believes that the controls in place are appropriately designed to prevent and or detect errors. This instance was isolated and resulted from a coding error related to incorrectly keying the accounting string into our accounting system, which went undetected. Management reassessed the controls over reporting and compliance with laws and regulations. The following steps have been taken to strengthen controls: • Implement enhanced management tools i.e. ERP and shared weekly ledger reports • Staff training in accounts payable to identify and correct errors • Develop operating procedures requiring weekly budget monitoring and updates for program managers

Finding 2023-001 - Special Tests and Provisions – Gramm-Leach-Bliley Act Responsible Individuals – Director of Computer Services and Vice President for Finance & Risk Management. Finding Summary: During testing of Gramm-Leach-Bliley Act and inquiry with management, it was determined that the University does not have a written comprehensive information security program in place. Corrective Action Planned: Dordt will be working with an external organization familiar with the policy requirements of the Gramm-Leach-Bliley Act to take existing procedures and incorporate them into a formal written information security policy that addresses the key areas of the Gramm-Leach-Bliley Act. Anticipated Completion Date: June 30, 2024.

The College will implement procedures to ensure accurate, timely, and complete data is submitted. As an added layer of data validation and verification, the reports required for the Clearinghouse and generated through the college’s student information system will be converted to Excel format (from Notepad) with the help of the Institutional Research office to ensure that data meets the criteria required by the clearinghouse and is free of errors. The responsibility to ensure that data submitted to the National Clearinghouse and NSLDS remains with the Registrar’s office at CCSJ. The Registrar’s office at CCSJ will review data for accuracy, timeliness, and completeness before uploading to the FTP Clearinghouse site. Furthermore, the Director of Student Financial Services has been added as a secondary administrator to the college’s FTP clearinghouse account in which he and the Registrar will receive alerts generated through the Clearinghouse when reports have been uploaded to the site. The Registrar is the primary party responsible for clearing alerts, but the Director of Student Financial Services will verify that the alerts have been cleared. Responsible officers: Marlena Avalos, Assistant Vice President of Academic Affairs (mavalos@ccsj.edu); Derek Shouba, Vice President of Academic Affairs Estimated completion date: March 31, 2024

Finding – Special Tests and Provisions: Enrollment Reporting – Federal Direct Student Loan Program, Assistance Listing Number 84.268; June 30, 2023 Award Year; U.S. Department of Education Criteria or Specific Requirement Enrollment information, including the effective date of separation from the institution, must be accurately reported within 30 days whenever attendance changes for a student, unless a roster will be submitted within 60 days. The changes include reductions or increases in attendance levels, withdrawals, graduations, and approved leaves-of absence. It is the institution’s responsibility, as a participant in the Title IV aid programs, to monitor and report these changes to the National Student Loan Data System (“NSLDS”). (NSLDS Enrollment Reporting Guide November 2022, and 34 CFR 685.309(b)) Condition Of the 40 students selected for enrollment reporting testing, three students were reported to NSLDS outside the maximum 60-day window. This was not a statistically valid sample. Views of Responsible Officials and Planned Corrective Actions The University concurs with the finding. The University will continue to remain vigilant in its oversight over timely communication of enrollment reporting detail to NSC and from NSC to NSLDS, utilizing enhanced exception reporting and a structured process to identify any discrepancies in the data. Names of Contact Persons Responsible for Corrective Action: Nadira Dookharan, Registrar and Anne-Marie Caruso, Associate Vice President, Student Financial Services Anticipated Completion Date: November 30, 2023

