Pennsylvania College of Technology

Finding 2020-001: Special Tests and Provisions - Return of Title IV Federal Program - Student Financial Assistance Program Federal Agency - U.S. Department of Education Pass-Through Entity - Not Applicable CFDA Number - 84.007, 84.003, 84.063, 84.268 Federal Award Year - June 30, 2020 Criteria: Title IV regulations (34 CFR 668.22), require the College to return the unearned portion of grants or loans to the Title IV program within 45 days after a student withdraws. Condition/Context: The federal aid for 1 of 11 students was not returned within 45 days from the date of withdrawal. The sample was not a statistically valid sample. Cause: The delay in a return of funds was a result of miscommunication between the Registrar's Office and the Financial Aid Office, causing a delay between the date that the student's withdrawal was determined and the date that the refund was issued. Effect: The College was in possession of funds belong to the federal government longer than allowed. Recommendation: The College should continue to review and adhere to its policies and procedures to ensure that calculations are performed in a timely manner. Views of Responsible Officials and Planned Corrective Actions: See corrective action plan.

The delay of return of Title IV funds was due to a human error that resulted from a need to clarify information on the last date of attendance with faculty. The following initiatives were put into practice to improve this process: (1) In Fall 2019, an educational resource focusing on our attendance policy was developed and shared by Academic School Deans with all faculty during their annual start up School Meetings. A Stoppage of Attendance procedure was implemented in Fall 2020. This process requires faculty to submit a Stoppage of Attendance Notification to inform the Financial Aid Office of students who began attending their class and have since stopped attending for fourteen or more calendar days. The Financial Aid Office reviews the Stoppage of Attendance data to help determine which students may have stopped attending all classes and therefore need a Return to Title IV calculation. A communication plan is in place to regularly remind faculty about this process. Education for faculty on Title IV aid guidelines was expanded for 2020-2021 to include: Academic Advising Professional Development Session on Financial Aid Implications. Professional Development on Financial Aid Processes and Regulations for new faculty.

Finding 2019-001: Special Tests and Provisions - Gramm-Leach Bliley Act Federal Program - Student Financial Assistance Cluster Federal Agency - U.S. Department of Education Pass-Through Entity - Not Applicable CFDA Number - 84.007, 84.033, 84.063, 84.268 Federal Award Year - June 30, 2019 Criteria: In accordance with Title IV regulations (CFR 314.1 (b)), a College is required to designate an individual to coordinate the information security program, perform a risk assessment that addresses (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other systems failures, and document safeguards for identified risks. Condition: The College has not documented its formal risk assessment addressing (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other systems failures as required by the Gramm-Leach Bliley Act (?GLBA?). Cause: The College did not have procedures and processes in place specific to GLBA and therefore, did not document the required risk assessment or risk mitigation. Effect: Failure to comply with GLBA standards puts the institution at risk of compromising consumer nonpublic personal information. Questioned costs: None. Recommendation: The College should perform and document an annual risk assessment to determine the College's specific risks relevant to protecting consumer nonpublic personal information. At a minimum, the College should have at least one risk statement aligned or referenced to each of the three required areas noted in the GLBA law at 16 CFR 314.4 (b). Finally, the College should identify and document at least one safeguard (i.e., control) for each of the risks identified and documented in the risk assessment. Each control should be aligned or referenced to the risk(s) to which the safeguard applies. Views of Responsible Officials and Planned Corrective Actions: See corrective action plan.

Pennsylvania College of Technology Corrective Action Plan For the Year Ended June 30, 2019 Finding 2019-001: Special Tests and Provisions ? Gramm-Leach Bliley Act Condition The College has not documented its formal risk assessment addressing (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other systems failures as required by the Gramm-Leach Bliley Act (?GLBA?) Corrective Action Plan The College takes the protection of confidential customer information very seriously and to that end has implemented Information Technology (IT) safeguards and best practices including, but not limited to: mandatory IT security training for employees, a designated IT security manager, multi-factor authentication, safe links monitoring, secure logins, disabling of inactive accounts, increased password complexity, firewalls maintained, information is encrypted in transit, and systems are updated and patched on a timely basis; however these processes are not formally documented. Corrective Action Plan: The following steps will be taken to correct this deficiency: 1. An internal risk assessment will be completed and a matrix developed to include risks identified, vulnerability score, impact level, risk rating, existing safeguards in place to mitigate the risk, and new strategies needed to address potential threats exposed as part of the assessment. 2. Develop a formal documentation process for reporting, tracking, and evaluating IT security procedures, network topology, and computing infrastructure. 3. Update any affected policies and procedures, adding the requirement of an annual risk assessment. Name(s) of Contact Person(s) Responsible for Corrective Action: A.J. Lacomba, Vice President for IT/CIO Jim Williams, Manager of IT Security Anticipated Completion Date: June 30, 2020

GSA_MIGRATION

GSA_MIGRATION