Finding #2026-001 Context Finding #2026-001 indicates that the University did not have effective internal controls to ensure required Federal Direct Loan disbursement notifications were sent to parents or students within the regulatory timeframe. 1. Interim Manual Processing of Nightly Communications Effective June 6, 2026, all nightly communications will be manually reviewed and processed until the associated PeopleSoft PSJob has been fully audited and the process changes described in this corrective action plan have been implemented and validated by multiple staff members. This interim control will remain in place until management determines that the automated process has been adequately validated and that the associated monitoring controls are operating effectively. 2. Weekly Audit of Federal Direct Loan Disbursement Notifications The Financial Aid Office will conduct a weekly audit of Direct Loan disbursement notifications using the PeopleSoft PSQuery XCFA_LN_DISB_NOTICE_AUDIT_QRY. The query will be run at the beginning of each week, normally on Monday or, when Monday is a holiday, on the next business day. The review will cover the preceding Sunday through Saturday. The reviewer will examine the results to identify Direct Loan disbursements for which the required notification was not generated or for which the notification date falls outside the applicable regulatory timeframe. Any communication for which the date of the disbursement exceeds 30 days from the date of the notification will be flagged for further review and resolution. The completed query results will be saved to: J:\PeopleSoft\Communications\Disbursement Notice Audit The file name will identify the beginning and ending dates of the period reviewed. 3. Additional Review When the Disbursement Audit Report Is Blank If the XCFA_LN_DISB_NOTICE_AUDIT_QRY produces no results for a weekly review period, an additional audit will be performed to confirm that disbursement activity occurred and that the absence of Direct Loan notifications is not the result of a system or query-processing issue. The additional report will include surrounding disbursement transactions, including non-Direct Loan disbursements, to determine whether disbursements were processed during the review period but no Direct Loan transactions were included in the notification audit. This report will be saved in the same location: J:\PeopleSoft\Communications\Disbursement Notice Audit The report will use the same date convention as the primary audit report and will have a distinct file name identifying it as the supplemental or anomalous activity review. Any unexpected result will be investigated and documented. 4. Enhanced Controls for Nightly Communication Processing Communication selection queries will be modified to include defined processing time parameters. For example, revisions older than 14 days will not be selected for automatic processing without additional review. For each communication type, a report will identify communications that fall outside the established processing window and have not already been satisfied by a successfully processed communication. A separate report will provide the communication's add date and processing status following the nightly selection and processing of the communication batch. Following completion of each communication's processing job, the applicable reports will be distributed by email to: • Alexander Musser (amusser) • Lauren Musser (musser) • Jenni Swindell (jswindel) Email subject lines will clearly identify the communication type and report type. The email body will describe the applicable processing activity and identify any exceptions requiring review. The reports and associated documentation will be reviewed and retained in: J:\PeopleSoft\Communications\Weekly Communications Files will be named using the applicable communication type, report type, and processing date. 5. Monthly Audit of Automated PeopleSoft PSJobs All automated PeopleSoft PSJobs supporting financial aid communications will be subject to a monthly control audit. The monthly review will include a manual review of each step within the applicable PSJob to verify that: • Each step remains properly configured; • Selection criteria and processing parameters remain appropriate; • The correct processes and queries are being executed; • The PSJob is running under the appropriate user account; • No unauthorized or unexplained changes have been made; and • The overall sequence and configuration of the PSJob remain consistent with the intended business process. The review will be documented in the PSJob Log, maintained in: J:\PeopleSoft\PSJobs The PSJob Log will contain a separate worksheet for each applicable PSJob and will document the PSJob's current status, configuration changes, the individual making each change, the user account under which the automation operates, and the date and time of changes. Monthly reviews, system configuration adjustments, and user-related adjustments will be documented in the log. 6. Management Monitoring Management will review the results of the weekly Direct Loan disbursement notification audits and monthly PSJob audits to identify recurring exceptions, processing failures, or trends that could indicate a deficiency in the underlying automated process. Exceptions identified through these reviews will be investigated and corrected. Where appropriate, corrective actions will include modification of the automated process, additional staff review, or modification of the monitoring control. Documentation of the reviews, exceptions, and corrective actions will be retained in accordance with the University's established record-retention practices. Expected Outcome These corrective actions are designed to provide multiple levels of control over Federal Direct Loan disbursement notifications. The combination of automated processing, weekly transaction-level review, exception reporting, supplemental review when expected activity is absent, and monthly PSJob configuration audits is intended to provide reasonable assurance that required Direct Loan disbursement notifications are generated and provided within the applicable federal timeframe and that failures in automated processing are identified promptly. Responsible Parties Jenni Swindell, Associate Director Alex Musser, Business Analyst