2023–007 TRANSPARENCY ACT REPORTING Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Education Child Nutrition Cluster 10.553/10.555/10.556/10.559/10.582 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Under the requirements of the Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282) (Transparency Act) that are codified in 2 CFR Part 170, “unless the auditee is exempt as provided in paragraph d. of this award term, the auditee must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency no later than the end of the month following the month in which the obligation was made.” Recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) per submission instructions posted at http://www.fsrs.gov. Condition: The West Virginia Department of Education is a prime recipient of funding for the Child Nutrition Cluster and made first tier subawards of greater than $30,000, but did not file any of the necessary Federal Funding Accountability and Transparency Act (FFATA) reports. Cause: Policies and procedures and internal controls were not in place to ensure compliance with the Transparency Act. Effect or Potential Effect: West Virginia Department of Education management did not report the necessary FFATA reports for first tier subawards over $30,000 to The FFATA Subaward Reporting System. Questioned Costs: N/A Context: Total federal expenditures and total subrecipient expenditures for the Child Nutrition Cluster were $197,977,921 and $197,522,202, respectively, for the year ended June 30, 2023. Identification as a Repeat Finding: Prior Year Finding 2022–004 Recommendation: We recommend that West Virginia Department of Education management take immediate action to ensure compliance with the reporting requirements of the FFATA. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–007 TRANSPARENCY ACT REPORTING Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Education Child Nutrition Cluster 10.553/10.555/10.556/10.559/10.582 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Under the requirements of the Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282) (Transparency Act) that are codified in 2 CFR Part 170, “unless the auditee is exempt as provided in paragraph d. of this award term, the auditee must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency no later than the end of the month following the month in which the obligation was made.” Recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) per submission instructions posted at http://www.fsrs.gov. Condition: The West Virginia Department of Education is a prime recipient of funding for the Child Nutrition Cluster and made first tier subawards of greater than $30,000, but did not file any of the necessary Federal Funding Accountability and Transparency Act (FFATA) reports. Cause: Policies and procedures and internal controls were not in place to ensure compliance with the Transparency Act. Effect or Potential Effect: West Virginia Department of Education management did not report the necessary FFATA reports for first tier subawards over $30,000 to The FFATA Subaward Reporting System. Questioned Costs: N/A Context: Total federal expenditures and total subrecipient expenditures for the Child Nutrition Cluster were $197,977,921 and $197,522,202, respectively, for the year ended June 30, 2023. Identification as a Repeat Finding: Prior Year Finding 2022–004 Recommendation: We recommend that West Virginia Department of Education management take immediate action to ensure compliance with the reporting requirements of the FFATA. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–007 TRANSPARENCY ACT REPORTING Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Education Child Nutrition Cluster 10.553/10.555/10.556/10.559/10.582 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Under the requirements of the Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282) (Transparency Act) that are codified in 2 CFR Part 170, “unless the auditee is exempt as provided in paragraph d. of this award term, the auditee must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency no later than the end of the month following the month in which the obligation was made.” Recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) per submission instructions posted at http://www.fsrs.gov. Condition: The West Virginia Department of Education is a prime recipient of funding for the Child Nutrition Cluster and made first tier subawards of greater than $30,000, but did not file any of the necessary Federal Funding Accountability and Transparency Act (FFATA) reports. Cause: Policies and procedures and internal controls were not in place to ensure compliance with the Transparency Act. Effect or Potential Effect: West Virginia Department of Education management did not report the necessary FFATA reports for first tier subawards over $30,000 to The FFATA Subaward Reporting System. Questioned Costs: N/A Context: Total federal expenditures and total subrecipient expenditures for the Child Nutrition Cluster were $197,977,921 and $197,522,202, respectively, for the year ended June 30, 2023. Identification as a Repeat Finding: Prior Year Finding 2022–004 Recommendation: We recommend that West Virginia Department of Education management take immediate action to ensure compliance with the reporting requirements of the FFATA. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–008 TRANSPARENCY ACT REPORTING Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Housing and Urban Development Community Development Block Grants/State’s Program and Non-Entitlement Gants in Hawaii 14.228, Grant Award B15DC540001, Grant Award B16DL540001 #2, Grant Award B15DC540001, Grant Award B16DC540001, Grant Award B17DC540001, Grant Award B18DC540001, Grant Award B19DC540001, Grant Award B20DC540001, Grant Award B20DW540001, Grant Award B21DC540001 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Under the requirements of the Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282) (Transparency Act) that are codified in 2 CFR Part 170, “unless the auditee is exempt as provided in paragraph d. of this award term, the auditee must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency no later than the end of the month following the month in which the obligation was made.” Recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) per submission instructions posted at http://www.fsrs.gov. Condition: During our testing of Federal Funding Accountability and Transparency Act (FFATA) Reports, it was noted that the reports were not submitted by the State of West Virginia Community Development Block Grant program management within the timeframe designated in 2 CFR 170 Appendix A. Cause: A lack of oversight and adequate review of the FFATA reporting requirements by CDBG management caused the reports required for first-tier subawards over $30,000 to not be submitted timely to the FFATA Subaward Reporting System, and to have missing/incorrect information reported. Effect or Potential Effect: CDBG management did not report the necessary FFATA reports for first-tier subawards over $30,000 to The FFATA Subaward Reporting System accurately or in a timely fashion. Questioned Costs: N/A Context: Subawards for the CDBG program included 19 subawards that totaled $21,829,101 for the year ended June 30, 2023. The five subawards tested that were not reported to the FFATA Subaward Reporting System timely were $18,302,375. Total expenditures for the CDBG program were $29,946,440 for the year ended June 30, 2023. Identification as a Repeat Finding: Prior Year Finding 2022–005 Recommendation: We recommend that CDBG management take immediate action to ensure compliance with the reporting requirements of the Federal Funding Accountability and Transparency Act, which includes the timely submission of the reports and accurate information. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–008 TRANSPARENCY ACT REPORTING Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Housing and Urban Development Community Development Block Grants/State’s Program and Non-Entitlement Gants in Hawaii 14.228, Grant Award B15DC540001, Grant Award B16DL540001 #2, Grant Award B15DC540001, Grant Award B16DC540001, Grant Award B17DC540001, Grant Award B18DC540001, Grant Award B19DC540001, Grant Award B20DC540001, Grant Award B20DW540001, Grant Award B21DC540001 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Under the requirements of the Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282) (Transparency Act) that are codified in 2 CFR Part 170, “unless the auditee is exempt as provided in paragraph d. of this award term, the auditee must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency no later than the end of the month following the month in which the obligation was made.” Recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) per submission instructions posted at http://www.fsrs.gov. Condition: During our testing of Federal Funding Accountability and Transparency Act (FFATA) Reports, it was noted that the reports were not submitted by the State of West Virginia Community Development Block Grant program management within the timeframe designated in 2 CFR 170 Appendix A. Cause: A lack of oversight and adequate review of the FFATA reporting requirements by CDBG management caused the reports required for first-tier subawards over $30,000 to not be submitted timely to the FFATA Subaward Reporting System, and to have missing/incorrect information reported. Effect or Potential Effect: CDBG management did not report the necessary FFATA reports for first-tier subawards over $30,000 to The FFATA Subaward Reporting System accurately or in a timely fashion. Questioned Costs: N/A Context: Subawards for the CDBG program included 19 subawards that totaled $21,829,101 for the year ended June 30, 2023. The five subawards tested that were not reported to the FFATA Subaward Reporting System timely were $18,302,375. Total expenditures for the CDBG program were $29,946,440 for the year ended June 30, 2023. Identification as a Repeat Finding: Prior Year Finding 2022–005 Recommendation: We recommend that CDBG management take immediate action to ensure compliance with the reporting requirements of the Federal Funding Accountability and Transparency Act, which includes the timely submission of the reports and accurate information. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–009 TRANSPARENCY ACT REPORTING Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of the Interior Abandoned Mine Land Reclamation (AMLR) 15.252, Grant Award S16AF20058, Grant Award S18AF20000, Grant Award S19AF20000, Grant Award S19AF20020, Grant Award S20AF20008, Grant Award S20AF20038, Grant Award S20AF20094, Grant Award S21AF10040, Grant Award S22AF00013, Grant Award S22AF00039, Grant Award S23AF00013, Grant Award S23AF00059, Grant Award S23AF00107 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Under the requirements of the Federal Funding Accountability and Transparency Act (Pub. L. No. 109-282) (Transparency Act) that are codified in 2 CFR Part 170, “unless the auditee is exempt as provided in paragraph d. of this award term, the auditee must report each action that equals or exceeds $30,000 in Federal funds for a subaward to a non-Federal entity or Federal agency no later than the end of the month following the month in which the obligation was made.” Recipients of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) per submission instructions posted at http://www.fsrs.gov. Condition: For three of four subawards selected for testing, the West Virginia Department of Environmental Protection (the Department) was not in compliance with FFATA reporting requirements. The following table summarizes the exceptions noted during testing. There were no internal controls in place surrounding review and approval of the FFATA reports. Cause: The Department does not have adequate internal controls and policies and procedures in place to ensure that subawards of $30,000 or more are being reported accurately to FSRS. Effect or Potential Effect: The Department is not reporting accurate information for first-tier subawards of $30,000 or more causing them not to be in compliance with federal reporting requirements. Questioned Costs: N/A Context: Total federal expenditures and total subrecipient expenditures for the Abandoned Mine Land Reclamation (AMLR) Grants program were $29,631,143 and $12,283,714, respectively, for the year ended June 30, 2023. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: We recommend that the Department strengthen internal controls and policies and procedures over FFATA reporting to ensure they are in compliance with federal reporting requirements. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–010 REPORTING Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of the Interior Abandoned Mine Land Reclamation (AMLR) 15.252, Grant Award S16AF20058, Grant Award S18AF20000, Grant Award S19AF20000, Grant Award S19AF20020, Grant Award S20AF20008, Grant Award S20AF20038, Grant Award S20AF20094, Grant Award S21AF10040, Grant Award S22AF00013, Grant Award S22AF00039, Grant Award S23AF00013, Grant Award S23AF00059, Grant Award S23AF00107 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.302(b)(2) “Accurate, current, and complete disclosure of the financial results of each Federal award or program in accordance with the reporting requirements set forth in §§ 200.328 and 200.329.” Condition: The West Virginia Department of Environmental Protection (the Department) is responsible for preparing the SF-425 and SF-425A. There were errors in reporting on the SF-425 reports where receipts and disbursements reported did not agree to the underlying data used to prepare the reports. In addition, the Department did not file the SF-425A reports as required. There were no internal controls in place surrounding review and approval of the financial reports. Cause: The Department does not have adequate internal controls and policies and procedures in place to ensure that reports contain accurate financial information and are submitted as required. Effect or Potential Effect: The Department is not reporting accurate information for the SF-425 reports and is not submitting the SF-425A reports causing them not to be in compliance with federal reporting requirements over financial reports. Questioned Costs: Unknown Context: We selected five SF-425 reports for testing and noted errors in all the reports. We selected five SF-425A reports for testing and noted the reports were not filed. Total federal expenditures for the AMLR Grants program were $29,631,143 for the year ended June 30, 2023. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: We recommend that the Department strengthen internal controls and policies and procedures over financial reporting to ensure they are in compliance with federal reporting requirements. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–011 SUBRECIPIENT MONITORING Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of the Interior Abandoned Mine Land Reclamation (AMLR) 15.252, Grant Award S16AF20058, Grant Award S18AF20000, Grant Award S19AF20000, Grant Award S19AF20020, Grant Award S20AF20008, Grant Award S20AF20038, Grant Award S20AF20094, Grant Award S21AF10040, Grant Award S22AF00013, Grant Award S22AF00039, Grant Award S23AF00013, Grant Award S23AF00059, Grant Award S23AF00107 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR 200.332(b) requires that all pass-through entities must: (b) Evaluate each subrecipient’s risk of noncompliance with Federal statutes, regulations, and the terms and conditions of the subaward for purposes of determining the appropriate subrecipient monitoring described in paragraphs (d) and (e) of this section, which may include consideration of such factors as: (1) The subrecipient’s prior experience with the same or similar subawards; (2) The results of previous audits including whether or not the subrecipient receives a Single Audit in accordance with Subpart F of this part, and the extent to which the same or similar subaward has been audited as a major program; (3) Whether the subrecipient has new personnel or new or substantially changed systems; and (4) The extent and results of Federal awarding agency monitoring (e.g., if the subrecipient also receives Federal awards directly from a Federal awarding agency). Condition: We noted that the West Virginia Department of Environmental Protection (the Department) did not perform a subrecipient risk assessment. Therefore, the Department was unable to provide documentation supporting that the level of monitoring to be completed for each subrecipient was appropriate based on the risk assessment. Cause: The Department does not have policies and procedures in place surrounding the subrecipient monitoring compliance requirements and a risk assessment of subrecipients was not performed during the current fiscal year. Effect or Potential Effect: The Department does not have proper internal controls in place to ensure risk assessments are performed annually for all subrecipients. Questioned Costs: Unknown Context: Total federal expenditures and total subrecipient expenditures for the AMLR Grants program were $29,631,143 and $12,283,714, respectively, for the year ended June 30, 2023. There were 24 subrecipients during the year ended June 30, 2023. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: We recommend that the Department implement written policies and procedures to perform an annual risk assessment of subrecipients to determine the proper extent of monitoring procedures. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–012 REPORTING - SCHEDULE OF EXPENDITURES OF FEDERAL AWARDS Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of the Interior Abandoned Mine Land Reclamation (AMLR) Grants 15.252, Grant Award S16AF20058, Grant Award S18AF20000, Grant Award S19AF20000, Grant Award S19AF20020. Grant Award S20AF20008, Grant Award S20AF20038, Grant Award S20AF20094, Grant Award S21AF10040, Grant Award S22AF00013, Grant Award S22AF00039, Grant Award S23AF00013, Grant Award S23AF00059, Grant Award S23AF00107 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The Uniform Guidance 2 CFR section 200.510 states, “(b) Schedule of expenditures of Federal awards. The auditee must also prepare a schedule of expenditures of federal awards (SEFA) for the period covered by the auditee’s financial statements which must include the total Federal awards expended as determined in accordance with §200.502 Basis for determining Federal awards expended.” Condition: The West Virginia Department of Environmental Protection (the Department)’s internal controls are not adequate to ensure the Schedule of Expenditures of Federal Awards (SEFA) accurately reports all federal assistance. The Department’s SEFA for fiscal year 2023 under the Abandoned Mine Land Reclamation (AMLR) Grants program excluded indirect costs preliminary SEFA. Cause: The internal controls over the SEFA reporting processes were not operating effectively to ensure the SEFA included indirect costs. Effect or Potential Effect: The Department is not properly reporting their federal expenditures and major programs may not be appropriately identified. Questioned Costs: N/A Context: Total indirect costs for fiscal 2023, totaling $1,592,074, were incorrectly excluded from the SEFA. Management corrected the final SEFA. Total federal expenditures for the AMLR Grants program were $31,223,217 for the year ended June 30, 2023. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: We recommend that the Department ensure staff responsible for the preparation of the SEFA be provided guidance on recording indirect expenses on the SEFA and the SEFA be reviewed and approved by supervising personnel. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–013 INTERNAL CONTROLS OVER INFORMATION TECHNOLOGY Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Labor Unemployment Insurance (UI) 17.225, Grant Award UI-38244-22-55-A-54, Grant Award UI-34749-20-55-A-54, Grant Award UI-39304-23-55-A-54, Grant Award UI-37257-22-55-A-54, Grant Award UI-39356-23-55-A-54, Grant Award UI-38014-22-60-A-54 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Workforce West Virginia (WWV) does not perform periodic documented reviews of administrator access changes to the Automated Benefit Payment System (ABPS) or the Unemployment Compensation Tax applications (UC Tax). A user access review is performed periodically for ABPS and UC Tax, however the review is not documented. Employee terminations were not being communicated timely to the West Virginia Office of Technology (WVOT) to remove network access or within the organization to remove access to ABPS and UC Tax. The current process to remove terminated employees does not allow for the documentation of all applications requiring access removal. WWV has not performed periodic disaster recovery testing for WWV owned applications. WWV did not perform a timely review of the SOC report for wvOASIS and documentation did not include reviewing and determining if the required complementary user entity controls were in place. Additionally, complementary user entity controls were not in place. Cause: The internal controls over the information technology processes were not adequately designed or implemented. Effect or Potential Effect: Unauthorized access to critical information systems may occur and not be detected or resolved in a timely manner causing WWV to be in noncompliance. WWV may not be able to effectively respond to a disaster and recover pertinent data. Questioned Costs: N/A Context: Total federal disbursements for the UI program were $138,362,181 for the year ended June 30, 2023. Identification as a Repeat Finding: Prior Year Findings 2022–008 and 2021–005 Recommendation: WWV should implement policies and procedures that include monitoring the information systems and systems controls reports. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–014 REPORTING Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Labor Unemployment Insurance (UI) 17.225, Grant Award UI-38244-22-55-A-54, Grant Award UI-34749-20-55-A-54, Grant Award UI-39304-23-55-A-54, Grant Award UI-37257-22-55-A-54, Grant Award UI-9356-23-55-A-54, Grant Award UI-38014-22-60-A-54 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: The following reports tested were not reviewed and approved prior to submission: 1) ) one of the four Employment and Training Administration “ETA” 9050 reports 2) two of the four ETA 9052 reports, and 3) one of the four ETA 9055 reports. Cause: The internal controls over the individual reporting processes were not adequately enforced or documented. Effect and Potential Effect: Reports could be filed with errors or lack of supporting documentation and not be identified by management. Questioned Costs: N/A Context: Total federal disbursements for the UI program were $138,362,181 for the year ended June 30, 2023. Identification as a Repeat Finding: Prior Year Findings 2022–007 and 2021–006 Recommendation: We recommend that WWV implement internal controls over the report submission process, to ensure each report is reviewed and approved by appropriate individuals familiar with the reporting requirements to ensure that accurate information is reported. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–015 REPORTING Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Transportation National Infrastructure Investments 20.933, Grant Award 693JJ22040000BDG0WV0522045, Grant Award 693JJ22040000BDG0WV0484326, Grant Award 693JJ22140000BDG3WV0641399, Grant Award 693JJ22240000BDG6WV0793309 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that the non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The terms and conditions of the grant awards require the recipient to submit various financial and performance reports, including Quarterly Project Progress Reports and Pre-Project Performance Measurement Reports. Condition: The West Virginia Division of Highways (the Division) could not provide documentation that the Quarterly Project Progress Reports and Pre-project Performance Measurement Report, that were required to be submitted during the fiscal year under audit, were filed. Cause: The Division does not have proper policies and procedures in place surrounding the reporting compliance requirements. Effect or Potential Effect: The Division could not provide documentation that required reports were submitted to the federal awarding agency in accordance with the grant awards. Questioned Costs: Unknown Context: There was one Pre-project Performance Measurement Report and 15 Quarterly Project Progress Reports required to be filed in fiscal year 2023. Total federal expenditures for the National Infrastructure Investments program were $35,831,611 for the year ended June 30, 2023. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: We recommend that the Division implement policies and procedures surrounding reporting to ensure compliance with all conditions of the grant awards. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–016 SPECIAL TESTS AND PROVISIONS - NOTIFICATION OF CHANGES TO KEY PERSONNEL Federal Program Information: Federal Agency and Program Name Assistance Listing # U.S. Department of Transportation National Infrastructure Investments 20.933, Grant Award 693JJ22040000BDG0WV0522045, Grant Award 693JJ22040000BDG0WV0484326, Grant Award 693JJ22140000BDG3WV0641399, Grant Award 693JJ22240000BDG6WV0793309 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The terms and conditions of the grant awards require the recipient to notify all U.S. Department of Transportation (USDOT) representatives, noted in the grant agreement, in writing within 30 calendar days of any change in key personnel. Condition: The West Virginia Division of Highways (the Division) could not provide documentation that the USDOT was made aware of changes in key personnel within 30 calendar days. Cause: The Division does not have proper policies and procedures in place over the notification of changes to key personnel requirements. Effect or Potential Effect: The Division is not in compliance with the provisions of the grant awards since changes to key personnel were not communicated in writing to the USDOT within 30 calendar days. Questioned Costs: Unknown Context: There were three grants that had a change in key personnel; the change in key personnel was not communicated to the USDOT. Total federal expenditures for the National Infrastructure Investments program were $35,831,611 for the year ended June 30, 2023. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: We recommend that the Division implement policies and procedures surrounding the notification of changes to key personnel requirements to ensure compliance with all conditions of the grant awards. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–017 SPECIAL TESTS AND PROVISIONS – SATISFACTORY ACADEMIC PROGRESS (N9) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” 34 CFR 668.16(e) states: “For purposes of determining student eligibility for assistance under a title IV, HEA program, establishes, publishes, and applies reasonable standards for measuring whether an otherwise eligible student is maintaining satisfactory academic progress in his or her educational program. The Secretary considers an institution's standards to be reasonable if the standards are in accordance with the provisions specified in § 668.34.” 34 CFR 668.34 states: “An institution must establish a reasonable satisfactory academic progress policy for determining whether an otherwise eligible student is making satisfactory academic progress in his or her educational program and may receive assistance under the title IV, HEA programs. The Secretary considers the institution's policy to be reasonable if— (1) The policy is at least as strict as the policy the institution applies to a student who is not receiving assistance under the title IV, HEA programs; (2) The policy provides for consistent application of standards to all students within categories of students, e.g., full-time, part-time, undergraduate, and graduate students, and educational programs established by the institution; (3) The policy provides that a student's academic progress is evaluated— (i) At the end of each payment period if the educational program is either one academic year in length or shorter than an academic year; or (ii) For all other educational programs, at the end of each payment period or at least annually to correspond with the end of a payment period; (4) (i) The policy specifies the grade point average (GPA) that a student must achieve at each evaluation, or if a GPA is not an appropriate qualitative measure, a comparable assessment measured against a norm; and (ii) If a student is enrolled in an educational program of more than two academic years, the policy specifies that at the end of the second academic year, the student must have a GPA of at least a “C” or its equivalent, or have academic standing consistent with the institution's requirements for graduation; (5) The policy specifies— (i) For all programs, the maximum timeframe as defined in paragraph (b) of this section; and (ii) For a credit hour program using standard or nonstandard terms that is not a subscription-based program, the pace, measured at each evaluation, at which a student must progress through his or her educational program to ensure that the student will complete the program within the maximum timeframe, calculated by either dividing the cumulative number of hours the student has successfully completed by the cumulative number of hours the student has attempted or by determining the number of hours that the student should have completed by the evaluation point in order to complete the program within the maximum timeframe. In making this calculation, the institution is not required to include remedial courses; (6) The policy describes how a student's GPA and pace of completion are affected by course incompletes, withdrawals, or repetitions, or transfers of credit from other institutions. Credit hours from another institution that are accepted toward the student's educational program must count as both attempted and completed hours; (7) Except as provided in paragraphs (c) and (d) of this section, the policy provides that, at the time of each evaluation, a student who has not achieved the required GPA, or who is not successfully completing his or her educational program at the required pace, is no longer eligible to receive assistance under the title IV, HEA programs; (8) If the institution places students on financial aid warning, or on financial aid probation, as defined in paragraph (b) of this section, the policy describes these statuses and that— (i) A student on financial aid warning may continue to receive assistance under the title IV, HEA programs for one payment period despite a determination that the student is not making satisfactory academic progress. Financial aid warning status may be assigned without an appeal or other action by the student; and (ii) A student on financial aid probation may receive title IV, HEA program funds for one payment period. While a student is on financial aid probation, the institution may require the student to fulfill specific terms and conditions such as taking a reduced course load or enrolling in specific courses. At the end of one payment period on financial aid probation, the student must meet the institution's satisfactory academic progress standards or meet the requirements of the academic plan developed by the institution and the student to qualify for further title IV, HEA program funds; (9) If the institution permits a student to appeal a determination by the institution that he or she is not making satisfactory academic progress, the policy describes— (i) How the student may reestablish his or her eligibility to receive assistance under the title IV, HEA programs; (ii) The basis on which a student may file an appeal: The death of a relative, an injury or illness of the student, or other special circumstances; and (iii) Information the student must submit regarding why the student failed to make satisfactory academic progress, and what has changed in the student's situation that will allow the student to demonstrate satisfactory academic progress at the next evaluation; (10) If the institution does not permit a student to appeal a determination by the institution that he or she is not making satisfactory academic progress, the policy must describe how the student may reestablish his or her eligibility to receive assistance under the title IV, HEA programs; and (11) The policy provides for notification to students of the results of an evaluation that impacts the student's eligibility for title IV, HEA program funds.” Condition: Bluefield State University (BSU), Fairmont State University (FSU), Marshall University (MU), New River Community and Technical College (NRCTC), West Liberty University (WLU), West Virginia Northern Community College (WVNCC), West Virginia School of Osteopathic Medicine (WVSOM), and West Virginia University at Parkersburg (WVUP) did not have adequate internal controls in place surrounding the satisfactory academic progress (SAP) policy. During our testing, we noted there was no documentation retained to evidence that a review of the SAP policy was performed to ensure compliance with federal regulations. Additionally, Blue Ridge Community College (BRCTC) and WVUP did not publish the most recent version of the SAP policy on their websites. Furthermore, WVSOM did not include reasonable standards for measuring whether eligible students are maintaining SAP in their educational program in their published SAP policy as the related SAP polices excluded the required element #11 above. BRCTC had an appropriate policy, but they did not publish the most recent version of the policy on their website. The older version of the SAP policy that was published on their website did not include the required element #11 above. Cause: Management of BRCTC, BSU, FSU, MU, NRCTC, WLU, WVNCC, WVSOM, and WVUP did not retain sufficient documentation for their review procedures over the SAP policy. Management of BRCTC and WVSOM did not include all reasonable standards for measuring whether eligible students are maintaining SAP in their educational program in their published SAP policies. Effect or Potential Effect: The published SAP policy may be deemed insufficient for the compliance requirements. Questioned Costs: None Context: Total Student Financial Assistance Cluster expenditures for BRCTC, BSU, FSU, MU, NRCTC, WLU, WVNCC, WVSOM, and WVUP were $5,084,582, $7,651,688, $17,584,932, $93,991,163, $3,672,778, $16,726,007, $3,090,314, $44,681,370, $6,847,451, respectively, for the year ended June 30, 2023. The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: Management should ensure the SAP is reviewed and approved on an annual basis and supporting documentation of the review retained. Management should design and implement internal controls over the SAP policy to ensure all requirements are included in the policy appropriately and published on the institution’s website timely. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–019 SPECIAL TESTS AND PROVISIONS – GRAMM-LEACH-BLILEY ACT-STUDENT INFORMATION SECURITY (N12) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. At a minimum, an institution’s written information security program — (1) Designates a qualified individual responsible for overseeing and implementing the institution’s information security program and enforcing the information security program in compliance (16 CFR 314.4(a)). (2) Provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution) that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks (16 CFR 3 14.4(b)). (3) Provides for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 3 14.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The eight minimum safeguards that the written information security program must address are summarized as follows: (i) Implement and periodically review access controls. (ii) Conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted. (iii) Encrypt customer information on the institution’s system and when it’s in transit. (iv) Assess apps developed by the institution (v) Implement multi-factor authentication for anyone accessing customer information on the institution’s system (vi) Dispose of customer information securely (vii) Anticipate and evaluate changes to the information system or network. (viii) Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. (4) Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). (5) Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). (6) Addresses how the institution will oversee its information system service providers (16 CFR 314.4(f)). (7) Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Condition: Blue Ridge Community and Technical College (BRCTC), Concord University (CU), Marshall University (MU), New River Community and Technical College (NRCTC), West Liberty University (WLU), West Virginia Northern Community College (WVNCC), and West Virginia University at Parkersburg (WVUP) did not have adequate internal controls in place surrounding the Information Security Program. During our testing, we noted there was no documentation retained to evidence that a review of the Information Security Program was performed to ensure compliance with federal regulations. Additionally, the written Information Security Program for Bluefield University (BSU), CU, MU, NRCTC, Shepherd University (SU), WLU, WVNCC, West Virginia State University (WVSU) and WVUP did not address all required elements per 16 CFR 314.4 outlined above. Furthermore, Fairmont State University (FSU) and Pierpont Community and Technical College (PCTC) did not have a written Information Security Program. For FSU, the written Information Security Program was not in place until May 2023. Cause: Management of BRCTC, CU, MU, NRCTC, WLU, WVNCC, and WVUP did not retain sufficient documentation for their review procedures over the Information Security Program. Management of BSU, CU, MU, NRCTC, SU, WVNCC, and WVSU did not include all reasonable standards required for the Information Security Program. Management of FSU and PCTC did not have a written Information Security Program. Effect or Potential Effect: The written Information Security Program may not be compliant with federal regulations. Questioned Costs: None Context: Total Student Financial Assistance Cluster expenditures for BRCTC, BSU, CU, FSU, MU, NRCTC, PCTC, SU, WLU, WVNCC, WVSU, and WVUP were $5,084,582, $7,651,688, $13,833,684, $17,584,932, $93,991,163, $3,672,778, $4,388,461, $15,171,851, $16,726,007, $3,090,314, $9,313,808, $6,847,451, respectively, for the year ended June 30, 2023. The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: Management should design and implement internal controls over the Information Security Program to ensure all requirements of the GLBA are included in the written Information Security Program appropriately. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–020 INTERNAL CONTROLS OVER SPECIAL TESTS AND PROVISIONS – VERIFICATION (N1) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Fairmont State University (FSU) did not have adequate internal controls in place surrounding the verification compliance requirement. During our testing, we noted for the samples selected that there were multiple selections showing a lack of proper review in the verification process. Cause: FSU did not have adequate internal controls in place to ensure that verification changes identified were processed and submitted to the U.S. Department of Education. Effect or Potential Effect: Students receiving federal aid could receive the incorrect amount of federal student financial assistance. Questioned Costs: N/A Context: We selected a sample of 23 students for FSU and identified 8 instances where the verification forms were not reviewed and approved. Total Student Financial Assistance Cluster expenditures for FSU were $17,584,932 for the year ended June 30, 2023. The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: Prior Year Findings 2022–015 and 2021–014 Recommendation: Management should develop and update internal controls to ensure that controls related to the verification process are implemented. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–021 BANNER INFORMATION TECHNOLOGY GENERAL CONTROLS Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: The State of West Virginia did not implement all logical access and change management controls that are required to be in place to support effective information technology general controls (ITGCs) for the Banner application instances at 12 of 15 universities / colleges. As a result, Banner ITGCs, and therefore, Banner application controls, cannot be relied upon in the period of audit. Cause: Across the 11 universities/colleges (Blue Ridge Community and Technical College, Bluefield State University, Mountwest Community and Technical College, New River Community and Technical College, Pierpont Community and Technical College, Shepherd University, West Liberty University, West Virginia Northern Community College, West Virginia University, West Virginia University at Parkersburg, and West Virginia State University), management did not have a formalized process to support access provisioning events were authorized, approved and documented. Additionally, documentation did not exist to support the timely revocation of access upon a user leaving the university / college. Further, a user access review for Banner was not performed to ensure access remains appropriate based on users’ job responsibilities. We also identified instances where privileged accounts to Banner were shared amongst users and password settings were not configured with leading industry standards. Specific to the change management process, a formalized and documented process was not consistently followed to support that Banner application and supporting infrastructure patches and releases were authorized, tested, and approved prior to being implemented to production. Effect or Potential Effect: There is a risk the data relevant to the Student Financial Assistance Cluster program stored within the student financial aid system may be inappropriately created or modified. Effective testing of the required logical access and change management controls is to support effective ITGCs over the Banner application. As a result, the Banner application cannot be relied on for the audit period. Questioned Costs: None Context: The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: Documentation of the requestor, access rights requested, and approval should be defined and maintained for all new and modified Banner access requests. This documentation should allow for an audit trail of all new and transferred users ensuring that access was granted/removed from the Banner application. Additionally, segregation of duties should exist between the requestor/approver and grantor of the access. Management should remove the terminated user's access from the Banner application. Management should enhance the process of communicating terminated employees to ensure access is revoked or disabled timely. Management should ensure that a review of user access is performed on a periodic basis (e.g., annually) to ensure user access rights remain consistent with user job responsibilities. Review procedures should be performed for all users with access to the Banner application to determine access appropriateness. In addition, management should ensure that adequate documentation is maintained to provide evidence (i.e., sign-offs, hard-copy reports, etc.) of the review. Management should configure Banner password settings related to minimum length, complexity, expiration, history, and account lockout to enhance overall security. Further, privileged access to the Banner application should be granted to administrators via unique IDs to provide accountability and avoid the sharing of default privileged accounts. A formal, documented change process needs implemented to capture authorization, testing and production migration approvals for patches and releases to the Banner application and supporting infrastructure. This documentation should allow for an audit trail of all program changes ensuring that changes were appropriately authorized and administered. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–022 SPECIAL TESTS AND PROVISIONS – RETURN OF TITLE IV FUNDS (N4) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.063/84.268 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 34 CFR section 668.173(b) requires timely return of title IV, HEA program funds. “In accordance with procedures established by the Secretary or FFEL Program lender, an institution returns unearned title IV, HEA program funds timely if - (1) The institution deposits or transfers the funds into the bank account it maintains under § 668.163 no later than 45 days after the date it determines that the student withdrew; (2) The institution initiates an electronic funds transfer (EFT) no later than 45 days after the date it determines that the student withdrew; (3) The institution initiates an electronic transaction, no later than 45 days after the date it determines that the student withdrew, that informs a FFEL lender to adjust the borrower’s loan account for the amount returned; or (4) The institution issues a check no later than 45 days after the date it determines that the student withdrew. An institution does not satisfy this requirement if - (i) The institution’s records show that the check was issued more than 45 days after the date the institution determined that the student withdrew; or (ii) The date on the cancelled check shows that the bank used by the Secretary or FFEL Program lender endorsed that check more than 60 days after the date the institution determined that the student withdrew.” Condition: Blue Ridge Community and Technical College (BRCTC), Mountwest Career & Technical College (MCTC), Pierpont Community and Technical College (PCTC), and West Virginia Northern Community College (WVNCC) were unable to provide adequate documentation showing they maintained an effective review process over the returns of Title IV funds. In addition, for Bluefield State University (BSU) it was noted during compliance testing that certain amounts to be returned were not returned timely. Cause: The institutions do not have adequate internal controls in place over the return of Title IV funds to prevent noncompliance. Effect or Potential Effect: The institutions may not be returning the correct amount of federal student financial assistance required or the funds are not returned within the required time frame to the United States Department of Education. Questioned Costs: None Context: In 11 of 29 instances of internal control testing at BRCTC, we noted that the internal control was not sufficiently documented or not functioning effectively. The support documentation provided did not include any evidence of review. In 19 of 22 instances of internal control testing at MCTC, we noted that the internal control was not sufficiently documented or not functioning effectively. MCTC relied on application controls within the Banner system, which has been determined to have ineffective ITGCs. Additionally, the support documentation provided did not include sufficient evidence of review. In 2 of 18 instances in internal control testing at PCTC, we noted that the internal control was not sufficiently documented or not functioning effectively. In addition, the return to Title IV funds was not completed within the required 45-day timeframe. In all 20 instances of internal control testing at WVNCC, we noted that the internal control was not sufficiently documented or not functioning effectively. WVNCC relied on the application controls within the Banner system, which has been determined to have ineffective ITGCs. Additionally, there was no evidence of review of the calculation in the support documentation provided. In one of 40 returns tested for compliance, we noted that one return related to BSU was not completed within the required 45-day timeframe. Total Student Financial Assistance Cluster expenditures for BRCTC, BSU, MCTC, PCTC, and WVNCC were $5,084,582, $7,651,688, $4,467,631, $4,388,461, and $3,090,314, respectively, for the year ended June 30, 2023. The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643 Identification as a Repeat Finding: Prior Year Findings 2022–011 and 2021–015 Recommendation: Management should implement internal controls to ensure that the correct amount of federal student financial assistance is returned and returned within the required time frame. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–023 INTERNAL CONTROLS OVER CASH MANAGEMENT Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.063/84.268 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: For the period July 2022 – January 2023 at Fairmont State University (FSU), there was no second level review of drawdown requests for accuracy, completeness and agreement to the underlying books and records of the institution. Bluefield State University (BSU) did not retain evidence of the review and approval for one of seven drawdown requests selected for internal control testing. Mountwest Community and Technical College (MCTC) did not have evidence of the review control related to cash management. Three of the 15 drawdown requests selected for internal control testing did not have proper approval prior to the drawdowns. West Virginia Northern Community College (WVNCC) did not retain evidence of the review and approval for seven of 12 drawdown requests selected for control testing. Cause: For FSU, one individual was responsible for preparing the drawdown request and making the drawdown through the U.S. Department of Education’s G5 payment management system. Internal controls were not implemented until February 2023. BSU, MCTC, and WVNCC have policies and procedures in place to review the drawdowns prior to requesting from the U.S. Department of Education’s G5 payment management system; however, the policies and procedures were not followed for these drawdowns. Effect or Potential Effect: Drawdowns could be inaccurate, incomplete, and not agree to underlying books and records of the institution. Questioned Costs: None Context: Total BSU, FSU, MCTC, and WVNCC expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $7,651,688, $17,584,932, and $4,467,631, and $3,090,314 respectively. Total Student Financial Assistance Cluster expenditures were $470,995,643 for the year ended June 30, 2023. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: For FSU, management should continue to follow internal controls implemented in February 2023 requiring a second level review of drawdown requests. For BSU, MCTC, and WVNCC, management should follow established policies, procedures and internal controls for the review and approval of drawdown requests. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–024 SPECIAL TESTS AND PROVISIONS – USING A SERVICER TO DELIVER TITLE IV CREDIT BALANCES TO A CARD OR OTHER ACCESS DEVICE (N3) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance (SFA) Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” An institution may enter into an arrangement with a servicer or a financial institution to make a direct payment of federal student aid credit balances to students through electronic funds transfer to a bank account designated by a student or parent, to issue a check payment to the student or to use an access device such as a debit, demand, or smart card provided by the servicer or its financial partner. Regulations at 34 CFR 668.164(e) and (f) establish two different types of arrangements between schools and financial account providers: Tier One arrangements and Tier Two arrangements. The type of arrangement determines the provisions that are applicable to the school. 34 CFR 668.164(e)(2)(viii) states under a T1 arrangement, the institution must “provide to the Secretary an up-to-date URL for the contract and contract data as described in paragraph (e)(2)(vii) of this section for publication in a centralized database accessible to the public.” 34 CFR 668.164(e)(2)(ix) states under a T1 arrangement, the institution must “ensure that the terms of the accounts offered pursuant to a T1 arrangement are not inconsistent with the best financial interests of the students opening them. The Secretary considers this requirement to be met if (A) The institution documents that it conducts reasonable due diligence reviews at least every two years to ascertain whether the fees imposed under the T1 arrangement are, considered as a whole, consistent with or below prevailing market rates; and (B) All contracts for the marketing or offering of accounts pursuant to T1 arrangements to the institution's students make provision for termination of the arrangement by the institution based on complaints received from students or a determination by the institution under paragraph (e)(2)(ix)(A) of this section that the fees assessed under the T1 arrangement are not consistent with or are higher than prevailing market rates.” 34 CFR 668.164(e)(2)(x) states under a T1 arrangement, the institution must “take affirmative steps, by way of contractual arrangements with the third-party servicer as necessary, to ensure that requirements of this section are met with respect to all accounts offered pursuant to T1 arrangements.” Condition: Bluefield State University (BSU), Blueridge Community & Technical College (BRCTC), Concord University (CU), Mountwest Community & Technical College (MCTC), Shepherd University (SU), West Virginia Northern Community College (WVNCC), and West Virginia University at Parkersburg (WVUP) have a T1 arrangement with a third-party servicer. BSU, CU, SU, WVNCC, and WVUP were unable to provide documentation showing that their institutions had submitted a URL to their contract with their third-party servicer and cost information related to their third-party servicer to the U.S. Department of Education for publication in the Cash Management Contracts Database. BSU, BRCTC, CU, MCTC, SU and WVNCC were unable to provide evidence showing that their institutions documented a due diligence review over the fees assessed by their third-party servicer of Title IV credit balances. Cause: BSU, BRCTC, CU, MCTC, SU, WVUP, and WVNCC did not have an internal control in place to review the contract with their third-party servicer of Title IV credit balances or obtain and review the third-party servicer’s Title IV compliance audit to ensure compliance with federal regulations. As such, instances of noncompliance were noted above. Effect or Potential Effect: The schools are not in compliance with certain federal regulations over T1 arrangements contained in 34 CFR 668.164(e). Questioned Costs: None Context: BSU, BRCTC, CU, MCTC, SU, WVNCC, and WVUP had total expenditures of $7,651,688, $5,084,582, $13,833,684, $4,467,631, $15,171,851, $3,090,314, and $6,847,451 respectively. Total expenditures for the SFA Cluster were $470,995,643 for the year ended June 30, 2023. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: The schools should implement internal controls over the review of the contract with their third-party servicer of Title IV credit balances and their Title IV compliance audit, Report on Controls at a Service Organization Relevant to User Entities’ Internal Control over Financial Reporting (SOC 1) and Report on Controls Relevant to Security (SOC 2) to ensure compliance with the federal regulations over T1 arrangements. Documentation over the specific items reviewed and conclusions reached should be retained to support the operating effectiveness of internal controls. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–017 SPECIAL TESTS AND PROVISIONS – SATISFACTORY ACADEMIC PROGRESS (N9) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” 34 CFR 668.16(e) states: “For purposes of determining student eligibility for assistance under a title IV, HEA program, establishes, publishes, and applies reasonable standards for measuring whether an otherwise eligible student is maintaining satisfactory academic progress in his or her educational program. The Secretary considers an institution's standards to be reasonable if the standards are in accordance with the provisions specified in § 668.34.” 34 CFR 668.34 states: “An institution must establish a reasonable satisfactory academic progress policy for determining whether an otherwise eligible student is making satisfactory academic progress in his or her educational program and may receive assistance under the title IV, HEA programs. The Secretary considers the institution's policy to be reasonable if— (1) The policy is at least as strict as the policy the institution applies to a student who is not receiving assistance under the title IV, HEA programs; (2) The policy provides for consistent application of standards to all students within categories of students, e.g., full-time, part-time, undergraduate, and graduate students, and educational programs established by the institution; (3) The policy provides that a student's academic progress is evaluated— (i) At the end of each payment period if the educational program is either one academic year in length or shorter than an academic year; or (ii) For all other educational programs, at the end of each payment period or at least annually to correspond with the end of a payment period; (4) (i) The policy specifies the grade point average (GPA) that a student must achieve at each evaluation, or if a GPA is not an appropriate qualitative measure, a comparable assessment measured against a norm; and (ii) If a student is enrolled in an educational program of more than two academic years, the policy specifies that at the end of the second academic year, the student must have a GPA of at least a “C” or its equivalent, or have academic standing consistent with the institution's requirements for graduation; (5) The policy specifies— (i) For all programs, the maximum timeframe as defined in paragraph (b) of this section; and (ii) For a credit hour program using standard or nonstandard terms that is not a subscription-based program, the pace, measured at each evaluation, at which a student must progress through his or her educational program to ensure that the student will complete the program within the maximum timeframe, calculated by either dividing the cumulative number of hours the student has successfully completed by the cumulative number of hours the student has attempted or by determining the number of hours that the student should have completed by the evaluation point in order to complete the program within the maximum timeframe. In making this calculation, the institution is not required to include remedial courses; (6) The policy describes how a student's GPA and pace of completion are affected by course incompletes, withdrawals, or repetitions, or transfers of credit from other institutions. Credit hours from another institution that are accepted toward the student's educational program must count as both attempted and completed hours; (7) Except as provided in paragraphs (c) and (d) of this section, the policy provides that, at the time of each evaluation, a student who has not achieved the required GPA, or who is not successfully completing his or her educational program at the required pace, is no longer eligible to receive assistance under the title IV, HEA programs; (8) If the institution places students on financial aid warning, or on financial aid probation, as defined in paragraph (b) of this section, the policy describes these statuses and that— (i) A student on financial aid warning may continue to receive assistance under the title IV, HEA programs for one payment period despite a determination that the student is not making satisfactory academic progress. Financial aid warning status may be assigned without an appeal or other action by the student; and (ii) A student on financial aid probation may receive title IV, HEA program funds for one payment period. While a student is on financial aid probation, the institution may require the student to fulfill specific terms and conditions such as taking a reduced course load or enrolling in specific courses. At the end of one payment period on financial aid probation, the student must meet the institution's satisfactory academic progress standards or meet the requirements of the academic plan developed by the institution and the student to qualify for further title IV, HEA program funds; (9) If the institution permits a student to appeal a determination by the institution that he or she is not making satisfactory academic progress, the policy describes— (i) How the student may reestablish his or her eligibility to receive assistance under the title IV, HEA programs; (ii) The basis on which a student may file an appeal: The death of a relative, an injury or illness of the student, or other special circumstances; and (iii) Information the student must submit regarding why the student failed to make satisfactory academic progress, and what has changed in the student's situation that will allow the student to demonstrate satisfactory academic progress at the next evaluation; (10) If the institution does not permit a student to appeal a determination by the institution that he or she is not making satisfactory academic progress, the policy must describe how the student may reestablish his or her eligibility to receive assistance under the title IV, HEA programs; and (11) The policy provides for notification to students of the results of an evaluation that impacts the student's eligibility for title IV, HEA program funds.” Condition: Bluefield State University (BSU), Fairmont State University (FSU), Marshall University (MU), New River Community and Technical College (NRCTC), West Liberty University (WLU), West Virginia Northern Community College (WVNCC), West Virginia School of Osteopathic Medicine (WVSOM), and West Virginia University at Parkersburg (WVUP) did not have adequate internal controls in place surrounding the satisfactory academic progress (SAP) policy. During our testing, we noted there was no documentation retained to evidence that a review of the SAP policy was performed to ensure compliance with federal regulations. Additionally, Blue Ridge Community College (BRCTC) and WVUP did not publish the most recent version of the SAP policy on their websites. Furthermore, WVSOM did not include reasonable standards for measuring whether eligible students are maintaining SAP in their educational program in their published SAP policy as the related SAP polices excluded the required element #11 above. BRCTC had an appropriate policy, but they did not publish the most recent version of the policy on their website. The older version of the SAP policy that was published on their website did not include the required element #11 above. Cause: Management of BRCTC, BSU, FSU, MU, NRCTC, WLU, WVNCC, WVSOM, and WVUP did not retain sufficient documentation for their review procedures over the SAP policy. Management of BRCTC and WVSOM did not include all reasonable standards for measuring whether eligible students are maintaining SAP in their educational program in their published SAP policies. Effect or Potential Effect: The published SAP policy may be deemed insufficient for the compliance requirements. Questioned Costs: None Context: Total Student Financial Assistance Cluster expenditures for BRCTC, BSU, FSU, MU, NRCTC, WLU, WVNCC, WVSOM, and WVUP were $5,084,582, $7,651,688, $17,584,932, $93,991,163, $3,672,778, $16,726,007, $3,090,314, $44,681,370, $6,847,451, respectively, for the year ended June 30, 2023. The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: Management should ensure the SAP is reviewed and approved on an annual basis and supporting documentation of the review retained. Management should design and implement internal controls over the SAP policy to ensure all requirements are included in the policy appropriately and published on the institution’s website timely. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–019 SPECIAL TESTS AND PROVISIONS – GRAMM-LEACH-BLILEY ACT-STUDENT INFORMATION SECURITY (N12) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. At a minimum, an institution’s written information security program — (1) Designates a qualified individual responsible for overseeing and implementing the institution’s information security program and enforcing the information security program in compliance (16 CFR 314.4(a)). (2) Provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution) that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks (16 CFR 3 14.4(b)). (3) Provides for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 3 14.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The eight minimum safeguards that the written information security program must address are summarized as follows: (i) Implement and periodically review access controls. (ii) Conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted. (iii) Encrypt customer information on the institution’s system and when it’s in transit. (iv) Assess apps developed by the institution (v) Implement multi-factor authentication for anyone accessing customer information on the institution’s system (vi) Dispose of customer information securely (vii) Anticipate and evaluate changes to the information system or network. (viii) Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. (4) Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). (5) Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). (6) Addresses how the institution will oversee its information system service providers (16 CFR 314.4(f)). (7) Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Condition: Blue Ridge Community and Technical College (BRCTC), Concord University (CU), Marshall University (MU), New River Community and Technical College (NRCTC), West Liberty University (WLU), West Virginia Northern Community College (WVNCC), and West Virginia University at Parkersburg (WVUP) did not have adequate internal controls in place surrounding the Information Security Program. During our testing, we noted there was no documentation retained to evidence that a review of the Information Security Program was performed to ensure compliance with federal regulations. Additionally, the written Information Security Program for Bluefield University (BSU), CU, MU, NRCTC, Shepherd University (SU), WLU, WVNCC, West Virginia State University (WVSU) and WVUP did not address all required elements per 16 CFR 314.4 outlined above. Furthermore, Fairmont State University (FSU) and Pierpont Community and Technical College (PCTC) did not have a written Information Security Program. For FSU, the written Information Security Program was not in place until May 2023. Cause: Management of BRCTC, CU, MU, NRCTC, WLU, WVNCC, and WVUP did not retain sufficient documentation for their review procedures over the Information Security Program. Management of BSU, CU, MU, NRCTC, SU, WVNCC, and WVSU did not include all reasonable standards required for the Information Security Program. Management of FSU and PCTC did not have a written Information Security Program. Effect or Potential Effect: The written Information Security Program may not be compliant with federal regulations. Questioned Costs: None Context: Total Student Financial Assistance Cluster expenditures for BRCTC, BSU, CU, FSU, MU, NRCTC, PCTC, SU, WLU, WVNCC, WVSU, and WVUP were $5,084,582, $7,651,688, $13,833,684, $17,584,932, $93,991,163, $3,672,778, $4,388,461, $15,171,851, $16,726,007, $3,090,314, $9,313,808, $6,847,451, respectively, for the year ended June 30, 2023. The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: Management should design and implement internal controls over the Information Security Program to ensure all requirements of the GLBA are included in the written Information Security Program appropriately. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–020 INTERNAL CONTROLS OVER SPECIAL TESTS AND PROVISIONS – VERIFICATION (N1) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Fairmont State University (FSU) did not have adequate internal controls in place surrounding the verification compliance requirement. During our testing, we noted for the samples selected that there were multiple selections showing a lack of proper review in the verification process. Cause: FSU did not have adequate internal controls in place to ensure that verification changes identified were processed and submitted to the U.S. Department of Education. Effect or Potential Effect: Students receiving federal aid could receive the incorrect amount of federal student financial assistance. Questioned Costs: N/A Context: We selected a sample of 23 students for FSU and identified 8 instances where the verification forms were not reviewed and approved. Total Student Financial Assistance Cluster expenditures for FSU were $17,584,932 for the year ended June 30, 2023. The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: Prior Year Findings 2022–015 and 2021–014 Recommendation: Management should develop and update internal controls to ensure that controls related to the verification process are implemented. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–021 BANNER INFORMATION TECHNOLOGY GENERAL CONTROLS Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: The State of West Virginia did not implement all logical access and change management controls that are required to be in place to support effective information technology general controls (ITGCs) for the Banner application instances at 12 of 15 universities / colleges. As a result, Banner ITGCs, and therefore, Banner application controls, cannot be relied upon in the period of audit. Cause: Across the 11 universities/colleges (Blue Ridge Community and Technical College, Bluefield State University, Mountwest Community and Technical College, New River Community and Technical College, Pierpont Community and Technical College, Shepherd University, West Liberty University, West Virginia Northern Community College, West Virginia University, West Virginia University at Parkersburg, and West Virginia State University), management did not have a formalized process to support access provisioning events were authorized, approved and documented. Additionally, documentation did not exist to support the timely revocation of access upon a user leaving the university / college. Further, a user access review for Banner was not performed to ensure access remains appropriate based on users’ job responsibilities. We also identified instances where privileged accounts to Banner were shared amongst users and password settings were not configured with leading industry standards. Specific to the change management process, a formalized and documented process was not consistently followed to support that Banner application and supporting infrastructure patches and releases were authorized, tested, and approved prior to being implemented to production. Effect or Potential Effect: There is a risk the data relevant to the Student Financial Assistance Cluster program stored within the student financial aid system may be inappropriately created or modified. Effective testing of the required logical access and change management controls is to support effective ITGCs over the Banner application. As a result, the Banner application cannot be relied on for the audit period. Questioned Costs: None Context: The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: Documentation of the requestor, access rights requested, and approval should be defined and maintained for all new and modified Banner access requests. This documentation should allow for an audit trail of all new and transferred users ensuring that access was granted/removed from the Banner application. Additionally, segregation of duties should exist between the requestor/approver and grantor of the access. Management should remove the terminated user's access from the Banner application. Management should enhance the process of communicating terminated employees to ensure access is revoked or disabled timely. Management should ensure that a review of user access is performed on a periodic basis (e.g., annually) to ensure user access rights remain consistent with user job responsibilities. Review procedures should be performed for all users with access to the Banner application to determine access appropriateness. In addition, management should ensure that adequate documentation is maintained to provide evidence (i.e., sign-offs, hard-copy reports, etc.) of the review. Management should configure Banner password settings related to minimum length, complexity, expiration, history, and account lockout to enhance overall security. Further, privileged access to the Banner application should be granted to administrators via unique IDs to provide accountability and avoid the sharing of default privileged accounts. A formal, documented change process needs implemented to capture authorization, testing and production migration approvals for patches and releases to the Banner application and supporting infrastructure. This documentation should allow for an audit trail of all program changes ensuring that changes were appropriately authorized and administered. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–022 SPECIAL TESTS AND PROVISIONS – RETURN OF TITLE IV FUNDS (N4) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.063/84.268 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 34 CFR section 668.173(b) requires timely return of title IV, HEA program funds. “In accordance with procedures established by the Secretary or FFEL Program lender, an institution returns unearned title IV, HEA program funds timely if - (1) The institution deposits or transfers the funds into the bank account it maintains under § 668.163 no later than 45 days after the date it determines that the student withdrew; (2) The institution initiates an electronic funds transfer (EFT) no later than 45 days after the date it determines that the student withdrew; (3) The institution initiates an electronic transaction, no later than 45 days after the date it determines that the student withdrew, that informs a FFEL lender to adjust the borrower’s loan account for the amount returned; or (4) The institution issues a check no later than 45 days after the date it determines that the student withdrew. An institution does not satisfy this requirement if - (i) The institution’s records show that the check was issued more than 45 days after the date the institution determined that the student withdrew; or (ii) The date on the cancelled check shows that the bank used by the Secretary or FFEL Program lender endorsed that check more than 60 days after the date the institution determined that the student withdrew.” Condition: Blue Ridge Community and Technical College (BRCTC), Mountwest Career & Technical College (MCTC), Pierpont Community and Technical College (PCTC), and West Virginia Northern Community College (WVNCC) were unable to provide adequate documentation showing they maintained an effective review process over the returns of Title IV funds. In addition, for Bluefield State University (BSU) it was noted during compliance testing that certain amounts to be returned were not returned timely. Cause: The institutions do not have adequate internal controls in place over the return of Title IV funds to prevent noncompliance. Effect or Potential Effect: The institutions may not be returning the correct amount of federal student financial assistance required or the funds are not returned within the required time frame to the United States Department of Education. Questioned Costs: None Context: In 11 of 29 instances of internal control testing at BRCTC, we noted that the internal control was not sufficiently documented or not functioning effectively. The support documentation provided did not include any evidence of review. In 19 of 22 instances of internal control testing at MCTC, we noted that the internal control was not sufficiently documented or not functioning effectively. MCTC relied on application controls within the Banner system, which has been determined to have ineffective ITGCs. Additionally, the support documentation provided did not include sufficient evidence of review. In 2 of 18 instances in internal control testing at PCTC, we noted that the internal control was not sufficiently documented or not functioning effectively. In addition, the return to Title IV funds was not completed within the required 45-day timeframe. In all 20 instances of internal control testing at WVNCC, we noted that the internal control was not sufficiently documented or not functioning effectively. WVNCC relied on the application controls within the Banner system, which has been determined to have ineffective ITGCs. Additionally, there was no evidence of review of the calculation in the support documentation provided. In one of 40 returns tested for compliance, we noted that one return related to BSU was not completed within the required 45-day timeframe. Total Student Financial Assistance Cluster expenditures for BRCTC, BSU, MCTC, PCTC, and WVNCC were $5,084,582, $7,651,688, $4,467,631, $4,388,461, and $3,090,314, respectively, for the year ended June 30, 2023. The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643 Identification as a Repeat Finding: Prior Year Findings 2022–011 and 2021–015 Recommendation: Management should implement internal controls to ensure that the correct amount of federal student financial assistance is returned and returned within the required time frame. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–023 INTERNAL CONTROLS OVER CASH MANAGEMENT Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.063/84.268 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: For the period July 2022 – January 2023 at Fairmont State University (FSU), there was no second level review of drawdown requests for accuracy, completeness and agreement to the underlying books and records of the institution. Bluefield State University (BSU) did not retain evidence of the review and approval for one of seven drawdown requests selected for internal control testing. Mountwest Community and Technical College (MCTC) did not have evidence of the review control related to cash management. Three of the 15 drawdown requests selected for internal control testing did not have proper approval prior to the drawdowns. West Virginia Northern Community College (WVNCC) did not retain evidence of the review and approval for seven of 12 drawdown requests selected for control testing. Cause: For FSU, one individual was responsible for preparing the drawdown request and making the drawdown through the U.S. Department of Education’s G5 payment management system. Internal controls were not implemented until February 2023. BSU, MCTC, and WVNCC have policies and procedures in place to review the drawdowns prior to requesting from the U.S. Department of Education’s G5 payment management system; however, the policies and procedures were not followed for these drawdowns. Effect or Potential Effect: Drawdowns could be inaccurate, incomplete, and not agree to underlying books and records of the institution. Questioned Costs: None Context: Total BSU, FSU, MCTC, and WVNCC expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $7,651,688, $17,584,932, and $4,467,631, and $3,090,314 respectively. Total Student Financial Assistance Cluster expenditures were $470,995,643 for the year ended June 30, 2023. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: For FSU, management should continue to follow internal controls implemented in February 2023 requiring a second level review of drawdown requests. For BSU, MCTC, and WVNCC, management should follow established policies, procedures and internal controls for the review and approval of drawdown requests. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–024 SPECIAL TESTS AND PROVISIONS – USING A SERVICER TO DELIVER TITLE IV CREDIT BALANCES TO A CARD OR OTHER ACCESS DEVICE (N3) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance (SFA) Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” An institution may enter into an arrangement with a servicer or a financial institution to make a direct payment of federal student aid credit balances to students through electronic funds transfer to a bank account designated by a student or parent, to issue a check payment to the student or to use an access device such as a debit, demand, or smart card provided by the servicer or its financial partner. Regulations at 34 CFR 668.164(e) and (f) establish two different types of arrangements between schools and financial account providers: Tier One arrangements and Tier Two arrangements. The type of arrangement determines the provisions that are applicable to the school. 34 CFR 668.164(e)(2)(viii) states under a T1 arrangement, the institution must “provide to the Secretary an up-to-date URL for the contract and contract data as described in paragraph (e)(2)(vii) of this section for publication in a centralized database accessible to the public.” 34 CFR 668.164(e)(2)(ix) states under a T1 arrangement, the institution must “ensure that the terms of the accounts offered pursuant to a T1 arrangement are not inconsistent with the best financial interests of the students opening them. The Secretary considers this requirement to be met if (A) The institution documents that it conducts reasonable due diligence reviews at least every two years to ascertain whether the fees imposed under the T1 arrangement are, considered as a whole, consistent with or below prevailing market rates; and (B) All contracts for the marketing or offering of accounts pursuant to T1 arrangements to the institution's students make provision for termination of the arrangement by the institution based on complaints received from students or a determination by the institution under paragraph (e)(2)(ix)(A) of this section that the fees assessed under the T1 arrangement are not consistent with or are higher than prevailing market rates.” 34 CFR 668.164(e)(2)(x) states under a T1 arrangement, the institution must “take affirmative steps, by way of contractual arrangements with the third-party servicer as necessary, to ensure that requirements of this section are met with respect to all accounts offered pursuant to T1 arrangements.” Condition: Bluefield State University (BSU), Blueridge Community & Technical College (BRCTC), Concord University (CU), Mountwest Community & Technical College (MCTC), Shepherd University (SU), West Virginia Northern Community College (WVNCC), and West Virginia University at Parkersburg (WVUP) have a T1 arrangement with a third-party servicer. BSU, CU, SU, WVNCC, and WVUP were unable to provide documentation showing that their institutions had submitted a URL to their contract with their third-party servicer and cost information related to their third-party servicer to the U.S. Department of Education for publication in the Cash Management Contracts Database. BSU, BRCTC, CU, MCTC, SU and WVNCC were unable to provide evidence showing that their institutions documented a due diligence review over the fees assessed by their third-party servicer of Title IV credit balances. Cause: BSU, BRCTC, CU, MCTC, SU, WVUP, and WVNCC did not have an internal control in place to review the contract with their third-party servicer of Title IV credit balances or obtain and review the third-party servicer’s Title IV compliance audit to ensure compliance with federal regulations. As such, instances of noncompliance were noted above. Effect or Potential Effect: The schools are not in compliance with certain federal regulations over T1 arrangements contained in 34 CFR 668.164(e). Questioned Costs: None Context: BSU, BRCTC, CU, MCTC, SU, WVNCC, and WVUP had total expenditures of $7,651,688, $5,084,582, $13,833,684, $4,467,631, $15,171,851, $3,090,314, and $6,847,451 respectively. Total expenditures for the SFA Cluster were $470,995,643 for the year ended June 30, 2023. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: The schools should implement internal controls over the review of the contract with their third-party servicer of Title IV credit balances and their Title IV compliance audit, Report on Controls at a Service Organization Relevant to User Entities’ Internal Control over Financial Reporting (SOC 1) and Report on Controls Relevant to Security (SOC 2) to ensure compliance with the federal regulations over T1 arrangements. Documentation over the specific items reviewed and conclusions reached should be retained to support the operating effectiveness of internal controls. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–017 SPECIAL TESTS AND PROVISIONS – SATISFACTORY ACADEMIC PROGRESS (N9) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” 34 CFR 668.16(e) states: “For purposes of determining student eligibility for assistance under a title IV, HEA program, establishes, publishes, and applies reasonable standards for measuring whether an otherwise eligible student is maintaining satisfactory academic progress in his or her educational program. The Secretary considers an institution's standards to be reasonable if the standards are in accordance with the provisions specified in § 668.34.” 34 CFR 668.34 states: “An institution must establish a reasonable satisfactory academic progress policy for determining whether an otherwise eligible student is making satisfactory academic progress in his or her educational program and may receive assistance under the title IV, HEA programs. The Secretary considers the institution's policy to be reasonable if— (1) The policy is at least as strict as the policy the institution applies to a student who is not receiving assistance under the title IV, HEA programs; (2) The policy provides for consistent application of standards to all students within categories of students, e.g., full-time, part-time, undergraduate, and graduate students, and educational programs established by the institution; (3) The policy provides that a student's academic progress is evaluated— (i) At the end of each payment period if the educational program is either one academic year in length or shorter than an academic year; or (ii) For all other educational programs, at the end of each payment period or at least annually to correspond with the end of a payment period; (4) (i) The policy specifies the grade point average (GPA) that a student must achieve at each evaluation, or if a GPA is not an appropriate qualitative measure, a comparable assessment measured against a norm; and (ii) If a student is enrolled in an educational program of more than two academic years, the policy specifies that at the end of the second academic year, the student must have a GPA of at least a “C” or its equivalent, or have academic standing consistent with the institution's requirements for graduation; (5) The policy specifies— (i) For all programs, the maximum timeframe as defined in paragraph (b) of this section; and (ii) For a credit hour program using standard or nonstandard terms that is not a subscription-based program, the pace, measured at each evaluation, at which a student must progress through his or her educational program to ensure that the student will complete the program within the maximum timeframe, calculated by either dividing the cumulative number of hours the student has successfully completed by the cumulative number of hours the student has attempted or by determining the number of hours that the student should have completed by the evaluation point in order to complete the program within the maximum timeframe. In making this calculation, the institution is not required to include remedial courses; (6) The policy describes how a student's GPA and pace of completion are affected by course incompletes, withdrawals, or repetitions, or transfers of credit from other institutions. Credit hours from another institution that are accepted toward the student's educational program must count as both attempted and completed hours; (7) Except as provided in paragraphs (c) and (d) of this section, the policy provides that, at the time of each evaluation, a student who has not achieved the required GPA, or who is not successfully completing his or her educational program at the required pace, is no longer eligible to receive assistance under the title IV, HEA programs; (8) If the institution places students on financial aid warning, or on financial aid probation, as defined in paragraph (b) of this section, the policy describes these statuses and that— (i) A student on financial aid warning may continue to receive assistance under the title IV, HEA programs for one payment period despite a determination that the student is not making satisfactory academic progress. Financial aid warning status may be assigned without an appeal or other action by the student; and (ii) A student on financial aid probation may receive title IV, HEA program funds for one payment period. While a student is on financial aid probation, the institution may require the student to fulfill specific terms and conditions such as taking a reduced course load or enrolling in specific courses. At the end of one payment period on financial aid probation, the student must meet the institution's satisfactory academic progress standards or meet the requirements of the academic plan developed by the institution and the student to qualify for further title IV, HEA program funds; (9) If the institution permits a student to appeal a determination by the institution that he or she is not making satisfactory academic progress, the policy describes— (i) How the student may reestablish his or her eligibility to receive assistance under the title IV, HEA programs; (ii) The basis on which a student may file an appeal: The death of a relative, an injury or illness of the student, or other special circumstances; and (iii) Information the student must submit regarding why the student failed to make satisfactory academic progress, and what has changed in the student's situation that will allow the student to demonstrate satisfactory academic progress at the next evaluation; (10) If the institution does not permit a student to appeal a determination by the institution that he or she is not making satisfactory academic progress, the policy must describe how the student may reestablish his or her eligibility to receive assistance under the title IV, HEA programs; and (11) The policy provides for notification to students of the results of an evaluation that impacts the student's eligibility for title IV, HEA program funds.” Condition: Bluefield State University (BSU), Fairmont State University (FSU), Marshall University (MU), New River Community and Technical College (NRCTC), West Liberty University (WLU), West Virginia Northern Community College (WVNCC), West Virginia School of Osteopathic Medicine (WVSOM), and West Virginia University at Parkersburg (WVUP) did not have adequate internal controls in place surrounding the satisfactory academic progress (SAP) policy. During our testing, we noted there was no documentation retained to evidence that a review of the SAP policy was performed to ensure compliance with federal regulations. Additionally, Blue Ridge Community College (BRCTC) and WVUP did not publish the most recent version of the SAP policy on their websites. Furthermore, WVSOM did not include reasonable standards for measuring whether eligible students are maintaining SAP in their educational program in their published SAP policy as the related SAP polices excluded the required element #11 above. BRCTC had an appropriate policy, but they did not publish the most recent version of the policy on their website. The older version of the SAP policy that was published on their website did not include the required element #11 above. Cause: Management of BRCTC, BSU, FSU, MU, NRCTC, WLU, WVNCC, WVSOM, and WVUP did not retain sufficient documentation for their review procedures over the SAP policy. Management of BRCTC and WVSOM did not include all reasonable standards for measuring whether eligible students are maintaining SAP in their educational program in their published SAP policies. Effect or Potential Effect: The published SAP policy may be deemed insufficient for the compliance requirements. Questioned Costs: None Context: Total Student Financial Assistance Cluster expenditures for BRCTC, BSU, FSU, MU, NRCTC, WLU, WVNCC, WVSOM, and WVUP were $5,084,582, $7,651,688, $17,584,932, $93,991,163, $3,672,778, $16,726,007, $3,090,314, $44,681,370, $6,847,451, respectively, for the year ended June 30, 2023. The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: Management should ensure the SAP is reviewed and approved on an annual basis and supporting documentation of the review retained. Management should design and implement internal controls over the SAP policy to ensure all requirements are included in the policy appropriately and published on the institution’s website timely. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–019 SPECIAL TESTS AND PROVISIONS – GRAMM-LEACH-BLILEY ACT-STUDENT INFORMATION SECURITY (N12) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. At a minimum, an institution’s written information security program — (1) Designates a qualified individual responsible for overseeing and implementing the institution’s information security program and enforcing the information security program in compliance (16 CFR 314.4(a)). (2) Provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution) that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks (16 CFR 3 14.4(b)). (3) Provides for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 3 14.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The eight minimum safeguards that the written information security program must address are summarized as follows: (i) Implement and periodically review access controls. (ii) Conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted. (iii) Encrypt customer information on the institution’s system and when it’s in transit. (iv) Assess apps developed by the institution (v) Implement multi-factor authentication for anyone accessing customer information on the institution’s system (vi) Dispose of customer information securely (vii) Anticipate and evaluate changes to the information system or network. (viii) Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. (4) Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). (5) Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). (6) Addresses how the institution will oversee its information system service providers (16 CFR 314.4(f)). (7) Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Condition: Blue Ridge Community and Technical College (BRCTC), Concord University (CU), Marshall University (MU), New River Community and Technical College (NRCTC), West Liberty University (WLU), West Virginia Northern Community College (WVNCC), and West Virginia University at Parkersburg (WVUP) did not have adequate internal controls in place surrounding the Information Security Program. During our testing, we noted there was no documentation retained to evidence that a review of the Information Security Program was performed to ensure compliance with federal regulations. Additionally, the written Information Security Program for Bluefield University (BSU), CU, MU, NRCTC, Shepherd University (SU), WLU, WVNCC, West Virginia State University (WVSU) and WVUP did not address all required elements per 16 CFR 314.4 outlined above. Furthermore, Fairmont State University (FSU) and Pierpont Community and Technical College (PCTC) did not have a written Information Security Program. For FSU, the written Information Security Program was not in place until May 2023. Cause: Management of BRCTC, CU, MU, NRCTC, WLU, WVNCC, and WVUP did not retain sufficient documentation for their review procedures over the Information Security Program. Management of BSU, CU, MU, NRCTC, SU, WVNCC, and WVSU did not include all reasonable standards required for the Information Security Program. Management of FSU and PCTC did not have a written Information Security Program. Effect or Potential Effect: The written Information Security Program may not be compliant with federal regulations. Questioned Costs: None Context: Total Student Financial Assistance Cluster expenditures for BRCTC, BSU, CU, FSU, MU, NRCTC, PCTC, SU, WLU, WVNCC, WVSU, and WVUP were $5,084,582, $7,651,688, $13,833,684, $17,584,932, $93,991,163, $3,672,778, $4,388,461, $15,171,851, $16,726,007, $3,090,314, $9,313,808, $6,847,451, respectively, for the year ended June 30, 2023. The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: Management should design and implement internal controls over the Information Security Program to ensure all requirements of the GLBA are included in the written Information Security Program appropriately. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–020 INTERNAL CONTROLS OVER SPECIAL TESTS AND PROVISIONS – VERIFICATION (N1) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Fairmont State University (FSU) did not have adequate internal controls in place surrounding the verification compliance requirement. During our testing, we noted for the samples selected that there were multiple selections showing a lack of proper review in the verification process. Cause: FSU did not have adequate internal controls in place to ensure that verification changes identified were processed and submitted to the U.S. Department of Education. Effect or Potential Effect: Students receiving federal aid could receive the incorrect amount of federal student financial assistance. Questioned Costs: N/A Context: We selected a sample of 23 students for FSU and identified 8 instances where the verification forms were not reviewed and approved. Total Student Financial Assistance Cluster expenditures for FSU were $17,584,932 for the year ended June 30, 2023. The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: Prior Year Findings 2022–015 and 2021–014 Recommendation: Management should develop and update internal controls to ensure that controls related to the verification process are implemented. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–021 BANNER INFORMATION TECHNOLOGY GENERAL CONTROLS Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: The State of West Virginia did not implement all logical access and change management controls that are required to be in place to support effective information technology general controls (ITGCs) for the Banner application instances at 12 of 15 universities / colleges. As a result, Banner ITGCs, and therefore, Banner application controls, cannot be relied upon in the period of audit. Cause: Across the 11 universities/colleges (Blue Ridge Community and Technical College, Bluefield State University, Mountwest Community and Technical College, New River Community and Technical College, Pierpont Community and Technical College, Shepherd University, West Liberty University, West Virginia Northern Community College, West Virginia University, West Virginia University at Parkersburg, and West Virginia State University), management did not have a formalized process to support access provisioning events were authorized, approved and documented. Additionally, documentation did not exist to support the timely revocation of access upon a user leaving the university / college. Further, a user access review for Banner was not performed to ensure access remains appropriate based on users’ job responsibilities. We also identified instances where privileged accounts to Banner were shared amongst users and password settings were not configured with leading industry standards. Specific to the change management process, a formalized and documented process was not consistently followed to support that Banner application and supporting infrastructure patches and releases were authorized, tested, and approved prior to being implemented to production. Effect or Potential Effect: There is a risk the data relevant to the Student Financial Assistance Cluster program stored within the student financial aid system may be inappropriately created or modified. Effective testing of the required logical access and change management controls is to support effective ITGCs over the Banner application. As a result, the Banner application cannot be relied on for the audit period. Questioned Costs: None Context: The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: Documentation of the requestor, access rights requested, and approval should be defined and maintained for all new and modified Banner access requests. This documentation should allow for an audit trail of all new and transferred users ensuring that access was granted/removed from the Banner application. Additionally, segregation of duties should exist between the requestor/approver and grantor of the access. Management should remove the terminated user's access from the Banner application. Management should enhance the process of communicating terminated employees to ensure access is revoked or disabled timely. Management should ensure that a review of user access is performed on a periodic basis (e.g., annually) to ensure user access rights remain consistent with user job responsibilities. Review procedures should be performed for all users with access to the Banner application to determine access appropriateness. In addition, management should ensure that adequate documentation is maintained to provide evidence (i.e., sign-offs, hard-copy reports, etc.) of the review. Management should configure Banner password settings related to minimum length, complexity, expiration, history, and account lockout to enhance overall security. Further, privileged access to the Banner application should be granted to administrators via unique IDs to provide accountability and avoid the sharing of default privileged accounts. A formal, documented change process needs implemented to capture authorization, testing and production migration approvals for patches and releases to the Banner application and supporting infrastructure. This documentation should allow for an audit trail of all program changes ensuring that changes were appropriately authorized and administered. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–024 SPECIAL TESTS AND PROVISIONS – USING A SERVICER TO DELIVER TITLE IV CREDIT BALANCES TO A CARD OR OTHER ACCESS DEVICE (N3) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance (SFA) Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” An institution may enter into an arrangement with a servicer or a financial institution to make a direct payment of federal student aid credit balances to students through electronic funds transfer to a bank account designated by a student or parent, to issue a check payment to the student or to use an access device such as a debit, demand, or smart card provided by the servicer or its financial partner. Regulations at 34 CFR 668.164(e) and (f) establish two different types of arrangements between schools and financial account providers: Tier One arrangements and Tier Two arrangements. The type of arrangement determines the provisions that are applicable to the school. 34 CFR 668.164(e)(2)(viii) states under a T1 arrangement, the institution must “provide to the Secretary an up-to-date URL for the contract and contract data as described in paragraph (e)(2)(vii) of this section for publication in a centralized database accessible to the public.” 34 CFR 668.164(e)(2)(ix) states under a T1 arrangement, the institution must “ensure that the terms of the accounts offered pursuant to a T1 arrangement are not inconsistent with the best financial interests of the students opening them. The Secretary considers this requirement to be met if (A) The institution documents that it conducts reasonable due diligence reviews at least every two years to ascertain whether the fees imposed under the T1 arrangement are, considered as a whole, consistent with or below prevailing market rates; and (B) All contracts for the marketing or offering of accounts pursuant to T1 arrangements to the institution's students make provision for termination of the arrangement by the institution based on complaints received from students or a determination by the institution under paragraph (e)(2)(ix)(A) of this section that the fees assessed under the T1 arrangement are not consistent with or are higher than prevailing market rates.” 34 CFR 668.164(e)(2)(x) states under a T1 arrangement, the institution must “take affirmative steps, by way of contractual arrangements with the third-party servicer as necessary, to ensure that requirements of this section are met with respect to all accounts offered pursuant to T1 arrangements.” Condition: Bluefield State University (BSU), Blueridge Community & Technical College (BRCTC), Concord University (CU), Mountwest Community & Technical College (MCTC), Shepherd University (SU), West Virginia Northern Community College (WVNCC), and West Virginia University at Parkersburg (WVUP) have a T1 arrangement with a third-party servicer. BSU, CU, SU, WVNCC, and WVUP were unable to provide documentation showing that their institutions had submitted a URL to their contract with their third-party servicer and cost information related to their third-party servicer to the U.S. Department of Education for publication in the Cash Management Contracts Database. BSU, BRCTC, CU, MCTC, SU and WVNCC were unable to provide evidence showing that their institutions documented a due diligence review over the fees assessed by their third-party servicer of Title IV credit balances. Cause: BSU, BRCTC, CU, MCTC, SU, WVUP, and WVNCC did not have an internal control in place to review the contract with their third-party servicer of Title IV credit balances or obtain and review the third-party servicer’s Title IV compliance audit to ensure compliance with federal regulations. As such, instances of noncompliance were noted above. Effect or Potential Effect: The schools are not in compliance with certain federal regulations over T1 arrangements contained in 34 CFR 668.164(e). Questioned Costs: None Context: BSU, BRCTC, CU, MCTC, SU, WVNCC, and WVUP had total expenditures of $7,651,688, $5,084,582, $13,833,684, $4,467,631, $15,171,851, $3,090,314, and $6,847,451 respectively. Total expenditures for the SFA Cluster were $470,995,643 for the year ended June 30, 2023. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: The schools should implement internal controls over the review of the contract with their third-party servicer of Title IV credit balances and their Title IV compliance audit, Report on Controls at a Service Organization Relevant to User Entities’ Internal Control over Financial Reporting (SOC 1) and Report on Controls Relevant to Security (SOC 2) to ensure compliance with the federal regulations over T1 arrangements. Documentation over the specific items reviewed and conclusions reached should be retained to support the operating effectiveness of internal controls. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–025 SPECIAL TESTS AND PROVISIONS – PERKINS LOAN RECORDKEEPING AND RECORD RETENTION (N7) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.038 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” As stated in the 2023 OMB Compliance Supplement (34 CFR 674.19), “when an institution uses a third-party servicer for its Perkins Loan program, the institution must perform due diligence to ensure that the third-party servicer is in compliance with the requirements for the functions the third-party servicer is performing for the institution. Such due diligence could include obtaining and reviewing the third-party servicer’s most recent Title IV compliance audit.” 34 CFR 674.19(e)(2) states “an institution shall retain a record of disbursements for each loan made to a borrower on a Master Promissory Note (MPN). This record must show the date and amount of each disbursement.” 34 CFR 674.19(e)(4) states “Manner of retention of promissory notes and repayment schedules. An institution shall keep the original promissory notes and repayment schedules until the loans are satisfied. If required to release original documents in order to enforce the loan, the institution must retain certified true copies of those documents. (i) An institution shall keep the original paper promissory note or original paper MPN and repayment schedules in a locked, fireproof container. (ii) If a promissory note was signed electronically, the institution must store it electronically and the promissory note must be retrievable in a coherent format. An original electronically signed MPN must be retained by the institution for 3 years after all the loans made on the MPN are satisfied. (iii) After the loan obligation is satisfied, the institution shall return the original or a true and exact copy of the note marked “paid in full” to the borrower, or otherwise notify the borrower in writing that the loan is paid in full, and retain a copy for the prescribed period.” Condition: Concord University (CU), Marshall University (MU), Shepherd University (SU), West Liberty University (WLU), West Virginia School of Osteopathic Medicine (WVSOM), and West Virginia University (WVU) did not maintain sufficient evidence of the due diligence review performed over their third-party servicer of its Federal Perkins Loan Program portfolio. While the schools obtained the third-party servicer’s Title IV compliance audit report, Report on Controls at a Service Organization Relevant to User Entities’ Internal Control over Financial Reporting (SOC 1) and Report on Controls Relevant to Security (SOC 2), the schools did not retain documentation showing what specific items were reviewed or what conclusions were reached related to the servicers compliance with the requirements they were contracted for. For six of 40 Perkins loans sampled, WVU could not provide a copy of the MPN. Cause: CU, MU, SU, WLU, WVSOM and WVU did not have effective internal controls in place requiring retention of the due diligence review performed. WVU did not have adequate internal controls in place over the retention of Perkins loan records, specifically, MPNs. Effect or Potential Effect: The third-party servicer could be out of compliance with federal regulations and have ineffective internal controls which could impact the school’s compliance with the Federal Perkins Loan Program requirements. In addition, WVU is in noncompliance with federal Perkins loan recordkeeping and record retention requirements. Questioned Costs: None Context: CU, MU, SU, WLU, WVSOM, and WVU had Federal Perkins Loan Program expenditures of $1,096,355, $2,246,751, $60,304, $1,076,806, $482,984, and $8,147,751, respectively. Total Federal Perkins Loan Program expenditures were $13,183,684 for the year ended June 30, 2023. Total expenditures for the SFA Cluster were $470,995,643 for the year ended June 30, 2023. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: The schools should retain all relevant documentation used in performing the due diligence review, including the specific items reviewed and the conclusions reached. In addition, WVU should ensure it is retaining the required Perkins loan program records for the timeframe required per federal regulations. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–017 SPECIAL TESTS AND PROVISIONS – SATISFACTORY ACADEMIC PROGRESS (N9) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” 34 CFR 668.16(e) states: “For purposes of determining student eligibility for assistance under a title IV, HEA program, establishes, publishes, and applies reasonable standards for measuring whether an otherwise eligible student is maintaining satisfactory academic progress in his or her educational program. The Secretary considers an institution's standards to be reasonable if the standards are in accordance with the provisions specified in § 668.34.” 34 CFR 668.34 states: “An institution must establish a reasonable satisfactory academic progress policy for determining whether an otherwise eligible student is making satisfactory academic progress in his or her educational program and may receive assistance under the title IV, HEA programs. The Secretary considers the institution's policy to be reasonable if— (1) The policy is at least as strict as the policy the institution applies to a student who is not receiving assistance under the title IV, HEA programs; (2) The policy provides for consistent application of standards to all students within categories of students, e.g., full-time, part-time, undergraduate, and graduate students, and educational programs established by the institution; (3) The policy provides that a student's academic progress is evaluated— (i) At the end of each payment period if the educational program is either one academic year in length or shorter than an academic year; or (ii) For all other educational programs, at the end of each payment period or at least annually to correspond with the end of a payment period; (4) (i) The policy specifies the grade point average (GPA) that a student must achieve at each evaluation, or if a GPA is not an appropriate qualitative measure, a comparable assessment measured against a norm; and (ii) If a student is enrolled in an educational program of more than two academic years, the policy specifies that at the end of the second academic year, the student must have a GPA of at least a “C” or its equivalent, or have academic standing consistent with the institution's requirements for graduation; (5) The policy specifies— (i) For all programs, the maximum timeframe as defined in paragraph (b) of this section; and (ii) For a credit hour program using standard or nonstandard terms that is not a subscription-based program, the pace, measured at each evaluation, at which a student must progress through his or her educational program to ensure that the student will complete the program within the maximum timeframe, calculated by either dividing the cumulative number of hours the student has successfully completed by the cumulative number of hours the student has attempted or by determining the number of hours that the student should have completed by the evaluation point in order to complete the program within the maximum timeframe. In making this calculation, the institution is not required to include remedial courses; (6) The policy describes how a student's GPA and pace of completion are affected by course incompletes, withdrawals, or repetitions, or transfers of credit from other institutions. Credit hours from another institution that are accepted toward the student's educational program must count as both attempted and completed hours; (7) Except as provided in paragraphs (c) and (d) of this section, the policy provides that, at the time of each evaluation, a student who has not achieved the required GPA, or who is not successfully completing his or her educational program at the required pace, is no longer eligible to receive assistance under the title IV, HEA programs; (8) If the institution places students on financial aid warning, or on financial aid probation, as defined in paragraph (b) of this section, the policy describes these statuses and that— (i) A student on financial aid warning may continue to receive assistance under the title IV, HEA programs for one payment period despite a determination that the student is not making satisfactory academic progress. Financial aid warning status may be assigned without an appeal or other action by the student; and (ii) A student on financial aid probation may receive title IV, HEA program funds for one payment period. While a student is on financial aid probation, the institution may require the student to fulfill specific terms and conditions such as taking a reduced course load or enrolling in specific courses. At the end of one payment period on financial aid probation, the student must meet the institution's satisfactory academic progress standards or meet the requirements of the academic plan developed by the institution and the student to qualify for further title IV, HEA program funds; (9) If the institution permits a student to appeal a determination by the institution that he or she is not making satisfactory academic progress, the policy describes— (i) How the student may reestablish his or her eligibility to receive assistance under the title IV, HEA programs; (ii) The basis on which a student may file an appeal: The death of a relative, an injury or illness of the student, or other special circumstances; and (iii) Information the student must submit regarding why the student failed to make satisfactory academic progress, and what has changed in the student's situation that will allow the student to demonstrate satisfactory academic progress at the next evaluation; (10) If the institution does not permit a student to appeal a determination by the institution that he or she is not making satisfactory academic progress, the policy must describe how the student may reestablish his or her eligibility to receive assistance under the title IV, HEA programs; and (11) The policy provides for notification to students of the results of an evaluation that impacts the student's eligibility for title IV, HEA program funds.” Condition: Bluefield State University (BSU), Fairmont State University (FSU), Marshall University (MU), New River Community and Technical College (NRCTC), West Liberty University (WLU), West Virginia Northern Community College (WVNCC), West Virginia School of Osteopathic Medicine (WVSOM), and West Virginia University at Parkersburg (WVUP) did not have adequate internal controls in place surrounding the satisfactory academic progress (SAP) policy. During our testing, we noted there was no documentation retained to evidence that a review of the SAP policy was performed to ensure compliance with federal regulations. Additionally, Blue Ridge Community College (BRCTC) and WVUP did not publish the most recent version of the SAP policy on their websites. Furthermore, WVSOM did not include reasonable standards for measuring whether eligible students are maintaining SAP in their educational program in their published SAP policy as the related SAP polices excluded the required element #11 above. BRCTC had an appropriate policy, but they did not publish the most recent version of the policy on their website. The older version of the SAP policy that was published on their website did not include the required element #11 above. Cause: Management of BRCTC, BSU, FSU, MU, NRCTC, WLU, WVNCC, WVSOM, and WVUP did not retain sufficient documentation for their review procedures over the SAP policy. Management of BRCTC and WVSOM did not include all reasonable standards for measuring whether eligible students are maintaining SAP in their educational program in their published SAP policies. Effect or Potential Effect: The published SAP policy may be deemed insufficient for the compliance requirements. Questioned Costs: None Context: Total Student Financial Assistance Cluster expenditures for BRCTC, BSU, FSU, MU, NRCTC, WLU, WVNCC, WVSOM, and WVUP were $5,084,582, $7,651,688, $17,584,932, $93,991,163, $3,672,778, $16,726,007, $3,090,314, $44,681,370, $6,847,451, respectively, for the year ended June 30, 2023. The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: Management should ensure the SAP is reviewed and approved on an annual basis and supporting documentation of the review retained. Management should design and implement internal controls over the SAP policy to ensure all requirements are included in the policy appropriately and published on the institution’s website timely. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–018 INTERNAL CONTROLS OVER FINANCIAL REPORTING Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.063/84.268 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: In our control testing, Pierpont Community and Technical College (PCTC) could not provide adequate documentation of controls in place over Pell Common Origination and Disbursement (COD) reconciliations conducted prior to October 2022 to ensure the data reported is complete, accurate, and prepared in accordance with the required instructions. Effective controls were implemented with the reconciliation for October and remained in effect the remainder of the audit period. Cause: PCTC’s policies and procedures did not require adequate documentation be maintained to demonstrate that controls are operating effectively prior to October 2022. Effect or Potential Effect: The U.S. Department of Education could receive incorrect Pell or Direct Loan payment data. Questioned Costs: N/A Context: Total Direct Loans and Pell expenditures for PCTC were $4,201,839 for the year ended June 30, 2023. The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: Prior Year Findings 2022–014 and 2021–020 Recommendation: We recommend that PCTC continues to use the policies and procedures implemented for reconciliations performed for October 2022 and after. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–019 SPECIAL TESTS AND PROVISIONS – GRAMM-LEACH-BLILEY ACT-STUDENT INFORMATION SECURITY (N12) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. At a minimum, an institution’s written information security program — (1) Designates a qualified individual responsible for overseeing and implementing the institution’s information security program and enforcing the information security program in compliance (16 CFR 314.4(a)). (2) Provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution) that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks (16 CFR 3 14.4(b)). (3) Provides for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 3 14.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The eight minimum safeguards that the written information security program must address are summarized as follows: (i) Implement and periodically review access controls. (ii) Conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted. (iii) Encrypt customer information on the institution’s system and when it’s in transit. (iv) Assess apps developed by the institution (v) Implement multi-factor authentication for anyone accessing customer information on the institution’s system (vi) Dispose of customer information securely (vii) Anticipate and evaluate changes to the information system or network. (viii) Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. (4) Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). (5) Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). (6) Addresses how the institution will oversee its information system service providers (16 CFR 314.4(f)). (7) Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Condition: Blue Ridge Community and Technical College (BRCTC), Concord University (CU), Marshall University (MU), New River Community and Technical College (NRCTC), West Liberty University (WLU), West Virginia Northern Community College (WVNCC), and West Virginia University at Parkersburg (WVUP) did not have adequate internal controls in place surrounding the Information Security Program. During our testing, we noted there was no documentation retained to evidence that a review of the Information Security Program was performed to ensure compliance with federal regulations. Additionally, the written Information Security Program for Bluefield University (BSU), CU, MU, NRCTC, Shepherd University (SU), WLU, WVNCC, West Virginia State University (WVSU) and WVUP did not address all required elements per 16 CFR 314.4 outlined above. Furthermore, Fairmont State University (FSU) and Pierpont Community and Technical College (PCTC) did not have a written Information Security Program. For FSU, the written Information Security Program was not in place until May 2023. Cause: Management of BRCTC, CU, MU, NRCTC, WLU, WVNCC, and WVUP did not retain sufficient documentation for their review procedures over the Information Security Program. Management of BSU, CU, MU, NRCTC, SU, WVNCC, and WVSU did not include all reasonable standards required for the Information Security Program. Management of FSU and PCTC did not have a written Information Security Program. Effect or Potential Effect: The written Information Security Program may not be compliant with federal regulations. Questioned Costs: None Context: Total Student Financial Assistance Cluster expenditures for BRCTC, BSU, CU, FSU, MU, NRCTC, PCTC, SU, WLU, WVNCC, WVSU, and WVUP were $5,084,582, $7,651,688, $13,833,684, $17,584,932, $93,991,163, $3,672,778, $4,388,461, $15,171,851, $16,726,007, $3,090,314, $9,313,808, $6,847,451, respectively, for the year ended June 30, 2023. The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: Management should design and implement internal controls over the Information Security Program to ensure all requirements of the GLBA are included in the written Information Security Program appropriately. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–020 INTERNAL CONTROLS OVER SPECIAL TESTS AND PROVISIONS – VERIFICATION (N1) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Fairmont State University (FSU) did not have adequate internal controls in place surrounding the verification compliance requirement. During our testing, we noted for the samples selected that there were multiple selections showing a lack of proper review in the verification process. Cause: FSU did not have adequate internal controls in place to ensure that verification changes identified were processed and submitted to the U.S. Department of Education. Effect or Potential Effect: Students receiving federal aid could receive the incorrect amount of federal student financial assistance. Questioned Costs: N/A Context: We selected a sample of 23 students for FSU and identified 8 instances where the verification forms were not reviewed and approved. Total Student Financial Assistance Cluster expenditures for FSU were $17,584,932 for the year ended June 30, 2023. The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: Prior Year Findings 2022–015 and 2021–014 Recommendation: Management should develop and update internal controls to ensure that controls related to the verification process are implemented. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–021 BANNER INFORMATION TECHNOLOGY GENERAL CONTROLS Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: The State of West Virginia did not implement all logical access and change management controls that are required to be in place to support effective information technology general controls (ITGCs) for the Banner application instances at 12 of 15 universities / colleges. As a result, Banner ITGCs, and therefore, Banner application controls, cannot be relied upon in the period of audit. Cause: Across the 11 universities/colleges (Blue Ridge Community and Technical College, Bluefield State University, Mountwest Community and Technical College, New River Community and Technical College, Pierpont Community and Technical College, Shepherd University, West Liberty University, West Virginia Northern Community College, West Virginia University, West Virginia University at Parkersburg, and West Virginia State University), management did not have a formalized process to support access provisioning events were authorized, approved and documented. Additionally, documentation did not exist to support the timely revocation of access upon a user leaving the university / college. Further, a user access review for Banner was not performed to ensure access remains appropriate based on users’ job responsibilities. We also identified instances where privileged accounts to Banner were shared amongst users and password settings were not configured with leading industry standards. Specific to the change management process, a formalized and documented process was not consistently followed to support that Banner application and supporting infrastructure patches and releases were authorized, tested, and approved prior to being implemented to production. Effect or Potential Effect: There is a risk the data relevant to the Student Financial Assistance Cluster program stored within the student financial aid system may be inappropriately created or modified. Effective testing of the required logical access and change management controls is to support effective ITGCs over the Banner application. As a result, the Banner application cannot be relied on for the audit period. Questioned Costs: None Context: The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: Documentation of the requestor, access rights requested, and approval should be defined and maintained for all new and modified Banner access requests. This documentation should allow for an audit trail of all new and transferred users ensuring that access was granted/removed from the Banner application. Additionally, segregation of duties should exist between the requestor/approver and grantor of the access. Management should remove the terminated user's access from the Banner application. Management should enhance the process of communicating terminated employees to ensure access is revoked or disabled timely. Management should ensure that a review of user access is performed on a periodic basis (e.g., annually) to ensure user access rights remain consistent with user job responsibilities. Review procedures should be performed for all users with access to the Banner application to determine access appropriateness. In addition, management should ensure that adequate documentation is maintained to provide evidence (i.e., sign-offs, hard-copy reports, etc.) of the review. Management should configure Banner password settings related to minimum length, complexity, expiration, history, and account lockout to enhance overall security. Further, privileged access to the Banner application should be granted to administrators via unique IDs to provide accountability and avoid the sharing of default privileged accounts. A formal, documented change process needs implemented to capture authorization, testing and production migration approvals for patches and releases to the Banner application and supporting infrastructure. This documentation should allow for an audit trail of all program changes ensuring that changes were appropriately authorized and administered. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–022 SPECIAL TESTS AND PROVISIONS – RETURN OF TITLE IV FUNDS (N4) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.063/84.268 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 34 CFR section 668.173(b) requires timely return of title IV, HEA program funds. “In accordance with procedures established by the Secretary or FFEL Program lender, an institution returns unearned title IV, HEA program funds timely if - (1) The institution deposits or transfers the funds into the bank account it maintains under § 668.163 no later than 45 days after the date it determines that the student withdrew; (2) The institution initiates an electronic funds transfer (EFT) no later than 45 days after the date it determines that the student withdrew; (3) The institution initiates an electronic transaction, no later than 45 days after the date it determines that the student withdrew, that informs a FFEL lender to adjust the borrower’s loan account for the amount returned; or (4) The institution issues a check no later than 45 days after the date it determines that the student withdrew. An institution does not satisfy this requirement if - (i) The institution’s records show that the check was issued more than 45 days after the date the institution determined that the student withdrew; or (ii) The date on the cancelled check shows that the bank used by the Secretary or FFEL Program lender endorsed that check more than 60 days after the date the institution determined that the student withdrew.” Condition: Blue Ridge Community and Technical College (BRCTC), Mountwest Career & Technical College (MCTC), Pierpont Community and Technical College (PCTC), and West Virginia Northern Community College (WVNCC) were unable to provide adequate documentation showing they maintained an effective review process over the returns of Title IV funds. In addition, for Bluefield State University (BSU) it was noted during compliance testing that certain amounts to be returned were not returned timely. Cause: The institutions do not have adequate internal controls in place over the return of Title IV funds to prevent noncompliance. Effect or Potential Effect: The institutions may not be returning the correct amount of federal student financial assistance required or the funds are not returned within the required time frame to the United States Department of Education. Questioned Costs: None Context: In 11 of 29 instances of internal control testing at BRCTC, we noted that the internal control was not sufficiently documented or not functioning effectively. The support documentation provided did not include any evidence of review. In 19 of 22 instances of internal control testing at MCTC, we noted that the internal control was not sufficiently documented or not functioning effectively. MCTC relied on application controls within the Banner system, which has been determined to have ineffective ITGCs. Additionally, the support documentation provided did not include sufficient evidence of review. In 2 of 18 instances in internal control testing at PCTC, we noted that the internal control was not sufficiently documented or not functioning effectively. In addition, the return to Title IV funds was not completed within the required 45-day timeframe. In all 20 instances of internal control testing at WVNCC, we noted that the internal control was not sufficiently documented or not functioning effectively. WVNCC relied on the application controls within the Banner system, which has been determined to have ineffective ITGCs. Additionally, there was no evidence of review of the calculation in the support documentation provided. In one of 40 returns tested for compliance, we noted that one return related to BSU was not completed within the required 45-day timeframe. Total Student Financial Assistance Cluster expenditures for BRCTC, BSU, MCTC, PCTC, and WVNCC were $5,084,582, $7,651,688, $4,467,631, $4,388,461, and $3,090,314, respectively, for the year ended June 30, 2023. The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643 Identification as a Repeat Finding: Prior Year Findings 2022–011 and 2021–015 Recommendation: Management should implement internal controls to ensure that the correct amount of federal student financial assistance is returned and returned within the required time frame. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–023 INTERNAL CONTROLS OVER CASH MANAGEMENT Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.063/84.268 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: For the period July 2022 – January 2023 at Fairmont State University (FSU), there was no second level review of drawdown requests for accuracy, completeness and agreement to the underlying books and records of the institution. Bluefield State University (BSU) did not retain evidence of the review and approval for one of seven drawdown requests selected for internal control testing. Mountwest Community and Technical College (MCTC) did not have evidence of the review control related to cash management. Three of the 15 drawdown requests selected for internal control testing did not have proper approval prior to the drawdowns. West Virginia Northern Community College (WVNCC) did not retain evidence of the review and approval for seven of 12 drawdown requests selected for control testing. Cause: For FSU, one individual was responsible for preparing the drawdown request and making the drawdown through the U.S. Department of Education’s G5 payment management system. Internal controls were not implemented until February 2023. BSU, MCTC, and WVNCC have policies and procedures in place to review the drawdowns prior to requesting from the U.S. Department of Education’s G5 payment management system; however, the policies and procedures were not followed for these drawdowns. Effect or Potential Effect: Drawdowns could be inaccurate, incomplete, and not agree to underlying books and records of the institution. Questioned Costs: None Context: Total BSU, FSU, MCTC, and WVNCC expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $7,651,688, $17,584,932, and $4,467,631, and $3,090,314 respectively. Total Student Financial Assistance Cluster expenditures were $470,995,643 for the year ended June 30, 2023. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: For FSU, management should continue to follow internal controls implemented in February 2023 requiring a second level review of drawdown requests. For BSU, MCTC, and WVNCC, management should follow established policies, procedures and internal controls for the review and approval of drawdown requests. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–024 SPECIAL TESTS AND PROVISIONS – USING A SERVICER TO DELIVER TITLE IV CREDIT BALANCES TO A CARD OR OTHER ACCESS DEVICE (N3) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance (SFA) Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” An institution may enter into an arrangement with a servicer or a financial institution to make a direct payment of federal student aid credit balances to students through electronic funds transfer to a bank account designated by a student or parent, to issue a check payment to the student or to use an access device such as a debit, demand, or smart card provided by the servicer or its financial partner. Regulations at 34 CFR 668.164(e) and (f) establish two different types of arrangements between schools and financial account providers: Tier One arrangements and Tier Two arrangements. The type of arrangement determines the provisions that are applicable to the school. 34 CFR 668.164(e)(2)(viii) states under a T1 arrangement, the institution must “provide to the Secretary an up-to-date URL for the contract and contract data as described in paragraph (e)(2)(vii) of this section for publication in a centralized database accessible to the public.” 34 CFR 668.164(e)(2)(ix) states under a T1 arrangement, the institution must “ensure that the terms of the accounts offered pursuant to a T1 arrangement are not inconsistent with the best financial interests of the students opening them. The Secretary considers this requirement to be met if (A) The institution documents that it conducts reasonable due diligence reviews at least every two years to ascertain whether the fees imposed under the T1 arrangement are, considered as a whole, consistent with or below prevailing market rates; and (B) All contracts for the marketing or offering of accounts pursuant to T1 arrangements to the institution's students make provision for termination of the arrangement by the institution based on complaints received from students or a determination by the institution under paragraph (e)(2)(ix)(A) of this section that the fees assessed under the T1 arrangement are not consistent with or are higher than prevailing market rates.” 34 CFR 668.164(e)(2)(x) states under a T1 arrangement, the institution must “take affirmative steps, by way of contractual arrangements with the third-party servicer as necessary, to ensure that requirements of this section are met with respect to all accounts offered pursuant to T1 arrangements.” Condition: Bluefield State University (BSU), Blueridge Community & Technical College (BRCTC), Concord University (CU), Mountwest Community & Technical College (MCTC), Shepherd University (SU), West Virginia Northern Community College (WVNCC), and West Virginia University at Parkersburg (WVUP) have a T1 arrangement with a third-party servicer. BSU, CU, SU, WVNCC, and WVUP were unable to provide documentation showing that their institutions had submitted a URL to their contract with their third-party servicer and cost information related to their third-party servicer to the U.S. Department of Education for publication in the Cash Management Contracts Database. BSU, BRCTC, CU, MCTC, SU and WVNCC were unable to provide evidence showing that their institutions documented a due diligence review over the fees assessed by their third-party servicer of Title IV credit balances. Cause: BSU, BRCTC, CU, MCTC, SU, WVUP, and WVNCC did not have an internal control in place to review the contract with their third-party servicer of Title IV credit balances or obtain and review the third-party servicer’s Title IV compliance audit to ensure compliance with federal regulations. As such, instances of noncompliance were noted above. Effect or Potential Effect: The schools are not in compliance with certain federal regulations over T1 arrangements contained in 34 CFR 668.164(e). Questioned Costs: None Context: BSU, BRCTC, CU, MCTC, SU, WVNCC, and WVUP had total expenditures of $7,651,688, $5,084,582, $13,833,684, $4,467,631, $15,171,851, $3,090,314, and $6,847,451 respectively. Total expenditures for the SFA Cluster were $470,995,643 for the year ended June 30, 2023. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: The schools should implement internal controls over the review of the contract with their third-party servicer of Title IV credit balances and their Title IV compliance audit, Report on Controls at a Service Organization Relevant to User Entities’ Internal Control over Financial Reporting (SOC 1) and Report on Controls Relevant to Security (SOC 2) to ensure compliance with the federal regulations over T1 arrangements. Documentation over the specific items reviewed and conclusions reached should be retained to support the operating effectiveness of internal controls. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–026 INTERNAL CONTROLS OVER SPECIAL TESTS AND PROVISIONS – ENROLLMENT REPORTING (N5) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance (SFA) Cluster U.S. Department of Education 84.063/84.268 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: Internal controls over the review and approval of the enrollment report sent to the National Student Clearinghouse (NSC) were not adequately designed or operating effectively for Bluefield State University (BSU), Blueridge Community and Technical College (BRCTC), Concord University (CU), Fairmont State University (FSU), Marshall University (MU), Mountwest Community and Technical College (MCTC), New River Community and Technical College (NRCTC), Pierpont Community and Technical College (PPCTC), Shepherd University (SU), West Liberty University (WLU), West Virginia Northern Community College (WVNCC), West Virginia State University (WVSU), West Virginia University (WVU), and West Virginia University at Parkersburg (WVUP). For the enrollment reporting transmissions tested for internal controls, we noted the following: * Final review and approval signoff to submit the enrollment report to NSC, the third-party used in the enrollment reporting process, was not consistently retained by the institution (BSU, BRCTC, PCTC, WLU, WVNCC, WVSU) * A record count reconciliation between the final enrollment report, text file and the number of files received by the NSC, including documentation over how any rejected records were addressed, was not retained. (BSU, BRCTC, CU, FSU, MU, MCTC, NRCTC, PCTC, SU, WLU, WVNCC, WVSU, WVU, WVUP) * Details of the validation of student information included in the enrollment report for accuracy was not consistently retained by the institution. (BSU, FSU, MU, MCTC, NRCTC, WVSU) * The NSC automated emails used as a quality checklist regarding due dates, receipt of the text file by the NSC, availability and completion of the Error Resolution Report, and confirmation of certification and processing by the NSC were not consistently retained by the institution (BSU, BRCTC, NRCTC, PCTC, SU, WLU, WVNCC, WVSU, WVUP) Cause: The institutions did not have adequately designed internal controls in place surrounding the enrollment reporting process. Effect or Potential Effect: The institutions may not promptly notify the National Student Loan Data System (NSLDS) of changes in student status in an accurate and complete manner; thus, inaccurate, or incomplete information could be reported to the NSLDS. Questioned Costs: None Context: The total expenditures for the SFA Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: Prior Year Findings 2022–012 and 2021–016 Recommendation: Documentation over the review and approval of the enrollment report for accuracy and completeness should be retained to evidence the operating effectiveness of internal controls. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–017 SPECIAL TESTS AND PROVISIONS – SATISFACTORY ACADEMIC PROGRESS (N9) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” 34 CFR 668.16(e) states: “For purposes of determining student eligibility for assistance under a title IV, HEA program, establishes, publishes, and applies reasonable standards for measuring whether an otherwise eligible student is maintaining satisfactory academic progress in his or her educational program. The Secretary considers an institution's standards to be reasonable if the standards are in accordance with the provisions specified in § 668.34.” 34 CFR 668.34 states: “An institution must establish a reasonable satisfactory academic progress policy for determining whether an otherwise eligible student is making satisfactory academic progress in his or her educational program and may receive assistance under the title IV, HEA programs. The Secretary considers the institution's policy to be reasonable if— (1) The policy is at least as strict as the policy the institution applies to a student who is not receiving assistance under the title IV, HEA programs; (2) The policy provides for consistent application of standards to all students within categories of students, e.g., full-time, part-time, undergraduate, and graduate students, and educational programs established by the institution; (3) The policy provides that a student's academic progress is evaluated— (i) At the end of each payment period if the educational program is either one academic year in length or shorter than an academic year; or (ii) For all other educational programs, at the end of each payment period or at least annually to correspond with the end of a payment period; (4) (i) The policy specifies the grade point average (GPA) that a student must achieve at each evaluation, or if a GPA is not an appropriate qualitative measure, a comparable assessment measured against a norm; and (ii) If a student is enrolled in an educational program of more than two academic years, the policy specifies that at the end of the second academic year, the student must have a GPA of at least a “C” or its equivalent, or have academic standing consistent with the institution's requirements for graduation; (5) The policy specifies— (i) For all programs, the maximum timeframe as defined in paragraph (b) of this section; and (ii) For a credit hour program using standard or nonstandard terms that is not a subscription-based program, the pace, measured at each evaluation, at which a student must progress through his or her educational program to ensure that the student will complete the program within the maximum timeframe, calculated by either dividing the cumulative number of hours the student has successfully completed by the cumulative number of hours the student has attempted or by determining the number of hours that the student should have completed by the evaluation point in order to complete the program within the maximum timeframe. In making this calculation, the institution is not required to include remedial courses; (6) The policy describes how a student's GPA and pace of completion are affected by course incompletes, withdrawals, or repetitions, or transfers of credit from other institutions. Credit hours from another institution that are accepted toward the student's educational program must count as both attempted and completed hours; (7) Except as provided in paragraphs (c) and (d) of this section, the policy provides that, at the time of each evaluation, a student who has not achieved the required GPA, or who is not successfully completing his or her educational program at the required pace, is no longer eligible to receive assistance under the title IV, HEA programs; (8) If the institution places students on financial aid warning, or on financial aid probation, as defined in paragraph (b) of this section, the policy describes these statuses and that— (i) A student on financial aid warning may continue to receive assistance under the title IV, HEA programs for one payment period despite a determination that the student is not making satisfactory academic progress. Financial aid warning status may be assigned without an appeal or other action by the student; and (ii) A student on financial aid probation may receive title IV, HEA program funds for one payment period. While a student is on financial aid probation, the institution may require the student to fulfill specific terms and conditions such as taking a reduced course load or enrolling in specific courses. At the end of one payment period on financial aid probation, the student must meet the institution's satisfactory academic progress standards or meet the requirements of the academic plan developed by the institution and the student to qualify for further title IV, HEA program funds; (9) If the institution permits a student to appeal a determination by the institution that he or she is not making satisfactory academic progress, the policy describes— (i) How the student may reestablish his or her eligibility to receive assistance under the title IV, HEA programs; (ii) The basis on which a student may file an appeal: The death of a relative, an injury or illness of the student, or other special circumstances; and (iii) Information the student must submit regarding why the student failed to make satisfactory academic progress, and what has changed in the student's situation that will allow the student to demonstrate satisfactory academic progress at the next evaluation; (10) If the institution does not permit a student to appeal a determination by the institution that he or she is not making satisfactory academic progress, the policy must describe how the student may reestablish his or her eligibility to receive assistance under the title IV, HEA programs; and (11) The policy provides for notification to students of the results of an evaluation that impacts the student's eligibility for title IV, HEA program funds.” Condition: Bluefield State University (BSU), Fairmont State University (FSU), Marshall University (MU), New River Community and Technical College (NRCTC), West Liberty University (WLU), West Virginia Northern Community College (WVNCC), West Virginia School of Osteopathic Medicine (WVSOM), and West Virginia University at Parkersburg (WVUP) did not have adequate internal controls in place surrounding the satisfactory academic progress (SAP) policy. During our testing, we noted there was no documentation retained to evidence that a review of the SAP policy was performed to ensure compliance with federal regulations. Additionally, Blue Ridge Community College (BRCTC) and WVUP did not publish the most recent version of the SAP policy on their websites. Furthermore, WVSOM did not include reasonable standards for measuring whether eligible students are maintaining SAP in their educational program in their published SAP policy as the related SAP polices excluded the required element #11 above. BRCTC had an appropriate policy, but they did not publish the most recent version of the policy on their website. The older version of the SAP policy that was published on their website did not include the required element #11 above. Cause: Management of BRCTC, BSU, FSU, MU, NRCTC, WLU, WVNCC, WVSOM, and WVUP did not retain sufficient documentation for their review procedures over the SAP policy. Management of BRCTC and WVSOM did not include all reasonable standards for measuring whether eligible students are maintaining SAP in their educational program in their published SAP policies. Effect or Potential Effect: The published SAP policy may be deemed insufficient for the compliance requirements. Questioned Costs: None Context: Total Student Financial Assistance Cluster expenditures for BRCTC, BSU, FSU, MU, NRCTC, WLU, WVNCC, WVSOM, and WVUP were $5,084,582, $7,651,688, $17,584,932, $93,991,163, $3,672,778, $16,726,007, $3,090,314, $44,681,370, $6,847,451, respectively, for the year ended June 30, 2023. The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: Management should ensure the SAP is reviewed and approved on an annual basis and supporting documentation of the review retained. Management should design and implement internal controls over the SAP policy to ensure all requirements are included in the policy appropriately and published on the institution’s website timely. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–018 INTERNAL CONTROLS OVER FINANCIAL REPORTING Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.063/84.268 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: In our control testing, Pierpont Community and Technical College (PCTC) could not provide adequate documentation of controls in place over Pell Common Origination and Disbursement (COD) reconciliations conducted prior to October 2022 to ensure the data reported is complete, accurate, and prepared in accordance with the required instructions. Effective controls were implemented with the reconciliation for October and remained in effect the remainder of the audit period. Cause: PCTC’s policies and procedures did not require adequate documentation be maintained to demonstrate that controls are operating effectively prior to October 2022. Effect or Potential Effect: The U.S. Department of Education could receive incorrect Pell or Direct Loan payment data. Questioned Costs: N/A Context: Total Direct Loans and Pell expenditures for PCTC were $4,201,839 for the year ended June 30, 2023. The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: Prior Year Findings 2022–014 and 2021–020 Recommendation: We recommend that PCTC continues to use the policies and procedures implemented for reconciliations performed for October 2022 and after. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–019 SPECIAL TESTS AND PROVISIONS – GRAMM-LEACH-BLILEY ACT-STUDENT INFORMATION SECURITY (N12) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. At a minimum, an institution’s written information security program — (1) Designates a qualified individual responsible for overseeing and implementing the institution’s information security program and enforcing the information security program in compliance (16 CFR 314.4(a)). (2) Provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution) that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks (16 CFR 3 14.4(b)). (3) Provides for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 3 14.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The eight minimum safeguards that the written information security program must address are summarized as follows: (i) Implement and periodically review access controls. (ii) Conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted. (iii) Encrypt customer information on the institution’s system and when it’s in transit. (iv) Assess apps developed by the institution (v) Implement multi-factor authentication for anyone accessing customer information on the institution’s system (vi) Dispose of customer information securely (vii) Anticipate and evaluate changes to the information system or network. (viii) Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. (4) Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). (5) Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). (6) Addresses how the institution will oversee its information system service providers (16 CFR 314.4(f)). (7) Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). Condition: Blue Ridge Community and Technical College (BRCTC), Concord University (CU), Marshall University (MU), New River Community and Technical College (NRCTC), West Liberty University (WLU), West Virginia Northern Community College (WVNCC), and West Virginia University at Parkersburg (WVUP) did not have adequate internal controls in place surrounding the Information Security Program. During our testing, we noted there was no documentation retained to evidence that a review of the Information Security Program was performed to ensure compliance with federal regulations. Additionally, the written Information Security Program for Bluefield University (BSU), CU, MU, NRCTC, Shepherd University (SU), WLU, WVNCC, West Virginia State University (WVSU) and WVUP did not address all required elements per 16 CFR 314.4 outlined above. Furthermore, Fairmont State University (FSU) and Pierpont Community and Technical College (PCTC) did not have a written Information Security Program. For FSU, the written Information Security Program was not in place until May 2023. Cause: Management of BRCTC, CU, MU, NRCTC, WLU, WVNCC, and WVUP did not retain sufficient documentation for their review procedures over the Information Security Program. Management of BSU, CU, MU, NRCTC, SU, WVNCC, and WVSU did not include all reasonable standards required for the Information Security Program. Management of FSU and PCTC did not have a written Information Security Program. Effect or Potential Effect: The written Information Security Program may not be compliant with federal regulations. Questioned Costs: None Context: Total Student Financial Assistance Cluster expenditures for BRCTC, BSU, CU, FSU, MU, NRCTC, PCTC, SU, WLU, WVNCC, WVSU, and WVUP were $5,084,582, $7,651,688, $13,833,684, $17,584,932, $93,991,163, $3,672,778, $4,388,461, $15,171,851, $16,726,007, $3,090,314, $9,313,808, $6,847,451, respectively, for the year ended June 30, 2023. The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: Management should design and implement internal controls over the Information Security Program to ensure all requirements of the GLBA are included in the written Information Security Program appropriately. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–020 INTERNAL CONTROLS OVER SPECIAL TESTS AND PROVISIONS – VERIFICATION (N1) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: Fairmont State University (FSU) did not have adequate internal controls in place surrounding the verification compliance requirement. During our testing, we noted for the samples selected that there were multiple selections showing a lack of proper review in the verification process. Cause: FSU did not have adequate internal controls in place to ensure that verification changes identified were processed and submitted to the U.S. Department of Education. Effect or Potential Effect: Students receiving federal aid could receive the incorrect amount of federal student financial assistance. Questioned Costs: N/A Context: We selected a sample of 23 students for FSU and identified 8 instances where the verification forms were not reviewed and approved. Total Student Financial Assistance Cluster expenditures for FSU were $17,584,932 for the year ended June 30, 2023. The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: Prior Year Findings 2022–015 and 2021–014 Recommendation: Management should develop and update internal controls to ensure that controls related to the verification process are implemented. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–021 BANNER INFORMATION TECHNOLOGY GENERAL CONTROLS Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: The State of West Virginia did not implement all logical access and change management controls that are required to be in place to support effective information technology general controls (ITGCs) for the Banner application instances at 12 of 15 universities / colleges. As a result, Banner ITGCs, and therefore, Banner application controls, cannot be relied upon in the period of audit. Cause: Across the 11 universities/colleges (Blue Ridge Community and Technical College, Bluefield State University, Mountwest Community and Technical College, New River Community and Technical College, Pierpont Community and Technical College, Shepherd University, West Liberty University, West Virginia Northern Community College, West Virginia University, West Virginia University at Parkersburg, and West Virginia State University), management did not have a formalized process to support access provisioning events were authorized, approved and documented. Additionally, documentation did not exist to support the timely revocation of access upon a user leaving the university / college. Further, a user access review for Banner was not performed to ensure access remains appropriate based on users’ job responsibilities. We also identified instances where privileged accounts to Banner were shared amongst users and password settings were not configured with leading industry standards. Specific to the change management process, a formalized and documented process was not consistently followed to support that Banner application and supporting infrastructure patches and releases were authorized, tested, and approved prior to being implemented to production. Effect or Potential Effect: There is a risk the data relevant to the Student Financial Assistance Cluster program stored within the student financial aid system may be inappropriately created or modified. Effective testing of the required logical access and change management controls is to support effective ITGCs over the Banner application. As a result, the Banner application cannot be relied on for the audit period. Questioned Costs: None Context: The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: Documentation of the requestor, access rights requested, and approval should be defined and maintained for all new and modified Banner access requests. This documentation should allow for an audit trail of all new and transferred users ensuring that access was granted/removed from the Banner application. Additionally, segregation of duties should exist between the requestor/approver and grantor of the access. Management should remove the terminated user's access from the Banner application. Management should enhance the process of communicating terminated employees to ensure access is revoked or disabled timely. Management should ensure that a review of user access is performed on a periodic basis (e.g., annually) to ensure user access rights remain consistent with user job responsibilities. Review procedures should be performed for all users with access to the Banner application to determine access appropriateness. In addition, management should ensure that adequate documentation is maintained to provide evidence (i.e., sign-offs, hard-copy reports, etc.) of the review. Management should configure Banner password settings related to minimum length, complexity, expiration, history, and account lockout to enhance overall security. Further, privileged access to the Banner application should be granted to administrators via unique IDs to provide accountability and avoid the sharing of default privileged accounts. A formal, documented change process needs implemented to capture authorization, testing and production migration approvals for patches and releases to the Banner application and supporting infrastructure. This documentation should allow for an audit trail of all program changes ensuring that changes were appropriately authorized and administered. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–022 SPECIAL TESTS AND PROVISIONS – RETURN OF TITLE IV FUNDS (N4) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.063/84.268 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 34 CFR section 668.173(b) requires timely return of title IV, HEA program funds. “In accordance with procedures established by the Secretary or FFEL Program lender, an institution returns unearned title IV, HEA program funds timely if - (1) The institution deposits or transfers the funds into the bank account it maintains under § 668.163 no later than 45 days after the date it determines that the student withdrew; (2) The institution initiates an electronic funds transfer (EFT) no later than 45 days after the date it determines that the student withdrew; (3) The institution initiates an electronic transaction, no later than 45 days after the date it determines that the student withdrew, that informs a FFEL lender to adjust the borrower’s loan account for the amount returned; or (4) The institution issues a check no later than 45 days after the date it determines that the student withdrew. An institution does not satisfy this requirement if - (i) The institution’s records show that the check was issued more than 45 days after the date the institution determined that the student withdrew; or (ii) The date on the cancelled check shows that the bank used by the Secretary or FFEL Program lender endorsed that check more than 60 days after the date the institution determined that the student withdrew.” Condition: Blue Ridge Community and Technical College (BRCTC), Mountwest Career & Technical College (MCTC), Pierpont Community and Technical College (PCTC), and West Virginia Northern Community College (WVNCC) were unable to provide adequate documentation showing they maintained an effective review process over the returns of Title IV funds. In addition, for Bluefield State University (BSU) it was noted during compliance testing that certain amounts to be returned were not returned timely. Cause: The institutions do not have adequate internal controls in place over the return of Title IV funds to prevent noncompliance. Effect or Potential Effect: The institutions may not be returning the correct amount of federal student financial assistance required or the funds are not returned within the required time frame to the United States Department of Education. Questioned Costs: None Context: In 11 of 29 instances of internal control testing at BRCTC, we noted that the internal control was not sufficiently documented or not functioning effectively. The support documentation provided did not include any evidence of review. In 19 of 22 instances of internal control testing at MCTC, we noted that the internal control was not sufficiently documented or not functioning effectively. MCTC relied on application controls within the Banner system, which has been determined to have ineffective ITGCs. Additionally, the support documentation provided did not include sufficient evidence of review. In 2 of 18 instances in internal control testing at PCTC, we noted that the internal control was not sufficiently documented or not functioning effectively. In addition, the return to Title IV funds was not completed within the required 45-day timeframe. In all 20 instances of internal control testing at WVNCC, we noted that the internal control was not sufficiently documented or not functioning effectively. WVNCC relied on the application controls within the Banner system, which has been determined to have ineffective ITGCs. Additionally, there was no evidence of review of the calculation in the support documentation provided. In one of 40 returns tested for compliance, we noted that one return related to BSU was not completed within the required 45-day timeframe. Total Student Financial Assistance Cluster expenditures for BRCTC, BSU, MCTC, PCTC, and WVNCC were $5,084,582, $7,651,688, $4,467,631, $4,388,461, and $3,090,314, respectively, for the year ended June 30, 2023. The total expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $470,995,643 Identification as a Repeat Finding: Prior Year Findings 2022–011 and 2021–015 Recommendation: Management should implement internal controls to ensure that the correct amount of federal student financial assistance is returned and returned within the required time frame. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–023 INTERNAL CONTROLS OVER CASH MANAGEMENT Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance Cluster U.S. Department of Education 84.007/84.033/84.063/84.268 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” Condition: For the period July 2022 – January 2023 at Fairmont State University (FSU), there was no second level review of drawdown requests for accuracy, completeness and agreement to the underlying books and records of the institution. Bluefield State University (BSU) did not retain evidence of the review and approval for one of seven drawdown requests selected for internal control testing. Mountwest Community and Technical College (MCTC) did not have evidence of the review control related to cash management. Three of the 15 drawdown requests selected for internal control testing did not have proper approval prior to the drawdowns. West Virginia Northern Community College (WVNCC) did not retain evidence of the review and approval for seven of 12 drawdown requests selected for control testing. Cause: For FSU, one individual was responsible for preparing the drawdown request and making the drawdown through the U.S. Department of Education’s G5 payment management system. Internal controls were not implemented until February 2023. BSU, MCTC, and WVNCC have policies and procedures in place to review the drawdowns prior to requesting from the U.S. Department of Education’s G5 payment management system; however, the policies and procedures were not followed for these drawdowns. Effect or Potential Effect: Drawdowns could be inaccurate, incomplete, and not agree to underlying books and records of the institution. Questioned Costs: None Context: Total BSU, FSU, MCTC, and WVNCC expenditures for the Student Financial Assistance Cluster for the year ended June 30, 2023, were $7,651,688, $17,584,932, and $4,467,631, and $3,090,314 respectively. Total Student Financial Assistance Cluster expenditures were $470,995,643 for the year ended June 30, 2023. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: For FSU, management should continue to follow internal controls implemented in February 2023 requiring a second level review of drawdown requests. For BSU, MCTC, and WVNCC, management should follow established policies, procedures and internal controls for the review and approval of drawdown requests. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.
2023–024 SPECIAL TESTS AND PROVISIONS – USING A SERVICER TO DELIVER TITLE IV CREDIT BALANCES TO A CARD OR OTHER ACCESS DEVICE (N3) Federal Program Information: Federal Agency and Program Name Assistance Listing # Student Financial Assistance (SFA) Cluster U.S. Department of Education 84.007/84.033/84.038/84.063/84.268/84.379; U.S. Department of Health and Human Services 93.264/93.342/93.364 Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must “(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States and the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).” An institution may enter into an arrangement with a servicer or a financial institution to make a direct payment of federal student aid credit balances to students through electronic funds transfer to a bank account designated by a student or parent, to issue a check payment to the student or to use an access device such as a debit, demand, or smart card provided by the servicer or its financial partner. Regulations at 34 CFR 668.164(e) and (f) establish two different types of arrangements between schools and financial account providers: Tier One arrangements and Tier Two arrangements. The type of arrangement determines the provisions that are applicable to the school. 34 CFR 668.164(e)(2)(viii) states under a T1 arrangement, the institution must “provide to the Secretary an up-to-date URL for the contract and contract data as described in paragraph (e)(2)(vii) of this section for publication in a centralized database accessible to the public.” 34 CFR 668.164(e)(2)(ix) states under a T1 arrangement, the institution must “ensure that the terms of the accounts offered pursuant to a T1 arrangement are not inconsistent with the best financial interests of the students opening them. The Secretary considers this requirement to be met if (A) The institution documents that it conducts reasonable due diligence reviews at least every two years to ascertain whether the fees imposed under the T1 arrangement are, considered as a whole, consistent with or below prevailing market rates; and (B) All contracts for the marketing or offering of accounts pursuant to T1 arrangements to the institution's students make provision for termination of the arrangement by the institution based on complaints received from students or a determination by the institution under paragraph (e)(2)(ix)(A) of this section that the fees assessed under the T1 arrangement are not consistent with or are higher than prevailing market rates.” 34 CFR 668.164(e)(2)(x) states under a T1 arrangement, the institution must “take affirmative steps, by way of contractual arrangements with the third-party servicer as necessary, to ensure that requirements of this section are met with respect to all accounts offered pursuant to T1 arrangements.” Condition: Bluefield State University (BSU), Blueridge Community & Technical College (BRCTC), Concord University (CU), Mountwest Community & Technical College (MCTC), Shepherd University (SU), West Virginia Northern Community College (WVNCC), and West Virginia University at Parkersburg (WVUP) have a T1 arrangement with a third-party servicer. BSU, CU, SU, WVNCC, and WVUP were unable to provide documentation showing that their institutions had submitted a URL to their contract with their third-party servicer and cost information related to their third-party servicer to the U.S. Department of Education for publication in the Cash Management Contracts Database. BSU, BRCTC, CU, MCTC, SU and WVNCC were unable to provide evidence showing that their institutions documented a due diligence review over the fees assessed by their third-party servicer of Title IV credit balances. Cause: BSU, BRCTC, CU, MCTC, SU, WVUP, and WVNCC did not have an internal control in place to review the contract with their third-party servicer of Title IV credit balances or obtain and review the third-party servicer’s Title IV compliance audit to ensure compliance with federal regulations. As such, instances of noncompliance were noted above. Effect or Potential Effect: The schools are not in compliance with certain federal regulations over T1 arrangements contained in 34 CFR 668.164(e). Questioned Costs: None Context: BSU, BRCTC, CU, MCTC, SU, WVNCC, and WVUP had total expenditures of $7,651,688, $5,084,582, $13,833,684, $4,467,631, $15,171,851, $3,090,314, and $6,847,451 respectively. Total expenditures for the SFA Cluster were $470,995,643 for the year ended June 30, 2023. Identification as a Repeat Finding: This is not a repeat finding from the prior year. Recommendation: The schools should implement internal controls over the review of the contract with their third-party servicer of Title IV credit balances and their Title IV compliance audit, Report on Controls at a Service Organization Relevant to User Entities’ Internal Control over Financial Reporting (SOC 1) and Report on Controls Relevant to Security (SOC 2) to ensure compliance with the federal regulations over T1 arrangements. Documentation over the specific items reviewed and conclusions reached should be retained to support the operating effectiveness of internal controls. Views of Responsible Officials: Management concurs with the finding and has developed a plan to correct the finding.