Corrective Action Plans

Finding 2024-005 Enrollment Reporting: (Significant Deficiency) Federal Agency: Department of Education Program: Federal Direct Student Loans, Pell Grants AL #: 84.268, 84.063 Award Year: 2023-2024 Condition: Nine out of eighteen Enrollment Reporting rosters received were returned back after 15 days. Corrective Action Planned: The late Enrollment Reporting was a result of the significant turnover in the Registrar's office. The University formed an oversight committee outside of the Registrar's office that corrected inaccurate reporting and worked through the backlog to meet reporting requirements. The experienced oversight committee will train the Registrar's office in continuing this timely compliance process for Enrollment Reporting and can backstop if any future personnel turnover or other event could negatively impact timely reporting. Responsible Party: Mark Messingschlager, Director of Financial Aid Anticipated Completion Date: Immediately

Finding 2024-004 Notices and Authorizations: (Significant Deficiency) Federal Agency: Department of Education Program: Federal Direct Student Loans AL #: 84.268 Award Year: 2023-2024 Condition: The written notifications were not provided to students for the periods October 2, 2023 through October 26, 2023 and December 19, 2023 through February 9, 2024. Corrective Action Planned: Corrective actions were taken to resolve the automated notification process. Additional failures were discovered, which led to these deficiencies, and subsequent corrections were made to the system. Based on the possibility of future failures in the automatic process, an additional safeguard procedure has been added to the Financial Aid Office at two levels to verify that the required notices are communicated timely. Responsible Party: Mark Messingschlager, Director of Financial Aid Anticipated Completion Date: Immediately

Condition: The School does not have a documented Direct Loan quality assurance program. Planned Corrective Action: The Iliff School of Theology has contracted with a professional, third-party processing company to administer its student aid programs. The school will coordinate with this third-party processor to ensure that there is a documented quality assurance program that is regularly exercised for compliance purposes. All documentation will be maintained. Contact person responsible for corrective action: Jason Warr, VP for Business, Controller Anticipated Completion Date: June 2024

Condition: The School submitted a FISAP to the U.S. Department of Education that reported inaccurate information in several data fields within the report. In addition, there was no evidence that an individual other than the preparer reviewed the report. Planned Corrective Action: The Iliff School of Theology has contracted with a professional, third-party processing company to administer its student aid programs. Preparation and submission of the FISAP will be completed with coordination between the VP of Business and the third-party processor. This includes a quality review process for accuracy. Contact person responsible for corrective action: Jason Warr, VP for Business, Controller Anticipated Completion Date: June 2024

Condition: Our audit procedures identified instances of untimely reporting of enrollment information to NSLDS. Planned Corrective Action: The Iliff School of Theology has contracted with a professional, third-party processing company to administer its student aid programs. The School has also ensured that this third-party processor is properly coordinated with the registrar’s office to meet federal requirements for NSLDS enrollment reporting. Contact person responsible for corrective action: Jason Warr, VP for Business, Controller Anticipated Completion Date: June 2024

