Federal Agency: U.S. Department of Agriculture, and U.S. Department of Education Federal Program Name: Research & Development, Agriculture Extension at 1890 Land-grant Institutions, and Higher Education Institutional Aid Assistance Listing Number: 10.205, 10.512, 84.031 Federal Award Identification Number and Year: NI241445XXXXG012 - 2025, NI221444XXXXG019 - 2025, NI211444XXXXG016 - 2025, P031B220009 - 2025 Award Period: July 1, 2024 to June 30, 2025 Type of Finding: - Significant Deficiency in Internal Control over Compliance - Other Matters Criteria or specific requirement: Per Uniform Guidance 2 CFR 200.318(i), the recipient must maintain records sufficient to detail the history of each procurement transaction. These records must include the rationale for the procurement method, contract type selection, contractor selection or rejection, and the basis for the contract price. Per Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University did not go through procurement procedures prior to entering into a contract with the vendor. Questioned costs: None. Context: During our testing of the Research & Development Cluster, we identified 1 out of 8 transactions that did not go through the proper procurement procedures. During our testing of the Higher Education Institutional Aid Program, we identified 1 out of 8 transactions that did not go through the proper procurement procedures. During our testing of the Extension Services at 1890 Colleges and Tuskegee University, West Virginia State College, and Central State University Program, we identified 3 out of 8 transactions that did not go through the proper procurement procedures. Cause: The University did not have an effective control in place to ensure that the purchases went through the procurement procedures. Effect: The University was not in compliance with the regulation to go through the procurement procedures prior to entering a contract. Repeat Finding: No Recommendation: We recommend that the University review policies and procedures for procurement to ensure that every applicable transaction is going through the proper procurement procedures. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.
Federal Agency: Federal Government Federal Program Name: Research & Development, Agriculture Extension at 1890 Land-grant Institutions, and Higher Education Institutional Aid Assistance Listing Number: Multiple Federal Award Identification Number and Year: Multiple Award Period: July 1, 2024 to June 30, 2025 Type of Finding: - Material Weakness in Internal Control over Compliance Criteria or specific requirement: Uniform Grant Guidance, 2 CFR 200.313(d)(2), procedures for managing equipment (including replacement equipment), whether acquired in whole or in part under a Federal award, until disposition takes place will, as a minimum, meet the following requirements, a physical inventory of the property must be taken and the results reconciled with the property records at least once every two years. Per Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University did not have documentation of physical inventory of the equipment purchased with Federal funds. Questioned costs: None. Context: During inquiries with management, the University had been unable to fill a staffing position to help implement correct action of tracking equipment purchased with Federal funds. Cause: The University did not have an effective control in place to ensure physical inventory over equipment was completed every two years. Effect: Failure to maintain accurate inventory records inhibits the University from properly safeguarding and maintaining equipment. Repeat Finding: Yes, 2024-002 Recommendation: We recommend the University ensures that a physical inventory over equipment is completed at least every two years. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.
Finding 2025-003 — Material Weakness (Internal Control Over Compliance): Grant Accounting and Close Process Affecting Major Programs Condition: The deficiencies noted in Finding 2025-001 also affect internal control over compliance for major programs. Programs Affected: 1) ALN 14.872 – Public Housing Capital Fund and 2) ALN 97.036 – Disaster Grants – Public Assistance. Repeat finding: No. Criteria: 2 CFR 200.303 and 200.516(a) require effective internal control over compliance. Cause: Lack of a structured, documented month end and year end close process and delayed reconciliations of grant related activity. Effect: Increased risk of misclassification or reporting in the wrong period for federal awards. Questioned Costs: 1) Known questioned costs were $0 and 2) likely questioned costs were $0. Perspective / Context: The control deficiencies were observed across all grant related closing cycles reviewed for FY 2025, demonstrating a systemic process issue rather than isolated instances. Recommendation: Apply the corrective actions in Finding 2025-001, including: 1) establishing a documented monthly and year end closing calendar, 2) performing timely reconciliations of grant activity, 3) strengthening supervisory review points prior to SEFA preparation and reporting. Management Response: Management concurs and will implement the recommended improvements beginning FY 2026.
Federal Agency: U.S. Department of Education Assistance Listing Number: 84.063, 84.268 Program Expenditures: $31,997,072 Program Name: Federal Pell Grant Program, Federal Direct Student Loans Award Number(s): P063P231391, P063P241391, P063P251391, P268K241391, and P268K251391 Questioned Costs: None CONDITION: Western Illinois University (University) did not have adequate procedures in place to complete accurate enrollment reporting for all students. During our testing of Pell or Direct Loan borrowers, we noted 4 out of 40 (10%) students campus-level record and program-level record were not updated with accurate enrollment status changes. The sample was not a statistically valid sample. The University is required to report enrollment reporting changes accurately. During the year, there were underlying problems with how data was being submitted to the National Student Clearinghouse (NSC), resulting in enrollment status changes and degree confirmations to be inaccurate for 4 students tested out of 40 students tested (10% of students tested).While the University had a policy in place to ensure enrollment reporting for degree confirmations and status changes were being submitted to the NSC, there was a flaw in the University’s process that caused the fall graduate batch of students to be initially coded to “G-Not Applied” in the National Student Loan Data System (NSLDS). This was due to an error in the upload compared with underlying information in the NSLDS system. When the next batch of students were submitted to the NSLDS, this resulted in all “G-Not Applied” students to auto-update to “Withdrawn” in the NSLDS system. CRITERIA: For the Federal Pell Grant Program, 34 CFR Section 690.83(b)(2) requires an institution to submit in accordance with deadline dates established by the secretary, through publication in the Federal Register, other reports and information the secretary requires and shall comply with the procedures the secretary finds necessary to ensure that the reports are correct. For the Federal Direct Student Loans, 34 CFR Section 685.309(b) requires changes in student status to be reported to the NSLDS in accordance with enrollment reporting in transmissions sent to the NSLDS, including updating all flagged information by NSLDS. Uniform Guidance (2 CFR 200.303(a)) requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure enrollment reporting is accurate. CAUSE AND EFFECT: University officials indicated staff turnover required reassessment of internal documentation and procedures that were in place to ensure all required campus-level data and program-level data was being reported to NSLDS via NSC accurately due to a flaw in their process causing degree confirmations to be overridden. Inadequate Internal Control over Student Enrollment Reporting (Continued) Without sufficient controls around enrollment reporting there is a greater risk that student enrollment data will not be reported accurately. Inaccurate reporting of student enrollment data can result in inconsistencies between the University’s records and the National Student Loan Data System as well as potential delays in the repayment of federal loans. (Finding Code No. 2025-001, 2024-001, 2023-001, 2022-002) RECOMMENDATION: We recommend the University implement controls to ensure that all enrollment status changes and degree confirmations are being appropriately reported through NSC to NSLDS and that submissions of degree confirmations to NSC are appropriate to ensure enrollment status changes are reported accurately. UNIVERSITY RESPONSE: The University agrees wth the finding. The University is implementing enhanced internal controls to ensure enrollment status changes and degree confirmations are being appropriately submitted and reported.
Federal Agency: U.S. Department of Education Assistance Listing Number: 84.063, 84.268, 84.007, 84.379 Program Expenditures: $32,514,420 Program Name: Federal Pell Grant Program, Federal Direct Student Loans, Federal Supplemental Education Opportunity Grants, Teacher Education Assistance for College and Higher Education Grants Award Number(s): P063P231391, P063P241391, P063P251391, P268K241391, P268K251391, P007A241313, P379T241391, and P379T251391 Questioned Costs: None CONDITION: Western Illinois University (University) did not have adequate procedures in place to complete accurate and timely return of Title IV funds for all students within the required time period. During our testing of borrowers that withdrew from the University, we noted 7 out of 40 (17.5%) students return of Title IV funds were not processed within the 45 day window, ranging from 60-163 days late. The sample was not a statistically valid sample. CRITERIA : A school participating in Title IV aid programs must establish and maintain proper administrative and fiscal procedures and initiate returns accurately within 45 days after the determined date of withdrawal (34 CFR 668.173(b)), and accurately calculate the amount of unearned title IV assistance to be returned to the Department of Education (34 CFR 668.22(g)). Uniform Guidance (2 CFR 200.303(a)) requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure the return of Title IV funds is accurate and timely. CAUSE AND EFFECT: University management indicated staffing shortages as well as regulatory and systemic changes during the 2024-2025 aid year caused this to occur. Without sufficient controls in place to return Title IV funds, there is a greater risk that the school does not return funds timely or accurately or that students may not receive post-withdrawal disbursements timely or accurately. (Finding Code No. 2025-002, 2024-002, 2023-002) RECOMMENDATION: We recommend the University implement controls to ensure that all refunds of Title IV funds are initiated within 45 days of the date of determination for the students withdrawal and additional controls to ensure proper review of the return of Title IV calculations. We also recommend these controls be monitored to ensure that all necessary refunds are completed within the required time frame and accurately. UNIVERSITY RESPONSE: The University agrees with the finding. The University is committed to developing a comprehensive plan to ensure compliance with return of Title IV funds policies and procedures.
Federal Agency: Department of Agriculture Assistance Listing Number: 10.310 Program Expenditures: $1,328,494 Program Name: Oilseed Pennycress: A New Cash Cover-Crop for the Midwest Award Number(s): 2019-69012-29851 Questioned Costs: None CONDITION: Western Illinois University (University) did not have adequate procedures in place to complete a timely disbursement of requested pass-through funds to subrecipients within the required time period. During our testing of payments made on requests from subrecipients, there were 2 out of 8 (25%) tested instances of the University not disbursing funds within 30 days of the payment request, as required. For the samples mentioned, the funds were sent 32 days and 120 days after the request. The sample was not a statistically valid sample. CRITERIA: Uniform Guidance (2 CFR 200.305(b)(3)) states that when the reimbursement method is used, the Federal agency or pass-through entity must make payment within 30 calendar days after receipt of the payment request unless the Federal agency or pass-through entity reasonably believes the request to be improper. Uniform Guidance (2 CFR 200.303(a)) requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure the timely disbursement of funds to subrecipients. CAUSE AND EFFECT: The University did not have adequate procedures in place to ensure all payments to subrecipients were made within the 30 day requirement. Without sufficient controls around return over subrecipient payments and overall cash management, there is a greater risk that the school will miss a payment to be passed through to the subrecipient, thus understating expenditures on the Schedule of Expenditures of Federal Awards. (Finding Code No. 2025-003) RECOMMENDATION: We recommend the University implement controls to ensure that all payments to be passed through to subrecipients are identified and paid within the required time frame. UNIVERSITY RESPONSE: The University agrees with the finding. The University is committed to developing a comprehensive plan to ensure compliance with payment of pass-through funds policies and procedures.
Criteria or Specific Requirement: Entities receiving federal awards must identify in its accounts all federal awards expended and report those amounts on the Schedule of Expenditures of Federal Awards for the period the federal award was expensed. Specifically, in accordance with Uniform Administrative Requirements outlined in 2 CFR 200, the guidance states: • Per 2 CFR 200.502, the determination of when a Federal award is expended must be based on when the activity related to the Federal award occurs. • Per 2 CFR 200.303, entities must establish and maintain internal controls which provide reasonable assurance that federal award expenditures are in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. • In addition, per 2 CFR 200.510, the Schedule of Expenditures of Federal Awards (SEFA) must be prepared to reflect the awards for the period covered by the auditee’s financial statements. 2 CFR 200.510 also states that for costs to be allowable, they should be determined in accordance with generally accepted accounting principles (with exceptions provided in that part). Condition: The University’s year-end cutoff controls allowed for certain costs from Fiscal Year 2023 and Fiscal Year 2024 to be reported in the Fiscal Year 2025 SEFA. Context: During our testing of 40 payroll transactions, we found 1 instance of payroll related expenses that were incurred during Fiscal Year 2023 being charged to the federal program in Fiscal Year 2025 and 12 instances of payroll related expenses that were incurred during Fiscal Year 2024 being charged to the federal program in Fiscal Year 2025. Questioned Costs: Known amounts of Fiscal Year 2023 costs included in the Fiscal Year 2025 SEFA was $813 and known amounts of Fiscal Year 2024 costs included in the Fiscal Year 2025 SEFA was $23,838. Cause: Per the University, the cause for the 13 exceptions was due to the University improperly identifying the awards as State funded at inception. During Fiscal Year 2025, the University discovered that the award through the State of Oregon was Federally funded and re-indexed costs previously recorded on the State award indexes to Federal award indexes. During the re-indexing of these costs, the transaction dates of costs that were incurred during Fiscal Year 2023 and Fiscal Year 2024 were recorded with dates in Fiscal Year 2025 causing them to be included in the Fiscal Year 2025 SEFA. Effect: The University was out of compliance as it relates to identifying and reporting federal costs in the period incurred. Repeat Finding: No Recommendation: We recommend that the University evaluate its cutoff procedures to ensure that federal costs are identified and reported in the correct fiscal year. We also recommend that the University evaluate its internal controls to ensure that federal awards are properly identified as such at inception. Views of Responsible Officials: Management agrees with the finding and has developed a plan to correct the finding.
Criteria: Management is responsible for the preparation and fair presentation of the financial statements in accordance with U.S. generally accepted accounting principles (GAAP), including the proper timing of revenue recognition for costreimbursement grants in accordance with Accounting Standards Codification (ASC) 958. In addition, 2 CFR 200.303 – Internal Controls requires nonfederal entities to establish and maintain effective internal control over financial reporting and compliance to provide reasonable assurance that transactions are recorded in the proper accounting period. Further, 2 CFR 200.510(b) requires the auditee to prepare a Schedule of Expenditures of Federal Awards (SEFA) that accurately reflects federal expenditures for the fiscal year. Condition: During the audit, it was identified that cash received from federal granting agencies under cost-reimbursement grants prior to year-end were appropriately recorded as refundable advances; however, reimbursable expenditures incurred prior to year-end were not fully recognized as contribution revenue and federal expenditures in the appropriate fiscal year. As a result, audit adjustments were required to recognize contribution revenue and federal expenditures related to costs incurred prior to year-end and to update the SEFA to reflect the corrected expenditures. The updated SEFA resulted in an additional federal program being identified as a major program subject to audit. Cause: Internal controls were not sufficiently designed to ensure that reimbursement requests submitted to federal granting agencies were evaluated and incorporated into the revenue recognition and SEFA preparation process. Specifically, while cash received in advance was properly recorded as refundable advances, management did not have a control in place to identify reimbursable expenditures incurred prior to year-end and convert refundable advances to contribution revenue and federal expenditures in the appropriate fiscal period. Effect: Failure to recognize reimbursable grant revenue and federal expenditures in the proper fiscal year resulted in the understatement of contribution revenue and federal expenditures, including amounts reported on the SEFA, prior to audit adjustments. This condition affected the determination of major programs and increased the risk that federal awards may not be accurately reported for audit purposes. Questioned Costs: None. Recommendation: We recommend that management strengthen internal controls over cost-reimbursement grant accounting by implementing procedures to ensure that reimbursable expenditures are identified, reviewed, and recorded in the appropriate fiscal year. This should include reconciliation of reimbursement requests, refundable advances, recorded revenue, and amounts reported on the SEFA, along with documented supervisory review of year-end cutoff procedures. Views of Responsible Officials: Management acknowledges the above finding and will continue to enhance its year-end grant review and reconciliation procedures. During the year ended June 30, 2025, management implemented enhanced grant accounting practices, including engaging an outsourced accounting firm. Management also clarified roles and responsibilities related to federal reporting requirements and implemented additional oversight and training. Management remains committed to the ongoing improvement of internal controls over federal grant reporting and compliance.
Federal Agency: U.S. Department of Housing and Urban Development Federal Program Name: Section 811 - Project Rental Assistance Program Assistance Listing Number: 14.326 Federal Award Identification Number and Year: IL06RDD1201 - 2012; IL06RDD1301 - 2013; IL06RDD1901 - 2019 Pass-Through Agency: State of Illinois Pass-Through Number: IL902 Award Period: July 1, 2024 to June 30, 2025 Questioned Costs: None Compliance Requirement: Subrecipient Monitoring Finding 2025-001 Failure to Adequately Monitor Subrecipients CONDITION The Illinois Housing Development Authority (Authority) did not follow its established policies and procedures for monitoring subrecipients of the Section 811 Project Rental Assistance (Section 811) program. The Authority has implemented procedures whereby program staff perform property inspections over subrecipient compliance with regulations applicable to the Section 811 program. The Authority’s policies require the subrecipient to have an inspection every three years. During our testing of the monitoring of subrecipients, we noted one of eight (13%) subrecipients (with expenditures of $319,404 during the year ended June 30, 2025) had not received an inspection within the required three-year period in accordance with Authority policy. The most recent inspection for this subrecipient was conducted in fiscal year 2019. This sample was not intended to be, and was not, a statistically valid sample. CRITERIA OR SPECIFIC REQUIREMENT According to 2 CFR 200.332(e), a pass-through entity is required to monitor the activities of subrecipients as necessary to ensure that federal awards are used for authorized purposes in compliance with laws, regulations, and the provisions of contracts or grant agreements and that performance goals are achieved. In addition, 2 CFR 200.303 requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include ensuring inspections are performed in a timely manner. CAUSE Authority management indicated there are three underlying causes for this audit finding: 1) Increased volume in required inspections - the annual volume of required inspections in fiscal year 2025 was 56% higher than the annual required inspections in fiscal year 2020 while staffing remained constant. 2) COVID-19 Waivers - In 2020, the Internal Revenue Service issued COVID-19 waivers that eliminated physical inspection requirements and allowed a calendar “reset” for Low Income Housing Tax Credit transactions until 2023. The result of the increased volume and calendar “reset” created a significant backlog of physical inspections due. 3) Inadequate controls – lack of quality control procedures to ensure the inspection reports were completed and filed appropriately. EFFECT Failure to adequately perform inspections of subrecipients may result in subrecipients not properly administering the Federal programs in accordance with laws, regulations, and the grant agreement. (Finding Code No. 2025-001) RECOMMENDATION We recommend the Authority improve its internal controls to ensure inspections are completed in accordance with established policies and procedures. AUTHORITY RESPONSE The Authority agrees with the finding. The Authority will implement additional internal controls, including quality control of completed inspection, documentation, and inspection scheduling. Additionally, the Authority recognizes that the volume of required annual inspections has increased beyond existing Full Time Equivalent (FTE) capacity; therefore, an RFP for the third-party inspection vendor has been issued to supplement internal resources and support timely completion of inspections.
Special Tests – Enrollment Reporting Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ASSISTANCE LISTING Number: 84.268 – Federal Direct Student Loans 84.063 – Federal Pell Grant Program Federal Award Identification: Various Award Period: June 1, 2024 to June 30, 2025 Type of Finding: Significant Deficiency in Internal Control Over Compliance, Other Matter Criteria or specific requirement: Institutions are required to report enrollment information under the Pell grant and the Direct loan programs via the National Student Loan Data System (NSLDS) (OMB No. 1845-0035) (Pell, 34 CFR 690.83(b)(2); Direct Loan, 34 CFR 685.309). Institutions must review, update, and verify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website. There are two categories of enrollment information; “Campus Level” and “Program Level,” both of which need to be reported accurately and have separate record types. The NSLDS Enrollment Reporting Guide provides the requirements and guidance for reporting enrollment details using the NSLDS Enrollment Reporting Process. Institutions must report enrollment changes within 30 days; however, if a roster file is expected within 60 days, you may provide the updated data on that roster file. The University must also have an adequate process to internally review submissions to either the third-party servicer or directly to NSLDS. Additionally, Institutions are required to ensure adequate internal controls over compliance are established and maintained in accordance with 2 CFR 200.303. Condition: During our testing of the Direct Loan and Pell Grant programs, we selected a sample of 40 student enrollment changes to test for timeliness and accurate reporting of student status changes to the National Student Loan Data System (NSLDS). Our testing resulted in the following items of noncompliance. 1. 1 student enrollment changes where the enrollment status effective date was not correctly reported to NSLDS. 34 CFR 685.309 (b)(1) and 34 CFR 690.83(b)(2) 2. 5 instances where a student’s enrollment status change was not reported timely to NSLDS. 34 CFR 685.309(b)(1) and 34 CFR 690.83(b)(2) 3. 1 student enrollment change where status change was not reported to NSLDS. 34 CFR 685.309(b)(1) and 34 CFR 690.83(b)(2) Questioned costs: N/A Context: Out of a sample of 40 enrollment changes selected for testing for the requirement noted above, we noted 6 students with exceptions. 1 student had multiple instances of noncompliance. Cause: The university was unaware of the errors which were caused by the transmission of date between their student information system and the third-party servicer. Effect: The NSLDS system could not be updated accurately or timely with student enrollment information. Repeat finding: Yes 2024-001 Recommendation: We recommend that the University enhance its policies and procedures regarding enrollment reporting including additional monitoring over the third-party service provider to ensure that reporting is completed accurately and timely. Views of responsible officials and planned corrective actions: There is no disagreement with the audit finding. Management has addressed their corrective action plan in a separately issued letter.
Program: WIC Special Supplemental Nutrition Program for Women, Infants, and Children Federal Financial Assistance Listing Number: 10.557 Federal Grantor: U.S. Department of Agriculture Passed-Through: California Department of Public Health Award No. and Year: 22-10270 A03 and 2022 Compliance Requirements: Activities Allowed or Unallowed and Allowable Costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria: 2 CFR Section 200.303(a), Internal Controls, states that the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR Section 200.430, Compensation – Personal Services, states that charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must be supported by a system of internal control that provides reasonable assurance that the charges are accurate, allowable, and properly allocated. Condition: During our testing of the HCA’s provisions for activities allowed or unallowed and allowable costs/cost principles requirements, we noted that for one (1) of sixty (60) payroll samples tested, the employee was able to review and approve their own timecard. Cause: It was determined that the control deficiency resulted from a system configuration error that permitted the employee to approve their own timecard under the supervisor/manager review role. Effect: Failure to consistently apply internal controls over payroll charges increases the risk that unallowable or unsupported payroll costs could be charged to the Federal program and not be detected in a timely manner. Questioned Costs: No questioned costs were identified as a result of our procedures. Context/Sampling: A nonstatistical sampling of sixty (60) timecards was selected for testing out of a population of 1,144. The condition noted above was identified during our procedures related to activities allowed or unallowed and allowable costs/cost principles. Repeat Finding from Prior Years: No. Recommendation: Management should ensure appropriate segregation of duties within the payroll system by restricting approval authority to independent supervisors or managers and implementing controls to prevent self-approval. In addition, management should periodically review user access roles and system configurations to confirm that approval controls are operating as designed and that payroll charges to Federal programs are allowable, properly allocated, and adequately supported. Views of Responsible Officials: See separately issued Corrective Action Plan.
