Finding Text
2023-003
Federal Agency: Department of Education
Federal Program Title: Student Financial Assistance Cluster
Assistance Listing Number: 84.038, 84.268, 84.033, 84.007, 84.063, 84.268, 93.264
Award Period: July 1, 2022 to June 30, 2023
Type of Finding: Significant Deficiency in Internal Control over Compliance, and Other matter
Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as financial institutions and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi).
Condition: Under an institutions Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs.
Questioned Costs: None reported
Context: We noted that the Organization did not meet the Single Audit compliance requirements over the GLBA Safeguards Rule. Audit procedures required the new Safeguards Rule components to be outlined within the Written Information Security Program and associated policies and procedures. We noted the following areas were not covered in existing, current policies at the University: - Access Controls, - Data Encryption
Cause: The University has not created appropriate policies that address all GLBA Safeguards Rules.
Effect: The University was not in compliance with the GLBA Safeguards Rule regulations.
Repeat Finding: No
Recommendation: We recommend that the Organization enhance its policies and procedures to meet GLBA compliance pertaining to the following control areas: - Implement and periodically review access controls, - Encrypt sensitive information at rest and in transit, and - Dispose of customer information securely and follow appropriate data retention requirements
Views of Responsible Officials: There is no disagreement with the audit finding.