U.S. Department of Education Year ended June 30, 2024 Student Financial Assistance Cluster: Federal Pell Grant Program (Assistance Listing #84.063) Federal Direct Student Loans (Assistance Listing #84.268) Compliance Requirement: Special Tests and Provisions Criteria: The Gramm-Leach-Bliley Act (Public Law 106-102) (GLBA) requires the BOCES, on an annual basis, to identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer (student) information that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assess the sufficiency of any safeguards in place to control these risks. At a minimum, the GLBA risk assessment should include consideration of risk in each relevant area of operations, including: 􀀄 Employee training and management. 􀀄 Information systems, including network and software design, as well as information processing, storage, transmission, and disposal. 􀀄 Detecting, preventing, and responding to attacks, intrusions, or other system failures. Condition: During our testing, we noted the following: 􀀄 A periodic inventory of data, noting where it is collected, stored, and transmitted was not performed. 􀀄 Vulnerability scanning and penetration testing is not completed annually. 􀀄 A written information security program is not fully in place. Policies surrounding risk management have not been implemented. 􀀄 Unsupported operating systems in use. Cause: The expected documentation supporting the required controls to adequately confirm compliance with GLBA safeguards was not complete. Effect: Without demonstrable, documented controls supporting compliance with the GLBA standards for safeguarding the protected data, compliance with the law and the requirements in the federal PPA may not be assured. Context: Inquiry and observation of the information received from the BOCES related to compliance with GLBA. Auditor’s Recommendation: The BOCES should review the GLBA safeguarding rules and as soon as practical implement and document the controls necessary for compliance with the rule, focusing on the completion of a documented, thorough, and standardized risk assessment and management reporting framework. The BOCES should perform comprehensive risk assessments on a regular basis, which is suggested to be at least annually, and at any significant change in infrastructure or business process. Contact Period Responsible for Corrective Action Plan: Warren Taylor, Chief Financial Officer Corrective Action Plan and Timing of Planned Corrective Action Plan: The BOCES is actively engaged in a formal Request for Proposals (RFP) process to procure a qualified vendor for the design and implementation of a comprehensive Information Security Program aligned with GLBA requirements. The selected vendor will conduct a full assessment of existing controls, help develop required policies and procedures, and assist in ensuring full compliance with GLBA mandates, including employee training, information systems safeguards, and incident response protocols. This process will be completed by December 2025. As part of the upcoming vendor engagement, a complete data inventory and structured risk assessment will be conducted. This will identify where sensitive data is collected, stored, transmitted, and processed, and will form the basis for implementing technical and administrative safeguards. This process will be completed by March 2026. In the past several years the BOCES has reviewed several student systems and was unable to identify a system that met all of their needs due to the differences between requirements applicable to school districts and those appropriate to the unique needs of a BOCES. The organization is on track to discontinue the use of all unsupported operating systems by June 30, 2026.

This Corrective Action Plan is in response to Lancaster Bible College’s single audit report for the fiscal year ended June 30, 2024, prepared by Tait, Weller & Baker. Finding 2024-001 Recommendation: The College should review its procedures related to the request and disbursement of federal funds, including controls over compliance, to ensure they are following the advance payment method and establish controls to ensure it complies with the federal requirement. Corrective Action: In July 2024, a new tracking system was implemented for daily reconciliation of award batch detail along with specific individual training to ensure staff follows compliance responsibilities and understand the requirements of the program. The Controller and Financial Aid Director meet monthly to discuss any potential gaps in compliance. Person Responsible for Corrective Action: Matthew Mason, Vice President of Finance Anticipated Completion Date: The Corrective Action Plan was corrected during July 2024.

Finding 2024-002 – Student Financial Aid Cluster, Assistance Listing # 84.063 and 84.268 Limestone University utilizes Jenzabar software to extract and report enrollment data to the National Student Clearinghouse (NSC). However, in some instances, the data reported was incorrect. Since the occurrence of this issue, the University hired a new Registrar in August 2024. After reviewing the findings, the Registrar implemented the use of the NSC Edit Student Data Records window, in addition to the NSC Edit Registration Transactions window. This change allows a special status on the NSC Edit Student Data Records window to override the status on the Registration Transactions window, providing more precise monitoring of withdrawal dates and ensuring the accuracy and timeliness of the data reported to NSC. To ensure ongoing accuracy, the Registrar now reports enrollment status changes to NSC on a monthly basis. Additionally, the University reviewed the students identified in the findings, along with other students who had the same status (withdrawn) and made adjustments as necessary to ensure that all student data was accurately reported.

2024-027 Oregon Department of Human Services Strengthen controls around background checks Management Response: Child Welfare has robust business processes that support the accurate and timely completion of fingerprint-based background checks. These include an OR-Kids provider record that ensures all required elements are completed prior to issuing a full certificate of approval, including management approval. Additionally, Title IV-E eligibility business processes require the verification of finger-print based background checks through review of the original documentation (1011f). The Foster Care Program completes regular quality assurance reviews in all districts as an ongoing effort to identify issues and ensure compliance. Any issues identified during reviews are discussed with local managers and staff to coordinate corrections and identify solutions and/or training needs. Program analysis of this error has determined the issue to be an isolated event of human error. Foster Care Program and Federal Policy and Resources will collaborate to ensure the error case is corrected and provide documentation to demonstrate those corrections. Anticipated Completion Date: April 30, 2025. Contact Persons: Megan Brazo-Erickson, Federal Policy and Resources, Donna Haney, Foster Care Program

CORRECTIVE ACTION PLAN YEAR END JUNE 30, 2024 Gettysburg Area School District respectfully submits the following corrective action plan in response to the findings listed in Section II of the Schedule of Findings and Questioned Costs for the year end June 30, 2024. Finding 2024-001: Reporting Requirements Condition: The District did not file the Title I, Title II, Title III, Title IV, ARP ESSER, ARP ESSER 7%, ARP ESSER Homeless Children and Youth, and ARP ESSER 2.5% Reconciliation of Cash on Hand Quarterly Reports for September 2023 and March 2024 in an timely manner within the 10-day requirement. The District did not file the Title I, Title II, Title III, Title IV, ARP ESSER, ARP ESSER 7%, ARP ESSER Homeless Children and Youth, and ARP ESSER 2.5% Reconciliation of Cash on Hand Quarterly Reports for December 2023 and June 2024. Additionally, the Final Expenditure Report for the ESSER II was not filed by the required due date. The reports noted here were not related to a single audit requirement and thus were reported as a financial statement internal control finding. Corrective Actions Taken or Planned: Corrective Action has been addressed for the Federal filing requirements for the 2024-2025 fiscal year and thereafter.

2024-027 Oregon Department of Human Services Strengthen controls around background checks Management Response: Child Welfare has robust business processes that support the accurate and timely completion of fingerprint-based background checks. These include an OR-Kids provider record that ensures all required elements are completed prior to issuing a full certificate of approval, including management approval. Additionally, Title IV-E eligibility business processes require the verification of finger-print based background checks through review of the original documentation (1011f). The Foster Care Program completes regular quality assurance reviews in all districts as an ongoing effort to identify issues and ensure compliance. Any issues identified during reviews are discussed with local managers and staff to coordinate corrections and identify solutions and/or training needs. Program analysis of this error has determined the issue to be an isolated event of human error. Foster Care Program and Federal Policy and Resources will collaborate to ensure the error case is corrected and provide documentation to demonstrate those corrections. Anticipated Completion Date: April 30, 2025. Contact Persons: Megan Brazo-Erickson, Federal Policy and Resources, Donna Haney, Foster Care Program

Condition: Northeastern Illinois University (University) did not have adequate procedures and controls in place to ensure student that unofficially withdrew during the semester were accurately reported to the National Student Loan Data System (NSLDS) for the effective date of the enrollment change Planned Corrective Action: Registrar’s office will utilize the financial aid’s last date of attendance report to back date the effective enrollment reported date for unofficially withdrawn students. Contact person responsible for corrective action: Rahshida Walker, Registrar Anticipated Completion Date: 6/30/2025

The different conditions mentioned pertain to two students. There were errors in calculation which have been corrected by the financial aid office and the cause noted to prevent future occurrences. Since the college does not require repayment from students for amounts returned in an R2T4 calculation, it is positive to note that the students were not financially affected by the errors. 54

Student exceptions were caused by a coding error within the Banner reporting system. Upon discovery, the errors were promptly reviewed and corrected subsequent to year end. The necessary adjustments were made to the enrollment data, and the corrected information was submitted to the appropriate federal and state agencies in compliance with reporting requirements. The Financial Aid Director and Registrar will work closely together to continue to monitor the withdrawal process put in place after the finding was identified in the 2023 fiscal year.

2024-001: Return of Title IV - Student Financial Aid Cluster - Assistance Listing Number 84.007, 84.033, 84.063, 84.268, Grant Period - Year Ended August 31, 2024 Condition: During our return of Title IV Fund testing we noted that University did not properly calculate or return Title IV for one student out of the five students in our sample. The University returned $687 more in Title IV funds than they were required to return. We consider this to be an instance of non-compliance relating to the Special Tests and Provisions Compliance Requirement. Corrective Action Plan Financial Aid Office will make sure to accurate calculate the return of Title IV. EWU will return the over awarded Direct Loan Subsidized to reflect the correct amount for the student. This was an isolated data entry error while entering the amounts on COD R2T4 calculator. Responsible Person for Corrective Action Plan Director of Financial Aid Cesar Campos Implementation Date of Corrective Action Plan 02/10/2025

Description of Finding During the 2024 audit, it was identified that 3 out of 19 sampled students were not disbursed the correct Pell award. Corrective Action Plan The College is dedicated to awarding and disbursing all federal awards timely and accurately. A system error resulted in the locking of Pell grant awards which prevented the automated updates of award amounts when students’ registered credits changed. The College has implemented training to all Financial Aid team who award students to not lock any federal aid awards with the system. When reviewing and disbursing there will also be a specific check for locked awards to prevent this going forward. Timeline for Implementation of Corrective Action Plan The College has implemented the corrective action plan on October 31, 2024. Contact Person James Ryan, Ph.D. Vice President of Enrollment Management

Identifying Number: 2024-002 Finding: Special Tests: Enrollment Reporting – Improper Reporting of Withdrawal Date Applicable Regulation: Per the National Student Loan Data System (NSLDS) enrollment reporting guide (Section 4.4.3) when a student withdraws during a term, the effective date for the withdrawn status is the withdrawal date used by the Institution in accordance with 34 CFR 668.22. Finding: 3 out of a total of 24 students tested for enrollment reporting in NSLDS had an incorrect date listed as the effective date of the student’s enrollment status. Summary: During our enrollment testing, we noted that the effective date of withdrawal in NSLDS for 3 students tested was incorrectly listed as the date of determination by UWS instead of the withdrawal date determined in accordance with 34 CFR 668.22. Internal controls in place did not identify the errors. Three students with incorrect enrollment reporting dates were due to the student’s out of school status treated by the relevant University department as an unofficial withdrawal instead of an official withdrawal for enrollment reporting purposes. The Dates of Determination were therefore used incorrectly. Corrective Action Planned or Taken: The University of Western States has updated its policy for all out of school and reporting for all out of school students. Additionally, an internal Decision Tree resource document has also been created for use when processing student withdrawals and reporting student statuses. All out of school students will have the appropriate out of school date selected and submitted for enrollment roster reporting based on the updated policy and the supplemental Decision Tree. UWS staff has also reviewed all students and confirms reporting statuses align with the updated policy. Contact Person: Michelle Miller, Senior Vice President of Enrollment Management mmiller10@tcsedsystem.edu Anticipated Completion Date: September 17, 2024

Response to audit report Audit Period: June 30,2024 Audit Finding: Finding No. 2024-01 Special Tests and Provisions - Return of Title IV Funds Corrective Action: Since August 2023, the institution has implemented a new unofficial withdrawals (UW) policy. This policy defines an unofficial withdrawal as a student who stops attending one or more courses without officially withdrawing. An unofficial withdrawal will be assigned to any student who has consecutively ceased attending a course for three weeks and for whom no evidence of attendance is available at the time of reporting within the specified period. If a student stops attending all their courses, the Registrar's Office will inactivate the student and issue a report to the Financial Aid office for an R2T4 calculation. This process will occur on the last instructional day before the final exams, as outlined in the academic calendar. According to the policy, Faculty members submit a report of students who have stopped attending (using an official form) and indicate the last date of academic activity for each student reported as UW. These students are not assigned a grade but rather a "UW." Students who complete the course by continuing to attend but fail to meet the academic requirements receive a grade of "F." In addition, effective March 2025, the Academic Deanship has established an institutional policy for submitting grade records (roll books) at the end of each academic term. Since 2024, some faculty members have participated in a pilot project to adopt the Electronic Gradebook (Roll book). After adjusting the system, the institution will offer training sessions to all faculty members. By the end of the February-May 2025 term, faculty will submit the required documentation to maintain records of the grades assigned to each student. Name of the Contact Person: Norma Ortiz, EdD Academic Dean 787-720-1022 ext. 1138 nortiz@atlanticu.edu Projected Completion Date: Beginning in May 2025, the institution will require all faculty members to submit roll books. The Academic Dean's Office will ensure compliance with this new policy. Ramón Barquín Torres Chairman of the Board rbarquin3@atlanticu.edu

AUDIT FINDING Finding 2024-001 NSLDS Status Reporting Error MANAGEMENT'S COMMENTS ON FINDINGS AND RECOMMENDATIONS We concur with the auditor's finding and identification of a deficiency in our internal controls. ACTIONS TAKEN OR PLANNED We will increase internal controls to ensure all NSLDS status reporting is done correctly. EMPLOYEE/ DIVISION RESPONSIBLE Financial Aid Director TIMELINE AND ESTIMATED COMPLETION DATE Immediately

FINDING 2024-002: Program Income Response: Montana Office of Public Instruction has informed us of this error in management of the 21st Century Grant. In order to be compliant, we are not charging fees for programs within this grant.

Corrective Action Plan The College is required to notify students who have borrowed Title IV student loans to complete loan exit counseling if they withdraw, take a leave of absence, are enrolled less than half-time or have completed their academic program. The Director, or designee, will evaluate students in the above conditions twice a month and email students about the requirement to complete loan exit counseling. In addition, at the end of the fall, spring and summer terms, the Director will request a list of students who completed programs from the Registrar, identify those with loans and send the notice. Timeline for Implementation of Corrective Action Plan: The corrective action plan was implemented in January 2025.

The 3999-AD Grant (After School Grant) was not approved by ISBE until January 19th, 2024. No expenditure report could have been done by December 30, 2023. Title 2, Title 4, IDEA Flow Through and IDEA PS were all submitted on October 27, 2023. Moving forward reports will be submitted within the required time frame.

The University has established policies and procedures to report a change in a student’s enrollment status in its next updated Enrollment Reporting roster. The University will take the necessary steps to ensure compliance with established policies and procedures with regard to reporting a change in a student’s enrollment status.

Lane College acknowledges the audit finding regarding delayed reporting of withdrawal and graduation dates to the National Student Loan Data System (NSLDS). The College recognizes the importance of timely and accurate reporting as a critical compliance requirement under 2 CFR Part 200 and the compliance supplement. In response to this audit finding, Lane College commits to implementing immediate and sustained corrective actions as follows: 1. Enhanced Tracking System: Lane College will implement a robust tracking system specifically designed to monitor student enrollment status changes, including withdrawals and graduations, to ensure these changes are promptly identified and reported. The tracking system will be integrated within the existing enrollment management software, enabling automatic notifications to designated staff when an enrollment status change occurs. 2. Internal Control Improvements: The College will strengthen internal controls by clearly delineating responsibilities for enrollment reporting among relevant departments. The Registrar's Office will have primary accountability for overseeing timely reporting, supported by coordinated 3. checks and balances from the Financial Aid Office to cross-verify reporting accuracy and timeliness. 4. Staff Training: Regular training sessions will be conducted for all staff involved in reporting enrollment status changes. These trainings will focus on compliance requirements, reporting timelines, and use of the updated tracking and reporting system. Attendance will be mandatory, and training effectiveness will be evaluated through periodic assessments. 5. Periodic Audits: To sustain compliance, the College will institute internal audits conducted quarterly by the Office of Enrollment Management. These audits will sample enrollment status changes and assess the timeliness of reports submitted to NSLDS. Audit results will be documented, reviewed by senior management, and any deviations will be promptly addressed. 6. Reporting Accountability: Staff responsible for reporting enrollment status changes will be required to submit monthly summaries of reporting activities to their supervisors. Supervisors will review these summaries to ensure adherence to the 60-day reporting deadline and address any delays proactively. Lane College is committed to rectifying this compliance issue swiftly and effectively. The College understands that maintaining accurate and timely reporting to NSLDS is essential to prevent inaccuracies in student loan records, avoid potential financial consequences, and uphold regulatory compliance. These measures demonstrate our dedication to robust compliance practices and continuous institutional improvement.

Federal Program: Student Financial Assistance (SFA) Cluster - Various ALN Compliance Requirement - Enrollment Reporting Management’s Response The UPR concurs with this finding. On February 26, 2025, we met with all deans for Academic Affairs and explained to them the importance of complying with federal requirements. Twenty-two exceptions were found in the FY2023 single audit report, and an exception was found in FY2024 single audit report. We recognize that we have improved, however, we are not satisfied with the results. We understand that we have not achieved 100% compliance, and our correction action plan remains in force. We will take additional actions such as: • Continue to guide professors on the importance of taking and reporting attendance timely. • One of the special assistants of the Vice Presidency for Academic Affairs will send a reminder to the registrars every month indicating how much time they have left to inform the NSLDS of the change in status on or before 60 days after the change occurred. • The next meeting of the University Board will be used to inform members (chancellors, faculty, and student representatives) so that they can take the message to their institutional units. The goal is to have 100% compliance. Responsible Person or Office: Executive Vice President for Academic Affairs and Research. Timeline: 2025-2026