Program: Refugee and Entrant Assistance State/Replacement Designee Administered Programs Federal Financial Assistance Listing Number: 93.566 Federal Grantor: U.S. Department of Health and Human Services Pass Through: California Department of Social Services Award No. and Year: Various Compliance Requirements: Activities Allowed or Unallowed, Allowable Costs/Cost Principles, and Eligibility Type of Finding: Significant Deficiency in Internal Control Over Compliance and Instance of Noncompliance Criteria: 2 CFR Section 200.303(a), Internal Controls, states that the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 45 CFR Part 400, prescribes the eligibility conditions refugees must meet to receive RCA including the following: • RCA recipients must meet the general eligibility requirements for immigration status and refugee identification in accordance with 45 CFR §400.40 - §400.44. • RCA is limited to refugees who are ineligible for TANF, SSI, OAA, AB, APTD, and AABD in accordance with 45 CFR §400.53. • Mandatory work registrants must comply with work requirements and may not voluntarily quit or refuse suitable employment within 30 days prior to application; benefits must be terminated when requirements are not met (45 CFR §§400.75(a), 400.77, and 400.82(a)). • RCA payments may not exceed ORR-authorized rates and may not be less than the State TANF payment rate (45 CFR §§400.60(b) and 400.60(d); ORR PL 22-01). Condition: During our testing of the Social Service Agency’s (SSA) compliance with eligibility and allowable cost/cost principles, we noted the following: • One (1) instance of payment issued to a participant who did not meet eligible immigration status requirements. • One (1) instance of payment issued to a participant who was eligible for another federally funded cash assistance program. • One (1) instance of payment issued to a participant who failed to meet the mandatory work registrant requirements within the required time frame. • One (1) instance of payment issued to a participant using an incorrect benefit rate. Cause: Controls over eligibility determination and benefit rate calculation were not consistently applied, including insufficient verification and supervisory review of eligibility criteria and payment amounts. Effect: Program funds were expended for ineligible participants and an incorrect benefit rate was used, increasing the risk of noncompliance with federal requirements. Questioned Costs: Questioned costs for cases tested in which we determined to be ineligible to receive cash assistance was $1,814. Context/Sampling: A nonstatistical sample of sixty (60) out of all active program participants were sampled. For ineligible cases, we have projected questioned costs against the remaining population for a total of $24,276. The underpayment related to an incorrect benefit rate used was not projected as questioned costs as this did not result in an over-expenditure of federal funds. The condition above was identified during our procedures over eligibility, activities allowed or unallowed, and allowable costs/cost principles testing. Repeat Finding from Prior Years: Yes. Recommendation: We recommend that the SSA department strengthen its internal controls to ensure that program eligibility criteria and benefit determinations are properly supported. Views of Responsible Officials: See separately issued Corrective Action Plan.
Program: HIV Emergency Relief Project Grants (Ryan White) Federal Financial Assistance Listing Number: 93.914 Federal Grantor: U.S. Department of Health and Human Services Award No. and Year: 6H89HA00019-32-04; 2024 Compliance Requirements: Activities Allowable or Unallowed and Allowable Costs/Cost Principles Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria: 2 CFR Section 200.303(a), Internal Controls, states that the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR Section 200.430, Compensation – Personal Services, states that charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must be supported by a system of internal control that provides reasonable assurance that the charges are accurate, allowable, and properly allocated. Condition: During our testing, for one (1) out of sixty (60) payroll expenditures, we noted the timecard did not contain documented evidence of supervisory approval. Cause: The County’s internal control procedures were not consistently followed to ensure that the review and approval of timecards was documented. Effect: Lack of documented review for personnel hours could lead to an increased risk that unallowable or inaccurate activities and costs to be charged to the Federal program. Question Costs: No questioned costs were identified as a result of our procedures. Context/Sampling: A nonstatistical sampling of sixty (60) timecards were selected for testing out of a population of 5,994. The condition noted above was identified during our procedures related to activities allowed or unallowed and allowable costs/cost principles. Repeat Findings from Prior Years: No. Recommendation: We recommend that the County strengthen its policies and procedures to ensure that timecards consistently include documented evidence of supervisor approval prior to payroll processing. The County should also establish compensating controls for circumstances where timely supervisory approvals is not possible, and ensure such controls are consistently documented. Views of Responsible Officials: See separately issued Corrective Action Plan.
Program: Congressionally Recommended Awards / HOME Investment Partnerships Program / Homeland Security Grant Program / Epidemiology and Laboratory Capacity for Infectious Disease Federal Financial Assistance Listing Number: 16.753 / 14.239 / 97.067 / 93.323 Federal Grantor: U.S. Department of Justice / U.S. Department of Housing and Urban Development / U.S. Department of Homeland Security / U.S. Department of Health and Human Services Award No. and Year: Multiple Compliance Requirements: Other – Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) §200.510(b) - Schedule of Expenditures of Federal awards Type of Finding: Material Weakness in Internal Control Over Compliance Criteria: Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) §200.510(b) states that the auditee (the County) must prepare a Schedule of Expenditures of Federal Awards (SEFA) for the period covered by the auditee’s financial statements, which must include the total federal awards expended as determined in accordance with §200.502. §200.331 of the Uniform Guidance states the County is responsible for making case-by-case determinations to determine whether the entity receiving the Federal funds is a subrecipient. In addition, §200.303 of the Uniform Guidance states that the County must establish and maintain effective internal control over the federal awards, including controls over the accuracy of program information and expenditure amounts. Condition: During our audit procedures performed over the SEFA we noted the following: • The Sheriff-Coroner Department did not properly identify the amount expended for the Congressionally Recommended Awards, AL No. 16.753. The expenditures reported by the Department were overstated by $2,638,516. • The Orange County Community Resources Department did not properly identify the amount of Federal funding passed through to subrecipients for the HOME Investment Partnerships Program, AL No. 14.239. The amount passed through to subrecipients reported by the Department was overstated by $4,500,624. • The Sheriff-Coroner Department did not properly identify the amounts expended for the Homeland Security Grant Program, AL No. 97.067. The expenditures reported by the Department were overstated by $715,489. • The Orange County Health Care Agency (HCA) did not properly identify the amount expended for the Epidemiology and Laboratory Capacity for Infectious Disease program, AL No. 93.323. The expenditures reported by the Agency were overstated by $486,000. Cause: As a result, the County lacked adequate internal controls to ensure the SEFA is completely and accurately stated. Specifically, the County’s processes for recording and tracking expenditures of Federal awards are not designed so that expenditures are identified when incurred. In addition, the County’s processes for identifying and reporting subrecipients are not designed to ensure appropriate reporting on the SEFA. Effect: Adjustments to the SEFA were required. Questioned Costs: No questioned costs were identified as a result of our procedures. Context/Sampling: No sampling was used. Program expenditures and amounts passed through to subrecipients were reconciled to the supporting records. Repeat Finding from Prior Years: No. Recommendation: The County, including all its reporting departments, should follow existing policies, procedures and internal controls to ensure all expenditures and amounts passed through to subrecipients are accurately tracked and reported on the SEFA. Personnel knowledgeable of federal expenditures should review amounts coded to federal programs for completeness and accuracy. The SEFA should be prepared and reviewed in a timely manner and reconciled to underlying records as well as the basic financial statements. Views of Responsible Officials: See separately issued Corrective Action Plan.
Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.063, 84.268, 84.007, 84.033 Criteria or Specific Requirement: Per 2 CFR section 200.303(a), a nonfederal entity must: Establish and maintain effective internal control over the federal award that provides reasonable assurance that the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework,” issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During the audit, it was observed that the University did not have adequate segregation of duties in its financial aid office and did not maintain supporting documentation. The Director of Financial Aid prepares is responsible for authorizing, processing, and reviewing transactions related to Title IV funds. Questioned Costs: N/A Context: Effective internal controls are crucial to ensure funds are properly managed and disbursed. There are instances where the Director of Financial Aid is reviewing and approving financial aid packages, reconciliations and other required reports. We also noted instances were supporting documentation could not be provided. Cause: The University’s financial aid processes have overlapping responsibilities which has resulted in inadequate segregation of duties. Effect: The absence of proper segregation of duties increases risk for errors, noncompliance, and inaccuracies in awarding and reporting of Title IV funds. Repeat Finding: No Recommendation: We recommend the University implement additional internal controls to ensure proper segregation of duties. This includes hiring additional staff or redistributing responsibilities to separate the functions of authorizing, processing, and reviewing transactions. Additionally, ongoing training should be provided to financial aid staff on the importance of internal controls and compliance with Title IV regulations. Views of Responsible Officials: There is no disagreement with the audit finding and the University is in the process of implementing corrective procedures. Federal Award Identification Number: P007A243144, P063P241946, P033A243144, P268K251946 Award Period: July 1, 2024 – June 30, 2025 Type of Finding: Material Weakness in Internal Control over Compliance
Criteria or Specific Requirement: Per 2 CFR 200.303 - Internal Controls and the OMB Compliance Supplement: Education Stabilization Fund, Reporting- The District is required to have internal controls, including segregation of duties, over reporting for quarterly expenditure claims. These internal controls should be effective in preventing, detecting, and correcting misstatements in the reports. Condition: Multiple individuals are responsible for the preparation and submission of the District's quarterly expenditure reports; however, the expenditure reports filed for September 30, 2024 included expenditures in the amount of $22,040 that were neither obligated nor liquidated by the date of the report. Questioned Costs: None. Context: The District's internal controls did not identify and correct a material misstatement in the Septmeber 30, 2024 expenditure report for the 2025 Covid-19 - Community Partnership grant - C3 program. Effect: The September 30, 2024 expenditure report was filed overstating expenditures by $22,040. Cause: The individual responsible for reviewing the expenditure report did not have adequate knowledge of the federal reporting requirements; consequently, errors on quarterly expenditure reports were not identified in the review. Recommendation: Personnel with adequate knowledge of reporting requirements should review all expenditure reports to ensure any errors are identified and corrected before the expenditure report is submitted. Management's Response: Management does not disagree with this finding, and competent personnel will review all future expenditure reports.
