Maria CollegeHigher Education

Finding 2021-001 - 84.268, 84.063, 84.033, 84.007 Student Financial Aid Cluster Federal Agency - U.S. Department of Education Grant Period ? Year ended June 30, 2021 Criteria: Institutions participating in Title IV programs are required to comply with various laws and regulations as part of their signed Program Participation Agreement (PPA), including but not limited to, the Federal Trade Commission?s Gramm-Leach-Bliley Act (GLBA) Safeguards Rule (Title 16, Chapter I, Subchapter C, Part 314). Condition: Although the College has performed an information security risk assessment during the year, it was not inclusive of additional control areas, including third-party service providers/vendor (TSP), administrative (policy and procedures), and personnel (conflict of interest, segregation of duties, privileged access, etc.) risks. . Cause: The College?s information security program does not include procedures for the performance of regular risk assessments. Effect: As the College has not performed a thorough information security risk assessment, it may be unaware of the risks to its sensitive data, specifically datasets protected under GLBA. Recommendation: The College should work to implement a standardized and detailed risk management framework, such as those provided by National Institute of Standards and Technology (NIST). Risk assessment documentation should include detailed information regarding current procedures in place, justifications for scoring, safeguards for each identified risk, and remediation plans. Response: The College agrees with the finding and is working to enhance the annual assessment.

Finding 2021-002 - 84.268, 84.063, 84.033, 84.007 Student Financial Aid Cluster Federal Agency - U.S. Department of Education Grant Period ? Year ended June 30, 2021 Criteria: In accordance with 34 CFR 685.309(b)(1), upon receipt of an enrollment report from the Secretary, a school must update all information included in the report and return to the Sectary ?(i) in the manner and format prescribed by the Secretary, (ii) within the timeframe prescribed by the Secretary. According to the National Student Loan Data System (NSLDS) Enrollment Reporting Guide, schools are required to report campus-level enrollment for the student, which includes data related to the student?s overall enrollment, including enrollment status and effective date, anticipated completion date, and certification date. Condition: Within our sample of 4, there were 4 instances where the student had withdrawn from the College, but notification was not given to the NSLDS within the required 45-day time frame. Cause: The College did implement a policy based on prior year recommendations. The Clearinghouse reports withdrawals to NSLDS, the College will be updating enrollment in NSLDS directly upon conducting R2T4 calculations. However, these reporting dates still fell outside the required reporting 45-day time frame. Effect: The College is not meeting the required criteria for notification.

Finding 2020-001 - 84.268, 84.063, 84.033, 84.007 Student Financial Aid Cluster Federal Agency - U.S. Department of Education Grant Period ? Year ended June 30, 2020 Criteria: Institutions participating in Title IV programs are required to comply with various laws and regulations as part of their signed Program Participation Agreement (PPA), including but not limited to, the Federal Trade Commission?s Gramm-Leach-Bliley Act (GLBA) Safeguards Rule (Title 16, Chapter I, Subchapter C, Part 314). Condition: The College has not performed a thorough information security risk assessment which should include employee training, information security incident response, and general security controls. Cause: The College?s information security program does not include procedures for the performance of regular risk assessments. Effect: As the College has not performed a thorough information security risk assessment, it may be unaware of the risks to its sensitive data, specifically datasets protected under GLBA. Recommendation: The College should work to implement a standardized and detailed risk management framework, such as those provided by National Institute of Standards and Technology (NIST). Risk assessment documentation should include detailed information regarding current procedures in place, justifications for scoring, safeguards for each identified risk, and remediation plans. Response: The College acknowledges that a complete risk assessment was not performed and has a planned corrective action.

Finding 2020-002 - 84.268, 84.063, 84.033, 84.007 Student Financial Aid Cluster Federal Agency - U.S. Department of Education Grant Period ? Year ended June 30, 2020 Criteria: In accordance with 34 CFR 685.309(b)(1), upon receipt of an enrollment report from the Secretary, a school must update all information included in the report and return to the Sectary ?(i) in the manner and format prescribed by the Secretary, (ii) within the timeframe prescribed by the Secretary. According to the National Student Loan Data System (NSLDS) Enrollment Reporting Guide, schools are required to report campus-level enrollment for the student, which includes data related to the student?s overall enrollment, including enrollment status and effective date, anticipated completion date, and certification date. Condition: Within our sample of 13, there were 6 instances where the student had withdrawn from the College, but notification was not given to the NSLDS within the required 45-day time frame. Cause: The College does not have a standardized policy in place for their notification of withdrawal students to the NSLDS. Effect: The College is not meeting the required criteria for notification. Recommendation: The College should work to implement a standardized process for notification of withdrawal status to the NSLDS. Response: The College agrees with the finding of notification for withdrawal students

Within our sample of 60 student files, there were seven (7) instances in which the student's enrollment timeline was not accurately or timely reported in NSLDS. Of these seven (7) instances, there were two (2) instances in which the students' enrollment status' were not reported within NSLDS, two (2) instances in which the students were placed on an academic leave of absence, but were administratively withdrawn from the College, and NSLDS was not updated to reflect the change in status, and three (3) instances in which the students withdrew from the College, and NSLDS was not accurately updated.

Within our sample of 60 students, four (4) of whom were enrolled in a Gainful Employment Program, all four (4) students' Gainful Employment information was not reported within NSLDS.

Within our sample of 60 students, of which 10 were withdrawal students, there was one (1) instance where the College failed to determine that the student withdrew from the College without providing notification. Had the College properly determined that the student withdrew from the College and performed the required Return of Title IV funds calculation, no funds would have been required to be returned to the U.S. Department of Education.

Within our audit sample of 60 students, of which 33 received Pell Grant Awards, there were three (3) instances in which the College did not correctly calculate the Pell Grant Awards. In one (1) instance the student should have been awarded $2,400 of Pell Grant funds, but was awarded $1,422, resulting in an under-award of $978. In two (2) instances, in which the student's academic programs included a summer term, the students' were collectively over-awarded $2,098 due to an incorrect calculation due to the inclusion of the required summer term.

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION