Findings Citing § 200.303

CRITERIA/SPECIFIC REQUIREMENT: The grant award agreement between the U.S. Department of Justice and South Cook Intermediate Service Center #4 requires the South Cook Intermediate Service Center #4 to complete and submit federal financial reports quarterly and progress reports semi-annually. The quarterly financial reports are due 30 calendar days after the end of the reporting quarter while the semi-annual progress reports are due 30 calendar days after the reporting semi-annual period. Additionally, the grant award agreement between the Regional Office of Education No. 56 and South Cook Intermediate Service Center #4 requires the South Cook Intermediate Service Center #4 to submit quarterly expenditure and GATA reports. These reports will be submitted no later than the 10 days after the end of each quarter. Also, one of the core services and required state activities is to create a Community Advisory Group. Finally, the Code of Federal Regulations (Code) (2 CFR. §200.303 (a)) requires the South Cook Intermediate Service Center #4 to establish and maintain effective internal control over the federal award to provide reasonable assurance the South Cook Intermediate Service Center #4 is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Effective internal controls should include procedures to ensure compliance with grant requirements. CONDITION: The South Cook Intermediate Service Center #4 had inadequate controls over grant compliance to ensure all grant reports during the fiscal year were timely reported and grant requirements were met. During testing of the South Cook Intermediate Service Center #4’s compliance with the grant requirements, we noted the following: For Public Safety Partnership and Community Policing Grants - • One of 2 (50%) quarterly federal financial reports were submitted 36 days late. • One of 1 (100%) semi-annual performance report was submitted 47 days late. For McKinney-Vento Education for Homeless Children and Youth - • Four of 4 (100%) quarterly expenditure reports and the Grant Accountability and Transparency Act (GATA) reports were submitted but the South Cook Intermediate Service Center #4 was unable to provide proof of submission; therefore, we were unable to determine if the required reports were submitted timely or at all. • South Cook Intermediate Service Center #4 did not formally establish a Community Advisory Group. QUESTIONED COSTS: None. CONTEXT: South Cook Intermediate Service Center #4 did not comply with grant requirements, as several reports were submitted late or lacked proof of submission, and a required Community Advisory Group was not established. EFFECT: Failure to meet grant reporting requirements is noncompliance with the related grant agreement and could result in loss of grant funding in future years. Additionally, failure to formally establish the Community Advisory Group could hinder the program's effectiveness, affect its alignment with the goals stipulated in the grant agreement, and limit the necessary support for program success and community involvement. CAUSE: Management indicated that the issues were due to a combination of website technical difficulties, changes in administrative access to the grant reporting system, and management oversight. RECOMMENDATION: We recommend the South Cook Intermediate Service Center #4 implement procedures to ensure adherence to the grant reporting requirements. In addition, we recommend that South Cook Intermediate Service Center #4 establish the advisory group as stipulated in the grant agreement. MANAGEMENT’S RESPONSE: The South Cook Intermediate Service Center #4 agrees with the finding. Management is in the process of developing more formal and comprehensive grant monitoring procedures that will include a checklist for all the necessary reporting and compliance requirements. Specifically for the Mc-Kinney Vento grant, formal documentation of the Community Advisory Group will be obtained in consultation with the grantor.

CRITERIA/SPECIFIC REQUIREMENT: The grant award agreement between the U.S. Department of Justice and South Cook Intermediate Service Center #4 requires the South Cook Intermediate Service Center #4 to complete and submit federal financial reports quarterly and progress reports semi-annually. The quarterly financial reports are due 30 calendar days after the end of the reporting quarter while the semi-annual progress reports are due 30 calendar days after the reporting semi-annual period. Additionally, the grant award agreement between the Regional Office of Education No. 56 and South Cook Intermediate Service Center #4 requires the South Cook Intermediate Service Center #4 to submit quarterly expenditure and GATA reports. These reports will be submitted no later than the 10 days after the end of each quarter. Also, one of the core services and required state activities is to create a Community Advisory Group. Finally, the Code of Federal Regulations (Code) (2 CFR. §200.303 (a)) requires the South Cook Intermediate Service Center #4 to establish and maintain effective internal control over the federal award to provide reasonable assurance the South Cook Intermediate Service Center #4 is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Effective internal controls should include procedures to ensure compliance with grant requirements. CONDITION: The South Cook Intermediate Service Center #4 had inadequate controls over grant compliance to ensure all grant reports during the fiscal year were timely reported and grant requirements were met. During testing of the South Cook Intermediate Service Center #4’s compliance with the grant requirements, we noted the following: For Public Safety Partnership and Community Policing Grants - • One of 2 (50%) quarterly federal financial reports were submitted 36 days late. • One of 1 (100%) semi-annual performance report was submitted 47 days late. For McKinney-Vento Education for Homeless Children and Youth - • Four of 4 (100%) quarterly expenditure reports and the Grant Accountability and Transparency Act (GATA) reports were submitted but the South Cook Intermediate Service Center #4 was unable to provide proof of submission; therefore, we were unable to determine if the required reports were submitted timely or at all. • South Cook Intermediate Service Center #4 did not formally establish a Community Advisory Group. QUESTIONED COSTS: None. CONTEXT: South Cook Intermediate Service Center #4 did not comply with grant requirements, as several reports were submitted late or lacked proof of submission, and a required Community Advisory Group was not established. EFFECT: Failure to meet grant reporting requirements is noncompliance with the related grant agreement and could result in loss of grant funding in future years. Additionally, failure to formally establish the Community Advisory Group could hinder the program's effectiveness, affect its alignment with the goals stipulated in the grant agreement, and limit the necessary support for program success and community involvement. CAUSE: Management indicated that the issues were due to a combination of website technical difficulties, changes in administrative access to the grant reporting system, and management oversight. RECOMMENDATION: We recommend the South Cook Intermediate Service Center #4 implement procedures to ensure adherence to the grant reporting requirements. In addition, we recommend that South Cook Intermediate Service Center #4 establish the advisory group as stipulated in the grant agreement. MANAGEMENT’S RESPONSE: The South Cook Intermediate Service Center #4 agrees with the finding. Management is in the process of developing more formal and comprehensive grant monitoring procedures that will include a checklist for all the necessary reporting and compliance requirements. Specifically for the Mc-Kinney Vento grant, formal documentation of the Community Advisory Group will be obtained in consultation with the grantor.

