Alvernia UniversityHigher Education

Federal Program Department of Education - Strengthening Institutions Program, ALN 84.031A, Award No. P031A190172, Period 10/1/19 - 9/30/24 Criteria The grant application and award outline allowable activities and costs for the grant funds. This includes defining eligible program staff and student navigators. Condition/Cause During the year ended June 30, 2022, an individual working in an allowable position under the grant changed job titles to a different position, which was not allowable under the grant. The wages and fringe benefits for this individual continued to be charged to the grant after the change in position. Internal controls in place did not detect the unallowable costs charged to the grant in the 4th quarter of the fiscal year, prior to drawing down funds. Effect Funds were drawn down to reimburse the University for salaries and benefits for an individual who was not working in an allowable position under the grant. Questioned Costs Less than $25,000 Context Sampling was not utilized in the audit testing of salaries. Unallowable activities/costs were identified for 1 of the 11 individuals tested. Repeat Finding No. Recommendation We recommend that the University revisit and strengthen internal controls over determining compliance with the allowable activities and allowable cost requirements of the grant for wages and fringe benefits. Management Response See corrective action plan included in this report package.

Federal Program Corporation of National and Community Service - AmeriCorps Seniors Foster Grandparent Program, ALN 94.011, Award No. 21SFBPA002, Period 7/1/21 - 6/30/24 Criteria Stipends paid to participants who meet income levels set by AmeriCorps are paid based on hours worked and mileage reimbursement. Grantees should maintain documentation to support all stipend expenses paid using grant funds. Through September 30, 2021, a stipend allowance was in place, allowing participants to be paid based on average hours worked prior to the COVID-19 emergency due to several locations still operating under restrictions as a result of the pandemic. Program staff and individuals working under the Foster Grandparent Grant are required to complete certain criminal history checks to determine eligibility prior to beginning work on service on the grant. These include: (1) National Sex Offender Public Website nationwide check; (2) Pennsylvania Criminal Record Check; (3) Pennsylvania Child Abuse Clearance; and (4) FBI fingerprint-based check. The grantee is required to maintain documentation that all required components were conducted on time through sources authorized by AmeriCorps and reviewed to consider eligibility. Condition/Cause Due to turnover in program staff, management was unable to locate certain requested documentation for audit testing. Effect The University was unable to support compliance with the allowable activities, allowable costs, and national service criminal history checks special tests requirements of the grant for certain items selected for audit testing. Questioned Costs Less than $25,000 Context We selected a sample of 40 stipend payments during the 2021-2022 year for testing. For 2 of the stipends selected, current program management was unable to provide documentation to support amount paid. These stipends fell during the allowance period and were based on average hours worked; however, documentation was not maintained which allowed for recalculation of stipend paid. For an additional 4 of the stipends selected, current program management was unable to locate timecards completed by the volunteer. However, hours paid agreed to a spreadsheet that had been maintained by a previous program director. We selected a sample of 7 individuals who worked as staff or volunteers within the program. Of the 7 selected, 2 of the 4 required clearances could not be located for 1 individual. The individual is no longer working as a staff member of the grant. Repeat Finding No. Recommendation We recommend that the University revisit and revise their documentation filing system for timecards, mileage reimbursement, and other documentation that would support amounts paid for stipends under the program. This would also include a complete inventory of all clearances/criminal background checks for current staff and volunteers working in the program and obtain updated background checks for any that are not on file. We also recommend the University revisit the process of replacing a director after their departure to ensure program compliance continues. Management Response See corrective action plan included in this report package.

Finding 2019-001 - Gramm-Leach Bliley Act Federal Program - Student Financial Assistance Cluster Federal Agency - U.S. Department of Education Pass-Through Entity - Not Applicable CFDA Number - 84.007, 84.033, 84.038, 84.064, 84.268, 93.925 Federal Award Year - June 30, 2019 Criteria: In accordance with Title IV regulations (CFR 314.1 (b)), an University is required to designate an individual to coordinate the information security program, perform a risk assessment that addresses (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other systems failures, and document safeguards for identified risks. Condition: The University has not designated an individual responsible for coordinating an information security program, nor has the University performed a risk assessment to address employee training and management related to information security as required by the Gramm-Leach Bliley Act ("GLBA"). Cause: The University does not have a designated coordinator nor has procedures and processes in place specific to GLBA. Effect: Failure to comply with the requirements of GLBA standards puts the University at risk of compromising consumer nonpublic personal information. Questioned Costs: None. Recommendation: The University should designate an individual responsible for coordinating the information security program. Additionally, the University should perform and document an annual risk assessment to determine the University's specific risks relevant to protecting consumer nonpublic personal information. At a minimum, the University should have at least one risk statement aligned or referenced to each of the three required areas noted in the GLBA law at 16 CFR 314.4 (b). Finally, the University should identify and document at least one safeguard (i.e., control) for each of the risks identified and documented in the risk assessment. Each control should be aligned or referenced to the risk(s) to which the safeguard applies. Views of Responsible Officials and Planned Corrective Actions: The University has designated Carl Marks, Vice President & Chief Information Officer as the responsible individual for coordinating the information security program. The University?s Information Technology Department, under the direction of Carl Marks, will perform and document an annual risk assessment to determine specific risks relevant to protect consumer nonpublic personal information. This assessment will contain at least one risk statement aligned or referenced to each of the three required areas noted in the GLBA law at 16 CFR 314.4 (b) with each control aligned or referenced to the risk(s) to which the safeguard applies. This risk assessment will be completed prior to June 30, 2020.

GSA_MIGRATION

GSA_MIGRATION