Northwest Mississippi Community College

Criteria: Special Test – Gramm-Leach-Bliley Act – Student Information Security – The Gramm-Leach- Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Under an institution’s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act , schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. (16 CFR 314.3; HEA 483(a)(3)(E) and HEA 485B(d)(2)). Condition: The College must have a written information security program to address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). Questioned Costs: None Context: The College has designated an individual to coordinate the information security program, and the College has procedures in place to perform a risk assessment and safeguard the security of student information; however, the College does not have a written information security program in accordance with the condition stated above. Effect: Non-compliance with program requirements. Cause: Internal controls were not adequately designed and implemented to ensure compliance with the program’s requirements. Identification as a Repeat Finding, if Applicable: N/A Recommendation: We recommend management continue to formalize their written policies and procedures for a information security to ensure program compliance the College complies with the program’s compliance requirements. Views of Responsible Officials and Planned Corrective Actions: Administration concurs with the finding. See Management’s Corrective Action Plan.

Name Connie Joseph Title Controller Phone (662) 562-3292 Email cjoseph@northwestms.edu Finding 2023-001: U.S. Department of Education-Student Financial Assistance Management is in the process of developing a written information security program. Anticipated Completion Date: Prior to June 30, 2024

Section II: Financial Statements Findings The results of our tests did not disclose any findings related to the financial statements that are required to be reported by Government Auditing Standards. Section III: Federal Awards Findings and Questioned Costs Finding 2022-001: Federal Program- Education Stabilization Fund COVID-19 - HEERF Strengthening Institutions Program and COVID-19 - HEERF Supplemental Assistance to Institutions of Higher Education (SAIHE) Program Assistance Listing Numbers 84.425M and 84.425S U.S. Department of Education Program Year 2021-2022 Other Noncompliance Criteria: Quarterly Public Reporting Condition: The College failed to include all expenditures for the second quarter of 2022 in the required quarterly report. The College is responsible for completing quarterly reports for HEERF and for establishing internal controls to ensure that reports are accurately submitted within federal requirements. Questioned Cost: N/A Context: All expenditures for funds expended by June 30, 2022 were not reported in the quarterly reports. Effect: The College failed to communicate information regarding HEERF Strengthening Institutions Program and HEERF Supplemental Assistance to Institutions of Higher Education (SAIHE) Program funding distributions to the public as required. HEERF Strengthening Institutions Program distributions of $304,971 and HEERF Supplemental Assistance to Institutions of Higher Education (SAIHE) Program distributions of $454,997 were not included in the June 30, 2022 quarterly report. Cause: Management turnover at the end of the fiscal year resulted in several end of year expenditures not being reported. Identification of repeat findings: Not a repeat finding. Recommendation: The College should submit a revised quarterly report that includes all funds expended by June 30, 2022. Views of responsible officials: See Corrective Action Plan

Individuals Responsible for Corrective Action Plan: Management will submit a revised second quarter 2022 reports that includes all funds expended through June 30, 2022. Anticipated Completion Date: September 30, 2023