Finding – Eligibility – Federal Direct Student Loan Program, Assistance Listing Number 84.268 and Federal Pell Grant Program, Assistance Listing Number 84.063; June 30, 2023 Award Year; U.S. Department of Education Criteria or Specific Requirement The amount of a student's Pell Grant for an academic year is based upon the payment and disbursement schedules published by the Secretary for each award year (34 CFR Section 690.62(a)).The annual maximum loan amount an undergraduate student may receive must be prorated when the borrower is enrolled in a program that is shorter than a full academic year; or enrolled in a program that is one academic year or more in length, but is in a remaining period of study that is shorter than a full academic year. (2022 - 2023 Student Financial Aid Bank Book, Volume 3, Chapter 5, 34 CFR 685.203(a),(b),(c)) Condition Of the 40 students selected for eligibility testing, two students were incorrectly awarded student financial assistance; one student was incorrectly under-awarded a Pell Grant and the other student was over-awarded a Direct Loan. This was not a statistically valid sample. Views of Responsible Officials and Planned Corrective Actions The University concurs with the finding. The University will implement regular periodic quality control checks, utilizing enhanced reporting and dedicated staff resources to ensure student aid is being appropriately calculated and awarded based upon relevant student enrollment and financial information. Names of Contact Persons Responsible for Corrective Action: Anne-Marie Caruso, Associate Vice President, Student Financial Services Anticipated Completion Date: November 30, 2023

FINDING 2023-003 – CONTROLS AND NONCOMPLIANCE OVER SPECIAL TESTS AND PROVISIONS – RETURN OF FUNDS Management’s Response The College accepts this finding and has implemented the corrective plan below to reinforce established policies and procedures to ensure file documentation would identify students in the return funds population. Plan South Suburban College has already established a control process to assist with remaining in compliance as stated in the Single Audit Report Finding 2023-003 Recommendation section. Previously, South Suburban College Financial Aid Department used Business Objects reports to retrieve the college Return of Title IV funding (R2T4) population, it was found that the reporting process was insufficient, therefore the Director of Financial Aid decided to develop an R2T4 tracking process to maintain accurate return of funds calculations. The R2T4 student tracking process is reviewed by the Financial Aid Coordinator and verified by the Financial Aid Manager every week. The Director of Financial Aid will continue to work with South Suburban College Information Technology Department to enhance the retrieval of the Return of Title IV funding student populations reporting process through Ellucian Colleague per 34 CFR 668.22(a)(1) through (a)(5). *This corrective plan has been implemented. Anticipated Date of Completion 1/24/24 Name of Contact Person Avianca Taylor, MBA

FINDING 2023-002 – CONTROLS AND NONCOMPLIANCE OVER SPECIAL TESTS AND PROVISIONS – NATIONAL STUDENT LOAN DATA SYSTEM Management’s Response The College accepts this finding and has implemented the corrective plan below to reinforce established policies and procedures to ensure SSCR information is remitted timely as well as properly reviewed and approved. Plan South Suburban College's Financial Aid Director will work in conjunction with the Director of Registration to review and verify the Student Status Change Report (SSCR) submitted to the Clearinghouse is cross-referenced with the Title IV students in the National Student Loan Data System (NSLDS). To administer this process control the Financial Aid Director will establish a monthly meeting with the Director of Registration to ensure that student status changes are being accurately reported from the Clearinghouse database to the NSLDS. If corrections are needed within the 30-day window the Financial Aid Director will notify the Financial Aid Manager to work with the registration department to reconcile and update any student status changes. Maintaining the control implemented will allow South Suburban College to remain in compliance with the Uniform Guidance in the Compliance Supplement. This was also identified during the audit request. Documentation was provided that the National Student Loan Data System was having issues with their system reporting accurate student status changes during that timeframe. *This corrective plan has been implemented. Anticipated Date of Completion 1/24/24 Name of Contact Person Avianca Taylor, MBA

FINDING 2023-001 – CONTROLS AND NONCOMPLIANCE OVER-REPORTING – PELL COMMON ORIGINATION AND DISBURSEMENT Management’s Response The College accepts this finding and has implemented the corrective plan below to reinforce established policies and procedures regarding timely submission of COD information. Plan South Suburban College Financial Aid Department has implemented cross-training between the Financial Aid Manager, Financial Aid Coordinator, and Financial Aid Advisor to reinforce in the case of possible turnover the established controls for processing Pell Common Origination and Disbursement payments within the 15 days of submission window per the required Uniform Guidance in the Compliance Supplement. For instance, the control will consist of one of the designated staff members listed to process the batches weekly. This will allow all batches to be processed within 7 days assuring that the 15-day submission period is within compliance. In addition, the Director of Financial Aid has added a weekly calendar reminder for all trained staff to avoid missing batch processes due to personnel being out of the office or working from home. This control process was executed after positions were successfully filled and staff trained, in the Fall 2022 term. The process has been accomplished in Spring 2023. *The corrective action plan has been implemented. Anticipated Date of Completion 1/24/24 Name of Contact Person Avianca Taylor, MBA

We discovered the program was only reporting students as lessthan- half-time (“L”), half-time (“H”), and full-time (“F”). We have already adjusted the enrollment reporting program to properly report students who are enrolled at a ¾-time (“Q”) level. We will also work with the National Student Clearinghouse to ensure the enrollment effective dates are correctly reported for both the campus and program levels. Contact person: Tom Ochsner, Director of Scholarships and Financial Aid Planned completion date for corrective action plan: October 2023 If the Department of Education has questions regarding this plan, please call Tom Ochsner at (402) 465- 2212.

Condition: The University did not timely notify student or parent within 30 days of crediting the student’s account with FDL. Planned Corrective Action: When posting direct loans to the student’s account, we add a touchpoint to the student’s record. This automatically sends an email to the student. We will mail a notification to the parent in the case of a Parent PLUS loan. Contact person responsible for corrective action: Nicole Neal Anticipated Completion Date: 11/01/2023

Condition: Shawnee State University did not report student status changes timely and accurately for certain students who withdrew during the year. Planned Corrective Action: Shawnee State University will perform a comprehensive review of reporting procedures (including review of reporting process, personnel responsibilities, system modifications) and make revisions to workflow to prevent future occurrence of this finding. A review of activity prior to implementation of revised procedures will be conducted and any exceptions will be documented and corrected. Contact person responsible for corrective action: James Farmer, Chief Enrollment Officer and Greg Ballengee, Chief Financial Officer Anticipated Completion Date: 12/31/2023

Condition: The University did not return Title IV funds to the Department of Education within the required time frame for certain students who required a return of funds, and it did not initially identify all students who required a return of Title IV funds. Planned Corrective Action: Shawnee State University will perform a comprehensive review of financial aid procedures (including review of financial aid processing, personnel responsibilities, system modifications) and make revisions to workflow to prevent future occurrence of this finding. A review of activity prior to implementation of revised procedures will be conducted and any exceptions will be documented and corrected. Contact person responsible for corrective action: James Farmer, Chief Enrollment Officer and Greg Ballengee, Chief Financial Officer Anticipated Completion Date: 12/31/2023

The District has taken responsibility for providing the Department of Education with the website link and will provide that going forward. Personnel Responsible for Implementation: Nyame-Tease Prempeh Position of Responsible Personnel: Assistant Director of Accounting Expected Date of Implementation: November 1, 2023