FINDING 2024-002 Subject: Special Education Cluster (IDEA) - Internal Controls Federal Agency: Department of Education Federal Programs: Special Education Grants to States, COVID-19 - Special Education Grants to States Assistance Listings Number: 84.027 Federal Award Numbers and Years (or Other Identifying Numbers): 22611-048-PN01, 23611-048-PN01, 24611-048-PN01, 22611-048-ARP Pass-Through Entity: Indiana Department of Education Compliance Requirement: Matching, Level of Effort, Earmarking Audit Finding: Material Weakness Condition and Context An effective internal control system, which would include segregation of duties, was not in place at the School Corporation in order to ensure compliance with requirements related to the grant agreement and the following compliance requirement: INDIANA STATE BOARD OF ACCOUNTS 16 JAC-CEN-DEL COMMUNITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Level of Effort - Maintenance of Effort The Indiana Department of Education calculates the Level of Effort - Maintenance of Effort based on expenditure information submitted on the Form 9 for that fiscal year. The School Corporation Treasurer was responsible for the preparation and submission of the Form 9. There were no documented internal controls in place, such as an oversight, review, or approval process, to ensure expenditures were correctly reported. The lack of internal controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause A proper system of internal controls was not designed by management of the School Corporation. The individual responsible for review of the Form 9 information signed a cover sheet, but did not receive adequate supporting documentation to ensure expenditures were correctly reported. Effect Without the proper implementation of an effectively designed system of internal controls, expenditure information used by the Indiana Department of Education to review compliance with the Level of Effort - Maintenance of Effort requirement, could be inaccurate. Noncompliance with the provisions of federal statutes, regulations, and the terms and conditions of the federal award could result in the loss of future federal funding to the School Corporation. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a system of internal controls, including segregation of duties, related to the grant agreement and compliance requirement listed above. INDIANA STATE BOARD OF ACCOUNTS 17 JAC-CEN-DEL COMMUNITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-002 Subject: Special Education Cluster (IDEA) - Internal Controls Federal Agency: Department of Education Federal Programs: Special Education Grants to States, COVID-19 - Special Education Grants to States Assistance Listings Number: 84.027 Federal Award Numbers and Years (or Other Identifying Numbers): 22611-048-PN01, 23611-048-PN01, 24611-048-PN01, 22611-048-ARP Pass-Through Entity: Indiana Department of Education Compliance Requirement: Matching, Level of Effort, Earmarking Audit Finding: Material Weakness Condition and Context An effective internal control system, which would include segregation of duties, was not in place at the School Corporation in order to ensure compliance with requirements related to the grant agreement and the following compliance requirement: INDIANA STATE BOARD OF ACCOUNTS 16 JAC-CEN-DEL COMMUNITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Level of Effort - Maintenance of Effort The Indiana Department of Education calculates the Level of Effort - Maintenance of Effort based on expenditure information submitted on the Form 9 for that fiscal year. The School Corporation Treasurer was responsible for the preparation and submission of the Form 9. There were no documented internal controls in place, such as an oversight, review, or approval process, to ensure expenditures were correctly reported. The lack of internal controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause A proper system of internal controls was not designed by management of the School Corporation. The individual responsible for review of the Form 9 information signed a cover sheet, but did not receive adequate supporting documentation to ensure expenditures were correctly reported. Effect Without the proper implementation of an effectively designed system of internal controls, expenditure information used by the Indiana Department of Education to review compliance with the Level of Effort - Maintenance of Effort requirement, could be inaccurate. Noncompliance with the provisions of federal statutes, regulations, and the terms and conditions of the federal award could result in the loss of future federal funding to the School Corporation. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a system of internal controls, including segregation of duties, related to the grant agreement and compliance requirement listed above. INDIANA STATE BOARD OF ACCOUNTS 17 JAC-CEN-DEL COMMUNITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-002 Subject: Special Education Cluster (IDEA) - Internal Controls Federal Agency: Department of Education Federal Programs: Special Education Grants to States, COVID-19 - Special Education Grants to States Assistance Listings Number: 84.027 Federal Award Numbers and Years (or Other Identifying Numbers): 22611-048-PN01, 23611-048-PN01, 24611-048-PN01, 22611-048-ARP Pass-Through Entity: Indiana Department of Education Compliance Requirement: Matching, Level of Effort, Earmarking Audit Finding: Material Weakness Condition and Context An effective internal control system, which would include segregation of duties, was not in place at the School Corporation in order to ensure compliance with requirements related to the grant agreement and the following compliance requirement: INDIANA STATE BOARD OF ACCOUNTS 16 JAC-CEN-DEL COMMUNITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Level of Effort - Maintenance of Effort The Indiana Department of Education calculates the Level of Effort - Maintenance of Effort based on expenditure information submitted on the Form 9 for that fiscal year. The School Corporation Treasurer was responsible for the preparation and submission of the Form 9. There were no documented internal controls in place, such as an oversight, review, or approval process, to ensure expenditures were correctly reported. The lack of internal controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause A proper system of internal controls was not designed by management of the School Corporation. The individual responsible for review of the Form 9 information signed a cover sheet, but did not receive adequate supporting documentation to ensure expenditures were correctly reported. Effect Without the proper implementation of an effectively designed system of internal controls, expenditure information used by the Indiana Department of Education to review compliance with the Level of Effort - Maintenance of Effort requirement, could be inaccurate. Noncompliance with the provisions of federal statutes, regulations, and the terms and conditions of the federal award could result in the loss of future federal funding to the School Corporation. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a system of internal controls, including segregation of duties, related to the grant agreement and compliance requirement listed above. INDIANA STATE BOARD OF ACCOUNTS 17 JAC-CEN-DEL COMMUNITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-002 Subject: Special Education Cluster (IDEA) - Internal Controls Federal Agency: Department of Education Federal Programs: Special Education Grants to States, COVID-19 - Special Education Grants to States Assistance Listings Number: 84.027 Federal Award Numbers and Years (or Other Identifying Numbers): 22611-048-PN01, 23611-048-PN01, 24611-048-PN01, 22611-048-ARP Pass-Through Entity: Indiana Department of Education Compliance Requirement: Matching, Level of Effort, Earmarking Audit Finding: Material Weakness Condition and Context An effective internal control system, which would include segregation of duties, was not in place at the School Corporation in order to ensure compliance with requirements related to the grant agreement and the following compliance requirement: INDIANA STATE BOARD OF ACCOUNTS 16 JAC-CEN-DEL COMMUNITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Level of Effort - Maintenance of Effort The Indiana Department of Education calculates the Level of Effort - Maintenance of Effort based on expenditure information submitted on the Form 9 for that fiscal year. The School Corporation Treasurer was responsible for the preparation and submission of the Form 9. There were no documented internal controls in place, such as an oversight, review, or approval process, to ensure expenditures were correctly reported. The lack of internal controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause A proper system of internal controls was not designed by management of the School Corporation. The individual responsible for review of the Form 9 information signed a cover sheet, but did not receive adequate supporting documentation to ensure expenditures were correctly reported. Effect Without the proper implementation of an effectively designed system of internal controls, expenditure information used by the Indiana Department of Education to review compliance with the Level of Effort - Maintenance of Effort requirement, could be inaccurate. Noncompliance with the provisions of federal statutes, regulations, and the terms and conditions of the federal award could result in the loss of future federal funding to the School Corporation. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a system of internal controls, including segregation of duties, related to the grant agreement and compliance requirement listed above. INDIANA STATE BOARD OF ACCOUNTS 17 JAC-CEN-DEL COMMUNITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-003 Subject: COVID-19 - Education Stabilization Fund - Reporting Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Number: 84.425U Federal Award Number and Year (or Other Identifying Number): S425U210013 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Findings: Material Weakness, Other Matters Repeat Finding This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-002. Condition and Context An effective internal control system was not designed or implemented at the School Corporation to ensure compliance with requirements related to the grant agreement and the Reporting compliance requirement. The School Corporation had not designed, nor implemented, a system of internal controls to ensure that the annual Elementary and Secondary School Emergency Relief (ESSER) Data Collection reports (Reports) were complete and accurately submitted. The Reports were prepared by one employee without a documented oversight, review, or approval process in place to prevent, or detect and correct, errors. Due to the lack of effective internal controls, two of the five Reports submitted during the audit period were not supported by the School Corporation's records. The following errors were noted:  For the ESSER III, Year 2 report, which covered the period July 1, 2021 to June 30, 2022, total expenses reported were understated by $369,741.  For the ESSER III, Year 3 report, which covered the period July 1, 2022 to June 30, 2023, total expenses reported for Property - Mandatory Subgrant Funds - Exclusive of Learning Loss Set-Aside were understated by $519,504. Total expenses reported for Supplies - Mandatory Subgrant Funds - Learning Loss Set-Aside were overstated by $11,260. The lack of internal controls was a systemic issue throughout the audit period. Noncompliance was isolated to the ESSER III, Year 2 and Year 3 reports. INDIANA STATE BOARD OF ACCOUNTS 18 JAC-CEN-DEL COMMUNITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.334 states in part: "Financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following . . . (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 and 200.329. . . ." 