SOUTHERN ILLINOIS UNIVERSITY

2022-002. Finding: Inadequate Procedures for Ensuring Compliance with Earmarking Requirements for the Student Support Services Program Federal Agency: U.S. Department of Education Assistance Listing Number: 84.042 Program Expenditures: $1,011,855 Program Name: TRIO ? Student Support Services Award Number(s): P042A201635 Questioned Costs: None The Southern Illinois University (University) Carbondale campus did not have adequate procedures in place to ensure the earmarking requirements for the Student Support Services program were met during the fiscal year. During our testing of earmarking requirements for TRIO Student Support Services at the University, we noted the program at the Carbondale campus served 160 students, of which 95 (59%) students met the criteria for being either low-income individuals who are first-generation college students or individuals with disabilities. The University has not implemented sufficient processes and controls over the past several years to ensure compliance with TRIO earmarking requirements. The Student Support Services Program requires that, in addition to the eligibility criteria for individual students, not less than two-thirds of the program participants will be either low-income individuals who are first-generation college students or individuals with disabilities (34 CFR Section 646.11(a)(1)). Uniform Guidance (2 CFR 200.303(a)) requires nonfederal entities receiving federal awards establish and maintain effective internal control to reasonably ensure compliance with Federal laws, statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure that all earmarking requirements are reviewed and monitored to ensure compliance. The Fiscal Control and Internal Auditing Act (30 ILCS 10/3001) requires the establishment and maintenance of a system, or systems, of internal fiscal and administrative controls to safeguard funds against waste, loss, unauthorized use, and misappropriation. University officials stated the failure to meet the two-thirds requirement was due to a decreasing pool of students who qualify as first-generation and low income. In addition, officials stated the student recruiting plan was insufficient to ensure that the earmarking requirement was met. Management indicated in the current year, both of these conditions were still present and contributed to the University not meeting the earmarking requirement. Without effective controls to review the participants and ensure compliance for TRIO Student Support Services, the University is at a greater risk of not meeting the minimum earmarking requirements, as well as increased likelihood of program reviews from oversight agencies. In addition, the University is at risk of being required to return funds to the Department of Education and/or becoming ineligible to administer the program. (Finding Code No. 2022-002, 2021-002, 2020-003, 2019-001, 2018-002) RECOMMENDATION We recommend the University establish processes and procedures, including plans for increasing participation in the program by targeted populations, to ensure it will meet the earmarking program requirements. We also recommend the University implement controls to identify likely disparities in expected and actual results throughout the year and take proactive corrective action as necessary. UNIVERSITY RESPONSE We agree and have implemented corrective actions. Ongoing changes at the university continue to impact the potential for enrollment growth of minority students, which directly impacts the success of the program. Realignment of support services has structured Trio programs in an area with other similar programs that serve students that meet the criteria of the program. This realignment of services is already producing positive results, and the Trio program currently meets earmarking requirements. The requirements will be documented in the upcoming Annual Performance Report once submitted to the US Department of Education for AY 2022-2023 (May 2023). We hope to sustain this progress as enrollment at the university continues to trend upward.

2022-002. Finding: Inadequate Procedures for Ensuring Compliance with Earmarking Requirements for the Student Support Services Program - Carbondale Campus Response: We agree and have implemented corrective actions. Ongoing changes at the university continue to impact the potential for enrollment growth of minority students, which directly impacts the success of the program. Corrective Action Plan: Realignment of support services has structured Trio programs in an area with other similar programs that serve students that meet the criteria of the program. This realignment of services is already producing positive results. We believe this upward trend will continue for the university and program. To ensure earmarking requirements are met, applications are monitored daily. Other actions that have been taken include: ? The project director has been appointed to committees that directly impact the recruitment, selection, and retention of this population of students. ? The director also participates in recruitment activities that focuses on increasing underrepresented minority populations. ? Under the newly structured unit, a retention team has been established to improve support services and mitigate challenges to enrollment and retention of the population of students. The current status of program is mentioned in tabular form in corrective action plan. The Trio currently meets earing marking requirements. The requirements will be documented in the upcoming Annual Performance Report once submitted to the US Department of Education for AY 2022-2023 (May 2023). We hope to sustain this progress as enrollment at the university continues to trend upward. Contact Person: Renada Greer (SIUC Assistant Dean & Director TRIO) Anticipated completion date: May 2, 2023

2021-002

2022-003. Finding: Sliding Fee Discount Not Applied to All Eligible Patients Federal Agency: U.S. Department of Health and Human Services Assistance Listing Number: 93.224, 93.527 Program Expenditures: $5,085,751 Program Name: Health Center Program Cluster Award Number(s): H8FCS41336, H80CS24098 Questioned Costs: None The Southern Illinois University (University) Springfield campus did not properly apply the sliding fee discount to all eligible patients. During our testing of patients treated during the year under audit, we noted 3 of 26 (12%) patients treated did not have the sliding fee discount applied to their charges. The sample was not a statistically valid sample. The 3 patients? charges were partially paid for by Medicare, however, the sliding fee discount should have been applied to the remaining Medicare coinsurance. Federal guidelines require health centers to prepare and apply a sliding fee discount schedule so amounts owed for health center services by eligible patients are adjusted (discounted) based on the patient?s ability to pay (42 CFR 51c.303(f)). The Fiscal Control and Internal Auditing Act (30 ILCS 10/3001) requires the establishment and maintenance of a system, or systems, of internal fiscal and administrative controls to safeguard funds against waste, loss, unauthorized use, and misappropriation. University management stated it was unable to provide patients with the sliding fee discount subsequent to a Medicare claim posting due to a turnover in key Patient Billing Services (PBS) staff members and a failure to educate new staff members on Federally qualified health center (FQHC) billing policies, which differ from SIU-Medicine billing policies. Without effective controls to provide all eligible patients with the sliding fee discount, there is a risk a patient may be charged incorrectly for health center services provided. (Finding Code No. 2022-003) RECOMMENDATION We recommend the University establish processes and procedures to ensure sliding fee discounts are applied for all eligible patients. UNIVERSITY RESPONSE We agree. We did not provide the sliding fee discount to eligible patients after a Medicare claim posting. Now that we are aware of the weakness, we are committed and have developed a corrective action plan to address the matter.

2022-003. Finding: Sliding Fee Discount Not Applied to All Eligible Patients ? School of Medicine Response: We agree. We did not provide the sliding fee discount to eligible patients after a Medicare claim posting. Now that we are aware of the weakness, we are committed and have developed a corrective action plan to address the matter. Corrective Action Plan: The following corrective actions are in process: ? In conjunction with SIU Patient Business Services (PBS): Review and revise/update all billing policies/procedures that relate to the Sliding Fee Discount Program (SFDP). o Status: Currently in process of review o Anticipated completion date: 2-3 months (April-May 2023) ? Educate staff on updated SFDP; including all applicable PBS staff members, all FQHC financial counselors, and any FQHC administration staff. Re-education will be performed semi-annually to all staff mentioned above o Status: Pending o Anticipated completion date: 3-6 months (June-Sept 2023) ? Develop and implement a self-audit procedure to be performed internally on a quarterly basis o Status: Pending o Anticipated completion date: 6-9 months (By end of year 2023) Contact Person: Agnes Arnold (Asst Professor of Family and Community Medicine) Anticipated completion date: As noted above.

2022-005. Finding: Inadequate Procedures for Ensuring Retention of Eligibility Documentation for the Upward Bound Program Federal Agency: U.S. Department of Education Assistance Listing Number: 84.047M Program Expenditures: $1,990,376 Program Name: TRIO ? Upward Bound Award Number(s): P047M170568 - 21 Questioned Costs: None The Southern Illinois University (University) Edwardsville campus did not have adequate procedures in place to ensure the required documentation was retained for all students who received stipends during the audit period. During our testing of students who received stipends during the year under audit, we noted for 6 of 40 students (15%) students who received stipends totaling $1,405, the University did not maintain appropriate records to determine the students were eligible for the stipend received. The sample was not a statistically valid sample. Additionally, we noted for 5 of 40 students (12.5%) who participated in Upward Bound, the University did not maintain appropriate records to determine the students were eligible to participate in the Upward Bound program. The 5 students for which documentation was not maintained for eligibility to participate in Upward Bound are also included in the 6 students for which documentation was not maintained for eligibility to receive stipends. According to federal regulations (34 CFR 645.42), an Upward Bound project may provide stipends for full-time participants who show evidence of satisfactory participation in activities of the project. Uniform Guidance (2 CFR 200.303(a)) requires nonfederal entities receiving federal awards establish and maintain effective internal control to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include the retention of documentation supporting participant eligibility. The Fiscal Control and Internal Auditing Act (30 ILCS 10/3001) requires the establishment and maintenance of a system, or systems, of internal fiscal and administrative controls to safeguard funds against waste, loss, unauthorized use, and misappropriation. The State Records Act (5 ILCS 160/8) requires records to be made and preserved containing adequate and proper documentation of decisions of the agency designed to furnish information to protect the legal and financial rights of the State and of persons directly affected by the agency's activities. According to University officials, the missing documentation relates to a grant that is no longer funded and those responsible for retaining the documentation are no longer with the University. Without adequate documentation to support eligibility, there is a risk a student may improperly receive stipends or improperly be allowed to participate in the program. The University is also at risk of reduced funding in future years, as well as increased likelihood of program reviews from oversight agencies. (Finding Code No. 2022-005) RECOMMENDATION We recommend the University establish processes and procedures to ensure documentation is retained and retrievable when the parties responsible for the documentation leave the University. UNIVERSITY RESPONSE We agree we did not have adequate procedures to ensure the required documents were retained for all students who received stipends during the period tested. We will implement adequate controls to ensure document retention, including in instances where responsible staff have departed the University.