A. Formally Establish and Document Risk Acceptance Process Requirements for risk assessments and risk acceptance processes to comply with GLBA were expanded in June of 2023. The District engaged a third-party consultant to conduct a GLBA-compliant risk assessment and advise on recommended changes to the District’s Written Information Security Plan (WISP) to comply with the new requirements. The findings and recommendations were presented to the District in October of 2023 and are currently under review. The District will initiate a project to formalize risk acceptance by December 31st, 2023, and implement the risk acceptance process by June 30, 2024. B. Perform Regular Backup Restoration Tests The District has engaged with a third party to build a testing environment to physically test restoration of the SIS environment. Initiation of the project is pending processing of the Purchase Order. The District anticipates completion of the restoration by December 31st, 2023. With respect to SAP, the District is currently engaged in an effort to migrate the SAP database to HANA. When this project is complete, the same test environment will be capable of performing physical recovery tests for SAP. The HANA migration is estimated to be completed on February 28th, 2024. C. Perform Timely Access Revocation and Regular Access Reviews With respect to the District’s Single Sign-On (ADFS or SSO) environments, the District engaged professional services consultants to address this item by automating the disablement of employee accounts based upon the termination of assignment. The work is currently underway. The target completion of the process is December 15, 2023. With respect to the SAP environment, the District has engaged with a vendor to implement Multifactor Authentication (MFA) in the SAP environment. Work will begin upon processing the Purchase Order. Once both efforts are complete, disabling employee accounts in SSO, SIS and SAP will be performed automatically based upon the termination of assignments according to criteria established by Human Resources. With respect to access reviews of SIS and SAP, the District is currently researching the export of user audit logs to the District’s analysis environment to enable regular reviews. The new target to perform regular access reviews for SAP and SIS is the end of Q1 2024. With respect to physical access reviews, the District Information Security Team will perform an annual review of relevant operational protocols for data center access with the appropriate internal teams and perform an audit of data access at a minimum of once per year. The first annual protocol review will be completed by December 1st, 2023. The first annual audit will commence no later than March 1st, 2024. D. Perform Necessary Due Diligence to Regularly Evaluate All Third-party Safeguards To prevent recurrence, the LACCD Information Security Team will coordinate an annual review of Administrative Protocol 3723A: Information Security Evaluation of Third-Party Providers with District Financial Aid, Procurement and Educational Programming and Institutional Effectiveness (EPIE) leadership teams to help assure future relevant contracts are provided to the Information Security Team prior to renewal to allow for timely security review. E. Maintain and Review Logs of Users’ Activity for both SAP and PS SIS The District is currently researching the export of user audit logs to the District’s analysis environment to enable regular reviews. The new target to perform regular access reviews for SAP and SIS is the end of Q1 2024. F. Implement data encryption for Devices Storing Customer Data The District engaged a third-party consultant to perform a comprehensive review of PeopleSoft security controls, including the implementation of encryption of financial aid data within PeopleSoft. The results are pending. Based upon those recommendations, the District will work with encryption providers to develop and implement field-level encryption of financial aid data in SIS as appropriate. With respect to end-user devices storing sensitive data, the District recently adopted workstation hardening requirements that include whole-disk encryption for desktop and laptop computers used by personnel who routinely access sensitive information, including financial aid data. The District will implement the standards on workstations used by employees in financial aid and institutional research by June 30, 2024. Once this is complete, additional workstations will be encrypted in order of potential risk. G. Strictly Implement Processes and Control for Direct Changes in the SAP Production Environment The requests for direct changes in SAP production will be tracked and included in our help desk requests so that an auditable trail can be created leading to the purpose and completion of the production changes. Additionally, direct production change requests will be reviewed and approved following the LACCD Change Control process. Minor updates that do not fall within the change control guidelines will require managerial approval within the help desk system. Personnel Responsible for Implementation: Carmen V. Lidz Position of Responsible Personnel: Vice Chancellor & Chief Information Officer

A. Incorrect Calculation of Return to Title IV Funds East Los Angeles College The corrective action plan that will be put in place is to develop a chart with a predetermined number of days based on the enrollment period. This will avoid the manual counting of the number of days for each student. We also trained an additional staff member to help with the workload. This will ensure that errors will be caught before the completion of the review process. Implementation will begin in Spring 2024. Staff is currently being trained. Personnel Responsible for Implementation: Gavino Herrera Position of Responsible Personnel: Financial Aid Supervisor Expected Date of Implementation: Spring 2024 Los Angeles Southwest College The corrective action that we are implementing to remediate this finding is to move the campus return to Title IV processing to the “R2T4 Unit” at the District Office. Personnel Responsible for Implementation: Muniece R. Bruton Position of Responsible Personnel: Financial Aid Manager Expected Date of Implementation: December 1, 2023 B. Untimely Notification of Grant Overpayment to Students and Secretary East Los Angeles College The Corrective Action plan is being implemented by providing an additional staff member to assist with the return to Title IV process along with helping with the validation to ensure calculation, notification, and reporting to NSLDS will be completed on a timely basis. A reminder is set in the Financial Aid Technician Outlook calendar to help remind them to help meet the deadline of the reporting requirement. Personnel Responsible for Implementation: Gavino Herrera Position of Responsible Personnel: Financial Aid Supervisor Expected Date of Implementation: Fall 2023 C. Distance Education Courses – Lack of Formal Process to Determine Accuracy of Student Withdrawal Date In the fall 2022 term, the District implemented training for all Distance Education (DE) faculty members to reduce the risk of data entry errors. DE faculty receive follow-up notifications at the beginning of every term). In addition, the District attempted to conduct random sampling to ensure the accuracy of the data entry. However, the District did not have the authorization or resources to perform sampling during the audit period. As a result, the corrective action plan (CAP) was only partially implemented during fiscal year 2023. In fall 2023, the District secured the human resources and required authorizations to conduct random sampling of the faculty data entry. The District’s Internal Audit Department (IAD) is performing random sampling of all campuses. As of fall 2023, all corrective actions have been fully implemented. Personnel Responsible for Implementation: Steve Giorgi, Betsy Regalado, Keyna Crenshaw Position of Responsible Personnel: Financial Aid Manager, Associate Vice Chancellor of Educational Programs and Institutional Effectiveness, LACCD Supervising Auditor) Expected Date of Implementation: Fall 2023

The District believes this error was an isolated incident and the effect is minimal as we performed an extensive review of all nine campuses’ Pell grant award disbursements for the term and found that this was the only similar award. The District will monitor disbursements and will perform reconciliation on a monthly basis. Personnel Responsible for Implementation: FA Office and the Central Financial Aid Unit. Position of Responsible Personnel: FA Managers Expected Date of Implementation: Already Implemented

Views of Responsible Officials and Planned Corrective Actions – The National Student Clearinghouse (NSC) Graduation Status submission calendar will be updated to reflect the necessary reporting timeline. The report will be completed after verification of graduation requirements and credentialing are completed in Colleague by the Registrar's Office. The Registrar and Associate Registrar complete different steps in the credentialing process, but will review the student records together to ensure accuracy and timely completion. Submission of graduation status to NSC will occur after each academic term (fall and spring semester, January and summer sessions).

Recommendation Test work on samples from both Portales and Roswell populations resulted in the identification of two possible issues related to incorrect calculations of aid to be returned to federal aid programs based on student’s complete withdrawal from the University. Contact was made with Ellucian/Banner customer support regarding the issue. Ellucian customer care subsequently verified a known issue within vendor software where the R2T4 calculation is incorrect when manual award adjustments or ‘locks’ are made to students who were not enrolled as full-time students when originally disbursed.   Management Response Corrective Action: In an immediate review of all students subject to return of funds calculations in both Banner instances for the 2022-2023 award year it was found that of the 322 (213 Portales/Ruidoso, 101 Roswell) students subject to Return of Title IV Funds, 17 students were identified where the calculation was incorrect, manual recalculation of funding is ongoing and will be handled within allowable timeframes with the business office. Although the software defect is present in both instances of banner no students at the Roswell campus were impacted as a result of procedural differences. Timeline of Corrective Action: Effective immediately the institution has implemented the recommended software vendor “work around”. In addition, all students enrolled less than full time will be monitored and calculations confirmed to ensure calculations are accurate. Responsible Party(ies): Financial Aid Directors – Portales and Roswell Campuses