34 CFR 76.722 states: "A State may require a subgrantee to submit reports in a manner and format that assists the State in complying with the requirements under 34 CFR 76.720 and in carrying out other responsibilities under the program." Cause A proper system of internal controls was not designed by management of the School Corporation. Due to turnover in the position responsible for review, reports were not reviewed to detect errors prior to submission. Effect Without the proper implementation of an effectively designed system of internal controls, the internal control system cannot be capable of effectively preventing, or detecting and correcting, material noncompliance. As a result, the ESSER III, Year 2 and Year 3 reports were not supported by the School Corporation's records. INDIANA STATE BOARD OF ACCOUNTS 19 JAC-CEN-DEL COMMUNITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Questioned Costs There were no questioned costs identified. Recommendation We recommended that the management of the School Corporation establish a proper system of internal controls and develop policies and procedures to ensure that all reports are supported by the School Corporation's records. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-003 Subject: COVID-19 - Education Stabilization Fund - Reporting Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Number: 84.425U Federal Award Number and Year (or Other Identifying Number): S425U210013 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Findings: Material Weakness, Other Matters Repeat Finding This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-002. Condition and Context An effective internal control system was not designed or implemented at the School Corporation to ensure compliance with requirements related to the grant agreement and the Reporting compliance requirement. The School Corporation had not designed, nor implemented, a system of internal controls to ensure that the annual Elementary and Secondary School Emergency Relief (ESSER) Data Collection reports (Reports) were complete and accurately submitted. The Reports were prepared by one employee without a documented oversight, review, or approval process in place to prevent, or detect and correct, errors. Due to the lack of effective internal controls, two of the five Reports submitted during the audit period were not supported by the School Corporation's records. The following errors were noted:  For the ESSER III, Year 2 report, which covered the period July 1, 2021 to June 30, 2022, total expenses reported were understated by $369,741.  For the ESSER III, Year 3 report, which covered the period July 1, 2022 to June 30, 2023, total expenses reported for Property - Mandatory Subgrant Funds - Exclusive of Learning Loss Set-Aside were understated by $519,504. Total expenses reported for Supplies - Mandatory Subgrant Funds - Learning Loss Set-Aside were overstated by $11,260. The lack of internal controls was a systemic issue throughout the audit period. Noncompliance was isolated to the ESSER III, Year 2 and Year 3 reports. INDIANA STATE BOARD OF ACCOUNTS 18 JAC-CEN-DEL COMMUNITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.334 states in part: "Financial records, supporting documents, statistical records, and all other non-Federal entity records pertinent to a Federal award must be retained for a period of three years from the date of submission of the final expenditure report or, for Federal awards that are renewed quarterly or annually, from the date of the submission of the quarterly or annual financial report, respectively, as reported to the Federal awarding agency or pass-through entity in the case of a subrecipient. . . ." 2 CFR 200.302(b) states in part: "The financial management system of each non-Federal entity must provide for the following . . . (2) Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 and 200.329. . . ." 34 CFR 76.722 states: "A State may require a subgrantee to submit reports in a manner and format that assists the State in complying with the requirements under 34 CFR 76.720 and in carrying out other responsibilities under the program." Cause A proper system of internal controls was not designed by management of the School Corporation. Due to turnover in the position responsible for review, reports were not reviewed to detect errors prior to submission. Effect Without the proper implementation of an effectively designed system of internal controls, the internal control system cannot be capable of effectively preventing, or detecting and correcting, material noncompliance. As a result, the ESSER III, Year 2 and Year 3 reports were not supported by the School Corporation's records. INDIANA STATE BOARD OF ACCOUNTS 19 JAC-CEN-DEL COMMUNITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Questioned Costs There were no questioned costs identified. Recommendation We recommended that the management of the School Corporation establish a proper system of internal controls and develop policies and procedures to ensure that all reports are supported by the School Corporation's records. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-004 Subject: Special Education Cluster (IDEA) - Earmarking Federal Agency: Department of Education Federal Program: Special Education Grants to States Assistance Listings Number: 84.027 Federal Award Number and Year (or Other Identifying Number): 22611-048-PN01 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Matching, Level of Effort, Earmarking Audit Findings: Material Weakness, Other Matters Condition and Context The School Corporation is a member of the Ripley-Ohio-Dearborn Special Education Cooperative (Cooperative). During fiscal year 2022-2023, the Cooperative operated the special education programs and spent the federal money for earmarked expenditures on behalf of four of the six member schools. As the grant agreements were between the Indiana Department of Education (IDOE) and the member school, the School Corporation was responsible for ensuring and providing oversight of the Cooperative. However, there was inadequate oversight performed by the School Corporation in order to ensure compliance with the Matching, Level of Effort, Earmarking compliance requirement. The School Corporation did not have internal controls in place to ensure that the Cooperative complied with the earmarking requirements. The Cooperative did not have adequate procedures in place to ensure that the required level of expenditures for nonpublic school students with disabilities was met for each member school. The Cooperative did not have effective internal controls to ensure nonpublic school expenditures were appropriately identified and reported. The Non-Public Proportionate Share expenditures for the 22611-048-PN01 grant award could not be verified for the individual member schools. The nonpublic school share funds for the participating member schools were allocated based on the yearly budget for certified staff instead of time charged to the nonpublic schools. These allocations were the amounts reported to the IDOE. As such, we were unable to identify which expenditures were for each school in order to verify the minimum amount per the grant award was expended and properly reported to the IDOE as required. The lack of internal controls and noncompliance was isolated to the 22611-048-PN01 grant award in 2022-2023. INDIANA STATE BOARD OF ACCOUNTS 20 JAC-CEN-DEL COMMUNITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.403 states in part: "Except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: . . . . (g) Be adequately documented. . . ." 2 CFR 200.208(b) states in part: "The Federal awarding agency or pass-through entity may adjust specific Federal award conditions as needed . . ." 511 IAC 7-34-7(b) states: "The public agency, in providing special education and related services to students in nonpublic schools must expend at least an amount that is the same proportion of the public agency total subgrant under 20 U.S.C. 1411(f) as the number of nonpublic school students with disabilities, who are enrolled by their parents in nonpublic schools within its boundaries, is to the total number of students with disabilities of the same age range." Cause A proper system of internal controls was not designed by management of the School Corporation to ensure time worked by certified staff for nonpublic schools was properly identified. Internal controls in place did not identify that an improper method was used to identify expenditures for nonpublic students with disabilities. Effect Without the proper implementation of an effectively designed system of internal controls, the School Corporation was unable to ensure that the proportionate share required to be expended for nonpublic students was met. Noncompliance with the provisions of federal statutes, regulations, and the terms and conditions of the federal award could result in the loss of future federal funding to the School Corporation. Questioned Costs There were no questioned costs identified. INDIANA STATE BOARD OF ACCOUNTS 21 JAC-CEN-DEL COMMUNITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Recommendation We recommended that management of the School Corporation establish a proper system of internal controls and develop policies and procedures to ensure nonpublic proportionate share funds are appropriately allocated to the member school based on expenses charged directly on behalf of the member school. Supporting documentation for these expenses should be retained for audit. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

2024-001 Internal Control over Compliance and Compliance with Period of Performance Identification of the Federal Program: United States Department of Justice Assistance Listing Number: 16.726 Assistance Listing Name: Juvenile Mentoring Program Grant Award Number: 15PJDP-21-GG-02766-MENT Award Period: October 1, 2021 through June 30, 2024 Criteria or Specific Requirement: §200.303 Internal Controls states that a non-federal entity must (a) establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Per 2 CFR Section 200.1 Period of performance means the time during which the non–Federal entity may incur new obligations to carry out the work authorized under the Federal award. The Federal awarding agency or pass-through entity must include start and end dates of the period of performance in the Federal award (see Sections 200.211 Information contained in a Federal award paragraph (b)(5) and 200.332 Requirements for pass-through entities, paragraph (b)(1)(v)). Condition: During the audit, we tested Council’s period of performance of subrecipient costs. We noted that Council has documented policies and procedures to comply with period of performance requirements and in all twenty-four samples tested complied with the prime award period of performance. However, in one sample out of twenty-four tested, Council paid the subrecipient $1,322 for expenses that were incurred after the subaward period of performance. Upon identifying this condition in our audit procedures, Council management determined that a total of $5,635 was paid to the subrecipient for costs incurred after the end of the subaward period of performance. Cause: Council did not follow its process to execute a no-cost extension of the subaward period of performance before approving reimbursement for costs incurred by the subrecipient during the prime award’s period of performance. Effect: The lack of adherence to the established internal control policies and procedures can lead to noncompliance with federal statutes, regulations, and the provisions of grant agreements which could ultimately lead to disallowed costs for the major federal program. Questioned Costs: There are questioned costs totaling $5,635. Context: This is a condition based on testing of Council’s compliance with specified requirements. The prevalence of the finding is detailed in the condition section above. The samples were selected using a non-statistical method. Repeat Finding: This is not a repeat finding. Recommendation: BDO recommends that Council follows its processes to ensure only subrecipient costs incurred during an active subgrant period of performance are reimbursed. Views of Responsible Officials: Council management agrees with the finding and recommendations set forth within and will work with program management teams to provide guidance and training related to subrecipient organization period of performance. Refer to management’s corrective action plan for additional information.

Federal agency: U.S. Department of Treasury Pass-through entity: Oregon Department of Administrative Services Federal program: 21.027 COVID-19 Coronavirus State and Local Fiscal Recovery Funds Criteria: When a non-federal entity enters into a covered transaction with an entity at a lower tier, the non-federal entity must verify that the entity, as defined in 2 CFR section 180.995 and agency adopting regulations, is not suspended or debarred or otherwise excluded from participating in the transaction. This verification may be accomplished by (1) checking the System for Award Management (SAM) Exclusions maintained by the General Services Administration (GSA) and available at SAM.gov, (2) collecting a certification from the entity, or (3) adding a clause or condition to the covered transaction with that entity (2 CFR section 180.300). Per 2 CFR 200.303, a non-Federal entity must “establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.” Condition: The City did not verify that its vendors were not suspended or debarred or otherwise excluded from participating in a covered transaction. A material weakness in controls over compliance with procurement requirements was identified. Cause: The City did not appear to be aware of this compliance requirement. Effect or potential effect: Prior to entering into a covered transaction, the City did not verify that its vendors were not suspended or debarred or otherwise excluded from participating in the transaction. Questioned Costs: None noted. Context: Of a population of 3 contracts, 2 sampled contracts did not have documentation that the City verified the vendor was not suspended or debarred or otherwise excluded from participating in a covered transaction. Recommendation: The City should implement controls to ensure it verifies that its vendors are not suspended or debarred or otherwise excluded prior to entering into a covered transaction. Views of responsible officials: The City understands and concurs with the finding and recommendation.

FINDING 2024-001 Subject: COVID-19 - Education Stabilization Fund - Reporting Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Number: 84.425 Federal Award Numbers and Years (or Other Identifying Numbers): S424U200013, S425D200013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Finding: Material Weakness Repeat Finding This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-003. Condition and Context An effective internal control system was not designed, nor implemented, at the School Corporation to ensure compliance with requirements related to the grant agreement and the Reporting compliance requirement. The School Corporation had not designed, nor implemented, a system of internal controls to ensure the annual Elementary and Secondary School Emergency Relief (ESSER) annual Data Collection reports (Reports) were complete and accurately submitted. The School Corporation Reports were reviewed by the Assistant Deputy Treasurer and submitted by the Chief Financial Officer; however, there was no documentation provided to verify that the oversight or review process to prevent, or detect and correct, errors was performed during the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause There was no documentation that a system of internal controls had been designed and implemented by management of the School Corporation to ensure compliance with the federal award and the Reporting compliance requirement. INDIANA STATE BOARD OF ACCOUNTS 16 FRANKLIN COMMUNITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect Without an effective system of internal controls noncompliance with the federal award and the Reporting compliance requirement could have occurred. Users of the Report rely upon its accuracy to make appropriate decisions. Noncompliance with the conditions of the federal award could result in the loss of federal funding to the School Corporation. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a system of internal controls related to the federal award and the Reporting compliance requirement which includes documentation of the operation of the internal controls. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-001 Subject: COVID-19 - Education Stabilization Fund - Reporting Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Number: 84.425 Federal Award Numbers and Years (or Other Identifying Numbers): S424U200013, S425D200013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Finding: Material Weakness Repeat Finding This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-003. Condition and Context An effective internal control system was not designed, nor implemented, at the School Corporation to ensure compliance with requirements related to the grant agreement and the Reporting compliance requirement. The School Corporation had not designed, nor implemented, a system of internal controls to ensure the annual Elementary and Secondary School Emergency Relief (ESSER) annual Data Collection reports (Reports) were complete and accurately submitted. The School Corporation Reports were reviewed by the Assistant Deputy Treasurer and submitted by the Chief Financial Officer; however, there was no documentation provided to verify that the oversight or review process to prevent, or detect and correct, errors was performed during the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause There was no documentation that a system of internal controls had been designed and implemented by management of the School Corporation to ensure compliance with the federal award and the Reporting compliance requirement. INDIANA STATE BOARD OF ACCOUNTS 16 FRANKLIN COMMUNITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect Without an effective system of internal controls noncompliance with the federal award and the Reporting compliance requirement could have occurred. Users of the Report rely upon its accuracy to make appropriate decisions. Noncompliance with the conditions of the federal award could result in the loss of federal funding to the School Corporation. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a system of internal controls related to the federal award and the Reporting compliance requirement which includes documentation of the operation of the internal controls. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-002 Subject: COVID-19 - Education Stabilization Fund - Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Number: 84.425 Federal Award Number and Year (or Other Identifying Number): S424U200013 Pass-Through Entity: Indiana Department of Education Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles Audit Finding: Significant Deficiency Condition and Context An effective internal control system was not designed at the School Corporation to ensure compliance with requirements related to the grant agreement and the Activities Allowed or Unallowed and Allowable Costs/Cost Principles compliance requirements. The School Corporation had designed a system of internal controls to ensure payroll expenditures charged to the grant fund were allowable. However, 2 of the 44 expenditures tested did not have documentation that the internal control had been applied and operated effectively. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 17 FRANKLIN COMMUNITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause An effective system of internal controls had not been designed by management of the School Corporation to ensure compliance with the federal award and the Activities Allowed or Unallowed and Allowable Costs/Cost Principles compliance requirements. An internal control had been designed but was not applied consistently to all payroll transactions. Effect Without an effective system of internal controls, noncompliance with the federal award and the Activities Allowed or Unallowed and Allowable Costs/Cost Principles compliance requirements could have occurred. Noncompliance with the conditions of the federal award could result in the loss of federal funding to the School Corporation. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a system of internal controls related to the federal award and the Activities Allowed or Unallowed and Allowable Costs/Cost Principles compliance requirements and apply the controls consistently to all transactions. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-001 Subject: COVID-19 - Education Stabilization Fund - Reporting Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Number: 84.425 Federal Award Numbers and Years (or Other Identifying Numbers): S424U200013, S425D200013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Finding: Material Weakness Repeat Finding This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-003. Condition and Context An effective internal control system was not designed, nor implemented, at the School Corporation to ensure compliance with requirements related to the grant agreement and the Reporting compliance requirement. The School Corporation had not designed, nor implemented, a system of internal controls to ensure the annual Elementary and Secondary School Emergency Relief (ESSER) annual Data Collection reports (Reports) were complete and accurately submitted. The School Corporation Reports were reviewed by the Assistant Deputy Treasurer and submitted by the Chief Financial Officer; however, there was no documentation provided to verify that the oversight or review process to prevent, or detect and correct, errors was performed during the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause There was no documentation that a system of internal controls had been designed and implemented by management of the School Corporation to ensure compliance with the federal award and the Reporting compliance requirement. INDIANA STATE BOARD OF ACCOUNTS 16 FRANKLIN COMMUNITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect Without an effective system of internal controls noncompliance with the federal award and the Reporting compliance requirement could have occurred. Users of the Report rely upon its accuracy to make appropriate decisions. Noncompliance with the conditions of the federal award could result in the loss of federal funding to the School Corporation. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a system of internal controls related to the federal award and the Reporting compliance requirement which includes documentation of the operation of the internal controls. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-001 Subject: COVID-19 - Education Stabilization Fund - Reporting Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Number: 84.425 Federal Award Numbers and Years (or Other Identifying Numbers): S424U200013, S425D200013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Finding: Material Weakness Repeat Finding This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-003. Condition and Context An effective internal control system was not designed, nor implemented, at the School Corporation to ensure compliance with requirements related to the grant agreement and the Reporting compliance requirement. The School Corporation had not designed, nor implemented, a system of internal controls to ensure the annual Elementary and Secondary School Emergency Relief (ESSER) annual Data Collection reports (Reports) were complete and accurately submitted. The School Corporation Reports were reviewed by the Assistant Deputy Treasurer and submitted by the Chief Financial Officer; however, there was no documentation provided to verify that the oversight or review process to prevent, or detect and correct, errors was performed during the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause There was no documentation that a system of internal controls had been designed and implemented by management of the School Corporation to ensure compliance with the federal award and the Reporting compliance requirement. INDIANA STATE BOARD OF ACCOUNTS 16 FRANKLIN COMMUNITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect Without an effective system of internal controls noncompliance with the federal award and the Reporting compliance requirement could have occurred. Users of the Report rely upon its accuracy to make appropriate decisions. Noncompliance with the conditions of the federal award could result in the loss of federal funding to the School Corporation. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a system of internal controls related to the federal award and the Reporting compliance requirement which includes documentation of the operation of the internal controls. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-001 Subject: COVID-19 - Education Stabilization Fund - Reporting Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Number: 84.425 Federal Award Numbers and Years (or Other Identifying Numbers): S424U200013, S425D200013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Finding: Material Weakness Repeat Finding This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-003. Condition and Context An effective internal control system was not designed, nor implemented, at the School Corporation to ensure compliance with requirements related to the grant agreement and the Reporting compliance requirement. The School Corporation had not designed, nor implemented, a system of internal controls to ensure the annual Elementary and Secondary School Emergency Relief (ESSER) annual Data Collection reports (Reports) were complete and accurately submitted. The School Corporation Reports were reviewed by the Assistant Deputy Treasurer and submitted by the Chief Financial Officer; however, there was no documentation provided to verify that the oversight or review process to prevent, or detect and correct, errors was performed during the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause There was no documentation that a system of internal controls had been designed and implemented by management of the School Corporation to ensure compliance with the federal award and the Reporting compliance requirement. INDIANA STATE BOARD OF ACCOUNTS 16 FRANKLIN COMMUNITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect Without an effective system of internal controls noncompliance with the federal award and the Reporting compliance requirement could have occurred. Users of the Report rely upon its accuracy to make appropriate decisions. Noncompliance with the conditions of the federal award could result in the loss of federal funding to the School Corporation. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a system of internal controls related to the federal award and the Reporting compliance requirement which includes documentation of the operation of the internal controls. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-001 Subject: COVID-19 - Education Stabilization Fund - Reporting Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Number: 84.425 Federal Award Numbers and Years (or Other Identifying Numbers): S424U200013, S425D200013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Finding: Material Weakness Repeat Finding This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-003. Condition and Context An effective internal control system was not designed, nor implemented, at the School Corporation to ensure compliance with requirements related to the grant agreement and the Reporting compliance requirement. The School Corporation had not designed, nor implemented, a system of internal controls to ensure the annual Elementary and Secondary School Emergency Relief (ESSER) annual Data Collection reports (Reports) were complete and accurately submitted. The School Corporation Reports were reviewed by the Assistant Deputy Treasurer and submitted by the Chief Financial Officer; however, there was no documentation provided to verify that the oversight or review process to prevent, or detect and correct, errors was performed during the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause There was no documentation that a system of internal controls had been designed and implemented by management of the School Corporation to ensure compliance with the federal award and the Reporting compliance requirement. INDIANA STATE BOARD OF ACCOUNTS 16 FRANKLIN COMMUNITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect Without an effective system of internal controls noncompliance with the federal award and the Reporting compliance requirement could have occurred. Users of the Report rely upon its accuracy to make appropriate decisions. Noncompliance with the conditions of the federal award could result in the loss of federal funding to the School Corporation. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a system of internal controls related to the federal award and the Reporting compliance requirement which includes documentation of the operation of the internal controls. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-002 Subject: COVID-19 - Education Stabilization Fund - Activities Allowed or Unallowed, Allowable Costs/Cost Principles Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Number: 84.425 Federal Award Number and Year (or Other Identifying Number): S424U200013 Pass-Through Entity: Indiana Department of Education Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles Audit Finding: Significant Deficiency Condition and Context An effective internal control system was not designed at the School Corporation to ensure compliance with requirements related to the grant agreement and the Activities Allowed or Unallowed and Allowable Costs/Cost Principles compliance requirements. The School Corporation had designed a system of internal controls to ensure payroll expenditures charged to the grant fund were allowable. However, 2 of the 44 expenditures tested did not have documentation that the internal control had been applied and operated effectively. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: INDIANA STATE BOARD OF ACCOUNTS 17 FRANKLIN COMMUNITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause An effective system of internal controls had not been designed by management of the School Corporation to ensure compliance with the federal award and the Activities Allowed or Unallowed and Allowable Costs/Cost Principles compliance requirements. An internal control had been designed but was not applied consistently to all payroll transactions. Effect Without an effective system of internal controls, noncompliance with the federal award and the Activities Allowed or Unallowed and Allowable Costs/Cost Principles compliance requirements could have occurred. Noncompliance with the conditions of the federal award could result in the loss of federal funding to the School Corporation. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a system of internal controls related to the federal award and the Activities Allowed or Unallowed and Allowable Costs/Cost Principles compliance requirements and apply the controls consistently to all transactions. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-001 Subject: COVID-19 - Education Stabilization Fund - Reporting Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Number: 84.425 Federal Award Numbers and Years (or Other Identifying Numbers): S424U200013, S425D200013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Finding: Material Weakness Repeat Finding This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-003. Condition and Context An effective internal control system was not designed, nor implemented, at the School Corporation to ensure compliance with requirements related to the grant agreement and the Reporting compliance requirement. The School Corporation had not designed, nor implemented, a system of internal controls to ensure the annual Elementary and Secondary School Emergency Relief (ESSER) annual Data Collection reports (Reports) were complete and accurately submitted. The School Corporation Reports were reviewed by the Assistant Deputy Treasurer and submitted by the Chief Financial Officer; however, there was no documentation provided to verify that the oversight or review process to prevent, or detect and correct, errors was performed during the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause There was no documentation that a system of internal controls had been designed and implemented by management of the School Corporation to ensure compliance with the federal award and the Reporting compliance requirement. INDIANA STATE BOARD OF ACCOUNTS 16 FRANKLIN COMMUNITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect Without an effective system of internal controls noncompliance with the federal award and the Reporting compliance requirement could have occurred. Users of the Report rely upon its accuracy to make appropriate decisions. Noncompliance with the conditions of the federal award could result in the loss of federal funding to the School Corporation. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a system of internal controls related to the federal award and the Reporting compliance requirement which includes documentation of the operation of the internal controls. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-001 Subject: COVID-19 - Education Stabilization Fund - Reporting Federal Agency: Department of Education Federal Program: COVID-19 - Education Stabilization Fund Assistance Listings Number: 84.425 Federal Award Numbers and Years (or Other Identifying Numbers): S424U200013, S425D200013, S425U210013, S425W210015 Pass-Through Entity: Indiana Department of Education Compliance Requirement: Reporting Audit Finding: Material Weakness Repeat Finding This is a repeat finding from the immediately prior audit report. The prior audit finding number was 2022-003. Condition and Context An effective internal control system was not designed, nor implemented, at the School Corporation to ensure compliance with requirements related to the grant agreement and the Reporting compliance requirement. The School Corporation had not designed, nor implemented, a system of internal controls to ensure the annual Elementary and Secondary School Emergency Relief (ESSER) annual Data Collection reports (Reports) were complete and accurately submitted. The School Corporation Reports were reviewed by the Assistant Deputy Treasurer and submitted by the Chief Financial Officer; however, there was no documentation provided to verify that the oversight or review process to prevent, or detect and correct, errors was performed during the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause There was no documentation that a system of internal controls had been designed and implemented by management of the School Corporation to ensure compliance with the federal award and the Reporting compliance requirement. INDIANA STATE BOARD OF ACCOUNTS 16 FRANKLIN COMMUNITY SCHOOL CORPORATION SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect Without an effective system of internal controls noncompliance with the federal award and the Reporting compliance requirement could have occurred. Users of the Report rely upon its accuracy to make appropriate decisions. Noncompliance with the conditions of the federal award could result in the loss of federal funding to the School Corporation. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the School Corporation's management establish a system of internal controls related to the federal award and the Reporting compliance requirement which includes documentation of the operation of the internal controls. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

Finding Number: 2024‐001 Repeat Finding: No Program Name/Assistance Listing Title: Education Stabilization Fund Assistance Listing Number: 84.425 Federal Agency: U.S. Department of Education Federal Award Number: S425U210038 Pass‐Through Agency: Arizona Department of Education Questioned Costs: N/A Type of Finding: Noncompliance, Significant Deficiency Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles Criteria In accordance with 2 CFR Part 200.303, the District is responsible for the establishing and maintaining effective internal control over the Federal award that provides reasonable assurance that the non‐ Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition The District’s internal approval queue in the ERP system to ensure expenditures are allowable under a federal grant was not always followed. Cause Proper approval protocols over a purchase were not adhered to during the requisition process. A District employee expedited quick approval without following standard procedures, bypassing the approver who reviews allowable costs related to federal programs. Effect A $28,570 expenditure was not reviewed or approved by an appropriate person familiar with the ESSER grant for allowability and reasonability prior to purchase. The expenditure was ultimately determined to be allowable under the federal grant. Context For one of 50 disbursements reviewed, the purchase order was not approved by the appropriate authorized District personnel prior to issuance. The sample was not intended to be, and was not a statistically valid sample. Recommendation The District should review the expenditure approval queue and ensure it is followed for all federal purchases. Additional training should be provided to ensure employees follow established procedures. The District should also consider eliminating expedited approval processes to ensure all purchases are reviewed prior to purchase. Views of Responsible Officials See Corrective Action Plan.

FINDING 2024-001 Subject: Student Financial Assistance Cluster - Special Tests and Provisions - Verification Federal Agency: U.S. Department of Education Federal Programs: Federal Supplemental Educational Opportunity Grants, Federal Work-Study Program, Federal Pell Grant Program, Federal Direct Student Loans Assistance Listings Numbers: 84.007, 84.033, 84.063, 84.268 Federal Award Number and Year (or Other Identifying Number): FY2024 Compliance Requirement: Special Tests and Provisions - Verification Audit Finding: Material Weakness Condition and Context As a recipient of the Title IV funding from the Federal Supplemental Educational Opportunity Grants (SEOG), Federal Work-Study Program (FWS), Federal Pell Grant Program (Pell), and Federal Direct Student Loans program (direct loan), the University was responsible for designing and implementing effective internal controls. The University had developed a system of internal controls over these federal programs that included policies and procedures related to the Special Tests and Provisions - Verification compliance requirement. The University had designed a key internal control that one employee would perform the required verifications, and a second employee would then review a sample of those verifications. However, the internal control was not properly implemented or operating effectively as the University had not established proper segregation of duties. The same employee responsible for performing the verifications was also responsible for reviewing those verifications during the audit period without an independent oversight, review, or approval process involving a second employee. The lack of effective internal controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Embedded within a properly designed and implemented internal control system should be internal controls consisting of policies and procedures. Policies reflect the University's management statements of what should be done to effect internal controls, and procedures should consist of actions that would implement these policies. The system of internal controls, as designed by the University's management, was not properly implemented due to a staffing shortage in the Office of Student Financial Assistance. As a result, the same employee performed and reviewed the required verifications. INDIANA STATE BOARD OF ACCOUNTS 16 UNIVERSITY OF SOUTHERN INDIANA SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect Without the proper implementation of an effectively designed system of internal controls, the internal control system cannot be capable of effectively preventing, or detecting and correcting, material noncompliance. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the University's management properly implement the system of internal controls as designed to ensure compliance with the Special Tests and Provisions - Verification compliance requirement. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-001 Subject: Student Financial Assistance Cluster - Special Tests and Provisions - Verification Federal Agency: U.S. Department of Education Federal Programs: Federal Supplemental Educational Opportunity Grants, Federal Work-Study Program, Federal Pell Grant Program, Federal Direct Student Loans Assistance Listings Numbers: 84.007, 84.033, 84.063, 84.268 Federal Award Number and Year (or Other Identifying Number): FY2024 Compliance Requirement: Special Tests and Provisions - Verification Audit Finding: Material Weakness Condition and Context As a recipient of the Title IV funding from the Federal Supplemental Educational Opportunity Grants (SEOG), Federal Work-Study Program (FWS), Federal Pell Grant Program (Pell), and Federal Direct Student Loans program (direct loan), the University was responsible for designing and implementing effective internal controls. The University had developed a system of internal controls over these federal programs that included policies and procedures related to the Special Tests and Provisions - Verification compliance requirement. The University had designed a key internal control that one employee would perform the required verifications, and a second employee would then review a sample of those verifications. However, the internal control was not properly implemented or operating effectively as the University had not established proper segregation of duties. The same employee responsible for performing the verifications was also responsible for reviewing those verifications during the audit period without an independent oversight, review, or approval process involving a second employee. The lack of effective internal controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Embedded within a properly designed and implemented internal control system should be internal controls consisting of policies and procedures. Policies reflect the University's management statements of what should be done to effect internal controls, and procedures should consist of actions that would implement these policies. The system of internal controls, as designed by the University's management, was not properly implemented due to a staffing shortage in the Office of Student Financial Assistance. As a result, the same employee performed and reviewed the required verifications. INDIANA STATE BOARD OF ACCOUNTS 16 UNIVERSITY OF SOUTHERN INDIANA SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect Without the proper implementation of an effectively designed system of internal controls, the internal control system cannot be capable of effectively preventing, or detecting and correcting, material noncompliance. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the University's management properly implement the system of internal controls as designed to ensure compliance with the Special Tests and Provisions - Verification compliance requirement. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-001 Subject: Student Financial Assistance Cluster - Special Tests and Provisions - Verification Federal Agency: U.S. Department of Education Federal Programs: Federal Supplemental Educational Opportunity Grants, Federal Work-Study Program, Federal Pell Grant Program, Federal Direct Student Loans Assistance Listings Numbers: 84.007, 84.033, 84.063, 84.268 Federal Award Number and Year (or Other Identifying Number): FY2024 Compliance Requirement: Special Tests and Provisions - Verification Audit Finding: Material Weakness Condition and Context As a recipient of the Title IV funding from the Federal Supplemental Educational Opportunity Grants (SEOG), Federal Work-Study Program (FWS), Federal Pell Grant Program (Pell), and Federal Direct Student Loans program (direct loan), the University was responsible for designing and implementing effective internal controls. The University had developed a system of internal controls over these federal programs that included policies and procedures related to the Special Tests and Provisions - Verification compliance requirement. The University had designed a key internal control that one employee would perform the required verifications, and a second employee would then review a sample of those verifications. However, the internal control was not properly implemented or operating effectively as the University had not established proper segregation of duties. The same employee responsible for performing the verifications was also responsible for reviewing those verifications during the audit period without an independent oversight, review, or approval process involving a second employee. The lack of effective internal controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Embedded within a properly designed and implemented internal control system should be internal controls consisting of policies and procedures. Policies reflect the University's management statements of what should be done to effect internal controls, and procedures should consist of actions that would implement these policies. The system of internal controls, as designed by the University's management, was not properly implemented due to a staffing shortage in the Office of Student Financial Assistance. As a result, the same employee performed and reviewed the required verifications. INDIANA STATE BOARD OF ACCOUNTS 16 UNIVERSITY OF SOUTHERN INDIANA SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect Without the proper implementation of an effectively designed system of internal controls, the internal control system cannot be capable of effectively preventing, or detecting and correcting, material noncompliance. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the University's management properly implement the system of internal controls as designed to ensure compliance with the Special Tests and Provisions - Verification compliance requirement. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-001 Subject: Student Financial Assistance Cluster - Special Tests and Provisions - Verification Federal Agency: U.S. Department of Education Federal Programs: Federal Supplemental Educational Opportunity Grants, Federal Work-Study Program, Federal Pell Grant Program, Federal Direct Student Loans Assistance Listings Numbers: 84.007, 84.033, 84.063, 84.268 Federal Award Number and Year (or Other Identifying Number): FY2024 Compliance Requirement: Special Tests and Provisions - Verification Audit Finding: Material Weakness Condition and Context As a recipient of the Title IV funding from the Federal Supplemental Educational Opportunity Grants (SEOG), Federal Work-Study Program (FWS), Federal Pell Grant Program (Pell), and Federal Direct Student Loans program (direct loan), the University was responsible for designing and implementing effective internal controls. The University had developed a system of internal controls over these federal programs that included policies and procedures related to the Special Tests and Provisions - Verification compliance requirement. The University had designed a key internal control that one employee would perform the required verifications, and a second employee would then review a sample of those verifications. However, the internal control was not properly implemented or operating effectively as the University had not established proper segregation of duties. The same employee responsible for performing the verifications was also responsible for reviewing those verifications during the audit period without an independent oversight, review, or approval process involving a second employee. The lack of effective internal controls was a systemic issue throughout the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." Cause Embedded within a properly designed and implemented internal control system should be internal controls consisting of policies and procedures. Policies reflect the University's management statements of what should be done to effect internal controls, and procedures should consist of actions that would implement these policies. The system of internal controls, as designed by the University's management, was not properly implemented due to a staffing shortage in the Office of Student Financial Assistance. As a result, the same employee performed and reviewed the required verifications. INDIANA STATE BOARD OF ACCOUNTS 16 UNIVERSITY OF SOUTHERN INDIANA SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Effect Without the proper implementation of an effectively designed system of internal controls, the internal control system cannot be capable of effectively preventing, or detecting and correcting, material noncompliance. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the University's management properly implement the system of internal controls as designed to ensure compliance with the Special Tests and Provisions - Verification compliance requirement. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

FINDING 2024-002 Subject: PPHF Geriatric Education Centers - Subrecipient Monitoring Federal Agency: U.S. Department of Health and Human Services Federal Program: PPHF Geriatric Education Centers Assistance Listings Number: 93.969 Federal Award Number and Year (or Other Identifying Number): FY2024 Compliance Requirement: Subrecipient Monitoring Audit Findings: Material Weakness, Other Matters Condition and Context The University expended $831,232 in PPHF Geriatric Education Centers funds during the audit period. Of that amount, $309,264 was passed through to three subrecipients. As a pass-through entity, the University was required to identify the award and applicable requirements and monitor the subrecipient. Procedures to monitor its subrecipients included the following:  Reviewing financial and programmatic reports as required by the University.  Following up and ensuring the subrecipient takes timely and appropriate actions on all deficiencies pertaining to the federal award provided to the subrecipient detected through audits, on-site reviews, and other means.  Issuing a management decision for audit findings pertaining to the federal award provided to the subrecipient. INDIANA STATE BOARD OF ACCOUNTS 17 UNIVERSITY OF SOUTHERN INDIANA SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) Two of the three subrecipients expended more than $750,000 in federal awards in fiscal year 2023, thus subjecting each to a Single Audit as required by the Uniform Guidance. As such, both subrecipients were required to submit a Single Audit report to the Federal Audit Clearinghouse (FAC) by March 31, 2024. The University should have expected that the two subrecipients would receive a Single Audit report as both subrecipients were subject to a Single Audit for multiple years leading up to 2023. However, the University did not obtain a copy of either subrecipient's 2023 Single Audit report. Obtaining and reviewing Single Audit reports of subrecipients is a required component of conducting proper monitoring of subrecipients. The lack of proper monitoring would not have allowed the University to follow up and ensure that the subrecipients took timely and appropriate action on all deficiencies pertaining to the federal awards passed through to the subrecipients from the University. In addition, it would not have allowed for the University to issue a management decision for audit findings pertaining to the federal award provided to the subrecipient within six months of acceptance by the FAC. The lack of effective internal controls was a systemic issue throughout the audit period. The noncompliance was isolated to two of the University's three subrecipients during the audit period. Criteria 2 CFR 200.303 states in part: "The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in 'Standards for Internal Control in the Federal Government' issued by the Comptroller General of the United States or the 'Internal Control Integrated Framework', issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). . . ." 2 CFR 200.332 states in part: "All pass-through entities must: . . . (d) Monitor the activities of the subrecipient as necessary to ensure that the subaward is used for authorized purposes, in compliance with Federal statutes, regulations, and the terms and conditions of the subaward; and that subaward performance goals are achieved. Pass-through entity monitoring of the subrecipient must include: . . . (2) Following-up and ensuring that the subrecipient takes timely and appropriate action on all deficiencies pertaining to the Federal award provided to the subrecipient from the pass-through entity detected through audits, on-site reviews, and written confirmation from the subrecipient, highlighting the status of actions planned or taken to address Single Audit findings related to the particular subaward. (3) Issuing a management decision for applicable audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521. . . ." INDIANA STATE BOARD OF ACCOUNTS 18 UNIVERSITY OF SOUTHERN INDIANA SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) 2 CFR 200.521(d) states in part: ". . . The federal awarding agency or pass-through entity responsible for issuing a management decision must do so within six months of acceptance of the audit report by the FAC. . . ." Cause Embedded within a properly designed and implemented internal control system should be internal controls consisting of policies and procedures. Policies reflect the University's management statements of what should be done to effect internal controls, and procedures should consist of actions that would implement these policies. The University's management had not designed or implemented a system of internal controls to ensure that subrecipient audit reports were received and reviewed. Effect Without the proper implementation of an effectively designed system of internal controls, the internal control system cannot be capable of effectively preventing, or detecting and correcting, material noncompliance. As a result, subrecipients to whom payments were made were not adequately monitored. The failure to establish a sufficient system of internal controls allowed noncompliance with the grant agreements and the Subrecipient Monitoring compliance requirement. Questioned Costs There were no questioned costs identified. Recommendation We recommended that the University's management establish a system of internal controls to ensure that subrecipient audit reports are received and reviewed, when required, to ensure that subrecipients are properly monitored in accordance with the federal regulations. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not maintained in written form. Questioned Costs: None Context: The College’s written information security program did not cover the following requirements as of the required deadline in June 2024: - Assess apps developed by the institution - Implement multi-factor authentication for anyone accessing customer information on the institution’s system - Dispose of customer information securely - Anticipate and evaluate changes to the information system or network. - Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. - Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). - Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). - Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Cause: These deficiencies were primarily due to insufficient resources and oversight dedicated to the development and maintenance of the written information security program. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 004: Fiscal Operations Report and Application to Participate (FISAP) Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The documents retained by the University to support amounts included in the FISAP did not agree to the FISAP. Questioned Costs: None Context: The enrollment count reported in the FISAP did not agree to supporting documentation. Cause: These errors are a result of issues with the student information system. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and verification processes to ensure the accuracy of data reported in the FISAP. This may include creating a formalized review process for the FISAP and ensuring all supporting schedules used to populate the form are centrally stored. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 005: Population for Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The College was unable to provide the required population for the students that withdrew during the fiscal year in a timely manner. Questioned Costs: None Context: The College does not have a process in place to identify students who have withdrawn and received Title IV funds. Cause: Currently, the collection of this information is a very manual process that caused the delay. Effect: The College’s single audit may be delayed. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and improves coordination among departments to ensure timely submission of required data for the Return of Funds. This may include implementing a more robust tracking system, providing additional training to staff, and establishing clear deadlines and responsibilities for data submission. Views of responsible officials: There is no disagreement with the audit finding.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not maintained in written form. Questioned Costs: None Context: The College’s written information security program did not cover the following requirements as of the required deadline in June 2024: - Assess apps developed by the institution - Implement multi-factor authentication for anyone accessing customer information on the institution’s system - Dispose of customer information securely - Anticipate and evaluate changes to the information system or network. - Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. - Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). - Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). - Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Cause: These deficiencies were primarily due to insufficient resources and oversight dedicated to the development and maintenance of the written information security program. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 004: Fiscal Operations Report and Application to Participate (FISAP) Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The documents retained by the University to support amounts included in the FISAP did not agree to the FISAP. Questioned Costs: None Context: The enrollment count reported in the FISAP did not agree to supporting documentation. Cause: These errors are a result of issues with the student information system. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and verification processes to ensure the accuracy of data reported in the FISAP. This may include creating a formalized review process for the FISAP and ensuring all supporting schedules used to populate the form are centrally stored. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 005: Population for Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The College was unable to provide the required population for the students that withdrew during the fiscal year in a timely manner. Questioned Costs: None Context: The College does not have a process in place to identify students who have withdrawn and received Title IV funds. Cause: Currently, the collection of this information is a very manual process that caused the delay. Effect: The College’s single audit may be delayed. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and improves coordination among departments to ensure timely submission of required data for the Return of Funds. This may include implementing a more robust tracking system, providing additional training to staff, and establishing clear deadlines and responsibilities for data submission. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 002: Special Tests and Provisions – NSLDS Enrollment & Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Code of Federal Regulations, 34 CFR 685.309(b), states that: Institutions must have some arrangement to report student enrollment data to NSLDS through an enrollment roster file. The institution is required to report changes in the enrollment status, the effective date of the status, and an anticipated completion date. Also, the Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Condition: During testing of the enrollment status reporting, we noted that the incorrect enrollment status and effective date was reported in NSLDS. Questioned Costs: None Context: • The enrollment status was incorrectly reported for 6 out of 40 students. • The enrollment effective date was incorrectly reported for 4 out of 40 students. Cause: These errors are a result of issues with the student information system. Effect: Student enrollment status was not reported accurately and/or timely to NSLDS. Repeat Finding: No Recommendation: The institution should evaluate their procedures and policies related to reporting status changes and effective dates to NSLDS and enhance as deemed necessary to ensure that accurate information is reported to NSLDS. Views of responsible officials: There is no disagreement with the audit finding.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not maintained in written form. Questioned Costs: None Context: The College’s written information security program did not cover the following requirements as of the required deadline in June 2024: - Assess apps developed by the institution - Implement multi-factor authentication for anyone accessing customer information on the institution’s system - Dispose of customer information securely - Anticipate and evaluate changes to the information system or network. - Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. - Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). - Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). - Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Cause: These deficiencies were primarily due to insufficient resources and oversight dedicated to the development and maintenance of the written information security program. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 004: Fiscal Operations Report and Application to Participate (FISAP) Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The documents retained by the University to support amounts included in the FISAP did not agree to the FISAP. Questioned Costs: None Context: The enrollment count reported in the FISAP did not agree to supporting documentation. Cause: These errors are a result of issues with the student information system. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and verification processes to ensure the accuracy of data reported in the FISAP. This may include creating a formalized review process for the FISAP and ensuring all supporting schedules used to populate the form are centrally stored. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 005: Population for Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The College was unable to provide the required population for the students that withdrew during the fiscal year in a timely manner. Questioned Costs: None Context: The College does not have a process in place to identify students who have withdrawn and received Title IV funds. Cause: Currently, the collection of this information is a very manual process that caused the delay. Effect: The College’s single audit may be delayed. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and improves coordination among departments to ensure timely submission of required data for the Return of Funds. This may include implementing a more robust tracking system, providing additional training to staff, and establishing clear deadlines and responsibilities for data submission. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 002: Special Tests and Provisions – NSLDS Enrollment & Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Code of Federal Regulations, 34 CFR 685.309(b), states that: Institutions must have some arrangement to report student enrollment data to NSLDS through an enrollment roster file. The institution is required to report changes in the enrollment status, the effective date of the status, and an anticipated completion date. Also, the Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Condition: During testing of the enrollment status reporting, we noted that the incorrect enrollment status and effective date was reported in NSLDS. Questioned Costs: None Context: • The enrollment status was incorrectly reported for 6 out of 40 students. • The enrollment effective date was incorrectly reported for 4 out of 40 students. Cause: These errors are a result of issues with the student information system. Effect: Student enrollment status was not reported accurately and/or timely to NSLDS. Repeat Finding: No Recommendation: The institution should evaluate their procedures and policies related to reporting status changes and effective dates to NSLDS and enhance as deemed necessary to ensure that accurate information is reported to NSLDS. Views of responsible officials: There is no disagreement with the audit finding.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not maintained in written form. Questioned Costs: None Context: The College’s written information security program did not cover the following requirements as of the required deadline in June 2024: - Assess apps developed by the institution - Implement multi-factor authentication for anyone accessing customer information on the institution’s system - Dispose of customer information securely - Anticipate and evaluate changes to the information system or network. - Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. - Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). - Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). - Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Cause: These deficiencies were primarily due to insufficient resources and oversight dedicated to the development and maintenance of the written information security program. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 004: Fiscal Operations Report and Application to Participate (FISAP) Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The documents retained by the University to support amounts included in the FISAP did not agree to the FISAP. Questioned Costs: None Context: The enrollment count reported in the FISAP did not agree to supporting documentation. Cause: These errors are a result of issues with the student information system. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and verification processes to ensure the accuracy of data reported in the FISAP. This may include creating a formalized review process for the FISAP and ensuring all supporting schedules used to populate the form are centrally stored. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 005: Population for Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The College was unable to provide the required population for the students that withdrew during the fiscal year in a timely manner. Questioned Costs: None Context: The College does not have a process in place to identify students who have withdrawn and received Title IV funds. Cause: Currently, the collection of this information is a very manual process that caused the delay. Effect: The College’s single audit may be delayed. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and improves coordination among departments to ensure timely submission of required data for the Return of Funds. This may include implementing a more robust tracking system, providing additional training to staff, and establishing clear deadlines and responsibilities for data submission. Views of responsible officials: There is no disagreement with the audit finding.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not maintained in written form. Questioned Costs: None Context: The College’s written information security program did not cover the following requirements as of the required deadline in June 2024: - Assess apps developed by the institution - Implement multi-factor authentication for anyone accessing customer information on the institution’s system - Dispose of customer information securely - Anticipate and evaluate changes to the information system or network. - Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. - Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). - Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). - Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Cause: These deficiencies were primarily due to insufficient resources and oversight dedicated to the development and maintenance of the written information security program. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 004: Fiscal Operations Report and Application to Participate (FISAP) Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The documents retained by the University to support amounts included in the FISAP did not agree to the FISAP. Questioned Costs: None Context: The enrollment count reported in the FISAP did not agree to supporting documentation. Cause: These errors are a result of issues with the student information system. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and verification processes to ensure the accuracy of data reported in the FISAP. This may include creating a formalized review process for the FISAP and ensuring all supporting schedules used to populate the form are centrally stored. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 005: Population for Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The College was unable to provide the required population for the students that withdrew during the fiscal year in a timely manner. Questioned Costs: None Context: The College does not have a process in place to identify students who have withdrawn and received Title IV funds. Cause: Currently, the collection of this information is a very manual process that caused the delay. Effect: The College’s single audit may be delayed. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and improves coordination among departments to ensure timely submission of required data for the Return of Funds. This may include implementing a more robust tracking system, providing additional training to staff, and establishing clear deadlines and responsibilities for data submission. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 002: Special Tests and Provisions – NSLDS Enrollment & Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Code of Federal Regulations, 34 CFR 685.309(b), states that: Institutions must have some arrangement to report student enrollment data to NSLDS through an enrollment roster file. The institution is required to report changes in the enrollment status, the effective date of the status, and an anticipated completion date. Also, the Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Condition: During testing of the enrollment status reporting, we noted that the incorrect enrollment status and effective date was reported in NSLDS. Questioned Costs: None Context: • The enrollment status was incorrectly reported for 6 out of 40 students. • The enrollment effective date was incorrectly reported for 4 out of 40 students. Cause: These errors are a result of issues with the student information system. Effect: Student enrollment status was not reported accurately and/or timely to NSLDS. Repeat Finding: No Recommendation: The institution should evaluate their procedures and policies related to reporting status changes and effective dates to NSLDS and enhance as deemed necessary to ensure that accurate information is reported to NSLDS. Views of responsible officials: There is no disagreement with the audit finding.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not maintained in written form. Questioned Costs: None Context: The College’s written information security program did not cover the following requirements as of the required deadline in June 2024: - Assess apps developed by the institution - Implement multi-factor authentication for anyone accessing customer information on the institution’s system - Dispose of customer information securely - Anticipate and evaluate changes to the information system or network. - Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. - Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). - Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). - Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Cause: These deficiencies were primarily due to insufficient resources and oversight dedicated to the development and maintenance of the written information security program. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 004: Fiscal Operations Report and Application to Participate (FISAP) Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Code of Federal Regulations, 34 CFR 668.24(e)(i) requires an institution to maintain records to support the data contained in the FISAP. Condition: The documents retained by the University to support amounts included in the FISAP did not agree to the FISAP. Questioned Costs: None Context: The enrollment count reported in the FISAP did not agree to supporting documentation. Cause: These errors are a result of issues with the student information system. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and verification processes to ensure the accuracy of data reported in the FISAP. This may include creating a formalized review process for the FISAP and ensuring all supporting schedules used to populate the form are centrally stored. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 005: Population for Return of Title IV Funds Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: The College was unable to provide the required population for the students that withdrew during the fiscal year in a timely manner. Questioned Costs: None Context: The College does not have a process in place to identify students who have withdrawn and received Title IV funds. Cause: Currently, the collection of this information is a very manual process that caused the delay. Effect: The College’s single audit may be delayed. Repeat Finding: No Recommendation: It is recommended that the College strengthens its internal controls and improves coordination among departments to ensure timely submission of required data for the Return of Funds. This may include implementing a more robust tracking system, providing additional training to staff, and establishing clear deadlines and responsibilities for data submission. Views of responsible officials: There is no disagreement with the audit finding.

2024 – 002: Special Tests and Provisions – NSLDS Enrollment & Reporting Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Code of Federal Regulations, 34 CFR 685.309(b), states that: Institutions must have some arrangement to report student enrollment data to NSLDS through an enrollment roster file. The institution is required to report changes in the enrollment status, the effective date of the status, and an anticipated completion date. Also, the Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Condition: During testing of the enrollment status reporting, we noted that the incorrect enrollment status and effective date was reported in NSLDS. Questioned Costs: None Context: • The enrollment status was incorrectly reported for 6 out of 40 students. • The enrollment effective date was incorrectly reported for 4 out of 40 students. Cause: These errors are a result of issues with the student information system. Effect: Student enrollment status was not reported accurately and/or timely to NSLDS. Repeat Finding: No Recommendation: The institution should evaluate their procedures and policies related to reporting status changes and effective dates to NSLDS and enhance as deemed necessary to ensure that accurate information is reported to NSLDS. Views of responsible officials: There is no disagreement with the audit finding.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P233052, P063P223052, P268K243052, P268K233052, P007A231754, P007A221754, P033A231754 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not maintained in written form. Questioned Costs: None Context: The College’s written information security program did not cover the following requirements as of the required deadline in June 2024: - Assess apps developed by the institution - Implement multi-factor authentication for anyone accessing customer information on the institution’s system - Dispose of customer information securely - Anticipate and evaluate changes to the information system or network. - Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. - Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). - Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). - Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Cause: These deficiencies were primarily due to insufficient resources and oversight dedicated to the development and maintenance of the written information security program. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.