Finding Text
Identification of the Federal Program: U.S. Department of Education Federal Pell Grant Program (ALN: 84.063) and Federal Direct Stafford Loans (ALN: 84.268) Criteria: N. Special Tests and Provisions - The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the GLBA because they appear to be significantly engaged in wiring funds to consumers. Under an institution’s Program Participation Agreement with the Department of Education (ED) and the GLBA, institutions must protect student financial aid information, with particular attention to information provided to institutions by ED or otherwise obtained in support of the administration of the federal student financial aid programs. Accordingly, institutions are required to develop, implement, and maintain a written comprehensive information security program. Condition: During our audit procedures, we noted that Centra’s written information security program did not entirely meet all minimum requirements of the GLBA and therefore was not fully in compliance with the requirement. Cause: Insufficient internal controls and administrative oversight with respect to the Special tests and provisions (N) compliance requirement. Effect or Potential Effect: Centra is not fully in compliance with the GLBA requirement for the year ended December 31, 2025. Questioned costs: None Context: Centra had designated a qualified individual responsible for overseeing and implementing and enforcing an information security program (16 CFR 314.4(a)) and have completed the risk assessment (16 CFR 314.4(b)), as required by the GLBA. However, three of the seven GLBA Safeguards Rule elements set forth in 16 CFR 314.4(c), (d), and (g) were still in process of being fully implemented as of December 31, 2025. Repeat finding: This is a repeat of prior year finding 2024-001. Recommendation: We recommend that Centra maintain appropriate internal controls and administrative oversight in order to fully comply with the GLBA requirements of 16 CFR 314.4(c), (d), and (g). Such would include (i) design and implementation of safeguards, (ii) regularly test and monitor the safeguards, and, (iii) adjust the program in light of results of testing and monitoring. View of Responsible Officials: Centra management agrees with this finding and is in process of implementing a corrective action plan. Management indicated that the institution was fully compliant with 11 of the 15 required security controls and partially compliant with the remaining four controls. Management further indicated that mitigating measures had been established for the four controls not yet fully implemented and that efforts were underway to expand those measures to achieve full compliance. Additionally, one additional control is expected to be finalized by the end of July 2026, the remaining applicable controls are expected to be addressed by the end of September 2026, and one control will continue to be addressed through a mitigating measure until the Student Information System (SIS) is replaced.