St. Thomas University, Inc.

Federal Program Information - Federal Work Study (ALN #84.033) Criteria or Specific Requirement - Special Tests and Provisions – Disbursements to or on Behalf of Students – Federal Work Study (FWS) - The University shall ensure that the student is paid at least once per month for wages earned (34 CFR Section 675.16(a)(2)). Condition - Instances where the University did not pay the student for hours actually earned. Cause - Lack of administrative oversight with respect to recordkeeping and payroll processing. Effect or Potential Effect - The University was not in compliance with disbursements to or on behalf of students for federal work study payments. Questioned Costs - $29 Context - For 1 of our 25 selections, the University improperly disbursed a student more bi-weekly pay than earned during the pay period. Identification as a Repeat Finding - No similar findings noted in the prior year. Recommendation - We recommend the University only disburse FWS funds for actual hours worked. Views of Responsible Officials - The University agrees with the finding and is implementing a reconciliation and review process to ensure compliance.

Federal Program Information - Student Financial Assistance Cluster Criteria or Specific Requirement - L. Reporting - Special Reporting - The Fiscal Operations Report and Application to Participate (FISAP) is an electronic report submitted annually to receive funds for the campus-based programs. The institution uses the Fiscal Operations Report portion to report its expenditures in the previous award year and the Application to Participate portion to apply for the following year. Key line items containing critical information include: Part I, Identifying Information, Certification, and Warning; Part II, Application to Participate (selected sections); Part III, Fiscal Operations Report, Part IV, Fiscal Operations Report Federal Supplemental Educational Opportunity Grant Program; Part V, Fiscal Operations Report Federal Work-Study Program; and Part VI, Program Summary for Award Year. The FISAP must be submitted each year by the deadline established by the ED (34 CRF Section 668.24 (e)(1)(i)).   Condition - Instances where the University did not accurately report key line items identified in the OMB Compliance Supplement. Cause - Lack of administrative oversight with respect to FISAP Reporting Effect or Potential Effect - The University was not in compliance with accurately reporting award metrics on the FISAP reported to the U.S. Department of Education. Questioned Costs - $151,081 Context - For several key line items in the FISAP, the University did not accurately report actual values. Identification as a Repeat Finding - No similar findings noted in the prior year. Recommendation - We recommend the University enhance its policies and procedures to ensure that reports used to prepare the annual FISAP are retained, in accordance with federal regulations. In the case that additional reconciliations have been performed after initial submission of the FISAP to the U.S. Department of Education, an updated FISAP should be reported to the U.S. Department of Education prior to the deadline. Views of Responsible Officials - The University agrees with the finding and is implementing a reconciliation and review process to ensure compliance.

Federal Program Information: Gramm-Leach-Bliley Act – Student Information Security Criteria or Specific Requirement: Special Tests and Provisions – Gramm-Leach-Bliley Act – Student Information Security - The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). On December 9, 2021, the Federal Trade Commission (FTC) issued final regulations for 16 CFR Part 314 to implement the GLBA information safeguarding standards that institutions must implement. These regulations significantly modified the requirements that institutions must meet under GLBA. The regulations established minimum standards that institutions must meet. Condition: The University did not fully comply with 1 out of the 9 elements included in the FTC’s regulations. Cause: Lack of administrative oversight with respect to the new GLBA requirements. Effect or Potential Effect: The penetration and vulnerability assessments were not completed as of June 30, 2023. Questioned Costs: None. Context: The penetration and vulnerability assessments were not completed as of June 30, 2023. Identification as a Repeat Finding: There was no similar finding in the prior year. Recommendation: We recommend that the University annually reviews the GLBA requirements for updates on a timely basis and implement the requirements before the due date. Views of Responsible Officials: The University has executed an agreement with a vendor to perform penetration and vulnerability assessments, which is expected to be completed by June 30, 2024.

Federal Program Information: Federal Work Study (ALN #84.033) Criteria or Specific Requirement: Special Tests and Provisions – Disbursements to or on Behalf of Students – Federal Work Study - The University shall ensure that the student is paid at least once per month for wages earned. Condition: Instances where the University did not retain adequate support for wages earned. Cause: Lack of administrative oversight with respect to recordkeeping for timesheets. Effect or Potential Effect: The University was not in compliance with disbursements to or on behalf of students for federal work study payments. Questioned Costs: None above threshold Context: For 2 of 25 payments selected for testing, the University was unable to locate the approved timesheets. Identification as a Repeat Finding: There was no similar finding in the prior year. Recommendation: We recommend the University retain the appropriate records for hours earned by work study students. Views of Responsible Officials: For these 2 disbursements, the students did not report their time through the online payroll system but instead with physical timesheets. Due to the turnover and changing of positions of the payroll office, the timesheets were misfiled. The payroll department will scan and file all manual timesheets electronically in order to retain adequate records.

Federal Program Information: Federal Perkins Loan Program (ALN #84.038) Criteria or Specific Requirement: Special Tests and Provisions – Perkins Loan Recordkeeping and Record Retention - Institutions must retain original or true and exact copies of promissory and master promissory notes (MPN), repayment records, and cancellation and deferment requests for each Perkins loan made, in a locked, fireproof container. (34 CFR 674.19.(e)) Condition: Instances where the University did not retain the original or true and exact copies of promissory notes. Cause: Lack of administrative oversight with respect to recordkeeping and record retention related to the Federal Perkins Loan program (“Perkins”), including improper tracking and storage of records. Effect or Potential Effect: The University was not in compliance with the Perkins loan recordkeeping and record retention requirements. Questioned Costs: None. Context: For 6 of 35 borrowers with open loans selected for testing, the University did not retain an original or true and exact copy of the promissory note. For 5 of 40 borrowers with retired loans within the previous three fiscal years and current fiscal year, the University did not retain the appropriate records. Identification as a Repeat Finding: Yes – Finding 2022-003 Recommendation: We recommend the University retain the appropriate records for the required timeframe. We also recommend a full review of records on-hand. Views of Responsible Officials: The Policy and Procedures manual has been updated to reflect this process. The Business Office has implemented measures to ensure that Perkins Promissory Notes are identified, stored, and accessible during their repayment and collection period. In addition to the current filing system, the Business Office will utilize management software for ease of access and recording. To ensure that all remaining promissory notes are kept in accordance with Department of Education regulations, the Business Office will: • Record all incoming promissory notes internally and externally. • Promissory notes created prior to 2013 will be made digitally accessible through Perceptive Content, a secure content management system. Access to these promissory notes will only be accessible by parties with authorized access. • Promissory notes created after 2013 will continue to be made available through Heartland ECSI’s third party filing system. ECSI records paid, completed, cancelled, and retired promissory notes that were created after 2013. • In accordance with the Perkins Assignment and Liquidation Guide from the Department of Education (EA ID: General-21-53), all accounts with promissory notes unable to be located will be written off and/or purchased from the Department of Education. The University recorded an entry to repurchase open default loans as of June 30, 2023.

Federal Program Information: Federal Direct Student Loans (ALN #84.268) Criteria or Specific Requirement: Special Tests and Provisions ? Disbursements To or On Behalf of Students - Loan Disbursement Notification - Federal regulations (34 CFR section 668.165 (a)(6)(i)) require that the institution notify the student, or parent, in writing of (1) the date and amount of the disbursement; (2) the student?s right, or parent?s right, to cancel all or a portion of that loan or loan disbursement and have the loan proceeds returned to the holder of that loan or the TEACH Grant payments returned to the U.S. Department of Education; and (3) the procedure and time by which the student or parent must notify the institution that he or she wishes to cancel the loan, TEACH Grant, or TEACH Grant disbursement. Institutions that implement an affirmative confirmation process (as described in 34 CFR section 668.165 (a)(6)(i)) must make this notification to the student or parent no earlier than 30 days before, and no later than 30 days after, crediting the student?s account at the institution with Direct Loan or TEACH Grants. The Federal Student Aid Handbook further clarifies that in general, there are two types of notifications a school must provide: (1) a general notification to parent Direct PLUS borrowers and all students receiving Federal Student Aid (?FSA?) funds, and (2) a notice when FSA loan funds or TEACH Grant funds are credited to a student?s account. Condition: Instances were identified where the required loan disbursement notifications were not sent to the student or parent. Cause: Lack of administrative oversight and insufficient internal control over compliance with respect to loan disbursement notification requirements, including untimely review of notification logs. Effect or Potential Effect: Students and/or parents were not notified of award disbursements and/or their right to cancel/decline loan awards in a timely manner. Questioned Costs: None. Context: For 25 of 25 students selected for testing, the University did not send the required loan disbursement notifications to borrowers. Identification as a Repeat Finding: There was no similar finding in the prior year. Recommendation: We recommend the University enhance its policies, procedures and internal control over compliance with award notifications to ensure that such notifications are sent to student and/or parent borrowers within the required timeframe. We also recommend timely review of notification logs and retention of proper documentation. Views of Responsible Officials: The Policy and Procedures manual has been updated to reflect the following updated process: The Financial Aid Office has implemented measures to ensure students/parents that have Title IV loans disbursed are sent loan disbursement notifications via Colleague once a loan disbursement has been made. The process is done via Colleague each day and captures all Title IV loan disbursements made for the previous day. The notifications are processed via the ST-PCB process in Colleague, which sends a system generated loan disbursement notification to the student/parent. Processes are being worked on with the Information Technology department to generate a copy of the notification and to put in place a paper notification if no parent email is provided.

Federal Program Information: Federal Direct Student Loans (ALN #84.268) Criteria or Specific Requirement: Special Tests and Provisions ? Disbursements to or on Behalf of Students ? Federal Student Aid (?FSA?) Credit Balances - Where disbursements created a credit balance in the student account and the student or parent did not provide an authorization for the institution to retain funds, the institution must provide the credit balance amount to the student within 14 days of the date the balance was created (34 CFR 668.164(h)). Condition: Instances where the University did not issue a refund within the required timeframe. Cause: Lack of administrative oversight with respect to disbursements to or on behalf of students, including inadequate review and tracking of refunds due. Effect or Potential Effect: The University was not in compliance with disbursements to or on behalf of students. Questioned Costs: None. Context: For 2 of 25 students selected for testing, the University did not issue the refund within the required 14 days. Identification as a Repeat Finding: There was no similar finding in the prior year. Recommendation: We recommend the University complete a timely review of credit balances in order to issue all refunds with respect to FSA credit balances within the required timeframe. We also recommend timely review of refunds due. Views of Responsible Officials: The Policy and Procedures manual has been updated to reflect the following updated process: The Business Office processes student refunds within 14 days after a Title IV credit balance appears on a student?s account. At least once per week, the Refunds Coordinator generates a refund report (ARTM) which lists students with credit balances. The University?s policy is that all refunds are processed via ACH (direct deposit), and all students are required to provide their bank account information. Communication is sent to students throughout the semester reminding them to sign up for direct deposit. To ensure that all students receive their refunds by the required 14 days, a paper check is issued to students missing banking information. Checks are sent to the mailing address on file. Communication will continue to be sent to all students encouraging them to sign up for ACH refunds. However, refunds are processed timely even if the banking information is not available.

Federal Program Information: Federal Perkins Loan Program (ALN #84.038) Criteria or Specific Requirement: Special Tests and Provisions ? Perkins Loan Recordkeeping and Record Retention - Institutions must retain original or true and exact copies of promissory and master promissory notes (MPN), repayment records, and cancellation and deferment requests for each Perkins loan made, in a locked, fireproof container. (34 CFR 674.19.(e)) Condition: Instances where the University did not retain the original or true and exact copies of promissory notes. Cause: Lack of administrative oversight with respect to recordkeeping and record retention related to the Federal Perkins Loan program (?Perkins?), including improper tracking and storage of records. Effect or Potential Effect: The University was not in compliance with the Perkins loan recordkeeping and record retention requirements. Questioned Costs: None. Context: For 4 of 25 borrowers with open loans selected for testing, the University did not retain an original or true and exact copy of the promissory note. For 3 of 25 borrowers with retired loans within the previous three fiscal years and current fiscal year, the University did not retain the appropriate records. Identification as a Repeat Finding: There was no similar finding in the prior year. Recommendation: We recommend the University retain the appropriate records for the required timeframe. We also recommend a full review of records on-hand. Views of Responsible Officials: The Policy and Procedures manual has been updated to reflect this process. The Business Office has implemented measures to ensure that Perkins Promissory Notes are identified, stored, and accessible during their repayment and collection period. In addition to the current filing system, the Business Office will utilize management software for ease of access and recording. To ensure that all remaining promissory notes are kept in accordance with Department of Education regulations, the Business Office will: ? Record all incoming promissory notes internally and externally. ? Promissory notes created prior to 2013 will be made digitally accessible through Perceptive Content, a secure content management system. Access to these promissory notes will only be accessible by parties with authorized access. ? Promissory notes created after 2013 will continue to be made available through Heartland ECSI?s third party filing system. ECSI records paid, completed, cancelled, and retired promissory notes that were created after 2013. ? In accordance with the Perkins Assignment and Liquidation Guide from the Department of Education (EA ID: General-21-53), all accounts with promissory notes unable to be located will be written off and/or purchased from the Department of Education prior to the end of FY 2023.

2021-001: The University did not timely remit returns of Title IV funds Federal Awarding Agency: United States Department of Education Pass-Through Entity: Not applicable CFDA Number and Title: Student Financial Assistance Cluster Federal Award Number: Various Applicable Compliance Component: N. Special Tests and Provisions; 4. Return of Title IV Funds Questioned Cost Amount: None Criteria: The University is responsible for making returns of Title IV funds in the proper amount and in a timely manner in accordance with the federal guidelines. According to the Code of Federal Regulations (?CFR?), Title 34, Section 668-22, when a recipient of Title IV grant or loan assistance withdraws from an institution during a payment period in which the recipient began attendance, the institution must determine the amount of Title IV assistance earned by the student as of the student?s withdrawal date. If the total amount of Title IV assistance earned by the student is less than the amount that was disbursed to the student or on his or her behalf as of the date of the institution?s determination that the student withdrew, the difference must be returned to the Title IV programs within 45 days of the student?s withdrawal date. Condition: During our testing of returns of Title IV funds we noted that one of the thirteen (13) returns sampled was made more than 45 days after the University determined that the student never attended class. The total dollar amount of this late return was $3,320. Cause: Due to manual processing of the official withdrawal form, the University missed calculating the return of Title IV funds timely. The University is required to adhere to written policies and procedures to ensure that the return of Title IV funds is made within the required number of days. Effect: The University is not in compliance with the provisions of CFR Title 34, Section 668-22. There was one return processed 45 days after the University determined that the student never attended class. Questioned Costs None Context Of the thirteen (13) samples we tested for the above requirement, we noted one instance where the return of Title IV funds was not made within the prescribed deadline. Recommendation: We recommend the University strengthen its policies and procedures to ensure the return of Title IV funds are remitted timely.

2019-002: Gramm-Leach-Bliley Act ? information security program was not adequately developed. Federal Awarding Agency: United States Department of Education Pass-Through Entity: Not applicable CFDA Number and Title: Student Financial Aid-Cluster Federal Award Number: Not applicable Applicable Compliance Component: N. Special Tests and Provisions; 10. Gramm-Leach-Bliley Act Student Information Security Questioned Cost Amount: None Criteria: The Gramm-Leach-Bliley Act (?GLBA?) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. Under a University?s Program Participation Agreement with the Department of Education and the GLBA, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department of Education or otherwise obtained in support of the administration of the federal student financial aid programs. The University should: a. designate an individual to coordinate the information security program; b. perform a risk assessment that addresses the three required areas noted in 16 CFR 314.4 (b), which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures; c. document a safeguard for each risk identified from step b above. Effect: A comprehensive information security framework has not been established to meet all of the GLBA requirements. Cause: We noted the University has designated a qualified individual to coordinate its information security program but a formal policy has not yet been developed. Additionally, the University has not formally performed a complete set of risk assessments nor documented thoroughly the safeguards as required under GLBA. Recommendation: We recommend the University develop a comprehensive information security policy, provide ongoing trainings, perform internal and external risk assessments, and document results and safeguards for all risks in a systematic manner.

2019-001: Untimely reporting of changes in enrollment status. Federal Awarding Agency: United States Department of Education Pass-Through Entity: Not applicable CFDA Number and Title:Student Financial Aid-Cluster Federal Award Number:Not applicable Applicable Compliance Component: N. Special Tests and Provisions; 4. Enrollment Reporting Questioned Cost Amount: None Criteria: The University is responsible for updating changes in student status, report the date the enrollment status was effective, enter the new anticipated completion date, and submit the changes electronically through the batch method or the NSLDS website. The University is responsible for timely reporting, whether they report directly or via a third-party servicer. A student?s enrollment status determines eligibility for in-school status, deferment, and grace periods, as well as for the payment of interest subsidies to FFEL Program loan holders by ED. Enrollment information must be reported within 30 days whenever attendance changes for students, unless a roster will be submitted within 60 days. The University is on a 60 day cycle. Effect: Timely reconciliation and monitoring of controls do not appear to be in place for the University?s enrollment reporting process to ensure that the status change is submitted within the required number of days. Cause: We noted 2 exceptions in our testing of enrollment reporting out of a total of 40 selections. We found that the 2 status changes were reported more than 60 days after the student?s degree was conferred. The range of these late reports was from 69 to 72 days and was isolated to students enrolled in the University?s summer classes. Recommendation: We recommend the University strengthen its policies and procedures to ensure the enrollment reports are complete and submitted to the clearinghouse in a timely manner. Enrollment reporting in a timely and accurate manner is critical for effective management of the programs.

2019-002: Gramm-Leach-Bliley Act ? information security program was not adequately developed. Federal Awarding Agency: United States Department of Education Pass-Through Entity: Not applicable CFDA Number and Title: Student Financial Aid-Cluster Federal Award Number:Not applicable Applicable Compliance Component: N. Special Tests and Provisions; 10. Gramm-Leach-Bliley Act Student Information Security Questioned Cost Amount: None Criteria: The Gramm-Leach-Bliley Act (?GLBA?) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. Under a University?s Program Participation Agreement with the Department of Education and the GLBA, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department of Education or otherwise obtained in support of the administration of the federal student financial aid programs. The University should: a. designate an individual to coordinate the information security program; b. perform a risk assessment that addresses the three required areas noted in 16 CFR 314.4 (b), which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures; c. document a safeguard for each risk identified from step b above. Effect: A comprehensive information security framework has not been established to meet all of the GLBA requirements. Cause: We noted the University has designated a qualified individual to coordinate its information security program but a formal policy has not yet been developed. Additionally, the University has not formally performed a complete set of risk assessments nor documented thoroughly the safeguards as required under GLBA. Recommendation: We recommend the University develop a comprehensive information security policy, provide ongoing trainings, perform internal and external risk assessments, and document results and safeguards for all risks in a systematic manner.

GSA_MIGRATION