Finding Text
Finding Type. Immaterial Noncompliance / Significant Deficiency in Internal Control over Compliance (Special
Tests and Provisions). Program. Student Financial Assistance Cluster; U.S. Department of Education; Assistance Listing Numbers 84.007, 84.033, 84.063, and 84.268; Award Numbers P007A221980, P007A211980, P033A221980,
P063P221624, P063P211624, P268K231624, and P268K221624. Criteria. The Federal Trade Commission (FTC) states that the Gramm Leach Bliley Act "requires financial institutions to explain their information‐sharing practices to their customers and safeguard sensitive data." Condition. The most recent Gramm Leach Bliley Policy fails to address the implementation of safeguards to control the risks the institution identifies through its risk assessment, the testing or monitoring the effectiveness of the safeguards implemented, and the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring. Cause. The College does not have a review process in place for ensuring all safeguard policies set forth in the
Gramm Leach Bliley Act are included in its written security policy. Effect. As a result of this condition, the College isn't meeting the safeguard requirements necessary to comply with the FTC. In addition, the lack of safeguard controls creates an increased risk to highly sensitive data that is possessed by the College. Questioned Costs. No costs are required to be questioned as a result of this finding, insomuch as no unallowable expenditures were noted. Recommendation. We recommend that the College implement procedures to ensure that all Gramm Leach Bliley Policies are met and verified by a second individual. View of Responsible Officials. Management agrees with this finding and has prepared a Corrective Action Plan.