FAC Explorer

Finding 517981 (2024-003)

Significant Deficiency Repeat Finding
Requirement
N
Questioned Costs
-
Year
2024
Accepted
2025-01-07
Audit: 336229
Organization: Mount Mercy University (IA)
Auditor: Cliftonlarsonallen LLP

AI Summary

  • Core Issue: The University has a significant deficiency in its internal controls over compliance with the Gramm-Leach-Bliley Act (GLBA), failing to adequately protect student financial aid information.
  • Impacted Requirements: The University did not evaluate or update its Written Information Security Program based on monitoring results and risk assessments, violating GLBA safeguard rules.
  • Recommended Follow-Up: The University should review and enhance its security policies to ensure full compliance with GLBA requirements and protect sensitive student information.

Finding Text

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.038, 84.268, 84.033, 84.007, 84.063, 84.268, 93.264 Award Period: July 1, 2023 through June 30, 2024 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matter Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The written information security program (WISP) for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its written information security program are at 16 CFR 314.4. At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Condition: Under a University’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned Costs: None reported Context: During our audit procedures, it was noted that the University’s Written Information Security Program was not evaluated and adjusted based on monitoring results, risk assessments and penetration tests within the audit period. Cause: The University has not created appropriate policies that address all GLBA Safeguard Rules. Effect: The students’ personal information could be vulnerable. Repeat Finding: Yes Recommendation: We recommend that the University review each element of GLBA to ensure compliance with all necessary requirements. Views of Responsible Officials: There is no disagreement with the audit finding.

Categories

Subrecipient Monitoring Significant Deficiency

Other Findings in this Audit

  • 517958 2024-001
    Significant Deficiency Repeat
  • 517959 2024-001
    Significant Deficiency Repeat
  • 517960 2024-001
    Significant Deficiency Repeat
  • 517961 2024-001
    Significant Deficiency Repeat
  • 517962 2024-001
    Significant Deficiency Repeat
  • 517963 2024-001
    Significant Deficiency Repeat
  • 517964 2024-001
    Significant Deficiency Repeat
  • 517965 2024-001
    Significant Deficiency Repeat
  • 517966 2024-002
    Significant Deficiency Repeat
  • 517967 2024-002
    Significant Deficiency Repeat
  • 517968 2024-002
    Significant Deficiency Repeat
  • 517969 2024-002
    Significant Deficiency Repeat
  • 517970 2024-002
    Significant Deficiency Repeat
  • 517971 2024-002
    Significant Deficiency Repeat
  • 517972 2024-002
    Significant Deficiency Repeat
  • 517973 2024-002
    Significant Deficiency Repeat
  • 517974 2024-003
    Significant Deficiency Repeat
  • 517975 2024-003
    Significant Deficiency Repeat
  • 517976 2024-003
    Significant Deficiency Repeat
  • 517977 2024-003
    Significant Deficiency Repeat
  • 517978 2024-003
    Significant Deficiency Repeat
  • 517979 2024-003
    Significant Deficiency Repeat
  • 517980 2024-003
    Significant Deficiency Repeat
  • 1094400 2024-001
    Significant Deficiency Repeat
  • 1094401 2024-001
    Significant Deficiency Repeat
  • 1094402 2024-001
    Significant Deficiency Repeat
  • 1094403 2024-001
    Significant Deficiency Repeat
  • 1094404 2024-001
    Significant Deficiency Repeat
  • 1094405 2024-001
    Significant Deficiency Repeat
  • 1094406 2024-001
    Significant Deficiency Repeat
  • 1094407 2024-001
    Significant Deficiency Repeat
  • 1094408 2024-002
    Significant Deficiency Repeat
  • 1094409 2024-002
    Significant Deficiency Repeat
  • 1094410 2024-002
    Significant Deficiency Repeat
  • 1094411 2024-002
    Significant Deficiency Repeat
  • 1094412 2024-002
    Significant Deficiency Repeat
  • 1094413 2024-002
    Significant Deficiency Repeat
  • 1094414 2024-002
    Significant Deficiency Repeat
  • 1094415 2024-002
    Significant Deficiency Repeat
  • 1094416 2024-003
    Significant Deficiency Repeat
  • 1094417 2024-003
    Significant Deficiency Repeat
  • 1094418 2024-003
    Significant Deficiency Repeat
  • 1094419 2024-003
    Significant Deficiency Repeat
  • 1094420 2024-003
    Significant Deficiency Repeat
  • 1094421 2024-003
    Significant Deficiency Repeat
  • 1094422 2024-003
    Significant Deficiency Repeat
  • 1094423 2024-003
    Significant Deficiency Repeat

Programs in Audit

ALN Program Name Expenditures
84.063 Federal Pell Grant Program $1.72M
84.268 Federal Direct Student Loans $1.26M
84.038 Perkins Loan Program $386,945
84.033 Federal Work-Study Program $171,603
84.007 Federal Supplemental Educational Opportunity Grants $118,124
93.264 Nurse Faculty Loan Program (nflp) $104,129
84.379 Teacher Education Assistance for College and Higher Education Grants (teach Grants) $54,694