2022-005. Finding: Inadequate Procedures for Ensuring Retention of Eligibility Documentation for the Upward Bound Program ? Edwardsville Campus Response: We agree we did not have adequate procedures to ensure the required documents were retained for all students who received stipends during the period tested. Corrective Action Plan: We will implement adequate controls to ensure document retention, including in instances where responsible staff have departed the University. Contact Person: Timothy Staples (Director of University Services to East St Louis) Anticipated completion date: June 30, 2023

2022-006. Finding: Inaccurate Reporting of Student Verification Status Federal Agency: U.S. Department of Education Assistance Listing Number: 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.342 Program Expenditures: $91,856,705 Program Name: Student Financial Assistance Cluster Award Number(s): P007A211285, P033A211285, P063P200115, P063P210115, P268K220115, P379T220115, N/A Questioned Costs: None The Southern Illinois University (University) Carbondale campus incorrectly reported the verification status for a student to the Department of Education through the Common Origination and Disbursement (COD) website. During our testing of students during the year under audit, we noted 1 of 40 students (2.5%) selected for verification was not correctly reported to the COD website. The sample was not a statistically valid sample. The student qualified for a verification waiver, which the University utilized. The student was reported with verification code ?V? indicating verification had been completed, although, the student should have been reported with verification code ?S? meaning ?Selected not verified?. The U.S. Department of Education published Dear Colleague Letter GEN-21-05 on July 13, 2021. According to the letter, institutions were not required to verify students selected under Verification Tracking Flag ?V1? as of the date of the letter. The letter instructed institutions to use Verification Status Code ?S-Selected not verified? for students selected under V1 who qualified for a verification waiver under the guidance within the letter. The Fiscal Control and Internal Auditing Act (30 ILCS 10/3001) requires the establishment and maintenance of a system, or systems, of internal fiscal and administrative controls to safeguard funds against waste, loss, unauthorized use, and misappropriation. Management indicated the University did not have adequate review procedures in place to ensure all students were accurately reported. Without adequate controls over verification, the University may give false assurance over verification and has an increased likelihood of program review from oversight agencies. (Finding Code No. 2022-006) RECOMMENDATION We recommend the University establish processes and procedures to ensure student verification status is reported accurately to the Department of Education through the COD website. UNIVERSITY RESPONSE We agree and have implemented corrective actions. We did not correctly report the verification status for a student through the Common Origination and Disbursement website. We have implemented review procedures to ensure all students are reported accurately.

2022-006. Finding: Inaccurate Reporting of Student Verification Status ? Carbondale Campus Response: We agree we did not correctly report the verification status for a student through the Common Origination and Disbursement website. Corrective Action Plan: We have implemented review procedures to ensure all students are reported accurately. Contact Person: Jason Ramsey (Student Financial Aid, Chief Accountant) Anticipated completion date: January 1, 2023

2022-007. Finding: Exit Counseling Not Completed Federal Agency: U.S. Department of Education Assistance Listing Number: 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.342 Program Expenditures: $83,176,764 Program Name: Student Financial Assistance Cluster Award Number(s): P033A191286, PO33A151286, P033A141286, P063P170116, P063P180116, P007A151286, P379T180116, P379T190116, N/A Questioned Costs: None The Southern Illinois University (University) Edwardsville campus did not complete exit counseling for all necessary students within the required time period. During our testing of students who received title IV aid at the University, we noted 2 out of 25 (8%) students who received Direct Loans, did not complete exit counseling timely after leaving the Edwardsville campus. The sample was not a statistically valid sample. The University has not implemented sufficient processes and controls over the past several years to ensure compliance with exit counseling requirements. The Edwardsville campus requires students to complete exit counseling when they leave the University after previously attending. During the year, two students attended the University, received direct loans, and withdrew during the semesters they attended, but had not completed exit counseling within 30 days of the withdraw date from the University. The exit interviews were never conducted. According to 34 CFR 685.304(b), a school must ensure that exit counseling is conducted with each Direct Subsidized Loan or Direct Unsubsidized Loan borrower and graduate or professional student Direct PLUS Loan borrower shortly before the student borrower ceases at least half-time study at the school. According to 34 CFR 682.604(a)(1), if a student borrower withdraws from school without the school's prior knowledge or fails to complete an exit counseling session as required, the school must, within 30 days after learning that the student borrower has withdrawn from school or failed to complete the exit counseling as required, ensure that exit counseling is provided through interactive electronic means, by mailing written counseling materials to the student borrower at the student borrower's last known address, or by sending written counseling materials to an email address provided by the student borrower that is not an email address associated with the school sending the counseling materials. Uniform Guidance (2 CFR 200.303(a)) requires non-Federal entities receiving Federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure student exit counseling is completed appropriately. The Fiscal Control and Internal Auditing Act (30 ILCS 10/3001) requires the establishment and maintenance of a system, or systems, of internal fiscal and administrative controls to safeguard funds against waste, loss, unauthorized use, and misappropriation. According to University officials, the students were improperly coded with an enrollment status of ?Eligible to Register?. Banner initiates exit counseling for students with enrollment codes that have a withdrawal indicator and Eligible to Register does not have that indicator. Exit counseling helps federal student loan borrowers understand how to repay their loans and reviews deferment and repayment plan options. Exit counseling also discusses borrower rights and responsibilities. Updated student contact information will also be collected at the end of the exit counseling session. Failure to complete exit counseling may increase the likelihood of default on student loans and lack of student understanding of loan repayment options, rights and responsibilities. (Finding Code No. 2022-007, 2021-003, 2020-004, 2019-002, 2018-005, 2017- 004) RECOMMENDATION We recommend the University implement controls to identify all required exit counseling within the student financial aid department in addition to improving controls to identify exit counseling requirements within the information technology department. These controls should be monitored to ensure that all necessary students complete exit counseling within the required time frame. UNIVERSITY RESPONSE We agree and have implemented corrective actions. SIUE Student Financial Aid has reintroduced a Banner process which runs simultaneously with the current bi-monthly process, to notify students of exit counseling requirements as soon as possible. We will continue to work with the appropriate office for assistance on how to ensure the appropriate flag gets checked to ensure the proper results.

2022-007 Finding: Exit Counseling Not Completed ? Edwardsville Campus Response: We agree. SIUE Student Financial Aid has reintroduced a Banner process which runs simultaneously with the current bi-monthly process, in order to notify students of exit counseling requirements at the earliest possible time. Corrective Action Plan: Implemented. Specifically, we are running exit counseling reports more frequently and comparing exit requirements from Banner process to in-house process to create a job that runs exit counseling through production control. We will continue to work with the appropriate office for assistance on how to ensure the appropriate flag gets checked to ensure the proper results. Contact Person: Jeremy Baker (SIUE Student Financial Aid Associate Director) Anticipated completion date: October 31, 2022

2021-003

2021-002. Finding: Inadequate Procedures for Ensuring Compliance with Earmarking Requirements for the Student Support Services Program Federal Agency: U.S. Department of Education CFDA Number: 84.042 Program Expenditures: $777,532 Program Name: TRIO ? Student Support Services Award Number(s): P042A201635 and P9042A151636 Questioned Costs: None The Southern Illinois University (University) Carbondale campus did not have adequate procedures in place to ensure the earmarking requirements for the Student Support Services program were met during the fiscal year. During our testing of earmarking requirements for TRIO Student Support Services at the University, we noted the program at the Carbondale campus served 160 students, of which 100 (63%) students met the criteria for being either low-income individuals who are first-generation college students or individuals with disabilities. The University has not implemented sufficient processes and controls over the past several years to ensure compliance with TRIO earmarking requirements. The Student Support Services Program requires that, in addition to the eligibility criteria for individual students, not less than two-thirds of the program participants will be either low-income individuals who are first-generation college students or individuals with disabilities (34 CFR Section 646.11(a)(1)). Uniform Guidance (2 CFR 200.303(a)) requires nonfederal entities receiving federal awards establish and maintain effective internal control to reasonably ensure compliance with Federal laws, statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure that all earmarking requirements are reviewed and monitored to ensure compliance. The Fiscal Control and Internal Auditing Act (30 ILCS 10/3001) requires the establishment and maintenance of a system of internal fiscal and administrative controls to safeguard funds against waste, loss, unauthorized use, and misappropriation. University officials stated the failure to meet the two-thirds requirement was due to a decreasing pool of students who qualify as first-generation and low income and an insufficient recruiting plan to ensure the earmarking requirement was met. Without effective controls to review the participants and ensure compliance for TRIO Student Support Services, the University is at a greater risk of not meeting the minimum earmarking requirements, as well as increased likelihood of program reviews from oversight agencies. In addition, the University is at risk of being required to return funds to the Department of Education and/or becoming ineligible to administer the program. (Finding Code No. 2021-002, 2020-003, 2019-001, 2018-002) RECOMMENDATION We recommend the University establish processes and procedures, including plans for increasing participation in the program by targeted populations, to ensure it will meet the earmarking program requirements. The University should also implement controls to identify likely disparities in expected and actual results throughout the year and take proactive corrective action as necessary. UNIVERSITY RESPONSE We agree. Ongoing changes at the University continue to impact the potential for enrollment growth of minority students which directly impacts the success of the program. Realignment of support services has structured Trio programs in an area with other similar programs that serve students that meet the criteria of the program. This reorganization directly locates Student Support Services in a pipeline of programs to serve students that meet the two-thirds requirement. The new alignment was designed to address the program eligibility requirements and programmatic needs. Additionally, the reorganization places Student Support Services in an area of high recruitment activity. This positioning maximizes the opportunity to connect with students upon arrival to the university.

2020-002. Finding: Inadequate Procedures for Ensuring Compliance with Earmarking Requirements for the Student Support Services Program - Carbondale Campus Response: We agree. Ongoing changes at the university continue to impact the potential for enrollment growth of minority students which directly impacts the success of the program. Corrective Action Plan: Realignment of support services has structured Trio programs in an area with other similar programs that serve students that meet the criteria of the program. This reorganization directly locates Student Support Services in a pipeline of programs to serve students that meet the two-thirds requirement. The new alignment was designed to address the program eligibility requirements and programmatic needs. Additionally, the reorganization places Student Support Services in an area of high recruitment activity. This positioning maximizes the opportunity to connect with students upon arrival to the university. Contact Person: Renada Greer (SIUC Assistant Dean & Director TRIO) Anticipated completion date: June 30, 2023

2020-003

2021-003. Finding: Exit Counseling Not Completed Federal Agency: U.S. Department of Education CFDA Number: 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.342 Program Expenditures: $87,910,261 Program Name: Student Financial Assistance Cluster Award Number(s): P033A151286, P063P170116, P063P180116, P007A151286, P379T180116, P379T190116, P033A191286, P033A141286, P033A151286, N/A Questioned Costs: None The Southern Illinois University (University) Edwardsville campus did not complete exit counseling for all necessary students within the required time period. During our testing of students who received title IV aid at the University, we noted 2 out of 25 (8%) students who received Direct Loans did not complete exit counseling timely after leaving the Edwardsville campus. The sample was not a statistically valid sample. The University has not implemented sufficient processes and controls over the past several years to ensure compliance with exit counseling requirements. The Edwardsville campus requires students to complete exit counseling when they leave the University after previously attending. During the year, two students attended the University, received direct loans, and officially withdrew during the semesters they attended, but had not completed exit counseling within 30 days of the withdraw date from the University. The exit interviews were conducted between 4 and 5 days late. According to 34 CFR 685.304(b), a school must ensure that exit counseling is conducted with each Direct Subsidized Loan or Direct Unsubsidized Loan borrower and graduate or professional student Direct PLUS Loan borrower shortly before the student borrower ceases at least half-time study at the school. According to 34 CFR 682.604(a)(1), if a student borrower withdraws from school without the school's prior knowledge or fails to complete an exit counseling session as required, the school must, within 30 days after learning that the student borrower has withdrawn from school or failed to complete the exit counseling as required, ensure that exit counseling is provided through interactive electronic means, by mailing written counseling materials to the student borrower at the student borrower's last known address, or by sending written counseling materials to an email address provided by the student borrower that is not an email address associated with the school sending the counseling materials. Uniform Guidance (2 CFR 200.303(a)) requires non-Federal entities receiving Federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure student exit counseling is completed appropriately. The Fiscal Control and Internal Auditing Act (30 ILCS 10/3001) requires the establishment and maintenance of a system of internal fiscal and administrative controls to safeguard funds against waste, loss, unauthorized use, and misappropriation. University officials stated semi-monthly reports to identify withdrawals were not always prepared and review timely. The lack of consistent and timely review of the withdrawal reports for federal direct loans led exit counseling to be completed later than required. Exit counseling helps federal student loan borrowers understand how to repay their loans and reviews deferment and repayment plan options. During exit counseling, borrower rights and responsibilities are discussed and updated student contact information is collected at the end of the exit counseling session. Failure to complete exit counseling timely can result in students not understanding loan repayment options, rights, and responsibilities, which can lead to a greater potential for loan default. (Finding Code No. 2021-003, 2020-003, 2019-002, 2018-005, 2017-004) RECOMMENDATION We recommend the University enforce and monitor controls to ensure all necessary students complete exit counseling within the required time frame. UNIVERSITY RESPONSE We agree. SIUE Student Financial Aid has implemented processes to run exit counseling reports nightly, in order to notify students of exit counseling requirements at the earliest possible time.

2020-003. Finding: Exit Counseling Not Completed ? Edwardsville Campus Response: We agree. SIUE Student Financial Aid has implemented processes to run exit counseling reports nightly, in order to notify students of exit counseling requirements at the earliest possible time. Corrective Action Plan: Specifically, we are running exit counseling reports more frequently and comparing exit requirements from Banner process to in-house process to create a job that runs exit counseling nightly through production control. Contact Person: Jeremy Baker (SIUE Student Financial Aid Associate Director) Anticipated completion date: July 31, 2022

2020-004

2021-004. Finding: Information Technology Risk Assessment Not Performed Federal Agency: U.S. Department of Education CFDA Number: 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.342 Program Expenditures: $87,910,261 Program Name: Student Financial Assistance Cluster Award Number(s): P033A151286, P063P170116, P063P180116, P007A151286, P379T180116, P379T190116, P033A191286, P033A141286, P033A151286, N/A Questioned Costs: None The Southern Illinois University (University) Edwardsville campus did not document required risk assessments related to student information security. As a requirement under the University?s Program Participation Agreement with the Department of Education, the University must protect student financial aid information. However, during our testing, we noted they had not conducted a risk assessment identifying internal and external risks to the security, confidentiality, and integrity of the students? information. The University has not implemented sufficient processes and controls over the past several years to ensure compliance with the Gramm-Leach-Bliley Act (GLBA). The Standards for Safeguarding Customer Information, required by the GLBA (16 CFR ?314.4 (b)), requires customers to identify reasonable foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information, and assess the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risk in each relevant area of operations, including: (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other system failures. Additionally, the Uniform Guidance (2 CFR 200.303(a)) requires nonfederal entities receiving federal awards establish and maintain effective internal control designed to reasonably ensure compliance with Federal laws, statutes, regulations, and the terms and conditions of the Federal award. The Fiscal Control and Internal Auditing Act (30 ILCS 10/3001) requires the establishment and maintenance of a system of internal fiscal and administrative controls to safeguard funds against waste, loss, unauthorized use, and misappropriation. The Security and Privacy Controls for Information Systems and Organizations (Special Publication 800-53, Fifth Revision) published by the National Institute of Standards and Technology, Risk Assessment section, requires entities to conduct risk assessments to identify threats and vulnerability and determine the likelihood and magnitude of harm to the organization?s operations and assets. University management stated that the University did not document a GLBA-focused risk assessment due to ongoing disruption from the COVID-19 pandemic, which strained Information Technology Services? resources during Fiscal Year 2021. Without documentation of a risk assessment, the University is at risk of noncompliance with the GLBA. In addition, there is a risk that University systems and information could be vulnerable to attacks or intrusions, and these attacks may not be detected in a timely manner. (Finding Code No. 2021-004, 2020-005, 2019-004) RECOMMENDATION We recommend the University perform and document a comprehensive risk assessment identifying internal and external risks to the security, confidentiality, and integrity of the students? information. In addition, the University should ensure proper safeguards are in place to ensure the security of student information. UNIVERSITY RESPONSE Implemented. In September 2021, at the request of the Office of the U.S. Department of Education, SIUE provided satisfactory response and attestation that the required risk assessment had been performed. The Federal Student Aid (FSA) Cybersecurity Compliance Team reviewed the information provided and determined it was sufficient to close the prior year finding.

2020-004. Finding: Information Technology Risk Assessment Not Performed ? Edwardsville Campus Response: Agree. Implemented. Corrective Action Plan: In September 2021, at the request of the Office of the U.S. Department of Education, SIUE provided satisfactory response and attestation that the required risk assessment had been performed. The Federal Student Aid (FSA) Cybersecurity Compliance Team reviewed the information provided and determined it was sufficient to close the prior year finding. Contact Person: Mesha Garner (SIUE Director Student Financial Aid) and Jeff Laughlin (SIUE Chief Information Security Officer) Anticipated Completion date: September 2021

2020-005

2021-005. Finding: Return of Title IV Aid Federal Agency: U.S. Department of Education CFDA Number: 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.342 Program Expenditures: $87,910,261 Program Name: Student Financial Assistance Cluster Award Number(s): P033A151286, P063P170116, P063P180116, P007A151286, P379T180116, P379T190116, P033A191286, P033A141286, P033A151286, N/A Questioned Costs: None Southern Illinois University (University) Edwardsville campus did not complete the return of Title IV aid within the required timeframe for one student. During our testing of the University?s return of Title IV calculations, we noted 1 out of 40 (2.5%) students tested had Title IV aid that was returned to the Department of Education 48 days after the date of withdrawal of the student. The student was an unofficial withdrawal for the semester tested. The sample was not a statistically valid sample. When a recipient of Title IV grant or loan funds withdraws, the amount of Title IV grant or loan assistance earned by the student must be determined (34 CFR 668.22(a)). Any unearned Title IV funds must be returned to the applicable Title IV program within 45 days of the date the school determined the student withdrew (34 CFR 668.22(j)). The withdrawal date is the date that the student began the withdrawal process, provided official notification to the school in writing or orally, or ceases attendance (34 CFR 668.22(c)). Uniform Guidance (2 CFR 200.303(a)) requires nonfederal entities receiving federal awards establish and maintain effective internal control to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure return of Title IV aid is completed within the required timeframe. The Fiscal Control and Internal Auditing Act (30 ILCS 10/3001) requires the establishment and maintenance of a system of internal fiscal and administrative controls to safeguard funds against waste, loss, unauthorized use, and misappropriation. University management stated the failure to return Title IV aid timely was due to lack of oversight when reviewing the listing of withdrawals for the fall semester. Without effective controls to ensure timely return of Title IV aid to the Department of Education for student withdrawals, there is increased likelihood of program reviews by the Department of Education. Continued noncompliance may result in the potential loss of Title IV aid eligibility. (Finding Code No. 2021-005, 2020-007) RECOMMENDATION We recommend the University establish processes and procedures to ensure student withdrawals are communicated timely to the appropriate departments to ensure the return of Title IV calculations are completed within required timeframes. UNIVERSITY RESPONSE We agree controls should be strengthened to ensure student withdrawals are communicated timely to the appropriate departments so that Return of Title IV calculations are completed within the required timeframes. As such, processes have been implemented to require the necessary reports be run and reviewed on a weekly basis allowing for weekly identification of students for return calculations. Additionally, post reviews are conducted weekly to ensure these processes are carried out as planned.

2020-005. Finding: Return of Title IV Aid ? Edwardsville Campus Response: We agree controls should be strengthened to ensure student withdrawals are communicated timely to the appropriate departments so that Return of Title IV calculations are completed within the required timeframes. Corrective Action Plan: As such, processes have been implemented to require the necessary reports be run and reviewed on a weekly basis allowing for weekly identification of students for return calculations. Specifically, the reports included in this weekly review are: Official Report, Unofficial Report, Module Report, F and Unearned Grades Report, Any Grade With At Least One Unearned Report. Every Monday, all reports are reviewed and students in need of return of Title IV calculations are identified. Return calculations are completed throughout the week. Each Friday, R2T4 Specialists in charge of this process meet to ensure all students from the current week have been completed. Additionally, on a monthly basis, R2T4 specialists meet to review any new guidance passed by the Department of Education. Contact Person: Molly Hagnauer (SIUE Financial Aid Coordinator) and Kirsten McDermott (SIUE Financial Aid Manager) Completion date: June 2022

2020-007

2020-003. Finding: Inadequate Procedures for Ensuring Compliance with Earmarking Requirements for the Student Support Services Program Federal Agency: U.S. Department of Education CFDA Number: 84.042 Program Expenditures: $273,538 Program Name: TRIO ? Student Support Services Award Number(s): P042A151636 Questioned Costs: None The Southern Illinois University (University) Carbondale campus did not have adequate procedures in place to ensure the earmarking requirements for the Student Support Services program were met during the fiscal year. During our testing of earmarking requirements for TRIO Student Support Services at the University, we noted the program at the Carbondale campus served 160 students, of which only 95 (59%) students met the criteria for being either low-income individuals who are first-generation college students or individuals with disabilities. The University had not implemented sufficient processes and controls to ensure compliance with TRIO earmarking requirements. The Student Support Services Program requires that, in addition to the eligibility criteria for individual students, not less than two-thirds of the program participants will be either low-income individuals who are first-generation college students or individuals with disabilities (34 CFR Section 646.11(a)(1)). Uniform Guidance (2 CFR 200.303(a)) requires nonfederal entities receiving federal awards establish and maintain effective internal control to reasonably ensure compliance with Federal laws, statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure that all earmarking requirements are reviewed and monitored to ensure compliance. University management stated the failure to meet the two-thirds requirement was due to declining student enrollment at the University, which affects the overall application pool of students who qualify. Additionally, the program did not adequately monitor the proportion of students who qualify as both first-generation and low income to ensure the two-thirds requirement was met. Without effective controls to review the participants and ensure compliance for TRIO Student Support Services, the University is at a greater risk of not meeting the minimum earmarking requirements, as well as increased likelihood of program reviews from oversight agencies. In addition, the University is at risk of being required to return funds to the Department of Education and/or becoming ineligible to administer the program. (Finding Code No. 2020-003, 2019-001, 2018-002) RECOMMENDATION We recommend the University establish processes and procedures, including plans for increasing participation in the program by targeted populations, to ensure it will meet the earmarking program requirements. The University should also implement controls to identify likely disparities in expected and actual results throughout the year and take proactive corrective action as necessary. UNIVERSITY RESPONSE Agree. The TRIO Student Support Services Project at Southern Illinois University (SIUC) was on target to meet all program goals pre-pandemic (COVID-19), including the two-thirds earmark requirement. The University closed the SIUC campus the week of March 13, 2020 and moved all courses online. At this time, 63.76% of students enrolled in the program met the earmark requirement (first-generation and low-income), and the Project was just 2.19% points from reaching the goal 66.67%. The Project would have met all goals had it not been for this unforeseeable event of the pandemic. The Project and SIUC have complied with all planned interventions and continue to make significant progress to correct this finding. The Project Director is confident that earmark requirements can be met with the University fully functioning for the fall 2021 semester, employing the pre-pandemic strategies that had been identified and implemented prior the shutdown.

2020-003. Finding: Inadequate Procedures for Ensuring Compliance with Earmarking Requirements for the Student Support Services Program - Carbondale Campus Response: Agree. The Trio Student Support Services Project at Southern Illinois University (SIUC) was on target to meet all program goals pre-pandemic (covid-19), including the two-thirds earmark requirement. The university closed the SIUC campus the week of March 13, 2020 and moved all courses online. At this time, 63.76% of students enrolled in the program met the earmark requirement (first-generation and low-income), and the Project was just 2.19% points from reaching the goal 66.67%. Proof of this action was submitted to the auditors via database dashboard indicators. The Project would have met all goals had it not been for this unforeseeable event of the pandemic. The Project and Institution has complied with all planned interventions and continues to make significant progress to correct this finding. The pandemic is an unprecedented and uncontrollable event and its occurrence exacerbated an already tenuous situation. Corrective Action Plan: On Thursday, June 10, 2021, the Governor announced the Restore Illinois Plan had moved to Phase 5 which lifted restrictions for the number of people gathering in individual spaces. With this action, normal university operations will resume, and students will return to campus. Recruiting activities and events will also recommence. As a result, the program can implement the proposed plan submitted prior to the pandemic. The Project Director is confident that earmark requirements can be met with the institution fully functioning for the fall 2021 semester. The plan proposed prior to the pandemic consists of the following strategies: 1. Southern Illinois University-Carbondale has made changes to admission criteria?s including no longer requiring High School students to submit ACT or SAT tests for admission. Standardized tests, such as the ACT and SAT can be a barrier to admission for certain student groups due to demographic factors. Traditionally, standardized test scores have negatively impacted admission for underrepresented minorities and/or students of color which represent a large population of students that are eligible for Trio Programs. 2. The Trio Director collaborates with other campus programs that serve similar populations which include Exploratory Student Advisement, Disability Support Services, Achieve and Extended Campus to connect with students that would meet eligibility requirements for the program. This collaboration can provide direct access to a larger group of students. 3. The software purchased by the university has dashboards that track earmarking requirements in real-time. Thereby, providing the ability to determine increased and decreased enrollment numbers daily. Contact Person: Renada Greer (SIUC Assistant Dean & Director TRIO) Anticipated completion date: May 15, 2022

2019-001

2020-004. Finding: Exit Counseling Not Completed Federal Agency: U.S. Department of Education CFDA Number: 84.007, 84.038, 84.063, 84.268, 84.379, 93.342, 93.364 Program Expenditures: $202,334,276 Program Name: Student Financial Assistance Cluster Award Number(s): P033A141286, P033A151286, P033A191286, P063P170116, P063P180116, P007A151286, P379T180116, P379T190116, N/A Questioned Costs: None The Southern Illinois University (University) Edwardsville campus did not complete exit counseling for all necessary students within the required time period. During our testing of students who received title IV aid at the University, we noted 3 out of 25 (12%) students who received Direct Loans did not complete exit counseling timely after leaving the Edwardsville campus. The sample was not a statistically valid sample. The University had not implemented sufficient processes and controls over the past few years to ensure compliance with exit counseling requirements. The Edwardsville campus requires students to complete exit counseling when they leave the University after previously attending. During the year, two students attended the University, received direct loans, and officially withdrew during the semesters they attended, but had not received exit counseling within 30 days of the withdraw date from the University. The exit interviews were conducted between 8 ? 25 days late. Further, during the year, one student attended the University, received direct loans, and unofficially withdrew during the semester the student attended, but had not received exit counseling within 30 days of the withdrawal date from the University. The exit interview was conducted 13 days late. According to 34 CFR 685.304(b), a school must ensure that exit counseling is conducted with each Direct Subsidized Loan or Direct Unsubsidized Loan borrower and graduate or professional student Direct PLUS Loan borrower shortly before the student borrower ceases at least half-time study at the school. According to 34 CFR 682.604(a)(1), if a student borrower withdraws from school without the school's prior knowledge or fails to complete an exit counseling session as required, the school must, within 30 days after learning that the student borrower has withdrawn from school or failed to complete the exit counseling as required, ensure that exit counseling is provided through interactive electronic means, by mailing written counseling materials to the student borrower at the student borrower's last known address, or by sending written counseling materials to an email address provided by the student borrower that is not an email address associated with the school sending the counseling materials. Uniform Guidance (2 CFR 200.303(a)) requires non-Federal entities receiving Federal awards establish and maintain internal controls to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure student exit counseling is completed appropriately. According to University officials, during fiscal year 2020, many new financial aid, federal, and state initiatives were placed on the department. Management stated the new programs were listed as a priority and therefore led exit counseling to run later than expected. Exit counseling helps federal student loan borrowers understand how to repay their loans and provides information on deferment and repayment plan options. Exit counseling also discusses borrower rights and responsibilities. Updated student contact information will also be collected at the end of the exit counseling session. (Finding Code No. 2020-004, 2019-002, 2018-005, 2017-004) RECOMMENDATION We recommend the University implement controls and processes to identify students requiring exit counseling within the student financial aid department on a routine basis. These controls should ensure exiting student borrowers are monitored frequently to ensure that all necessary students complete exit counseling within the required time frame. UNIVERSITY RESPONSE Agree. University Student Financial Aid has revised the query used and created a semi-monthly communication schedule to notify students of their exit counseling requirements when enrollment is below 6 credit hours. This communication plan was implemented on February 16, 2021 and will continue to be performed on a semi-monthly basis.

2020-004. Finding: Exit Counseling Not Completed ? Edwardsville Campus Response: Agree. SIUE Student Financial Aid has revised the query used and created a semi-monthly communication schedule to notify students of their exit counseling requirements when enrollment is below 6 credit hours. Corrective Action Plan: The communication plan described above has been implemented and will continue to be performed on a semi-monthly basis. Contact Person: Jeremy Baker, SIUE Student Financial Aid Anticipated completion date: Implemented February 16, 2021

2019-002

2020-005. Finding: Information Technology Risk Assessment Not Performed Federal Agency: U.S. Department of Education CFDA Number: 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.342, 93.364 Program Expenditures: $202,334,276 Program Name: Student Financial Assistance Cluster Award Number(s): P033A141286, P033A151286, P033A191286, P063P170116, P063P180116, P007A151286, P379T180116, P379T190116, N/A Questioned Costs: None The Southern Illinois University (University) Edwardsville campus did not document required risk assessments related to student information security. As a requirement under the University?s Program Participation Agreement with the Department of Education, the University must protect student financial aid information. However, during our testing, we noted they had not conducted a risk assessment identifying internal and external risks to the security, confidentiality, and integrity of the students? information. The Standards for Safeguarding Customer Information, required by the Gramm-Leach- Bliley Act (GLBA) (16 CFR ?314.4 (b)), requires customers to identify reasonable foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information, and assess the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risk in each relevant area of operations, including: 1) Employee training and management; 2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and 3) Detecting, preventing and responding to attacks, intrusions, or other system failures. Additionally, the Uniform Guidance (2 CFR 200.303(a)) requires nonfederal entities receiving federal awards establish and maintain effective internal control designed to reasonably ensure compliance with Federal laws, statutes, regulations, and the terms and conditions of the Federal award. Furthermore, generally accepted information technology guidance endorses the implementation of a process to identify risk and ensure appropriate safeguards are in place to protect IT systems and data. University management stated the University did not document a GLBAfocused risk assessment due to a shifting of Information Technology Services? (ITS) priorities at the onset of the COVID-19 pandemic. ITS pivoted to focus on data security and disbursement of federal stimulus funds to students, and as a result, did not complete the GLBA-focused risk assessment during the year. Without documentation of a risk assessment, the University is at risk of noncompliance with the GLBA. In addition, there is a risk that University systems and information could be vulnerable to attacks or intrusions, and these attacks may not be detected in a timely manner. (Finding Code No. 2020-005, 2019-004) RECOMMENDATION We recommend the University perform and document a comprehensive risk assessment identifying internal and external risks to the security, confidentiality, and integrity of the students? information. In addition, the University should ensure proper safeguards are in place to ensure the security of student information. UNIVERSITY RESPONSE Agree. SIUE Student Financial Aid (SFA) and Information Technology Services will co-lead a cross functional team that assess the internal and external risks associated to student data and privacy. That team will in turn provide a risk assessment that indicates how we plan to mitigate any breaches. SFA will conduct annual trainings for SFA team members.

2020-005. Finding: Information Technology Risk Assessment Not Performed ? Edwardsville Campus Response: Agree. Corrective Action Plan: SIUE Student Financial Aid (SFA) and Information Technology Services will co-lead a cross functional team that assess the internal and external risks associated to student data and privacy. That team will in turn provide a risk assessment that indicates how we plan to mitigate any breaches. SFA will conduct annual trainings for SFA team members. Contact Person: Mesha Garner, SIUE Director Student Financial Aid and Jeff Laughlin, SIUE Chief Information Security Officer Anticipated Completion date: August 15, 2021

2019-004

2020-007. Finding: Return of Title IV Aid Federal Agency: U.S. Department of Education CFDA Number: 84.007, 84.038, 84.063, 84.268, 84.379, 93.342, 93.364 Program Expenditures: $202,334,276 Program Name: Student Financial Assistance Cluster Award Number(s): P007A191285, P063P190115, P063P180115, P379T200115, N/A Questioned Costs: None Southern Illinois University (University) Carbondale campus did not complete the return of Title IV aid within the required timeframe for one student. During our testing of the University?s return of Title IV calculations, we noted 1 out of 40 (2.5%) students tested had Title IV aid that was returned to the Department of Education 54 days after the date of withdrawal of the student. The student was an unofficial withdrawal and never began academic attendance for the semester tested. The sample was not a statistically valid sample. If a student does not begin attendance in a payment period or period of enrollment, the institution must return all Title IV, Higher Education Act program funds that were credited to the student's account at the institution or disbursed directly to the student for that payment period or period of enrollment as soon as possible, but no later than 30 days after the date that the institution becomes aware that the student will not or has not begun attendance. A student has not begun attendance in a payment period or period of enrollment if the institution is unable to document the student's attendance at any class during the payment period or period of enrollment. (34 CFR 668.21). Uniform Guidance (2 CFR 200.303(a)) requires nonfederal entities receiving federal awards establish and maintain effective internal control to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure return of Title IV aid is completed within the required timeframe. University management stated the delay in the return of Title IV aid to the student occurred due to oversight when reviewing the listing of withdrawals for the spring semester. The process for reviewing student withdrawals is a manual process which caused this student to be overlooked for timely reporting. Without effective controls to ensure timely return of Title IV aid to the Department of Education for student withdrawals, there is increased likelihood of program reviews by the Department of Education. Continued noncompliance may result in the potential loss of Title IV aid eligibility. (Finding Code No. 2020-007) RECOMMENDATION We recommend the University establish processes and procedures to ensure student withdrawals are identified timely to ensure the return of Title IV calculations are completed within required timeframes. UNIVERSITY RESPONSE Agree. The SIUC Student Financial Aid office has reviewed the current processes and procedures and determined an additional control can be implemented. The Associate Director will be added to the email notifications for the withdraw report, allowing for additional review. The produced report includes the name, ID, effective date, and number of days elapsed for each withdrawn student who has not had a return calculation completed.

2020-007. Finding: Return of Title IV Aid ? Carbondale Campus Response: Agree. The SIUC Student Financial Aid Office has reviewed the current processes and procedures and determined an additional control can be implemented. Corrective Action Plan: The Associate Director will be added to the email notifications for the withdraw report, allowing for additional review. The produced report includes the name, ID, effective date, and number of days elapsed for each withdrawn student who has not had a return calculation completed. Contact Person: Dee Rotolo, SIUC Financial Aid Director Anticipated completion date: June 30, 2021

2020-008. Finding: Student Enrollment Reporting Federal Agency: U.S. Department of Education CFDA Number: 84.007, 84.038, 84.063, 84.268, 84.379, 93.342, 93.364 Program Expenditures: $202,334,276 Program Name: Student Financial Assistance Cluster Award Number(s): P007A191285, P063P190115, P063P180115, P379T200115, N/A Questioned Costs: None Southern Illinois University Edwardsville (University) campus did not have adequate procedures in place to ensure that program-level student enrollment data elements were reported accurately and timely. During our testing of students who withdrew or graduated from the University, we noted 1 out of 40 (2.5%) students did not have program-level enrollment status accurately reported. The student was reported as being active in the program despite withdrawing from the University. The sample was not a statistically valid sample. A school participating in Title IV aid programs must establish and maintain proper administrative and fiscal procedures and all necessary records and submit all required reports, which contain accurate information, to the Department of Education (34 CFR 685.309). Uniform Guidance (2 CFR 200.303(a)) requires nonfederal entities receiving federal awards establish and maintain effective internal control to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure return of Title IV aid is completed within the required timeframe. According to University management, the reporting of withdrawals to the Department of Education is a manual process. In this case, management stated the student?s withdrawal from the University was reported, but an oversight error by University personnel resulted in not reporting the withdrawal from the program to the Department of Education. Without sufficient controls around enrollment reporting there is a greater risk that student enrollment data will not be reported accurately or timely. Inaccurate or untimely reporting of student enrollment data can result in inconsistencies between the University?s records and the National Students Loan Data System as well as potential delays in the repayment of federal loans. (Finding Code No. 2020-008) RECOMMENDATION We recommend the University establish processes and procedures to ensure student withdrawals from both the University and University programs are reviewed thoroughly to ensure that the Department of Education is provided accurate student enrollment data. UNIVERSITY RESPONSE Agree. The issue is not believed to be a systemic problem, but rather an isolated incident. The SIUE Registrar and Director of Student Financial Aid will ensure that employees are trained appropriately to update both program and enrollment data for program withdrawals. Training staff and reviewing staff performance will be ongoing.

2020-008. Finding: Student Enrollment Reporting ? Edwardsville Campus Response: Agree. The issue is not believed to be a systemic problem, but rather an isolated incident. Corrective Action Plan: The SIUE Registrar and Director of Financial Aid will ensure that employees are trained appropriately to update both program and enrollment data for program withdrawals. Training staff and reviewing staff performance will be ongoing. Contact Person: Laura Strom, SIUE Registrar and Mesha Garner, SIUE Director of Financial Aid Anticipated completion date: July 15, 2021

Federal Agency: U.S Department of Education CFDA Number: 84.042 Program Expenditures: $295,897 Program Name: TRIO ? Student Support Services Award Number(s): P042A151636 Questioned Costs: None The Southern Illinois University (University) Carbondale campus did not have adequate procedures in place to ensure the earmarking requirements for the Student Support Services program were met during the fiscal year. During our testing of earmarking requirements for TRIO Student Support Services at the University, we noted the program at the Carbondale campus served 160 students, of which 91 (57%) students met the criteria for being either low-income individuals who are first-generation college students or individuals with disabilities. During fiscal year 2019, the University purchased software to better track participants and eligibility, implemented a campus-wide referral system, and developed a corrective action plan to increase the percentage of students meeting the two-thirds requirement. However, the percentage of participants meeting the criteria dropped 3 percent from the prior year. The Student Support Services Program requires that, in addition to the eligibility criteria for individual students, not less than two-thirds of the program participants will be either low-income individuals who are first-generation college students or individuals with disabilities (34 CFR Section 646.11(a)(1)). Uniform Guidance (2 CFR 200.303(a)) requires nonfederal entities receiving federal awards establish and maintain effective internal control to reasonably ensure compliance with Federal laws, statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure that all earmarking requirements are reviewed and monitored to ensure compliance. As noted in the prior year, University officials stated the failure to meet the two-thirds requirement was due to a decreasing pool of students who qualify as first-generation and low income. In the prior year, officials also stated program staff had not adequately monitored the program to ensure the two-thirds requirement was met. In addition, we noted in the current year, there was an insufficient student recruiting plan to ensure that the earmarking requirement was met. Without effective controls to review the participants and ensure compliance for TRIO Student Support Services, the University is at a greater risk of not meeting the minimum earmarking requirements, as well as increased likelihood of program reviews from oversight agencies. In addition, the University is at risk of being required to return funds to the Department of Education and/or becoming ineligible to administer the program. (Finding Code No. 2019-001, 2018-002) RECOMMENDATION We recommend the University establish processes and procedures, including plans for increasing participation in the program by targeted populations, to ensure it will meet the earmarking program requirements. The University should also implement controls to identify likely disparities in expected and actual results throughout the year and take proactive corrective action as necessary. UNIVERSITY RESPONSE Agree. Southern Illinois University-Carbondale announced in December 2019 that it would no longer require high school students to take the ACT or SAT to be admitted to the University. We expect this action to have a positive impact on admission for underrepresented minorities, which in turn is expected to increase the population of students that are eligible for TRIO Programs. Additionally, the Trio Director has requested that the Student Support Services program be added as a provisional admission program for the University. Provisional Admission is used by the University to admit students under special circumstances to programs that can provide specialized support services to ensure success. This too is expected to increase enrollment in TRIO, as it will provide direct access to TRIO to a larger group of students. Lastly, the software purchased by the University contains dashboards, which has allowed for the tracking of earmarking requirements in real-time, thereby, providing the ability to determine increased and decreased enrollment numbers daily.

Response: The University agrees with this finding and is planning to implement several strategies to better monitor the two-third eligibility criteria required by the U.S. Department of Education. Corrective Action Plan: Southern Illinois University-Carbondale announced in December 2019 that it would no longer require High School students to take the ACT or SAT to be admitted to the university. We expect this action to have a positive impact on admission for underrepresented minorities, which in turn is expected to increase the population of students that are eligible for Trio Programs. Additionally, the Trio Director has requested that the Student Support Services program be added as a provisional admission program for the university. Provisional Admission is used by the university to admit students under special circumstances to programs that can provide specialized support services to ensure success. This too is expected to increase enrollment in TRIO, as it will provide direct access to TRIO to a larger group of students. Lastly, the software purchased by the university contains dashboards which has allowed for the tracking of earmarking requirements in real-time, thereby, providing the ability to determine increased and decreased enrollment numbers daily. Contact Person: Renada Greer (Assistant Dean & Director TRIO) Anticipated completion date: Fall 2020

2018-002

2019-002. Finding: Exit Counseling Not Completed Federal Agency: U.S Department of Education CFDA Number: 84.007, 84.038, 84.063, 84.268, 84.379, 93.342, 93.364 Program Expenditures: $223,381,697 Program Name: Student Financial Assistance Cluster Award Number(s): P033A151286, P033A141286, P033A171286, P033A181286, P033A191286, P063P170116, P063P180116, P007A151286, P379T180116, P379T190116, N/A Questioned Costs: None The Southern Illinois University (University) Edwardsville campus did not complete exit counseling for all necessary students within the required time period. During our testing of students who received title IV aid at the University, we noted 10 out of 25 (40%) students tested who received Direct Loans did not complete exit counseling timely after leaving the Edwardsville campus. The sample was not a statistically valid sample. The Edwardsville campus requires students to complete exit counseling when they leave the University after previously attending. During the year, nine students attended the University, received direct loans, and officially withdrew during the semesters they attended, but had not received exit counseling within 30 days of the withdraw date from the University. The exit interviews were conducted between 12 - 37 days late. Further, during the year, one student attended the University, received direct loans, and officially withdrew from the University. No exit counseling was performed for this student. According to 34 CFR 685.304(b), a school must ensure that exit counseling is conducted with each Direct Subsidized Loan or Direct Unsubsidized Loan borrower and graduate or professional student Direct PLUS Loan borrower shortly before the student borrower ceases at least half-time study at the school. According to 34 CFR 682.604(a)(1), if a student borrower withdraws from school without the school's prior knowledge or fails to complete an exit counseling session as required, the school must, within 30 days after learning that the student borrower has withdrawn from school or failed to complete the exit counseling as required, ensure that exit counseling is provided through interactive electronic means, by mailing written counseling materials to the student borrower at the student borrower's last known address, or by sending written counseling materials to an email address provided by the student borrower that is not an email address associated with the school sending the counseling materials. Uniform Guidance (2 CFR 200.303(a)) requires non-Federal entities receiving Federal awards establish and maintain internal controls to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure student exit counseling is completed appropriately. During the prior audit period, University officials identified a problem with the student system whereby students not enrolled at least half time were not being picked up for exit counseling if they unofficially withdrew. According to University officials, during fiscal year 2019, turnover in the information technology department, where the processes to flag exit counseling compliance were being monitored, caused exit counseling to be completed after the required timeframe. We noted in the current year there was no formal process to complete an independent review of exit counseling compliance within the student financial aid department. Exit counseling helps federal student loan borrowers understand how to repay their loans and reviews deferment and repayment plan options. Exit counseling also discusses borrower rights and responsibilities. Updated student contact information will also be collected at the end of the exit counseling session. (Finding Code No. 2019-002, 2018-005, 2017-004) RECOMMENDATION We recommend the University implement controls to identify exit counseling requirements within the student financial aid department in addition to improving controls to identify exit counseling requirements within the information technology department. These controls should be monitored to ensure that all necessary students complete exit counseling within the required time frame. UNIVERSITY RESPONSE Implemented. A custom program has been built to consistently identify the exit conference requirement. The program is run multiple times a month, and various team members have been trained on how to run the program in order to ensure continuity of the process.

Response: Implemented. A custom program has been built to consistently identify the exit conference requirement. The program is run multiple times a month, and various team members have been trained on how to run the program in order to ensure continuity of the process. Corrective Action Plan: We will continue to run the process on a regular basis. Contact Person: Jeremy Baker, Student Financial Aid Anticipated completion date: April 2019

2018-005

2019-003. Finding: Inadequate Support for Sliding Fee Discounts Federal Agency: U.S. Department of Health and Human Services CFDA Number: 93.224 Program Expenditures: $3,164,620 Program Name: Health Center Program Cluster Award Number(s): H80CS24098-08-00 Questioned Costs: None The Southern Illinois University (University) Springfield campus did not have adequate procedures in place to ensure the required documentation was retained for all patients treated during the audit period. During our testing of patients treated during the year under audit, we noted for 1 of 40 (2.5%) patients treated, the University did not maintain appropriate financial records to support whether patient charges were appropriately adjusted based on income and family size by applying the University?s sliding fee discount schedule. The sample was not a statistically valid sample. Federal guidelines require health centers to prepare and apply a sliding fee discount schedule so amounts owed for health center services by eligible patients are adjusted (discounted) based on the patient?s ability to pay (42 CFR Section 51.c303(f)). The University?s internal procedures require patient applications be reviewed and approved and then scanned into the patient?s account, along with any supporting documentation. Uniform Guidance (2 CFR 200.303(a)) requires nonfederal entities receiving federal awards establish and maintain effective internal control to reasonably ensure compliance with Federal laws, statutes, regulations, and the terms and conditions of the Federal award. Effective internal controls should include procedures to ensure that all required documentation is retained for patients treated. The University was unable to provide the patient?s application or identify the underlying cause for the missing documents, but we noted the inability to provide the patient?s application was due to the University?s failure to follow the internal document retention policy. A patient?s application, which includes information documenting a patient?s ability to pay, is the main support utilized by the University to determine the medical charges to a patient based on the sliding fee discount schedule. Without adequate documentation to support a patient?s ability to pay, there is a risk that a patient may be charged incorrectly for health center services provided. (Finding Code No. 2019-003) RECOMMENDATION We recommend the University implement controls to ensure the required documentation is retained for patients treated at the University?s health center. UNIVERSITY RESPONSE Implemented. This was an isolated incident at the Quincy location. The University agrees with the audit finding and has already put the following corrective action in place to ensure this does not happen in the future. For corrective action at the Quincy location, the completed Financial Assistance Application will be scanned into the patient?s chart and a copy will be retained by the Center. The original copy will be mailed to the patient. The Quincy Billing Supervisor will review the chart to make sure the completed Financial Assistance Application has been scanned into the chart, prior to the mailing of the original application to the patient.

Response: Implemented. This was an isolated incident at the Quincy location. The University agrees with the audit finding and has already put the following corrective action in place to ensure this does not happen in the future. Corrective Action Plan: For corrective action at the Quincy location, the completed Financial Assistance Application will be scanned into the patient?s chart and a copy will be retained by the Center. The original copy will be mailed to the patient. The Quincy Billing Supervisor will review the chart to make sure the completed Financial Assistance Application has been scanned into the chart, prior to the mailing of the original application to the patient. Contact Person: Jeanne Hill, Site Administrator is responsible for ensuring continued compliance to this corrective action plan to ensure required documentation for patients is retained at the health center. Anticipated Completion Date: This corrective action has already been implemented at the Quincy location.

2019-004. Finding: Information Technology Risk Assessment Not Performed Federal Agency: U.S Department of Education CFDA Number: 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.342, 93.364 Program Expenditures: $223,381,697 Program Name: Student Financial Assistance Cluster Award Number(s): P033A151286, P033A141286, P033A171286, P033A181286, P033A191286, P063P170116, P063P180116, P007A151286, P379T180116, P379T190116, N/A Questioned Costs: None The Southern Illinois University (University) Edwardsville campus did not document required risk assessments related to student information security. As a requirement under the University?s Program Participation Agreement with the Department of Education, the University must protect student financial aid information. However, during our testing, we noted they had not conducted a risk assessment identifying internal and external risks to the security, confidentiality, and integrity of the students? information. The Standards for Safeguarding Customer Information, required by the Gramm-Leach-Bliley Act (GLBA) (16 CFR ?314.4 (b)), requires customers to identify reasonable foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information, and assess the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risk in each relevant area of operations, including: (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other system failures. Additionally, the Uniform Guidance (2 CFR 200.303(a)) requires nonfederal entities receiving federal awards establish and maintain effective internal control designed to reasonably ensure compliance with Federal laws, statutes, regulations, and the terms and conditions of the Federal award. Furthermore, generally accepted information technology guidance endorses the implementation of a process to identify risk and ensure appropriate safeguards are in place to protect IT systems and data. According to University officials, the University did not document a GLBA-focused risk assessment during fiscal year 2019 because the University believed the initial assessment would be sufficient to comply with the GLBA guidelines. Without documentation of a risk assessment, the University is at risk of noncompliance with the GLBA. In addition, there is a risk that University systems and information could be vulnerable to attacks or intrusions, and these attacks may not be detected in a timely manner. (Finding Code No. 2019-004) RECOMMENDATION We recommend the University perform and document a comprehensive risk assessment identifying internal and external risks to the security, confidentiality, and integrity of the students? information. In addition, the University should ensure proper safeguards are in place to ensure the security of student information. UNIVERSITY RESPONSE Agree. Corrective action will include the formation of a committee chaired by the Student Financial Aid Security Coordinator, which will consult with Information Technology Services so that Student Financial Aid can produce the following deliverables: A documented risk assessment survey of sensitive data assets and systems specific to student financial data. Verification that Student Financial Aid personnel complete Human Resources Privacy training annually. A survey of how Student Financial Aid interacts with SIUE Intrusion detection, incident response, and business continuity.

Response: Agree. Corrective Action Plan: Corrective action will include the formation of a committee chaired by Jeremy Baker to act as the SFA Security Coordinator, which will consult with ITS so that SFA can produce the following deliverables: ? A documented risk assessment survey of sensitive data assets and systems specific to student financial data. ? Verification that SFA personnel complete HR Privacy training annually. ? A survey of how SFA interacts with SIUE Intrusion detection, incident response, and business continuity. Contact Person: Jeremy Baker, Student Financial Aid Anticipated Completion date: May 1, 2020

2019-005. Finding: Untimely Award Closeout and Misstatements on the Schedule of Expenditures of Federal Awards Federal Agency: U.S. Department of Health & Human Services, U.S. Department of Agriculture, National Institutes of Health, U.S. Department of Defense, U.S. Small Business Administration, Corporation for National and Community Service CFDA Number: Various Research and Development Cluster, Highway Planning and Construction Cluster, 12.556, 59.037, 93.600, 93.898, 93.959, 93.994, 94.006 Program Expenditures: $15,600,642 for Research and Development Cluster, $92,780 for Highway Planning and Construction Cluster, $1,046,170 for Fish and Wildlife Cluster, $9,179,356 for various CFDA numbers Program Name: Research and Development Cluster, Highway Planning and Construction Cluster, Fish and Wildlife Cluster, various CFDA numbers Award Number(s): 2015-05405-01, 2016-70020-25802, SC-16-7 (16-07), 3R01AG019899-15S1, 86380021F, 43CWZ03269, 83204002F, 1R15AI109566-01A1, 2014-05088-01, 06740/TPF-5(218), 087795-16651, 2011-05776-45/061379-13555, 2017-CQ02, 17-185126, 05CH8445-05-00; 05CH8445-04-00, 1R21NS090282-01A1, 5R21NS090282-02, N/A Questioned Costs: None The University did not have adequate procedures in place to ensure award accounts were completely closed out on a timely basis and the expenditures on the Schedule of Expenditures of Federal Awards (SEFA) contained the proper information. On each campus, Federal award accounts were not completely closed out in a timely manner, causing extraneous entries on the SEFA during subsequent years. Processes were in place on each campus to perform closeout procedures on all Federal awards and send required financial and performance reports to the grantor to close out the award within the 90-day required timeframe. However, the associated accounts were not zeroed out and closed at that time, thus permitting future transactions (late charges, errors, and/or adjustments) to be posted to the award accounts in Fiscal Year 2019. During our review of the Carbondale and Edwardsville campuses? SEFAs for the Fiscal Year 2019, we noted expenditures reported for awards that were past the award period of performance end date and the 90-day closeout timeframe. Although the University has significantly reduced the number of transactions posted after the deadline compared to prior audit periods, there were still 23 Federal awards with expired period of performance end dates and past the 90-day closeout timeframe noted during our review. The awards closeout expiration dates for each campus are summarized as follows: See Schedule of Findings and Questioned Costs for chart/tab. All of the exceptions were due to account reconciliation adjustments or indirect cost rate adjustments being posted manually to the award accounts. The University implemented system changes that restricted posting adjustments to most grant expenditures. However, manual changes were still allowed to be posted during the grant closeout process. According to Uniform Guidance (2 CFR 200.343(b)), unless the Federal awarding agency authorizes an extension, the entity must liquidate all obligations incurred under the Federal awards no later than 90 calendar days after the period of performance end date specified in the Federal award. The University should implement and enforce policies and procedures to properly close out awards within the 90-calendar day timeframe. Uniform Guidance (2 CFR 200.303(a)) requires non-Federal entities receiving Federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure the SEFA is reporting complete and accurate expenditure information. During the prior audit period, University officials stated system changes to block posting of most expenditures after expiration of the 90-day closeout period were only effective for new grant awards with start dates after July 1, 2018 at Edwardsville and after July 1, 2017 at Carbondale. University officials indicated the current period?s condition resulted from manual account reconciliation adjustments or indirect cost rate adjustments that were identified and posted after the grant closeout date. In the current year, we noted processes used to identify reconciling items or adjustments required to grant accounts did not reduce the number of accounts with postings after the closeout date. Without effective policies and procedures for timely and accurate SEFA reporting, the University is at a greater risk for reporting errors in the required annual financial statements and to the federal government. (Finding Code No. 2019-005, 2018-004, 2017-002, 2016-002, 2015-002) RECOMMENDATION We recommend the University review, update, and enforce internal policies and procedures for Federal award expenditures regarding SEFA closeout. Further, the University should proactively monitor the timeliness of award closeouts. UNIVERSITY RESPONSE We agree with the facts of this finding. The actions taken by the Office of Sponsored Projects Administration (SIUC) and Office of Research and Projects (SIUE) during and subsequent to Fiscal Year 2019, to closely monitor all federal and federal flow through projects from inception to end date to the 90-day close-out period, have generally proven successful in meeting 90-day close-out requirements on current year grants. This is demonstrated by the low number of exceptions relative to grants ending in Fiscal Year 2019 (3 at SIUC and 9 at SIUE). Consequently, with respect to current year grants, we believe our controls are now sufficient to provide reasonable assurance that we are managing our grants in compliance with the federal guidelines. The changes to the accounting system by our Information Technology departments to allow the `freezing? of accounts to prevent future charges has provided needed support for this effort. We do recognize that exceptions still exist with respect to older grants that have expired, but for which the associated accounts have not yet been closed. Therefore, we will continue efforts to not only ensure current year grants are closed timely, but will also address the prior year grants until those open accounts have been remedied. Specifically, SIUE has implemented two (2) new system/process changes that should significantly lower the occurrences of transactions hitting after the 90 day liquidation period: 1) the system end dates in the Administrative Information System for grants now closes sixty (60) days after the grant end date instead of 90 days after, and 2) the frequency of which the indirect costs are calculated has been changed from quarterly to monthly. These changes should significantly improve the two (2) major contributing factors that led to the 9 current year grants not being closed timely at SIUE. The positive effects of these improvements will be fully realized in FY 2021.

Response: The actions taken by the Office of Sponsored Projects Administration (SIUC) and Office of Research and Projects (SIUE) during and subsequent to Fiscal Year 2019, to closely monitor all federal and federal flow through projects from inception to end date to the 90-day close-out period, have generally proven successful in meeting 90-day close-out requirements on current year grants. This is demonstrated by the low number of exceptions relative to grants ending in Fiscal Year 2019 (3 at SIUC and 9 at SIUE). Consequently, with respect to current year grants, we believe our controls are now sufficient to provide reasonable assurance that we are managing our grants in compliance with the federal guidelines. The changes to the accounting system by our Information Technology departments to allow the `freezing? of accounts to prevent future charges has provided needed support for this effort. We do recognize that exceptions still exist with respect to older grants that have expired, but for which the associated accounts have not yet been closed. Corrective Action Plan: Therefore, we will continue efforts to not only ensure current year grants are closed timely, but will also address the prior year grants until those open accounts have been remedied. Specifically, SIUE has implemented two (2) new system/process changes that should significantly lower the occurrences of transactions hitting after the 90 day liquidation period: 1) the system end dates in AIS for grants now closes sixty (60) days after the grant end date instead of 90 days after, and 2) the frequency of which the indirect costs are calculated has been changed from quarterly to monthly. These changes should significantly improve the two (2) major contributing factors that led to the 9 current year grants not being closed timely at SIUE. The positive effects of these improvements will be fully realized in FY 2021. Contact Person: Sonjie Schwartz and Shirley Castle (SIUC) and Jerry Weinberg and Kevin Dial (SIUE) Anticipated completion date: Implemented measures will continue.

2018-004

GSA_MIGRATION

GSA_MIGRATION

2016-007

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION