Board of Trustees Illinois State UniversityHigher Education

Federal Agency: U.S. Department of Education Assistance Listing Number: 84.007; 84.063; 84.268 Cluster Name: Student Financial Assistance Cluster Program Names: Federal Supplemental Education Opportunity Grants; Federal Pell Grant Program; Federal Direct Student Loans Award Numbers: N/A; Federal Award Year 2024-2025 Questioned Cost: None Program Expenditures: $768,137; $45,573,205; $87,147,867 Cluster Expenditures: $137,694,385 The Illinois State University (University) did not accurately report student enrollment information to the U.S. Department of Education’s National Student Loan Data System (NSLDS) and internal controls in place did not identify the errors. Condition Out of twenty-five students tested, we noted fourteen students’ (56%) enrollment status changes had discrepancies in Enrollment Effective Dates between the NSLDS Campus-Level Record and the NSLDS Program-Level Record, with the NSLDS Program-Level Record dates being inaccurate by 17 days. The sample was not intended to be, and was not, a statistically valid sample. Criteria According to the NSLDS Enrollment Reporting Guide, a student’s Program-Level enrollment status should be reported with the same enrollment status as student’s Campus-Level enrollment status for all programs the student is enrolled in at a location, even if the student is not currently taking coursework which applies to a particular program. If the student has withdrawn or graduated from an academic program, a “terminal enrollment status” of ‘W’ or ‘G,’ as appropriate, should be reported for the program, even if the student is still taking coursework applicable to other programs in which the student is enrolled. The NSLDS Enrollment Reporting Guide also states the University is responsible for accurately reporting all Program-Level Record and Campus-Level Record data elements. Uniform Grant Guidance (2 CFR 200.303) requires nonfederal entities receiving federal awards to establish and maintain internal controls designed to reasonably ensure compliance with federal statutes, regulations, and terms and conditions of the federal award. Effective internal controls should include procedures to ensure accurate student enrollment information is submitted to NSLDS. Cause University management indicated the failure to report accurate enrollment information was due to a technical error in the University’s process to transfer data to NSLDS. Effect Failure to accurately report Campus-Level student enrollment information to NSLDS resulted in noncompliance with federal guidelines and inaccurate NSLDS records. (Finding Code No. 2025-004) Recommendation We recommend the University review current processes for reporting to NSLDS and implement procedures to ensure student enrollment information is reported accurately. University Response The University acknowledges the above finding. The identified issue was isolated and only impacted fall graduates. This issue was fully addressed when the university filed its fall 2025 enrollment reporting. The university has conducted an internal audit to identify students that were reported incorrectly and has manually updated files to ensure dates were properly reflected. At current state, internal monitoring and manual edits are made if discrepancies appear. It is expected that the Enterprise Resource Planning System will launch an automatic fix for this issue in a software update for all users in the first quarter of calendar year 2026. Should the software issue not result in an automation of the fix, the University plans to continue the manual edits, then customize the NSLDS reporting logic to ensure continued future alignment.

Current Findings ? Federal Compliance Finding 2020-004 Failure to Provide Exit Counseling to Nursing Students Compliance Requirement: Special Tests and Provisions ? Student Loan Repayments Funding Agency: U.S. Department of Education Program/Cluster Title: Student Financial Assistance Cluster Total Expenditures: $140,729,517 Assistance Listing Number(s): 84.007, 84.003, 84.038, 84.063, 84.268, 84.379, 93.364 Questioned Costs: None The Illinois State University (University) did not have adequate internal controls to ensure exit counseling was provided to all students who received a Nursing Student Loan (NSL). During testing, we sampled 15 of the 147 students with a NSL in repayment during the examination period. We noted five of the 15 (33%) tested NSLs in repayment were not provided with exit counseling. The sample methods used in performing this testing were not statistically valid. As of the date when we completed our test, the University had not evaluated whether additional errors exist. The Code of Federal Regulations (Code) (42 C.F.R. ? 57.310(b)(1)(ii)) requires the University to exercise due diligence in the collection of these NSLs by conducting and documenting an exit interview with the borrower if the University had advance notice the student was leaving the University or documenting attempts to notify the borrower of the substance of the exit interview if the student terminated their association with the University without advance notice. Further, the Code (2 C.F.R. ? 200.303(a)) requires the University establish and maintain effective internal control over federal awards to provide reasonable assurance the University is managing its federal awards in compliance with federal statutes, regulations, and terms and conditions applicable to a specific grant. University officials indicated, like they did in Fiscal Year 2019, these graduates did not have their exit counseling completed due to a system conversion issue with the University?s third-party service provider. Failure to perform exit counseling may result in borrowers not being aware of the repayment process and their rights and responsibilities associated with NSLs. In addition, noncompliance with the Code could impact the University?s institutional eligibility under the NSL program. (Finding Code No. 2020-004, 2019-002) Recommendation We recommend the University implement controls to ensure all individuals with an NSL in repayment receive exit counseling in accordance with the Code. Further, the University should review NSLs currently in repayment, identify those borrowers with an NSL in repayment where the University lacks documentation substantiating the borrower completed exit counseling, and make good faith attempts to inform the borrower of the substance of exit counseling by mail and then secure information back from the borrower by mail. Current Findings ? Federal Compliance Finding 2020-004 Failure to Provide Exit Counseling to Nursing Students (Continued) University Response The University is investigating the best method for ensuring all nursing students are afforded the proper exit counseling, including having the third-party servicer provide this service as well as any formal documentation. The University will make a good faith effort over the next twelve months to provide exit counseling to the students who lack evidence of proper exit counseling.

Current Findings ? Federal Compliance Finding 2020-005 Failure to Return Unearned Title IV Assistance Compliance Requirement: Special Tests and Provisions ? Return of Title IV Funds Funding Agency: U.S. Department of Education Program/Cluster Title: Student Financial Assistance Cluster Total Expenditures: $140,729,517 Assistance Listing Number(s): 84.007, 84.003, 84.038, 84.063, 84.268, 84.379, 93.364 Questioned Costs: $132 The Illinois State University (University) did not have adequate internal controls to ensure all unearned Title IV awards from withdrawn students were returned to the U.S. Department of Education (Department). During testing, we sampled 40 of the 765 students who withdrew from the University during the examination period. We noted the University did not properly calculate five of the 40 (13%) tested withdrawing students? unearned assistance, which resulted in $132 not being returned to the Department. The sample methods used in performing this testing were not statistically valid. As of the date when we completed our test, the University had not evaluated whether additional errors exist or quantified the impact of these errors on the population. As such, the amount reported as questioned costs includes only those errors identified by us as a result of our testing. However, after these five problematic withdrawals were identified by us, the University returned the $132 in unearned assistance to the Department. The Code of Federal Regulations (Code) (34 C.F.R. ? 668.22(g)) requires the return of unearned Title IV assistance, as determined by completing specific calculations specified within the Code, by the University to the Department. Further, the Code (2 C.F.R. ? 200.303(a)) requires the University establish and maintain effective internal control over federal awards to provide reasonable assurance the University is managing its federal awards in compliance with federal statutes, regulations, and terms and conditions applicable to a specific grant. University officials indicated these errors were due to human error stemming from insufficient training during the COVID-19 pandemic. Failure to properly calculate unearned Title IV assistance represents noncompliance with the Code and resulted in an underpayment of unearned Title IV assistance back to the Department. In addition, noncompliance with the Code could impact the University?s institutional eligibility under the Department?s student assistance programs. (Finding Code No. 2020-005) Recommendation We recommend the University implement controls, including additional training of staff, to ensure calculations of unearned Title IV assistance are properly performed in accordance with the provisions of the Code. Current Findings ? Federal Compliance Finding 2020-005 Failure to Return Unearned Title IV Assistance (Continued) University Response The University has implemented an additional layer of review once the initial calculation has been performed. In addition, additional training has been provided to the staff member. Additional procedures have been put into place to measure training comprehension as well. The University has subsequently reviewed and assessed all assistance returns, correcting all necessary calculations.

Current Finding ? Federal Compliance Finding 2019-002 Noncompliance with Special Tests and Provisions - Student Loan Repayment Federal Agency: Department of Education Program Name: Student Financial Assistance Cluster CFDA Numbers: 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.364 Program Expenditures: $140,824,735 Questioned Costs: None The Illinois State University (University) did not meet student loan repayment requirements for students awarded a Nursing Student Loan (NSL). During testing of 25 loans with a total outstanding balance of $98,334 at June 30, 2019, we identified the following problems: ? Five of 25 (20%) students, with a total balance of $32,864, were not classified and reported by the University as graduates, which resulted in these students not beginning repayment on their loans within nine months of their graduation date. University officials indicated, when performing a routine annual review of these balances on July 1, 2019, they noted this human error and corrected it. Due to this error, these students had not yet completed their exit counseling and the University decided to run each student?s nine-month grace period from this date. ? Four of 25 (16%) students, with a total balance of $15,919, were not provided exit counseling upon their graduation by the University. University officials indicated these students did not have their exit counseling completed due to a system conversion issue with its third-party service provider. The Code of Federal Regulations (Code) (42 C.F.R. ? 57.310(a)) states each NSL is repayable in equal or graduated installments over a 10-year period, with repayment beginning no later than nine months after the student ceases to be a student. In addition, the Code (42 C.F.R. ? 57.310(b)(1)) requires the University to exercise due diligence in the collection of these NSLs by (1) conducting and documenting an exit interview with the borrower if the University had advance notice the student was leaving the University or documenting attempts to notify the borrower of the substance of the exit interview if the student terminated their association with the University without advance notice and (2) notifying the borrower, in writing, twice during the nine-month grace period of the impending start of the loan?s repayment period. Further, the Code (2 C.F.R. ? 200.303(a)) requires the University establish and maintain effective internal control over federal awards to provide reasonable assurance the University is managing its federal awards in compliance with federal statutes, regulations, and terms and conditions applicable to a specific grant. Current Finding ? Federal Compliance Finding 2019-002 Noncompliance with Special Tests and Provisions - Student Loan Repayment (Continued) Failure to identify graduated students and timely begin the NSL repayment process delayed collection of NSLs, represents noncompliance with the Code, and may result in increased levels of uncollectible amounts as these NSL loans age beyond the usual lifetime of an NSL. Further, failure to perform exit counseling may result in borrowers not being aware of the repayment process and their rights and responsibilities associated with NSLs. Finally, noncompliance with the Code could impact the University?s institutional eligibility under the NSL Program. (Finding Code 2019-002) Recommendation We recommend the University implement controls to ensure all students with an NSL who graduate or separate from the University are promptly identified and properly classified for loan repayment purposes. Further, the University should implement controls to ensure all students with an NSL who graduate or separate from the University receive exit counseling in accordance with the Code. University Response The University has changed its process from reviewing enrolled students on an annual basis to reviewing enrolled students at the end of each semester to capture new graduates and students that have exited the program. The University will wait 10 days after submitting the separated students for each semester to verify that exit counseling is available on the third-party vendor?s website. Then, the University will print and file each exit counseling in the borrower?s promissory note file.

Current Finding ? Federal Compliance Finding 2019-003 Noncompliance with Special Tests and Provisions ? Student Financial Aid Information Security Federal Agency: Department of Education Program Name: Student Financial Assistance Cluster CFDA Numbers: 84.007, 84.033, 84.038, 84.063, 84.268, 84.379, 93.364 Program Expenditures: $140,824,735 Questioned Costs: None The Illinois State University (University) did not meet federal risk assessment requirements for its student financial aid information. The Federal Trade Commission considers higher education institutions participating in the U.S. Department of Education?s Title IV educational assistance programs to be financial institutions subject to its regulations adopted pursuant to the Financial Services Modernization Act of 1999 (Public Law 106-102). Under the University?s Program Participation Agreement with the U.S. Department of Education, the University must protect student financial aid information, which includes complying with the Federal Trade Commission?s risk assessment requirements adopted under the authority of Public Law 106-102 codified within the Code of Federal Regulations (Code) (16 C.F.R. ? 314.4). During testing, we noted the University had not completed its formal risk assessment as of June 30, 2019. Additionally, as the formal risk assessment had not been completed, the University had not implemented safeguards to control risks identified through the risk assessment and regularly monitored the effectiveness of the safeguards? key controls, systems, and procedures. The Code (16 C.F.R. ? 314.4(b)) requires the University develop, implement, and maintain the University?s information security program over student financial aid information by identifying reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of information that may result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of the information and then assessing the sufficiency of any safeguards in place to control these risks. Additionally, the Code (16 C.F.R. ? 314.4(c)) requires the University design and implement information safeguards to control the risks identified in the risk assessment and regularly test or otherwise monitor the effectiveness of the safeguards? key controls, systems, and procedures. Finally, the Code (16 C.F.R. ? 314.4(e)) requires the University evaluate and adjust its information security program (1) in light of the results of its testing and monitoring process, (2) when material changes to the University?s operations or business arrangements occur, or (3) when University management has reason to know circumstances exist that may have a material impact on the University?s information security program. Further, the Code (2 C.F.R. ? 200.303(a)) requires the University establish and maintain effective internal control over federal awards to provide reasonable assurance the University is managing its federal awards in compliance with federal statutes, regulations, and terms and conditions applicable to a specific grant. University officials indicated that the scope and complexity of completing a formal risk assessment far exceeded initial estimates of staff time and resources assigned to fully complete it prior to the end of the fiscal year. Current Finding ? Federal Compliance Finding 2019-003 Noncompliance with Special Tests and Provisions ? Student Financial Aid Information Security (Continued) Failure to complete a formal risk assessment and evaluate safeguards increases the likelihood information security weaknesses will not be timely identified and corrected in the normal course of the University?s operations. Further, noncompliance with the Code could impact the University?s eligibility to participate in student financial assistance programs. (Finding Code 2019-003) Recommendation We recommend the University complete its formal risk assessment process over its student financial aid information. Further, the University should develop and implement safeguards to mitigate risks identified through the risk assessment process and monitor the effectiveness of these safeguards in accordance with the Code. University Response University staff did complete an initial risk assessment; however, given the project?s overall complexity and personnel resource constraints, there was insufficient time to present the draft report findings to University management by the end of the fiscal year on June 30, 2019. An executive summary report is currently under development by IT leadership, with input and support from Internal Audit, for presentation to the University?s leadership during Fiscal Year 2020 with action steps planned for risk mitigation going forward. University management will determine the frequency of subsequent risk assessments, focusing higher priorities on high to medium risk areas, as part of their ongoing risk mitigation efforts in this area.

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION