WESTERN ILLINOIS UNIVERSITY

Federal Agency: U.S. Department of Education Assistance Listing Number: 84.063, 84.268 Program Expenditures: $31,997,072 Program Name: Federal Pell Grant Program, Federal Direct Student Loans Award Number(s): P063P231391, P063P241391, P063P251391, P268K241391, and P268K251391 Questioned Costs: None CONDITION: Western Illinois University (University) did not have adequate procedures in place to complete accurate enrollment reporting for all students. During our testing of Pell or Direct Loan borrowers, we noted 4 out of 40 (10%) students campus-level record and program-level record were not updated with accurate enrollment status changes. The sample was not a statistically valid sample. The University is required to report enrollment reporting changes accurately. During the year, there were underlying problems with how data was being submitted to the National Student Clearinghouse (NSC), resulting in enrollment status changes and degree confirmations to be inaccurate for 4 students tested out of 40 students tested (10% of students tested).While the University had a policy in place to ensure enrollment reporting for degree confirmations and status changes were being submitted to the NSC, there was a flaw in the University’s process that caused the fall graduate batch of students to be initially coded to “G-Not Applied” in the National Student Loan Data System (NSLDS). This was due to an error in the upload compared with underlying information in the NSLDS system. When the next batch of students were submitted to the NSLDS, this resulted in all “G-Not Applied” students to auto-update to “Withdrawn” in the NSLDS system. CRITERIA: For the Federal Pell Grant Program, 34 CFR Section 690.83(b)(2) requires an institution to submit in accordance with deadline dates established by the secretary, through publication in the Federal Register, other reports and information the secretary requires and shall comply with the procedures the secretary finds necessary to ensure that the reports are correct. For the Federal Direct Student Loans, 34 CFR Section 685.309(b) requires changes in student status to be reported to the NSLDS in accordance with enrollment reporting in transmissions sent to the NSLDS, including updating all flagged information by NSLDS. Uniform Guidance (2 CFR 200.303(a)) requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure enrollment reporting is accurate. CAUSE AND EFFECT: University officials indicated staff turnover required reassessment of internal documentation and procedures that were in place to ensure all required campus-level data and program-level data was being reported to NSLDS via NSC accurately due to a flaw in their process causing degree confirmations to be overridden. Inadequate Internal Control over Student Enrollment Reporting (Continued) Without sufficient controls around enrollment reporting there is a greater risk that student enrollment data will not be reported accurately. Inaccurate reporting of student enrollment data can result in inconsistencies between the University’s records and the National Student Loan Data System as well as potential delays in the repayment of federal loans. (Finding Code No. 2025-001, 2024-001, 2023-001, 2022-002) RECOMMENDATION: We recommend the University implement controls to ensure that all enrollment status changes and degree confirmations are being appropriately reported through NSC to NSLDS and that submissions of degree confirmations to NSC are appropriate to ensure enrollment status changes are reported accurately. UNIVERSITY RESPONSE: The University agrees wth the finding. The University is implementing enhanced internal controls to ensure enrollment status changes and degree confirmations are being appropriately submitted and reported.

Federal Agency: U.S. Department of Education Assistance Listing Number: 84.063, 84.268, 84.007, 84.379 Program Expenditures: $32,514,420 Program Name: Federal Pell Grant Program, Federal Direct Student Loans, Federal Supplemental Education Opportunity Grants, Teacher Education Assistance for College and Higher Education Grants Award Number(s): P063P231391, P063P241391, P063P251391, P268K241391, P268K251391, P007A241313, P379T241391, and P379T251391 Questioned Costs: None CONDITION: Western Illinois University (University) did not have adequate procedures in place to complete accurate and timely return of Title IV funds for all students within the required time period. During our testing of borrowers that withdrew from the University, we noted 7 out of 40 (17.5%) students return of Title IV funds were not processed within the 45 day window, ranging from 60-163 days late. The sample was not a statistically valid sample. CRITERIA : A school participating in Title IV aid programs must establish and maintain proper administrative and fiscal procedures and initiate returns accurately within 45 days after the determined date of withdrawal (34 CFR 668.173(b)), and accurately calculate the amount of unearned title IV assistance to be returned to the Department of Education (34 CFR 668.22(g)). Uniform Guidance (2 CFR 200.303(a)) requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure the return of Title IV funds is accurate and timely. CAUSE AND EFFECT: University management indicated staffing shortages as well as regulatory and systemic changes during the 2024-2025 aid year caused this to occur. Without sufficient controls in place to return Title IV funds, there is a greater risk that the school does not return funds timely or accurately or that students may not receive post-withdrawal disbursements timely or accurately. (Finding Code No. 2025-002, 2024-002, 2023-002) RECOMMENDATION: We recommend the University implement controls to ensure that all refunds of Title IV funds are initiated within 45 days of the date of determination for the students withdrawal and additional controls to ensure proper review of the return of Title IV calculations. We also recommend these controls be monitored to ensure that all necessary refunds are completed within the required time frame and accurately. UNIVERSITY RESPONSE: The University agrees with the finding. The University is committed to developing a comprehensive plan to ensure compliance with return of Title IV funds policies and procedures.

Federal Agency: Department of Agriculture Assistance Listing Number: 10.310 Program Expenditures: $1,328,494 Program Name: Oilseed Pennycress: A New Cash Cover-Crop for the Midwest Award Number(s): 2019-69012-29851 Questioned Costs: None CONDITION: Western Illinois University (University) did not have adequate procedures in place to complete a timely disbursement of requested pass-through funds to subrecipients within the required time period. During our testing of payments made on requests from subrecipients, there were 2 out of 8 (25%) tested instances of the University not disbursing funds within 30 days of the payment request, as required. For the samples mentioned, the funds were sent 32 days and 120 days after the request. The sample was not a statistically valid sample. CRITERIA: Uniform Guidance (2 CFR 200.305(b)(3)) states that when the reimbursement method is used, the Federal agency or pass-through entity must make payment within 30 calendar days after receipt of the payment request unless the Federal agency or pass-through entity reasonably believes the request to be improper. Uniform Guidance (2 CFR 200.303(a)) requires non-Federal entities receiving Federal awards to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure the timely disbursement of funds to subrecipients. CAUSE AND EFFECT: The University did not have adequate procedures in place to ensure all payments to subrecipients were made within the 30 day requirement. Without sufficient controls around return over subrecipient payments and overall cash management, there is a greater risk that the school will miss a payment to be passed through to the subrecipient, thus understating expenditures on the Schedule of Expenditures of Federal Awards. (Finding Code No. 2025-003) RECOMMENDATION: We recommend the University implement controls to ensure that all payments to be passed through to subrecipients are identified and paid within the required time frame. UNIVERSITY RESPONSE: The University agrees with the finding. The University is committed to developing a comprehensive plan to ensure compliance with payment of pass-through funds policies and procedures.

Federal Agency: U.S. Department of Education Assistance Listing Number: 84.063, 84.268 Program Expenditures: $38,764,799 Program Name: Federal Pell Grant Program, Federal Direct Student Loans Award Number(s): P063P211391, P063P221391, P063P231391, P268K231391, and P268K241391 Questioned Costs: None Condition: Western Illinois University (University) did not have adequate procedures in place to complete accurate enrollment reporting for all students. During our testing of Pell or Direct Loan borrowers, we noted 8 out of 40 (20%) students campus-level record and program-level record were not updated with accurate enrollment status changes. The sample was not a statistically valid sample. The University is required to report enrollment reporting changes accurately. During the year, there were underlying problems with how data was being submitted to the National Student Clearinghouse (NSC), resulting in enrollment status changes and degree confirmations to be inaccurate for 8 students tested out of 40 students tested (20% of students tested). Noted, while the University had a policy in place to ensure enrollment reporting for degree confirmations and status changes were being submitted to the NSC, there was a flaw in the University’s process that caused the fall graduate batch of students to be initially coded to “G-Not Applied” in the National Student Loan Data System (NSLDS). This was due to an error in the upload compared with underlying information in the NSLDS system. When the next batch of students were submitted to the NSLDS, this resulted in all “G-Not Applied” students to auto-update to “Withdrawn” in the NSLDS system. Criteria: For the Federal Pell Grant Program, 34 CFR Section 690.83(b)(2) requires an institution to submit in accordance with deadline dates established by the secretary, through publication in the Federal Register, other reports and information the secretary requires and shall comply with the procedures the secretary finds necessary to ensure that the reports are correct. For the Federal Direct Student Loans, 34 CFR Section 685.309(b) requires changes in student status to be reported to the NSLDS in accordance with enrollment reporting in transmissions sent to the NSLDS, including updating all flagged information by NSLDS. Uniform Guidance (2 CFR 200.303(a)) requires non-Federal entities receiving Federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure enrollment reporting is accurate. Cause and Effect: University officials indicated staff turnover required reassessment of internal documentation and procedure that were in place to ensure all required campus-level data and program-level data was being reported to NSLDS via NSC accurately due to a flaw in their process causing degree confirmations to be overridden with other enrollment information prior to submission. Without sufficient controls around enrollment reporting there is a greater risk that student enrollment data will not be reported accurately. Inaccurate reporting of student enrollment data can result in inconsistencies between the University’s records and the National Student Loan Data System as well as potential delays in the repayment of federal loans. (Finding Code No. 2024-001, 2023-001, 2022-002) Recommendation: We recommend the University implement controls to ensure that all enrollment status changes and degree confirmations are being appropriately reported through NSC to NSLDS and that submissions of degree confirmations to NSC are appropriate to ensure enrollment status changes are reported accurately. University Response: The University agrees with the finding. The University is implementing enhanced internal controls to ensure enrollment status changes and degree confirmations are being appropriately submitted and reported.

Federal Agency: U.S. Department of Education Assistance Listing Number: 84.063, 84.268, 84.007, 84.379 Program Expenditures: $39,166,408 Program Name: Federal Pell Grant Program, Federal Direct Student Loans, Federal Supplemental Education Opportunity Grants, Teacher Education Assistance for College and Higher Education Grants Award Number(s): P063P211391, P063P221391, P063P231391, P268K231391, P268K241391, P007A241313, P379T231391, and P379T241391 Questioned Costs: $50 Condition: Western Illinois University (University) did not have adequate procedures in place to complete accurate and timely return of Title IV funds for all students within the required time period. During our testing of borrowers that withdrew from the University, we noted 3 out of 40 (7.5%) students return of Title IV funds were not processed within the 45 day window, ranging from 4-25 days late. Additionally, we noted 1 student out of 40 (2.5%) had an incorrect calculation performed, resulting in $50 in excess Pell funds being returned to the Department of Education. The sample was not a statistically valid sample. Criteria: A school participating in Title IV aid programs must establish and maintain proper administrative and fiscal procedures and initiate returns accurately within 45 days after the determined date of withdrawal (34 CFR 668.173(b)), and accurately calculate the amount of unearned title IV assistance to be returned to the Department of Education (34 CFR 668.22(g)). Uniform Guidance (2 CFR 200.303(a)) requires non-Federal entities receiving Federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure return of Title IV funds is accurate and timely. Cause and Effect: University management indicated staffing shortages as well as regulatory and systemic changes during the 2023-2024 aid year caused this to occur. There were questioned costs of $50 due to the calculation error, resulting in a $50 overpayment to the Department of Education. Without sufficient controls in place to return Title IV funds there is a greater risk that the school does not return funds timely or accurately or that students may not receive post-withdrawal disbursements timely or accurately. (Finding Code No. 2024-002, 2023-002) Recommendation: We recommend the University implement controls to ensure that all refunds of Title IV funds are initiated within 45 days of the date of determination for the students withdrawal and additional controls to ensure proper review of the return of Title IV calculations. We also recommend these controls be monitored to ensure that all necessary refunds are completed within the required time frame and accurately. University Response: The University agrees with the finding. The University is committed to developing a comprehensive plan to ensure compliance with return of Title IV funds policies and procedures.

Federal Agency: U.S. Department of Education Assistance Listing Number: 84.063, 84.268 Program Expenditures: $38,687,691 Program Name: Federal Pell Grant Program, Federal Direct Student Loans Award Number(s): P063P211391, P063P221391, P063P231391, P268K221391, and P268K231391 Questioned Costs: None Western Illinois University (University) did not have adequate procedures in place to complete accurate and timely enrollment reporting for all students within the required time period. During our testing of Pell or Direct Loan borrowers, we noted 21 out of 40 (53%) students campus-level record and program-level record were not updated within the required time frame, ranging from 11-52 days late. For 19 out of the 21 students noted above, we also noted the enrollment effective date was incorrect (19 out of 40 students tested, 48%). The sample was not a statistically valid sample. The University is required to report enrollment reporting changes no less than every 60 days. During the year, there were underlying problems with how data was being submitted to the National Student Clearinghouse (NSC), resulting in enrollment status changes and degree confirmations not being reported timely for 21 students tested or accurately for 19 students tested. Noted, while the University had a policy in place to ensure enrollment reporting for degree confirmations and status changes were being submitted to the NSC at least every 30 days, there was a flaw in the University’s process that caused enrollment status changes and degree confirmations submitted to the NSC to not ultimately be submitted to National Student Loan Data System (NSLDS), resulting in enrollment reporting changes to be reported greater than 60 days after program enrollment effective date (for 21 students tested) and in some cases, with incorrect enrollment effective date (for 19 out of the 21 students noted above). For the Federal Pell Grant Program, 34 CFR Section 690.83(b)(2) requires an institution to submit in accordance with deadline dates established by the secretary, through publication in the Federal Register, other reports and information the secretary requires and shall comply with the procedures the secretary finds necessary to ensure that the reports are correct. For the Federal Direct Student Loans, 34 CFR Section 685.309(b) requires changes in student status to be reported to the NSLDS within 30 days of the change or included in a Student Status Confirmation Report (SSCR) sent to the NSLDS within 60 days of the status change. Uniform Guidance (2 CFR 200.303(a)) requires non-Federal entities receiving Federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure enrollment reporting is accurate and timely. University officials indicated the University did not have adequate procedures in place to ensure all required campus-level data and program-level data was being reported to NSLDS via NSC due to a flaw in their process causing degree confirmations to be overridden with other enrollment information prior to submission. The University did not have an appropriate enrollment reporting timeline to ensure student status changes were reported in the required time frame. Without sufficient controls around enrollment reporting there is a greater risk that student enrollment data will not be reported accurately or timely. Inaccurate or untimely reporting of student enrollment data can result in inconsistencies between the University’s records and the National Students Loan Data System as well as potential delays in the repayment of federal loans. (Finding Code No. 2023-001, 2022-002) RECOMMENDATION We recommend the University implement controls to ensure that all enrollment status changes and degree confirmations are being appropriately reported through NSC to NSLDS and that submissions of degree confirmations to NSC are appropriate to ensure enrollment status changes are reported at least every 60 days. We also recommend these controls be monitored to ensure that all necessary information is reported within the required time frame. UNIVERSITY RESPONSE The University agrees with the finding. Procedural changes have been identified and internal controls will be implemented moving forward to ensure that enrollment status changes and degree confirmations are being appropriately submitted and reported, and that they are done so in a timely manner.

Federal Agency: U.S. Department of Education Assistance Listing Number: 84.063, 84.268, 84.007, 84.379 Program Expenditures: $39,082,749 Program Name: Federal Pell Grant Program, Federal Direct Student Loans, Federal Supplemental Education Opportunity Grants, Teacher Education Assistance for College and Higher Education Grants Award Number(s): P063P211391, P063P221391, P063P231391, P268K221391, P268K231391, P007A231313, P379T221391, and P379T231391 Questioned Costs: None Western Illinois University (University) did not have adequate procedures in place to complete timely return of title IV funds for all students within the required time period. During our testing of borrowers that withdrew from the University, we noted 6 out of 25 (24%) students return of title IV funds were not processed within the 45 day window, ranging from 2-12 days late. The sample was not a statistically valid sample. A school participating in Title IV aid programs must establish and maintain proper administrative and fiscal procedures and initiate returns within 45 days after the determined date of withdrawal (34 CFR 668.173(b)). Uniform Guidance (2 CFR 200.303(a)) requires non-Federal entities receiving Federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure return of title IV funds is accurate and timely. University management indicated staffing shortages during the 2022-2023 aid year caused this to occur. Without sufficient controls in place to return title IV funds there is a greater risk that the school does not return funds timely or that students may not receive post-withdrawal disbursements timely. (Finding Code No. 2023-002) RECOMMENDATION We recommend the University implement controls to ensure that all refunds of title IV funds are initiated within 45 days of the date of determination for the students withdrawal. We also recommend these controls be monitored to ensure that all necessary refunds are completed within the required time frame. UNIVERSITY RESPONSE The University agrees with the finding. Additional procedures have been put in place and additional staffing efforts will be allocated to ensure timing requirements are met as it relates to Title IV funds.

Federal Agency: U.S. Department of Education Assistance Listing Number: 84.063 Program Expenditures: $12,171,226 Program Name: Federal Pell Grant Program Award Number(s): P063P211391, P063P221391, and P063P231391 Questioned Costs: None Western Illinois University (University) did not have adequate procedures in place to complete accurate and timely updating of verification statuses in the Common Origination and Disbursement (COD) database for all students within the required time period. During our testing of borrowers that had been selected for verification at the University, we noted 6 out of 25 (24%) students whose verification status was not properly reflected in the COD records. The sample was not a statistically valid sample. The University is required to update the verification status for all borrowers in the COD timely for those selected for verification. During the year, there was a misunderstanding of the waived verification requirements allowable under Dear Colleague Letter “Changes to 2022-2023 Verification Requirements” (GEN-22-06), which caused 6 out of 25 students to not have their verification status updated in the COD. A school participating in Title IV aid programs must establish and maintain proper administrative and fiscal procedures and verify an applicant’s FAFSA information and maintain up to date accurate information in COD (34 CFR 668.53(a)). Uniform Guidance (2 CFR 200.303(a)) requires non-Federal entities receiving Federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure verification status for students is updated accurately and timely. University management indicated there was a misunderstanding of the waived verification requirements which caused this error. Failure to have sufficient controls around verification requirements, resulted in the University not accurately or timely updating the verification status in the COD to report that required verifications occurred for students selected by the Department of Education for verification. (Finding Code No. 2023-003) RECOMMENDATION We recommend the University implement controls to ensure that all students verification statuses are updated accurately and timely in the COD. UNIVERSITY RESPONSE The University agrees with the finding. The University's internal controls have been updated as the Department of Education has released the COVID suspension of the verification process.

Federal Agency: U.S. Department of Education Assistance Listing Number: 84.063, 84.268 Program Expenditures: $42,889,579 Program Name: Federal Pell Grant Program, Federal Direct Student Loans Award Number(s): P063P201391, P063P211391, P063P221391, P268K201391, P268K211391, and P268K221391 Questioned Costs: None Western Illinois University (University) did not have adequate procedures in place to complete accurate and timely enrollment reporting for all students within the required time period. During our testing of Pell or Direct Loan borrowers that had a reduction or increase in attendance levels at the University, we noted 4 out of 40 (10%) students whose program-level record was not updated to reflect student?s program enrollment status. Additionally, we noted 29 out of 40 (73%) students whose campuslevel record and program-level record were not updated within the required time frame, ranging from 6-40 days late. The sample was not a statistically valid sample. The University is required to accurately report significant data elements under the program level-record that the Department of Education considers high risk, including program enrollment status. The University is also required to report enrollment reporting changes no less than every 60 days. During the year, there were underlying problems with how program-level data was being submitted to the National Student Clearinghouse (NSC), resulting in program enrollment status changes not being reported for 4 students. Noted, while the University had a policy in place to ensure enrollment reporting for degree confirmations was being submitted to the NSC at least every 30 days, there was a flaw in the University?s process that caused degree confirmations submitted to the NSC to be overridden with other student enrollment information, prior to information being reported from the NSC to National Student Loan Data System (NSLDS), resulting in enrollment reporting changes to be reported greater than 60 days after program enrollment effective date. For the Federal Pell Grant Program, 34 CFR Section 690.83(b)(2) requires an institution to submit in accordance with deadline dates established by the secretary, through publication in the Federal Register, other reports and information the secretary requires and shall comply with the procedures the secretary finds necessary to ensure that the reports are correct. For the Federal Direct Student Loans, 34 CFR Section 685.309(b) requires changes in student status to be reported to the NSLDS within 30 days of the change or included in a Student Status Confirmation Report (SSCR) sent to the NSLDS within 60 days of the status change. Uniform Guidance (2 CFR 200.303(a)) requires non-Federal entities receiving Federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure enrollment reporting is accurate and timely. University officials indicated the University did not have adequate procedures in place to ensure all required program-level data was being reported to NSLDS via NSC. The University did not have an appropriate enrollment reporting timeline to ensure student status changes were reported in the required time frame. Without sufficient controls around enrollment reporting there is a greater risk that student enrollment data will not be reported accurately or timely. Inaccurate or untimely reporting of student enrollment data can result in inconsistencies between the University?s records and the National Students Loan Data System as well as potential delays in the repayment of federal loans. (Finding Code No. 2022-002) RECOMMENDATION We recommend the University implement controls to ensure that all program level detail is being appropriately reported through NSC to NSLDS and that submissions of degree confirmations to NSC are appropriate to ensure enrollment status changes are reported at least every 60 days. We also recommend these controls be monitored to ensure that all necessary information is reported within the required time frame. UNIVERSITY RESPONSE The University agrees with the finding. The University's procedures between multiple departments lacked a collaboration on the timing of reports to NSLDS via NSC for degree confirmations. This procedural change has been identified and will be implemented moving forward. In addition, adequate procedure changes have also been identified as it relates to program-level reporting and will be implemented to ensure compliance.

2021-003 FINDING (Information Technology Risk Assessment Not Performed) "See Schedule of Findings and Questioned Costs for chart/table" Western Illinois University (University) did not document the Gramm-Leach-Bliley Act (GLBA) required risk assessments related to student information security. As a requirement under the University?s Program Participation Agreement with the Department of Education, the University must protect student financial aid information. During our testing, we noted they had not conducted a risk assessment identifying internal and external risks to the security, confidentiality, and integrity of the students? information. The Standards for Safeguarding Customer Information, required by the GLBA (16 CFR ?314.4) requires the University to: ? Identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information, and assess the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risks in each relevant area of your operations, including: (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures. ? Design and implement information safeguards to control the risks you identify through risk assessment, and regularly test or otherwise monitor the effectiveness of the safeguards' key controls, systems, and procedures. ? Evaluate and adjust your information security program in light of the results of the testing and monitoring required by paragraph (c) of this section; any material changes to your operations or business arrangements; or any other circumstances that you know or have reason to know may have a material impact on your information security program.Additionally, the Uniform Guidance (2 CFR 200.303(a)) requires nonfederal entities receiving federal awards establish and maintain effective internal controls designed to reasonably ensure compliance with Federal laws, statutes, regulations, and the terms and conditions of the Federal award. The Security and Privacy Controls for Information Systems and Organizations {Special Publication 800-53, Fifth Revision) published by the National Institute of Standards and Technology, Risk Assessment section, requires entities to conduct risk assessments to identify threats and vulnerabilities and determine the likelihood and magnitude of harm to the organization's operations and assets. According to University officials, while the University believes they have the safeguards in place to ensure the security and confidentiality of records covered under GLBA, the risk assessment had not yet been completed due to competing priorities and delays associated with the COVID-19 pandemic. Without the formal written documentation, the University is at risk of noncompliance with GLBA. In addition, there is a risk the University systems and information could be vulnerable to attacks or intrusions, and these attacks may not be detected in a timely manner. (Finding Code No. 2021-003, 2020-002)

2020-002 FINDING (Information Technology Risk Assessment Not Performed) Federal Agency: U.S Department of Education Cluster Name: Student Financial Assistance Cluster Program Expenditures: $56,961,834 "See Schedule of Findings and Questioned Costs for table" Questioned Costs: None Western Illinois University (University) did not document the Gramm-Leach-Bliley Act (GLBA) required risk assessments related to student information security. As a requirement under the University?s Program Participation Agreement with the Department of Education, the University must protect student financial aid information. During our testing, we noted they had not conducted a risk assessment identifying internal and external risks to the security, confidentiality, and integrity of the students? information. The Standards for Safeguarding Customer Information, required by the GLBA (16 CFR ?314.4) requires the University to: b) Identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information, and assess the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risks in each relevant area of your operations, including: (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures. c) Design and implement information safeguards to control the risks you identify through risk assessment, and regularly test or otherwise monitor the effectiveness of the safeguards' key controls, systems, and procedures. e) Evaluate and adjust your information security program in light of the results of the testing and monitoring required by paragraph (c) of this section; any material changes to your operations or business arrangements; or any other circumstances that you know or have reason to know may have a material impact on your information security program. Additionally, the Uniform Guidance (2 CFR 200.303(a)) requires nonfederal entities receiving federal awards establish and maintain effective internal controls designed to reasonably ensure compliance with Federal laws, statutes, regulations, and the terms and conditions of the Federal award. Furthermore, generally accepted information technology guidance endorses the implementation of a process to identify risk and ensure appropriate safeguards are in place to protect information technology systems and data. According to University officials, while the University has the safeguards in place to ensure the security and confidentiality of records covered under GLBA, the risk assessment had not yet been completed due to competing priorities and delays associated with the COVID-19 pandemic. Without the formal written documentation, the University is at risk of noncompliance with GLBA. In addition, there is a risk the University systems and information could be vulnerable to attacks or intrusions, and these attacks may not be detected in a timely manner. RECOMMENDATION We recommend the University perform and document a comprehensive risk assessment that specifically addresses the requirements of GLBA related to the security, confidentiality, and integrity of student information. (Finding Code No. 2020-002) UNIVERSITY RESPONSE The University agrees with the finding and will perform and document a comprehensive risk assessment that specifically addresses the requirements of GLBA related to the security, confidentiality, and integrity of student information.

2020-003 FINDING (Inaccurate calculation and disbursement of Higher Education Emergency Relief Fund (HEERF)) Federal Agency: U.S Department of Education CFDA Number: 84.425E Program Expenditures: $3,446,668 Program Name: COVID-19: Higher Education Emergency Relief Fund (HEERF) ? Student Aid Portion Questioned Costs: $112,818 Western Illinois University (University) disbursed the HEERF to non-eligible students and inconsistently applied the University?s approved method of determining and distribution of funds to students. During our testing of HEERF Student Aid Portion of the emergency aid grant disbursement for 60 students, a statistically valid sample, we noted the following: Two of 60 (3%) students enrolled in an online program received $2,875. The question cost was determined by obtaining the summary of students enrolled in online programs for the fiscal year 2020 spring and summer semesters. The list was matched to students awarded with HEERF grants for the same period. We noted 88 students enrolled in online program were awarded HEERF grants. The University charged $56,409 to the grant and recognized revenue for the same amount. If the amount is not recovered from the students, the University will have incurred unnecessary expenses for the same amount resulting in a total financial loss to the University of $112,818. One of 60 (2%) students with a total score of more than 1 was awarded $500 instead of the computed $2,500 based on the distribution plan. To determine the underpayment, we obtained the summary per the distribution plan for the fiscal year 2020 spring and summer semesters. This summary is the manual calculation of HEERF grants to be awarded to eligible students. We matched the calculated amount against HEERF grants disbursed to students by billing and receivable for the same period. We noted 63 students were underpaid by $56,566. The Coronavirus Aid, Relief, and Economic Security Act (CARES Act), Section 18004 (a)(1)(A) requires the University to allocate funds to recipients who are not exclusively enrolled in distance education courses prior to the coronavirus emergency. Further, the CARES Act, Section 18004 (c) requires the University to use such funds to provide emergency financial aid grants to students for expenses related to the disruption of campus operations due to coronavirus (including eligible expenses under a student?s cost of attendance, such as food, housing, course materials, technology, health care and childcare). The Emergency Aid Grant Method of Distribution based on the University?s website and reporting as of May 28, 2020 states that each student eligible to receive the emergency aid grant will be given 1 score point for the following eligibility: (a) receiving Pell Spring 2020; (b) RA or displaced student worker as identified by Housing and Student Employment; (c) Emergency Aid Application submitted by student; (d) Full-time enrollment ? graduate students should be enrolled for 9 hours or more while undergraduate students should be enrolled for 12 hours or more. Students with a total score of more than 1 will receive the total of Pell increase, RA award and/or amount requested on the emergency aid application not to exceed $2,500 whichever is lower. Student with total score equal to 1 will receive no more than the amount requested on emergency aid application or $500 whichever is less. Students with a score of 0 will not receive an emergency grant. For the Summer 2020 term, the amount distributed will not exceed the eligible amount of $500 for those enrolled for more than 6 hours; and $250 for those enrolled for less than 6 hours. According to University officials, the HEERF student aid was made available as a result of a national emergency with the stipulation that the funds be made available to students immediately. University officials stated the exceptions were due to human error as a result of implementing the program in a short amount of time in order to get the funds disbursed to students as quickly as possible. Improper disbursement of HEERF to students who were not eligible and inaccurate calculation of award resulted in noncompliance with the federal regulations, the University?s Emergency Aid Grant Method of Distribution Policy and questioned cost amounting to $112,818. (Finding Code No. 2020-003) RECOMMENDATION We recommend the University implement controls to ensure proper determination of eligibility and accuracy in the distribution of HEERF student aid. UNIVERSITY RESPONSE The University agrees with the finding. The Financial Aid office will review and modify its controls related to HEERF to ensure accuracy in awarding HEERF student aid.

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION