NORTHEASTERN ILLINOIS UNIVERSITYHigher Education

2025-006. FINDING - Noncompliance with Enrollment Reporting Requirements Federal Agency: Department of Education Assistance Listing Numbers: 84.268, 84.063 Program Names: Federal Direct Student Loans, Federal Pell Grant Program Award Numbers: P268K251350 - 2025; P063P241350 - 2025 Questioned Costs: None Northeastern Illinois University (University) did not have adequate procedures and controls in place to ensure that the effective date of students who unofficially withdrew was accurately reported to National Student Loan Data System (NSLDS). CONDITIONS FOUND & CRITERIA: During our testing of the University’s compliance with enrollment reporting requirements for Direct loan programs via the NSLDS (OMB No. 1845-0035), we noted the University did not update program-level and campus-level effective enrollment dates for the students’ appropriate withdrawal date. We noted the following: Two of 25 (8%) of the students originally tested withdrew during the Spring semester; however, they were reported to NSLDS as withdrawn with an effective enrollment change date in the following Fall semester and were not updated retroactively. NSLDS requires that the date the current enrollment status is to be reported when the change was first effective (See 4.4.2 of NSLDS Enrollment Reporting Guide). Ten of 15 (67%) additional students tested as a result of the error withdrew during their respective fall and spring semester; however, they were reported to NSLDS as withdrawn with an effective enrollment at the end of the semester and were not updated retroactively, thus bringing total errors to 12 of 40 students (30%). NSLDS requires that the date the current enrollment status is to be reported when the change was first effective (See 4.4.2 of NSLDS Enrollment Reporting Guide) and can be retroactively reported to reflect the accurate effective date (See 4.4.5 of NSLDS Enrollment Reporting Guide). The sample was not intended to be, and was not, a statistically valid sample. The NSLDS Enrollment Reporting Guide (4.4.5) does speak to continuing education as a way of determination of student’s enrollment status. However, this is only applicable when evaluating the end of the current school year, during the spring and summer semester, with respect to the upcoming school year’s fall semester. CAUSE: University officials stated due to timing issues between the University’s enrollment file certification process and the NSLDS’s roster creation process, the exceptions above were noted. EFFECT: Failure to meet enrollment reporting requirements is noncompliance with federal regulations and could result in loss of loan/grant funding in future years. (Finding Code No. 2025-006, 2024-006) RECOMMENDATION: We recommend the University's implement greater controls and oversight of the University's current Roster Verification process to ensure that a more accurate determination of the last date of attendance for withdrawal determination are reported to NSLDS. UNIVERSITY RESPONSE: The University agrees with the recommendation. To prevent a recurrence of roster timing conflict, the University will coordinate with the NSC to determine the most appropriate submission date for the Unofficial Withdrawal file. Implementing this solution will require the Financial Aid Office to provide the Registrar’s Office with the complete Unofficial Withdrawal file (Last Dates of Attendance included) earlier, as all students on that file are reported to the NSC as actively enrolled students.

2025-007. FINDING - Noncompliance with Federal Funding Accountability and Transparency Act Reporting Requirement Federal Agency: Department of Education Assistance Listing Numbers: 84.031 Program Names: Higher Education Institutional Aid, ARCOS - Advancing Research and Career Opportunities in STEM Award Numbers: P031C210111 – 2021 Questioned Costs: None Northeastern Illinois University (University) did not report a first-tier subaward of $30,000 or more to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS) for the Higher Education Institutional Aid grants. CONDITIONS FOUND & CRITERIA: The Higher Education Institutional Aid grants had one first-tier subaward for $217,541 that was not reported to the FSRS. This was the only subaward granted in the Higher Education Institutional Aid program. Under the requirements of the Federal Funding Accountability and Transparency Act (FFATA) that are codified in 2 CFR Part 170, recipients (i.e., direct recipients) of grants or cooperative agreements are required to report first-tier subawards of $30,000 or more to the FSRS. CAUSE: University officials stated the University did not have a formalized process for FFATA subaward reporting and had not clearly assigned responsibility to a specific office, resulting in the subaward not being reported. EFFECT: FFATA reporting is critical for management of federal funds when first-tier subawards are made. Without controls in place, the University in not in compliance with federal regulations. (Finding Code No. 2025-007) RECOMMENDATION: We recommend the University implements processes and controls to ensure that FFATA reporting requirements are executed when required. UNIVERSITY RESPONSE: The University agrees with the recommendation and acknowledges that the first-tier subaward under the Higher Education Institutional Aid grant was not reported to the FSRS. This occurred because the University did not have an established process for FFATA reporting and had not clearly designated which office was responsible. The University will explore procedures to address this issue.

2025-008. FINDING - Noncompliance with Reimbursements to Subrecipients Federal Agency: National Science Foundation Assistance Listing Numbers: 47.070 Program Names and Award Numbers: Research and Development Cluster: CISE-MSI: RPEP: S&CC: Information Systems meet Cultural Competencies; CISE-MSI: DP: IIS-III: ACOSUS: An AI-driven counseling System for Underrepresented Transfer Students Award Numbers: 2131291 – 2021; 2219623 – 2022 Questioned Costs: None Northeastern Illinois University (University) did not pay reimbursements within 30 days for certain subrecipients in the Research and Development Cluster. CONDITIONS FOUND & CRITERIA: For three of 10 (30%) subrecipient invoices selected for testing in the Research and Development Cluster, the University made payments in a time period greater than 30 days. The sample was not intended to be, and was not, a statistically valid sample. Uniform Guidance (2 CFR 200.305(b)(3)) requires, for recipients and subrecipients other than states, payment methods must minimize the time elapsing between the transfer of funds from the federal agency or the pass-through entity and the disbursement of funds by the recipient or subrecipient, regardless of whether the payment is made by electronic funds transfer or by other means. Further, when the reimbursement method is used for payment, organizations must make a payment within 30 calendar days after receipt of the billing unless the federal awarding agency or pass-through entity reasonably believes the request to be improper. CAUSE: University officials stated the department did not timely enter invoices into the Accounts Payable system which resulted in delayed processing by Accounts Payable, thus the payment was not made in accordance with the Uniform Guidance. EFFECT: Failure to meet subrecipients payment requirements is noncompliance with federal regulations and could result in loss of grant funding in future years. (Finding Code No. 2025-008) RECOMMENDATION: We recommend the University implements processes and controls to ensure that payments to subrecipients are made in accordance with the Uniform Guidance. UNIVERSITY RESPONSE: The University agrees with the recommendation. This issue was due to one department’s oversight in maintaining and providing appropriate documentation. The department was sent a reminder of the expectation of timely filing all required documentation to ensure payments to subrecipients are made in accordance with the Uniform Guidance.

FINDING - Noncompliance with Enrollment Reporting Requirements Federal Agency: Department of Education Assistance Listing Numbers: 84.268, 84.063 Program Names and Award Numbers: Federal Direct Student Loans, Federal Pell Grant Program Program Expenditures: $10,983,995, $12,186,160 Questioned Costs: None Northeastern Illinois University (University) did not have adequate procedures and controls in place to ensure that the effective date of students who unofficially withdrew was accurately reported to National Student Loan Data System (NSLDS). CONDITIONS FOUND & CRITERIA During our testing of the University’s compliance with enrollment reporting requirements for Direct loan programs via the NSLDS (OMB No. 1845-0035), we noted the University did not update program-level and campus-level effective enrollment dates for the students’ appropriate withdrawal date. We noted the following: - Two of 25 (8%) of the students originally tested withdrew during the Fall semester however were reported to NSLDS as withdrawn with an effective enrollment change date for the last day of the spring semester. NSLDS requires the that date the current enrollment status is to be reported when the change was first effective (See 4.4.2 of NSLDS Enrollment Reporting Guide) - Five of 25 (20%) of the students originally tested withdrew during their respective fall and spring semester however were reported to NSLDS as withdrawn with an effective enrollment at the end of the semester and not updated retroactively. - 15 of 15 (100%) additional students tested as a result of the error withdrew during their respective fall and spring semester however were reported to NSLDS as withdrawn with an effective enrollment at the end of the semester and not updated retroactively thus bringing total errors to 22 of 40 students (55%). NSLDS requires the that date the current enrollment status is to be reported when the change was first effective (See 4.4.2 of NSLDS Enrollment Reporting Guide) and can be retroactively reported to reflect the accurate effective date (See 4.4.5 of NSLDS Enrollment Reporting Guide) The sample was not intended to be, and was not, a statistically valid sample. NSLDS Enrollment Reporting Guide (4.4.5) does speak to continue education as a way of determination of student’s enrollment status. However, this is only applicable when evaluating the end of the current school year, during the spring and summer semester, with respect to the upcoming school year’s fall semester. CAUSE University’s officials stated these students’ enrollment effective date was not reported until the last day of the semester by confirming if the student was enrolled in the next term, which resulted in reporting the incorrect date. EFFECT Failure to meet enrollment reporting requirements is noncompliance with federal regulations and could result in loss of loan/grant funding in future years. (Finding Code No. 2024-006) RECOMMENDATION We recommend the University’s registrar’s office implement processes and controls to ensure the appropriate determination of the last date of attendance for withdrawal determinations are reported to NSLDS. UNIVERSITY RESPONSE The University agrees with the recommendation.

FINDING - Noncompliance with Grant Report Requirements Federal Agency: Department of Education Assistance Listing Numbers: 84.425F Program Names and Award Numbers: Education Stabilization Fund Under the Coronavirus Aid, Relief, And Economic Security Act [COVID-19 Higher Education Emergency Relief Fund: Institution Portion (P425F200852)] Program Expenditures: $2,160,298 Questioned Costs: None Northeastern Illinois University (University) did not have adequate procedures in place to ensure the Education Stabilization Fund - Higher Education Emergency Relief Fund (HEERF) reports were accurate and timely submitted to the U.S. Department of Education and posted to the University’s website. CONDITIONS FOUND & CRITERIA During our testing of the University’s compliance with the grant reporting requirements for HEERF, we noted the University did not review the required reports to ensure accuracy and compliance with the reporting requirements of the grant agreement. We noted the following: - Four of 4 (100%) Quarterly Public Reports improperly did not report the cumulative student aid disbursed for each undergraduate and graduate student. The Department of Education Quarterly Budget and Expenditure Reporting Form requires the posting of cumulative student aid disbursed by quarter for both undergraduate and graduate. - Two of 4 (50%) Quarterly Public Reports were posted 175 days and 84 days late to the University’s website. The Department of Education Quarterly Budget and Expenditure Reporting Form requires the University to post the Quarterly Public Reports covering each quarterly reporting period (September 30, December 31, March 31, June 30), no later than 10 days after the end of each calendar quarter. Uniform Guidance (2 CFR 200.303(a)) requires nonfederal entities receiving federal awards to establish and maintain effective internal control designed to reasonably ensure compliance with Federal laws, statutes, regulations, and the terms and conditions of the Federal award. CAUSE University officials stated required reports were not timely and accurately submitted due to turnover within the University resulting in staffing constraint. EFFECT Failure to meet grant reporting requirements is noncompliance with federal regulations and could result in loss of grant funding in future years. (Finding Code No. 2024-007, 2023-007, 2022-005, 2021-008, 2020-011) RECOMMENDATION We recommend the University improve its grant reporting and monitoring process to adhere with grant requests for reporting utilizing a calendar schedule and proper review before submission. UNIVERSITY RESPONSE The University agrees with the recommendation.

2023-007 FINDING - Noncompliance with Grant Report Requirements Federal Agency: Department of Education Assistance Listing Numbers: 84.425E/84.425F Program Names and Award Numbers: Education Stabilization Fund Under the Coronavirus Aid, Relief, And Economic Security Act [COVID-19 Higher Education Emergency Relief Fund: Institution Portion (P425F200852); COVID-19 Higher Education Emergency Relief Fund: Student Portion (P425E201821)] Program Expenditures: $5,142,525 Questioned Costs: None Northeastern Illinois University (University) did not have adequate procedures in place to ensure the Education Stabilization Fund - Higher Education Emergency Relief Fund (HEERF) reports were accurate and timely submitted to the U.S. Department of Education and posted to NEIU’s website.Northeastern Illinois University (University) did not have adequate procedures in place to ensure the Education Stabilization Fund - Higher Education Emergency Relief Fund (HEERF) reports were accurate and timely submitted to the U.S. Department of Education and posted to NEIU’s website. During our testing of the University’s compliance with the grant reporting requirements for HEERF, we noted the University did not review the required reports to ensure accuracy and compliance with the reporting requirements of the grant agreement. We noted the following: Four of 4 (100%) Quarterly Public Reports improperly completed and/or reported Student Aid amounts. The Department of Education Quarterly Budget and Expenditure Reporting Form requires the University to post the number of students and total amount of aid received each quarter. In addition, the Form requires the posting of cumulative student aid disbursed by quarter for both undergraduate and graduate. Finally, the University should note the average award amount per student for both undergraduate and graduate. Three of 4 (75%) Quarterly Public Reports were posted 15 days, 30 days, and 107 days late to the University’s website. The Department of Education Quarterly Budget and Expenditure Reporting Form requires the University to post the Quarterly Public Reports covering each quarterly reporting period (September 30, December 31, March 31, June 30), no later than 10 days after the end of each calendar quarter. Uniform Guidance (2 CFR 200.303(a)) requires nonfederal entities receiving federal awards establish and maintain effective internal control designed to reasonably ensure compliance with Federal laws, statutes, regulations, and the terms and conditions of the Federal award. University officials stated required reports were not timely and accurately submitted due to turnover within the University resulting in staffing constraints. Failure to meet grant reporting requirements is noncompliance with federal regulations and could result in loss of grant funding in future years. (Finding Code No. 2023-007, 2022-005, 2021-008, 2020-011) RECOMMENDATION: We recommend the University improve its grant reporting and monitoring process to adhere with grant requests for reporting. UNIVERSITY RESPONSE:The University agrees with the recommendation.

2022-005 - FINDING - Noncompliance with Grant Report Requirements Federal Agency: Department of Education Assistance Listing Numbers: 84.425 Program Names and Award Numbers: Education Stabilization Fund Under the Coronavirus Aid, Relief, And Economic Security Act [COVID-19 Higher Education Emergency Relief Fund: MSI Portion (P425L200096)); COVID-19 Higher Education Emergency Relief Fund: Institution Portion (P425F200852); COVID-19 Higher Education Emergency Relief Fund: Student Portion (P425E201821); and COVID-19 Governor's Emergency Education Relief Fund (21GEERNEIU)] Program Expenditures: $18,210,693 Questioned Costs: None Northeastern Illinois University (University) did not have adequate procedures in place to ensure the Education Stabilization Fund - Higher Education Emergency Relief Fund (HEERF) reporting requirements were submitted accurately and timely. During our testing of the University?s compliance with the grant reporting requirements for HEERF, we noted the University did not review the required reports to ensure accuracy and compliance with the reporting requirements of the grant agreement. We noted the following: Four of 4 (100%) Quarterly Public Reports for the Student Aid portion were not correctly completed. The reports were missing 3 of the 7 requirements. The missing requirements were items 1, 4 and 5 described below. The Federal Register Document No. 2020-19041 released on August 31, 2020 directs each HEERF - Student Portion participating institutions to post the following information on the institution?s primary website no later than 10 days after the end of each calendar quarter (September 30, and December 31, March 31, June 30) thereafter: 1) an acknowledgement that the institution signed and returned to the Department of Education (Department) the Certification and Agreement and the assurance that the institution has used, or intends to use, no less than 50 percent of the funds; 2) the total amount of funds that the institution will receive or has received from the Department; 3) the total amount of grants distributed to students; 4) the estimated total number of students at the institution eligible to participate and receive the grant; 5) the total number of students who have received the grant; 6) the method(s) used by the institution to determine which students receive the grant and how they would receive; and, 7) any instructions, directions or guidance provided by the institution to students concerning the grant. Three out of 8 (38%) Quarterly Public Reports were posted to the University website 1 day late in one instance and not posted to the University?s website in two instances. The Department of Education Quarterly Budget and Expenditure Reporting Form requires the University to post the Quarterly Public Reports covering each quarterly reporting period (September 30, December 31, March 31, June 30), no later than 10 days after the end of each calendar quarter. Uniform Guidance (2 CFR 200.303(a)) requires nonfederal entities receiving federal awards establish and maintain effective internal control designed to reasonably ensure compliance with Federal laws, statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure that all earmarking requirements are reviewed to ensure compliance. University officials stated required reports were not timely and accurately submitted due to turnover within the University resulting in staffing constraints. Failure to meet grant reporting requirements is noncompliance with federal regulations and could result in loss of grant funding in future years. (Finding Code No. 2022-005, 2021-008, 2020-011) RECOMMENDATION - We recommend the University improve its grant reporting and monitoring process to adhere with grant request for proposal and application agreement. UNIVERSITY RESPONSE - The University agrees with the recommendation.

2022-006 -FINDING - Insufficient Controls over Expenses Charged to TRIO Grant Federal Agency: Department of Education Assistance Listing Number: 84.042 Program Names and Award Numbers: TRIO ? Student Support Services, P042A200421 Program Expenditures: $809,380 Questioned Costs: $19,174 Northeastern Illinois University (University) charged unallowable expenditures to the Federal TRIO Program (TRIO) - Student Support Services grant During the testing of 40 expenditures selected from all of the TRIO grants, we noted one (3%) expenditure from the TRIO Student Support Services grant was an unallowable direct cost. It was for a legal settlement of $17,500 paid to an employee plus directly associated costs of $1,674. There was no approval request sent to the Department of Education. The sample was not intended to be, and was not, a statistically valid sample. Uniform Guidance (2 CFR 200.441) state that costs resulting from non-Federal entity violations of, alleged violations of, or failure to comply with, Federal, state, tribal, local or foreign laws and regulations are unallowable, except when incurred as a result of compliance with specific provisions of the Federal award, or with prior written approval of the Federal awarding agency. Uniform Guidance (2 CFR 200.303(a)) requires nonfederal entities receiving federal awards establish and maintain effective internal control designed to reasonably ensure compliance with Federal laws, statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure that all allowability policies are followed. University officials stated, there was inadequate communication between the departments involved. Failure to adequately review costs allowable under the uniform guidance principles resulted in the University overstating expenditures charged to the grant. (Finding Code No. 2022-006) RECOMMENDATION - We recommend the University ensure costs charged to grants are allowable under the Uniform Guidance. UNIVERSITY?S RESPONSE - The University agrees with the recommendation.

2022-007 - FINDING - Insufficient Controls over Payroll Charged to a Research Grant Federal Agency: National Institute of Health Assistance Listing Number: 93.397 Program Names and Award Numbers: Cancer Centers Support Grants (The Chicago Cancer Health Equity Collaborative a/k/a ChicagoCHEC), U54CA202995 Program Expenditures: $1,083,258 Questioned Costs: None Northeastern Illinois University (University) did not pay an employee for the time worked on a grant for a 3-month period when the employee worked those hours. During the testing of 60 expenditures selected from various research and development grants, we noted one (2%) expenditure tested for allowability was for retroactive pay to an employee originally only paid half of the hours worked on a grant for a 3-month period. The employee?s reported work hours were adjusted between periods to match available funding under the assumption that additional funding would be secured in a timely manner. The sample was not intended to be, and was not, a statistically valid sample. Uniform Guidance (2 CFR 200.430(i)) states charges to federal awards for salaries and wages must be based on records that accurately reflect the work performed. In accordance with Department of Labor regulations implementing the Fair Labor Standards Act (FLSA) (29 CFR part 516), charges for the salaries and wages of nonexempt employees must also be supported by records indicating the total number of hours worked each day. Uniform Guidance (2 CFR 200.303(a)) requires nonfederal entities receiving federal awards establish and maintain effective internal control designed to reasonably ensure compliance with Federal laws, statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure that all allowability policies are followed. University officials stated there was a significant delay by the funding agency in approving the usage of unspent grant funds from a prior period due to a delay in accepting the final financial status report for the previous grant period resulting in the University creating the payroll situation above. University?s response to delays in securing funding to pay employee resulted in costs being paid and charged to the grant in the wrong time periods. (Finding Code No. 2022-007). RECOMMENDATION - We recommend the University ensure procedures for payroll charges for employees are always for the actual hours worked within a given pay period according to the applicable regulations. UNIVERSITY RESPONSE - The University agrees with the recommendation.

2021-004. FINDING (Reporting of Disbursements to the Common Origination and Disbursement System)Northeastern Illinois University (University) did not timely submit disbursement records of the Federal Pell Grant Program to the Department of Education?s Common Origination and Disbursement (COD) System.During testing of 23 students with 49 disbursement transactions who received Federal Pell Grant Program funds totaling $99,972, we noted 5 (22%) students with 10 disbursement transactions totaling $22,793 were reported to the COD System 9 days late. The sample was not intended to be, and was not, a statistically valid sample.The Code of Federal Regulations (Code) (34 CFR ? 690.83(b)(2)) requires the University to submit, in accordance with deadline dates established by the Secretary, through publication in the Federal Register, other reports and information the Secretary requires and to comply with the procedures the Secretary finds necessary to ensure that the reports are correct.The Federal Register (Volume 85, No. 135 released on July 14, 2020) requires the University to submit Pell Grant disbursement records to the COD System, no later than 15 days after making the disbursement or becoming aware of the need to adjust a previously reported disbursement.The Code (2 CFR ? 200.303) also requires the nonfederal entity receiving federal awards establish and maintain effective internal control over the federal award that provides reasonable assurance the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Effective internal controls should include procedures to ensure submission of students? disbursement records to the federal agency within the required timeframe.University officials stated the issue was attributable to lack of staff going over the error log files, thus, resulting in the late reporting to the COD System.Failure to submit disbursements records within the required timeframe may result in the rejection of all or part of the reported disbursements by the federal agency, a program review finding, or the initiation of an adverse action in accordance with the federal regulation. (Finding Code No.2021-004, 2020-005)RECOMMENDATIONWe recommend the University continue to improve its internal control process to ensure all student disbursement records are reported to the COD system timely in accordance with the federal requirements.

2021-005. FINDING (Information Technology Risk Assessment Not Performed)Northeastern Illinois University (University) did not document required risk assessments related to student information security.As a requirement under the University?s Program Participation Agreement with the Department of Education, the University must protect student financial aid information. However, during our testing, we noted the University had not conducted a risk assessment identifying internal and external risks to the security, confidentiality, and integrity of the student?s information.The Standards for Safeguarding Customer Information, required by the Gramm-Leach-Bliley Act (GLBA) (16 CFR ? 314.4 (b)), requires entities to identify reasonable foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information, and assess the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risk in each relevant area of operations, including:(1) Employee training and management;(2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and(3) Detecting, preventing and responding to attacks, intrusions, or other system failures.Additionally, the Uniform Guidance (2 CFR ? 200.303(a)) requires nonfederal entities receiving federal awards establish and maintain effective internal control designed to reasonably ensure compliance with Federal laws, statutes, regulations, and the terms and conditions of the Federal award.In addition, the Framework for Improving Critical Infrastructure Cybersecurity published by the National Institute of Standards and Technology (NIST) requires entities to perform a risk assessment and establish a risk mitigation plan to minimize identified risks.University officials stated the issues were due to competing priorities and the delay in procuring a vendor.Without documentation of a risk assessment, the University is at risk of noncompliance with the GLBA. In addition, there is a risk the University?s systems and information could be vulnerable to attacks or intrusions, and these attacks may not be detected in a timely manner. (Finding Code No. 2021-005, 2020-006, 2019-007)RECOMMENDATIONWe recommend the University perform and document a comprehensive risk assessment identifying internal and external risks to the security, confidentiality, and integrity of the student?s information. In addition, the University should ensure proper safeguards are in place to ensure the security of student information.

2021-006. FINDING (Cost of Attendance for Student Financial Assistance)Northeastern Illinois University (University) did not have adequate documentation to support manual changes in the student?s cost of attendance information.The University annually determines the cost of attendance (COA) based on the types of costs established under the Higher Education Act. The University?s financial aid system automatically calculates the COA which can be manually adjusted based on special conditions, additional expenses and extenuating circumstances.During testing of 40 students who received financial aid assistance during Academic Year2020-2021, we noted manual adjustments in COA for 7 students (18%) without proper documentation being maintained in the students? file to support the manual changes made. The sample was not intended to be, and was not, a statistically valid sample.The University?s budgeting policy for Academic Year 2020 to 2021, Section 4.2, states that the University has the authority to use professional judgment to adjust the cost of attendance on a case-by-case basis to allow for special conditions, additional expenses and extenuating circumstances which must be documented in the student?s comment record.The Department of Education?s 2020 ? 2021 Federal Student Aid Handbook (Handbook) (Chapter 2 on Cost of Attendance and Chapter 5 on Application and Verification Guide) states financial aid administrator has the authority to use professional judgment to adjust the cost of attendance on a case-by-case basis to allow for special circumstances. Such adjustments must be documented in the student?s file.The Code of Federal Regulations (2 CFR ? 200.303) also requires the nonfederal entity receiving federal awards establish and maintain effective internal control over the federal award that provides reasonable assurance the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Effective internal controls should include procedures to ensure adequate documentation is maintained for adjustment to COA in compliance with the Handbook.University officials stated manual changes made on student?s cost of attendance without proper documentation were due to oversight.Failure to keep required documentation for changes made in cost of attendance or the data that determines student?s expected family contribution may result in incorrect financial assistance awarded to students. (Finding Code No. 2021-006, 2020-008)RECOMMENDATIONWe recommend the University document and retain documentation of the manual adjustments made to determine COA in compliance with the Handbook.

2021-007. FINDING (Inadequate Control Over Subrecipients)Northeastern Illinois University (University) did not communicate required program information and monitor subrecipients of federal awards.During testing of eight subrecipients, with pass-through federal expenditures totaling $1,472,962, on five programs of the Research and Development Cluster, Higher Education Institutional Aid, Twenty-First Century Community Learning Centers, and Gaining Early Awareness and Readiness for Undergraduate Programs, we noted the following:? The University did not timely communicate the required federal award information to five subrecipients (63%) to comply with federal statutes, regulations, and terms and conditions of the award. The communication through the agreements were made 203 to 321 days late.? The University did not communicate the required federal award information to three subrecipients (38%) to comply with federal statutes, regulations, and terms and conditions of the award.? The University did not verify that subrecipients undergo an audit when the subrecipients? federal awards exceeded the threshold.? The University erroneously classified a contractor as a subrecipient.The sample was not intended to be, and was not, a statistically valid sample.The Code of Federal Regulations (Code) (2 CFR ? 200.332 (a)) requires all pass-through entities to ensure that every subaward is clearly identified to the subrecipient as a subaward and include information to comply with Federal statutes, regulations, and the terms and conditions of the award. The required information includes the subrecipient?s name and unique entity identifier, CFDA number, federal award date, federal awarding agency, etc. When some of this information is not available, the pass-through entity shall provide the best information available to describe the Federal award.The Code of Federal Regulations (Code) (2 CFR ? 200.332 (f)) requires all pass-through entities to verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient's Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in 2 CFR ? 200.501.The Code (2 CFR ? 200.331) requires all pass-through entities to make case-by-case determination whether each agreement it makes for the disbursement of Federal program funds casts the party receiving the funds in the role of subrecipient or contractor.The Code (2 CFR ? 200.303) also requires nonfederal entities receiving awards to establish and maintain internal control designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Effective internal control should include procedures to ensure required information is communicated to subrecipients prior to the issuance of the subaward, verifying a subrecipient if an audit is required, and proper classification of a contractor from a subrecipient.University official stated the above issues were due to lack of staff during the fiscal year.Failure to communicate required subaward information could result in subrecipients not properly administering the federal programs in accordance with federal regulations. Failure to verify whether subrecipients meet the threshold for an audit may result in subrecipients not having adequate internal control to ensure compliance with the federal requirements. Erroneous classification of a contractor and subrecipients may result in inaccurate reporting of expenditures to the federal government. (Finding Code No. 2021-007, 2020-009, 2019-004, 2018-008)RECOMMENDATIONWe recommend the University implement uniform procedures across all departments to serve as guideline in communicating required subaward information to subrecipients, verify subrecipients to determine whether or not an audit is required, and properly classify contractors from subrecipients.

2021-008. FINDING (Noncompliance with Grant Report Requirements)Northeastern Illinois University (University) did not timely submit the required reports per grant agreements and statutory requirements.In testing the University compliance with the grant reporting requirements for the Twenty-First Century Community Learning Centers grant, we noted the following:? 12 of 12 (100%) Quarterly Grant Performance Reports for Award Year 2021 were submitted to the pass-through entity 4 to 278 days late.? Five of 39 (13%) State Evaluation Benchmarking Reports were submitted to the pass-through entity 3 days late and eight of 39 (21%) State Evaluation Benchmarking Reports were not submitted to the pass-through entity.The Grant Request for Proposal and Application Agreement of the University for the Twenty-First Century Community Learning Centers grant with Illinois State Board of Education (ISBE) requires submission of a periodic performance report 30 days after the end of each quarter. In addition, ISBE required State Evaluation Benchmarking Report for Summer 2020 and Spring 2021 to be submitted on September 14, 2020 and July 19, 2021, respectively.In testing the University compliance with the grant reporting requirements for the Education Stabilization Fund - Governor?s Emergency Education Relief (GEER) Fund, we noted the following:? Six of eight (75%) deliverables were submitted to the pass-through entity 3 to 101 days late and two of 8 (25%) deliverables were not prepared and submitted to the pass-through entity.? One of eight (13%) deliverables did not have the required report certification of the accuracy and completeness of the deliverables.? Three of eight (38%) grant Reimbursement Request forms were submitted to the pass-through entity 11 to 193 days late.The Grant Agreement of the University with the Illinois Board of Higher Education (IBHE) requires submission of deliverables that contain at a minimum the (a) programmatic detail which supports the Project Description; (b) expenditure detail for the reporting period; and (c) report certification. The deliverable reports and grant reimbursement forms were due October 31, 2020, January 31, 2021, April 30, 2021 and July 31, 2021.In testing the University compliance with the grant reporting requirements for the Education Stabilization Fund - Higher Education Emergency Relief Fund (HEERF), we noted the University did not review the required reports to ensure accuracy and compliance with the reporting requirements of the grant agreement. We noted the following:? Four of 4 (100%) Quarterly Public Reports for the Student Aid portion were not completed.The Federal Register Document No. 2020-19041 released on August 31, 2020 directs each HEERF ? Student Portion participating institutions to post the following information on the institution?s primary website no later than 10 days after the end of each calendar quarter (September 30, and December 31, March 31, June 30) thereafter: 1) an acknowledgement that the institution signed and returned to the Department of Education (Department) the Certification and Agreement and the assurance that the institution has used, or intends to use, no less than 50 percent of the funds; 2) the total amount of funds that the institution will receive or has received from the Department; 3) the total amount of grants distributed to students; 4) the estimated total number of students at the institution eligible to participate and receive the grant; 5) the total number of students who have received the grant; 6) the method(s) used by the institution to determine which students receive the grant and how they would receive; and, 7) any instructions, directions or guidance provided by the institution to students concerning the grant.? Four of 4 (100%) Quarterly Public Reports (Report) for the Institutional Portion and Minority Serving Institutions (MSI) were not correctly completed. The award amount and the disbursements for the Institutional Portion and MSI were not reported in the appropriate sections of the reports.The Department of Education Quarterly Budget and Expenditure Reporting Form (Form) requires the University to report the amount of funds awarded and the amount expended for the Institutional Portion and MSI in the appropriate section of the Form.? Five of 8 (63%) Quarterly Public Reports were posted to the University website2 to 3 days late.The Department of Education Quarterly Budget and Expenditure Reporting Form requires the University to post the Quarterly Public Reports covering each quarterly reporting period (September 30, December 31, March 31, June 30), no later than 10 days after the end of each calendar quarter.? The Annual Report submitted to the Department of Education was not accurately completed. The Student Aid Portion was not separately reported, the Institutional Portion and MSI were not correctly reported in the appropriations sections of the annual report.The Federal Register Document No. 2020-16429 released on July 29, 2020 requires the University to prepare and submit an annual report to the Department using a data collection form. The annual data collection form requires the Student Aid portion separately reported and Institutional Portion and MSI in the appropriate section of the data collection form.In testing the University?s compliance with the grant reporting requirements for Gaining Early Awareness and Readiness for Undergraduate Programs, we noted the University did not report sub-awards of two subrecipients (100%) who received sub-award over $30,000 through the Federal Funding Accountability Transparency Act (FFATA) Subaward Reporting System (FSRS).The Code of Federal Regulations on Reporting Subaward and Executive Compensation Information (2 CFR ? 170) requires the University to file a FFTA sub-award report by the end of the month following the month in which the University awards any sub-grant equal to or greater than $30,000.The Code (2 CFR ? 200.303) also requires the nonfederal entity receiving federal awards establish and maintain effective internal control over the federal award that provides reasonable assurance the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Effective internal controls should include procedures to ensure compliance with grantor?s reporting and other requirements.University officials stated required reports were not submitted or timely submitted due to oversight and technical errors encountered by the program director.Failure to meet grant reporting requirements is a noncompliance with the related grant request for proposal and application agreement and could result in loss of grant funding in future years. (Finding Code No. 2021-008, 2020-011)RECOMMENDATIONWe recommend the University improve its grant reporting and monitoring process to adhere with grant request for proposal and application agreement.

2020-004. FINDING (Student Notification of Disbursements of Direct Loans) Northeastern Illinois University (University) did not notify or timely notify the students in writing when the Federal Direct Student Loans funds were credited to students? accounts. During testing of 36 students with 70 disbursement transactions who received Federal Direct Student Loans fund totaling $330,542, we noted six (17%) students with six disbursement transactions totaling $25,884 were not notified by the University that federal financial assistance was credited to the students? accounts. In addition, we noted a student (3%) with a disbursement transaction amounting $2,721 was notified by the University 40 days after the Federal Direct Student Loans fund was credited to the student?s account. The sample was not intended to be, and was not, a statistically valid sample. The Code of Federal Regulations (Code) (34 CFR ? 668.165 (a)(3)(i)) requires the University to notify student or parent in writing no earlier than 30 days before, and no later than 30 days after, crediting the student?s ledger account at the University, if the University obtains affirmative confirmation from the student. The Code (2 CFR ? 200.303) also requires the nonfederal entity receiving federal awards establish and maintain effective internal control over the federal award that provides reasonable assurance the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Effective internal controls should include procedures to ensure timely notification of disbursements to students receiving Direct Loan. University officials stated student notifications are automatically created immediately after disbursements, via email, using a notification program linked to the University?s system. This notification program utilized by the University did not work properly, as intended, on those instances mentioned above. Failure to timely notify students regarding disbursements of financial aid may result in federal aid loans disbursed to students? accounts that were not agreed to by the students. (Finding Code No. 2020-004, 2019-001) RECOMMENDATION We recommend the University ensure compliance with the Code regarding student notification. UNIVERSITY?S RESPONSE The University agrees with the recommendation.

2020-005. FINDING (Reporting of Disbursements to the Common Origination and Disbursement System) Northeastern Illinois University (University) did not timely submit disbursement records of the Federal Pell Grant Program to the Department of Education?s Common Origination and Disbursement (COD) System. During testing of 27 students with 58 disbursement transactions who received Federal Pell Grant Program funds totaling $118,996, we noted 15 (56%) students with 19 disbursement transactions totaling $32,641 were reported to the COD System one to 66 days late. In addition, during testing of return of Title IV funds, we noted one (5%) of 19 return of Title IV funds tested was reported to the COD System two days late. The return of $1,549 was for a Federal Pell Grant awarded to a student. The sample was not intended to be, and was not, a statistically valid sample. The Code of Federal Regulations (Code) (34 CFR ? 690.83(b)(2)) requires the University to submit, in accordance with deadline dates established by the Secretary, through publication in the Federal Register, other reports and information the Secretary requires and comply with the procedures the Secretary finds necessary to ensure that the reports are correct. The Federal Register (Volume 84, No. 212 released on November 1, 2019) requires the University to submit Pell Grant disbursement records to the COD System, no later than 15 days after making the disbursement or becoming aware of the need to adjust a previously reported disbursement. The Code (2 CFR ? 200.303) also requires the nonfederal entity receiving federal awards establish and maintain effective internal control over the federal award that provides reasonable assurance the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Effective internal controls should include procedures to ensure submission of students? disbursement records to the federal agency within the required timeframe. University officials stated, during the extraction of information of Pell disbursements, the release indicator was not checked resulting in the late reporting to the COD System. Failure to submit disbursements records within the required timeframe may result in the rejection of all or part of the reported disbursements by the federal agency, a program review finding, or initiation of an adverse action in accordance with the federal regulation. (Finding Code No. 2020-005) RECOMMENDATION We recommend the University improve its internal control process to ensure all student disbursement records are reported to the COD system timely in accordance with the federal requirements. UNIVERSITY?S RESPONSE The University agrees with the recommendation.

2020-006. FINDING (Information Technology Risk Assessment Not Performed) Northeastern Illinois University (University) did not document required risk assessments related to student information security. As a requirement under the University?s Program Participation Agreement with the Department of Education, the University must protect student financial aid information. However, during our testing, we noted they had not conducted a risk assessment identifying internal and external risks to the security, confidentiality, and integrity of the student?s information. The Standards for Safeguarding Customer Information, required by the Gramm-Leach-Bliley Act (GLBA) (16 CFR ? 314.4 (b)), requires entities to identify reasonable foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information, and assess the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risk in each relevant area of operations, including: ? Employee training and management; ? Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and ? Detecting, preventing and responding to attacks, intrusions, or other system failures. Additionally, the Uniform Guidance (2 CFR ? 200.303(a)) requires nonfederal entities receiving federal awards establish and maintain effective internal control designed to reasonably ensure compliance with Federal laws, statutes, regulations, and the terms and conditions of the Federal award. Furthermore, generally accepted information technology guidance requires entities to perform a risk assessment and establish a risk mitigation plan to minimize identified risks. University officials stated the University has identified funding for an external consultant to perform a risk assessment as required by the GLBA, however, delay in the procurement and implementation process has been encountered due to the COVID pandemic and complication for onsite review. Without documentation of a risk assessment, the University is at risk of noncompliance with the GLBA. In addition, there is a risk the University systems and information could be vulnerable to attacks or intrusions, and these attacks may not be detected in a timely manner. (Finding Code No. 2020-006, 2019-007) RECOMMENDATION We recommend the University perform and document a comprehensive risk assessment identifying internal and external risks to the security, confidentiality, and integrity of the student?s information. In addition, the University should ensure proper safeguards are in place to ensure the security of student information. UNIVERSITY?S RESPONSE The University agrees with the recommendation.

2020-007. FINDING (Noncompliance with the Federal Perkins Loan Cohort Default Rate) Northeastern Illinois University?s (University) Federal Perkins Loan cohort rate is in excess of the threshold for administrative capability stipulated by the U.S. Department of Education. The Federal Perkins Loan cohort default rate as of June 30, 2020 (for borrowers who entered repayment during Fiscal Year 2019) was 35.55%. With the Federal Perkins Loan Program winding down in Fiscal Year 2018, the participating institutions had the option to assign the Perkins Loans to the U.S. Department of Education and distribute the assets of the Perkins Loan Revolving Fund or continue to service the Perkins Loans. The University chose to continue servicing their Perkins Loans. This finding was first reported in Fiscal Year 2018. In subsequent years, the University has been unsuccessful in implementing appropriate procedures to reduce the Federal Perkins Loan cohort default rate. The Code of Federal Regulations (Code) (34 CFR ? 668.16) states ?to begin and to continue to participate in any Title IV, Higher Education Act program, an institution shall demonstrate to the Secretary that the institution is capable of adequately administering that program under each of the standards established in this section. The Secretary considers an institution to have that administrative capability if the institution ?(m)(1) has a cohort default rate ? (iii) as defined in 34 CFR ? 674.5, on loans made under the Federal Perkins Loan Program to students for attendance at the institution that does not exceed 15 percent.? The U.S. Department of Education?s Dear Colleague (DCL ID: GEN-17-10) states that institutions that choose to continue to service their outstanding Perkins Loan portfolios must continue to service these loans in accordance with the Federal Perkins Loan Program regulations in 34 CFR ? 674. The Code (2 CFR ? 200.303) requires the nonfederal entity receiving federal awards establish and maintain effective internal control over the federal award that provides reasonable assurance the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Effective internal controls should include procedures to ensure the University maintains a Federal Perkins Loan cohort default rate of less than 15%. University officials stated the above issue was due to the elimination of the position that handled the collection and follow-up process to current/former students of the University with Federal Perkins Loan Program when they enter the repayment status. Failure to maintain a Federal Perkins Loan cohort default rate below 15% resulted in noncompliance with the Code. (Finding Code No. 2020-007, 2019-002, 2018-004) RECOMMENDATION We recommend the University improve procedures to collect its Federal Perkins Loans made to students in compliance with the Code of Federal Regulations. UNIVERSITY?S RESPONSE The University agrees with the recommendation.

2020-008. FINDING (Cost of Attendance for Student Financial Assistance) Northeastern Illinois University (University) did not have adequate documentation to support manual changes in the student?s cost of attendance information. The University annually determines the cost of attendance (COA) based on the types of costs established under the Higher Education Act. The University?s financial aid system automatically calculates the COA which can be manually adjusted based on financial aid administrator?s professional judgment for special circumstances. During our testing of 40 students who received financial aid assistance during Academic Year 2019-2020, we noted manual adjustments reducing the COA for 10 students (25%) without proper documentation being maintained in the students? file to support the manual changes made. The sample was not intended to be, and was not, a statistically valid sample. The Department of Education?s 2019 ? 2020 Federal Student Aid Handbook (Handbook) (Chapter 2 on Cost of Attendance and Chapter 5 on Application and Verification Guide) states financial aid administrator has the authority to use professional judgment to adjust the cost of attendance on a case-by-case basis to allow for special circumstances. Such adjustments must be documented in the student?s file. The Code of Federal Regulations (2 CFR ? 200.303) requires the nonfederal entity receiving federal awards establish and maintain effective internal control over the federal award that provides reasonable assurance the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Effective internal controls should include procedures to ensure adequate documentation is maintained for adjustments to COA in compliance with the Handbook. University officials stated manual changes made on student?s COA without proper documentation were due to oversight. Failure to keep required documentation for changes made in cost of attendance or the data that determines student?s expected family contribution may result in incorrect financial assistance awarded to students. (Finding Code No. 2020-008) RECOMMENDATION We recommend the University document and retain documentation of the manual adjustments made to determine COA is in compliance with the Handbook. UNIVERSITY?S RESPONSE The University agrees with the recommendation.

2020-009. FINDING (Failure to Communicate Required Information to Subrecipients) Northeastern Illinois University (University) did not communicate required program information to subrecipients of federal awards. During our testing of four subrecipients, with pass-through federal expenditures totaling $178,444, on three programs of the Research and Development Cluster, Higher Education Institutional Aid, and Twenty-First Century Community Learning Centers, we noted the University did not communicate the required federal award information to all (100%) subrecipients to comply with federal statutes, regulations, and terms and conditions of the award. The sample was not intended to be, and was not, a statistically valid sample. This finding was first reported in Fiscal Year 2018. In subsequent years, the University has been unsuccessful in implementing appropriate procedures to improve its controls in communicating required subaward information to subrecipients. The Code of Federal Regulations (Code) (2 CFR 200.332 (a)) requires all pass-through entities ensure that every subaward is clearly identified to the subrecipient as a subaward and include information to comply with Federal statutes, regulations, and the terms and conditions of the award. The required information includes the subrecipient?s name and unique entity identifier, CFDA number, federal award date, federal awarding agency, etc. When some of this information is not available, the pass-through entity shall provide the best information available to describe the Federal award. The Code (2 CFR ? 200.303) also requires nonfederal entities receiving awards to establish and maintain internal control designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Effective internal control should include procedures to ensure required information is communicated to subrecipients prior to the issuance of the subaward. University officials stated the failure to communicate required information to subrecipients was due to the lack of uniform procedures followed by various departments in providing subawards. Failure to communicate required subaward information could result in subrecipients not properly administering the federal programs in accordance with federal regulations. (Finding Code No. 2020-009, 2019-004, 2018-008) RECOMMENDATION We recommend the University implement uniform procedures across all departments to serve as guideline in communicating required subaward information to subrecipients. UNIVERSITY?S RESPONSE The University agrees with the recommendation.

2020-010. FINDING (Timesheets and Time and Effort Reports were not Submitted or Timely Submitted) Northeastern Illinois University (University) did not ensure time sheets and time and effort reports were submitted or timely submitted by employees. During our review of payroll documents for 30 employees, we noted the following: ? Five (17%) employees did not submit timesheets for the period tested. ? One (3%) employee timesheet was not approved by authorized personnel. ? Nine (30%) employees submitted their time and effort reports 4 to 179 days after the required due date. ? Four (13%) employees did not submit their time and effort reports for the period tested. The sample was not intended to be, and was not, a statistically valid sample. This finding was first reported in Fiscal Year 2017. In subsequent years, the University has been unsuccessful in implementing appropriate procedures to improve its controls over time and effort and time sheet reporting. The Code of Federal Regulations (Code) (2 CFR ? 200.430) states costs of compensation, including salaries and wages, are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees is determined and supported as provided in paragraph (i) of this section, Standards for Documentation of Personnel Expenses, when applicable. The Code (2 CFR ? 200.430(i)(1)(viii)(C)) states charges to Federal awards for salaries and wages must be based on records that accurately reflected the work performed. The nonfederal entity?s system of internal controls includes processes to review after-the fact interim charges made to a Federal award based on budget estimates. All necessary adjustments must be made such that the final amount charged to the Federal award is accurate, allowable, and properly allocated. University procedures require documentation supporting time spent each day on official State business to the nearest quarter hour to be submitted for all employees. In addition, University procedures require each employee?s timesheet be approved by his or her supervisor and/or unit head prior to payroll processing by the Office of Human Resources. The University?s Policy on Time and Effort Reporting for Federal Grants states the University utilizes an after-the fact time and effort reporting system to account for the effort of all faculty and staff who expend effort on federally sponsored grants. All University employees whose salary is being charged directly or cost shared on a federal flow-through sponsored project must complete and submit their time and effort reports. All time and effort reports are to be certified by the Principal Investigator (PI) or a person with suitable means of verification of work performed and endorsed by the PI and maintained in the Controller?s Office. The Code of Federal Regulations (2 CFR ? 200.303) also requires the nonfederal entity receiving federal awards establish and maintain effective internal control over the federal award that provides reasonable assurance the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Effective internal controls should include procedures to ensure timely submission of time and effort and time sheets of personnel in accordance with the University policy. University officials stated the delay in submission of time and effort reports and timesheets were due to remote operations and oversight. Failure to obtain time and effort reports and timesheets may hinder the ability of the University to determine whether salaries charged to federal grant funds are accurate, allowable, or properly allocated. (Finding Code No. 2020-010, 2019-003, 2018-007, 2017-006) RECOMMENDATION We recommend the University improve its procedures on time and effort and time sheet reporting to ensure timely submission of the reports and compliance with University policy and Federal regulations. UNIVERSITY?S RESPONSE The University agrees with the recommendation.

2020-011. FINDING (Noncompliance with Grant Report Requirements) Northeastern Illinois University (University) did not submit or timely submit the required reports to the Illinois State Board of Education (ISBE) for the Twenty-First Century Community Learning Centers grant. During testing of the University compliance with the grant requirements, we noted the following: ? 16 of 16 (100%) Quarterly Grant Performance Reports for Award Year 2019 were not prepared and submitted to ISBE; and ? Four of 39 (10%) State Evaluation Benchmarking Report for the Pathways program for Fall 2019 and Spring 2020 were submitted one to two days late. The Grant Request for Proposal and Application Agreement of the University with ISBE requires submission of a periodic performance report 30 days after the end of each quarter. In addition, ISBE required the State Evaluation Benchmarking Report for Fall 2019 and Spring 2020 to be submitted on May 18, 2020 and July 13, 2020, respectively. The Code (2 CFR 200.303) also requires the nonfederal entity receiving federal awards establish and maintain effective internal control over the federal award that provides reasonable assurance the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Effective internal controls should include procedures to ensure compliance with grantor?s reporting and other requirements. University officials stated required reports were not submitted or timely submitted due to oversight and technical errors encountered in filing. Failure to meet grant reporting requirements is a noncompliance with the related grant request for proposal and application agreement and could result in loss of grant funding in future years. (Finding Code No. 2020-011) RECOMMENDATION We recommend the University improve its grant reporting and monitoring process to ensure adherence with the grant request for proposal and application agreement. UNIVERSITY?S RESPONSE The University agrees with the recommendation.

2019-001. FINDING (Untimely Notification of Disbursements of Loan and TEACH Grants) Federal Agency: Department of Education CFDA Numbers: 84.268; 84.379 Program Names and Award Numbers: Student Financial Assistance Cluster [Federal Direct Student Loans (P268K181350/P268K191350); and Teacher Education Assistance for College and Higher Education Grants (P379T181350/P379T191350)] Program Expenditures: $19,055,480; $49,203 Questioned Costs: None Northeastern Illinois University (University) did not timely notify the students in writing when federal student aid loan funds were credited to students? accounts. In testing 33 students who received Federal Direct Student Loans and Teacher Education Assistance for College and Higher Education Grants (TEACH Grant) during the fiscal year, we noted 25 (76%) students tested, in 46 disbursement transactions, were notified 39 to 49 days after the federal assistance was credited to the students? accounts. The total direct loan and TEACH Grants disbursed to these students was $180,829. In addition, we noted 1 (3%) student was not notified of the change in their federal loan. The sample was not intended to be, and was not, a statistically valid sample. The Code of Federal Regulations (Code) (34 CFR Section 668.165 (a)(3)(i)) requires the University to notify student or parent in writing no earlier than 30 days before, and no later than 30 days after, crediting the student?s ledger account at the University, if the University obtains affirmative confirmation from the student. The Code (2 CFR 200.303) also requires the nonfederal entity receiving federal awards establish and maintain effective internal control over the federal award that provides reasonable assurance the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Effective internal controls should include procedures to ensure timely notification of disbursements to students receiving Direct Loan and TEACH grants. University officials stated student notifications are automatically created after disbursements and sent to the students via email. The delay in student notifications was due to emails not timely sent to students as a result of the issues encountered when the University moved the ERP system to the cloud during the fiscal year. Failure to timely notify students regarding disbursements of financial aid may result in federal aid loans disbursed to students? accounts that were not agreed to by the students. (Finding Code No. 2019-001) RECOMMENDATION We recommend the University ensure compliance with the federal regulations regarding student notification. UNIVERSITY?S RESPONSE The University agrees with the recommendation.

2019-002. FINDING (Noncompliance with the Federal Perkins Loan Cohort Default Rate) Federal Agency: Department of Education CFDA Numbers: 84.038 Program Names and Award Numbers: Student Financial Assistance Cluster [Federal Perkins Loan Program (None)] Program Expenditures: $1,478,085 Questioned Costs: None Northeastern Illinois University?s (University) Federal Perkins Loan cohort rate is in excess of the threshold for administrative capability stipulated by the U.S. Department of Education. The Federal Perkins Loan cohort default rate as of June 30, 2019 (for borrowers who entered repayment during Fiscal Year 2018) was 31%. With the Federal Perkins Loan Program winding down in Fiscal Year 2018, the participating institutions had the option to assign the Perkins Loans to the U.S. Department of Education and distribute the assets of the Perkins Loan Revolving Fund or continue to service the Perkins Loans. The University chose to continue servicing their Perkins Loans. The Code of Federal Regulations (Code) (34 CFR 668.16) states ?to begin and to continue to participate in any Title IV, Higher Education Act program, an institution shall demonstrate to the Secretary that the institution is capable of adequately administering that program under each of the standards established in this section. The Secretary considers an institution to have that administrative capability if the institution ?(m)(1) has a cohort default rate ? (iii) as defined in 34 CFR 674.5, on loans made under the Federal Perkins Loan Program to students for attendance at the institution that does not exceed 15 percent.? The U.S. Department of Education?s Dear Colleague (DCL ID: GEN-17-10) stated institutions that choose to continue to service their outstanding Perkins Loan portfolios must continue to service these loans in accordance with the Federal Perkins Loan Program regulations in 34 CFR 674. The Code (2 CFR 200.303) requires the nonfederal entity receiving federal awards establish and maintain effective internal control over the federal award that provides reasonable assurance the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Effective internal controls should include procedures to ensure the University maintains a Federal Perkins Loan cohort default rate of less than 15%. University officials stated the above issue was due to the elimination of the position that handled the collection and follow-up process to current/former students of the University with Federal Perkins Loan Program when they enter the repayment status. Failure to maintain a Federal Perkins Loan cohort default rate below 15% resulted in noncompliance with the Code. (Finding Code No. 2019-002, 2018-004) RECOMMENDATION We recommend the University improve procedures to collect its Federal Perkins Loans made to students in compliance with the Code of Federal Regulations. UNIVERSITY?S RESPONSE The University agrees with the recommendation.

2019-003. FINDING (Weaknesses over Allowable Costs/Cost Principles Requirements) Federal Agencies: National Science Foundation; Department of Health and Human Services; and Department of Education CFDA Numbers: 47.076; 93.859; 93.397 84.044; 84.217; 84.047; 84.042 84.287 84.031 Program Names and Award Numbers: Research and Development Cluster Education and Human Resources [Development of Assessment Protocols for Assessing Computational Thinking in Physics and Engineering Making Activities (1543124); University and Community College Collaboration for Mathematics and Biology Scholar Teacher Education (1660785); and Integrating Science, Mathematics, and Computing Within an Elementary and Middle School Pre-Service Teacher Education Curriculum (1640041)]; Biomedical Research and Research Training [NU-STARS for Northeastern Illinois Student Training in Academic Research in the Sciences (TGM105549A)]; and Cancer Centers Support Grants [The Chicago Collaborative to Promote and Advance Cancer Health Equity (UCA202995A)] TRIO Cluster [TRIO Talent Search (P044A160306); TRIO McNair Post-Baccalaureate Achievement (P217A170073); TRIO Upward Bound Math and Science Pathways (P047M170101); and TRIO Student Support Services (P042A151085/P042A151075/P042A151088)] Twenty-First Century Community Learning Centers [Pathways (4421-15-15-016-5405-51), Austin (4421-13-15-016-5405-51), Craft (4421-19-15-016-5405-51) and Morton Success (4421-25-15-016-5405-51)] Higher Education Institutional Aid [EXITO: Exit on Time in STEM (P031C160209), A Comprehensive System of Support: Increasing Retention into the Third Year (P031S160171), and Title V: Developing Hispanic-Serving Institutions Program (P031S180151)] Program Expenditures: $513,912; $ 277,526; $943,995 $460,590; $203,697; $291,366; $622,602 $1,395,206 $1,606,790 Questioned Costs: None Northeastern Illinois University (University) did not comply with the internal controls and compliance requirements on allowable costs and costs principles. During our review of payroll documents for 29 employees, we noted the following: ? 14 (48%) employees submitted their time and effort reports 9 to 42 days after the required due date. ? Five (17%) employees did not submit timesheets for the period tested. ? 16 (55%) employees for pay periods tested were not timely completed and approved by the supervisor or unit head. The timesheets were approved one to 238 days late. In addition, during our testing of 160 vouchers totaling $798,503, we noted the following: ? Required signatures on purchase requisitions and travel authorization of 2 (1%) vouchers totaling $3,456 were not obtained. The requisition forms for these vouchers totaling $9,142, were increased, therefore requiring an additional level of approval, which was not obtained. ? Required signature of 6 (4%) vouchers totaling $11,607 were not obtained. ? A voucher (1%) amounting to $1,100 was charges to an incorrect expenditure category. The sample was not intended to be, and was not, a statistically valid sample. The Code of Federal Regulations (Code) (2 CFR 200.430) states costs of compensation, including salaries and wages, are allowable to the extent that they satisfy the specific requirements of this part, and that the total compensation for individual employees is determined and supported as provided in paragraph (i) of this section, Standards for Documentation of Personnel Expenses, when applicable. The Code (2 CFR 200.430(i)(1)(viii)(C)) states charges to Federal awards for salaries and wages must be based on records that accurately reflected the work performed. The nonfederal entity?s system of internal controls includes processes to review after-the fact interim charges made to a Federal award based on budget estimates. All necessary adjustments must be made such that the final amount charged to the Federal award is accurate, allowable, and properly allocated. The University?s Policy on Time and Effort Reporting for Federal Grants states the University utilizes an after-the fact, Banner-based effort reporting system to account for the effort of all faculty and staff who expend effort on federally sponsored grants. All University employees whose salary is being charged directly or cost shared on a federal flow-through sponsored project must complete and submit their time and effort reports. All time and effort reports are to be certified by the Principal Investigator (PI) or a person with suitable means of verification of work performed and endorsed by the PI and maintained in the Controller?s Office. University procedures require documentation supporting time spent each day on official State business to the nearest quarter hour to be submitted for all employees except graduate assistants. The University?s Board of Trustees Regulations, Section V, Administrative Affairs, Subsection B, requires approval of purchases prior to the obligation of financial resources of the University. The University Purchasing Approval Levels require that (1) purchase requisitions with an amount of up to $2,499.99 require approval of the Financial Manager (FM) only, (2) purchase requisitions with an amount of $2,500.00 to $4,999.99 require an approval of a Level I Approver in addition to FM, (3) purchase requisitions with an amount of $5,000 to $9,999.99 require an approval of a Level II Approver in addition to the Level I and FM, (4) purchase requisitions with an amount of $10,000 to $49,999.99 require approval of the appropriate vice president or area executive in addition to the Level II, Level I, and FM, and (5) purchase requisitions with an amount of $50,000 to $99,999.99 require an approval of the President in addition to vice presidents or the area executive, Level II, Level I, and FM. The Code (2 CFR 200.303) also requires the nonfederal entity receiving federal awards establish and maintain effective internal control over the federal award that provides reasonable assurance the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Effective internal controls should include procedures to ensure timely submission of time and effort and time sheets of personnel and purchases are in accordance with approved University procurement and travel policy. University officials stated the delay in the submission of time and effort reports was due to a timing issue as employees were unavailable during the reporting deadline time frame and non-submission of time sheet were due to oversight of employees and their supervisors. In addition, University officials stated exceptions noted on voucher processing were due to staff turnover in the various departments of the University. Failure to obtain time and effort reports may hinder the ability of the University to determine whether salaries charged to federal grant funds are accurate, allowable, or properly allocated. Failure to obtain required approval and process vouchers in accordance with University policy resulted in noncompliance (Finding Code No. 2019-003, 2018-007, 2017-006) RECOMMENDATION We recommend the University improve its procedures on time and effort and time sheet reporting to ensure timely submission of the reports and compliance with University policy and Federal regulations. In addition, we recommend the University strengthen its controls over voucher processing to ensure compliance with the University policies and prevent and detect unauthorized transactions timely in compliance with the University policy and Federal regulations. UNIVERSITY?S RESPONSE The University agrees with the recommendation.

2019-004. FINDING (Failure to Communicate Required Information to Subrecipients) Federal Agencies: National Science Foundation Department of Health and Human Services Department of Education CFDA Numbers: 47.076; 93.397 84.031 84.287 Program Names and Award Numbers: Research and Development Cluster Education and Human Resources [University and Community College Collaboration for Mathematics and Biology Scholar Teacher Education (1660785)]; and Cancer Centers Support Grants [The Chicago Collaborative to Promote and Advance Cancer Health Equity (UCA202995A)] Higher Education Institutional Aid [EXITO: Exit on Time in STEM (P031C160209)] Twenty-First Century Community Learning Centers [Project 4421-13: Austin (4421-13-15-016-5405-51)] Program Expenditures: $214,121; $943,995 $932,070 $526,071 Questioned Costs: None Northeastern Illinois University (University) did not communicate required program information to subrecipients of federal awards. During our testing of six subrecipients of the Research and Development Cluster, Higher Education Institutional Aid, and 21st Century Community Learning Centers, the University did not communicate the required information to 4 (67%) subrecipients with federal expenditures totaling $131,256 to comply with federal statutes, regulations, and terms and conditions of the award. The sample was not intended to be, and was not, a statistically valid sample. The Code of Federal Regulations (Code) (2 CFR 200.331 (a)) requires all pass through entities to ensure that every subaward is clearly identified to the subrecipient as a subaward and include information to comply with Federal statutes, regulations, and the terms and conditions of the award. The required information includes the subrecipient?s name and unique entity identifier, CFDA number, federal award date, federal awarding agency, etc. When some of this information is not available, the pass-through entity shall provide the best information available to describe the Federal award. The Code (2 CFR 200.303) aslo requires nonfederal entities receiving awards to establish and maintain internal control designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Effective internal control should include procedures to ensure required information is communicated to subrecipients prior to the issuance of the subaward. University officials stated the failure to communicate required information to subrecipients was due to the lack of uniform procedures followed by various departments providing subawards. Failure to communicate required subaward information could result in subrecipients not properly administering the federal programs in accordance with federal regulations. (Finding Code No. 2019-004, 2018-008) RECOMMENDATION We recommend the University implement uniform procedures across all departments to serve as a guideline in communicating required subaward information to subrecipients. UNIVERSITY?S RESPONSE The University agrees with the recommendation.

2019-005. FINDING (Reporting to NSLDS) Federal Agency: Department of Education CFDA Numbers: 84.063; 84.007 Program Names and Award Numbers: Student Financial Assistance Cluster [Federal Pell Grant Program (P063P171350/P063P181350); and Federal Supplemental Educational Opportunity Grant (P007A171241/P007A181241)] Program Expenditures: $14,050,903; $454,559 Questioned Costs: None Northeastern Illinois University (University) did not report changes in enrollment status information of students to the National Student Loan Data System (NSLDS) in a timely manner. The University utilizes the National Student Clearinghouse (NSC) as a third-party provider in order to submit student information to the NSLDS. During testing of 40 students, we noted the University reported the change in enrollment status of a student (3%) to the NSLDS 26 days late. In addition, the University did not report the change in the enrollment status of another student (3%) who officially withdrew from the enrolled program to the NSLDS. The sample was not intended to be, and was not, a statistically valid sample. The Code of Federal Regulations (Code) (34 CFR 690.83(b)(2)) requires institutions submit, in accordance with deadline dates established by the Secretary, through publication in the Federal Register, other reports and information the Secretary requires and comply with the procedures the Secretary finds necessary to ensure that the reports are correct. Furthermore, the U.S. Department of Education clarified in a Dear Colleague Letter dated April 14, 2014 (DCL ID: GEN-14-07) that accurate and timely reporting to NSLDS is the school?s responsibility and if a school?s servicer NSLDS enrollment reporting is noncompliant, the school would be held responsible and subject to appropriate sanctions. The Code (2 CFR 200.303) also requires the nonfederal entity receiving federal awards establish and maintain effective internal control over the federal award that provides reasonable assurance the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Effective internal controls should include procedures to ensure changes in student statuses are submitted or timely submitted to NSLDS. University officials stated the above noted issues were due to human error by staff in processing student withdrawals from enrolled programs. Failure to provide accurate and complete enrollment reporting status information to NSLDS may jeopardize future federal funding. (Finding Code No. 2019-005, 2018-002, 2017-003, 2016-007, 2015-008) RECOMMENDATION We recommend the University improve its current procedures to ensure accurate and complete reporting of student information to the NSLDS. UNIVERSITY?S RESPONSE The University agrees with the recommendation.

2019-006. FINDING (Inadequate Records Supporting Student Eligibility for Financial Aid) Federal Agency: Department of Education CFDA Numbers: 84.063 Program Names and Award Numbers: Student Financial Assistance Cluster [Federal Pell Grant Program (P063P171350/P063P181350)] Program Expenditures: $14,050,903 Questioned Costs: $655 Northeastern Illinois University (University) did not ensure documents supporting the student?s eligibility for student financial assistance were obtained from the students. During testing of 40 students awarded with Title IV grants for the Academic Year 2018-2019, we noted a student (3%), whose application was selected by the U.S. Department of Education for verification by the University, did not provide documentation supporting their high school completion or recognized equivalent. The University upon inquiry by auditors, reversed the grant to the student by $655. The sample was not intended to be, and was not, a statistically valid sample. The Code of Federal Regulation (Code) (34 CFR 668.32(e)) requires a student to be eligible to receive Title IV to have a high school diploma or its recognized equivalent. The Code (2 CFR 200.303) also requires the nonfederal entity receiving federal awards establish and maintain effective internal control over the federal award that provides reasonable assurance the nonfederal entity is managing the federal award in compliance with federal statutes, regulations, and the terms and conditions of the federal award. Effective internal controls should include procedures to ensure required verification process for students applying for student financial aid is properly performed and admission requirements are adequately documented. University officials stated this was due to administrative oversight in the student admission and financial aid verification processes by the Enrollment and Admission Office and the Student Financial Aid Office, respectively. Failure to implement required verification for students applying financial aid may result in financial aid awarded to ineligible student. (Finding Code No. 2019-006, 2018-005) RECOMMENDATION We recommend the University improve its current procedures to ensure verification of students applying for financial aid is properly performed. UNIVERSITY?S RESPONSE The University agrees with the recommendation.

2019-007. FINDING (Information Technology Risk Assessment Not Performed) Federal Agency: Department of Education CFDA Numbers: 84.007; 84.268; 84.033; 84.038; 84.063 Program Names and Award Numbers: Student Financial Assistance Cluster [(Federal Supplemental Educational Opportunity Grants (P007A171241/P007A181241); Federal Direct Student Loans (P268K181350/P268K191350); Federal Work-Study Program (P033A171241/P033A181241); Federal Perkins Loan Program (None); Federal Pell Grant Program (P063P171350/P063P181350); Teacher Education Assistance for College and Higher Education Grants (P379T181350/P379T191350)] Program Expenditures: $454,559; $19,055,480; $502,886; $1,478,085; $14,050,903; $49,203 Questioned Costs: None Northeastern Illinois University (University) did not document required risk assessments related to student information security. As a requirement under the University?s Program Participation Agreement with the Department of Education, the University must protect student financial aid information. However, during our testing, we noted they had not conducted a risk assessment identifying internal and external risks to the security, confidentiality, and integrity of the student?s information. The Standards for Safeguarding Customer Information, required by the Gramm-Leach-Bliley Act (GLBA) (16 C.F.R ? 314.4 (b)), requires customers to identify reasonable foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information, and assess the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risk in each relevant area of operations, including: (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other system failures. Additionally, the Uniform Guidance (2 CFR 200.303(a)) requires nonfederal entities receiving federal awards establish and maintain effective internal control designed to reasonably ensure compliance with Federal laws, statutes, regulations, and the terms and conditions of the Federal award. Furthermore, generally accepted information technology guidance endorses the implementation of a process to identify risk and ensure appropriate safeguards are in place to protect IT systems and data. University management indicated the above issues were due to limited staff resources. Without documentation of a risk assessment, the University is at risk of noncompliance with the GLBA. In addition, there is a risk that University systems and information could be vulnerable to attacks or intrusions, and these attacks may not be detected in a timely manner. (Finding Code No. 2019-007). RECOMMENDATION We recommend the University perform and document a comprehensive risk assessment identifying internal and external risks to the security, confidentiality, and integrity of the student?s information. In addition, the University should ensure proper safeguards are in place to ensure the security of student information. UNIVERSITY?S RESPONSE The University agrees with the recommendation.

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION