ANCILLA DOMINI COLLEGE

Finding 2021-001?Allowable Costs Federal Program?COVID-19 ? Higher Education Emergency Relief Fund (HEERF) Institutional Portion (84.425F) Criteria: Under 2 CFR 200.425 states in part: (a) A reasonably proportionate share of the costs of audits required by, and performed in accordance with, the Single Audit Act Amendments of 1996 (31 U.S.C. 7501-7507), as implemented by requirements of this part, are allowable. Under section 314(c) of the CRRSAA, Recipient, an institution of higher education as defined in section 101 or 102(c) of the Higher Education Act of 1965, as amended (HEA), 20 USC ? 1001 or 1002(c), may use these supplemental grant funds for Recipient?s Institutional Costs to defray expenses associated with coronavirus (including lost revenue, reimbursement for expenses already incurred, technology costs associated with a transition to distance education, faculty and staff trainings, and payroll). Condition: The College received federal funds due to the COVID-19 pandemic and expended those funds for institutional costs of the College. However, the College did not expend certain funds in accordance with grant requirements. The College claimed single audit and consulting fees unrelated to the HEERF program. Context: Of the 62 total expenditures tested, we noted 2 expenditures were unallowed under HEERF grant requirements. Effect: Noncompliance with federal regulations could result in the return of federal awards disbursed and/or loss of future federal funding. Cause: The College did not have proper controls in place to prevent or detect unallowed costs from being charged to the grant. Questioned costs: Unallowed audit and consulting fees of $64,089. Recommendation: We recommend the College carefully review grant guidance to determine allowable costs and identify an individual at the College to review costs charged to the grant to ensure they are allowable. Ancilla Domini College Schedule of Findings and Questioned Costs (Continued) Year Ended June 30, 2021 Views of responsible officials: Management agreed with the finding. For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

Finding 2021-002?Reporting Federal Program?COVID-19 ? Higher Education Emergency Relief Fund (HEERF) Institutional Portion (84.425F) Criteria: Under 18004(a)(1) of the Coronavirus Aid, Relief, and Economic Security Act ("CARES Act"), Public Law 116-136, 134 Stat. 281, Institutions of Higher Education are required to publicly post certain grant information including completed forms on the College's primary website no later than 10 days after the end of each calendar quarter apart from the first report, which was due October 30, 2020. Condition: The College received federal funds due to the COVID-19 pandemic however did not prepare and post the required quarterly public reporting for the institutional portion of HEERF awards. Context: We noted none of the 3 quarterly reports required to be posted on the College's website in FY 2021 were prepared or posted to the institution's website. Effect: Noncompliance with federal regulations could result in the return of federal awards disbursed and/or loss of future federal funding. Cause: The College did not have proper controls in place to ensure proper reporting was performed. Questioned costs: There were no questioned costs identified. Recommendation: We recommend the College carefully review grant guidance to determine the type and frequency of required reporting and identify an individual at the College to review reporting and ensure it is performed accurately and timely. Views of responsible officials: Management agreed with the finding. For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

Finding 2021-003?Gramm-Leach-Bliley Act Federal Program?SFA Cluster Repeat finding: Yes Criteria: 16 CFR 314 states in part: .3(a) Information security program. You shall develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts and contains administrative, technical, and physical safeguards that are appropriate to your size and complexity, the nature and scope of your activities, and the sensitivity of any customer information at issue. Such safeguards shall include the elements set forth in ?314.4 and shall be reasonably designed to achieve the objectives of this part, as set forth in paragraph (b) of this section. (b) Objectives. The objectives of section 501(b) of the Act, and of this part, are to: (1) Ensure the security and confidentiality of customer information; (2) Protect against any anticipated threats or hazards to the security or integrity of such information; and (3) Protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer. .4 In order to develop, implement, and maintain your information security program, you shall: (a) Designate an employee or employees to coordinate your information security program. (b) Identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information, and assess the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risks in each relevant area of your operations, including: (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures. (c) Design and implement information safeguards to control the risks you identify through risk assessment, and regularly test or otherwise monitor the effectiveness of the safeguards' key controls, systems, and procedures. Ancilla Domini College Schedule of Findings and Questioned Costs (Continued) Year Ended June 30, 2021 (d) Oversee service providers, by: (1) Taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue; and (2) Requiring your service providers by contract to implement and maintain such safeguards. (e) Evaluate and adjust your information security program in light of the results of the testing and monitoring required by paragraph (c) of this section; any material changes to your operations or business arrangements; or any other circumstances that you know or have reason to know may have a material impact on your information security program. Condition: The College could not produce evidence that they complied with the requirements as outlined in 16 CFR 314.4(c) noted above. Context: The College has systems in place to protect student information and has identified a person responsible for the information security system. The College also engaged a third party to perform a risk assessment on the information security system; however, as required by GLBA, the College did not document safeguards to control risks identified to the security system. This is a repeat of finding 2019-004 from the prior year audit. Effect: Noncompliance with federal regulations could result in the return of federal financial aid disbursed and/or loss of future federal financial aid funding. Cause: The College did not have proper controls in place to prevent this finding from occurring. Questioned costs: There were no questioned costs identified. Recommendation: We recommend that the College design controls to ensure that documentation around GLBA is retained to evidence the requirements outlined regarding information security systems are considered and implemented adequately. Views of responsible officials: Management agreed with the finding. For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

Finding 2020-001?Preparation of the Schedule of Expenditures of Federal Awards Federal Program?Not applicable Criteria: 2 CFR 200.508 states in part, ?The auditee must?(b) Prepare appropriate financial statements, including the schedule of expenditures of federal awards in accordance with 200.510 financial statements?? Condition: The College did not have an effective system of internal controls in place to prevent, or detect and correct, an error on the schedule of expenditures of federal awards (SEFA). Context: The College did not properly identify and record expenditures on the SEFA related to the Institutional Portion of COVID-19 Higher Education Emergency Relief Funds, resulting in an understatement of $208,683. Effect: The SEFA was materially misstated. Cause: The College did not properly review the SEFA to ensure proper reporting of federal expenditures on the SEFA. Questioned Costs: There were no questioned costs identified. Recommendation: We recommend that the College identify federal grant funds received during the year and track expenditures related to those programs and compare expenditures to the SEFA prepared to ensure all federal expenditures are reflected on the SEFA. Views of responsible officials: Management agreed with the finding. For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

Finding 2020-002?Gramm-Leach-Bliley Act Federal Program?SFA Cluster Criteria: 16 CFR 314 states in part: .3(a) Information security program. You shall develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts and contains administrative, technical, and physical safeguards that are appropriate to your size and complexity, the nature and scope of your activities, and the sensitivity of any customer information at issue. Such safeguards shall include the elements set forth in ?314.4 and shall be reasonably designed to achieve the objectives of this part, as set forth in paragraph (b) of this section. (b) Objectives. The objectives of section 501(b) of the Act, and of this part, are to: (1) Ensure the security and confidentiality of customer information; (2) Protect against any anticipated threats or hazards to the security or integrity of such information; and (3) Protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer. .4 In order to develop, implement, and maintain your information security program, you shall: (a) Designate an employee or employees to coordinate your information security program. (b) Identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information, and assess the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risks in each relevant area of your operations, including: (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures. (c) Design and implement information safeguards to control the risks you identify through risk assessment, and regularly test or otherwise monitor the effectiveness of the safeguards' key controls, systems, and procedures. (d) Oversee service providers, by: (1) Taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue; and (2) Requiring your service providers by contract to implement and maintain such safeguards. (e) Evaluate and adjust your information security program in light of the results of the testing and monitoring required by paragraph (c) of this section; any material changes to your operations or business arrangements; or any other circumstances that you know or have reason to know may have a material impact on your information security program. Condition: The College could not produce evidence that they complied with the requirements as outlined in 16 CFR 314.4(c) noted above. Context: The College has systems in place to protect student information and has identified a person responsible for the information security system. The College also engaged a third party to perform a risk assessment on the information security system; however, as required by GLBA, the College did not document safeguards to control risks identified to the security system. This is a repeat of finding 2019-004 from the prior year audit. Effect: Noncompliance with federal regulations could result in the return of federal financial aid disbursed and/or loss of future federal financial aid funding. Cause: The College did not have proper controls in place to prevent this finding from occurring. Questioned costs: There were no questioned costs identified. Recommendation: We recommend that the College design controls to ensure that documentation around GLBA is retained to evidence the requirements outlined regarding information security systems are considered and implemented adequately. Views of responsible officials: Management agreed with the finding. For the views of responsible officials, refer to the Corrective Action Plan that is part of this report

Finding 2019-001 ? Verification Federal Program ? SFA Cluster Criteria The Department of Education selects certain students for verification of information submitted by students on their federal financial aid application. 34 CFR 668.57 outlines the acceptable documentation that the College is to obtain when a student is selected for verification. Condition The College did not retain acceptable documentation for certain students to evidence that verification was done properly prior to disbursement of financial aid to students. Context The College did not have appropriate documentation for 14 students out of 40 tested. This is a repeat of finding 2018-002 from the prior year audit. Effect Noncompliance with federal regulations could result in the return of federal financial aid disbursed and/or loss of future federal financial aid funding. Cause The College had turnover in the financial aid office during the award period. In addition, the individuals responsible to ensure controls are followed do not have extensive experience with financial aid. Questioned Costs There were no questioned costs identified. Recommendation We recommend that the College implement control procedures to ensure necessary information is retained as outlined in 34 CFR 668.57 to provide evidence verification was properly performed prior to disbursement of financial aid to students. We also recommend that financial aid staff receive additional training to ensure they are familiar with all required laws and regulations around Title IV funding related to student financial aid. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

Finding 2019-002 ? Exit Counseling Federal Program ? Federal Direct Loans (FDL) 84.268 Criteria 34 CFR 685.304 states in part: (b) Exit counseling. (1) A school must ensure that exit counseling is conducted with each Direct Subsidized Loan or Direct Unsubsidized Loan borrower and graduate or professional student Direct PLUS Loan borrower shortly before the student borrower ceases at least half-time study at the school. (2) The exit counseling must be in person, by audiovisual presentation, or by interactive electronic means. In each case, the school must ensure that an individual with expertise in the title IV programs is reasonably available shortly after the counseling to answer the student borrower's questions. (3) If a student borrower withdraws from school without the school's prior knowledge or fails to complete the exit counseling as required, exit counseling must, within 30 days after the school learns that the student borrower has withdrawn from school or failed to complete the exit counseling as required, be provided either through interactive electronic means, by mailing written counseling materials to the student borrower at the student borrower's last known address, or by sending written counseling materials to an email address provided by the student borrower that is not an email address associated with the school sending the counseling materials. (6) If exit counseling is conducted through interactive electronic means, a school must take reasonable steps to ensure that each student borrower receives the counseling materials, and participates in and completes the exit counseling. (7) The school must maintain documentation substantiating the school's compliance with this section for each student borrower. Condition The College uses interactive electronic means to communicate with students about requirement for exit counseling when they graduate, withdraw or fall below half-time study at the College. The College did not retain evidence the College had communicated the exit counseling requirement to certain students. Context The College did not have documentation substantiating compliance with requirement to communicate exit counseling for 5 of the 11 students tested. Effect Noncompliance with federal regulations could result in the return of federal financial aid disbursed and/or loss of future federal financial aid funding. Cause The College had turnover in the financial aid office during the award period. In addition, the individuals responsible to ensure controls are followed do not have extensive experience with financial aid. Questioned Costs There were no questioned costs identified. Recommendation We recommend that the College review controls to verify communication to student borrowers of exit counseling requirement is performed and documentation is retained. We also recommend that financial aid staff receive additional training to ensure they are familiar with all required laws and regulations around Title IV funding related to student financial aid. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

