Siena CollegeHigher Education

Federal Assistance Listing Number: Various – Student Financial Aid Cluster Criteria: Per 16 CFR 314.4 (c), the College is required to develop, implement, and maintain procedures for the secure disposal of customer information in any format no later than two years after the last date the information is used in connection with the provision of a product or service to the customer to which it relates. The College is also required to implement multifactor authentication for any individual accessing any information system, unless the Qualified Individual has approved in writing the use of reasonably equivalent or more secure access controls. Per the FSA Electronic Announcement GENERAL-23-09, institutions were required to implement these safeguards by June 9, 2023. Condition: The College did not fully implement secure customer information disposal or multi-factor authentication by June 9, 2023, which was the effective deadline. Cause: The College is still working to implement the required secure customer information disposal. The College is also currently in the process of implementing multi-factor authentication on the Banner INB system. Effect: The College is not in compliance with the requirements set by the Safeguards Rule under the Gramm-Leach Bliley Act. Prevalence: Implementing secure customer information disposal proved to be more time consuming due to the volume of customer data. Implementing multi-factor authentication was more complicated and time consuming for the student information system Banner INB. Multi-factor authentication or equivalent access controls are in place for all other systems containing student information. All other elements of the Safeguards Rule appear to be in place as required. Recommendation: The College should implement secure customer information disposal and multi-factor authentication for all systems as soon as possible and reference the related safeguards in the written Information Security Program. The College should also enhance its training and procedures to ensure that any future adjustments to Gramm Leach Bliley Act continue to be met in a timely manner. Management’s Response and Planned Corrective Action: The College is in the process of identifying customer data that should be disposed of or retained beyond two years. Management also acknowledged that implementation of multi-factor authentication for the Banner INB system has taken more time due to the complexity of the system in place. The secure customer information disposal and multi-factor authentication on the Banner INB system is expected to be implemented in 2025.

Criteria 34 CFR 685.309(b), Student Status confirmation report, states that a school shall, (1) Upon receipt of a student status confirmation report from the Secretary, complete and return that report to the Secretary within 30 days of receipt; and (2) Unless it expects to submit its next student status confirmation report to the Secretary within the next 60 days, notify the Secretary within 30 days if it discovers that a Direct Subsidized, Direct Unsubsidized, or Direct PLUS Loan has been made to or on behalf of a student who: (i) Enrolled at that school but has ceased to be enrolled on at least a halftime basis; (ii) Has been accepted for enrollment at that school but failed to enroll on at least a half-time basis for the period for which the loan was intended; or (iii) Has changed his or her permanent address. 45 CFR 75.303(a), Internal Controls, states the non-Federal entity must establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition Found Of the 65 students with enrollment changes selected for testwork, there was 1 student whose enrollment status was not transmitted within the required timeframe. The Department of Education lists several certification methods for enrollment reporting, including certifying directly through the NSLDS web site, certifying through the NLSDS?s batch enrollment reporting process, or through certification of rosters provided to the National Student Clearinghouse (NSC). The College generally certifies its enrollment reports through rosters provided to the NSC. The College was notified of a student?s enrollment change status upon their withdrawal on November 1, 2019. The College certified this status change with the NSC on January 9, 2020 as part of its roster transmission. Based on inquiries of management, all November and December 2019 transmissions were not submitted until January 2020, resulting in reporting outside of the above timing requirement for a total of 4 students. A similar finding was noted in prior year, 2019-001 for enrollment reporting. Possible Asserted Cause The condition found is primarily due to internal control procedures not being followed to ensure timely reporting performed by the Registrar?s Office to verify student enrollment status changes, as necessary. This control deficiency is considered to be a significant deficiency. Effect Failure to submit enrollment status changes to the NSLDS on a timely basis may result in noncompliance with federal laws and regulations, which may prevent the U.S. Department of Education from having an accurate roster file that is updated on a timely basis. Additionally, timely reporting of enrollment changes is necessary to allow for the correct initiation of loan repayments, when necessary. Statistical Sampling The sample was not indented to be, and was not, a statistically valid sample. Questioned Costs None identified. Recommendation We recommend that management review its procedures and enhance internal controls to ensure timely reporting of student enrollment change status, if necessary, is performed by the Registrar?s Office. Views of Responsible Officials The College had appropriate policies in place for enrollment reporting in the Registrar?s Office, however a breakdown in the procedures occurred due to personnel turnover and staff error. The Vice President of Academic Affairs has reviewed with staff the importance of timely and accurate enrollment reporting.

Criteria Part 5 of the Uniform Guidance Compliance Supplement, Student Financial Aid Cluster ? Special Test 5 ? Enrollment Reporting ? requires institutions to complete and return the Enrollment Reporting roster file to NSLDS. The institution determines how often it receives the Enrollment Reporting roster file with the default set at a minimum of every 60 days. Once received, the institution must update for changes in the student status, and submit the changes electronically through the batch method or the NSLDS website. Institutions are responsible for timely reporting, whether they report directly or via a third-party servicer. Condition Found Of the 40 students with enrollment changes selected for testwork, there were 21 students whose enrollment status was not transmitted within the required timeframe. The Department of Education lists several certification methods for enrollment reporting, including certifying directly through the NSLDS web site, certifying through the NLSDS?s batch enrollment reporting process, or through certification of rosters provided to the National Student Clearinghouse (NSC). The College generally certifies its enrollment reports through rosters provided to the NSC. However, as noted above, the College is still responsible for the timely reporting of all required enrollment changes to the NSLDS. The College identified each of these students' enrollment status change upon their graduation on May 12, 2019. The College certified these status changes with the NSC on August 13, 2019 as part of its spring semester roster transmission. The entire roster for spring graduates was not transmitted until August, resulting in a reporting outside of the above timing requirement. Possible Asserted Cause The condition found is primarily due to the lack of timely reporting performed by members of Registrar?s Office to verify that student enrollment change status, as necessary. This control deficiency is considered to be a significant deficiency. Effect Failure to submit enrollment status changes to the NSLDS on a timely basis may result in noncompliance with federal laws and regulations, which may prevent the U.S. Department of Education from having an accurate roster file that is updated on a timely basis. Statistical Sampling The sample was not indented to be, and was not, a statistically valid sample. Questioned Costs None identified. Recommendation We recommend that management review its procedures to ensure timely reporting of student enrollment change status, if necessary, is performed by members of the Registrar?s Office. Views of Responsible Officials As noted in the finding, policies were in place for enrollment reporting in the Registrar?s Office, however a breakdown in the procedures occurred due to personnel turnover and staff error. The Vice President of Academic Affairs has reviewed with staff the importance of timely and accurate enrollment reporting.

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION