Erikson Institute

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: July 1, 2024 through June 30, 2025 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: The Department of Education requires the Institute to report the disbursement dates and amounts to the Common Origination and Disbursement (COD) system within 15 days of disbursing Pell (34 CFR 690.83(b)(2) and Direct Loan (34 CFR 685.309) funds to a student. Condition: During our testing, we noted 3 instances tested had incorrect unsubsidized loan disbursement dates reported to the Common Origination and Disbursement (COD) system. Questioned Costs: None Context: 3 instances of disbursements tested had incorrect unsubsidized disbursement dates reported to COD. Cause: The Institute does not have a process in place to accurate report Unsubsidized Loan disbursements to COD. Effect: Students interest accrues based on disbursement date reported to COD, thus interest calculation could be skewed due to the discrepancy in disbursement dates reported. Repeat Finding: No Recommendation: We recommend the Institute evaluate its procedures and policies around reporting Unsubsidized Loan disbursements to COD to ensure that student information is reported accurately. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: July 1, 2024 through June 30, 2025 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or Specific Requirement: Per 34 CFR §685.309(b) and NSLDS Enrollment Reporting requirements, schools must report accurate enrollment status changes (including withdrawals, graduations, and reductions in course load) to NSLDS within 60 days of the status change. Condition: During our testing, we noted 3 out of 10 students tested had statuses that were not reported to NSLDS timely, leading to NSLDS detail not accurately reflecting the student’s statuses. Questioned Costs: None Context: 3 instances of NSLDS reporting not completed timely. Cause: The college was having an issue where students were being reported as 'Foreign' and was therefore having issues with updating statuses. Effect: Could result in incorrect loan servicing actions, and/or noncompliance with federal regulations. Repeat Finding: No Recommendation: We recommend the College evaluate its procedures and policies surrounding NSLDS reporting to ensure all status changes are reported timely. Views of Responsible Officials: There is no disagreement with the audit finding.

Finding 2024-001 – Return of Title IV Funds Repeat Finding: No Federal Program Title – U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal Award Year 2023-2024 Condition For one out of three students tested (33%) who withdrew from the Institute, the Institute could not provide evidence that the Institute reviewed the return of Title IV funds calculation. Further, the calculation that was originally performed failed to identify $480 of aid to be disbursed as post-withdrawal. Criteria CFR section 668.22 requires the Institute to determine the amount of title IV grant or loan assistance that the student earned as of the student's withdrawal date. 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure accurate reporting of enrollment status changes. Questioned Costs There is a questioned cost of $480 for the amount of aid to be disbursed as post-withdrawal. Cause During transition of Registrar staffing in Fall of 2023 enrollment status changes were delayed and thus the Financial Aid office did not have timely information to determine correct return of Title IV fund calculations. Once the enrollment status change for the student was reviewed and return of Title IV funds was determined, the correct amount of aid to be disbursed as post-withdrawal was processed. The Institute reviewed all student withdrawals during the fiscal year and no other discrepancies in Title IV fund calculations were found. Context The finding related to one out of three students selected for testing (33%). Effect Failure to accurately determine the amount of title IV grant or loan assistance that the student earned as of the student's withdrawal date is noncompliance with Federal regulation and could result in heightened monitoring by the U.S. Department of Education. Recommendation We recommend the Institute improve internal controls in order to correctly determine the amount of title IV grant or loan assistance that the student earned as of the student's withdrawal date timely and accurately. Views of responsible officials We agree with this finding. See corrective action plan.

Finding 2023-001—Gramm-Leach Bliley Act—Student Information Security Repeat Finding: No Federal Program Title—U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal TEACH Grants: 84.379 Federal Work-Study Program: 84.033 Federal Award Year 2022-2023 Condition While the Institute does have various policies addressing information security, the Institute did not have written policies to address the required safeguards for the eight required elements under the Gramm-Leach Bliley Act (GLBA) by June 9, 2023, the required date of compliance. Of the eight required elements under the GLBA, the Institute did have six written and formally documented safeguards, one is not applicable (assess apps developed by institution) and one had safeguards designed (dispose of customer information securely) but not a written policy in place. Criteria In accordance with 16 CFR 314.4(c), an institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). This includes the following: (1) implement and periodically review access controls, (2) conduct a periodic inventory of data, noting where it’s collected, stored or transmitted, (3) encrypt customer information on the institution’s system and when it’s in transit, (4) assess apps developed by the institution, (5) implement multi-factor authentication for anyone accessing customer information on the institution’s system, (6) dispose of customer information securely, (7) anticipate and evaluate changes to the information system or network, and (8) maintain a log of authorized users’ activity and keep an eye out for unauthorized users. 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure that reviews are being completed over information security policies and that they are in compliance with GLBA requirements. Questioned Costs There were no questioned costs. Cause While security policies and practices addressed the safeguards identified in 16 CFR 314.4(c)(1) through (8), all were not formally documented due to an oversight. Of the eight required elements under the GLBA the Institute did have six written and formally documented safeguards, one is not applicable and one had safeguards designed (dispose of customer information securely) but did not have a written policy in place. A comprehensive formal Information Security Policy that addresses all required safeguards under the GLBA has been drafted and is in its final institutional review. Context The required elements were not combined into a single policy. Effect Failure to meet the minimum requirements of the GLBA act is noncompliance and increases the risk of unauthorized disclosure, misuse, alteration, destruction, or other comprise of student information. Recommendation We recommend the Institute implement controls to ensure that GLBA requirements are reviewed and addressed in a formally documented policy. Views of Responsible Officials We agree with this finding. See corrective action plan.

Finding 2023-002—Enrollment Reporting Repeat Finding: Yes Federal Program Title—U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal Award Year 2022-2023 Condition For two out of four students tested (50%) who withdrew from the Institute, the students’ enrollment status reported to the National Student Loan Data System (NSLDS) did not match the institution’s records. Criteria CFR section 685.309 and 690.83(b)(2) requires the Institute to notify the NSLDS within 30 days of a change in student status or include the change in status in a response to an enrollment reporting roster within 60 days of the student’s date of determination of withdrawal. 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure accurate reporting of enrollment status changes. Questioned Costs There were no questioned costs related to testing of enrollment reporting. Cause Between 2022 and 2023, the Registration & Records office at Erikson experienced significant staff turnover, which revealed underlying vulnerabilities. Initially, there was a reorganization of the entire enrollment management function. During this time, a key office member was out for extended periods of time under FMLA prior to resigning in spring 2023. This staffing shortage led to delays in registration functions related to reporting to the NSLDS that sit within this office, including reporting. Context Two out of four students selected for testing. Effect Failure to report status changes timely is noncompliance with Federal regulation and could result in loss of future funding. Recommendation We recommend the Institute improve internal controls in order to report any status changes to the NSLDS timely and accurately. Views of Responsible Officials We agree with this finding. See corrective action plan. Finding 2023-002—Enrollment Reporting Repeat Finding: Yes Federal Program Title—U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal Award Year 2022-2023 Condition For two out of four students tested (50%) who withdrew from the Institute, the students’ enrollment status reported to the National Student Loan Data System (NSLDS) did not match the institution’s records. Criteria CFR section 685.309 and 690.83(b)(2) requires the Institute to notify the NSLDS within 30 days of a change in student status or include the change in status in a response to an enrollment reporting roster within 60 days of the student’s date of determination of withdrawal. 2 CFR Section 200.303 requires entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures in place to ensure accurate reporting of enrollment status changes. Questioned Costs There were no questioned costs related to testing of enrollment reporting. Cause Between 2022 and 2023, the Registration & Records office at Erikson experienced significant staff turnover, which revealed underlying vulnerabilities. Initially, there was a reorganization of the entire enrollment management function. During this time, a key office member was out for extended periods of time under FMLA prior to resigning in spring 2023. This staffing shortage led to delays in registration functions related to reporting to the NSLDS that sit within this office, including reporting. Context Two out of four students selected for testing. Effect Failure to report status changes timely is noncompliance with Federal regulation and could result in loss of future funding. Recommendation We recommend the Institute improve internal controls in order to report any status changes to the NSLDS timely and accurately. Views of Responsible Officials We agree with this finding. See corrective action plan.

Finding 2023-003—Cash Management—Excess Cash Repeat Finding: No Federal Program Title—U.S. Department of Education Student Financial Assistance Cluster Federal Direct Student Loans: 84.268 Federal Award Year 2022-2023 Condition During our cash management testing, we identified the following instances of excess cash: • The Institute had three instances of return of funds that resulted in excess cash for Federal Direct Student Loans ranging from $94 to $46,049 during the period of September 19, 2022 through November 29, 2022. In these situations, the excess cash amounts, being less than one percent of total prior year drawdowns, were not returned within a seven day tolerance period, as outlined below.   Criteria Uniform Grant Guidance (34 CFR 668.166) states the Secretary considers excess cash to be any amount of title IV, HEA program funds, other than Federal Perkins Loan program funds, that an institution does not disburse to students by the end of the third business day following the date the institution (1) received those funds from the Secretary; or (2) deposited or transferred to its depository account previously disbursed title IV, HEA program funds, such as those resulting from awards adjustments, recoveries, or cancellations. An institution may maintain for up to seven days an amount of excess cash that does not exceed one percent of the total amount of funds the institution drew down in the prior award year. The institution must return immediately to the Secretary any amount of excess cash over the one-percent tolerance and any amount of excess cash remaining in its account after the seven-day tolerance period. Uniform Grant Guidance (2 CFR 200.303) requires nonfederal entities receiving Federal awards establish and maintain internal controls deigned to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure excess cash is properly handled. Questioned Costs There were no questioned costs related to testing of excess cash. Cause During this period of time, Erikson was without a Student Bursar due to a resignation in September 2022. The Student Bursar is responsible for requesting and monitoring the return of federal funds. With the staff transition there was a gap in monitoring cash management procedures. In December 2022 all excess cash was returned. A new Student Bursar was hired in November 2022 and onboarding included comprehensive federal funds cash management training with an outside consultant. Context Ranging from $94 - $46,049 during the period from Sept 19 – Nov 29. Effect Excess cash is noncompliance with Federal regulation and could result in the loss of future funding. Recommendation We recommend the Institute review current processes for monitoring cash management and implement procedures that eliminate excess cash. Views of Responsible Officials We agree with this finding. See corrective action plan.

Finding 2022-001: Timely Enrollment Reporting Major Federal Program Title: United States Department of Education, Student Financial Assistance Cluster, Direct Student Loans (AL 84.268) Criteria: 2 CFR Part 200.303(a) state that the auditee must establish and maintain effective internal control over the federal awards that provides reasonable assurance that the auditee is managing the federal award in compliance with federal statues, regulations, and terms and conditions of the federal award. Specific criteria for enrollment reporting are established by the U.S. Department of Education within the 2021-2022 Federal Student Aid Handbook, Chapter 3, Sharing Information with NSLDS, Federal Loan Servicers, and Guarantors, including: (1) Institutions are required to report enrollment information under the Pell grant and the Direct loan programs via the NSLDS. (2) Institutions are responsible for timely reporting, whether they report directly or via a third-party servicer. (3) Institutions must report any enrollment status changes for students within 30 days; however, if a roster file is used, then the Institute may use the roster file to provide the update within 60 days. Condition: The Institute failed to notify the National Student Loan Data System for three selected students' withdrawals within the required 60 days. However, it was properly determined for the students to have earned 100% of the Title IV funds. Context: Three of 14 students tested from a population of 43 students with enrollment status changes were not reported in the required timeframe.Cause: These had occurred during the Registration and Records Department transitions with the Senior Director of Enrollment management leaving in July. Going forward it is practice for the Institute to notify NSLDS at the time of withdrawal determination to ensure timely submission. Effect: Noncompliance with federal regulations could result in the loss of future federal financial aid funding. In addition, not reporting enrollment status change within the required timeframe can impact an individual student?s loan deferment and repayment schedule. Questioned Costs: None Repeat finding: No Recommendation: We recommend that management consider the use of the ad hoc reporting option in NSLDS to prevent inadvertent late enrollment status updates for Return to Title IV Funds. Views of Responsible Official: Management agrees with this finding. Please see corrective action plan attached.