Finding 2019-003 ? Reporting Federal Program ? SFA Cluster Criteria 34 CFR 673.3 states in part: (a) To participate in the Federal Perkins Loan, FWS, or FSEOG programs, an institution shall file an application before the deadline date established annually by the Secretary through publication of a notice in the FEDERAL REGISTER. To meet this requirement, the College is required, annually, to file the Fiscal Operations Report and Application to Participate (FISAP) by October 1. The 2019 Compliance Supplement requires auditors to test key line items in the report, including tracing information to supporting documentation. Condition The College filed the FISAP in a timely manner, however, we noted the enrollment number and total tuition reported in section II lines 7(a) and 22, respectively, did not agree to underlying support. Context The College reported the number of undergraduate students as 429 on line 7(a), however this number could not be substantiated or supported by documentation provided. In addition, the College reported $512,615 as total tuition and fees for the award year July 1, 2018 to June 30, 2019 on line 22, however total tuition and fees, net of scholarships, reported in the audited financial statements is $4,685,819. Effect Noncompliance with federal regulations could result in the return of federal financial aid disbursed and/or loss of future federal financial aid funding. Cause The College had turnover in the financial aid office during the award period. In addition, the individuals responsible to ensure controls are followed do not have extensive experience with financial aid. Questioned Costs There were no questioned costs identified. Recommendation We recommend that the College implement control procedures to ensure information reported on the FISAP is reviewed for accuracy. We also recommend that financial aid staff receive additional training to ensure they are familiar with all required laws and regulations around Title IV funding related to student financial aid. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

Finding 2019-004 ? Gramm-Leach-Bliley Act Federal Program ? SFA Cluster Criteria 16 CFR 314 states in part: .3(a) Information security program. You shall develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts and contains administrative, technical, and physical safeguards that are appropriate to your size and complexity, the nature and scope of your activities, and the sensitivity of any customer information at issue. Such safeguards shall include the elements set forth in ?314.4 and shall be reasonably designed to achieve the objectives of this part, as set forth in paragraph (b) of this section. (b) Objectives. The objectives of section 501(b) of the Act, and of this part, are to: (1) Insure the security and confidentiality of customer information; (2) Protect against any anticipated threats or hazards to the security or integrity of such information; and (3) Protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer. .4 In order to develop, implement, and maintain your information security program, you shall: (a) Designate an employee or employees to coordinate your information security program. (b) Identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information, and assess the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risks in each relevant area of your operations, including: (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures. (c) Design and implement information safeguards to control the risks you identify through risk assessment, and regularly test or otherwise monitor the effectiveness of the safeguards' key controls, systems, and procedures. (d) Oversee service providers, by: (1) Taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue; and (2) Requiring your service providers by contract to implement and maintain such safeguards. (e) Evaluate and adjust your information security program in light of the results of the testing and monitoring required by paragraph (c) of this section; any material changes to your operations or business arrangements; or any other circumstances that you know or have reason to know may have a material impact on your information security program. Condition The College could not produce evidence that they complied with the requirements as outlined in 16 CFR 314 noted above. Context The College has systems in place to protect student information and has identified a person responsible for the information security system, however as required by GLBA the College did not document internal and external risks to the security system, and safeguards to control risks identified to the security system. Effect Noncompliance with federal regulations could result in the return of federal financial aid disbursed and/or loss of future federal financial aid funding. Cause The College did not have proper controls in place to prevent this finding from occurring. In addition, the College had turnover in the financial aid office during the award period and the individuals responsible to ensure controls are followed do not have extensive experience with financial aid. Questioned Costs There were no questioned costs identified. Recommendation We recommend that the College design controls to ensure that documentation around GLBA is retained to evidence the requirements outlined regarding information security systems are considered and implemented adequately. We also recommend that financial aid staff receive additional training to ensure they are familiar with all required laws and regulations around Title IV funding related to student financial aid. Views of Responsible Officials For the views of responsible officials, refer to the Corrective Action Plan that is part of this report.

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION