Finding Text
Federal agency: Department of Education Federal program title: Student Financial Aid Cluster CFDA Numbers: 84.063, 84.007, 84.033 Award Period: July 1, 2024 through June 30, 2025 Type of Finding: * Significant Deficiency in Internal Control over Compliance * Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the College did not provide formalized documentation which addresses the secured, internal development of applications which transmit sensitive information or the Organizations process to evaluate the security of externally developed applications which transmit sensitive information. The College has not provided formalized documentation which identifies continuous monitoring and safeguarding controls testing. Cause: The college should have an internal control process designed and implemented to ensure compliance with the documentation requirements of the Gramm-Leach-Bliley Act. Effect: The student personal information could be vulnerable. Repeat Finding: No Recommendation: We recommend that the College design and implement controls to ensure that all safeguards for identified risks required by the Gramm-Leach-Bliley Act are fully documented and updated as necessary. Views of responsible officials: There is no disagreement with the audit finding.