EIN: 231501197
UEI: N3W3MELK1238
Data as of August 24, 2026
Management decision deadline — for entities that funded this organization
The FAC accepted this audit on February 28, 2025. Under 2 CFR 200.521(d), a pass-through entity that provided federal funds to this organization for this audit period must issue a management decision on these findings by August 28, 2025 (362 days ago).
What is a management decision? →For one withdrawn student out of the 50 tested, the University incorrectly reported the date a student had withdrawn to the National Student Loan Data System (NSLDS). Cause: The University identified that there was an error in reporting for this student, the first date of the semester was entered as the withdrawal date rather than the true withdrawal date. Effect: The accuracy of Title IV student loan records depends heavily on the accuracy of the enrollment information reported by the schools. If an institution does not review, update, and verify student enrollment statuses, effective dates of the enrollment status, and other information, then the Title IV student loan records will be inaccurate, which impacts student loan repayments. Questioned Costs: None. Recommendation: It is recommended that policies and procedures are put in place to verify that the correct effective dates and status changes are reported to NSLDS within required time frames, as well as create accurate reports internally to track all students' whose status changed and verify against the roster submitted to NSLDS. This could include a review of withdrawal or graduation dates compared to the effective dates reported to NSLDS to make sure they are accurate. Management Response: Holy Family University is dedicated to ensuring the accuracy of our reporting to the NSLDS. The following is how we plan to verify the integrity of our reports. The Registrar’s Office will compare the list of students pulled in the monthly NSC process to a report showing all students who withdrew that month. This will ensure that we are reporting all withdrawn/graduated students in a timely manner. In addition, the Registrar’s Office will verify the potential graduation of students whose grades are changed after the end of the term. If the new grade completes their degree, the student will be reported as “graduated” when we process the next session’s graduation applications. This will eliminate the reliance on an external database, as manual updates tend to lack consistency. Lastly, prior to submitting the Graduates Only file to the NSLDS, the Registrar will compare the entire list of graduates to the report showing all students who withdrew throughout the semester. This will be a double check since we will also be checking grade changes, as mentioned above.
Show full finding ▾Hide full finding ▴Finding 2024-001: Significant Deficiency - Enrollment Reporting Repeat Finding: 2023-002 ALN: 84.268 Federal Direct Loan Program; 84.063 Federal Pell Grant Program Federal Award Identification Number: P268K232105; P063P222105 Award Year: July 1, 2023 - June 30, 2024 Federal Agency: U.S. Department of Education Pass Through Entity: Not applicable Criteria: 34 CFR 685.309(b) states that upon receipt of an enrollment report from the Secretary, a school must update all information included in the report and return the report to the Secretary in the manner and format prescribed by the Secretary and within the timeframe prescribed by the Secretary. Unless it expects to submit its next updated enrollment report to the Secretary within the next 60 days, a school must notify the Secretary within 30 days after the date the school discovers that a loan under Title IV of the Act was made to or on behalf of a student who was enrolled or accepted for enrollment at the school, and the student has ceased to be enrolled on at least a half-time basis or failed to enroll on at least a half-time basis for the period for which the loan was intended. Condition: For one withdrawn student out of the 50 tested, the University incorrectly reported the date a student had withdrawn to the National Student Loan Data System (NSLDS). Cause: The University identified that there was an error in reporting for this student, the first date of the semester was entered as the withdrawal date rather than the true withdrawal date. Effect: The accuracy of Title IV student loan records depends heavily on the accuracy of the enrollment information reported by the schools. If an institution does not review, update, and verify student enrollment statuses, effective dates of the enrollment status, and other information, then the Title IV student loan records will be inaccurate, which impacts student loan repayments. Questioned Costs: None. Recommendation: It is recommended that policies and procedures are put in place to verify that the correct effective dates and status changes are reported to NSLDS within required time frames, as well as create accurate reports internally to track all students' whose status changed and verify against the roster submitted to NSLDS. This could include a review of withdrawal or graduation dates compared to the effective dates reported to NSLDS to make sure they are accurate. Management Response: Holy Family University is dedicated to ensuring the accuracy of our reporting to the NSLDS. The following is how we plan to verify the integrity of our reports. The Registrar’s Office will compare the list of students pulled in the monthly NSC process to a report showing all students who withdrew that month. This will ensure that we are reporting all withdrawn/graduated students in a timely manner. In addition, the Registrar’s Office will verify the potential graduation of students whose grades are changed after the end of the term. If the new grade completes their degree, the student will be reported as “graduated” when we process the next session’s graduation applications. This will eliminate the reliance on an external database, as manual updates tend to lack consistency. Lastly, prior to submitting the Graduates Only file to the NSLDS, the Registrar will compare the entire list of graduates to the report showing all students who withdrew throughout the semester. This will be a double check since we will also be checking grade changes, as mentioned above.
Management Response: Holy Family University is dedicated to ensuring the accuracy of our reporting to the NSLDS. The following is how we plan to verify the integrity of our reports. The Registrar's Office will compare the list of students pulled in the monthly NSC process to a report showing all students who withdrew that month. This will ensure that we are reporting all withdrawn/graduated students in a timely manner. In addition, the Registrar's Office will verify the potential graduation of students whose grades are changed after the end of the term. If the new grade completes their degree, the student will be reported as "graduated" when we process the next session's graduation applications. This will eliminate the reliance on an external database, as manual updates tend to lack consistency. Lastly, prior to submitting the Graduates Only file to the NSLDS, the Registrar will compare the entire list of graduates to the report showing all students who withdrew throughout the semester. This will be a double check since we will also be checking grade changes, as mentioned above.
2023-002
FAC accepted this audit on March 6, 2024 — management decision was due September 6, 2024.
For one graduated student tested, the University reported the student as withdrawn to the National Student Loan Data System (NSLDS) while they were confirming degree complete. However, once the student did graduate, the University did not update their status to graduated in NSLDS. For another graduated student, their status was not updated within NSLDS, as they were continuing to a graduate program at the University in the following semester. While the student remained correctly reported as full-time on the campus level reporting, the University did not appropriately report the graduated status for program level reporting within NSLDS. The sample, which consisted of 25 students, was not a statistically valid sample. Cause: The University identified a gap in procedures regarding reporting status changes upon confirming degree completion. The University needs a process in place to identify and report non-traditional graduates. Effect: The accuracy of Title IV student loan records depends heavily on the accuracy of the enrollment information reported by the schools. If an institution does not review, update, and verify student enrollment statuses, effective dates of the enrollment status, and other information, then the Title IV student loan records will be inaccurate, which impacts student loan repayments. Questioned Costs: None. Recommendation: It is recommended that policies and procedures are put in place to verify that the correct effective dates and status changes are reported to NSLDS within required time frames, as well as create accurate reports internally to track all students' whose status changed and verify against the roster submitted to NSLDS. This could include a review of withdrawal or graduation dates compared to the effective dates reported to NSLDS to make sure they are accurate. Management Response: The University understands the importance of accurate enrollment information. The status for the first student has been corrected from withdrawn to graduated. The student was reported correctly after the end of the Fall 2022 semester as withdrawn since they had not fully completed their degree requirements. The graduation status for the second student was updated to graduated for their undergraduate degree as they continue full-time in their graduate degree program at the University.
Show full finding ▾Hide full finding ▴ALN: 84.268 Federal Direct Loan Program; 84.063 Federal Pell Grant Program Federal Award Identification Number: P268K232105; P063P222105 Award Year: July 1, 2022 - June 30, 2023 Federal Agency: U.S. Department of Education Pass Through Entity: Not applicable Criteria: 34 CFR 685.309(b) states that upon receipt of an enrollment report from the Secretary, a school must update all information included in the report and return the report to the Secretary in the manner and format prescribed by the Secretary and within the timeframe prescribed by the Secretary. Unless it expects to submit its next updated enrollment report to the Secretary within the next 60 days, a school must notify the Secretary within 30 days after the date the school discovers that a loan under Title IV of the Act was made to or on behalf of a student who was enrolled or accepted for enrollment at the school, and the student has ceased to be enrolled on at least a half-time basis or failed to enroll on at least a half-time basis for the period for which the loan was intended. Condition: For one graduated student tested, the University reported the student as withdrawn to the National Student Loan Data System (NSLDS) while they were confirming degree complete. However, once the student did graduate, the University did not update their status to graduated in NSLDS. For another graduated student, their status was not updated within NSLDS, as they were continuing to a graduate program at the University in the following semester. While the student remained correctly reported as full-time on the campus level reporting, the University did not appropriately report the graduated status for program level reporting within NSLDS. The sample, which consisted of 25 students, was not a statistically valid sample. Cause: The University identified a gap in procedures regarding reporting status changes upon confirming degree completion. The University needs a process in place to identify and report non-traditional graduates. Effect: The accuracy of Title IV student loan records depends heavily on the accuracy of the enrollment information reported by the schools. If an institution does not review, update, and verify student enrollment statuses, effective dates of the enrollment status, and other information, then the Title IV student loan records will be inaccurate, which impacts student loan repayments. Questioned Costs: None. Recommendation: It is recommended that policies and procedures are put in place to verify that the correct effective dates and status changes are reported to NSLDS within required time frames, as well as create accurate reports internally to track all students' whose status changed and verify against the roster submitted to NSLDS. This could include a review of withdrawal or graduation dates compared to the effective dates reported to NSLDS to make sure they are accurate. Management Response: The University understands the importance of accurate enrollment information. The status for the first student has been corrected from withdrawn to graduated. The student was reported correctly after the end of the Fall 2022 semester as withdrawn since they had not fully completed their degree requirements. The graduation status for the second student was updated to graduated for their undergraduate degree as they continue full-time in their graduate degree program at the University.
ALN: 84.268 Federal Direct Loan Program; 84.063 Federal Pell Grant Program Recommendation: It is recommended that policies and procedures are put in place to verify that the correct effective dates and status changes are reported to NSLDS within required time frames, as well as create accurate reports internally to track all students' whose status changed and verify against the roster submitted to NSLDS. This could include a review of withdrawal or graduation dates compared to the effective dates reported to NSLDS to make sure they are accurate. Action Taken: We have strengthened our procedures for our NSLDS report verification process as we continually strive to comply with all regulations. Once the Ellucian NSC graduation report is run, the Registrar's Office will compare that against at least 10 % of the students on the graduation list to ensure accuracy. There are six times a year that the graduation process occurs. If a student is no longer enrolled but has not completed degree requirements (i.e. takes an incomplete in a course), they would be reported as withdrawn during the next semester. However, once they complete their degree requirements and officially graduate, they will get reported as "graduated" on the next graduation run. Since these students are processed manually, the Registrar's Office will maintain a listing of the "non-traditional graduates" (i.e. finishes degree requirements outside of the six standard times per year) and verify their status is recorded correctly in NSLDS. They will also compare at least 10% of the students on the course drops and withdraw report against the status and date generated by the Ellucian NSC report to ensure accuracy. The Registrar's Office will also realign the NSC reporting schedule for graduating students to align with our processing schedule beginning with the Spring 2024 semester.
FAC accepted this audit on March 21, 2023 — management decision was due September 21, 2023.
The University has not performed a risk assessments to address (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other systems failures, and document safeguards for identified risks as required by the Gramm-Leach Bliley Act (GLBA). In addition, the University has not documented safeguards for identified risks. Cause: The University did not have procedures and processes in place specific to GLBA and therefore, did not document the required risk assessment or risk mitigation. Effect: With no formal policies and procedures surrounding student information security, the University may be susceptible to threats of consumer nonpublic personal information. Failure to comply with GLBA standards may bring penalties ranging from monetary fines to restriction or loss of eligibility for Title IV funding. Questioned Costs: None. Recommendation: The University should perform and document an annual risk assessment to determine the University's specific risks relevant to protecting consumer nonpublic personal information. At a minimum, the University should have at least one risk statement aligned or referenced to each of the three required areas noted in the GLBA law at 16 CFR 314.4 (b). Finally, the University should identify and document at least one safeguard (i.e., control) for each of the risks identified and document in the risk assessment. Each control should be aligned or referenced to the risk(s) to which the safeguard applies. Management Response: While a specific GLBA audit has not been performed, the general guidance from the National Institute of Standard and Technology (NIST) is well aligned with the controls needed to protect data as required by the Family Educational Rights and Privacy Act (FERPA) guidance.In addition to these policies and procedures in place at the University, in November 2021, an Interim CIO consultant was engaged to assess the technology environment and make recommendations. Risk-based priorities were established that included strengthening the network, firewalls, email access (including Multi-Factor Authentication (MFA)), applications and policies/procedures. The Interim CIO consultant was hired as a fulltime employee as of January 1, 2022. A significant investment was made to upgrade and enhance the security features of the network. Moving forward, management plans to address 1) designing a student portal to mitigate risks associated with data in transit from students and 2) reviewing and updating policies to align with stronger security measures required by employees, account deactivation, guidance/consolidation of data storage and new processes being streamlined across the University initiated by new leadership and organizational re-alignment.
Show full finding ▾Hide full finding ▴Award Year: July 1, 2021 - June 30, 2022 Federal Agency: U.S. Department of Education Pass Through Entity: Not applicable Criteria: In accordance with Title IV regulations (CFR 314.1 (b)), an Institution must protect student financial aid information by designating an individual to coordinate the information security program, perform a risk assessment that addresses (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other systems failures, and document safeguards for identified risks. Condition: The University has not performed a risk assessments to address (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other systems failures, and document safeguards for identified risks as required by the Gramm-Leach Bliley Act (GLBA). In addition, the University has not documented safeguards for identified risks. Cause: The University did not have procedures and processes in place specific to GLBA and therefore, did not document the required risk assessment or risk mitigation. Effect: With no formal policies and procedures surrounding student information security, the University may be susceptible to threats of consumer nonpublic personal information. Failure to comply with GLBA standards may bring penalties ranging from monetary fines to restriction or loss of eligibility for Title IV funding. Questioned Costs: None. Recommendation: The University should perform and document an annual risk assessment to determine the University's specific risks relevant to protecting consumer nonpublic personal information. At a minimum, the University should have at least one risk statement aligned or referenced to each of the three required areas noted in the GLBA law at 16 CFR 314.4 (b). Finally, the University should identify and document at least one safeguard (i.e., control) for each of the risks identified and document in the risk assessment. Each control should be aligned or referenced to the risk(s) to which the safeguard applies. Management Response: While a specific GLBA audit has not been performed, the general guidance from the National Institute of Standard and Technology (NIST) is well aligned with the controls needed to protect data as required by the Family Educational Rights and Privacy Act (FERPA) guidance.In addition to these policies and procedures in place at the University, in November 2021, an Interim CIO consultant was engaged to assess the technology environment and make recommendations. Risk-based priorities were established that included strengthening the network, firewalls, email access (including Multi-Factor Authentication (MFA)), applications and policies/procedures. The Interim CIO consultant was hired as a fulltime employee as of January 1, 2022. A significant investment was made to upgrade and enhance the security features of the network. Moving forward, management plans to address 1) designing a student portal to mitigate risks associated with data in transit from students and 2) reviewing and updating policies to align with stronger security measures required by employees, account deactivation, guidance/consolidation of data storage and new processes being streamlined across the University initiated by new leadership and organizational re-alignment.
Holy Family University respectfully submits the following corrective action plan for the year ended June 30, 2022. Name and address of independent public accounting firm: Baker Tilly US, LLP 1650 Market Street, Suite 4500 Philadelphia, Pennsylvania 19103 Audit period: June 30, 2022 The findings from the June 30, 2022 schedule of findings and questioned costs are discussed below. Finding 2022-001: Special Tests and Provisions - Gramm-Leach Bliley Act (?GLBA?) 84.268 Federal Direct Loan Program; 84.063 Federal Pell Grant Program, 84.033 Federal Work Study Program, 84.007 Federal Supplemental Education Opportunity Grant; 84.038 Federal Perkins Loan Program Recommendation: The University should perform and document an annual risk assessment to determine the University's specific risks relevant to protecting consumer nonpublic personal information. At a minimum, the University should have at least one risk statement aligned or referenced to each of the three required areas noted in the GLBA law at 16 CFR 314.4 (b). Finally, the University should identify and document at least one safeguard (i.e., control) for each of the risks identified and document in the risk assessment. Each control should be aligned or referenced to the risk(s) to which the safeguard applies. Action Taken: The institution acknowledges and understands the requirements set forth by the Gramm-Leach-Bliley Act (GLBA) and is in the process of selecting a qualified individual for the partner role. Our team is actively developing a timeline to ensure full compliance with GLBA by June 9, 2023. In order to prioritize our efforts, we have identified areas of risk and implemented risk-based priorities to strengthen our network security, including firewalls, email access with Multi-Factor Authentication (MFA), applications, and policies/procedures. As part of our compliance efforts, our team will conduct a risk assessment to address three areas of concern, including 1. employee training and management 2. information systems (including network and software design 3. as well as information processing, storage, transmission, and disposal), and detecting, preventing and responding to attacks, intrusions, or other systems failures. We will document safeguards for identified risks by June 30, 2023. Name(s) of Contact Person(s) Responsible for Corrective Action: Mark Green, Associate Vice President Institutional Effectiveness, IT, and Innovation Anticipated Completion Date: June 9, 2023 If there are any questions regarding this corrective action plan please contact Eric Nelson, Vice President for Finance & Administration, at enelson@holyfamily.edu.
FAC accepted this audit on December 3, 2017 — management decision was due June 3, 2018.
GSA_MIGRATION
Show full finding ▾Hide full finding ▴Data source: This information comes from the Federal Audit Clearinghouse, the official repository of Single Audit data. All data is public domain. Verify this organization's audit history at fac.gov.
Track your findings and corrective action plans across audit cycles.
Start tracking findings →Monitor subrecipient audit findings and compliance status.
Start monitoring →© 2026 Single Audit Intelligence. All data is public domain.