Washington College

2025 – 001: National Student Loan Data System (NSLDS) Reporting Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster ALN Number: 84.063, 84.268 Federal Award Identification Number: P063P241568, P063Q241568, P2687K251568, P268K261568 Award Period: July 1, 2024 – June 30, 2025 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance: 1. The Code of Federal Regulations, consisting of 34 CFR 685.309 and 34 CFR 690.83(b)(2), requires that enrollment status changes for students be reported to NSLDS within 30 days or within 60 days if the student with the status change will be reported on a scheduled transmission within 60 days of the change in status. Additionally, schools are required to certify enrollment at a minimum of every 60 days or every other month. 2. The Code of Federal Regulations, consisting of 34 CFR 685.309 and 34 CFR 690.83(b)(2), requires certain student enrollment information be reported to the Department of Education. Information provided to the Department of Education should agree to the institution’s records. Condition: The change in status was not reported timely to the NSLDS. Questioned costs: None Context: This condition occurred for 3 out of 24 students Cause: The Registrar's Office has been through several transitions over the past five years and training has been inadequate during this period. Specifically, there was not sufficient training on enrollment submissions, error resolutions, and timely updates. Effect: The NSLDS system is not updated timely with the student information which may cause over awarding should the student transfer to another institution and the students may not properly enter the repayment period. Repeat Finding: Yes, 2024-001 Recommendation: We recommend the College review its reporting procedures to ensure that students’ statuses are accurately and timely reported to NSLDS as required by regulations. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster ALN Number: 84.063, 84.268 Federal Award Identification Number: P063P221568, P063P231568, P063Q221568, P063Q231568, P268K231568, P268K241568 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control - Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance: 1. The Code of Federal Regulations, consisting of 34 CFR 685.309 and 34 CFR 690.83(b)(2), requires that enrollment status changes for students be reported to NSLDS within 30 days or within 60 days if the student with the status change will be reported on a scheduled transmission within 60 days of the change in status. Additionally, schools are required to certify enrollment at a minimum of every 60 days or every other month. 2. The Code of Federal Regulations, consisting of 34 CFR 685.309 and 34 CFR 690.83(b)(2), requires certain student enrollment information be reported to the Department of Education. Information provided to the Department of Education should agree to the institution’s records. Condition: The change in status was not reported timely and the program begin date per the institution’s records did not agree to information in the NSLDS. Questioned costs: None Context: This condition occurred in our statistically valid sample as follows: 1. The status was not reported timely for 4 out of 36 students 2. The Program Begin Date was incorrectly reported for 7 out of 35 students Cause: The Registrar's Office has been through several transitions over the past five years and training has been inadequate during this period. Specifically, there was not sufficient training on enrollment submissions, error resolutions, and timely updates. Effect: 1. The published program length reported to NSLDS is used to determine the student’s maximum and remaining eligibility periods under the 150% limit. By not reporting the correct length, the calculation of the 150% would be incorrect and the grace period begin date would be incorrect. 2. The NSLDS system is not updated timely with the student information which may cause over awarding should the student transfer to another institution and the students may not properly enter the repayment period. Repeat Finding: Yes, 2023-001 Recommendation: We recommend the College review its reporting procedures to ensure that students’ statuses are accurately and timely reported to NSLDS as required by regulations. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster ALN Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P007A221791, P007A231791, P007A241791, P033A221791, P063P221568, P033A231791, P063P231568, P063Q221568, P063Q231568, P268K231568, P268K241568 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control - Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not meeting GLBA requirements. Questioned costs: None Context: The College’s written information security program did not cover the requirement to provide for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). Cause: The gaps in the College’s information security program, during the specified audit period, stemmed from prior deficiencies in documentation and procedural enforcement, which were exacerbated by staff turnover and resource constraints. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: Yes, 2023-002 Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster Assistance Listing Number: 84.063 Federal Award Identification Number and Year: P063P221568, P063P231568, P063Q221568, P063Q231568 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control - Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - Per 34 CFR 690.83(a)(2), an institution must submit Pell grant payment data to the Department of Education that reflects information reported at the institution. Condition: The amount of Pell grant paid to the student per the institution’s records as of a certain date did not match the payment amounted reported in COD as of that same date. The difference was reported to COD as of a later date. Questioned costs: None Context: This condition occurred for one out of 16 students tested. Cause: The transmittal report was not reviewed closely enough to find that Pell Grant for one student had not fully transmitted. Effect: Accurate information is not provided to the Department of Education, as required. Repeat Finding: No Recommendation: We recommend the College evaluate its procedures and policies around reporting Pell disbursements to COD to ensure that student information is reported accurately and timely. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster ALN Number: 84.063, 84.268, 84.033 Federal Award Identification Number: P007A241791, P033A221791, P063P221568, P033A231791, P063P231568, P063Q221568, P063Q231568, P268K231568, P268K241568 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control - Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - Per 34 CFR 668.54(a)(1), an institution must verify information required by the Department of Education for applicants selected for verification by the Department of Education. Condition: Verification procedures were not completed for an applicant who was selected for verification by the Department of Education and who received Title IV aid. Questioned costs: $11,766 Context: This condition occurred for 1 out of 40 students selected for testing. Cause: A previous staff member indicated that verification had been completed by changing the status in Ellucian Colleague to complete. Therefore, it was not identified in reports that are reviewed for incomplete files. Effect: The student is awarded aid who is otherwise ineligible until verification procedures are completed. Repeat Finding: No Recommendation: The College should review the procedures surrounding the verification process to ensure all necessary support and documentation is obtained and retained in the student files. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster ALN Number: 84.268 Federal Award Identification Number: P268K231568, P268K241568 Award Period: July 1, 2023 – June 30, 2024 Type of Finding: Significant Deficiency in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control - Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance - The Code of Federal Regulations, 34 CFR 668.164(h) requires that credit balances on a student's ledger account derived from title IV funds must be returned to the student or parent as soon as possible, but no later than 14 days after the credit balance occurred. Condition: A credit balance was paid after 15 days, which exceeds the 14-day requirement to return the credit balance to the student. Questioned costs: None Context: This condition occurred for 1 out of 2 credit balances selected for testing. Cause: The voucher was inadvertently missed in our accounts payable process. As soon as the error was discovered, payment was remitted. We have implemented processes going forward to verify that all Parent Plus loans are paid out within 14 days. Effect: The College did not refund the student within 14 days for credit balances that arose from federal funds as required by regulations. Repeat Finding: No Recommendation: We recommend the College review and revise its policies for identifying and paying credit balances to ensure that it is paid to the student or parent as soon as possible, but no more than 14 days after the occurrence. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster CFDA Number: 84.063, 84.268 Federal Award Identification Number: P063P221568, P268K231568 Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Material Weakness in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance: 1. The Code of Federal Regulations, consisting of 34 CFR 685.309 and 34 CFR 690.83(b)(2), requires that enrollment status changes for students be reported to NSLDS within 30 days or within 60 days if the student with the status change will be reported on a scheduled transmission within 60 days of the change in status. Additionally, schools are required to certify enrollment at a minimum of every 60 days or every other month. 2. Per the NSLDS Enrollment Reporting Guide, Published Program Length should be reported based on the definition of “normal time” to completion in the regulations at 34 CFR 668.41(a), as follows: a. If the school has published, in its catalog, on its website, or in any promotional materials, the length of the program in weeks, months, or years, the program length reported must be the same as the program length that the school has published. b. If the school has not published a program length and the program is an associate or bachelor’s degree program, the program length to be reported should be two years (associate) or four years (bachelor), respectively, unless the academic design of the program makes it longer or shorter than typical. c. For all other programs for which the school has not published a program length, the program length is based on the school’s determination of how long, in weeks, months, or years, the program is designed for a full-time student to complete. Condition: The change in status was not reported timely and the incorrect program length was reported to NSLDS. Questioned costs: None Context: This condition occurred in our statistically valid sample as follows: 1. The status was not reported timely for 33 out of 35 students 2. The Program Length was incorrectly reported for 35 out of 35 students Cause: The Registrar's extended absences and sudden medical leave caused significant disruptions to the College’s operations, resulting in a delay in securing a temporary replacement from the Registry. Unfortunately, the Registrar has since resigned, and the College is currently in the process of searching for a suitable replacement. Effect: 1. The published program length reported to NSLDS is used to determine the student’s maximum and remaining eligibility periods under the 150% limit. By not reporting the correct length, the calculation of the 150% would be incorrect and the grace period begin date would be incorrect. 2. The NSLDS system is not updated timely with the student information which may cause over awarding should the student transfer to another institution and the students may not properly enter the repayment period. Repeat Finding: Yes, 2022-002 Recommendation: We recommend the College review its reporting procedures to ensure that students’ statuses are accurately and timely reported to NSLDS as required by regulations. Views of responsible officials: There is no disagreement with the audit finding.

Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster CFDA Number: 84.063, 84.268, 84.007, 84.033 Federal Award Identification Number: P063P221568, P268K231568, P007A221791, P033A211791 Award Period: July 1, 2022 – June 30, 2023 Type of Finding: Material Weakness in Internal Control over Compliance, Other Matters Criteria or specific requirement: Internal Control – Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non- Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Compliance – The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The elements that an institution must address in its written information security program are at 16 CFR 314.4. Condition: Certain elements of the College’s information security program were not meeting GLBA requirements. Questioned costs: None Context: The College’s written information security program did not cover the following requirements:  Provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (Risk Management section)  Assess apps developed by the institution (SDLC Policy or a policy that includes the testing done to applications provided by vendors)  Implement multi-factor authentication for anyone accessing customer information on the institution’s system (The use of MFA)  Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (performing annual penetration testing and IT Risk Assessment)  There is no Change Management Policy  There is no Vendor Management Policy  The Information Security Policy is in draft from. (Many of the requirements were located in this policy but the policy is in draft form) Cause: The college acknowledges certain deficiencies in compliance in large part due to a gap in having subject matter expertise consistently staffed in these areas. As part of the strategic plan the President has set forth a college wide goal of bringing on FTE staff with the needed subject matter expertise to properly address these compliance deficiencies. Effect: Information security management may not be optimized and responses delayed without the written plan. Repeat Finding: No Recommendation: We recommend the College ensure its written information security program addresses the required minimum elements as outlined in 16 CFR 314.4. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: Per 2 CFR section 200.320. Noncompetitive procurement can only be awarded if one or more of the following circumstances apply: (1) The acquisition of property or services, the aggregate dollar amount of which does not exceed the micro-purchase threshold (see paragraph (a)(1) of this section); (2) The item is available only from a single source; (3) The public exigency or emergency for the requirement will not permit a delay resulting from publicizing a competitive solicitation; (4) The Federal awarding agency or pass-through entity expressly authorizes a noncompetitive procurement in response to a written request from the non-Federal entity; or (5) After solicitation of a number of sources, competition is determined inadequate. Per 2 CFR 200.213 Suspension and Debarment restricts awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from or ineligible for participation in Federal assistance programs or activities. CFR 180.300 states that an entity may determine suspension and debarment status by: (a) Checking SAM Exclusions; or (b) Collecting a certification from that person; or (c) Adding a clause or condition to the covered transaction with that person. Condition: Documentation was not maintained to support why vendors were selected using noncompetitive procurement. Furthermore, the documentation to support the vendor?s suspension debarment status was not provided. Questioned costs: None Context: For 5 of 7 procurement transactions greater than $10,000, no documentation was provided to justify noncompetitive procurement method used. 3 of the 7 vendors exceeded $25,000 in procurement and further were not reviewed to ensure the vendors were not suspended or disbarred. Cause: The College used vendors that have been historically used by the institution during non-pandemic periods of time to acquire needed supplies and materials for the suppression and monitoring of COVID where possible. Several purchases that were needed for these efforts were not available from the College?s normal vendors and those costs had to be acquired from new sources. Multiple sources were investigated, but with supply chain issues, the College was unable to always find multiple vendors that could meet the needs of the institution. With changes in staffing at the institution, the records related to the processes used and vendor?s investigated have not been retained. The vendor?s used have all subsequently been checked for suspension debarment status and none where found to have any issues. Effect: Vendors may be selected in a manner that is not consistent with Federal guidelines and Federal funds may be paid to parties that are ineligible to participate in a Federal program. Repeat Finding: No Recommendation: We recommend the College establish policies and procedures to properly identify procured transactions and maintain documentation to support performance of the procurement procedures. We also recommend the College evaluate its policies procedures to ensure that suspension and debarment requirements are being met prior to entering into transactions with vendors. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 685.309 requires that enrollment status changes for students be reported to National Student Loan Data System (NSLDS) NSLDS within 30 days or within 60 days if the student with the status change will be reported on a scheduled transmission within 60 days of the change in status. 34 CFR 685.309(b), states that Institutions must have some arrangement to report student enrollment data to NSLDS through an enrollment roster file. The institution is required to report changes in the student?s enrollment status, the effective date of the status, and an anticipated completion date. Also, the Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Condition: The College did not comply with NSLDS enrollment reporting requirements. Questioned costs: None Context: This condition occurred as follows out of 60 students selected for testing: ? For 3 students, the enrollment status was not reported correctly ? For 4 students, the enrollment status effective date could not be verified ? For 30 students, the change in enrollment status was not reported timely ? For 8 students, we could not verify that the CIP code per NSLDS agreed to the institution?s records ? For 60 students, the incorrect program length was reported in NSLDS ? For 1 student, the program begin date was not reported in NSLDS. Cause: Due to an unexpected loss of staff and institutional knowledge in the Registrar?s Office, some of the processes for updating a student?s record, whether for a change of program or to a withdrawal status, were learned via documentation available without any resident expertise. Some errors were made in the learning process. However, with the help of an outside consultant, correct procedures have since been implemented. For the 60 students whose program length was incorrectly reported; this is due to the fact that the institution reported on the National Student Clearinghouse?s website that the bachelor?s degree takes 48 months to complete. Our bachelor?s degree is a four-year degree and should not have been reported in months. The Clearinghouse translated 48 months to the incorrect number of years. This is being corrected. Effect: The NSLDS system is not updated with the student information which may cause over awarding should the student transfer to another institution and the students may not properly enter the repayment period. Repeat Finding: Yes, 2021-002 Recommendation: We recommend the College review its reporting procedures to ensure that students? statuses are accurately and timely reported to NSLDS as required by regulations. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: Per Federal Register Notice of Public Posting Requirement of Grant Information for Higher Education Emergency Relief Fund (HEERF) Grantees dated 5/13/21, institutions are required to submit (in a time and manner required by the Secretary) a report to the Secretary describing the use of funds distributed from the HEERF. According to the OPE Reporting and Data Collection website, quarterly reports should appear on separate documents by quarter and should not be cumulative. Condition: Quarterly student reports were incorrectly reported on a cumulative basis. Questioned costs: None Context: This condition occurred for 2 out of 4 quarterly student reports. Cause: Washington College made every attempt to keep up with guidance for posting quarterly reports to our webpage. While the reports were posted, they totals were cumulative instead of what was spent for that quarter. Effect: The College is not meeting the reporting and information-sharing requirements determined by the Department of Education. As a result, the institution may be subject to additional enforcement actions by the Department of Education including a delay in funding for additional HEERF programs and possibly being determined ineligible for other program funding. Repeat Finding: No Recommendation: We recommend the College obtain an understanding of the reporting requirements established by the grant to ensure reports do not report on a cumulative basis. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 685.309 requires that enrollment status changes for students be reported to National Student Loan Data System (NSLDS) NSLDS within 30 days or within 60 days if the student with the status change will be reported on a scheduled transmission within 60 days of the change in status. Regulations require the status include an accurate effective date. Condition: The College incorrectly reported enrollment statuses within the NSLDS. Questioned costs: None Context: This condition occurred for 2 out of 40 student status? selected for testing as follows: ? Two students statuses were reported as Full-Time, but should have been reported as Withdrawn. Cause: Despite these withdrawals being processed in a timely manner, they were not correctly reported to the NSLDS due to the NSC Hiatus Codes Translate screen in Colleague which had not been reviewed or updated with accurate college withdrawal statuses. Effect: The NSLDS system is not updated with the student information which may cause over awarding should the student transfer to another institution and the students may not properly enter the repayment period. Repeat finding: Yes, see prior year finding 2020-002. Recommendation: We recommend the College review its reporting procedures to ensure that students? statuses are accurately and timely reported to NSLDS as required by regulations. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 685.309 requires that enrollment status changes for students be reported to NSLDS within 30 days or within 60 days if the student with the status change will be reported on a scheduled transmission within 60 days of the change in status. Regulations require the status include an accurate effective date. Condition: The College incorrectly reported withdrawal dates within NSLDS. Questioned costs: None Context: This condition occurred for 4 out of 40 students selected. Cause: In addition to the Registrar?s Office being extremely short staffed, it wasn?t until 2/8/2022 the other source was identified: Colleague was not identifying proper Hiatus Codes for College Withdrawals starting in Fall 2019. It was unknown this was changed by a prior user. Effect: The NSLDS system is not updated with the student information which may cause over awarding should the student transfer to another institution and the students may not properly enter the repayment period. Repeat finding: No Recommendation: We recommend the College review its reporting procedures to ensure that students? withdrawals are accurately and timely reported to NSLDS as required by regulations. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: The Code of Federal Regulations, 2 CFR section 200.328-200.329 requires that institutions publicly post certain information on their website. Institutions must publicly post their report as soon as possible, but no later than 30 days after the publication of the notice or 30 days after the date ED first obligated funds under HEERF I, II, and III. Per the Department of Education, all quarterly reports must remain on the institutions website for 3 years following the end of the performance period. Condition: The College?s website did not reflect posting of the student and institution quarterly reports for the required record retention period and instead reflected only the most recently filed reports. Questioned costs: None Context: This condition occurred for 1 out 1 institutional reports and 5 out of 5 student reports selected for testing. Cause: Like other pages on the College?s website, accurate and timely posted institutional and student HEERF reports were inadvertently removed from the CARES Act website during a system upgrade. Effect: The required information related to the Student Aid and Institutional Portions of the HEERF funds were not made available to parties of interest. Repeat finding: No Recommendation: We recommend the College review the reporting requirements and implement procedures to ensure that all required reports are issued/posted in an accurate and timely manner as well as ensuring the reports remain on the website for 3 years following the end of the performance period. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: The Code of Federal Regulations, 2 CFR section 200.328-200.329 requires that institutions publicly post certain information on their website. Institutions must publicly post their report as soon as possible, but no later than 30 days after the publication of the notice or 30 days after the date ED first obligated funds under HEERF I, II, and III. Per the Federal Register, Vol. 86, No. 91, pages 26213-26215, certain information was required to be included in the quarterly public reports covering the student aid portion of the grant (7 key items). Condition: The College misreported the number of students who received funding under HEERF I. Questioned costs: None Context: This condition occurred for 2 of 5 student reports selected for testing. Cause: Some students were duplicated in reporting instead of unduplicated. Effect: The required information related to the Number of Students who received Student Aid for HEERF funding was misreported to the available parties of interest. Repeat finding: No Recommendation: We recommend the College review the reporting requirements and ensure that these numbers are being reported correctly. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 685.309 requires that enrollment status changes for students be reported to NSLDS within 30 days or within 60 days if the student with the status change will be reported on a scheduled transmission within 60 days of the change in status. Regulations require the status include an accurate effective date. Condition: The College incorrectly reported enrollment statuses within the NSLDS. Questioned costs: None Context: This condition occurred for 2 out of 40 student status? selected for testing as follows: ? One student?s status was reported as Graduated but should have been reported as Withdrawn. ? One student?s status was reported as Full-Time but should have been reported as Withdrawn. For this same student, no certifications in NSLDS occurred during the year, which is greater than the 60-day requirement. Cause: The former Registrar was rushed into graduating students before the 60-day reporting requirement was exhausted. He mistakenly graduated a student who was not cleared by their department chair. The office was short staffed the majority of the year resulting in errors made during enrollment reporting. The college withdraw was completed retroactively once all mandatory documents needed to complete the withdraw were received. Effect: The NSLDS system is not updated with the student information which may cause over awarding should the student transfer to another institution and the students may not properly enter the repayment period. Repeat Finding: No Recommendation: We recommend the College review its reporting procedures to ensure that students? statuses are accurately and timely reported to NSLDS as required by regulations. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: All schools participating (or approved to participate) in the Federal Student Aid programs must have an arrangement to report student enrollment data to the NSLDS through a Roster file. Rosters must be returned within 15 days and any subsequent error records must be returned within 10 days (34CFR section 682.610). Condition: National Student Loan Data System (NSLDS) rosters yielded error records that were not corrected and resubmitted within the required 10 days. Questioned costs: None Context: This condition occurred for 1 out of 12 monthly submissions. Cause: The Registrar?s office was understaffed. Effect: Student enrollment statuses may not be correctly or timely reported to the NSLDS. Repeat Finding: No Recommendation: We recommend the College review its reporting procedures to ensure the requisite response to error records occurs within the 10 day time period. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or Specific Requirement: Per 34 CFR 668.24(e)(i) an institution must maintain records to support the data contained in the FISAP. Condition: The documents retained by the College to support amounts included in the FISAP did not agree to the FISAP. Context: The FISAP for the award year July 1, 2017 through June 30, 2018 contained the following error: Part II. Section F. line 39 reported five students lower than the total per supporting documentation. Cause: The error was made while keying numbers into the electronic FISAP application directly from a report obtained from colleague by the previous director. The rest of the other numbers were transposed correctly. Effect: The information in the FISAP is utilized to assist in the awarding of future awards and incorrect data could negatively impact future awards. Recommendation: We recommend the College revise procedures to ensure that the record retention requirements are met and supporting documentation agrees to the FISAP, including a supervisory review by someone other than the preparer. Views of Responsible Officials: There is no disagreement with the audit finding.

Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 690.62 states the Pell grant for an academic year is based upon the payment and disbursement scheduled published by the Secretary for each award year. The payment schedules take into account the cost of attendance, the student?s EFC and the enrollment status of the student. Condition: The College?s controls and processes did not identify an error made when posting an adjustment to a student?s award. Context: For one of 40 students selected for testing, the student was underawarded Pell grant funds. Cause: This error occurred because the Pell subroutine, available by Colleague, was not being used. This would have prevented this miskeyed Pell Grant from transmitting. The Pell subroutine is now active so this should not happen in the future. Effect: The student did not receive the full amount of Pell award which he was eligible. Recommendation: We recommend the College implement a review process over any changes made to Pell awards to ensure they are properly posted. Views of Responsible Officials: There is no disagreement with the audit finding.

Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as ?financial institutions? and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution?s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Context: The College did not perform a risk assessment that addresses the three areas noted in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: We performed an assessment and documentation of our network infrastructure in the spring which only covers part 3. That documentation was already included. Turnover in Information Technology, specifically in leadership, throughout the year caused parts 1 and 2 to not be fully covered. We made the decision to go to managed IT services with Ellucian, in part to better our information technology security. They began assessing us in early May but didn?t take over our information technology services until May 28th. Please see the Enterprise Application Assessment document, prepared by our executive director of information technology, where we document our assessment of parts 1 and 2. Effect: Personal student information could be vulnerable. Recommendation: We recommend that the College engage a third party or perform the risk assessment for the three areas required by the Gramm-Leach-Bliley Act and ensure that there are documented safeguards for identified risks. Views of Responsible Officials: There is no disagreement with the audit finding.

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION