Urshan University

2025-003 Special Tests and Provisions Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing No. 84.063, 84.268 Federal Award Identification Number and Year: P063P248567 – 2025, P268K258567 – 2025, P268K256514 - 2025 Award Periods: July 1, 2024 through June 30, 2025 Type of Finding:  Significant Deficiency in Internal Control Over Compliance  Other Matters Criteria or specific requirement: Per Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. The Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Changes to said status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days. The Code of Federal Regulations, 34 CFR 685.309(b), states the school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date. Condition: The University did not properly report student enrollment changes for students who received federal student aid to the National Student Loan Data System (NSLDS). Questioned Costs: None Context: During our testing of 17 students, we identified 1 student whose enrollment status change was not reported, 2 students with incorrect status changes reported for program-level reporting, 2 students with an incorrect effective date reported, and 9 students whose status changes were not reported in a timely manner. We also identified that for all 17 of the selected students, enrollment status was not certified every 60 days. Additionally. the University did not document any evidence of review over enrollment reporting. Cause: The University did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: The University was not in compliance with the requirements to properly report student enrollment data correctly. Incorrect dates submitted to NSLDS may be used to determine the grace period for the repayment and interest of outstanding Title IV student loans. Repeat findings: 2024-004 Recommendation: We recommend the University review current processes for reporting to NSLDS and implement procedures to ensure submissions are reported timely and accurately. Views of Responsible Officials: There is no disagreement with the audit finding.

2025-004 Special Tests and Provisions Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing No. 84.063, 84.268 Federal Award Identification Number and Year: P063P248567 – 2025, P268K258567 – 2025, P268K256514 - 2025 Award Periods: July 1, 2024 through June 30, 2025 Type of Finding:  Significant Deficiency in Internal Control Over Compliance  Other Matters Criteria or specific requirement: 34 CFR 668.21(a) states that the institution must return all title IV, HEA program funds that were credited to the student's account at the institution or disbursed directly to the student for the payment period. The institution must return those funds no later than 30 days after the date that the institution becomes aware that the student will not or has not begun attendance. Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University did not properly evaluate students in need of Return of Title IV (R2T4) calculations. Questioned Costs: None Context: During our testing of 5 R2T4 calculations, we identified 2 students with no R2T4 calculation performed. These students attended more than 60% of the term and did not require returned funds. Additionally, we identified 3 R2T4 calculations that did not have documentation of review. Cause: The University did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: The University could return incorrect amounts based off of their calculations and incorrect calculations could effect student repayment amounts based off of amount earned. Repeat findings: 2024-005 Recommendation: We recommend that the University review policies and procedures related to R2T4 calculations to ensure calculations are performed accurately. Views of Responsible Officials: There is no disagreement with the audit finding.

2025-005 Special Tests and Provisions Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing No. 84.063, 84.268 Federal Award Identification Number and Year: P063P248567 – 2025, P268K258567 – 2025, P268K256514 - 2025 Award Periods: July 1, 2024 through June 30, 2025 Type of Finding:  Significant Deficiency in Internal Control Over Compliance  Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The regulation states that the college must designate a qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program. (16 CFR 314.4(a)). The entity shall have a Written Information Security Program (WISP) that outlines the design and implementation of the risk assessment procedures. (16 CFR 314.4(b)). At a minimum, the institution's written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University has a Written Information Security Program; however, the University did not meet the minimum requirements stated in the Gramm-Leach-Bliley Act. Additionally, we were unable to observe evidence that the WISP was formally reviewed and approved. Questioned Costs: None Context: The WISP was missing the element discussing the secure disposal of customer information. Additionally, there was not an observable formal review or authorization.. Cause: The University did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: There is a risk the University’s information and systems could be vulnerable to attacks or intrusions, and these attacks may not be detected in a timely manner. Repeat findings: 2024-006 Recommendation: We recommend that the University review the GLBA requirements and ensure their WISP includes all required elements. Views of Responsible Officials: There is no disagreement with the audit finding.

2025-006 Eligibility Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing No. 84.063, 84.268 Federal Award Identification Number and Year: P063P248567 – 2025, P268K258567 – 2025, P268K256514 - 2025 Award Periods: July 1, 2024 through June 30, 2025 Type of Finding:  Significant Deficiency in Internal Control Over Compliance  Other Matters Criteria or specific requirement: Per Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Per 34 CFR 690.62 states the Pell grant for an academic year is based upon the payment and disbursement schedule published by the Secretary for each award year. 34 CFR 690.80(b)(1)) states if the student’s enrollment status changes from one academic term to another within the same award year, the institution shall recalculate the Federal Pell Grant award for the new payment period taking into account any changes in the cost of attendance. Condition: The University used a third-party servicer to perform key controls, but did not have documented review of the work performed by their third-party servicer. Additionally, the University incorrectly disbursed Pell funds for 10 students. Questioned Costs: $12,949 Context: During our eligibility testing of 60 students, we identified that the University did not document evidence of review for controls over award packaging performed by their third party servicer. Additionally, out of 43 students receiving Pell, 10 were under awarded. Cause: The University did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: Without proper controls the University risks being out of compliance with federal laws and regulations, as well as program compliance requirements. Repeat findings: 2024-007 Recommendation: We recommend the University review its current procedures for awarding Title IV funds and implement any changes necessary to ensure federal funds are awarded and disbursed in accordance with federal regulations. Views of Responsible Officials: There is no disagreement with the audit finding.

2025-007 Special Tests and Provisions Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing No. 84.063, 84.268 Federal Award Identification Number and Year: P063P248567 – 2025, P268K258567 – 2025, P268K256514 - 2025 Award Periods: July 1, 2024 through June 30, 2025 Type of Finding:  Significant Deficiency in Internal Control Over Compliance  Other Matters Criteria or specific requirement: Per Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University was unable to provide documentation of review for controls surrounding credit balance disbursements. Questioned Costs: None Context: The University did not have documented review of controls to ensure credit balance funds that were not successfully disbursed to the student were returned to the Department of Education after 240 days. Cause: The University did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: Without proper controls the University risks being out of compliance with federal laws and regulations, as well as program compliance requirements. Repeat findings: No Recommendation: We recommend the University design controls to ensure an adequate review process is in place to ensure compliance over stale checks that need to be returned to the Department of Education after 240 days. Views of Responsible Officials: There is no disagreement with the audit finding.

2025-008 Cash Management Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing No. 84.063, 84.268 Federal Award Identification Number and Year: P063P248567 – 2025, P268K258567 – 2025, P268K256514 - 2025 Award Periods: July 1, 2024 through June 30, 2025 Type of Finding:  Significant Deficiency in Internal Control Over Compliance  Other Matters Criteria or specific requirement: Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University did not have documentation that Direct Loan Reconciliations or Pell Reconciliations prepared by third-party servicer were reviewed. Additionally, we were unable to observe evidence that the University reviewed cash drawdowns prepared by the third party processor. Questioned Costs: None Context: During our testing, we reviewed 4 months of direct loan reconciliations that the University's third party servicer prepares; however, Urshan was unable to provide documentation of review for these reconciliations. Additionally, during our testing of 5 draws, we identified that all 5 draws did not have documented evidence of review. Cause: The University did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: Without proper controls the University risks being out of compliance with federal laws and regulations, as well as program compliance requirements. Repeat findings: 2024-009 Recommendation: We recommend that the University should implement formal review procedures to document that the Cash Management reconciliation and drawdown reviews are being performed to correct errors in a timely manner and to minimize the likelihood of errors going undetected. Views of Responsible Officials: There is no disagreement with the audit finding.

2025-009 Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing No. 84.063, 84.268 Federal Award Identification Number and Year: P063P248567 – 2025, P268K258567 – 2025, P268K256514 - 2025 Award Periods: July 1, 2024 through June 30, 2025 Type of Finding:  Significant Deficiency in Internal Control Over Compliance  Other Matters Criteria or specific requirement: Per Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University used a third-party servicer to perform key controls, but did not have documented review of the work performed by their third-party servicer. Additionally, 1 disbursement was incorrectly reported to COD. Questioned Costs: None Context: During our testing of 60 COD disbursements, we noted 1 disbursement that was incorrectly reported. We also noted that the University did not have documentation of review for COD disbursements. Cause: This discrepancy resulted from the student being initially packaged by Campus Ivy using the 01 ISIR transaction, which reflected an SAI of -1500. Subsequent ISIR transactions that significantly impacted eligibility were not identified prior to packaging. These discrepancies were later identified during the University’s internal HCM2 reconciliation process in collaboration with FA Solutions, resulting in a mismatch between awarded aid and COD records. Effect: Without proper controls the University risks being out of compliance with federal laws and regulations, as well as program compliance requirements. Repeat findings: No Recommendation: We recommend the University design controls to ensure an adequate review process is in place to ensure compliance with reporting requirements. Views of Responsible Officials: There is no disagreement with the audit finding.

2024-004 8540.032 Department Of Education Student Financial Aid 84.063, 84.268 "P063P218567-2024 P268K228567-2024" N/A N/A 7/1/23 - 6/30/24 Significant Deficiency Did not result in material questioned costs therefore will document as a SD. Finding is neither systemic nor will it lead to 5% questioned cost. N/A "Per Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. The Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Changes to said status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days. The Code of Federal Regulations, 34 CFR 685.309(b), states the school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date. " The University did not properly report student enrollment changes for students who received federal student aid to the National Student Loan Data System (NSLDS). N/A "During our testing of 9 students, we identified 4 students whose enrollment status changes were not reported, 1 student with an incorrect effective date reported, 1 student with an incorrect program begin date, and 6 students whose status changes were not reported timely. In addition, 1 student was incorrectly reported as withdrawal who should not have had a status change reported. We also note that for 7 of the selected students, enrollment status was not certified every 60 days. We also note that the University did not document any evidence of review." The college did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. The University was not in compliance with the requirements to properly report student enrollment data correctly. Incorrect dates submitted to NSLDS may be used to determine the grace period for the repayment and interest of outstanding Title IV student loans. Yes We recommend the University review current processes for reporting to NSLDS and implement procedures to ensure submissions are reported timely and accurately. Management agrees with this finding. See 0100.25

2024-005 8540.10 Department Of Education Student Financial Aid 84.063, 84.268 "P063P218567-2024 P268K228567-2024" N/A N/A 7/1/23 - 6/30/24 Material Weakness Material Appears to be systemic. "34 CFR 668.21(a) states that the institution must return all title IV, HEA program funds that were credited to the student's account at the instituion or disbursed directly to the student for th payment period. The instituion must return those funds no later than 30 days after the date that the instituion becomes aware that the student will not or has not begun attendance. Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements." The University did not properly evaluate students in need of Return of Title IV (R2T4) calculations. 283.39 "During our testing of 6 R2T4 calculations, we noted that 4 students were incorrectly evaluated as a withdrawal exemption and no R2T4 calculation was performed. For these 4 students, all 4 should have had an R2T4 calculation, and 2 should have had returned funds. In addition, we observed 1 student for whom 100% of funds were returned despite the student completing a portion of the term. We also noted 1 student who completed the term with passing grades for whom an R2T4 calculation was completed, and funds were returned in error. Additionally, R2T4 calculations did not have documentation of review." The college did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. The University could return incorrect amounts based off of their calculations and incorrect calculations could effect student repayment amounts based off of amount earned. No We recommend that the University review policies and procedures related to R2T4 calculations to ensure calculations are performed accurately. Management agrees with this finding. See 0100.25

2024-006 8540.13 Department Of Education Student Financial Aid 84.063, 84.268 "P063P218567-2024 P268K228567-2024" N/A N/A 7/1/23 - 6/30/24 Significant Deficiency Did not result in material questioned costs therefore will document as a SD. Finding is neither systemic nor will it lead to 5% questioned cost. N/A "The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The regulation states that the college must designate a qualified individual responsible for overseeing and implementting your information security program and enforcing your information security program. (16 CFR 314.4(a)). The entity shall have a Written Information Security Program (WISP) that outlines the design and implementation of the risk assessment procedures. (16 CFR 314.4(b)). At a minimum, the institution's written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements." "The College has a Written Information Security Program; however, the College did not meet the minimum requirements stated in the Gramm-Leach-Bliley Act. Additionally, we were unable to observe evidence that the WISP was formally reviewed and approved. " N/A "The WISP was missing the element discussing the secure disposal of customer information. Additionally, there was not am observable formal review or authorization. " The college did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. There is a risk the College’s information and systems could be vulnerable to attacks or intrusions, and these attacks may not be detected in a timely manner. Yes We recommend the College design controls to ensure an adequate review process is in place to ensure compliance with reporting requirements. Management agrees with this finding. See 0100.25

2024-007 8515.01 Department Of Education Student Financial Aid 84.063, 84.268 "P063P218567-2024 P268K228567-2024" N/A N/A 7/1/23 - 6/30/24 Significant Deficiency Did not result in material questioned costs therefore will document as a SD. Finding is neither systemic nor will it lead to 5% questioned cost. N/A "Per Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. The Code of Federal Regulations, 34 CFR 682.604, states that a school must ensure that exit counseling is conducted with each Stafford Loan borrower and graduate or professional student PLUS Loan borrower either in person, by audiovisual presentation, or by interactive electronic means. In each case, the school must ensure that this counseling is conducted shortly before the student borrower ceases at least half-time study at the school. Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Per 34 CFR 690.62 states the Pell grant for an academic year is based upon the payment and disbursement schedule published by the Secretary for each award year. 34 CFR 690.80(b)(1)) states if the student’s enrollment status changes from one academic term to another within the same award year, the institution shall recalculate the Federal Pell Grant award for the new payment period taking into account any changes in the cost of attendance." The University used a third-party servicer to perform key controls, but did not have documented review of the work performed by their third-party servicer. Additionally, the University did not notify 3 students of required exit counseling. The University also incorrectly disbursed Pell funds for 4 students. 1845 E During our eligibility testing of 60 students, we noted that the university did not document evidence of review for controls performed by their third party servicer. The University did not document review of award packaging, professional judgment determinations, COD reporting, or verification procedures. We also noted that 3 students were graduates or withdrawals but did not receive notifcation of required exit counseling. Additionally, out of 37 students receiving Pell, 3 were overawarded and 1 was underawarded. 1 student had an incorrect EFC used in their award packaging. The college did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Without proper controls the University risks being out of compliance with federal laws and regulations, as well as program compliance requirements. No We recommend the College design controls to ensure an adequate review process is in place to ensure compliance with reporting requirements. Management agrees with this finding. See 0100.25

2024-008 8540.17 Department Of Education Student Financial Aid 84.063, 84.268 "P063P218567-2024 P268K228567-2024" N/A N/A 7/1/23 - 6/30/24 Significant Deficiency Did not result in material questioned costs therefore will document as a SD. Finding is neither systemic nor will it lead to 5% questioned cost. N/A "The Code of Federal Regulations, 34 CFR 668.164(h)(2) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. Per Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements." Six Title IV checks were observed during testing that were stale more than 240 days. 4333.85 The University had six stale Title IV checks greater than 240 days The college did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Funds are not returned to the Department of Education in a timely manner No We recommend that the University review policies and procedures related to student refund checks to ensure stale checks are returned to the Department of Education. Management agrees with this finding. See 0100.25

2024-009 8565.02 Department Of Education Student Financial Aid 84.063, 84.268 "P063P218567-2024 P268K228567-2024" N/A N/A 7/1/23 - 6/30/24 Significant Deficiency Did not result in material questioned costs therefore will document as a SD. Finding is neither systemic nor will it lead to 5% questioned cost. N/A "The Code of Federal Regulations (34 CFR 685.300(b)(5)) and the Federal Student Aid Handbook, Volume 4, Chapter 6, states loan reconciliation is a mandatory monthly process requiring the comparison of both internal and external records to be completed by an institution participating in the Direct Loan Program. Reconciliation is conducted to identify and resolve differences between net draws and disbursements reported to the Common Origination and Disbursement for a specific award year. An institution must document the reasons and resolve the discrepancies identified during the reconciliation process and that a review had been performed. Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements." The University did not have documentation that Direct Loan Reconciliation prepared by third-party servicer was reviewed. N/A During our testing we examined four months of direct loan reconciliations (August, December, March, & May). For all four, the University's third party servicer (Campus Ivy) performed preparation and review of the reconciliation; however, Urshan did not review the work of Campus Ivy or a SOC1 report. The college did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Without proper controls the University risks being out of compliance with federal laws and regulations, as well as program compliance requirements. No We recommend the College design controls to ensure an adequate review process is in place to ensure compliance with reporting requirements. Management agrees with this finding. See 0100.25

2024-010 8540.15 Department Of Education Student Financial Aid 84.063, 84.268 "P063P218567-2024 P268K228567-2024" N/A N/A 7/1/23 - 6/30/24 Significant Deficiency Control finding did not result in material questioned costs-therefore we will document as a SD. N/A - I/C Finding Only Finding is neither systemic nor will it lead to 5% questioned cost. N/A Per Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. The University used a third-party servicer to perform key controls, but did not have documented review of the work performed by their third-party servicer. Additionally, we were unable to observe evidence that the University reviewed cash drawdowns prepared by the third party processor. N/A During our testing of Credit Balance refunds, CLA observed that the University did not have documentation of formal review. Additionally, during our testing of Cash Management CLA observed two draws that we were unable to verify review occurred. The college did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Without proper controls the University risks being out of compliance with federal laws and regulations, as well as program compliance requirements. No We recommend the College design controls to ensure an adequate review process is in place to ensure compliance with reporting requirements. Management agrees with this finding. See 0100.25

2023-004 Eligibility Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing No. 84.063 Federal Award Identification Number and Year: P063P218567-20233 Award Periods: July 1, 2022 through June 30, 2023 Type of Finding: - Significant Deficiency in Internal Control Over Compliance - Other Matters Criteria or specific requirement: The DoE requires institution to report the disbursement dates and amounts to the COD system within 15 days of disbursing Pell (34 CFR 690.83(b)(2) and Direct Loan (34 CFR 685.309) funds to a student. Condition: Of the 60 disbursements tested, one (1) had incorrect disbursement dates to the COD system. Questioned Costs: None Context: During our testing, of the 60 disbursements tested, one (1) had incorrect disbursement dates to the COD system. While performing audit procedures, it was noted that information was incorrectly reported to the COD and was not updated within the 15-day reporting time frame. Cause: The College did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: Student interest accrues based on disbursement date reported to COD, thus interest calculation could be skewed due to the discrepancy in disbursement dates reported. Repeat findings: 2022-003 Recommendation: We recommend the College provide additional resources to ensure all compliance requirements are met. Views of Responsible Officials: There is no disagreement with the audit finding.

2023-005 Eligibility Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing No. 84.063, 84.268 Federal Award Identification Number and Year: P063P218567-2023, P268K228567-2023 Award Periods: July 1, 2022 through June 30, 2023 Type of Finding: - Significant Deficiency in Internal Control Over Compliance - Other Matters Criteria or specific requirement: The Code of Regulations (34 CFR 668.34) Satisfactory academic progress. An institution must establish a reasonable satisfactory academic progress policy for determining whether an otherwise eligible student is making satisfactory academic progress in his or her educational program and may receive assistance under the title IV, HEA programs. The Secretary considers the institution's policy to be reasonable if: (1) Provide a policy that, if at the time of each evaluation, the student has not achieved the required GPA, is not successfully completing their program of study at the required pace (if required), or has not completed the program within the maximum time frame, they no longer are eligible for Title IV aid; (2) Provides specific procedures for disbursements to students on financial aid warning status or financial aid probation status; (3) If the institution permits the student to appeal a determination, provides specific procedures how the student may reestablish eligibility to receive Title IV; basis on which a student may file an appeal; and information that the student must submit regarding why they failed satisfactory academic progress and how they have changed that will now allow the student to make satisfactory academic progress at the next evaluation; (4) If the institution does not permit the student to appeal a determination, describes how a student may reestablish their eligibility to receive Title IV assistance; and (5) Provides for notification to the students of their results of an evaluation that impacts their eligibility for Title IV. Condition: Of the sixty (60) students tested for eligibility, one (1) student was on suspension status after the Spring 2022 semester due to not meeting the 67% completion rate and continued to fall below the completion rate in Fall 2022 and Spring 2023 semesters. Student did not receive a letter of suspension because they were meeting the GPA requirement and the Financial Aid office was not assessing completion status. The student's account showed a SAP status of Suspension for the 3 semesters; however, the student did not receive a letter of suspension or submit an appeal to continue to receive Aid. Questioned Costs: None. Context: Of the sixty (60) students tested for eligibility, one (1) student was on suspension status after the Spring 2022 semester due to not meeting the 67% completion rate and continued to fall below the completion rate in Fall 2022 and Spring 2023 semesters. Student did not receive a letter of suspension because they were meeting the GPA requirement and the Financial Aid office was not assessing completion status. The student's account showed a SAP status of Suspension for the 3 semesters; however, the student did not receive a letter of suspension or submit an appeal to continue to receive Aid. Cause: The College did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: Failure to properly assess student's SAP status based on the policy may result in students receiving funds they are no longer qualified for. Repeat findings: N/A Recommendation: We recommend the College design controls to ensure an adequate review process is in place to ensure compliance with reporting requirements. Views of Responsible Officials: There is no disagreement with the audit finding.

2023-006 Special Tests and Provisions Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing No. 84.063, 84.268 Federal Award Identification Number and Year: P063P218567-2023, P268K228567-2023 Award Periods: July 1, 2022 through June 30, 2023 Type of Finding: - Significant Deficiency in Internal Control Over Compliance - Other Matters Criteria or specific requirement: The Code of Federal Regulations (34 CFR 685.309) requires enrollment status changes for students be reported to NSLDS within 30 days or within 60 days if the student with the status change will be reported on a scheduled transmission within 60 days of the change in status. Regulations require the status include an accurate effective date. Uniform Grant Guidance (2 CFR 200.303) requires nonfederal entities receiving Federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure enrollment reporting is completed properly. Condition: Out of the eight students, from a statistically valid sample, we noted all eight (8) students status changes were reported after the 60-day reporting requirement. We also noted for the same eight students that enrollment was not certified 60 days. In addition, the enrollment reports do not have a documented review before they are uploaded. Questioned Costs: None Context: Out of the eight students, from a statistically valid sample, we noted all eight (8) students status changes were reported after the 60-day reporting requirement. We also noted for the same eight students that enrollment was not certified in 60 days. In addition, the enrollment reports do not have a documented review before they are uploaded. Cause: The College did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: If the NSLDS system is not updated with the student information, over awards could occur should the student transfer to another institution and the students may not properly enter the repayment period. Repeat findings: 2022-005 Recommendation: We recommend the College design controls to ensure an adequate review process is in place to ensure compliance with reporting requirements. Views of Responsible Officials: There is no disagreement with the audit finding.

2023-007 Special Tests and Provisions Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing No. 84.063, 84.268 Federal Award Identification Number and Year: P063P218567-2023, P268K228567-2023 Award Periods: July 1, 2022 through June 30, 2023 Type of Finding: - Significant Deficiency in Internal Control Over Compliance - Other Matters Criteria or specific requirement: Per the NSLDS reporting guide: The Program Begin Date is the date the student first began attending the program being reported. Typically, this would be the first day of the term in which the student began enrollment in the program, unless the student enrolled in the program on an earlier date. Also, per the NSLDS reporting guide (section 2.4.1 – NSLDS tracks how many students, included on a school’s Roster file, were certified with Program Level information and whether a school has reported programs with a 2020 CIP Year (Enrollment Reporting Statistics). This information is used to determine whether a school is complying with applicable regulations and guidance. Schools must ensure that all students enrolled in programs are reported with programs, as well as report a status for all programs on their Roster. Schools found to be non-compliant with NSLDS enrollment reporting requirements will receive a series of warning letters before being referred for compliance action. Additionally, having the correct CIP and program start date, allows NSLDS to determine if a borrower will lose subsidy (2.4.2). Condition: Out of the sample of eight students, we noted two (2) students whose program beginning dates that were reported to NSLDS did not agree to the institutions records. Questioned Costs: None Context: Out of the sample of eight students, we noted two (2) students whose program beginning dates that were reported to NSLDS did not agree to the institutions records. Cause: The College did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: If the NSLDS system is not updated with the student information, over awards could occur should the student transfer to another institution and the students may not properly enter the repayment period. Repeat findings: 2022-006 Recommendation: We recommend the College design controls to ensure an adequate review process is in place to ensure compliance with reporting requirements. Views of Responsible Officials: There is no disagreement with the audit finding.

2023-008 Special Tests and Provisions Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing No. 84.063, 84.268 Federal Award Identification Number and Year: P063P218567-2023, P268K228567-2023 Award Periods: July 1, 2022 through June 30, 2023 Type of Finding: - Significant Deficiency in Internal Control Over Compliance - Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The regulation states that the college must designate a qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program. (16 CFR 314.4(a)). The entity shall have a Written Information Security Program (WISP) that outlines the design and implementation of the risk assessment procedures. (16 CFR 314.4(b)). At a minimum, the institution's written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The College has now created a Written Information Security Program; however, the College did not meet the minimum requirements stated in the Gramm-Leach-Bliley Act. Additionally, the College did not designate a qualified individual responsible for overseeing and implementing the information and security program. Questioned Costs: None Context: The College now has a Written Information Security Program; however, the College did not meet the minimum requirements stated in the Gramm-Leach-Bliley Act. Additionally, the College did not designate a qualified individual responsible for overseeing and implementing the information and security program. Cause: The College did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: There is a risk the College’s information and systems could be vulnerable to attacks or intrusions, and these attacks may not be detected in a timely manner. Repeat findings: 2022-007 Recommendation: We recommend the College design controls to ensure an adequate review process is in place to ensure compliance with reporting requirements. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-003 Eligibility Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing No. 84.063, 84.268 Federal Award Identification Number and Year: P063P218567-2022, P268K228567-2022 Award Periods: July 1, 2021 through June 30, 2022 Type of Finding: ? Material Weakness in Internal Control Over Compliance ? Other Matters Criteria or specific requirement: The DoE requires institution to report the disbursement dates and amounts to the COD system within 15 days of disbursing Pell (34 CFR 690.83(b)(2) and Direct Loan (34 CFR 685.309) funds to a student. Condition: During our testing, of the 60 disbursements tested, twenty four (24) had incorrect disbursement dates to the COD system. Questioned Costs: None Context: During our testing, of the 60 disbursements tested, twenty four (24) had incorrect disbursement dates to the COD system. While performing audit procedures, it was noted that information was incorrectly reported to the COD and was not updated within the 15-day reporting time frame. Cause: The College did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: Student interest accrues based on disbursement date reported to COD, thus interest calculation could be skewed due to the discrepancy in disbursement dates reported. Repeat findings: 2021-005 Recommendation: We recommend the College provide additional resources to ensure all compliance requirements are met. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-004 Eligibility Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing No. 84.063 Federal Award Identification Number and Year: P063P218567-2022 Award Periods: July 1, 2021 through June 30, 2022 Type of Finding: ? Significant Deficiency in Internal Control Over Compliance ? Other Matters Criteria or specific requirement: The Code of Regulations (34 CFR 690.79) Liability for and recovery of Federal Pell Grant overpayments. A student is liable for any Federal Pell Grant overpayment made to him or her except for the following 2 situations: (1) The institution is liable for a Federal Pell Grant overpayment if the overpayment occurred because the institution failed to follow the procedures set forth in this part or 34 CFR Part 668. The institution must restore an amount equal to the overpayment to its Federal Pell Grant account; or (2) A student is not liable for, and the institution is not required to attempt recovery of or refer to the Secretary, a Federal Pell Grant overpayment if the amount of the overpayment is less than $25 and is not a remaining balance. Condition: During our testing, of the sixty (60) students tested for eligibility, three (3) students had more aid awarded and disbursed than what was earned. Questioned Costs: $3,757 Context: During our testing, of the sixty (60) students tested for eligibility, three (3) students had more aid awarded and disbursed than what was earned. Cause: The College did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: Failure to properly determine and disburse Title IV funds based on eligibility for each type of aid in accordance with federal regulations may result in students receiving incorrect funds. Repeat findings: N/A Recommendation: We recommend the College design controls to ensure an adequate review process is in place to ensure compliance with reporting requirements. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-005 Special Tests and Provisions Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing No. 84.063, 84.268 Federal Award Identification Number and Year: P063P218567-2022, P268K228567-2022 Award Periods: July 1, 2021 through June 30, 2022 Type of Finding: ? Significant Deficiency in Internal Control Over Compliance ? Other Matters Criteria or specific requirement: The Code of Federal Regulations (34 CFR 685.309) requires enrollment status changes for students be reported to NSLDS within 30 days or within 60 days if the student with the status change will be reported on a scheduled transmission within 60 days of the change in status. Regulations require the status include an accurate effective date. Uniform Grant Guidance (2 CFR 200.303) requires nonfederal entities receiving Federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure enrollment reporting is completed properly. Condition: Throughout the 2021-22 award year, we noted error records were being returned on the enrollment reporting rosters that were sent to National Student Loan Data System (NSLDS) and those error records were not being corrected and resubmitted within the required 10 days. Out of the eight students, from a statistically valid sample, we noted five (5) students status changes were reported after the 60-day reporting requirement. We also noted for the same five students that enrollment was not certified 60 days. In addition, the enrollment reports do not have a documented review before they are uploaded. Questioned Costs: None Context: Throughout the 2021-22 award year, we noted error records were being returned on the enrollment reporting rosters that were sent to National Student Loan Data System (NSLDS) and those error records were not being corrected and resubmitted within the required 10 days. Out of the eight students, from a statistically valid sample, we noted five (5) students status changes were reported after the 60-day reporting requirement. We also noted for the same five students that enrollment was not certified 60 days. Cause: The College did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: If the NSLDS system is not updated with the student information, over awards could occur should the student transfer to another institution and the students may not properly enter the repayment period. Repeat findings: 2021-007 Recommendation: We recommend the College design controls to ensure an adequate review process is in place to ensure compliance with reporting requirements. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-006 Special Tests and Provisions Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Award Identification Number and Year: P063P218567-2022, P268K228567-2022 Assistance Listing No. 84.063, 84.268 Award Periods: July 1, 2021 through June 30, 2022 Type of Finding: ? Significant Deficiency in Internal Control Over Compliance ? Other Matters Criteria or specific requirement: Per the NSLDS reporting guide: The Program Begin Date is the date the student first began attending the program being reported. Typically, this would be the first day of the term in which the student began enrollment in the program, unless the student enrolled in the program on an earlier date. Also, per the NSLDS reporting guide (section 2.4.1 ? NSLDS tracks how many students, included on a school?s Roster file, were certified with Program Level information and whether a school has reported programs with a 2020 CIP Year (Enrollment Reporting Statistics). This information is used to determine whether a school is complying with applicable regulations and guidance. Schools must ensure that all students enrolled in programs are reported with programs, as well as report a status for all programs on their Roster. Schools found to be non-compliant with NSLDS enrollment reporting requirements will receive a series of warning letters before being referred for compliance action. Additionally, having the correct CIP and program start date, allows NSLDS to determine if a borrower will lose subsidy (2.4.2). Condition: Out of the sample of eight students, we noted four (4) students whose program beginning dates that were reported to NSLDS did not agree to the institutions records. Questioned Costs: None Context: Out of the sample of eight students, we noted four (4) students whose program beginning dates that were reported to NSLDS did not agree to the institutions records. Cause: The College did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: If the NSLDS system is not updated with the student information, over awards could occur should the student transfer to another institution and the students may not properly enter the repayment period. Repeat findings: 2021-008 Recommendation: We recommend the College design controls to ensure an adequate review process is in place to ensure compliance with reporting requirements. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-007 Special Tests and Provisions Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing No. 84.063, 84.268 Federal Award Identification Number and Year: P063P218567-2022, P268K228567-2022 Award Periods: July 1, 2021 through June 30, 2022 Type of Finding: ? Significant Deficiency in Internal Control Over Compliance ? Other Matters Criteria or specific requirement: The Standards for Safeguarding Customer Information, required by the Gramm-Leach-Bliley Act (GLBA) (16 CFR 314.4 (b)), requires customers to identify reasonable foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information, and assess the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risk in each relevant area of operations, including: 1. Employee training and management; 2. Information systems, including network and software design, as well as information processing, storage, transmission, and disposal; and 3. Detecting, preventing, and responding to attacks, intrusions, or other system failures. Uniform Grant Guidance (2 CFR 200.303) requires nonfederal entities receiving Federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures for timely review of the Information Security Program and proper documentation of the risk assessments. Condition: As a requirement under the College's Program Participation Agreement with the Department of Education, the College must protect student financial aid information. However, during our testing, we noted the College had not properly conducted a risk assessment identifying all internal and external risks to the security, confidentiality, and the integrity of the students? information. Questioned Costs: None Context: As a requirement under the College's Program Participation Agreement with the Department of Education, the College must protect student financial aid information. However, during our testing, we noted the College had not properly conducted a risk assessment identifying all internal and external risks to the security, confidentiality, and the integrity of the students? information. Cause: The College did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: Without documentation of a proper risk assessment, the College is at risk of noncompliance with the GLBA. In addition, there is a risk the College?s information and systems could be vulnerable to attacks or intrusions, and these attacks may not be detected in a timely manner. Repeat findings: 2021-010 Recommendation: We recommend the College design controls to ensure an adequate review process is in place to ensure compliance with reporting requirements. After year end, the College engaged CLA to assist with the GLBA process for the next fiscal year. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-008 Inadequate Schedule of Federal Expenditures Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing No. 84.063, 84.268 Federal Award Identification Number and Year: P063P218567-2022, P268K228567-2022 Award Periods: July 1, 2021 through June 30, 2022 Type of Finding: ? Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: CFR ?200.510(b) of the Uniform Guidance requires the auditee to prepare a SEFA for the period covered by the auditee?s financial statements which must include the total federal awards expended as determined in accordance with ?200.502 of the Uniform Guidance, ?Basis for Determining Federal Awards Expended. Condition: Though the College provided a Schedule of Federal Expenditures, the College did not have the controls in place to provide a Schedule of Federal Expenditures timely. Questioned Costs: None Context: The College did not have the controls in place to provide a Schedule of Federal Expenditures in a timely manner. Cause: The College did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: An incorrect Schedule of Federal Expenditures can delay an audit beyond the reporting deadline and cause unnecessary audit costs. Also, the delay could cause the College not to be in compliance with the DCF submission. Repeat findings: 2021-011 Recommendation: We recommend the College design controls to ensure an adequate review process is in place to ensure compliance with reporting requirements. Views of Responsible Officials: There is no disagreement with the audit finding.

2022-009 Eligibility Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing No. 84.268 Federal Award Identification Number and Year: P268K228567-2022 Award Periods: July 1, 2021 through June 30, 2022 Type of Finding: ? Significant Deficiency in Internal Control Over Compliance ? Other Matters Criteria or specific requirement: The Code of Regulations (34 CFR 668.164(i)(2)) Early Disbursements. An institution may not: (1) Make an early disbursement of a Direct Loan to a first-year, first-time borrower who is subject to the 30-day delayed disbursement requirements in 34 CFR 685.303(b)(5). This restriction does not apply if the institution is exempt from the 30-day delayed disbursement requirements under 34 CFR 685.303(b)(5)(i)(A) or (B); or (2) Compensate a student employed under the FWS program until the student earns that compensation by performing work, as provided in 34 CFR 675.16(a)(5). Condition: During our testing, Of the sixty (60) students tested for eligibility, one (1) student, who was a first-time borrower, was disbursed aid before the 30-day requirement. Questioned Costs: None Context: During our testing, Of the sixty (60) students tested for eligibility, one (1) student, who was a first-time borrower, was disbursed aid before the 30-day requirement. Cause: The College did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: Failure to properly disburse Title IV funds based on requirements in accordance with federal regulations may result in noncompliance with regulations. Repeat findings: N/A Recommendation: We recommend the College design controls to ensure an adequate review process is in place to ensure compliance with reporting requirements. Views of Responsible Officials: There is no disagreement with the audit finding.

2021-004 Cash Management Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing No. 84.268 Award Periods: July 1, 2020 through June 30, 2021 Type of Finding: - Significant Deficiency in Internal Control Over Compliance - Other Matters Criteria or specific requirement: Uniform Grant Guidance (2 CFR 200.303) requires nonfederal entities receiving Federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure students are awarded and disbursed the proper federal fund amounts. Condition: In one (1) of our ten (10) drawdowns selected from the G5 External Award Activity Report for testing, Funds were not properly disbursed within 3 days of receipt. Questioned Costs: None Context: In one (1) of our ten (10) drawdowns selected from the G5 External Award Activity Report for testing, Funds were not properly disbursed within 3 days of receipt. Cause: The College did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: Drawing federal funds before federal aid expenses are incurred may result in funds being drawn in advance of the College?s immediate cash needs. Repeat findings: 2020-003 Recommendation: We recommend the College provide additional resources to ensure all compliance requirements are met. Views of Responsible Officials: There is no disagreement with the audit finding.

2021-005 Eligibility Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing No. 84.063, 84.268 Award Periods: July 1, 2020 through June 30, 2021 Type of Finding: - Material Weakness in Internal Control Over Compliance - Other Matters Criteria or specific requirement: The DoE requires institution to report the disbursement dates and amounts to the COD system within 15 days of disbursing Pell (34 CFR 690.83(b)(2) and Direct Loan (34 CFR 685.309) funds to a student. Condition: During our testing, of the 123 disbursements tested, one hundred seventeen (117) had incorrect disbursement dates, two (2) had the incorrect applied date to the COD system. Questioned Costs: None Context: During our testing, of the 123 disbursements tested, one hundred seventeen (117) had incorrect disbursement dates, two (2) had the incorrect applied date to the COD system. While performing audit procedures, it was noted that information was incorrectly reported to the COD and was not updated within the 15-day reporting time frame. Cause: The College did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: Student interest accrues based on disbursement date reported to COD, thus interest calculation could be skewed due to the discrepancy in disbursement dates reported. Repeat findings: 2020-005 Recommendation: We recommend the College provide additional resources to ensure all compliance requirements are met. Views of Responsible Officials: There is no disagreement with the audit finding.

2021-006 Special Tests and Provisions Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing No. 84.063, 84.268 Award Periods: July 1, 2020 through June 30, 2021 Type of Finding: - Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: Uniform Grant Guidance (2 CFR 200.303) requires nonfederal entities receiving Federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure students are awarded and disbursed the proper federal fund amounts. Condition: Throughout the 2020-21 award year, no review over the third-party reconciliation was performed by the College. Questioned Costs: None Context: While performing audit procedures, we noted that no review over the third-party reconciliation was performed by the college. Cause: The College did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: Ineffective internal controls, review and document retention can lead to improper aid being disbursed. Repeat findings: 2020-008 Recommendation: We recommend the College design controls to ensure an adequate review process is in place to ensure compliance with reporting requirements. Views of Responsible Officials: There is no disagreement with the audit finding.

