BETHANY LUTHERAN COLLEGE, INC.

Criteria: Section 18004(e) of the Coronavirus Aid, Relief, and Economic Security Act (CARES Act), directed institutions receiving funds under Section 18004 of the Act, to submit a new, separate form covering aggregate amounts spent for HEERF I, HEERF II, and HEERF III funds each quarterly reporting period (June 30, September 30, December 31, March 31), concluding after an institution has expended and liquidated all (a)(1) Student Portion, (a)(2), and (a)(3) funds and marks the ?final report? box. Condition/Context: The Corporation posted incomplete reports to their website as the information did not include the number of students eligible for emergency grants. In addition, reports for one of the quarters tested were not posted to the Corporation?s website within the required timeframe. Questioned Costs: Not applicable. Cause: The Corporation did not fill out the forms correctly nor in accordance with HEERF reporting requirements. Effect: The College did not provide the public with all required data related to the HEERF student portion aid and the reports for the quarter ended March 31, 2022 were not posted in a timely manner. Recommendation: The Corporation should assign an individual to monitor reporting requirements of awards to ensure the Corporation is in compliance.

Criteria: General procurement standards outlined in 2 CFR 200.318(a) state that a non-Federal entity must use its own documented procurement procedures which reflect applicable State, local, and tribal laws and regulations, provided that the procurements conform to the applicable Federal law and the standards identified by the Uniform Guidance (sections 200.318 ? 200.326). The Uniform Guidance outlines requirements over the proper oversight of contractors, having written standards of conduct for employees involved in contracting, awarding contracts to responsible contractors, maintaining records documenting the history of procurements including cost price analysis, conducting all transactions in a manner which provides full and open competition, having procedures for verifying that an entity with which it plans to enter into a covered transaction is not debarred, suspended, or otherwise excluded, utilizing the methods of procurement outlined in the Uniform Guidance, and ensuring every purchase order or contract includes the applicable provisions in Appendix II. Condition: The Corporation?s policies and procedures over procurement generally conform to the requirements outlined by the Uniform Guidance with an exception over a suspension and debarment policy. The Uniform Guidance establishes methods of procurements to be utilized which relate to the acquisition of both goods and services. While the Corporation has policies that outline procurement practices, these policies do not fully adhere to the requirements outlined by the Uniform Guidance. Subsequent to year-end, the Corporation did perform the appropriate check for suspension and debarment for the applicable vendors which did not identify any such issues in that regard. Questioned Costs: Not applicable. Context: We compared the Corporation's policies and procedures to the applicable sections of the Uniform Guidance by reviewing three suppliers of a total of six suppliers subject to such testing and obtained the associated supporting documentation for our selection. We noted for the three suppliers tested, the Corporation did not meet the requirement of verifying for vendor suspension or debarment. The sample was not statistically valid. Cause: The Corporation's policies were not reviewed to ensure all elements of Uniform Guidance were incorporated prior to entering into a contract with vendors for which federal funds were the source of the expenditure. Specifically, the Corporation?s practices were not designed appropriately to check for suspension and debarment of the contractor utilized. Effect: The Corporation is at risk of procuring goods and services that are not in compliance with the requirements outlined by Uniform Guidance, which increases the risk of federal expenditures being used improperly or the Corporation entering into a covered transaction with a vendor that is debarred, suspended, or otherwise excluded. Recommendation: We recommend the Corporation revise its policies and procedures to conform to the requirements of Uniform Guidance for the costs incurred with relevant awards, and implement procedures and controls to verify that a vendor with which it plans to enter into a covered transaction is not debarred, suspended, or otherwise excluded. Relevant employees should be trained on these new policies and procedures. Management?s response: The Corporation agrees with the finding. Immediately upon being informed of the requirement to check for suspension and debarment, the Corporation did complete such a review for all vendors with contracts over $10,000 for which all were found to be in good standing with the Federal government. Moving forward, the Corporation has informed staff of this clause and has implemented a policy to review expenditures involving Federal funding over $10,000 with the SAM website prior to procurement.

Criteria: Section 18004(e) of the Coronavirus Aid, Relief, and Economic Security Act (CARES Act), directed institutions receiving funds under Section 18004 of the Act, to submit a new, separate form covering aggregate amounts spent for HEERF I, HEERF II, and HEERF III funds each quarterly reporting period (September 30, December 31, March 31, June 30), concluding after an institution has expended and liquidated all (a)(1) Institutional Portion, (a)(2), and (a)(3) funds and checks the ?final report? box. Condition/Context: The Corporation posted inaccurate reports to their website as the information included amounts reported in the wrong column and did not include cumulative amounts in the top section. Following the identification of the finding, the Corporation submitted updated reports to reflect accurate presentation of the information noted previously. Questioned Costs: Not applicable. Cause: The Corporation did not fill out the forms correctly nor in accordance with HEERF reporting requirements. Effect: The Corporation did not provide the public with accurate and reliable data related to the HEERF Institutional Aid Portion. Recommendation: The Corporation should assign an individual to monitor reporting requirements of awards to ensure the Corporation is in compliance. Management's Response: The Corporation agrees with the finding. While the Corporation did not provide the public with data in proper columns and did not include cumulative amounts in the top section related to the HEERF Institutional Aid Portion, the amounts listed and what they were expensed for was correct. Based on the information provided to the Corporation by ED and attending other webinars regarding reporting requirements, the Corporation believed it had filed the reports correctly. The Corporation?s initial report was reviewed and accepted by ED on March 16, 2021. Based on that acceptance, the Corporation thought it was doing the reports correctly. Since the finding was identified during the audit, the Corporation has submitted the revised reports stated above. The Corporation has a committee to monitor reporting requirements of federal awards consisting of the Director of Financial Aid, Director of Accounting and Sr. VP of Finance and Administration.

Finding 2019-001: Significant Deficiency - Gramm-Leach Bliley Act (GLBA) Federal Program - Student Financial Assistance Cluster Federal Agency - U.S. Department of Education Pass-Through Entity - Not Applicable CFDA Number - 84.033, 84.268, 84.063, 84.038, 84.007 Federal Award Year - June 30, 2019 Criteria In accordance with Title IV regulations (16 CFR 314.1 (b)), an Institution must protect student financial aid information by designating an individual to coordinate the information security program, perform a risk assessment that addresses (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other systems failures, and document safeguards for identified risks. Condition The Institution has not designated an individual responsible for coordinating an information security program, nor has the Institution performed a risk assessments to address employee training and management related to information security as required by the Gramm-Leach Bliley Act (?GLBA?). Cause The Institution does not have a designator coordinator nor has procedures and processes in place specific to GLBA. Effect Failure to comply with the requirements of GLBA standards puts the Institution at risk of compromising consumer, nonpublic personal information. Questioned Costs None. Context Not applicable. Recommendation The institution should designate an individual responsible for coordinating the information security program. Additionally, the institution should perform and document an annual risk assessment to determine the institution's specific risks relevant to protecting consumer nonpublic personal information. At a minimum, the institution should have at least one risk statement aligned or referenced to each of the three required areas noted in the GLBA law at 16 CFR 314.4 (b). Finally, the institution should identify and document at least one safeguard (i.e., control) for each of the risks identified and documented in the risk assessment. Each control should be aligned or referenced to the risk(s) to which the safeguard applies. Management?s Response Management agrees with our comment. The Corporation will designate an individual responsible for coordinating the information security program. Risk assessments will be performed and documented on an annual basis to determine the Corporations specific risks relevant to protecting consumer nonpublic personal information. The Corporation will produce the appropriate number of risk statements and identify the appropriate number of safeguards that properly align with the risks documented.