LINCOLN LAND COMMUNITY COLLEGE - COMMUNITY COLLEGE DISTRICT #526Local Government

Type of Finding: Significant Deficiency in Internal Control Criteria or specific requirement: The Federal Register 79 FR 75879 states a non-Federal participant in a covered transaction with an entity at a lower tier must verify that the entity is not suspended, debarred, or otherwise excluded from participating in the transactions. Condition: During our testing of five entities with which the College entered into covered transactions, we noted the College was not able to provide sufficient evidence for verification of any of the entities before initiating the transactions. Questioned costs: None Context: Procedures to verify vendors have historically been in place, but it was noted the College?s control was not consistently in place during the fiscal year. Cause: Due to changes in the College's purchasing personnel, the process to verify entities during the fiscal year was not operating effectively. Effect: The College could possibly initiate a transaction with an entity not possessing the ability to perform successfully under the terms and conditions of a proposed procurement, and the Federal agency may disallow costs under the Federal program. Repeat finding: No Section III ? Federal Award Findings and Questioned Costs (Continued) 2022 ? 001 (Continued) Recommendation: We recommend the College review its procedures to adequately document the verification of entities with which it enters into covered transactions as not being suspended or debarred. Views of responsible officials: There is no disagreement with the audit finding.

2021-001 Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.425E and 84.425F Pass-Through Agency: N/A Pass-Through Number(s): N/A Award Period: July 1, 2020 ? June 30, 2021 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: The Federal Register 86 FR 26213 states that institutions must promptly and timely post detailed accounting of the use and expenditure of the (HEERF I, II, III) (a)(1) and (a)(4) Student Aid Portion funds in a format and location that is easily accessible to the public. The information is required to be updated no later than 10 days after the end of each calendar quarter (September 30, December 31, March 31, and June 30). The OMB Control Number 1840-0849 form states that institutions must promptly and timely post the completed budget and expenditure reporting form for (HEERF I, II, III) (a)(1) and (a)(3) Institutional Portion funds on the institution's primary website. The information is required to be updated no later than 10 days after the end of each calendar quarter (September 30, December 31, March 31, and June 30). Condition: During our testing of quarterly reports posted to the College?s website, we noted 1 of 4 required quarterly report postings was submitted 3 days after the required due date. Questioned costs: None. Context: It was noted that the College did not have a proper procedure in place for reporting information timely and accurately. Cause: There were time constraints due to the start of the new semester. Procedures are in place to meet all future reporting deadlines. Section III ? Federal Award Findings and Questioned Costs (Continued) 2021-001 (Continued) Effect: The College did not comply with the Department of Education regulations for timely quarterly reporting of specified information for (HEERF I, II, III) (a)(1), (a)(3) and (a)(4) Student Aid and Institutional Portion funds. Repeat finding: No Recommendation: We recommend the College reevaluate its procedures and review policies surrounding reporting requirements to ensure accurate and timely reporting. Views of responsible officials: There is no disagreement with the audit finding.

Finding 2019-001 ? Gramm Leach Bliley Act ? Risk Assessment of the Information System Federal Agency: U.S. Department of Education CFDA Number: 84.007; 84.033; 84.063; 84.268 Program Name: Student Financial Assistance Program Cluster Type of Finding: Special Tests and Provisions ? Significant Deficiency Criteria The Gramm-Leach-Bliley Act (Public Law 106-102) requires the College to comply with its provisions. The Act identifies that the College should designated an individual to coordinate the information security program, performed a risk assessment over their information system, and document safeguards for identified risks. Condition For fiscal year 2019, the College had not performed the following: designated an individual to coordinate the information security program; a risk assessment over their information system that addresses the three required areas noted in 16 CFR 314.4 (b); nor documented safeguards for identified risks. Context A risk assessment over the information system was not performed during fiscal year 2019. Effect Management could be unaware of vulnerable areas within their information system that could lead to data breaches. Cause Management did not have time to perform a risk assessment before the end of fiscal year 2019. Recommendation We recommend that an individual is identified to coordinate the information security program, perform a risk assessment over the information system, and document safeguards for any identified risks. Views of responsible officials An outside security firm has been engaged to complete a risk assessment for fiscal year 2020. Corrective Action Plan See the corrective action plan attached.