Finding Text
Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.268, 84.063, 84.007, 84.033, 84.379 Federal Award Identification Number and Year: P268K252058-2025, P063P242058-2025, P007A253479-2025, P033A253479-2025, P379T262058-2025 Award Period: July 1, 2024 to June 30, 2025 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Compliance, Other Matter Criteria or specific requirement: The Gramm-Leach-Bliley Act (GLBA) (Pub. L. No. 106-102) and its implementing regulations require financial institutions to protect the security, confidentiality, and integrity of customer information (16 CFR Part 314). Title IV-eligible institutions participating in the Federal Student Financial Assistance Programs are considered financial institutions subject to GLBA requirements and agree to comply with these requirements through their Program Participation Agreement with the U.S. Department of Education. Institutions are required to safeguard student financial aid information, including implementing administrative, technical, and physical safeguards, and periodically evaluating the effectiveness of those safeguards, including user access controls (16 CFR 314.3 and 314.4). Condition: CLA identified that the University does not meet all the compliance requirements of the GLBA safeguards rule. Questioned costs: None reported. Context: During our testing, we noted that the University did not demonstrate compliance with certain requirements of the GLBA Safeguards Rule related to ongoing monitoring of system access. Cause: The University does not have a process in place to periodically review and evaluate user access controls. Effect: The absence of periodic review of user access controls increases the risk of unauthorized access to sensitive student financial aid information, which could compromise the security andconfidentiality of protected data. Repeat Finding: No. Recommendation: We recommend the University review the GLBA Safeguards Rule and implement appropriate processes and controls to ensure compliance with all applicable provisions. View of Responsible Official: There is no disagreement with the audit finding.