2025-002 – Activities Allowed or Unallowed, Allowable Costs/Cost Principles – Significant Deficiency in Internal Control over Compliance and Noncompliance Federal Agencies: Department of Agriculture Federal Assistance Listing Numbers: 10.182 Programs: Pandemic Relief Activities: Local Food Purchase Agreements with States, Tribes, and Local Governments Award/Pass-Through Entity Identifying Numbers: F4303 Criteria: The Uniform Guidance in 2 CFR §200.303 requires that non-federal entities receiving federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with federal statues, regulations, and the terms and conditions of the federal award. Per 2 CFR §200.403(e), costs must be in accordance with Generally Accepted Accounting Procedures (GAAP) to be allowable under federal awards. Condition: During the testing of non-payroll related costs for the year ended June 30, 2025, two of 20 transactions selected for testing within the program were incurred in the year ended June 30, 2024. This practice is not in accordance with GAAP, which requires that costs be recorded in the period in which they are incurred. Both transactions were incurred and reported within the grant’s period of performance. Cause: The Organization did not have adequate policies and procedures in place to ensure that federal expenditures are properly accrued and recorded in the fiscal year in which the costs are actually incurred. Effect or Potential Effect: Failure to accrue costs in accordance with GAAP may result in expenditures being materially misstated on the schedule of expenditures of federal awards that could lead to inaccurate reporting to the federal agencies. Questioned Costs: Known Questioned Costs: $5,095 Likely Questioned Costs: $31,125 Context: This is a condition identified per review of the Organization’s compliance with specified requirements not using a statistically valid sample. Known questioned costs are $5,095 out of the total non-payroll related costs during the year ended June 30, 2025, which were $443,033. Identification as a Repeat Finding: Not a repeat finding. Recommendation: We recommend the Organization implement policies and procedures to accrue for federal expenditures in the period the costs were incurred to ensure costs are being recorded in accordance with GAAP and the schedule of expenditures of federal awards is representative of all federal expenditures incurred in the reporting year. Views of Responsible Officials: Management agrees with the finding. Management is formalizing and enhancing policies and procedures over cutoff and accruals.
2025-003 – Activities Allowed or Unallowed, Allowable Costs/Cost Principles – Significant Deficiency in Internal Control over Compliance Federal Agencies: Department of Housing and Urban Development Federal Assistance Listing Numbers: 14.239 Programs: Home Investment Partnerships Program Award/Pass-Through Entity Identifying Numbers: #165 59601114110 Criteria: The Uniform Guidance in 2 CFR §200.303 requires that non-federal entities receiving federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with federal statues, regulations, and the terms and conditions of the federal award. Condition: Internal controls failed to prevent or detect an incorrect unallowable cost from being allocated to the grant. The cost was able to be replaced with allowable costs. Cause: Employees responsible for determining the allowability of costs did not have adequate training on allowably costs.. Effect or Potential Effect: Without adequate controls to ensure that costs allocated to federal programs are allowable, the Organization could incorrectly charge expenditures to the federal program. Questioned Costs: None. Context: This is a condition identified per review of the Organization’s compliance with specified requirements not using a statistically valid sample. The cost was replaced with allowable costs. Identification as a Repeat Finding: Not a repeat finding. Recommendation: We recommend the Organization ensure internal controls are designed and performed by individuals with sufficient training on federal awards and allowable costs. Views of Responsible Officials: Management agrees with the finding. Management is strengthening internal controls over allowable costs and providing additional training to staff working with federal awards.
2025-005 – Special Tests and Provisions, Wage Rate Requirements – Significant Deficiency in Internal Control over Compliance Federal Agencies: Department of Housing and Urban Development Federal Assistance Listing Numbers: 14.251 Programs: Economic Development Initiative, Community Project Funding, and Miscellaneous Grants Award/Pass-Through Entity Identifying Numbers: B-23-CP-WA-1539 Criteria: The Uniform Guidance in 2 CFR §200.303 requires that non-federal entities receiving federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with federal statues, regulations, and the terms and conditions of the federal award. Nonfederal entities shall include in their construction contracts subject to the Wage Rate Requirements (which still may be referenced as the Davis-Bacon Act) a provision that the contractor or subcontractor comply with those requirements and the DOL regulations (29 CFR Part 5, Labor Standards Provisions Applicable to Contacts Governing Federally Financed and Assisted Construction). This includes a requirement for the contractor or subcontractor to submit to the nonfederal entity weekly, for each week in which any contract work is performed, a copy of the payroll and a statement of compliance (certified payrolls). Condition: The Organization did not implement internal controls to ensure certified payrolls were being submitted. During the testing of certified payrolls, it was identified that three of 21 contractor and subcontractor selections of certified payrolls were not being submitted timely. Cause: Internal controls were not designed to ensure the certified payrolls were being submitted timely and were received and reviewed by the nonfederal entity with each pay application from the contractor. Effect or Potential Effect: Certified payrolls could fail to be prepared and/or wages not in accordance with federal requirements could be allowed in error. Questioned Costs: None. Context: This is a condition identified per review of the Organization’s compliance with specified requirements not using a statistically valid sample. Total contractor costs were $1,162,720. Identification as a Repeat Finding: Not a repeat finding. Recommendation: We recommend the Organization provide training to staff on all applicable compliance requirements to the Organization and implement internal controls to ensure certified payrolls are received prior to payment of a pay application. Views of Responsible Officials: Management agrees with the finding. Management is establishing policies and procedures to ensure certified payrolls are received by contractors and subcontractors at regular intervals over the course of a project.
Federal Agency: Department of Education Federal Program Name: Wisconsin Charter Schools Program Waiver Cohort Assistance Listing Number: 84.282 Pass-Through Agency: Wisconsin Department of Public Instruction Pass-Through Number(s): 2025-138005-DPI-WCSPWC1-360 Award Period: July 1, 2024 through June 30, 2025 Type of Finding: Material Weakness in Internal Control over Compliance and Other Matter Criteria: According to 2 CFR, Part 200.303 of the Office of Management and Budget’s Uniform Grant Guidance, a non-Federal entity must establish and maintain effective internal controls to ensure compliance with federal statutes, regulations, and the terms and conditions of federal awards. Condition: One City Schools, Inc. did not have a process in place to review funding claims prior to submission. Questioned costs: None Context: We sampled 5 cash management requests, noting that 3 were not reviewed prior to submission. Cause: Policies and procedures were put in place, but were not being followed. Effect: Incomplete or inaccurate information could be reported on funding claims. Repeat Finding: Yes (2024-004) Recommendation: One City Schools, Inc. should implement appropriate internal controls for reviewing funding claims prior to submission. Views of responsible officials: One City Schools, Inc. agrees with the finding and are working on implementing policies and procedures over reviewing claims prior to submission.
Federal Agency: Department of Education Federal Program Name: Wisconsin Charter Schools Program Waiver Cohort Assistance Listing Number: 84.282 Pass-Through Agency: Wisconsin Department of Public Instruction Pass-Through Number(s): 2025-138005-DPI-WCSPWC1-360 Award Period: July 1, 2024 through June 30, 2025 Type of Finding: Material Weakness in Internal Control over Compliance and Other Matter Criteria: According to 2 CFR, Part 200.303 of the Office of Management and Budget’s Uniform Grant Guidance, a non-Federal entity must establish and maintain effective internal controls to ensure compliance with federal statutes, regulations, and the terms and conditions of federal awards. Condition: One City Schools, Inc. did not have controls in place to ensure period of performance requirements were adhered to. Questioned costs: None Context: We identified 3 expenditures not recorded correctly as they were not incurred by year-end and were subsequently removed from the SEFSA. Cause: Policies and procedures were put in place, but were not being followed. Effect: This could result in noncompliance, disallowed costs, or discontinuance of federal funding. Repeat Finding: No Recommendation: We recommend that the Organization maintain effective internal controls over period of performance requirements. Views of responsible officials: One City Schools, Inc. agrees with the finding and are working on implementing internal controls over period of performance.
Criteria According to 34 CFR Section 685.309, under the Federal Direct loan program, institutions must complete and return the Enrollment Reporting roster file via the National Student Loan Data System (NSLDS) within the timeframe prescribed by the Secretary. Unless the institution plans to submit its next updated enrollment report to the Secretary within 60 days, a school must notify the Secretary within 30 days after the date that the school discovers a change. An institution determines how often it receives the Enrollment Reporting roster file with the default set at a minimum of every 60 days to ensure attendance changes for students are reported within 60 days of the change. An institution must notify the Secretary of Education if it discovers that a loan under Title IV of the Act was made to or on behalf of a student who was enrolled or accepted for enrollment at the school, and the student has ceased to be enrolled on at least a half -time basis or failed to enroll on at least a half-time basis for the period for which the loan was intended. Internal controls 2 CFR 200.303(a) states the non-federal entity must establish and maintain effective internal control over the federal award that provides reasonable assurance that the non-federal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).Condition During our audit we found one (1) of forty (40) students selected for testing whose enrollment status was not timely transmitted to NSLDS. KPMG notes that for this exception, the student’s enrollment status was never reported to NSLDS although the College was aware of their enrollment status. Because the College did not have a significant number of students impacted by the specific cause for the exception noted, the noncompliance is not a reportable finding. However, the College did not have a control in place to identify errors in enrollment status transmissions and this control deficiency is considered to be a significant deficiency. Cause The condition resulted from the College’s internal controls not being designed at a level of precision to ensure all enrollment status changes are accurately and timely transmitted to NSLDS. Possible Asserted Effect Not identifying inaccurate, delayed, or lack of submission of student enrollment status information could have impacted the determinations that lenders and services of student loans make related to in-school status, deferments, grace periods, and repayment schedules, as well as the federal government’s payment of interest subsidies. Questioned Costs No questioned costs were identified. Statistical Sampling The sample was not intended to be, and was not, a statistically valid sample. Repeat Finding The conditions found do not constitute a repeat finding from the prior year. Recommendation We recommend that the College review its processes to ensure that appropriate controls are put in place to identify any errors in the reporting of enrollment changes. Views of College Officials Recommendation accepted. Please refer to corrective action plan.
Finding 2025-004: Payroll Processing Controls Criteria: In accordance with 2 CFR §200.303, management is responsible for establishing and maintaining effective internal control over federal awards, including controls to ensure payroll transactions are processed accurately and timely. Condition: During control testing over a major federal program, three instances were identified where payroll changes were not entered into the payroll system in a timely manner; however, the Organization subsequently processed appropriate retroactive adjustments. Cause: The Organization lacks procedures to ensure payroll changes are entered timely and reviewed for accuracy. Effect: Employees may not be compensated accurately or timely, and payroll expenses could be recorded in an incorrect period. Although corrections may be made, errors may not be identified or resolved in a timely manner. Recommendation: Management should implement procedures to ensure all approved payroll changes are entered timely into the payroll system and reviewed for accuracy.
Compliance Requirements: Activities Allowed or Unallowed Allowable Costs/Cost Principles Procurement Suspension and Debarment Internal Control Impact: Significant Deficiency Compliance Impact: Nonmaterial Noncompliance Federal Awarding Agency: U.S. Department of Agriculture Pass-Through Entity: Georgia Department of Education AL Numbers and Titles: 10.553 – School Breakfast Program; 10.555 – National School Lunch Program Federal Award Number: 255GA32N1199 (Year: 2025) Questioned Costs: None Identified Description: A review of expenditures charged to the Child Nutrition Cluster revealed that the School District’s internal control procedures were not operating appropriately to ensure that expenditures are reviewed and approved prior to payment. Background Information: The Child Nutrition Cluster (CNC) is comprised of various programs that are intended to assist states in administering and overseeing food service program operators that provide healthful, nutritious meals to eligible children in public and non-profit private schools, residential childcare institutions, and summer programs. This Cluster of programs also fosters healthy eating habits in children by providing fresh fruits and fresh vegetables to children attending elementary and secondary schools and encourages the domestic consumption of nutritious agricultural commodities. CNC funding is granted to the Georgia Department of Education (GaDOE) by the U.S. Department of Agriculture, and GaDOE is responsible for distributing funds to local educational agencies (LEAs) and overseeing the various CNC programs. CNC funds totaling $1,582,957.71 were expended and reported on the Screven County Board of Education’s Schedule of Expenditures of Federal Awards (SEFA) for fiscal year 2025. Criteria: As a recipient of federal awards, the School District is required to establish, document, and maintain effective internal control over federal awards that provides reasonable assurance of managing the federal awards in compliance with federal statutes, regulations, and the terms and conditions of the federal awards pursuant to Title 2 U.S. Code of Federal Regulations (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), Section 200.303 – Internal Controls. Condition: Auditors performed a review of various expenditure activity associated with the CNC programs to determine if appropriate internal controls were implemented and applicable compliance requirements were met. The following deficiencies were identified: • A sample of 40 expenditures was randomly selected for testing using a nonstatistical sampling approach. Evidence of review and approval was not reflected for seven of the expenditures tested. • A sample of 40 procurement transactions was randomly selected for testing using a non-statistical sampling approach. Evidence of review and approval was not reflected for five of the transactions tested. Cause: The School District did not follow its policies and procedures that govern the approval of expenditure for federal programs. Effect: The School District was not in compliance with the Uniform Guidance and GaDOE guidance related to the CNC programs. Failure to ensure that expenditures are appropriately approved exposes the School District to unnecessary risk of error and misuse of federal funds and could result in the expenditure of federal funds for unallowable purposes and/or with unqualified vendors. In addition, this deficiency could lead to the return of grant funds associated with unallowable expenditures. Recommendation: The School District should evaluate and improve internal control procedures to ensure that expenditures are reviewed and approved prior to payment. In addition, management should develop a monitoring process to ensure that these procedures are operating appropriately. Views of Responsible Officials: We concur with this finding
Criteria or Specific Requirement: Per 2 CFR 200.303 - Internal Controls and the OMB Complaince Supplement: Child Nutrition Cluster, Reporting - The District is required to have internal controls, including segregation of duties, over reporting of monthly reimbursement claims. Condition: The same individiual is responsible for preparing and submitting monthly reimbursement claims for the Child Nutrition Program without an independent review or approval before submission. Questioned Costs: The condition has resulted in no identified questioned costs. Context: Currently one individual is responsible for preparing and submitting the monthly reimbursement claims. Effect: Meal claims could be submitted to the Illinois State Board of Education that do not accurately reflect the number of meals served. Consequently, the District could be over- or under-reimbursed by this program. Cause: Abscense of formal internal control procedures resulted in one person performing all reporting functions. Recomendation: Implement segregation of duties by requiring one person to prepare the monthly claim and a second person (e.g., supervisor) to review and approve the claim before submission. The review should be suppported with signatures or electronic approval logs. Management's Reponse: A corrective action plan will be developed and implemented. A secondary review of the meal claim to the supporting documents will be performed before the meal claim is submitted.
Criteria or Specific Requirement: Per 2 CFR 200.303 a grant recipient must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: The District's internal controls did not affectively monitor the grant budget. Questioned Costs: None. Context: The District did not compare actual expenditures in each grant line item with available remaining budget amounts. Effect: The District claimed expenditures in grant lines that had already been fully expended. Cause: When expenditures were reviewed and approved they were not compared to the remaining budget. Recommendation: The District should accurately track the actual expenditures compared to the remaining budget for each grant line. Management's Response: The District agrees with the finding and a corrective action plan and proper internal controls will be implemented.
Criteria or Specific Requirement: Per 2 CFR 200.303 a grant recipient must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient managing the Federal award in compliance with Federal statues, regulations, and the terms and conditions of the Federal award. Condition: Management reviewed expenditure reports prior to submission, however this review did not detect or correct errors in the expenditure report. Questioned Costs: None. Context: The District submitted innacurate expenditure reports which did not agree with the accounting records. Effect: The District reported expenditures that could not be supported by the accounting records. Cause: When the expenditure reports were reviewed they were not accurately compared to the accounting records. Recommendation: Management's review of the expenditure reports should include a comparison of the functions and objects reported on the report to the accounting records. Management's Response: The District agrees with the finding and a corrective action plan and proper internal controls will be implemented.
2025-001 Procurement Suspension and Debarment U.S. Department of Education: Innovative Approaches to Literacy, Promise Neighborhoods, Full-Service Community Schools, And Congressionally Directed Spending for Elementary and Secondary Education Community Projects (ALN 84.215K) Grant Number and Award Year: S215K240115 (09/06/2024 – 03/21/2025) Statistically Valid Sample: No, and it was not intended to be Prior Year Finding: Not a repeat finding Finding Type: Material Weakness and Noncompliance Criteria: Non-federal entities are prohibited from contracting with or making subawards under covered transactions to parties that are suspended or debarred. Covered transactions include contracts for goods and services awarded under a non-procurement transaction (e.g., grant or cooperative agreement) that are expected to equal or exceed $25,000 or meet certain other criteria as specified in 2 CFR section 180.220. When a non-federal entity enters into a covered transaction with an entity at a lower tier, the non-federal entity must verify that the entity, as defined in 2 CFR section 180.995 and agency adopting regulations, is not suspended or debarred or otherwise excluded from participating in the transaction. This verification may be accomplished by (1) checking the System for Award Management (SAM) Exclusions maintained by the General Services Administration (GSA) and available at SAM.gov | Home (click on Search Record, then click on Advanced Search Exclusions) (Note: The OMB guidance at 2 CFR Part 180 and agency implementing regulations still refer to the SAM Exclusions as the Excluded Parties List System (EPLS)), (2) collecting a certification from the entity, or (3) adding a clause or condition to the covered transaction with that entity (2 CFR section 180.300). Additionally, in accordance with 2 CFR section 200.303, the Organization shall maintain internal controls over Federal programs designed to provide reasonable assurance that transactions are executed in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award that could have a direct and material effect on a Federal program. Effective internal controls should include procedures to ensure when a non-federal entity enters into a covered transaction with an entity at a lower tier, the non-federal entity must verify that the entity, as defined in 2 CFR section 180.995 and agency adopting regulations, is not suspended or debarred or otherwise excluded from participating in the transaction. Condition and Context: The Organization received federal grant funds from the U.S. Department of Education and a portion of these funds were contracted to a third-party vendor through a sole-source procurement transaction, given the specialized nature of the services to be procured, in which management of the Organization adequately documented its rationale for the sole-source procurement in accordance with federal rules and regulations Because of the dollar value of the funds provided, the Organization entered into a covered transaction with this third-party vendor. The Organization did not verify that the third-party vendor was not suspended or debarred prior to entering into the covered transaction. However, it was determined that the third-party vendor was not suspended or debarred at the time the Organization entered into the covered transaction upon checking the third-party vendor’s status on the SAM Exclusions maintained by the GSA on the SAM.gov website. Cause: The Organization did not have a formal process in place to include a suspension and debarment check prior to entering into covered transactions and therefore a check was not performed. Effect: Funds could have been provided to an entity who was suspended or debarred. Questioned Costs: No questioned costs were noted as the third-party vendor was ultimately determined not to be suspended or debarred at the time the covered transaction was entered into by the Organization. Recommendation: We recommend the Organization review its current policies and procedures to ensure that a suspension and debarment check is performed for all covered transactions prior to entering into the covered transaction. Views of Responsible Officials: Management agrees with the finding as the Organization did not perform a suspension and debarment check on the vendor prior to entering into a covered transaction. The Organization will ensure that a suspension and debarment check is performed for all covered transactions prior to entering into the covered transaction.
Federal Agency: US Department of Education Federal Program Name: Higher Education Institutional Aid Assistance Listing Number: 84.031X Federal Award Identification Number and Year: P031X230004 - 2025, P031X200017 - 2025 Award Period: July 1, 2024 to June 30, 2025 Type of Finding: Compliance, Other Matter Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.430(g)(1)(vi), Charges to federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records should support the distribution of the employee's salary or wages among specific activities or cost objectives if the employee works on more than one federal award; a federal award and nonfederal award; an indirect cost activity and a direct cost activity; two or more indirect activities allocated using different allocation bases; or an unallowable activity and a direct or indirect cost activity. Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The College did not have proper documentation of Time and Effort reporting. Questioned costs: None. Context: During our testing of 40 payroll transactions, we identified four employees’ time and effort reports that were not documented properly to track hours worked on federal grants. Cause: The College did not have proper procedures in place to track time and effort for all personnel on federal grants. Effect: The College could potentially expend incorrect amounts to federal grants. Repeat Finding: No Recommendation: We recommend the College review policies and procedures to ensure all personnel on federal grants have documented time and effort reports as stated in federal regulations. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.
Federal Agency: US Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: 84.063, 84.268, 84.033, 84.007 Federal Award Identification Number and Year: P063P24032 - 2025, P268K252032 - 2025, P033A243410 - 2025, P007A243410 - 2025 Award Period: July 1, 2024 to June 30, 2025 Type of Finding: Compliance, Other Matter Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 675.18(g) require institutions to use at least 7% of the sum of its initial and supplemental Federal Work Study allocation for an award year to compensate students employed in community service activities unless a waiver is obtained from the Department of Education. Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The College did not meet the community service requirement for its Federal Work Study program. Questioned costs: None. Context: The College did not use at least 7% of its Federal Work Study (FWS) funds for students employed in community service activities. Cause: Due to several staff turnovers in the Financial Aid Office, the community service waiver request was discovered to not have been completed by the submission deadline. Effect: If the College fails to meet any of the FWS community service requirements, then they will be required to return FWS federal funds in an amount equal to the difference between the amount a school should have spent for community service and the amount it actually spent. The College could also be denied future participation in the FWS Program and possibly other FWS programs. Repeat Finding: No Recommendation: We recommend the College review current processes for calculating and tracking the students employed in community service activities for its Federal Work Study funds to meet the minimum 7% requirement.
Federal Agency: US Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: 84.063, 84.268, 84.033, 84.007 Federal Award Identification Number and Year: P063P24032 - 2025, P268K252032 - 2025, P033A243410 - 2025, P007A243410 - 2025 Award Period: July 1, 2024 to June 30, 2025 Type of Finding: Compliance, Other Matter Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Department of Education requires institutions to report the disbursement dates and amounts to the Common Origination and Disbursement (COD) system within 15 days of disbursing Pell (34 CFR 690.83(b)(2) and Direct Loan (34 CFR 685.309) funds to a student. Per Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: During testing of Common Origination and Disbursement (COD) reporting, we noted one instance of noncompliance. Questioned costs: None. Context: During our testing of 40 COD disbursements we noted, one Pell disbursement was not reported within the required 15 days. Cause: The College did not have proper control or procedures in place to verify disbursements were reported to COD within the required 15 days after disbursement. Effect: A lack of timely reporting may prevent the College and other schools from having the most accurate student information which may lead to over awards. Repeat Finding: No Recommendation: We recommend the College evaluate its procedures and policies around reporting disbursements to COD to ensure that student information is reported accurately and timely. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.
Federal Agency: US Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: 84.063, 84.268, 84.033, 84.007 Federal Award Identification Number and Year: P063P24032 - 2025, P268K252032 - 2025, P033A243410 - 2025, P007A243410 - 2025 Award Period: July 1, 2024 to June 30, 2025 Type of Finding: Compliance, Other Matter Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The amount of a student's Pell Grant for an academic year is based upon the payment and disbursement schedules published by the Secretary for each award year (34 CFR 690.62) The Code of Federal Regulations (34 CFR 690.80(b)(1)) states if the student’s enrollment status changes from one academic term to another within the same award year, the institution shall recalculate the Federal Pell Grant award for the new payment period taking into account any changes in the cost of attendance. Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The College under-awarded funds for the Pell Grant. Questioned costs: $909 Context: During our testing, we identified one out of 40 students were awarded and disbursed less Pell funds than should have been awarded based on the 2024-2025 Pell payment schedule. The Pell payment schedule considers the cost of attendance, the student's Student Aid Index and the enrollment status of the student. Cause: The College did not have proper procedures in place to capture student enrollment in summer to be packaged for Pell. Effect: Failure to properly determine and disburse Title IV funds based on eligibility for each type of aid in accordance with federal regulations may result in students receiving incorrect funds. Repeat Finding: Yes, 2024-005 Recommendation: We recommend the College review its current procedures for awarding Title IV funds and implement any changes necessary to ensure federal funds are awarded and disbursed in accordance with federal regulations. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.
Federal Agency: US Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: 84.063, 84.268, 84.033, 84.007 Federal Award Identification Number and Year: P063P24032 - 2025, P268K252032 - 2025, P033A243410 - 2025, P007A243410 - 2025 Award Period: July 1, 2024 to June 30, 2025 Type of Finding: Compliance, Other Matter Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 685.309(b), states the school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date. Per Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The College did not properly report student enrollment changes for students who received federal student aid to the National Student Loan Data System (NSLDS). Questioned costs: None Context: During our testing of 40 students, we identified four students that had Program enrollment effective dates that did not match institutional records and one student that was reported after the 60- day reporting requirement. Cause: The College didn't have proper procedures in place to verify students' status in NSLDS matched the institutions records accurately and submitted timely. Effect: The College was not in compliance with the requirements to properly report student enrollment data correctly. Incorrect dates submitted to NSLDS may be used to determine the grace period for the repayment and interest of outstanding Title IV student loans. Repeat Finding: Yes, 2024-002 Recommendation: We recommend the College review current processes for reporting to NSLDS and implement procedures to ensure submissions are reported timely and accurately. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.
Federal Agency: US Department of Education Federal Program Name: Student Financial Assistance Cluster Assistance Listing Number: 84.063, 84.268, 84.033, 84.007 Federal Award Identification Number and Year: P063P24032 - 2025, P268K252032 - 2025, P033A243410 - 2025, P007A243410 - 2025 Award Period: July 1, 2024 to June 30, 2025 Type of Finding: Compliance, Other Matter Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: 34 CFR 668.21(a) states that the institution must return all title IV, HEA program funds that were credited to the student's account at the institution or disbursed directly to the student for the payment period. The institution must return those funds no later than 30 days after the date that the institution becomes aware that the student will not or has not begun attendance. Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The College incorrectly calculated Return to Title IV (R2T4) calculations. Questioned costs: ALN 84.063 $615 ALN 84.268 $2,722 Context: During our testing of 17 R2T4 calculations, we identified that 2 had a mechanically incorrect calculation. Cause: The College did not maintain proper documentation of withdrawal date for R2T4 calculations. Effect: The College could return incorrect amounts based off their calculations, which could affect student repayment amounts based off of amount earned. Repeat Finding: Yes, 2024-001 Recommendation: We recommend that the College review policies and procedures related to R2T4 calculations to ensure calculations are performed accurately. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.
Program: COVID-19 CDBG-Entitlement/Special Purpose Grants Cluster Assistance Listing No.: 14.218 Federal Grantor: U.S. Department of Housing and Urban Development Passed-through: N/A - Direct Award Award No.: B20UW060501, B24UC060502 Award Year: 2021, 2025 Compliance Requirements: Reporting Type of Finding: Significant Deficiency in Internal Control over Compliance Criteria: 2 CFR Section 200.303(a), Internal Controls, states that the non-Federal entity must establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) (Pub. L. No. 109-282), as amended by Section 6202 of Pub. L. No. 110-252, that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). Condition: As a result of our audit procedures, we noted that for three (3) out of three (3) first tier subawards tested there was no documented review of the FFATA submissions by an individual independent of the preparation of the FFATA submissions. Cause: The County’s procedures did not include documenting the review and approval of the reports prior to submission. Effect: Ineffective controls over this area of compliance could result in reports that are inaccurate or incomplete being submitted or disclosed to the granting agency. Questioned Costs: No questioned costs were identified as a result of our audit procedures. Context/Sampling: We tested the entire population of three subawards obligations during the year. Repeat Finding from Prior Years: No Recommendation: We recommend the County revise its procedures to include evidence to document the individual who reviewed and approved required reports prior to submission. Views of Responsible Officials: Management agrees. See separately issued Corrective Action Plan.
Written Policies and Procedures Related to Federal Awards - Condition: The Town does not have written policies and procedures to ensure compliance with federal award requirements. Specifically, written procedures are missing for: Allowability of Costs (2 CFR 200 Subpart E), Procurement Standards (2 CFR 200.318), Financial Management (2 CFR 200.302). Criteria: 2 CFR §200.303(a) requires non-federal entities to establish and maintain effective internal control over federal awards that provides reasonable assurance that the entity is managing the award in compliance with federal statutes, regulations, and the terms of the award. Cause of Condition: The organization lacked dedicated administrative staff or training to develop these documents, relying on informal processes.Effect: Without written policies, the Town cannot ensure that costs are consistently treated as allowable, reasonable, and allocable in accordance with federal requirements, potentially leading to questioned costs or disallowance. Recommendation: The Town should develop and formally adopt comprehensive, written, and up-to-date policies and procedures that explicitly address 2 CFR 200 requirements for procurement, allowable costs, and financial reporting. Views of Responsible Officials and Planned Corrective Actions: We will reach out to MTAS to help the Town write and implement a policy for the Federal Award Program.
Federal agency: U.S. Small Business Administration Federal program name: Congressional Grants Inclusive Ventures Small Business Program Assistance listing number: 59.059 Pass-through agency: Anne Arundel County, Maryland Pass-through number: SBAHQ23I0140 Award Period: September 1,2023 through August 31, 2028 Compliance Requirement: Procurement and Suspension and Debarment Type of Findings: Material Weakness in Internal Control over Compliance, Material Noncompliance (Modified Opinion) Criteria or specific requirement: Compliance: Nonfederal entities must follow the procurement standards set out at 2 CFR sections 200.318 through 200.327. 2 CFR section 200.318 states the grant recipient or subrecipient must maintain and use documented procedures for procurement transactions under a Federal award or subaward, including for acquisition of property or services. These documented procurement procedures must be consistent with State, local, and tribal laws and regulations and the standards identified in sections 200.317 through 200.327. Compliance: Non-federal entities are prohibited from contracting with or making subawards under covered transactions to parties that are suspended or debarred. “Covered transactions” include contracts for goods and services awarded under a non-procurement transaction (e.g., grant or cooperative agreement) that are expected to equal or exceed $25,000 or meet certain other criteria as specified in 2 CFR section 180.220. All non-procurement transactions entered into by a pass-through entity (i.e., subawards to subrecipients), irrespective of award amount, are considered covered transactions, unless they are exempt as provided in 2 CFR section 180.215. When a non-federal entity enters into a covered transaction with an entity at a lower tier, the nonfederal entity must verify that the entity, as defined in 2 CFR section 180.995 and agency adopting regulations, is not suspended or debarred or otherwise excluded from participating in the transaction. This verification may be accomplished by (1) checking the System for Award Management (SAM) Exclusions maintained by the General Services Administration (GSA), (2) collecting a certification from the entity, or (3) adding a clause or condition to the covered transaction with that entity (2 CFR section 180.300). Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition The Corporation did not follow their written procurement procedures which reflect applicable State, local, and tribal laws and regulations which also conform to the applicable federal law and standards identified in the Uniform Guidance. The Corporation could not provide documentation that it ensured contractors were not suspended or debarred before executing contracts with the entities. Questioned Costs Amounts paid to the two contractors for the fiscal year ended June 30, 2025 was $175,000. Context Supporting documentation for the procurement, suspension and debarment status for two of the two contractors selected for testing was not documented. Cause The Corporation has not historically received federal funding so the procurement, suspension and debarment documentation was not deemed necessary. Effect A lack of documented procurement standards for the Corporation could increase the risk of goods and services being procured through a method which is not in accordance with applicable State, local, and tribal law as well as federal regulations including the Uniform Guidance. If the suspension and debarment status is not verified when entering into covered transactions, it is possible that a subaward could be issued to an ineligible entity. Repeat Finding No Recommendation We recommend that management follow their written procurement policies and controls to ensure it maintains documentation of procurement, suspension and debarments checks and that the documentation is available for audit. Views of Responsible Officials Management agrees with finding. See corrective action plan for additional information.
Federal Agency: National Science Foundation, U.S. Department of Transportation, U.S. Department of Energy, U.S. Department of Commerce Federal Program Name: Research & Development Assistance Listing Number: 11.469, 20.000, 47.083 and 81.089 Federal Award Identification Number and Year: 1946093 - 2025, 692Ml5-20-T-00029 - 2025, DEFE0031776 - 2025, NA23NWS4690009 – 2025 Pass-Through Agency: Iowa State University Pass-Through Number: 692M15-20-T-00029 PASS THRU 023063C Award Period: July 1, 2024 to June 30, 2025 Type of Finding: - Significant Deficiency in Internal Control over Compliance - Other Matters Criteria or specific requirement: Uniform Grant Guidance (2 CFR Section 200.305(b)(3)) requires that when the reimbursement method is used, the Federal awarding agency or pass-through entity must make payment within 30 calendar days after receipt of the billing, unless the Federal awarding agency or pass-through entity reasonably believes the request to be improper. Per Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: Oklahoma State University Stillwater (OSU STW) did not make payments to subrecipients within 30 days after receipt of invoices. Questioned costs: None. Context: During our testing we identified 7 subrecipient payments from OSU STW out of 40 payments that did not process payment requests from the subrecipients timely. Cause: OSU STW did not process payment requests from the subrecipient timely. Effect: Subrecipients on federal awards do not receive timely payment for federal contract work. Repeat Finding: No Recommendation: We recommend OSU STW review and update policies and procedures to allow for more timely payment to subrecipients for work the University contracts them to perform. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.
Federal Agency: U.S. Department of Health and Human Services Federal Program Name: Research & Development Assistance Listing Number: 93.859 Federal Award Identification Number and Year: 5P20GM109097 - 2025 Award Period: July 1, 2024 to June 30, 2025 Type of Finding: - Significant Deficiency in Internal Control over Compliance - Other Matters Criteria or specific requirement: Uniform Grant Guidance, 2 CFR 200.313(d)(2), procedures for managing equipment (including replacement equipment), whether acquired in whole or in part under a Federal award, until disposition takes place will, as a minimum, meet the following requirements: a physical inventory of the property must be taken and the results reconciled with the property records at least once every two years. Per Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: Oklahoma State University Center for Health Sciences (OSU CHS) did not properly maintain physical inventory of property purchased with federal funds. Questioned costs: None. Context: During our testing, we identified 1 out of 40 equipment items sampled that were purchased with federal funds did not have documentation of a completed physical inventory and could not be physically observed, as the equipment was reported to be misplaced. Cause: OSU CHS did not have effective controls in place to ensure that equipment purchased with federal funds was subject to a timely physical inventory and appropriately tracked, including procedures to ensure equipment could be located for observation. Effect: As a result, OSU CHS was unable to demonstrate the existence and proper safeguarding of equipment purchased with federal funds, increasing the risk that equipment may not be properly monitored, safeguarded, or used in accordance with federal requirements. Repeat Finding: No Recommendation: We recommend that OSU CHS implement and consistently perform procedures to ensure that all equipment purchased with federal funds is subject to a physical inventory at least once every two years, with results properly documented and reconciled to equipment records. We further recommend that OSU CHS strengthen controls over tracking equipment locations to ensure that federally funded equipment can be readily identified and physically located when required. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.
Federal Agency: U.S. Department of Transportation and U.S. Treasury Federal Program Name: Research & Development and Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 20.000 and 21.027 Federal Award Identification Number and Year: 692Ml5-20-T-00029-2025 and SLFRP4646-2025 Pass-Through Agency: Iowa State University Pass-Through Number: 692M15-20-T-00029 PASS THRU 023063C Award Period: July 1, 2024 to June 30, 2025 Type of Finding: - Significant Deficiency in Internal Control over Compliance - Other Matters Criteria or specific requirement: Per Uniform Guidance 2 CFR 200.318(i), the recipient must maintain records sufficient to detail the history of each procurement transaction. These records must include the rationale for the procurement method, contract type selection, contractor selection or rejection, and the basis for the contract price. Per Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: Oklahoma State University Stillwater (OSU STW) and Oklahoma State University Center for Health Sciences (OSU CHS) did not go through procurement procedures prior to entering into a contract with the vendor. Questioned costs: None. Context: During our testing of the Research & Development Cluster, we identified 1 transaction from OSU STW out of 40 transactions that did not go through the proper procurement procedures. During our testing of the Coronavirus State and Local Fiscal Recovery Funds Program, we identified 1 transaction from OSU CHS out of 6 transactions that did not go through the proper procurement procedures. Cause: OSU STW and OSU CHS did not have an effective control in place to ensure that the purchases went through the procurement procedures. Effect: OSU STW and OSU CHS were not in compliance with the regulation to go through the procurement procedures prior to entering a contract. Repeat Finding: No Recommendation: We recommend that OSU STW and OSU CHS review policies and procedures for procurement to ensure that every applicable transaction is going through the proper procurement procedures. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.
Federal Agency: Federal Government Federal Program Name: Research & Development and Economic Development Cluster Assistance Listing Number: Multiple Federal Award Identification Number and Year: Multiple Pass-Through Agency: Multiple Pass-Through Number: Multiple Award Period: July 1, 2024 to June 30, 2025 Type of Finding: - Material Weakness in Internal Control over Compliance Criteria or specific requirement: 2 CFR 200.403: Factors affecting allowability of costs; 2 CFR 200.413: Direct costs; 2 CFR 200.414: Indirect costs, OSU Policy 4-0135. Per Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: Oklahoma State University’s (OSU) policies were not consistently followed related to Professional Engineering Service (PES) rates charged by Oklahoma Aerospace Institute for Research and Education (OAIRE), a department within OSU. Questioned costs: Up to $2,853,832 of which approximately $935,974 occurred in FY2025. Of this $2,853,832, $1,333,596 was related to cost-reimbursable agreements, $1,159,037 to time and materials agreements, $221,613 to fixed price agreements, and $139,586 to undefined agreements. Context: OAIRE developed (PES) rates, which are the types of hourly rates typically used by contractors in time-and-materials type federal agreements. In some instances, OAIRE charged these fixed hourly rates for PES work in cost-reimbursable federal agreements, which resulted in OAIRE charging more than its actual costs incurred for such PES work. In addition, the PES rates were not consistent with OSU’s facilities and administration (F&A) rate agreement in that they included costs typically charged as indirect in its direct cost labor rates without justification and defining special circumstances when bidding contract rates. Certain labor rates were also calculated based on an understated number of available hours, which resulted in an overstated PES rate. Cause: Professional services rates were developed without documented review or attestation by subject matter experts in research administration or sponsored programs. Effect: Failure to adhere to costing principles may result in questioned costs and overbilling to sponsors. Repeat Finding: No Recommendation: We recommend that OSU should notify the applicable sponsors and federal agencies regarding the calculated questioned costs and make any necessary repayments or adjustments. Further, OSU should develop and document a process to ensure the PES rates are developed and billed in accordance with OSU Policy, applicable federal regulations, and the requirements of OSU’s Federal Agreements. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.
Criteria or specific requirement: Control: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should comply with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Schools was unable to provide evidence of timesheet approval for 2 of 40 payroll samples tested. Context: Forty timesheets were selected for testing and the following exceptions were noted: • For 2 of 40 timesheets selected for testing, Schools was unable to provide documentation evidencing the timesheets were properly approved. Questioned costs: Not applicable. Cause: Schools’ procedures and controls were not sufficient to ensure that time and effort reporting was accurately performed and documented, nor that employee time was properly allocated and approved. Effect: There is an increased risk of charging unallowed payroll costs to the program. Recommendation: Schools should reevaluate its current process, implement proper controls, and perform additional training over time and effort reporting. Schools should not seek federal reimbursement unless it can substantiate that the time and effort was dedicated to the federal program. Documentation should be readily available for audit.
Inadequate Internal Controls Over Compliance Related to Identification and Reporting of Assistance Listing Numbers (ALNs) in Schedule of Expenditures of Federal Awards Federal Program State Energy Program ALN 81.141 Energy Efficiency and Conservation Block Grant ALN 81.128 Name of Federal Agency U.S. Department of Energy Compliance Requirement Reporting Type of Finding Internal control over compliance/non-compliance Category Significant deficiency on internal controls over compliance and Other Matter. Criteria Title 2 CFR §200.303 requires non-Federal entities to establish and maintain effective internal control over Federal awards that provides reasonable assurance that the entity is managing the awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Additionally, 2 CFR §200.510(b) requires the Schedule of Expenditures of Federal Awards (SEFA) to include the correct Assistance Listing Number (ALN) for each Federal program. Proper identification of ALNs is essential, as different ALNs may be subject to different compliance requirements under the Uniform Guidance and program-specific terms and conditions. Condition During our review of the Schedule of Expenditures of Federal Awards (SEFA), we noted that Federal funds received under the U.S. Department of Energy were not consistently identified and documented under the correct Assistance Listing Numbers. Specifically, expenditures related to ALNs 81.141 and 81.128 were not clearly distinguished or were incorrectly classified. The entity did not have sufficient internal controls in place to ensure that Federal awards were properly identified by ALN at the time funds were received and subsequently recorded and reported on the SEFA. Cause The condition resulted from inadequate internal controls over compliance related to: •The identification of Federal awards upon receipt of funds; •The documentation and tracking of ALNs throughout the grant lifecycle; and •The preparation and review of the SEFA to ensure accurate classification by ALN. Management relied on informal processes and did not implement a formal review or reconciliation procedure to verify that Federal expenditures were recorded under the correct Assistance Listing Numbers. Effect Failure to correctly identify and document the applicable ALN may result in noncompliance with Federal requirements, as different ALNs can carry different compliance requirements, including but not limited to: •Allowable costs and activities. •Period of performance •Reporting requirements •Special tests and provisions; and •Subrecipient monitoring requirements. Misclassification of expenditures by ALN increases the risk that the entity may apply incorrect compliance requirements to a Federal award, potentially leading to unrecognized instances of noncompliance and inaccurate reporting on the SEFA. Additionally, incorrect ALN reporting may affect the determination of major programs and the scope of Single Audit testing. Context Two (2) out of a total of fifteen (15) Federal programs were not consistently identified and documented under the correct Assistance Listing Numbers. Questioned Costs None. Identification as a Repeated Finding This is not a repeat finding from the immediate previous audit. Recommendation We recommend that management strengthen internal controls over compliance by: 1. Implementing formal procedures to identify and document the correct ALN at the time Federal funds are received. 2. Maintaining detailed grant tracking records that clearly link expenditures to the appropriate ALN. 3. Establishing a supervisory review process over the preparation of the SEFA to verify the accuracy and completeness of ALN classifications prior to submission. Views of responsible officials and planned corrective actions Management of the Department agrees with this finding. Refer to the corrective action plan on pages 114-119.
Criteria: Health centers receiving federal funding under the Health Center Program (93.224) and Ryan White Part C (93.918) are required to maintain and consistently apply a sliding fee discount program in accordance with federal regulations and program guidance. Specifically, 42 CFR §51c.303(f) requires health centers to have a schedule of fees and discounts based on patients’ ability to pay and to apply the schedule consistently. The HRSA Health Center Program Compliance Manual, Chapter 9, mandates documented eligibility determinations, defined timeframes for eligibility reassessment, proper application of the sliding fee scale, and retention of documentation. Similarly, the Ryan White HIV/AIDS Program Part C Manual requires eligibility determinations and fee assessments consistent with approved policies and program requirements. Additionally, federal standards under 2 CFR §200.303 require non-federal entities to establish and maintain effective internal controls over federal awards, 2 CFR §200.302(b) requires financial management systems to adequately identify and document eligibility determinations, and 2 CFR §200.328 requires accurate programmatic reporting and monitoring. Condition: During testing of the sliding fee discount program for the fiscal year ended June 30, 2025, we identified multiple instances of noncompliance with established policies and federal program requirements. Specifically, patient financial information was updated over prior evaluations, which eliminated historical tracking and resulted in files not being properly closed in accordance with the health center’s policies. Effect: As a result of these deficiencies, NeoMed Center Inc. is at increased risk of improper fee discounts being applied to patients who may not meet eligibility requirements, noncompliance with federal and program-specific requirements, inaccurate financial reporting related to patient service revenue, lack of proper and accurate collection of services provided and potential loss of federal funds awards. Cause: The noncompliance is caused by inadequate implementation of internal controls policies and procedures designed over the sliding fee program. Also, it caused by lack of appropriate staff training and missing standardized monitoring policies and procedures, as well as inadequate supervisory review of eligibility determinations and documentation. Recommendations: We recommend that the Institution implement the following corrective actions: 1. Review current policies and procedures to improve and establish robust internal controls to ensure that patient financial information is updated without overwriting prior evaluations, preserving historical tracking and maintaining properly closed files. 2. Provide training to staff responsible for eligibility determinations and fee assessments to ensure consistent application of the sliding fee scale and compliance with federal program requirements. 3. Implement standardized monitoring and supervisory review procedures to verify that eligibility determinations, fee assessments, and documentation are accurate, complete, and retained in accordance with program requirements. 4. Implement and perform, on a recurrent basis, audit and/or review of patient files to ensure ongoing compliance, timely reassessment, and proper application of the sliding fee discount program. 5. Maintain clear records and documentation to support all eligibility determinations and fee discounts, ensuring the entity can demonstrate compliance during internal reviews or external audit
Federal Agency: 84 – Department of Education Federal Program Title: Higher Education Institutional Aid Assistance Listing Number: 84.031 Award Period: July 1, 2024, through June 30, 2025 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: In accordance with 2 CFR §200.328, non‑Federal entities must submit required performance reports in accordance with the terms and conditions of the Federal award and include all information required by the Federal awarding agency. Performance reports must be submitted in the form, manner, and frequency prescribed in the award agreement. Additionally, 2 CFR §200.303 requires non‑Federal entities to establish and maintain effective internal control over Federal awards, including controls to ensure required reports are reviewed, approved, documented, and submitted in accordance with award requirements. Condition/Context: During our testing of Reporting, we selected a sample of 5 Higher Education Institutional Aid performance reports. This major program includes 5 award agreements, of which 2 agreements have quarterly reporting requirements, 2 agreements have semi‑annual reporting requirements, and 4 agreements have annual reporting requirements. The following exceptions were noted: • For 2 of the 5 reports tested, the reports were prepared; however, evidence supporting submission was not provided, and documentation could not be provided to demonstrate that the reports were reviewed and approved prior to submission. As a result, evidence of management review and report submission could not be verified. Questioned Costs: None. Effect: Failure to retain documentation supporting report submission and management review limits the UEC’s ability to demonstrate compliance with Federal reporting requirements and increases the risk that required reports are not reviewed or submitted in accordance with award terms. Cause: The UEC’s internal controls were not designed or implemented to consistently ensure that required performance reports are reviewed, approved, and submitted in accordance with Federal award requirements, and that documentation is retained to support evidence of review and submission. Repeat Finding: No. Recommendation: We recommend the UEC strengthen its reporting procedures to ensure required performance reports are reviewed and approved prior to submission and that documentation is retained to support evidence of management review and report submission in accordance with Federal award requirements. Views of Responsible Officials: Management agrees with the finding and has developed a plan to correct the finding.
Federal Agency: 11 – Department of Commerce, 12 – Department of Defense, 15 – Department of the Interior, 16 – Department of Justice, 43 – National Aeronautics and Space Administration, 47 – National Science Foundation, 81 – Department of Energy, 84 – Department of Education, 93 – Department of Health and Human Services Federal Program Title: R&D Cluster and TRIO Cluster Assistance Listing Number: R&D and 84.TRIO Award Period: July 1, 2024, through June 30, 2025 Type of Finding: • Significant Deficiency in Internal Control over Compliance Criteria or Specific Requirement: In accordance with 2 CFR §200.403(a), costs charged to Federal awards must be necessary, reasonable, and allocable to the Federal award. Additionally, 2 CFR §200.309 requires costs to be incurred during the approved period of performance of the Federal award. Further, 2 CFR §200.302(a) requires non‑Federal entities to maintain financial management systems that provide for accurate, current, and complete disclosure of the financial results of each Federal award, and 2 CFR §200.303 requires non‑Federal entities to establish and maintain effective internal control over Federal awards. Condition/Context: The population sizes below are presented only for programs in which exceptions were identified for the applicable compliance test. Cash Disbursement Testing – TRIO Cluster (Control Finding Only): • For 2 of the 40 TRIO samples tested, the related expenses were allowable and incurred within the awards’ approved periods of performance; however, the expenses were improperly recorded in fiscal year 2025. Specifically, 1 expense related to fiscal year 2024, and 1 expense represented a prepayment for a fiscal year 2026 cost. The resulting misstatement to the Schedule of Expenditures of Federal Awards (SEFA) totaled $5,260, which is less than program materiality. Payroll Testing – R&D Cluster (Control Finding Only): • For 10 of the 40 R&D samples tested, timesheets were not submitted timely, resulting in variances between the payroll register and the recalculated gross wages for the applicable pay periods. No unallowable payroll costs were identified; however, controls over timely payroll documentation and reconciliation did not operate effectively. • For 1 of the 40 R&D samples tested, the timesheet was not signed by the supervisor, indicating that payroll review controls were not consistently applied. Questioned Costs: None. Effect: Although the costs tested were allowable and incurred within the approved periods of performance, improper period recognition and untimely or incomplete payroll documentation increase the risk that Federal expenditures are not recorded in the proper fiscal period and that Federal financial reporting is not accurate. Cause: The UEC’s internal controls were not designed or implemented to consistently ensure that expenditures are recorded in the proper fiscal period and that payroll documentation is submitted, reviewed, and approved timely. Repeat Finding: No. Recommendation: We recommend the UEC strengthen its controls over expenditure recognition to ensure costs are recorded in the appropriate fiscal period and enhance payroll review procedures to ensure timesheets are submitted and reviewed timely to support accurate payroll reporting. Views of Responsible Officials: Management agrees with the finding and has developed a plan to correct the finding.
Federal Agency: 11 – Department of Commerce, 12 – Department of Defense, 15 – Department of the Interior, 16 – Department of Justice, 43 – National Aeronautics and Space Administration, 47 – National Science Foundation, 81 – Department of Energy, 84 – Department of Education, 93 – Department of Health and Human Services Federal Program Title: R&D Cluster, Child Care Access Means Parents in School, TRIO Cluster, and Higher Education Institutional Aid Assistance Listing Number: R&D, 84.335, 84.TRIO, and 84.031 Award Period: July 1, 2024, through June 30, 2025 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: In accordance with 2 CFR §200.305(b), when using the reimbursement method, Federal drawdowns must be limited to allowable costs that have been incurred and supported. Additionally, 2 CFR §200.302(a) requires non Federal entities to maintain financial management systems that provide for accurate, current, and complete disclosure of the financial results of each Federal award. Condition/Context: During our testing of Cash Management, we selected a sample of 85 reimbursement requests, consisting of 40 R&D Cluster samples, 12 Child Care Access Means Parents in School samples, 23 TRIO Cluster samples, and 10 Higher Education Institutional Aid. The following exceptions were noted: R&D Cluster, TRIO Cluster, and Higher Education Institutional Aid: For 4 of the 40 R&D samples tested, 9 of the 23 TRIO samples tested, and 1 of the 10 Higher Education Institutional Aid samples tested, instances of noncompliance were identified. • For 4 of the 4 R&D samples, 8 of the 9 TRIO samples, and 1 of the 1 Higher Education Institutional Aid samples with instances of noncompliance noted, a portion of the reimbursement drawn down during fiscal year 2025 related to expenses incurred outside to the current fiscal year. Additionally, 1 of the 4 R&D samples included expenses incurred as far back as October 2020. • For 1 of the 9 TRIO samples with instances of noncompliance noted, supporting documentation (such as invoice support, indirect cost recalculations, or payroll registers) was not provided for a portion of the expenses included in the reimbursement requests. As a result, we were unable to determine the period to which the funds drawn down related. Child Care Access Means Parents in School (Control Finding Only): • For 1 of the 12 samples tested, the UEC was ultimately in compliance with cash management requirements; however, internal controls did not operate effectively. Specifically, there was an approximate six‑month delay between the incurrence of program costs and the submission of the reimbursement request. Questioned Costs: $68,759 Effect: Reimbursement requests that include costs incurred outside the applicable fiscal period or costs that are not supported increase the risk that Federal expenditures are not recorded in the proper accounting period and that Federal financial reporting is not accurate. Additionally, delays in submitting reimbursement requests increase the risk that expenditures are not timely reported in accordance with Federal requirements. Cause: The UEC’s internal controls were not designed or implemented to consistently ensure that costs included in reimbursement requests are recorded in the appropriate fiscal period, supported by adequate documentation, and submitted timely in accordance with Federal cash management and financial reporting requirements. Repeat Finding: No. Recommendation: We recommend the UEC strengthen its cash management and financial reporting procedures to ensure reimbursement requests include only costs incurred in the appropriate fiscal period, are supported by adequate documentation, and are submitted timely. The UEC should also enhance review controls to verify proper period recognition of costs prior to submission of reimbursement requests. Views of Responsible Officials: Management agrees with the finding and has developed a plan to correct the finding. Further, 2 CFR §200.303 requires non Federal entities to establish and maintain effective internal control over Federal awards to ensure transactions are recorded in the proper accounting period and in accordance with applicable Federal requirements.
2025-003 Special Tests and Provisions Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing No. 84.063, 84.268 Federal Award Identification Number and Year: P063P248567 – 2025, P268K258567 – 2025, P268K256514 - 2025 Award Periods: July 1, 2024 through June 30, 2025 Type of Finding: Significant Deficiency in Internal Control Over Compliance Other Matters Criteria or specific requirement: Per Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. The Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Changes to said status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days. The Code of Federal Regulations, 34 CFR 685.309(b), states the school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date. Condition: The University did not properly report student enrollment changes for students who received federal student aid to the National Student Loan Data System (NSLDS). Questioned Costs: None Context: During our testing of 17 students, we identified 1 student whose enrollment status change was not reported, 2 students with incorrect status changes reported for program-level reporting, 2 students with an incorrect effective date reported, and 9 students whose status changes were not reported in a timely manner. We also identified that for all 17 of the selected students, enrollment status was not certified every 60 days. Additionally. the University did not document any evidence of review over enrollment reporting. Cause: The University did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: The University was not in compliance with the requirements to properly report student enrollment data correctly. Incorrect dates submitted to NSLDS may be used to determine the grace period for the repayment and interest of outstanding Title IV student loans. Repeat findings: 2024-004 Recommendation: We recommend the University review current processes for reporting to NSLDS and implement procedures to ensure submissions are reported timely and accurately. Views of Responsible Officials: There is no disagreement with the audit finding.
2025-004 Special Tests and Provisions Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing No. 84.063, 84.268 Federal Award Identification Number and Year: P063P248567 – 2025, P268K258567 – 2025, P268K256514 - 2025 Award Periods: July 1, 2024 through June 30, 2025 Type of Finding: Significant Deficiency in Internal Control Over Compliance Other Matters Criteria or specific requirement: 34 CFR 668.21(a) states that the institution must return all title IV, HEA program funds that were credited to the student's account at the institution or disbursed directly to the student for the payment period. The institution must return those funds no later than 30 days after the date that the institution becomes aware that the student will not or has not begun attendance. Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University did not properly evaluate students in need of Return of Title IV (R2T4) calculations. Questioned Costs: None Context: During our testing of 5 R2T4 calculations, we identified 2 students with no R2T4 calculation performed. These students attended more than 60% of the term and did not require returned funds. Additionally, we identified 3 R2T4 calculations that did not have documentation of review. Cause: The University did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: The University could return incorrect amounts based off of their calculations and incorrect calculations could effect student repayment amounts based off of amount earned. Repeat findings: 2024-005 Recommendation: We recommend that the University review policies and procedures related to R2T4 calculations to ensure calculations are performed accurately. Views of Responsible Officials: There is no disagreement with the audit finding.
2025-005 Special Tests and Provisions Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing No. 84.063, 84.268 Federal Award Identification Number and Year: P063P248567 – 2025, P268K258567 – 2025, P268K256514 - 2025 Award Periods: July 1, 2024 through June 30, 2025 Type of Finding: Significant Deficiency in Internal Control Over Compliance Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The regulation states that the college must designate a qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program. (16 CFR 314.4(a)). The entity shall have a Written Information Security Program (WISP) that outlines the design and implementation of the risk assessment procedures. (16 CFR 314.4(b)). At a minimum, the institution's written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University has a Written Information Security Program; however, the University did not meet the minimum requirements stated in the Gramm-Leach-Bliley Act. Additionally, we were unable to observe evidence that the WISP was formally reviewed and approved. Questioned Costs: None Context: The WISP was missing the element discussing the secure disposal of customer information. Additionally, there was not an observable formal review or authorization.. Cause: The University did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: There is a risk the University’s information and systems could be vulnerable to attacks or intrusions, and these attacks may not be detected in a timely manner. Repeat findings: 2024-006 Recommendation: We recommend that the University review the GLBA requirements and ensure their WISP includes all required elements. Views of Responsible Officials: There is no disagreement with the audit finding.