College of the Atlantic

During compliance testing, it was identified that a Federal Pell Grant was not properly disbursed to a student who was eligible to receive it.

Enrollment Reporting (Significant Deficiency) Programs Department of Education ? Federal Direct Student Loans CFDA 84.268 Department of Education ? Federal Perkins Loans CFDA 84.038 Department of Education ? Federal Pell Grant CFDA 84.063 Criteria Enrollment Reporting ? Under the Pell grant and ED loan programs, schools must complete and return within 15 days of receipt the Enrollment Reporting roster file placed in the school?s Student Aid Internet Gateway (SAIG) via NSLDS. The school determines how often it receives the Enrollment Reporting roster file with the default set at a minimum of every 60 days. Once received, the school must update for changes in student status, report the date the enrollment status was effective, enter the new anticipated completion date, and submit the changes electronically through the batch method or the NSLDS website. Schools are responsible for timely reporting, whether they report directly or via a third-party servicer. According to CFR 34 685.309 for the Federal Direct Student Loan program, unless the school expects to complete its next roster within 60 days, the school must notify the lender or the guaranty agency within 30 days, if it discovers that a student who received a loan either did not enroll or ceased to be enrolled on at least a half-time basis. Condition and Context During our audit, we selected a sample of 40 students and performed various control and compliance testing procedures over those requirements deemed direct and material. Out of the total sample of 40 students, 10 students had student status changes that required updating in the school?s Enrollment Reporting roster file. Out of these 10 students, 3 students did not have their status accurately updated on the Enrollment Reporting roster file within the required time frame. Questioned Costs None Cause and Effect Management has determined that, due to a lack of defined controls and procedures, there are issues with the process it uses to accumulate and extract the student data for enrollment reporting from its database, and their ability to submit the status changes electronically to NSLDS. These issues have resulted in the College not reporting several students timely and accurately. Recommendation To ensure full compliance in the future, we recommend that the College review its policies and procedures to ensure that its student status changes are being reported timely to NSLDS. We also recommend that the College implement a procedure to review the NSLDS database after each submission to ensure the enrollment data has been reported timely and accurately.

Exit Counseling (Significant Deficiency) Programs Department of Education ? Federal Direct Student Loans CFDA 84.268 Criteria According to CFR 34 682.604 for the Federal Direct Student Loan program, a school must ensure that exit counseling is conducted with each Stafford Loan borrower and graduate or professional student PLUS Loan borrower either in person, by audiovisual presentation, or by interactive electronic means. In each case, the school must ensure that this counseling is conducted shortly before the student borrower ceases at least half-time study at the school, and that an individual with expertise in the title IV programs is reasonably available shortly after the counseling to answer the student borrower's questions. As an alternative, in the case of a student borrower enrolled in a correspondence program or a study-abroad program that the home institution approves for credit, written counseling materials may be provided by mail within 30 days after the student borrower completes the program. If a student borrower withdraws from school without the school's prior knowledge or fails to complete an exit counseling session as required, the school must, within 30 days after learning that the student borrower has withdrawn from school or failed to complete the exit counseling as required, ensure that exit counseling is provided through interactive electronic means, by mailing written counseling materials to the student borrower at the student borrower's last known address, or by sending written counseling materials to an email address provided by the student borrower that is not an email address associated with the school sending the counseling materials. Condition and Context During our audit, we selected a sample of 40 students and performed various control and compliance testing procedures over those requirements deemed direct and material. Out of the total sample of 40 students, the College was required to conduct exit counseling for 10 students. Out of these 10 students, the College did not conduct exit counseling for 3 of the students within the required time frame. Questioned Costs None Cause and Effect Management has determined that, due to a lack of defined controls and procedures, there are issues with the process it uses to monitor whether exit counseling procedures, as required, have been conducted. These issues have resulted in the College not conducting timely exit counseling. Recommendation To ensure full compliance in the future, we recommend that the College review its policies and procedures to ensure that exit counseling is performed with required time frames. We also recommend that the College implement a procedure to review its student database to ensure that compliance with exit counseling requirement is appropriately documented.

Student Information Security (Significant Deficiency) Programs Department of Education ? Student Financial Aid Cluster Criteria The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as ?financial institutions? and subject to the Gramm-Leach-Bliley. Under an institution?s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Schools are required to designate an individual to coordinate the information security program, perform a risk assessment that addresses (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other systems failures, and document safeguards for identified risks. Condition and Context During our audit, we noted the College had designated an individual to coordinate the information security program however the College had not performed a risk assessment of the three required areas or documented safeguards for identified risks. Questioned Costs None Cause and Effect Management has determined that, due to a lack of defined controls and procedures, there are issues with the process it uses to assess and perform information technology risk assessments. These issues have prevented the College from identifying risks in order to determine and document applicable safeguards. Recommendation To ensure full compliance in the future, we recommend that the College review its policies and procedures to ensure that annual information technology risk assessments are performed. We also recommend that identified risks and applicable safeguards are documented and maintained to enable routine monitoring and to ensure compliance with applicable student information security requirements.

Enrollment Reporting (Significant Deficiency) Programs Department of Education ? Federal Direct Student Loans CFDA 84.268 Department of Education ? Federal Perkins Loans CFDA 84.038 Department of Education ? Federal Pell Grant CFDA 84.063 Criteria Enrollment Reporting ? Under the Pell grant and loan programs, schools must complete and return within 30 days of receipt the Enrollment Reporting roster file placed in the school?s Student Aid Internet Gateway (SAIG) via NSLDS. The school determines how often it receives the Enrollment Reporting roster file with the default set at every two months, but a minimum is twice a year. Once received, the school must update for changes in student status, report the date the enrollment status was effective, enter the new anticipated completion date, and submit the changes electronically through the batch method or the NSLDS website. Schools are responsible for timely reporting, whether they report directly or via a third-party servicer. According to CFR 34 685.309 for the Federal Direct Student Loan program, unless the school expects to complete its next roster within 60 days, the school must notify the lender or the guaranty agency within 30 days, if it discovers that a student who received a loan either did not enroll or ceased to be enrolled on at least a half-time basis. Condition and Context During our audit, we selected a sample of 40 students and performed various control and compliance testing procedures over those requirements deemed direct and material. Out of the total sample of 40 students, 7 students had student status changes that required updating in the school?s Enrollment Reporting roster file. Out of these 7 students, 4 students did not have their status accurately updated on the Enrollment Reporting roster file within the required time frame. Questioned Costs None Cause and Effect Management has determined that, due to a lack of defined controls and procedures, there are issues with the process it uses to accumulate and extract the student data for enrollment reporting from its database, and their ability to submit the status changes electronically to NSLDS. These issues have resulted in the College not reporting several students timely and accurately. Recommendation To ensure full compliance in the future, we recommend that the College review its policies and procedures to ensure that its student status changes are being reported timely to NSLDS. We also recommend that the College implement a procedure to review the NSLDS database after each submission to ensure the enrollment data has been reported timely and accurately.

Exit Counseling (Significant Deficiency) Programs Department of Education ? Federal Direct Student Loans CFDA 84.268 Criteria According to CFR 34 682.604 for the Federal Direct Student Loan program, a school must ensure that exit counseling is conducted with each Stafford Loan borrower and graduate or professional student PLUS Loan borrower either in person, by audiovisual presentation, or by interactive electronic means. In each case, the school must ensure that this counseling is conducted shortly before the student borrower ceases at least half-time study at the school, and that an individual with expertise in the title IV programs is reasonably available shortly after the counseling to answer the student borrower's questions. As an alternative, in the case of a student borrower enrolled in a correspondence program or a study-abroad program that the home institution approves for credit, written counseling materials may be provided by mail within 30 days after the student borrower completes the program. If a student borrower withdraws from school without the school's prior knowledge or fails to complete an exit counseling session as required, the school must, within 30 days after learning that the student borrower has withdrawn from school or failed to complete the exit counseling as required, ensure that exit counseling is provided through interactive electronic means, by mailing written counseling materials to the student borrower at the student borrower's last known address, or by sending written counseling materials to an email address provided by the student borrower that is not an email address associated with the school sending the counseling materials. Condition and Context During our audit, we selected a sample of 40 students and performed various control and compliance testing procedures over those requirements deemed direct and material. Out of the total sample of 40 students, the College was required to conduct exit counseling for 5 students. Out of these 5 students, the College did not conduct exit counseling for 2 of the students within the required time frame. Questioned Costs None Cause and Effect Management has determined that, due to a lack of defined controls and procedures, there are issues with the process it uses to monitor whether exit counseling procedures, as required, have been conducted. These issues have resulted in the College not conducting timely exit counseling. Recommendation To ensure full compliance in the future, we recommend that the College review its policies and procedures to ensure that exit counseling is performed with required time frames. We also recommend that the College implement a procedure to review its student database to ensure that compliance with exit counseling requirement is appropriately documented.

Student Information Security (Significant Deficiency) Programs Department of Education ? Student Financial Aid Cluster Criteria The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as ?financial institutions? and subject to the Gramm-Leach-Bliley. Under an institution?s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Schools are required to designate an individual to coordinate the information security program, perform a risk assessment that addresses (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other systems failures, and document safeguards for identified risks. Condition and Context During our audit, we noted the College had designated an individual to coordinate the information security program however the College had not performed a risk assessment of the three required areas or documented safeguards for identified risks. Questioned Costs None Cause and Effect Management has determined that, due to a lack of defined controls and procedures, there are issues with the process it uses to assess and perform information technology risk assessments. These issues have prevented the College from identifying risks in order to determine and document applicable safeguards. Recommendation To ensure full compliance in the future, we recommend that the College review its policies and procedures to ensure that annual information technology risk assessments are performed. We also recommend that identified risks and applicable safeguards are documented and maintained to enable routine monitoring and to ensure compliance with applicable student information security requirements.