HERKIMER COUNTY COMMUNITY COLLEGELocal Government

Condition: It was noted that the College has not designated an individual for implementing and monitoring of the College’s information security program and no written information security program is available. Criteria: The GLBA requires the College to explain its information sharing practices to its customers and to safeguard sensitive information. On December 9, 2021, the Federal Trade Commission issued final regulations for 16 CFR Part 314 to implement the GLBA information safeguarding standards that institutions must implement. Institutions are required to be in compliance with the revised or final requirements no later than June 9, 2023. Cause: Unknown Effect or Potential Effect: Currently, the College is not in compliance with the GLBA, a required Program Eligibility compliance for the Student Financial Assistance program. Known Questioned Costs: None noted Context: Adherence to the GLBA is part of program eligibility requirements for the Student Financial Assistance Program. Repeat Finding: No Recommendation: We recommend that the College designate an individual that would take responsibility for implementing and monitoring of the College’s information security program including drafting the Information Security Program for approval by the Board of Trustees.

Findings and Questioned Costs ? Major Federal Award Programs Audit 2019-01 Federal Uniform Guidance Policies and Procedures Condition: The College currently has effective procedural controls in place over the management of Federal awards as concluded through the testing of grant expenditures. However, key changes under the Uniform Guidance expanded the rules regarding the documentation of internal controls over Federal Awards to require that they be documented in writing in the College?s policies and that management should evaluate and document the results of ongoing monitoring to identify internal control issues. The written internal controls should specifically address each of the applicable twelve (12) compliance requirements of the Federal award programs. Criteria: On December 26, 2014 the Office of Management and Budget?s Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, more commonly referred to as the ?Uniform Guidance,? became effective for all Federal awards, whether the funds are provided directly from a Federal agency or passed-through another state or local agency. Cause: Unknown Effect or Potential Effect: The College is more at risk of noncompliance with Federal Grant regulations related to Uniform Administrative Requirements by not having fully effective procedural controls in place. Known Questioned Costs: None noted. Context: The College manages multiple federal programs in a single year. Repeat Finding: No Recommendation: The College should document policies and procedures in accordance with the new Uniform Guidance. This should include monitoring procedures to ensure that internal controls over compliance for the various programs are working effectively. Management?s Response: The College will develop policies and procedures for the new Uniform Guidance. Policies and procedures will be documented and monitored to ensure internal controls over compliance are working effectively.