Federal agency: U.S. Department of Treasury Pass-through entity: Oregon Department of Administrative Services Federal program: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Criteria: When a non-federal entity enters into a covered transaction with an entity at a lower tier, the non-federal entity must verify that the entity, as defined in 2 CFR section 180.995 and agency adopting regulations, is not suspended or debarred or otherwise excluded from participating in the transaction. This verification may be accomplished by (1) checking the System for Award Management (SAM) Exclusions maintained by the General Services Administration (GSA) and available at SAM.gov, (2) collecting a certification from the entity, or (3) adding a clause or condition to the covered transaction with that entity (2 CFR section 180.300). Per 2 CFR 200.303, a non-Federal entity must “establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Condition: The City did not verify that its vendors were not suspended or debarred or otherwise excluded from participating in a covered transaction. A material weakness in controls over compliance with procurement requirements was identified. Cause: The City did not appear to be aware of this compliance requirement. Effect or potential effect: Prior to entering into a covered transaction, the City did not verify that its vendors were not suspended or debarred or otherwise excluded from participating in the transaction. Questioned Costs: None noted. Context: Of a population of 3 contracts, 2 sampled contracts did not have documentation that the City verified the vendor was not suspended or debarred or otherwise excluded from participating in a covered transaction. Recommendation: The City should implement controls to ensure it verifies that its vendors are not suspended or debarred or otherwise excluded prior to entering into a covered transaction. Views of responsible officials: The City understands and concurs with the finding and recommendation.
FINDING 2024-001 Subject: COVID-19 - Education Stabilization Fund - Reporting Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Number: 84.425 Federal Award Numbers and Years (or Other Identifying Numbers): S424U200013, S425D200013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Finding: Material Weakness Repeat Finding This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-003. Condition and Context An effective internal control system was not designed, nor implemented, at the School Corporation to ensure compliance with requirements related to the grant agreement and the Reporting compliance requirement. The School Corporation had not designed, nor implemented, a system of internal controls to ensure the annual Elementary and Secondary School Emergency Relief (ESSER) annual Data Collection reports (Reports) were complete and accurately submitted. The School Corporation Reports were reviewed by the Assistant Deputy Treasurer and submitted by the Chief Financial Officer; however, there was no documentation provided to verify that the oversight or review process to prevent, or detect and correct, errors was performed during the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause There was no documentation that a system of internal controls had been designed and implemented by management of the School Corporation to ensure compliance with the federal award and the Reporting compliance requirement. INDIANA STATE BOARD OF ACCOUNTS 16 FRANKLIN COMMUNITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect Without an effective system of internal controls noncompliance with the federal award and the Reporting compliance requirement could have occurred. Users of the Report rely upon its accuracy to make appropriate decisions. Noncompliance with the conditions of the federal award could result in the loss of federal funding to the School Corporation. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a system of internal controls related to the federal award and the Reporting compliance requirement which includes documentation of the operation of the internal controls. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.
FINDING 2024-001 Subject: COVID-19 - Education Stabilization Fund - Reporting Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Number: 84.425 Federal Award Numbers and Years (or Other Identifying Numbers): S424U200013, S425D200013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Finding: Material Weakness Repeat Finding This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-003. Condition and Context An effective internal control system was not designed, nor implemented, at the School Corporation to ensure compliance with requirements related to the grant agreement and the Reporting compliance requirement. The School Corporation had not designed, nor implemented, a system of internal controls to ensure the annual Elementary and Secondary School Emergency Relief (ESSER) annual Data Collection reports (Reports) were complete and accurately submitted. The School Corporation Reports were reviewed by the Assistant Deputy Treasurer and submitted by the Chief Financial Officer; however, there was no documentation provided to verify that the oversight or review process to prevent, or detect and correct, errors was performed during the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause There was no documentation that a system of internal controls had been designed and implemented by management of the School Corporation to ensure compliance with the federal award and the Reporting compliance requirement. INDIANA STATE BOARD OF ACCOUNTS 16 FRANKLIN COMMUNITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect Without an effective system of internal controls noncompliance with the federal award and the Reporting compliance requirement could have occurred. Users of the Report rely upon its accuracy to make appropriate decisions. Noncompliance with the conditions of the federal award could result in the loss of federal funding to the School Corporation. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a system of internal controls related to the federal award and the Reporting compliance requirement which includes documentation of the operation of the internal controls. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.
FINDING 2024-002 Subject: COVID-19 - Education Stabilization Fund - Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Number: 84.425 Federal Award Number and Year (or Other Identifying Number): S424U200013 Pass-Through Entity: Indiana Department of Education Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles Audit Finding: Significant Deficiency Condition and Context An effective internal control system was not designed at the School Corporation to ensure compliance with requirements related to the grant agreement and the Activities Allowed or Unallowed and Allowable Costs/Cost Principles compliance requirements. The School Corporation had designed a system of internal controls to ensure payroll expenditures charged to the grant fund were allowable. However, 2 of the 44 expenditures tested did not have documentation that the internal control had been applied and operated effectively. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 17 FRANKLIN COMMUNITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause An effective system of internal controls had not been designed by management of the School Corporation to ensure compliance with the federal award and the Activities Allowed or Unallowed and Allowable Costs/Cost Principles compliance requirements. An internal control had been designed but was not applied consistently to all payroll transactions. Effect Without an effective system of internal controls, noncompliance with the federal award and the Activities Allowed or Unallowed and Allowable Costs/Cost Principles compliance requirements could have occurred. Noncompliance with the conditions of the federal award could result in the loss of federal funding to the School Corporation. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a system of internal controls related to the federal award and the Activities Allowed or Unallowed and Allowable Costs/Cost Principles compliance requirements and apply the controls consistently to all transactions. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.
FINDING 2024-001 Subject: COVID-19 - Education Stabilization Fund - Reporting Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Number: 84.425 Federal Award Numbers and Years (or Other Identifying Numbers): S424U200013, S425D200013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Finding: Material Weakness Repeat Finding This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-003. Condition and Context An effective internal control system was not designed, nor implemented, at the School Corporation to ensure compliance with requirements related to the grant agreement and the Reporting compliance requirement. The School Corporation had not designed, nor implemented, a system of internal controls to ensure the annual Elementary and Secondary School Emergency Relief (ESSER) annual Data Collection reports (Reports) were complete and accurately submitted. The School Corporation Reports were reviewed by the Assistant Deputy Treasurer and submitted by the Chief Financial Officer; however, there was no documentation provided to verify that the oversight or review process to prevent, or detect and correct, errors was performed during the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause There was no documentation that a system of internal controls had been designed and implemented by management of the School Corporation to ensure compliance with the federal award and the Reporting compliance requirement. INDIANA STATE BOARD OF ACCOUNTS 16 FRANKLIN COMMUNITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect Without an effective system of internal controls noncompliance with the federal award and the Reporting compliance requirement could have occurred. Users of the Report rely upon its accuracy to make appropriate decisions. Noncompliance with the conditions of the federal award could result in the loss of federal funding to the School Corporation. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a system of internal controls related to the federal award and the Reporting compliance requirement which includes documentation of the operation of the internal controls. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.
FINDING 2024-001 Subject: COVID-19 - Education Stabilization Fund - Reporting Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Number: 84.425 Federal Award Numbers and Years (or Other Identifying Numbers): S424U200013, S425D200013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Finding: Material Weakness Repeat Finding This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-003. Condition and Context An effective internal control system was not designed, nor implemented, at the School Corporation to ensure compliance with requirements related to the grant agreement and the Reporting compliance requirement. The School Corporation had not designed, nor implemented, a system of internal controls to ensure the annual Elementary and Secondary School Emergency Relief (ESSER) annual Data Collection reports (Reports) were complete and accurately submitted. The School Corporation Reports were reviewed by the Assistant Deputy Treasurer and submitted by the Chief Financial Officer; however, there was no documentation provided to verify that the oversight or review process to prevent, or detect and correct, errors was performed during the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause There was no documentation that a system of internal controls had been designed and implemented by management of the School Corporation to ensure compliance with the federal award and the Reporting compliance requirement. INDIANA STATE BOARD OF ACCOUNTS 16 FRANKLIN COMMUNITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect Without an effective system of internal controls noncompliance with the federal award and the Reporting compliance requirement could have occurred. Users of the Report rely upon its accuracy to make appropriate decisions. Noncompliance with the conditions of the federal award could result in the loss of federal funding to the School Corporation. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a system of internal controls related to the federal award and the Reporting compliance requirement which includes documentation of the operation of the internal controls. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.
FINDING 2024-001 Subject: COVID-19 - Education Stabilization Fund - Reporting Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Number: 84.425 Federal Award Numbers and Years (or Other Identifying Numbers): S424U200013, S425D200013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Finding: Material Weakness Repeat Finding This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-003. Condition and Context An effective internal control system was not designed, nor implemented, at the School Corporation to ensure compliance with requirements related to the grant agreement and the Reporting compliance requirement. The School Corporation had not designed, nor implemented, a system of internal controls to ensure the annual Elementary and Secondary School Emergency Relief (ESSER) annual Data Collection reports (Reports) were complete and accurately submitted. The School Corporation Reports were reviewed by the Assistant Deputy Treasurer and submitted by the Chief Financial Officer; however, there was no documentation provided to verify that the oversight or review process to prevent, or detect and correct, errors was performed during the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause There was no documentation that a system of internal controls had been designed and implemented by management of the School Corporation to ensure compliance with the federal award and the Reporting compliance requirement. INDIANA STATE BOARD OF ACCOUNTS 16 FRANKLIN COMMUNITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect Without an effective system of internal controls noncompliance with the federal award and the Reporting compliance requirement could have occurred. Users of the Report rely upon its accuracy to make appropriate decisions. Noncompliance with the conditions of the federal award could result in the loss of federal funding to the School Corporation. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a system of internal controls related to the federal award and the Reporting compliance requirement which includes documentation of the operation of the internal controls. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.
FINDING 2024-001 Subject: COVID-19 - Education Stabilization Fund - Reporting Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Number: 84.425 Federal Award Numbers and Years (or Other Identifying Numbers): S424U200013, S425D200013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Finding: Material Weakness Repeat Finding This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-003. Condition and Context An effective internal control system was not designed, nor implemented, at the School Corporation to ensure compliance with requirements related to the grant agreement and the Reporting compliance requirement. The School Corporation had not designed, nor implemented, a system of internal controls to ensure the annual Elementary and Secondary School Emergency Relief (ESSER) annual Data Collection reports (Reports) were complete and accurately submitted. The School Corporation Reports were reviewed by the Assistant Deputy Treasurer and submitted by the Chief Financial Officer; however, there was no documentation provided to verify that the oversight or review process to prevent, or detect and correct, errors was performed during the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause There was no documentation that a system of internal controls had been designed and implemented by management of the School Corporation to ensure compliance with the federal award and the Reporting compliance requirement. INDIANA STATE BOARD OF ACCOUNTS 16 FRANKLIN COMMUNITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect Without an effective system of internal controls noncompliance with the federal award and the Reporting compliance requirement could have occurred. Users of the Report rely upon its accuracy to make appropriate decisions. Noncompliance with the conditions of the federal award could result in the loss of federal funding to the School Corporation. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a system of internal controls related to the federal award and the Reporting compliance requirement which includes documentation of the operation of the internal controls. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.
FINDING 2024-002 Subject: COVID-19 - Education Stabilization Fund - Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Number: 84.425 Federal Award Number and Year (or Other Identifying Number): S424U200013 Pass-Through Entity: Indiana Department of Education Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles Audit Finding: Significant Deficiency Condition and Context An effective internal control system was not designed at the School Corporation to ensure compliance with requirements related to the grant agreement and the Activities Allowed or Unallowed and Allowable Costs/Cost Principles compliance requirements. The School Corporation had designed a system of internal controls to ensure payroll expenditures charged to the grant fund were allowable. However, 2 of the 44 expenditures tested did not have documentation that the internal control had been applied and operated effectively. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 17 FRANKLIN COMMUNITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause An effective system of internal controls had not been designed by management of the School Corporation to ensure compliance with the federal award and the Activities Allowed or Unallowed and Allowable Costs/Cost Principles compliance requirements. An internal control had been designed but was not applied consistently to all payroll transactions. Effect Without an effective system of internal controls, noncompliance with the federal award and the Activities Allowed or Unallowed and Allowable Costs/Cost Principles compliance requirements could have occurred. Noncompliance with the conditions of the federal award could result in the loss of federal funding to the School Corporation. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a system of internal controls related to the federal award and the Activities Allowed or Unallowed and Allowable Costs/Cost Principles compliance requirements and apply the controls consistently to all transactions. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.
FINDING 2024-001 Subject: COVID-19 - Education Stabilization Fund - Reporting Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Number: 84.425 Federal Award Numbers and Years (or Other Identifying Numbers): S424U200013, S425D200013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Finding: Material Weakness Repeat Finding This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-003. Condition and Context An effective internal control system was not designed, nor implemented, at the School Corporation to ensure compliance with requirements related to the grant agreement and the Reporting compliance requirement. The School Corporation had not designed, nor implemented, a system of internal controls to ensure the annual Elementary and Secondary School Emergency Relief (ESSER) annual Data Collection reports (Reports) were complete and accurately submitted. The School Corporation Reports were reviewed by the Assistant Deputy Treasurer and submitted by the Chief Financial Officer; however, there was no documentation provided to verify that the oversight or review process to prevent, or detect and correct, errors was performed during the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause There was no documentation that a system of internal controls had been designed and implemented by management of the School Corporation to ensure compliance with the federal award and the Reporting compliance requirement. INDIANA STATE BOARD OF ACCOUNTS 16 FRANKLIN COMMUNITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect Without an effective system of internal controls noncompliance with the federal award and the Reporting compliance requirement could have occurred. Users of the Report rely upon its accuracy to make appropriate decisions. Noncompliance with the conditions of the federal award could result in the loss of federal funding to the School Corporation. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a system of internal controls related to the federal award and the Reporting compliance requirement which includes documentation of the operation of the internal controls. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.
FINDING 2024-001 Subject: COVID-19 - Education Stabilization Fund - Reporting Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Number: 84.425 Federal Award Numbers and Years (or Other Identifying Numbers): S424U200013, S425D200013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Finding: Material Weakness Repeat Finding This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-003. Condition and Context An effective internal control system was not designed, nor implemented, at the School Corporation to ensure compliance with requirements related to the grant agreement and the Reporting compliance requirement. The School Corporation had not designed, nor implemented, a system of internal controls to ensure the annual Elementary and Secondary School Emergency Relief (ESSER) annual Data Collection reports (Reports) were complete and accurately submitted. The School Corporation Reports were reviewed by the Assistant Deputy Treasurer and submitted by the Chief Financial Officer; however, there was no documentation provided to verify that the oversight or review process to prevent, or detect and correct, errors was performed during the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause There was no documentation that a system of internal controls had been designed and implemented by management of the School Corporation to ensure compliance with the federal award and the Reporting compliance requirement. INDIANA STATE BOARD OF ACCOUNTS 16 FRANKLIN COMMUNITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect Without an effective system of internal controls noncompliance with the federal award and the Reporting compliance requirement could have occurred. Users of the Report rely upon its accuracy to make appropriate decisions. Noncompliance with the conditions of the federal award could result in the loss of federal funding to the School Corporation. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a system of internal controls related to the federal award and the Reporting compliance requirement which includes documentation of the operation of the internal controls. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.
Finding Number: 2024‐001 Repeat Finding: No Program Name/Assistance Listing Title: Education Stabilization Fund Assistance Listing Number: 84.425 Federal Agency: U.S. Department of Education Federal Award Number: S425U210038 Pass‐Through Agency: Arizona Department of Education Questioned Costs: N/A Type of Finding: Noncompliance, Significant Deficiency Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles Criteria In accordance with 2 CFR Part 200.303, the District is responsible for the establishing and maintaining effective internal control over the Federal award that provides reasonable assurance that the non‐ Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition The District’s internal approval queue in the ERP system to ensure expenditures are allowable under a federal grant was not always followed. Cause Proper approval protocols over a purchase were not adhered to during the requisition process. A District employee expedited quick approval without following standard procedures, bypassing the approver who reviews allowable costs related to federal programs. Effect A $28,570 expenditure was not reviewed or approved by an appropriate person familiar with the ESSER grant for allowability and reasonability prior to purchase. The expenditure was ultimately determined to be allowable under the federal grant. Context For one of 50 disbursements reviewed, the purchase order was not approved by the appropriate authorized District personnel prior to issuance. The sample was not intended to be, and was not a statistically valid sample. Recommendation The District should review the expenditure approval queue and ensure it is followed for all federal purchases. Additional training should be provided to ensure employees follow established procedures. The District should also consider eliminating expedited approval processes to ensure all purchases are reviewed prior to purchase. Views of Responsible Officials See Corrective Action Plan.
FINDING 2024-001 Subject: Student Financial Assistance Cluster - Special Tests and Provisions - Verification Federal Agency: U.S. Department of Education Federal Programs: Federal Supplemental Educational Opportunity Grants, Federal Work-Study Program, Federal Pell Grant Program, Federal Direct Student Loans Assistance Listings Numbers: 84.007, 84.033, 84.063, 84.268 Federal Award Number and Year (or Other Identifying Number): FY2024 Compliance Requirement: Special Tests and Provisions - Verification Audit Finding: Material Weakness Condition and Context As a recipient of the Title IV funding from the Federal Supplemental Educational Opportunity Grants (SEOG), Federal Work-Study Program (FWS), Federal Pell Grant Program (Pell), and Federal Direct Student Loans program (direct loan), the University was responsible for designing and implementing effective internal controls. The University had developed a system of internal controls over these federal programs that included policies and procedures related to the Special Tests and Provisions - Verification compliance requirement. The University had designed a key internal control that one employee would perform the required verifications, and a second employee would then review a sample of those verifications. However, the internal control was not properly implemented or operating effectively as the University had not established proper segregation of duties. The same employee responsible for performing the verifications was also responsible for reviewing those verifications during the audit period without an independent oversight, review, or approval process involving a second employee. The lack of effective internal controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Embedded within a properly designed and implemented internal control system should be internal controls consisting of policies and procedures. Policies reflect the University's management statements of what should be done to effect internal controls, and procedures should consist of actions that would implement these policies. The system of internal controls, as designed by the University's management, was not properly implemented due to a staffing shortage in the Office of Student Financial Assistance. As a result, the same employee performed and reviewed the required verifications. INDIANA STATE BOARD OF ACCOUNTS 16 UNIVERSITY OF SOUTHERN INDIANA SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect Without the proper implementation of an effectively designed system of internal controls, the internal control system cannot be capable of effectively preventing, or detecting and correcting, material noncompliance. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the University's management properly implement the system of internal controls as designed to ensure compliance with the Special Tests and Provisions - Verification compliance requirement. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.
FINDING 2024-001 Subject: Student Financial Assistance Cluster - Special Tests and Provisions - Verification Federal Agency: U.S. Department of Education Federal Programs: Federal Supplemental Educational Opportunity Grants, Federal Work-Study Program, Federal Pell Grant Program, Federal Direct Student Loans Assistance Listings Numbers: 84.007, 84.033, 84.063, 84.268 Federal Award Number and Year (or Other Identifying Number): FY2024 Compliance Requirement: Special Tests and Provisions - Verification Audit Finding: Material Weakness Condition and Context As a recipient of the Title IV funding from the Federal Supplemental Educational Opportunity Grants (SEOG), Federal Work-Study Program (FWS), Federal Pell Grant Program (Pell), and Federal Direct Student Loans program (direct loan), the University was responsible for designing and implementing effective internal controls. The University had developed a system of internal controls over these federal programs that included policies and procedures related to the Special Tests and Provisions - Verification compliance requirement. The University had designed a key internal control that one employee would perform the required verifications, and a second employee would then review a sample of those verifications. However, the internal control was not properly implemented or operating effectively as the University had not established proper segregation of duties. The same employee responsible for performing the verifications was also responsible for reviewing those verifications during the audit period without an independent oversight, review, or approval process involving a second employee. The lack of effective internal controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Embedded within a properly designed and implemented internal control system should be internal controls consisting of policies and procedures. Policies reflect the University's management statements of what should be done to effect internal controls, and procedures should consist of actions that would implement these policies. The system of internal controls, as designed by the University's management, was not properly implemented due to a staffing shortage in the Office of Student Financial Assistance. As a result, the same employee performed and reviewed the required verifications. INDIANA STATE BOARD OF ACCOUNTS 16 UNIVERSITY OF SOUTHERN INDIANA SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect Without the proper implementation of an effectively designed system of internal controls, the internal control system cannot be capable of effectively preventing, or detecting and correcting, material noncompliance. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the University's management properly implement the system of internal controls as designed to ensure compliance with the Special Tests and Provisions - Verification compliance requirement. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.
FINDING 2024-001 Subject: Student Financial Assistance Cluster - Special Tests and Provisions - Verification Federal Agency: U.S. Department of Education Federal Programs: Federal Supplemental Educational Opportunity Grants, Federal Work-Study Program, Federal Pell Grant Program, Federal Direct Student Loans Assistance Listings Numbers: 84.007, 84.033, 84.063, 84.268 Federal Award Number and Year (or Other Identifying Number): FY2024 Compliance Requirement: Special Tests and Provisions - Verification Audit Finding: Material Weakness Condition and Context As a recipient of the Title IV funding from the Federal Supplemental Educational Opportunity Grants (SEOG), Federal Work-Study Program (FWS), Federal Pell Grant Program (Pell), and Federal Direct Student Loans program (direct loan), the University was responsible for designing and implementing effective internal controls. The University had developed a system of internal controls over these federal programs that included policies and procedures related to the Special Tests and Provisions - Verification compliance requirement. The University had designed a key internal control that one employee would perform the required verifications, and a second employee would then review a sample of those verifications. However, the internal control was not properly implemented or operating effectively as the University had not established proper segregation of duties. The same employee responsible for performing the verifications was also responsible for reviewing those verifications during the audit period without an independent oversight, review, or approval process involving a second employee. The lack of effective internal controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Embedded within a properly designed and implemented internal control system should be internal controls consisting of policies and procedures. Policies reflect the University's management statements of what should be done to effect internal controls, and procedures should consist of actions that would implement these policies. The system of internal controls, as designed by the University's management, was not properly implemented due to a staffing shortage in the Office of Student Financial Assistance. As a result, the same employee performed and reviewed the required verifications. INDIANA STATE BOARD OF ACCOUNTS 16 UNIVERSITY OF SOUTHERN INDIANA SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect Without the proper implementation of an effectively designed system of internal controls, the internal control system cannot be capable of effectively preventing, or detecting and correcting, material noncompliance. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the University's management properly implement the system of internal controls as designed to ensure compliance with the Special Tests and Provisions - Verification compliance requirement. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.
FINDING 2024-001 Subject: Student Financial Assistance Cluster - Special Tests and Provisions - Verification Federal Agency: U.S. Department of Education Federal Programs: Federal Supplemental Educational Opportunity Grants, Federal Work-Study Program, Federal Pell Grant Program, Federal Direct Student Loans Assistance Listings Numbers: 84.007, 84.033, 84.063, 84.268 Federal Award Number and Year (or Other Identifying Number): FY2024 Compliance Requirement: Special Tests and Provisions - Verification Audit Finding: Material Weakness Condition and Context As a recipient of the Title IV funding from the Federal Supplemental Educational Opportunity Grants (SEOG), Federal Work-Study Program (FWS), Federal Pell Grant Program (Pell), and Federal Direct Student Loans program (direct loan), the University was responsible for designing and implementing effective internal controls. The University had developed a system of internal controls over these federal programs that included policies and procedures related to the Special Tests and Provisions - Verification compliance requirement. The University had designed a key internal control that one employee would perform the required verifications, and a second employee would then review a sample of those verifications. However, the internal control was not properly implemented or operating effectively as the University had not established proper segregation of duties. The same employee responsible for performing the verifications was also responsible for reviewing those verifications during the audit period without an independent oversight, review, or approval process involving a second employee. The lack of effective internal controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Embedded within a properly designed and implemented internal control system should be internal controls consisting of policies and procedures. Policies reflect the University's management statements of what should be done to effect internal controls, and procedures should consist of actions that would implement these policies. The system of internal controls, as designed by the University's management, was not properly implemented due to a staffing shortage in the Office of Student Financial Assistance. As a result, the same employee performed and reviewed the required verifications. INDIANA STATE BOARD OF ACCOUNTS 16 UNIVERSITY OF SOUTHERN INDIANA SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect Without the proper implementation of an effectively designed system of internal controls, the internal control system cannot be capable of effectively preventing, or detecting and correcting, material noncompliance. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the University's management properly implement the system of internal controls as designed to ensure compliance with the Special Tests and Provisions - Verification compliance requirement. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.
FINDING 2024-002 Subject: PPHF Geriatric Education Centers - Subrecipient Monitoring Federal Agency: U.S. Department of Health and Human Services Federal Program: PPHF Geriatric Education Centers Assistance Listings Number: 93.969 Federal Award Number and Year (or Other Identifying Number): FY2024 Compliance Requirement: Subrecipient Monitoring Audit Findings: Material Weakness, Other Matters Condition and Context The University expended $831,232 in PPHF Geriatric Education Centers funds during the audit period. Of that amount, $309,264 was passed through to three subrecipients. As a pass-through entity, the University was required to identify the award and applicable requirements and monitor the subrecipient. Procedures to monitor its subrecipients included the following: Reviewing financial and programmatic reports as required by the University. Following up and ensuring the subrecipient takes timely and appropriate actions on all deficiencies pertaining to the federal award provided to the subrecipient detected through audits, on-site reviews, and other means. Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient. INDIANA STATE BOARD OF ACCOUNTS 17 UNIVERSITY OF SOUTHERN INDIANA SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Two of the three subrecipients expended more than $750,000 in federal awards in fiscal year 2023, thus subjecting each to a Single Audit as required by the Uniform Guidance. As such, both subrecipients were required to submit a Single Audit report to the Federal Audit Clearinghouse (FAC) by March 31, 2024. The University should have expected that the two subrecipients would receive a Single Audit report as both subrecipients were subject to a Single Audit for multiple years leading up to 2023. However, the University did not obtain a copy of either subrecipient's 2023 Single Audit report. Obtaining and reviewing Single Audit reports of subrecipients is a required component of conducting proper monitoring of subrecipients. The lack of proper monitoring would not have allowed the University to follow up and ensure that the subrecipients took timely and appropriate action on all deficiencies pertaining to the federal awards passed through to the subrecipients from the University. In addition, it would not have allowed for the University to issue a management decision for audit findings pertaining to the federal award provided to the subrecipient within six months of acceptance by the FAC. The lack of effective internal controls was a systemic issue throughout the audit period. The noncompliance was isolated to two of the University's three subrecipients during the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.332 states in part: "All pass-through entities must: . . . (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: . . . (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521. . . ." INDIANA STATE BOARD OF ACCOUNTS 18 UNIVERSITY OF SOUTHERN INDIANA SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) 2 CFR 200.521(d) states in part: ". . . The federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. . . ." Cause Embedded within a properly designed and implemented internal control system should be internal controls consisting of policies and procedures. Policies reflect the University's management statements of what should be done to effect internal controls, and procedures should consist of actions that would implement these policies. The University's management had not designed or implemented a system of internal controls to ensure that subrecipient audit reports were received and reviewed. Effect Without the proper implementation of an effectively designed system of internal controls, the internal control system cannot be capable of effectively preventing, or detecting and correcting, material noncompliance. As a result, subrecipients to whom payments were made were not adequately monitored. The failure to establish a sufficient system of internal controls allowed noncompliance with the grant agreements and the Subrecipient Monitoring compliance requirement. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the University's management establish a system of internal controls to ensure that subrecipient audit reports are received and reviewed, when required, to ensure that subrecipients are properly monitored in accordance with the federal regulations. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.
Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not maintained in written form. Questioned Costs: None Context: The College’s written information security program did not cover the following requirements as of the required deadline in June 2024: - Assess apps developed by the institution - Implement multi-factor authentication for anyone accessing customer information on the institution’s system - Dispose of customer information securely - Anticipate and evaluate changes to the information system or network. - Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. - Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). - Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). - Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Cause: These deficiencies were primarily due to insufficient resources and oversight dedicated to the development and maintenance of the written information security program. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.
2024 – 004: Fiscal Operations Report and Application to Participate (FISAP) Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The documents retained by the University to support amounts included in the FISAP did not agree to the FISAP. Questioned Costs: None Context: The enrollment count reported in the FISAP did not agree to supporting documentation. Cause: These errors are a result of issues with the student information system. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and verification processes to ensure the accuracy of data reported in the FISAP. This may include creating a formalized review process for the FISAP and ensuring all supporting schedules used to populate the form are centrally stored. Views of responsible officials: There is no disagreement with the audit finding.
2024 – 005: Population for Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The College was unable to provide the required population for the students that withdrew during the fiscal year in a timely manner. Questioned Costs: None Context: The College does not have a process in place to identify students who have withdrawn and received Title IV funds. Cause: Currently, the collection of this information is a very manual process that caused the delay. Effect: The College’s single audit may be delayed. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and improves coordination among departments to ensure timely submission of required data for the Return of Funds. This may include implementing a more robust tracking system, providing additional training to staff, and establishing clear deadlines and responsibilities for data submission. Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not maintained in written form. Questioned Costs: None Context: The College’s written information security program did not cover the following requirements as of the required deadline in June 2024: - Assess apps developed by the institution - Implement multi-factor authentication for anyone accessing customer information on the institution’s system - Dispose of customer information securely - Anticipate and evaluate changes to the information system or network. - Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. - Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). - Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). - Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Cause: These deficiencies were primarily due to insufficient resources and oversight dedicated to the development and maintenance of the written information security program. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.
2024 – 004: Fiscal Operations Report and Application to Participate (FISAP) Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The documents retained by the University to support amounts included in the FISAP did not agree to the FISAP. Questioned Costs: None Context: The enrollment count reported in the FISAP did not agree to supporting documentation. Cause: These errors are a result of issues with the student information system. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and verification processes to ensure the accuracy of data reported in the FISAP. This may include creating a formalized review process for the FISAP and ensuring all supporting schedules used to populate the form are centrally stored. Views of responsible officials: There is no disagreement with the audit finding.
2024 – 005: Population for Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The College was unable to provide the required population for the students that withdrew during the fiscal year in a timely manner. Questioned Costs: None Context: The College does not have a process in place to identify students who have withdrawn and received Title IV funds. Cause: Currently, the collection of this information is a very manual process that caused the delay. Effect: The College’s single audit may be delayed. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and improves coordination among departments to ensure timely submission of required data for the Return of Funds. This may include implementing a more robust tracking system, providing additional training to staff, and establishing clear deadlines and responsibilities for data submission. Views of responsible officials: There is no disagreement with the audit finding.
2024 – 002: Special Tests and Provisions – NSLDS Enrollment & Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Code of Federal Regulations, 34 CFR 685.309(b), states that: Institutions must have some arrangement to report student enrollment data to NSLDS through an enrollment roster file. The institution is required to report changes in the enrollment status, the effective date of the status, and an anticipated completion date. Also, the Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Condition: During testing of the enrollment status reporting, we noted that the incorrect enrollment status and effective date was reported in NSLDS. Questioned Costs: None Context: • The enrollment status was incorrectly reported for 6 out of 40 students. • The enrollment effective date was incorrectly reported for 4 out of 40 students. Cause: These errors are a result of issues with the student information system. Effect: Student enrollment status was not reported accurately and/or timely to NSLDS. Repeat Finding: No Recommendation: The institution should evaluate their procedures and policies related to reporting status changes and effective dates to NSLDS and enhance as deemed necessary to ensure that accurate information is reported to NSLDS. Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not maintained in written form. Questioned Costs: None Context: The College’s written information security program did not cover the following requirements as of the required deadline in June 2024: - Assess apps developed by the institution - Implement multi-factor authentication for anyone accessing customer information on the institution’s system - Dispose of customer information securely - Anticipate and evaluate changes to the information system or network. - Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. - Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). - Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). - Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Cause: These deficiencies were primarily due to insufficient resources and oversight dedicated to the development and maintenance of the written information security program. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.
2024 – 004: Fiscal Operations Report and Application to Participate (FISAP) Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The documents retained by the University to support amounts included in the FISAP did not agree to the FISAP. Questioned Costs: None Context: The enrollment count reported in the FISAP did not agree to supporting documentation. Cause: These errors are a result of issues with the student information system. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and verification processes to ensure the accuracy of data reported in the FISAP. This may include creating a formalized review process for the FISAP and ensuring all supporting schedules used to populate the form are centrally stored. Views of responsible officials: There is no disagreement with the audit finding.
2024 – 005: Population for Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The College was unable to provide the required population for the students that withdrew during the fiscal year in a timely manner. Questioned Costs: None Context: The College does not have a process in place to identify students who have withdrawn and received Title IV funds. Cause: Currently, the collection of this information is a very manual process that caused the delay. Effect: The College’s single audit may be delayed. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and improves coordination among departments to ensure timely submission of required data for the Return of Funds. This may include implementing a more robust tracking system, providing additional training to staff, and establishing clear deadlines and responsibilities for data submission. Views of responsible officials: There is no disagreement with the audit finding.
2024 – 002: Special Tests and Provisions – NSLDS Enrollment & Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Code of Federal Regulations, 34 CFR 685.309(b), states that: Institutions must have some arrangement to report student enrollment data to NSLDS through an enrollment roster file. The institution is required to report changes in the enrollment status, the effective date of the status, and an anticipated completion date. Also, the Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Condition: During testing of the enrollment status reporting, we noted that the incorrect enrollment status and effective date was reported in NSLDS. Questioned Costs: None Context: • The enrollment status was incorrectly reported for 6 out of 40 students. • The enrollment effective date was incorrectly reported for 4 out of 40 students. Cause: These errors are a result of issues with the student information system. Effect: Student enrollment status was not reported accurately and/or timely to NSLDS. Repeat Finding: No Recommendation: The institution should evaluate their procedures and policies related to reporting status changes and effective dates to NSLDS and enhance as deemed necessary to ensure that accurate information is reported to NSLDS. Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not maintained in written form. Questioned Costs: None Context: The College’s written information security program did not cover the following requirements as of the required deadline in June 2024: - Assess apps developed by the institution - Implement multi-factor authentication for anyone accessing customer information on the institution’s system - Dispose of customer information securely - Anticipate and evaluate changes to the information system or network. - Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. - Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). - Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). - Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Cause: These deficiencies were primarily due to insufficient resources and oversight dedicated to the development and maintenance of the written information security program. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.
2024 – 004: Fiscal Operations Report and Application to Participate (FISAP) Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The documents retained by the University to support amounts included in the FISAP did not agree to the FISAP. Questioned Costs: None Context: The enrollment count reported in the FISAP did not agree to supporting documentation. Cause: These errors are a result of issues with the student information system. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and verification processes to ensure the accuracy of data reported in the FISAP. This may include creating a formalized review process for the FISAP and ensuring all supporting schedules used to populate the form are centrally stored. Views of responsible officials: There is no disagreement with the audit finding.
2024 – 005: Population for Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The College was unable to provide the required population for the students that withdrew during the fiscal year in a timely manner. Questioned Costs: None Context: The College does not have a process in place to identify students who have withdrawn and received Title IV funds. Cause: Currently, the collection of this information is a very manual process that caused the delay. Effect: The College’s single audit may be delayed. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and improves coordination among departments to ensure timely submission of required data for the Return of Funds. This may include implementing a more robust tracking system, providing additional training to staff, and establishing clear deadlines and responsibilities for data submission. Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not maintained in written form. Questioned Costs: None Context: The College’s written information security program did not cover the following requirements as of the required deadline in June 2024: - Assess apps developed by the institution - Implement multi-factor authentication for anyone accessing customer information on the institution’s system - Dispose of customer information securely - Anticipate and evaluate changes to the information system or network. - Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. - Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). - Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). - Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Cause: These deficiencies were primarily due to insufficient resources and oversight dedicated to the development and maintenance of the written information security program. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.
2024 – 004: Fiscal Operations Report and Application to Participate (FISAP) Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The documents retained by the University to support amounts included in the FISAP did not agree to the FISAP. Questioned Costs: None Context: The enrollment count reported in the FISAP did not agree to supporting documentation. Cause: These errors are a result of issues with the student information system. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and verification processes to ensure the accuracy of data reported in the FISAP. This may include creating a formalized review process for the FISAP and ensuring all supporting schedules used to populate the form are centrally stored. Views of responsible officials: There is no disagreement with the audit finding.
2024 – 005: Population for Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The College was unable to provide the required population for the students that withdrew during the fiscal year in a timely manner. Questioned Costs: None Context: The College does not have a process in place to identify students who have withdrawn and received Title IV funds. Cause: Currently, the collection of this information is a very manual process that caused the delay. Effect: The College’s single audit may be delayed. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and improves coordination among departments to ensure timely submission of required data for the Return of Funds. This may include implementing a more robust tracking system, providing additional training to staff, and establishing clear deadlines and responsibilities for data submission. Views of responsible officials: There is no disagreement with the audit finding.
2024 – 002: Special Tests and Provisions – NSLDS Enrollment & Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Code of Federal Regulations, 34 CFR 685.309(b), states that: Institutions must have some arrangement to report student enrollment data to NSLDS through an enrollment roster file. The institution is required to report changes in the enrollment status, the effective date of the status, and an anticipated completion date. Also, the Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Condition: During testing of the enrollment status reporting, we noted that the incorrect enrollment status and effective date was reported in NSLDS. Questioned Costs: None Context: • The enrollment status was incorrectly reported for 6 out of 40 students. • The enrollment effective date was incorrectly reported for 4 out of 40 students. Cause: These errors are a result of issues with the student information system. Effect: Student enrollment status was not reported accurately and/or timely to NSLDS. Repeat Finding: No Recommendation: The institution should evaluate their procedures and policies related to reporting status changes and effective dates to NSLDS and enhance as deemed necessary to ensure that accurate information is reported to NSLDS. Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not maintained in written form. Questioned Costs: None Context: The College’s written information security program did not cover the following requirements as of the required deadline in June 2024: - Assess apps developed by the institution - Implement multi-factor authentication for anyone accessing customer information on the institution’s system - Dispose of customer information securely - Anticipate and evaluate changes to the information system or network. - Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. - Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). - Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). - Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Cause: These deficiencies were primarily due to insufficient resources and oversight dedicated to the development and maintenance of the written information security program. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.
2024 – 004: Fiscal Operations Report and Application to Participate (FISAP) Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The documents retained by the University to support amounts included in the FISAP did not agree to the FISAP. Questioned Costs: None Context: The enrollment count reported in the FISAP did not agree to supporting documentation. Cause: These errors are a result of issues with the student information system. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and verification processes to ensure the accuracy of data reported in the FISAP. This may include creating a formalized review process for the FISAP and ensuring all supporting schedules used to populate the form are centrally stored. Views of responsible officials: There is no disagreement with the audit finding.
2024 – 005: Population for Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The College was unable to provide the required population for the students that withdrew during the fiscal year in a timely manner. Questioned Costs: None Context: The College does not have a process in place to identify students who have withdrawn and received Title IV funds. Cause: Currently, the collection of this information is a very manual process that caused the delay. Effect: The College’s single audit may be delayed. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and improves coordination among departments to ensure timely submission of required data for the Return of Funds. This may include implementing a more robust tracking system, providing additional training to staff, and establishing clear deadlines and responsibilities for data submission. Views of responsible officials: There is no disagreement with the audit finding.
2024 – 002: Special Tests and Provisions – NSLDS Enrollment & Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Code of Federal Regulations, 34 CFR 685.309(b), states that: Institutions must have some arrangement to report student enrollment data to NSLDS through an enrollment roster file. The institution is required to report changes in the enrollment status, the effective date of the status, and an anticipated completion date. Also, the Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Condition: During testing of the enrollment status reporting, we noted that the incorrect enrollment status and effective date was reported in NSLDS. Questioned Costs: None Context: • The enrollment status was incorrectly reported for 6 out of 40 students. • The enrollment effective date was incorrectly reported for 4 out of 40 students. Cause: These errors are a result of issues with the student information system. Effect: Student enrollment status was not reported accurately and/or timely to NSLDS. Repeat Finding: No Recommendation: The institution should evaluate their procedures and policies related to reporting status changes and effective dates to NSLDS and enhance as deemed necessary to ensure that accurate information is reported to NSLDS. Views of responsible officials: There is no disagreement with the audit finding.
Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not maintained in written form. Questioned Costs: None Context: The College’s written information security program did not cover the following requirements as of the required deadline in June 2024: - Assess apps developed by the institution - Implement multi-factor authentication for anyone accessing customer information on the institution’s system - Dispose of customer information securely - Anticipate and evaluate changes to the information system or network. - Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. - Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). - Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). - Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Cause: These deficiencies were primarily due to insufficient resources and oversight dedicated to the development and maintenance of the written information security program. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.
2024 – 004: Fiscal Operations Report and Application to Participate (FISAP) Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The documents retained by the University to support amounts included in the FISAP did not agree to the FISAP. Questioned Costs: None Context: The enrollment count reported in the FISAP did not agree to supporting documentation. Cause: These errors are a result of issues with the student information system. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and verification processes to ensure the accuracy of data reported in the FISAP. This may include creating a formalized review process for the FISAP and ensuring all supporting schedules used to populate the form are centrally stored. Views of responsible officials: There is no disagreement with the audit finding.
2024 – 005: Population for Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The College was unable to provide the required population for the students that withdrew during the fiscal year in a timely manner. Questioned Costs: None Context: The College does not have a process in place to identify students who have withdrawn and received Title IV funds. Cause: Currently, the collection of this information is a very manual process that caused the delay. Effect: The College’s single audit may be delayed. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and improves coordination among departments to ensure timely submission of required data for the Return of Funds. This may include implementing a more robust tracking system, providing additional training to staff, and establishing clear deadlines and responsibilities for data submission. Views of responsible officials: There is no disagreement with the audit finding.
Reference Number: 2024-001 Federal Agency: U.S. Department of Treasury Federal Program Name: Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Compliance Requirement: Activities Allowed or Unallowed Award Period: Fiscal Year 2024 Award Number: Unknown Type of Finding: Material Weakness in Internal Control Over Compliance Criteria or Specific Requirement: Internal Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control- Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition/Context: During their disbursement review and approval process, the County did not verify reimbursement requests excluded unallowable costs. Questioned Costs: $0 Cause: The County’s procedures and controls were not sufficient to prevent payment for unallowable costs. Effect: Federal funds may have been used for purposes that are not in accordance with the terms of the grant agreement. Repeat Finding: No Recommendation: We recommend all reimbursements and payments be reviewed in detail to ensure no payments are funding unallowable costs. Views of Responsible Officials: Management agrees with the finding. See attached corrective action plan.
Reference Number: 2024-002 Federal Agency: U.S. Department of Treasury Federal Program Name: Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 21.027 Compliance Requirement: Procurement & Suspension & Debarment Award Period: Fiscal Year 2024 Award Number: Unknown Type of Finding: Material Weakness in Internal Control Over Compliance, Material Noncompliance Criteria or Specific Requirement: Internal Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should align with the guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control- Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance: Non-Federal entities other than states, must follow the procurement standards set out at 2 CFR sections 200.318 through 200.327. Condition/Context: When awarding contracts the County did not follow procurement policies in place at the County or outlined in the Uniform Guidance. Questioned Costs: Undetermined Cause: The County’s procedures and controls were not sufficient during the procurement process for awarding contracts. Effect: Two contracts exceeding the simplified acquisition threshold were not bid out to provide full and open competition. Repeat Finding: No Recommendation: We recommend the County follow procurement policies in place at the County or outlined in the Uniform Guidance. Views of Responsible Officials: Management agrees with the finding. See attached corrective action plan.
Information on the federal program: Subject: Education Stabilization Fund – Special Tests and Provisions - Wage Rate Requirements Federal Agency: Department of Education Federal Program: COVID-19 - Eucation Stabilization Fund Assistance Listing Number: 84.425D, 84.425U Federal Award Numbers and Years (or Other Identifying Numbers): S425D210013, S425U210013 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Special Tests and Provisions - Wage Rate Requirements Audit Findings: Material Weakness, Material Noncompliance, Qualified Opinion Criteria: 2 CFR section 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 29 CFR 5.5 states in part: (1) Minimum wages. (i) All laborers and mechanics employed or working upon the site of the work (or under the United States Housing Act of 1937 or under the Housing Act of 1949 in the construction or development of the project), will be paid unconditionally and not less often than once a week, and without subsequent deduction or rebate on any account (except such payroll deductions as are permitted by regulations issued by the Secretary of Labor under the Copeland Act (29 CFR part 3)), the full amount of wages and bona fide fringe benefits (or cash equivalents thereof) due at time of payment computed at rates not less than those contained in the wage determination of the Secretary of Labor which is attached hereto and made a part hereof, regardless of any contractual relationship which may be alleged to exist between the contractor and such laborers and mechanics… (3)(ii)(A) The contractor shall submit weekly for each week in which any contract work is performed a copy of all payrolls to the (write in name of appropriate federal agency) if the agency is a party to the contract, but if the agency is not such a party, the contractor will submit the payrolls to the applicant, sponsor, or owner, as the case may be, for transmission to the (write in name of agency). 2 CFR 200 Appendix II states in part: In addition to other provisions required by the Federal agency or non-Federal entity; all contracts made by the non-Federal entity under the Federal award must contain provisions covering the following, as applicable. . . . (D) Davis-Bacon Act, as amended (40 U.S.C. 3141-3148). When required by Federal program legislation, all prime construction contracts in excess of $2,000 awarded by non-Federal entities must include a provision for compliance with the Davis-Bacon Act (40 U.S.C. 3141-3144, and 3146-3148) as supplemented by Department of Labor regulations (29 CFR Part 5, “Labor Standards Provisions Applicable to Contracts Covering Federally Financed and Assisted Construction”). In accordance with the statute, contractors must be required to pay wages to laborers and mechanics at a rate not less than the prevailing wages specified in a wage determination made by the Secretary of Labor. In addition, contractors must be required to pay wages not less than once a week.. . .” Condition: An effective internal control system was not in place at the School Corporation in order to ensure compliance with requirements related to the grant agreement and the Special Tests and Provisions – Wage Rate Requirements compliance requirements. Cause: The School Corporation's management had not developed a system of internal controls to ensure compliance with the compliance requirements listed above. Effect: The failure to design and implement an effective internal control system enabled material noncompliance to go undetected. Noncompliance with the grant agreement and the Special Tests and Provisions – Wage Rate Requirements compliance requirement could result in the loss of future federal funds to the School Corporation. Questioned Costs: There were no questioned costs identified. Context: For the one project sampled for Davis-Bacon requirements, the School Corporation did not obtain the weekly payroll reports certifications from the company that performed renovations on the School Corporation. Therefore, no review was performed to ensure that pay rates complied with the federal wage rate requirements. Additionally, the School Corporation did not have a contract with the company that included the clause for the federal wage rate requirements. The amount disbursed and reported on the SEFA during the audit period is $231,000. Identification as a repeat finding: This is a repeat finding from the immediately prior audit. The prior finding number was 2022-004. Recommendation: We recommend the School Corporation implement a formal process to ensure the required weekly payroll reports certifications are collected and reviewed to ensure compliance with the wage rate requirements. Views of Responsible Officials and Planned Corrective Actions: Management agrees with the finding and has prepared a corrective action plan.
Information on the federal program: Subject: Education Stabilization Fund – Special Tests and Provisions - Wage Rate Requirements Federal Agency: Department of Education Federal Program: COVID-19 - Eucation Stabilization Fund Assistance Listing Number: 84.425D, 84.425U Federal Award Numbers and Years (or Other Identifying Numbers): S425D210013, S425U210013 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Special Tests and Provisions - Wage Rate Requirements Audit Findings: Material Weakness, Material Noncompliance, Qualified Opinion Criteria: 2 CFR section 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 29 CFR 5.5 states in part: (1) Minimum wages. (i) All laborers and mechanics employed or working upon the site of the work (or under the United States Housing Act of 1937 or under the Housing Act of 1949 in the construction or development of the project), will be paid unconditionally and not less often than once a week, and without subsequent deduction or rebate on any account (except such payroll deductions as are permitted by regulations issued by the Secretary of Labor under the Copeland Act (29 CFR part 3)), the full amount of wages and bona fide fringe benefits (or cash equivalents thereof) due at time of payment computed at rates not less than those contained in the wage determination of the Secretary of Labor which is attached hereto and made a part hereof, regardless of any contractual relationship which may be alleged to exist between the contractor and such laborers and mechanics… (3)(ii)(A) The contractor shall submit weekly for each week in which any contract work is performed a copy of all payrolls to the (write in name of appropriate federal agency) if the agency is a party to the contract, but if the agency is not such a party, the contractor will submit the payrolls to the applicant, sponsor, or owner, as the case may be, for transmission to the (write in name of agency). 2 CFR 200 Appendix II states in part: In addition to other provisions required by the Federal agency or non-Federal entity; all contracts made by the non-Federal entity under the Federal award must contain provisions covering the following, as applicable. . . . (D) Davis-Bacon Act, as amended (40 U.S.C. 3141-3148). When required by Federal program legislation, all prime construction contracts in excess of $2,000 awarded by non-Federal entities must include a provision for compliance with the Davis-Bacon Act (40 U.S.C. 3141-3144, and 3146-3148) as supplemented by Department of Labor regulations (29 CFR Part 5, “Labor Standards Provisions Applicable to Contracts Covering Federally Financed and Assisted Construction”). In accordance with the statute, contractors must be required to pay wages to laborers and mechanics at a rate not less than the prevailing wages specified in a wage determination made by the Secretary of Labor. In addition, contractors must be required to pay wages not less than once a week.. . .” Condition: An effective internal control system was not in place at the School Corporation in order to ensure compliance with requirements related to the grant agreement and the Special Tests and Provisions – Wage Rate Requirements compliance requirements. Cause: The School Corporation's management had not developed a system of internal controls to ensure compliance with the compliance requirements listed above. Effect: The failure to design and implement an effective internal control system enabled material noncompliance to go undetected. Noncompliance with the grant agreement and the Special Tests and Provisions – Wage Rate Requirements compliance requirement could result in the loss of future federal funds to the School Corporation. Questioned Costs: There were no questioned costs identified. Context: For the one project sampled for Davis-Bacon requirements, the School Corporation did not obtain the weekly payroll reports certifications from the company that performed renovations on the School Corporation. Therefore, no review was performed to ensure that pay rates complied with the federal wage rate requirements. Additionally, the School Corporation did not have a contract with the company that included the clause for the federal wage rate requirements. The amount disbursed and reported on the SEFA during the audit period is $231,000. Identification as a repeat finding: This is a repeat finding from the immediately prior audit. The prior finding number was 2022-004. Recommendation: We recommend the School Corporation implement a formal process to ensure the required weekly payroll reports certifications are collected and reviewed to ensure compliance with the wage rate requirements. Views of Responsible Officials and Planned Corrective Actions: Management agrees with the finding and has prepared a corrective action plan.
Information on the federal program: Subject: Education Stabilization Fund - Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: Department of Education Federal Program: COVID-19 – Education Stabilization Fund Assistance Listing Number: 84.425U Federal Award Numbers and Years (or Other Identifying Numbers): S425U210013 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Activities Allowed or Unallowed, Allowable Costs/Cost Principles Audit Finding: Material Weakness, Material Noncompliance, Qualified Opinion Criteria: 2 CFR section 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Condition: An effective internal control system was not in place at the School Corporation in order to ensure compliance with requirements related to the grant agreement and the activities allowed or unallowed and allowable costs/cost principle compliance requirements. Cause: The School Corporation's management had not developed a system of internal controls to ensure compliance with the compliance requirements listed above. Effect: The failure to design and implement an effective internal control system enabled material noncompliance to go undetected. Noncompliance with the grant agreement and the Activities Allowed or Unallowed, Allowable Costs/Cost Principles compliance requirements could result in the loss of future federal funds to the School Corporation. Questioned Costs: $61,841 (Known) Context: For testing of activities allowed and unallowed, a sample of 21 vendor vouchers were selected for testing. Two vouchers totaling $61,841 were related to disbursements for floor replacement costs incurred and charged to the ESSER III grant award. The School Corporation received approval from the Indiana Department of Education (IDOE) through the grant application to utilize a portion of the ESSER II grant award for floor replacement throughout the School Corporation. During the audit period, the School Corporation had $88,600 that was disbursed and reported on the SEFA for ESSER II and $142,400 that was disbursed and reported on the SEFA for ESSER III for floor replacement. The School Corporation did not receive approval from the Indiana Department of Education (IDOE) to use ESSER III funding for the flooring project as required for construction or remodeling related projects. The total amount of the flooring project funded by the ESSER III grant, including amounts paid prior to the audit, was $219,992. The portion of the flooring project paid by the ESSER II grant was $163,000 which was properly approved by IDOE. Identification as a repeat finding, if applicable: No. Recommendation: We recommended that the School Corporation's management establish a system of internal controls related to the grant agreement and the activities allowed or unallowed and allowable costs/cost principle compliance requirements to ensure only allowable costs are charged to the grant award. Views of Responsible Officials and Planned Corrective Actions: Management agrees with the finding and has prepared a corrective action plan.
Assistance Listing Number, Federal Agency, and Program Name - 10.558, U.S. Department of Agriculture, Child Care and Adult Food Program Federal Award Identification Number and Year - 15-016-271P-00, 2024 and 2023 Pass through Entity - Illinois State Board of Education Finding Type - Material weakness and material noncompliance with laws and regulations Repeat Finding - Yes 2023-005 Criteria - Per 2 CFR 200.303(a), the nonfederal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in Standards for Internal Control in the Federal Government, issued by the Comptroller General of the United States, or the Internal Control Integrated Framework, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Other requirements include the following: (a) Per 7 CFR 226.15(f), each sponsoring organization of day care homes shall determine which of the day care homes under its sponsorship are eligible as tier I day care homes. (b) As required under 7 CFR 226.16(d)(4)(iii), sponsoring organizations are required to perform on site monitoring of each of its facilities three times every year, which includes requirements to ensure the amount of time between reviews does not exceed six months (unless review average is used). Condition - There was a lack of documented controls as evidence of supervisory review and segregation of duties to ensure compliance with federal program requirements, specifically over the following: a) Tier (day care home eligibility) determinations b) Subrecipient monitoring Noncompliance was identified for subrecipient monitoring as noted in the context below. Questioned Costs - None Identification of How Questioned Costs Were Computed - N/A - No instances of noncompliance result in questioned costs. Context (a) While gaining an understanding of controls over tier (day care home eligibility) determinations, we noted no controls established to ensure supervisory review of these determinations. (b) While testing a sample of 56 provider monitoring visits, we noted 35 day care homes and 1 day care center with less than the required 3 annual on site monitoring visits for the year and 40 day care homes for which time between on site monitoring visits exceeded six months. Cause and Effect - A lack of effectively designed, implemented, and operating controls in any of these areas could result in future material noncompliance with program requirements or the Uniform Guidance in the future. The deficiency in operating controls for subrecipient monitoring resulted in noncompliance for fiscal year 2024. Recommendation - We recommend management formalize documentation of a supervisory review of the following: (a) Data used in making tier/eligibility determinations for accuracy and completeness (b) Subrecipient monitoring Views of Responsible Officials and Corrective Action Plan - Management agrees with the recommendations and plans the following: (a) Management is working with the Software company staff to develop software based evidence of second review. If this is not possible, a tracking mechanism external to the software will be developed by March 2025. (b) Under management’s supervision, monitoring visits are being brought current on the contract currently in place and will be completed as required by end of the contract. A tracking mechanism has been put in place to ensure compliance with the required number of monitoring visits and timeliness.
Finding Number: 2024‐001 Repeat Finding: No Program Names/Assistance Listing Titles: Assistance Listing Numbers: Federal Award Numbers: Questioned Costs: Emergency Connectivity Fund 32.009 ECF202208394 $141,445 Education Stabilization Fund 84.425 S425U210038 141,445 Federal Agencies: Department of Education and USAC Pass‐Through Agencies: Arizona Department of Education and USAC Type of Finding: Noncompliance, Significant Deficiency Compliance Requirements: Activities Allowed or Unallowed and Allowable Costs/Cost Principles Criteria Management is responsible for establishing and maintaining internal controls over its accounting records. Further, in accordance with 2 CFR 200.510, the District is responsible for the design and implementation of controls over the preparation of the Schedule of Expenditures of Federal Awards (SEFA) each fiscal year. Additionally, 2 CFR 200.303 requires the District establish and maintain internal control over the federal awards that provides reasonable assurance that the District is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. Condition The District was awarded several new Federal grants in response to the COVID‐19 pandemic, which made proper preparation of the SEFA challenging and the District failed to include the new grant on the fiscal year 2022 SEFA. The District also submitted the same expenditures for reimbursement for two federal programs. Cause The District did not account for the Emergency Connectivity Fund (ECF) properly as the program was unique and not part of the District’s normal federal program operations. It was not known that the program was subject to Single Audit. In addition, there was a lack of financial oversight of the ECF grant application submitted by the Technology Department during fiscal year 2022. Effect The District received reimbursements for two federal grants, one for the Education Stabilization Fund in fiscal year 2022 and the other for the ECF grant in fiscal year 2024, for expenditures totaling $141,445. In addition, the fiscal year 2022 SEFA was incorrect as the ECF expenditures were not included on the SEFA; however, it was determined the error did not have an effect on the selection of major federal programs. Context During fiscal year 2021‐22, the District applied for and was approved for funding under the Universal Service Company (USAC)'s Emergency Connectivity Fund (ECF). The District, in conjunction with its consultant, submitted expenditures from two purchase orders to USAC's ECF for purchases made in fiscal year 2021‐22, one of which was paid for and previously reimbursed under the Education Stabilization Fund. The District received the USAC ECF reimbursement in fiscal year 2023‐24. The sample was not intended to be, and was not, a statistically valid sample. Recommendation The District should ensure all federal programs are properly reviewed prior to submitting any applications or expenditures for reimbursements. The expenditures should be included in the SEFA for the fiscal year in which the expenditures occurred. In addition, the District should strengthen controls over the accounting records to ensure reimbursements are not submitted for multiple programs. Views of Responsible Officials See Corrective Action Plan.
Finding Number: 2024‐001 Repeat Finding: No Program Names/Assistance Listing Titles: Assistance Listing Numbers: Federal Award Numbers: Questioned Costs: Emergency Connectivity Fund 32.009 ECF202208394 $141,445 Education Stabilization Fund 84.425 S425U210038 141,445 Federal Agencies: Department of Education and USAC Pass‐Through Agencies: Arizona Department of Education and USAC Type of Finding: Noncompliance, Significant Deficiency Compliance Requirements: Activities Allowed or Unallowed and Allowable Costs/Cost Principles Criteria Management is responsible for establishing and maintaining internal controls over its accounting records. Further, in accordance with 2 CFR 200.510, the District is responsible for the design and implementation of controls over the preparation of the Schedule of Expenditures of Federal Awards (SEFA) each fiscal year. Additionally, 2 CFR 200.303 requires the District establish and maintain internal control over the federal awards that provides reasonable assurance that the District is managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of federal awards. Condition The District was awarded several new Federal grants in response to the COVID‐19 pandemic, which made proper preparation of the SEFA challenging and the District failed to include the new grant on the fiscal year 2022 SEFA. The District also submitted the same expenditures for reimbursement for two federal programs. Cause The District did not account for the Emergency Connectivity Fund (ECF) properly as the program was unique and not part of the District’s normal federal program operations. It was not known that the program was subject to Single Audit. In addition, there was a lack of financial oversight of the ECF grant application submitted by the Technology Department during fiscal year 2022. Effect The District received reimbursements for two federal grants, one for the Education Stabilization Fund in fiscal year 2022 and the other for the ECF grant in fiscal year 2024, for expenditures totaling $141,445. In addition, the fiscal year 2022 SEFA was incorrect as the ECF expenditures were not included on the SEFA; however, it was determined the error did not have an effect on the selection of major federal programs. Context During fiscal year 2021‐22, the District applied for and was approved for funding under the Universal Service Company (USAC)'s Emergency Connectivity Fund (ECF). The District, in conjunction with its consultant, submitted expenditures from two purchase orders to USAC's ECF for purchases made in fiscal year 2021‐22, one of which was paid for and previously reimbursed under the Education Stabilization Fund. The District received the USAC ECF reimbursement in fiscal year 2023‐24. The sample was not intended to be, and was not, a statistically valid sample. Recommendation The District should ensure all federal programs are properly reviewed prior to submitting any applications or expenditures for reimbursements. The expenditures should be included in the SEFA for the fiscal year in which the expenditures occurred. In addition, the District should strengthen controls over the accounting records to ensure reimbursements are not submitted for multiple programs. Views of Responsible Officials See Corrective Action Plan.