NEW YORK COLLEGE OF PODIATRIC MEDICINENon-Profit

Special Test ?Gramm-Leach-Bliley Act - Student Information Security CFDA Number: 84.038/84.268 Program or Cluster Name: Federal Perkins Loan / Federal Direct Student Loans (Student Financial Assistance Cluster) Agency: U.S. Department of Education Criteria The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions (also Colleges) to explain their information-sharing practices to their customers and to safeguard sensitive data. Under an institution?s Program Participation Agreement with the U.S. Department of Education and the Gramm-Leach-Bliley Act, colleges must protect student financial aid information, with particular attention to information provided to colleges by the U.S. Department of Education or otherwise obtained in support of the administration of federal student financial aid programs. Colleges are required to perform a risk assessment that addresses the three required areas noted in 16 CFR 314.4 (b), which are (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other systems failures. In addition, for all risks identified, the College must address each risk with a documented safeguard. Condition We noted that the College did not have a formalized policy to perform a risk assessment that addresses the required areas noted in 16 CFR 314.4 (b). Questioned Costs None. Cause The College has implemented various privacy policies; however, the College has not performed the required risk assessment and documentation of safeguards required by the Gramm-Leach-Bliley-Act. Effect The College does not have a process in place to evaluate the risks to student information on an ongoing basis. Identification as a Repeat Finding The finding is a repeat finding from the prior year. Recommendation We recommend that management develop and implement a policy to ensure that required risk assessments are performed, and that safe guards for all risks identified are implemented. Views of responsible officials and planned corrective actions See attached management?s corrective action plan.

Special Test ? Enrollment Reporting CFDA Number: 84.268 Program or Cluster Name: Federal Direct Student Loans (Student Financial Assistance Cluster) Agency: U.S. Department of Education Criteria Institutions are required to report enrollment information under the Federal Direct Student Loans via the National Student Loan Data System (?NSLDS?). Institutions must complete and return within 15 days the Enrollment Reporting roster file placed in their Student Aid Internet Gateway mailboxes sent by the U.S. Department of Education via NSLDS. Condition Four of the six Enrollment Reporting roster files received by the College during the fiscal year ended June 30, 2021 were not returned within the 15-day period as required by the U.S. Department of Education. Questioned Costs None. Cause Enrollment Reporting is performed on a monthly basis. Based upon the College?s schedule of receiving roster files every 60 days on the first business day of the month, roster files are due within the first half of the month. The current process for updating student enrollment takes place at the end of the month, which does overlap with the due date of the roster file updates. Effect The College did not return updates to Enrollment Reporting roster file to the U.S. Department of Education within the 15 day period after the receipt of the Enrollment Reporting roster file. Identification as a Repeat Finding The finding is a repeat finding from the prior year. Recommendation We recommend the College ensures that Enrollment Reporting roster files are complete and returned within the first 15 days of the month. Views of responsible officials and planned corrective actions See attached management?s corrective action plan.

Special Test ?Gramm-Leach-Bliley Act - Student Information Security CFDA Number: None Program or Cluster Name: Student Financial Assistance Cluster Agency: U.S. Department of Education Criteria The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. Under an institution?s Program Participation Agreement with the U.S. Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the U.S. Department of Education or otherwise obtained in support of the administration of federal student financial aid programs. Institutions are required to perform a risk assessment that addresses the three required areas noted in 16 CFR 314.4 (b), which are (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other systems failures. In addition, for all risks identified, the College must address each risk with a documented safeguard. Condition We noted that the College did not have a formalized policy to perform a risk assessment that addresses the required areas noted in 16 CFR 314.4 (b). Questioned Costs None. Cause The College has implemented various privacy policies; however, the College has not performed the required risk assessment and documentation of safeguards required by the Gramm-Leach-Bliley-Act. Effect The College does not have a process in place to evaluate the risks to student information on an ongoing basis. Identification as a Repeat Finding The finding is not a repeat finding from the prior year. Recommendation We recommend that management develop and implement a policy to ensure that required risk assessments are performed, and that safe guards for all risks identified are implemented. Views of responsible officials and planned corrective actions See attached management?s corrective action plan.

Special Test ? Enrollment Reporting CFDA Number: 84.063/84.268 Program or Cluster Name: Federal Pell Grant Program/Federal Direct Student Loans (Student Financial Assistance Cluster) Agency: U.S. Department of Education Criteria Institutions are required to report enrollment information under the Federal Pell Grant Program and Federal Direct Student Loans via the National Student Loan Data System (?NSLDS?). Institutions must complete and return within 15 days the Enrollment Reporting roster file placed in their Student Aid Internet Gateway mailboxes sent by the U.S. Department of Education via NSLDS. Condition Five of the six Enrollment Reporting roster files received by the College during the fiscal year ended June 30, 2020 were not returned within the 15-day period as required by the U.S. Department of Education. Questioned Costs None. Cause Enrollment Reporting is performed on a monthly basis. Based upon the College?s schedule of receiving roster files every 60 days on the first business day of the month, roster files are due within the first half of the month. The current process for updating student enrollment takes place at the end of the month, which does not overlap with the due date of the roster file updates. Effect The College did not return updates to the Enrollment Reporting roster file to the U.S. Department of Education within the 15 day period after the receipt of the Enrollment Reporting roster file. Identification as a Repeat Finding The finding is not a repeat finding from the prior year. Recommendation We recommend that the College ensure that Enrollment Reporting roster files are completed and returned within the first 15 days of the month. Views of responsible officials and planned corrective actions See attached management?s corrective action plan.

Special Test ? Borrower Data and Reconciliation CFDA Number: 84.268 Program or Cluster Name: Federal Direct Loan Program (Student Financial Assistance Cluster) Agency: U.S. Department of Education Criteria A school must report all loan disbursements and submit required records to Common Origination and Disbursement (?COD?) within 15 days of disbursement. Each month, the COD provides institutions with a School Account Statement (?SAS?) data file. The institution is required to reconcile these files to the school?s financial records on a monthly basis. Condition Management was unable to provide monthly SAS reconciliations. Questioned Costs None. Cause The College experienced a significant transitioning of members in the accounting department. In addition, the COVID-19 pandemic created additional challenges during the reconciliation process. Effect Monthly reconciliations of SAS files were not reconciled to the school?s financial records as required. Identification as a Repeat Finding The finding is not a repeat finding from the prior year. Recommendation We recommend that Management ensure that SAS reconciliations are completed on a monthly basis. Views of responsible officials and planned corrective actions See attached management?s corrective action plan.

2020-006 Eligibility CFDA Number: 84.033/84.268/93.342 Program or Cluster Name: Federal Work-Study Program/ Federal Direct Student Loans/ Health Professions Student Loans, including Primary Care Loans/ Loans for Disadvantaged Students (Student Financial Assistance Cluster) Agency: U.S. Department of Education/U.S. Department of Health and Human Services Criteria In the process of a student applying for financial aid, an Institutional Student Information Record (?ISIR?) is sent electronically to the College. The ISIR contains a significant portion of the information necessary to determine a student?s eligibility for financial aid, and must be reviewed as part of the process of packaging financial aid. Condition During the fiscal year, the Financial Aid Director completed the review of the ISIRs electronically in the PowerFAIDS software. Management was unable to verify the controls in place over the software. Questioned Costs None. Cause The College retired the PowerFAIDS software subsequent to year-end. In addition, the Financial Aid Director that performed the review during the period under audit was no longer employed by the College. Effect We were unable to verify that controls over eligibility were in place during the audit period. Identification as a Repeat Finding The finding is not a repeat finding from the prior year. Recommendation We recommend that Management enhance policies to ensure that performance of controls are documented and accessible in the event of employment changes or transitions to new software or systems. Views of responsible officials and planned corrective actions See attached management?s corrective action plan.

Finding 2019-001 Eligibility CFDA Number Name of Federal Program 84.033, 84.268, 93.342 Student Financial Assistance Cluster Criteria Schools are required to have a system of internal controls in place for the Federal Work Study program to ensure that they will be alerted if the student?s wages approach their maximum award amount, which could cause the student to receive funds in excess of their need. Condition Our compliance test for the year under audit found that 3 of the 40 students sampled received Federal Work Study wages in excess of their maximum award amount, which caused the students to receive funds in excess of their need. Questioned Costs $20,692 Context A statistically valid sample of 40 students was selected for eligibility testing. We found that 3 of the 40 students sampled received Federal Work Study wages in excess of the student?s maximum award amount and the student?s need. Effect During the year under audit, 3 students received Federal Work Study awards in excess of the student?s maximum award amount and need. Cause The College did not have an effective internal control system in place to monitor student?s wages for the Federal Work Study program to ensure they did not exceed their maximum award amount and need. Identification as a Repeat Finding The finding is not a repeat finding from the prior year.We recommend that management develop a system of internal controls for the Federal Work Study program to ensure that wages paid to students do not exceed their maximum award amount and each student?s need. Views of responsible officials and planned corrective actions See management?s corrective action plan in Appendix A.

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION