Waukesha County Technical College DistrictHigher Education

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Federal Award Identification Number and Year: P007A214563-2023, P033A214563-2023, P063P212632-2023, P268K222632-2023 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: The District is responsible for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The minimum safeguards include eight required written information security program. Condition: The District's written information security program address 6 of the 8 minimum safeguards identified in the related regulations. The District's policy did not include written documentation for the remaining two required minimum safeguards. Questioned costs: None Context: The District's written information security program is in process of continued review and updating. During the year under audit, the required safeguards were not fully updated in the written policies. Cause: The District's policy reviews for compliance with the noted requirements were not completed prior to the fiscal year. Effect: The District's polices and procedures may not comply with all applicable requirements. Repeat Finding: The finding is not a repeat finding. Recommendation: We recommend the District review and update as necessary the written information security program(s) to include aspects required by regulations. Views of responsible officials: There is no disagreement with the audit finding. While WCTC has implemented practices that ensure the safeguards are in place, the appropriate documentation had not yet been updated. WCTC has completed the recommended revisions as required by the standards.

Federal Agency: U.S. Department of Education Federal Program Name: Student Financial Aid Cluster Assistance Listing Number: 84.007, 84.033, 84.063, 84.268 Federal Award Identification Number and Year: P007A214563-2023, P033A214563-2023, P063P212632-2023, P268K222632-2023 Award Period: July 1, 2022 through June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or specific requirement: Institutions must report student disbursement data to Common Organization and Disbursement (COD) system within 15 calendar days after the institution makes a disbursement or becomes aware of the need to make an adjustment to previously reported student disbursement data or expected student disbursement data (OMB N. 1845-0039). Condition: During testing we noted 2 instances of student disbursements were reported to COD more than 15 days after the date of disbursement. Questioned costs: None Context: A statistically valid sample of 40 student disbursement was selected for testing to ensure disbursements were reported to COD within 15 days of the date of disbursement. 2 of the selected payments were reported more than 15 days after the disbursement. Cause: Internal control process in effect at the time did not ensure that all disbursements were reported to COD with in the required 15-day time line. Effect: Some instances of student disbursements were not reported within the required timeline to COD. Repeat Finding: The finding is not a repeat finding. Recommendation: We recommend the District design and implement controls to ensure all student disbursements are reported to COD with in required timelines. Views of responsible officials: There is no disagreement with the audit finding. WCTC has added additional internal controls specific to the disbursement process in response to the audit. Implementing these various measures ensures timely COD disbursement reporting, including multi-layered file reviews and monthly reconciliations. These controls specifically targeted our audit findings, ensuring thorough file scrutiny and prompt rectification of discrepancies.

Criteria or Specific Requirement: Under 2 CFR 200.214 grantees are subject to the non-procurement debarment and suspension regulations applicable to federal agencies under 2 CFR 180. Under 2 CFR 180 grantees are prohibited from entering into ?covered transactions? with parties that are suspended or debarred. ?Covered transactions? include contracts for goods and services that are expected to equal or exceed $25,000. In addition, grantees are required to design and implement controls to ensure that the contractor is not suspended or debarred or otherwise excluded from participating in the transaction. Condition: During our testing of the suspension and debarment compliance requirement, we noted that the District has not designed and implemented a system of internal controls to ensure it complies with suspension and debarment requirements. Cause: The District?s current procurement policy does not contain documented procedures to ensure parties are not suspended or debarred. Effect: A party involved in a covered transaction with the District as part of the federal program may be suspended or debarred if proper controls are not implemented to ensure compliance. Repeat Finding: No Recommendation: We recommend the District design and implement control processes to ensure compliance related to debarment and suspension requirements. View of Responsible Officials: The District agrees with the auditor?s comments and has taken corrective action to ensure review of suspension and debarment is documented in accordance with updated procurement policies.