2021-007 Special Tests and Provisions Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing No. 84.063, 84.268 Award Periods: July 1, 2020 through June 30, 2021 Type of Finding: - Significant Deficiency in Internal Control Over Compliance - Other Matters Criteria or specific requirement: The Code of Federal Regulations (34 CFR 685.309) requires enrollment status changes for students be reported to NSLDS within 30 days or within 60 days if the student with the status change will be reported on a scheduled transmission within 60 days of the change in status. Regulations require the status include an accurate effective date. Uniform Grant Guidance (2 CFR 200.303) requires nonfederal entities receiving Federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure enrollment reporting is completed properly. Condition: Throughout the 2020-21 award year, we noted error records were being returned on the enrollment reporting rosters that were sent to National Student Loan Data System (NSLDS) and those error records were not being corrected and resubmitted within the required 10 days. Out of the eight (8) students, from a statistically valid sample, we noted all eight (8) students status changes were reported after the 60-day reporting requirement. We also noted for the same eight students that enrollment was not certified 60 days. Finally, out of the same sample of eight (8) students, we noted three (3) students did not have their effective enrollment date reported to NSLDS correctly. Questioned Costs: None Context: Throughout the 2020-21 award year, we noted error records were being returned on the enrollment reporting rosters that were sent to National Student Loan Data System (NSLDS) and those error records were not being corrected and resubmitted within the required 10 days. Out of the eight (8) students, from a statistically valid sample, we noted all eight (8) students status changes were reported after the 60-day reporting requirement. We also noted for the same eight (8) students that enrollment was not certified 60 days. Finally, out of the same sample of eight students, we noted three (3) students did not have their effective enrollment date reported to NSLDS correctly. Cause: The College did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: If the NSLDS system is not updated with the student information, over awards could occur should the student transfer to another institution and the students may not properly enter the repayment period. Repeat findings: 2020-009 Recommendation: We recommend the College design controls to ensure an adequate review process is in place to ensure compliance with reporting requirements. Views of Responsible Officials: There is no disagreement with the audit finding.

2021-008 Special Tests and Provisions Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing No. 84.063, 84.268 Award Periods: July 1, 2020 through June 30, 2021 Type of Finding: - Significant Deficiency in Internal Control Over Compliance - Other Matters Criteria or specific requirement: Per the NSLDS reporting guide: The Program Begin Date is the date the student first began attending the program being reported. Typically, this would be the first day of the term in which the student began enrollment in the program, unless the student enrolled in the program on an earlier date. Also, per the NSLDS reporting guide (section 2.4.1 ? NSLDS tracks how many students, included on a school?s Roster file, were certified with Program Level information and whether a school has reported programs with a 2020 CIP Year (Enrollment Reporting Statistics). This information is used to determine whether a school is complying with applicable regulations and guidance. Schools must ensure that all students enrolled in programs are reported with programs, as well as report a status for all programs on their Roster. Schools found to be non-compliant with NSLDS enrollment reporting requirements will receive a series of warning letters before being referred for compliance action. Additionally, having the correct CIP and program start date, allows NSLDS to determine if a borrower will lose subsidy (2.4.2). Condition: Out of the eight (8) students from a statistically valid sample, we noted one student whose CIP code that was reported to NSLDS did not match the enrolled program per the institutions records. Out of the sample of eight (8) students, we noted three (3) whose program beginning dates that were reported to NSLDS did not agree to the institutions records. Finally, out of the sample of eight (8) students, we noted one whose Credential Level and Published Program length that were reported to NSLDS did not match the enrolled program per the institutions records. Questioned Costs: None Context: Out of the eight (8) students from a statistically valid sample, we noted one student whose CIP code that was reported to NSLDS did not match the enrolled program per the institutions records. Out of the sample of eight (8) students, we noted three (3) whose program beginning dates that were reported to NSLDS did not agree to the institutions records. Finally, out of the sample of eight (8) students, we noted one whose Credential Level and Published Program length that were reported to NSLDS did not match the enrolled program per the institutions records. Cause: The College did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: If the NSLDS system is not updated with the student information, over awards could occur should the student transfer to another institution and the students may not properly enter the repayment period. Repeat findings: 2020-010 Recommendation: We recommend the College design controls to ensure an adequate review process is in place to ensure compliance with reporting requirements. Views of Responsible Officials: There is no disagreement with the audit finding.

2021-009 Special Tests and Provisions Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing No. 84.063 Award Periods: July 1, 2020 through June 30, 2021 Type of Finding: - Significant Deficiency in Internal Control Over Compliance - Other Matters Criteria or specific requirement: According to 34 CFR 668.22(f)(1)(), institutions are required to complete accurate Return of Title IV calculations as defined in the regulations and use the correct number of days in the enrollment period. Uniform Grant Guidance (2 CFR 200.303) requires nonfederal entities receiving Federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure enrollment reporting is completed properly. Effective internal control should proper review and documentation. Condition: Out of the five (5) students, we noted that two calculations were calculated wrong. For one student, the preparer of R2T4 did not round the calculated percentages to the correct amount of decimal points (3). For the other student, preparer did not have the correct end date listed on the schedule. Incorrect rounding and dates resulted in amounts not being refunded properly and resulted in $6.12 ($8.55 in under-payment and $2.43 in overpayment) of questioned costs. The College has indicated that review is happening, however, no formal review could be substantiated. Questioned Costs: $6.12 Context: Out of the five (5) students, we noted that two calculations were calculated wrong. For one student, the preparer of R2T4 did not round the calculated percentages to the correct amount of decimal points (3). For the other student, preparer did not have the correct end date listed on the schedule. Incorrect rounding and dates resulted in amounts not being refunded properly and resulted in $6.12 ($8.55 in under-payment and $2.43 in overpayment) of questioned costs. The College has indicated that review is happening, however, no formal review could be substantiated. Cause: The College did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: The Return of Title IV calculation determines the amount of federal financial assistance the student is entitled to and is based on the number of days they completed in the period. Using the incorrect number of days in the term in the R2T4 calculations may result in incorrect return calculations and additional funds needing to be returned to the US Department of Education. The lack of independent documented review of the R2T4 calculations being performed by the student financial aid staff could result in errors going undetected by the College. Repeat findings: 2020-011 Recommendation: We recommend the College design controls to ensure an adequate review process is in place to ensure compliance with reporting requirements. Views of Responsible Officials: There is no disagreement with the audit finding.

2021-010 Special Tests and Provisions Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing No. 84.063, 84.268 Award Periods: July 1, 2020 through June 30, 2021 Type of Finding: - Significant Deficiency in Internal Control Over Compliance - Other Matters Criteria or specific requirement: The Standards for Safeguarding Customer Information, required by the Gramm-Leach-Bliley Act (GLBA) (16 CFR 314.4 (b)), requires customers to identify reasonable foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information, and assess the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risk in each relevant area of operations, including: 1. Employee training and management; 2. Information systems, including network and software design, as well as information processing, storage, transmission, and disposal; and 3. Detecting, preventing, and responding to attacks, intrusions, or other system failures. Uniform Grant Guidance (2 CFR 200.303) requires nonfederal entities receiving Federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures for timely review of the Information Security Program and proper documentation of the risk assessments. Condition: As a requirement under the College's Program Participation Agreement with the Department of Education, the College must protect student financial aid information. However, during our testing, we noted the College had not properly conducted a risk assessment identifying all internal and external risks to the security, confidentiality, and the integrity of the students? information. Questioned Costs: None Context: As a requirement under the College's Program Participation Agreement with the Department of Education, the College must protect student financial aid information. However, during our testing, we noted the College had not properly conducted a risk assessment identifying all internal and external risks to the security, confidentiality, and the integrity of the students? information. Cause: The College did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: Without documentation of a proper risk assessment, the College is at risk of noncompliance with the GLBA. In addition, there is a risk the College?s information and systems could be vulnerable to attacks or intrusions, and these attacks may not be detected in a timely manner. Repeat findings: 2020-012 Recommendation: We recommend the College design controls to ensure an adequate review process is in place to ensure compliance with reporting requirements. Views of Responsible Officials: There is no disagreement with the audit finding.

2021-011 Inadequate Schedule of Federal Expenditures Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing No. 84.063, 84.268 Award Periods: July 1, 2020 through June 30, 2021 Type of Finding: - Significant Deficiency in Internal Control Over Compliance Criteria or specific requirement: CFR ?200.510(b) of the Uniform Guidance requires the auditee to prepare a SEFA for the period covered by the auditee?s financial statements which must include the total federal awards expended as determined in accordance with ?200.502 of the Uniform Guidance, ?Basis for Determining Federal Awards Expended. Condition: Though the College provided a Schedule of Federal Expenditures, the College did not have the controls in place to provide a complete, reviewed Schedule of Federal Expenditures timely. Questioned Costs: None Context: The College did not have the controls in place to provide a complete Schedule of Federal Expenditures in a timely manner. Cause: The College did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: An incorrect Schedule of Federal Expenditures can delay an audit beyond the reporting deadline and cause unnecessary audit costs. Also, the delay could cause the College not to be in compliance with the DCF submission. Repeat findings: 2020-013 Recommendation: We recommend the College design controls to ensure an adequate review process is in place to ensure compliance with reporting requirements. Views of Responsible Officials: There is no disagreement with the audit finding.

2020-003 Cash Management Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster CFDA No. 84.007, 84.033, 84.038, 84.063, 84.268, 84.379 Award Periods: July 1, 2019 through June 30, 2020 Type of Finding: - Significant Deficiency in Internal Control Over Compliance - Other Matters Criteria or specific requirement: Uniform Grant Guidance (2 CFR 200.303) requires nonfederal entities receiving Federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure students are awarded and disbursed the proper federal fund amounts. Condition: During our testing, in three (3) of our nine (9) items selected, Funds were not disbursed within 3 days of receipt. Questioned Costs: None Context: The College did not disburse funds within the required timeline. Cause: The college did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: Drawing federal funds before federal aid expenses are incurred may result in funds being drawn in advance of the College?s immediate cash needs. Repeat findings: N/A Recommendation: We recommend the College provide additional resources to ensure all compliance requirements are met. Views of Responsible Officials: There is no disagreement with the audit finding.

2020-004 Eligibility Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster CFDA No. 84.007, 84.033, 84.038, 84.063, 84.268, 84.379 Award Periods: July 1, 2019 through June 30, 2020 Type of Finding: - Significant Deficiency in Internal Control Over Compliance - Other Matters Criteria or specific requirement: Uniform Grant Guidance (2 CFR 200.303) requires nonfederal entities receiving Federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure students are awarded and disbursed the proper federal fund amounts. Condition: During our testing, in all 25 of our selections, no documented review over the award packaging occurred by the College. Questioned Costs: None Context: The College did not document their review over the third party servicer. Cause: The college did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: Ineffective internal controls, review and document retention can lead to improper aid being disbursed. Repeat findings: N/A Recommendation: We recommend the College provide additional resources to ensure all compliance requirements are met. Views of Responsible Officials: There is no disagreement with the audit finding.

2020-005 Eligibility Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster CFDA No. 84.007, 84.033, 84.038, 84.063, 84.268, 84.379 Award Periods: July 1, 2019 through June 30, 2020 Type of Finding: - Material Weakness in Internal Control Over Compliance - Material Noncompliance (Modified Opinion) - Other Matters Criteria or specific requirement: The DoE requires institution to report the disbursement dates and amounts to the COD system within 15 days of disbursing Pell (34 CFR 690.83(b)(2) and Direct Loan (34 CFR 685.309) funds to a student. Condition: During our testing, of the 113 disbursements tested, two (2) had incorrect disbursement dates, ninety-six (96) had the incorrect applied date to the COD system. Questioned Costs: None Context: Of the 113 disbursements tested, two (2) had incorrect disbursement dates, ninety-five (96) had the incorrect applied date to the COD system While performing audit procedures, it was noted that information was incorrectly reported to the COD, and was not updated within the 15 day reporting time frame. Cause: The college did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: Student interest accrues based on disbursement date reported to COD, thus interest calculation could be skewed due to the discrepancy in disbursement dates reported. Repeat findings: N/A Recommendation: We recommend the College provide additional resources to ensure all compliance requirements are met. Views of Responsible Officials: There is no disagreement with the audit finding.

2020-006 Eligibility Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster CFDA No. 84.007, 84.033, 84.038, 84.063, 84.268, 84.379 Award Periods: July 1, 2019 through June 30, 2020 Type of Finding: - Significant Deficiency in Internal Control Over Compliance - Other Matters Criteria or specific requirement: Per 34 CFR 685.303(g) Treatment of excess loan proceeds. Before the disbursement of any Direct Subsidized Loan, Direct Unsubsidized Loan, or Direct PLUS Loan proceeds, if a school learns that the borrower will receive or has received financial aid for the period of enrollment for which the loan was intended that exceeds the amount of assistance for which the student is eligible (except for Federal Work-Study Program funds up to $300), the school must reduce or eliminate the over award by either: (1) Using the student?s Direct Unsubsidized Loan, Direct PLUS Loan, or State-sponsored or another non-Federal loan to cover the expected family contribution, if not already done; or (2) Reducing one or more subsequent disbursements to eliminate the over award. Condition: During our testing, of the twenty-five (25) students tested for eligibility, one (1) student had more aid disbursed than was awarded. Questioned Costs: $4.00. Context: Of the twenty-five (25) students tested for eligibility, one (1) student had more aid disbursed than was awarded. While performing audit procedures, it was noted that the College was not reviewing the packaging as they were being disbursed. Cause: The college did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: Failure to properly determine and disburse Title IV funds based on eligibility for each type of aid in accordance with federal regulations may result in students receiving incorrect funds. Repeat findings: N/A Recommendation: We recommend the College provide additional resources to ensure all compliance requirements are met. Views of Responsible Officials: There is no disagreement with the audit finding.

2020-007 Eligibility Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster CFDA No. 84.007, 84.033, 84.038, 84.063, 84.268, 84.379 Award Periods: July 1, 2019 through June 30, 2020 Type of Finding: - Significant Deficiency in Internal Control Over Compliance - Other Matters Criteria or specific requirement: Per 34 CFR 685.303 (d)(6) only if an institution has a Cohort Default Rate below 15% can they make single disbursements if amount is over $1,000. Condition: During our testing, of the twenty-five (25) students tested for eligibility, one (1) student was disbursed their aid in a single disbursement. Questioned Costs: None Context: Of the twenty-five (25) students tested for eligibility, one (1) student was disbursed their aid in a single disbursement. While performing audit procedures, it was noted that the College was not reviewing the packaging as they were being disbursed. Cause: The college did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: Failure to properly determine and disburse Title IV funds based on eligibility for each type of aid in accordance with federal regulations may result in students receiving incorrect funds. Repeat findings: N/A Recommendation: We recommend the College provide additional resources to ensure all compliance requirements are met. Views of Responsible Officials: There is no disagreement with the audit finding.

2020-008 Special Tests and Provisions Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster CFDA No. 84.007, 84.033, 84.038, 84.063, 84.268, 84.379 Award Periods: July 1, 2019 through June 30, 2020 Type of Finding: - Significant Deficiency in Internal Control Over Compliance - Other Matters Criteria or specific requirement: Uniform Grant Guidance (2 CFR 200.303) requires nonfederal entities receiving Federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure students are awarded and disbursed the proper federal fund amounts. Condition: Throughout the 2019-20 award year, no review over the third-party reconciliation was performed by the college. Questioned Costs: None Context: While performing audit procedures, we noted that no review over the third-party reconciliation was performed by the college. Cause: The college did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: Ineffective internal controls, review and document retention can lead to improper aid being disbursed. Repeat findings: N/A Recommendation: We recommend the College design controls to ensure an adequate review process is in place to ensure compliance with reporting requirements. Views of Responsible Officials: There is no disagreement with the audit finding.

2020-009 Special Tests and Provisions Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster CFDA No. 84.007, 84.033, 84.038, 84.063, 84.268, 84.379 Award Periods: July 1, 2019 through June 30, 2020 Type of Finding: - Significant Deficiency in Internal Control Over Compliance - Other Matters Criteria or specific requirement: The Code of Federal Regulations (34 CFR 685.309) requires enrollment status changes for students be reported to NSLDS within 30 days or within 60 days if the student with the status change will be reported on a scheduled transmission within 60 days of the change in status. Regulations require the status include an accurate effective date. Uniform Grant Guidance (2 CFR 200.303) requires nonfederal entities receiving Federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure enrollment reporting is completed properly. Condition: Throughout the 2019-20 award year, we noted error records were being returned on the enrollment reporting rosters that were sent to National Student Loan Data System (NSLDS) and those error records were not being corrected and resubmitted within the required 10 days. Out of the five students, from a statistically valid sample, we noted five students? status changes were reported after the 60-day reporting requirement. We also noted for the same five students that enrollment was not certified within 60 days. Out of the same sample of five students, we noted four students did not have their effective enrollment date reported to NSLDS correctly. Finally, out of the same sample of five students, we noted one student did not have the correct enrollment status reported to NSLDS. Questioned Costs: None Context: Throughout the 2019-20 award year, we noted error records were being returned on the enrollment reporting rosters that were sent to National Student Loan Data System (NSLDS) and those error records were not being corrected and resubmitted within the required 10 days. Out of the five students, from a statistically valid sample, we noted five student?s status changes were reported after the 60-day reporting requirement. We also noted for the same five students that enrollment was not certified within 60 days. Out of the same sample of five students, we noted four students did not have their effective enrollment date reported to NSLDS correctly. Finally, out of the same sample of five students, we noted one student did not have the correct enrollment status reported to NSLDS. Cause: The college did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: If the NSLDS system is not updated with the student information, over awards could occur should the student transfer to another institution and the students may not properly enter the repayment period. Repeat findings: N/A Recommendation: We recommend the College design controls to ensure an adequate review process is in place to ensure compliance with reporting requirements. Views of Responsible Officials: There is no disagreement with the audit finding.

2020-010 Special Tests and Provisions Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster CFDA No. 84.007, 84.033, 84.038, 84.063, 84.268, 84.379 Award Periods: July 1, 2019 through June 30, 2020 Type of Finding: - Significant Deficiency in Internal Control Over Compliance - Other Matters Criteria or specific requirement: Per the NSLDS reporting guide: The Program Begin Date is the date the student first began attending the program being reported. Typically, this would be the first day of the term in which the student began enrollment in the program, unless the student enrolled in the program on an earlier date. Also, per the NSLDS reporting guide (section 2.4.1 ? NSLDS tracks how many students, included on a school?s Roster file, were certified with Program Level information and whether a school has reported programs with a 2020 CIP Year (Enrollment Reporting Statistics). This information is used to determine whether a school is complying with applicable regulations and guidance. Schools must ensure that all students enrolled in programs are reported with programs, as well as report a status for all programs on their Roster. Schools found to be non-compliant with NSLDS enrollment reporting requirements will receive a series of warning letters before being referred for compliance action. Additionally, having the correct CIP and program start date, allows NSLDS to determine if a borrower will lose subsidy (2.4.2). Condition: Out of the five students from a statistically valid sample, we noted three students whose CIP codes that were reported to NSLDS did not match the enrolled program per the institution?s records. Out of the sample of five students, we noted three whose program begging dates that were reported to NSLDS did not agree to the institution?s records. Questioned Costs: None Context: Out of the five students from a statistically valid sample, we noted three students whose CIP codes that were reported to NSLDS did not match the enrolled program per the institution?s records. Out of the sample of five students, we noted three whose program begging dates that were reported to NSLDS did not agree to the institution?s records. Cause: The college did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: If the NSLDS system is not updated with the student information, over awards could occur should the student transfer to another institution and the students may not properly enter the repayment period. Repeat findings: N/A Recommendation: We recommend the College design controls to ensure an adequate review process is in place to ensure compliance with reporting requirements. Views of Responsible Officials: There is no disagreement with the audit finding.

2020-011 Special Tests and Provisions Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster CFDA No. 84.007, 84.033, 84.038, 84.063, 84.268, 84.379 Award Periods: July 1, 2019 through June 30, 2020 Type of Finding: - Significant Deficiency in Internal Control Over Compliance - Other Matters Criteria or specific requirement: According to 34 CFR 668.22(f)(1)(), institutions are required to complete accurate Return of Title IV calculations as defined in the regulations and use the correct number of days in the enrollment period. Uniform Grant Guidance (2 CFR 200.303) requires nonfederal entities receiving Federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure enrollment reporting is completed properly. Effective internal control should proper review and documentation. Condition: Out of the four students, we noted that one calculation, the preparer of R2T4 did not round initial calculation to the correct number of decimal points (4). Preparer also did not have the correct start and end dates listed on the schedule. Incorrect rounding and dates resulted in amounts being refunded properly and resulted in $1,115.04 of questioned costs. The College has indicated that review is happening, however, no formal review could be substantiated. Questioned Costs: $1,115.04 Context: Out of the four students, we noted that one calculation, the preparer of R2T4 did not round initial calculation to the correct number of decimal points (4). Preparer also did not have the correct start and end dates listed on the schedule. Incorrect rounding and dates resulted in amounts being refunded properly and resulted in $1,115.04 of questioned costs. The College has indicated that review is happening, however, no formal review could be substantiated. Cause: The college did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: The Return of Title IV calculation determines the amount of federal financial assistance the student is entitled to and is based on the number of days they completed in the period. Using the incorrect number of days in the term in the R2T4 calculations may result in incorrect return calculations and additional funds needing to be returned to the US Department of Education. The lack of independent documented review of the R2T4 calculations being performed by the student financial aid staff could result in errors going undetected by the College. Repeat findings: N/A Recommendation: We recommend the College design controls to ensure an adequate review process is in place to ensure compliance with reporting requirements. Views of Responsible Officials: There is no disagreement with the audit finding.

2020-012 Special Tests and Provisions Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster CFDA No. 84.007, 84.033, 84.038, 84.063, 84.268, 84.379 Award Periods: July 1, 2019 through June 30, 2020 Type of Finding: - Significant Deficiency in Internal Control Over Compliance - Other Matters Criteria or specific requirement: The Standards for Safeguarding Customer Information, required by the Gramm-Leach-Bliley Act (GLBA) (16 CFR 314.4 (b)), requires customers to identify reasonable foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information, and assess the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risk in each relevant area of operations, including: (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission, and disposal; and (3) Detecting, preventing, and responding to attacks, intrusions, or other system failures. Uniform Grant Guidance (2 CFR 200.303) requires nonfederal entities receiving Federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures for timely review of the Information Security Program and proper documentation of the risk assessments. Condition: As a requirement under the College's Program Participation Agreement with the Department of Education, the College must protect student financial aid information. However, during our testing, we noted the College had not properly conducted a risk assessment identifying all internal and external risks to the security, confidentiality, and the integrity of the students? information. Questioned Costs: None Context: As a requirement under the College's Program Participation Agreement with the Department of Education, the College must protect student financial aid information. However, during our testing, we noted the College had not properly conducted a risk assessment identifying all internal and external risks to the security, confidentiality, and the integrity of the students? information. Cause: The college did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: Without documentation of a proper risk assessment, the College is at risk of noncompliance with the GLBA. In addition, there is a risk the College?s information and systems could be vulnerable to attacks or intrusions, and these attacks may not be detected in a timely manner. Repeat findings: N/A Recommendation: We recommend the College design controls to ensure an adequate review process is in place to ensure compliance with reporting requirements. Views of Responsible Officials: There is no disagreement with the audit finding.

2020-013 Inadequate Schedule of Federal Expenditures Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster CFDA No. 84.007, 84.033, 84.038, 84.063, 84.268, 84.379 Award Periods: July 1, 2019 through June 30, 2020 Type of Finding: - Significant Deficiency in Internal Control Over Compliance - Other Matters Criteria or specific requirement: CFR ?200.510(b) of the Uniform Guidance requires the auditee to prepare a SEFA for the period covered by the auditee?s financial statements which must include the total federal awards expended as determined in accordance with ?200.502 of the Uniform Guidance, ?Basis for Determining Federal Awards Expended. Condition: The College did not have the controls in place to provide an adequate Schedule of Federal Expenditures. Questioned Costs: None Context: The College did not have the controls in place to provide an adequate Schedule of Federal Expenditures. Cause: The college did not have the appropriate resources and staffing in place to verify they were in compliance with all requirements. Effect: An incorrect Schedule of Federal Expenditures can delay an audit beyond the reporting deadline and cause unnecessary audit costs. Also, the delay could cause the College not to be in compliance with the DCF submission. Repeat findings: N/A Recommendation: We recommend the College design controls to ensure an adequate review process is in place to ensure compliance with reporting requirements. Views of Responsible Officials: There is no disagreement with the audit finding.