UNIVERSITY OF PUERTO RICOHigher Education

Finding Number: 2023-002 Federal Program Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) – 21.027 COVID-19 Higher Education Emergency Relief Fund (HEERF) - 84.425 Family Planning Services - 93.217 Category Internal Control Internal Control over Compliance Requirement Reporting Criteria Recipients must use the standard reporting forms and submit them in a timely manner as prescribed by the federal award agency and/or the Compliance Supplement. Condition It was observed that there are ineffective internal controls in place to ensure timely filing of reports within the established timeline. Specifically, there is a lack of formalized procedures and monitoring mechanisms to track and enforce adherence to reporting deadlines. Cause Processes and controls over the reporting requirements are not in place to ensure that the University complies with the submission of required reports timely. Effect The University could not provide evidence supporting the internal control operated effectively during the period. Lack of proper controls increases the risk of delayed reporting, potentially leading to regulatory non-compliance. Questioned Costs Not applicable. Context The programs mentioned above have different frequencies and types of reports. When combined, reports for the programs totaled 97 from which we selected 10 samples to test. Identification as a repeat finding, if applicable 2022-003 and 2022-004 (internal control portion only) Recommendation We recommend the University implements internal controls and/or monitoring procedures to ensure reports are completed and filed timely, and that such procedures include requirements for the supporting documentation to be retained as evidence of the control operation. Management’s Response The University of Puerto Rico concurs with this finding. Management response is included in a separate document.

Finding Number: 2023-003 Program Student Financial Assistance (SFA) Cluster - Various ALN Category Internal Control / Compliance Compliance Requirement Special Tests and Provisions – Return of Title IV Funds Criteria When a recipient of Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the recipient began the attendance, the institution must determine the amount of Title IV aid earned by the student as of the student’s withdrawal date. If the total amount of Title IV assistance earned by the student is less than the amount that was disbursed to the student or on his or her behalf as of the date of the institution’s determination that the student withdrew, the difference must be returned to the Title IV programs. The amount earned Title IV grant or loan assistance is calculated by determining the percentage of Title IV grant or loan assistance that has been earned by the student and applying that percentage to the total amount of Title IV grant or loan assistance that was or could have been disbursed to the student for the payment period or period of enrollment as of the student’s withdrawal date. A student earns 100 percent if his or her withdrawal date is on or after the completion of 60 percent. Otherwise, the percentage earned by the student is equal to the percentage (less than 60 percent) of the payment period or period of enrollment that was completed as of the student’s withdrawal date. The unearned amount of Title IV assistance to be returned is calculated by subtracting the amount of Title IV assistance earned by the student from the amount of Title IV aid that was disbursed to the student as of the date of the institution’s determination that the student withdrew (34 CFR 668.22(e)). Returns of Title IV funds are required to be deposited or transferred into the SFA account or electronic fund transfers initiated to ED as soon as possible, but no later than 45 days after the date institution determines that the student withdrew. Condition We noted two transactions selected for testing whereas the return of payment check was issued 45 days after the withdrawal date of the student. Cause Processed and controls over the return of payment requirements are not in place to ensure that the University issues payments timely. Effect The University did not comply with return of title IV funds requirements, which could lead to funds disallowance. Questioned Costs Not applicable. Context Our sample consisted of 40 items from a population that consisted of 789 withdrawn students. Identification as a repeat finding, if applicable Not applicable. Recommendation We recommend the University establishes procedures to ensure payments are issued timely and accurately, and that compliance with timeliness requirements is monitored. Management’s Response The University of Puerto Rico concurs with this finding. Management response is included in a separate document.

Finding Number: 2023-004 Program Student Financial Assistance (SFA) Cluster - Various ALN Category Internal Control / Compliance Compliance Requirement Special Tests and Provisions – Enrollment Reporting Criteria Under the Pell Grant and Education Department (ED) loan programs, institutions must complete and return within 15 days the Enrollment Reporting roster file placed in their Student Aid Internet Gateway (SAIG) (OMB No. 1845-0002) mailboxes sent by ED via NSLDS (OMB No.1845-0035). The institution determines the Enrollment Reporting roster file with the default set at minimum of every 60 days. Once received, the institution must update for changes in student status, report the date the enrollment status was effective, enter the new anticipated completion date, and submit the changes electronically through the batch method, spreadsheet submittal, or the NSLDS website. Institutions are responsible for timely reporting, whether they report directly or via a third-party servicer. A student’s enrollment status determines eligibility for in-school status, deferment, and grace periods, as well as for the payment of interest subsidies to FFEL Program loan holders by ED. Enrollment Reporting in a timely and accurate manner is critical for effective management of the programs. Enrollment information must be reported in the next updated Enrollment Reporting Roster file (due within 60 days). These changes include reductions or increases in attendance levels, withdrawals, graduations, or approved leaves-of-absence. As explained in the NSLDS Enrollment Reporting Guide, the Enrollment Reporting roster file is due within 15 days from the creation of the file that is placed in the institution’s SAIG (PELL, 34 CFR section 690.83(b)(2); FFEL, 34 CFR section 682.610; Direct Loan, 34 CFR section 685.309). Per 34 CFR Section 682.610 for the Federal Family Education Loan (FFEL) and 34 CFR Section 685.309 for the Direct Loans Program, schools must complete and return within 60 days the Enrollment Reporting roster file placed in their Student Aid Internet Gateway (SAIG) mailboxes sent by U.S Department of Education (ED) via National Student Loan Data System (NSLDS) (OMB No. 1845-0035). The institution determines how often it receives the Enrollment Reporting roster file with the default set at a minimum of every 60 days. Once received, the institution must update for changes in student status, report the date the enrollment status was effective, enter the new anticipated completion date, and submit the changes electronically through the batch method or the NSLDS website. Institutions are responsible for timely reporting, whether they report directly or via a third-party servicer. Condition We noted that for 22 students selected for testing, the status change reported to the National Student Loan Data System (NSLDS) was past the 60 days established threshold. Cause Processes and controls over the reporting of the student status change to the Department of Education are not in place to ensure that the University timely complies with this requirement. Effect This condition prevents the University from reporting a student’s status in a timely manner to the NSLDS, which can cause funds being awarded to individuals who are not entitled to receive student financial assistance. Also, an incorrect enrollment status and/or status date reported could cause a student's loan to be inappropriately delayed in being converted in repayment status. Questioned Costs Not applicable. Context Our sample consisted of 60 items (out of a population of 4,201 students that had a reduction or increase in attendance levels, dropped out, withdrew, never attended, or requested graduation for fiscal year 2023). Since several exceptions were identified, we concluded that the items do represent systematic occurrences. Identification as a repeat finding, if applicable 2022-002 Recommendation We recommend that the University establishes procedures to ensure that enrollment status changes are updated and accurately reported in a timely manner in the NSLDS database. Management’s Response The University of Puerto Rico concurs with this finding. Management response is included in a separate document.

Finding Number: 2022-002 Program Student Financial Assistance (SFA) Cluster - Various CFDA numbers Category Internal Control / Compliance Compliance Requirement Special Tests and Provisions ? Enrollment Reporting Criteria Under the Pell Grant and Education Department (ED) loan programs, institutions must complete and return within 15 days the Enrollment Reporting roster file placed in their Student Aid Internet Gateway (SAIG) (OMB No. 1845-0002) mailboxes sent by ED via NSLDS (OMB No.1845-0035). The institution determines the Enrollment Reporting roster file E5with the default set at minimum of every 60 days. Once received, the institution must update for changes in student status, report the date the enrollment status was effective, enter the new anticipated completion date, and submit the changes electronically through the batch method or the NSLDS website. Institutions are responsible for timely reporting, whether they report directly or via a third-party servicer. A student?s enrollment status determines eligibility for in-school status, deferment, and grace periods, as well as for the payment of interest subsidies to FFEL Program loan holders by ED. Enrollment Reporting in a timely and accurate manner is critical for effective management of the programs. Enrollment information must be reported in the next updated Enrollment Reporting Roster file (due within 60 days). These changes include reductions or increases in attendance levels, withdrawals, graduations, or approved leaves-of-absence. As explained in the NSLDS Enrollment Reporting Guide, the Enrollment Reporting roster file is due within 15 days from the creation of the file that is placed in the institution?s SAIG (PELL, 34 CFR section 690.83(b)(2); FFEL, 34 CFR section 682.610; Direct Loan, 34 CFR section 685.309). Per 34 CFR Section 682.610 for the Federal Family Education Loan (FFEL) and 34 CFR Section 685.309 for the Direct Loans Program, schools must complete and return within 60 days the Enrollment Reporting roster file placed in their Student Aid Internet Gateway (SAIG) mailboxes sent by U.S Department of Education (ED) via National Student Loan Data System (NSLDS) (OMB No. 1845-0035). The institution determines how often it receives the Enrollment Reporting roster file with the default set at every two months, but the minimum is twice a year. Once received, the institution must update for changes in student status, report the date the enrollment status was effective, enter the new anticipated completion date, and submit the changes electronically through the batch method or the NSLDS web site. Institutions are responsible for timely reporting, whether they report directly or via a third-party servicer. Unless the school expects to complete its next roster within 60 days, the school must notify the lender or Section III ? Federal Award Findings and Questioned Costs (continued) Finding Number: 2022-002 (continued) the guaranty agency within 30 days, if it discovers that a student who received a loan either did not enroll or ceased to be enrolled on at least a half-time basis (FFEL, 34 CFR section 682.610; Direct Loan, 34 CFR section 685.309). Condition We noted that for 17 students selected for testing, the University was not in compliance with the requirements as follows: Instances of Noncompliance: A ? The status change was never reported to National Student Loan Data System (NSLDS) which is the Department of Education central database for student aid. B - The status change reported to the National Student Loan Data System (NSLDS) was past the 60 days established threshold. C- The University could not provide supporting information from the National Student Loan Data System (NSLDS) to demonstrate accurate enrollment reporting was completed. "See Schedule of Findings and Questioned Costs for chart/table". Section III ? Federal Award Findings and Questioned Costs (continued) Finding Number: 2022-002 (continued) Cause Processes and controls over the reporting of the student status change to the Department of Education are not in place to ensure that the University timely complies with this requirement. An incorrect enrollment status and/or status date reported could cause a student's loan to be inappropriately delayed in being converted in repayment status. Effect This condition prevents the University from reporting a student?s status in a timely manner to the NSLDS, which can cause funds being awarded to individuals who are not entitled to receive student financial assistance. Questioned Costs Not applicable. Context Our sample consisted of 60 items (out of a population of 8,133 students that had a reduction or increase in attendance levels, dropped out, withdrew+E1, never attended, or requested graduation for fiscal year 2022). Since several exceptions were identified, we concluded that the items do represent systematic occurrences. Identification as a repeat finding, if applicable 2021-002 Recommendation We recommend that the University establishes procedures to ensure that enrollment status changes are updated and accurately reported in a timely manner in the NSLDS database. Management?s Response The University of Puerto Rico concurs with this finding.

Finding Number: 2022-003 Program COVID-19 Higher Education Emergency Relief Fund (HEERF) - 84.425 Category Internal Control / Compliance Compliance Requirement Reporting Criteria The Department of Education required the submission of an annual report for HEERF grantees on May 6, 2022, as per Electronic Announcement General-22-24. Based on this requirement, institutions must report on their uses of HEERF I CARES Act funds, HEERF II CRRSAA funds, and HEERF III ARP funds in advance of the ARP annual reporting deadline. Condition We noted that one of the University?s units submitted the Annual Report after the due date of May 6, 2022. Instances of Noncompliance: A ? Annual report was submitted after the established due date. Cause Processes and controls over the reporting requirements are not in place to ensure that the University complies with the requirement to submit required reports timely. Effect The University did not comply with timing of reporting requirements, which could lead to funds disallowance. Questioned Costs Not applicable. "See Schedule of Findings and Questioned Costs for chart/table". Context Our sample consisted of 9 items for quarterly reports from a total population of 88 reports, and the whole population (11 units) for the annual reports. Identification as a repeat finding, if applicable 2020-004 Recommendation We recommend the University establishes procedures to ensure reports are completed timely and accurately, and that compliance with reporting requirements is monitored. Management?s Response The University of Puerto Rico concurs with this finding.

Finding Number: 2022-004 Program Coronavirus State and Local Fiscal Recovery Funds (CSLFRF) ? 21.027 Category Internal Control / Compliance Compliance Requirement Reporting Criteria The Interim Final Rule clarifies that the lists of transferees in sections 602(c)(3) and 603(c)(3) are not exclusive, and recipients may transfer funds to constituent units of government or private entities beyond those specified in the statute. A transferee receiving a transfer from a recipient under sections 602(c)(3) and 603(c)(3) will be considered to be a subrecipient and will be expected to comply with all subrecipient reporting requirements. The University of Puerto Rico must comply with biweekly reporting requirements of the Puerto Rico Fiscal Agency and Financial Advisory Authority (AAFAF). Condition We noted that one report was submitted after the established deadline and another report was never submitted to the awarding entity. Instances of Noncompliance: A ? Biweekly report was submitted after the established due date. B - Biweekly report was never submitted. "See Schedule of Findings and Questioned Costs for chart/table". Cause Processed and controls over the reporting requirements are not in place to ensure that the University complies with the requirement to submit required reports timely. Effect The University did not comply with enrollment reporting requirements, which could lead to funds disallowance. Questioned Costs Not applicable. Context Our sample consisted of 100% of the population which was 14 items (biweekly reports). Identification as a repeat finding, if applicable Not applicable. Recommendation We recommend the University establishes procedures to ensure reports are completed timely and accurately, and that compliance with reporting requirements is monitored. Management?s Response The University of Puerto Rico concurs with this finding.

Program Student Financial Assistance Cluster (84.063) Category Internal Control / Compliance Compliance Requirement Special Tests and Provisions ? Enrollment Reporting Criteria Under the Pell Grant and Education Department (ED) loan programs, institutions must complete and return within 15 days the Enrollment Reporting roster file [formerly the Student Status Confirmation Report (SSCR)] placed in their Student Aid Internet Gateway (SAIG) (OMB No. 1845-0002) mailboxes sent by ED via NSLDS (OMB No.1845-0035). The institution determines the Enrollment Reporting roster file with the default set at minimum of every 60 days. Once received, the institution must update for changes in student status, report the date the enrollment status was effective, enter the new anticipated completion date, and submit the changes electronically through the batch method or the NSLDS website. Institutions are responsible for timely reporting, whether they report directly or via a third-party servicer. A student?s enrollment status determines eligibility for in-school status, deferment, and grace periods, as well as for the payment of interest subsidies to FFEL Program loan holders by ED. Enrollment Reporting in a timely and accurate manner is critical for effective management of the programs. Enrollment information must be reported in the next updated Enrollment Reporting Roster file (due within 60 days). These changes include reductions or increases in attendance levels, withdrawals, graduations, or approved leaves-of-absence. As explained in the NSLDS Enrollment Reporting Guide, the Enrollment Reporting roster file is due within 15 days from the creation of the file that is placed in the institution?s SAIG (PELL, 34 CFR section 690.83(b)(2); FFEL, 34 CFR section 682.610; Direct Loan, 34 CFR section 685.309).

Program Student Financial Assistance Cluster (Various Assistance Listing numbers) Category Internal Control / Compliance Compliance Requirement Special Tests and Provisions ? Gramm-Leach-Bliley Act ? Student Information Security Criteria 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 16 CFR 314.4 (b) requires institutions to ?Identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information, and assess the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risks in each relevant area of your operations, including: (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures.? 16 CFR 314.4(c) requires institutions to ?Design and implement information safeguards to control the risks you identify through risk assessment, and regularly test or otherwise monitor the effectiveness of the safeguards? key controls, systems, and procedures.?

Program Student Financial Assistance Cluster (Various CFDA numbers) Category Internal Control / Compliance Compliance Requirement Special Tests and Provisions ? Enrollment Reporting Criteria Under the Pell Grant and Education Department (ED) loan programs, institutions must complete and return within 15 days the Enrollment Reporting roster file [formerly the Student Status Confirmation Report (SSCR)] placed in their Student Aid Internet Gateway (SAIG) (OMB No. 1845-0002) mailboxes sent by ED via NSLDS (OMB No.1845-0035). The institution determines the Enrollment Reporting roster file with the default set at minimum of every 60 days. Once received, the institution must update for changes in student status, report the date the enrollment status was effective, enter the new anticipated completion date, and submit the changes electronically through the batch method or the NSLDS website. Institutions are responsible for timely reporting, whether they report directly or via a third-party servicer. A student?s enrollment status determines eligibility for in-school status, deferment, and grace periods, as well as for the payment of interest subsidies to FFEL Program loan holders by ED. Enrollment Reporting in a timely and accurate manner is critical for effective management of the programs. Enrollment information must be reported within 30 days whenever attendance changes for students, unless a roster will be submitted within 60 days. These changes include reductions or increases in attendance levels, withdrawals, graduations, or approved leaves-of-absence. As explained in the NSLDS Enrollment Reporting Guide, the Enrollment Reporting roster file is due within 15 days from the creation of the file that is placed in the institution?s SAIG (PELL, 34 CFR section 690.83(b)(2); FFEL, 34 CFR section 682.610; Direct Loan, 34 CFR section 685.309). Per 34 CFR Section 682.610 for the Federal Family Education Loan (FFEL) and 34 CFR Section 685.309 for the Direct Loans Program, schools must complete and return within 30 days the Enrollment Reporting roster file [formerly the Student Status Confirmation Report (SSCR)] placed in their Student Aid Internet Gateway (SAIG) mailboxes sent by U.S Department of Education (ED) via National Student Loan Data System (NSLDS) (OMB No. 1845-0035). The institution determines how often it receives the Enrollment Reporting roster file with the default set at every two months, but the minimum is twice a year. Once received, the institution must update for changes in student status, report the date the enrollment status was effective, enter the new anticipated completion date, and submit the changes electronically through the batch method or the NSLDS web site. Institutions are responsible for timely reporting, whether they report directly or via a third-party servicer. Unless the school expects to complete its next roster within 60 days, the school must notify the lender or the guaranty agency within 30 days, if it discovers that a student who received a loan either did not enroll or ceased to be enrolled on at least a half-time basis (FFEL, 34 CFR section 682.610; Direct Loan, 34 CFR section 685.309). Condition We noted that for twenty-two (22) students selected for testing, the University was not in compliance with the requirement as follows: Exceptions and Instances of Noncompliance A- The status change of the student was not reported to the U.S. Department of Education (DOE) within 30 days (unless roster was to be submitted within 60 days) as required. B- The status change was never reported to National Student Loan Data System (NSLDS) which is the DOE central database for student aid. C- The student was reported as withdrawn instead of graduated. D- The student was reported as full-time instead of graduated. E- The student was reported as never attended instead of graduated. Item Number Campus Exceptions 2316 Rio Piedras A 2317 Rio Piedras A 2377 Rio Piedras A 2494 Rio Piedras A 2773 Rio Piedras A 2847 Rio Piedras A 2859 Rio Piedras A 3175 Rio Piedras A 3255 Rio Piedras A 3486 Rio Piedras A 5095 UPR Cayey A 6814 Carolina A 6851 Carolina A 1368 RCM A, D 8831 Bayamon A, D 6918 Carolina C 1875 Humacao C 6952 Carolina C 7926 Ponce E 8058 Ponce E 8106 Ponce E 3055 Rio Piedras B The process and controls over the reporting of the student status change to the U.S. Department of Education are not in place to ensure that the University timely complies with this requirement. An incorrect enrollment status and/or status date reported could cause a student's loan to be inappropriately delayed in being converted in repayment status. Effect This condition prevents the University from reporting a student?s status in a timely manner to the NSLDS, which can cause funds being awarded to individuals who are not entitled to receive student financial assistance. Questioned Costs Not applicable. Context Our sample consisted of 60 items (out of a population of 8,862 students that withdrew, never attended and requested graduation for fiscal year 2020). Since several exceptions were identified, we concluded that these items do not represent non-systematic occurrences. Identification as a repeat finding, if applicable 2019-002 Recommendation We recommend that the University establishes procedures to ensure that enrollment status changes are updated and accurately reported in a timely manner in the NSLDS database. Management?s Response The University of Puerto Rico concurs with this finding.

Program Student Financial Assistance Cluster (Various CFDA numbers) Category Internal Control / Compliance Compliance Requirement Special Tests and Provisions ? Gramm-Leach-Bliley Act ? Student Information Security Criteria 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 16 CFR 314.4 (b) requires institutions to ?Identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information, and assess the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risks in each relevant area of your operations, including: (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures.? 16 CFR 314.4(c) requires institutions to ?Design and implement information safeguards to control the risks you identify through risk assessment, and regularly test or otherwise monitor the effectiveness of the safeguards? key controls, systems, and procedures.? Condition The University did not perform a risk assessment that addresses the three required areas as noted in 16 CFR 314.4(b), which are 1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other systems failures. Further, since a risk assessment was not completed, the University did not document safeguards as required by 16 CFR 314.4(c). Cause The University does not have policies and procedures, including internal controls, addressing the requirements of 16 CFR 314.4(b) and (c). Effect The absence of policies and procedures could result in the loss or improper storage of student account information. Questioned Costs Not applicable. Context Total expenditures for the SFA cluster in total were $250,945,495 for the year ended June 30, 2020. Identification as a repeat finding, if applicable 2019-003 Recommendation We recommend that management implement policies and procedures, including internal controls, to ensure that they are in compliance with 16 CFR 314.4(b) and (c). Management?s Response The University of Puerto Rico concurs with this finding.

Program COVID-19 Higher Education Emergency Relief Fund (HEERF) Student Portion (CFDA 84.425E) Category Internal Control / Compliance Compliance Requirement Reporting Criteria Section 18004(e) of the Coronavirus Aid, Relief, and Economic Security Act (?CARES Act? or the ?Act?)), Pub. L. No. 116-136, 134 Stat. 281 (March 27, 2020), directs institutions receiving funds under Section 18004 of the Act to submit (in a time and manner required by the Secretary) a report to the Secretary describing the use of funds distributed from the Higher Education Emergency Relief Fund (?HEERF?). Section 18004(c) of the CARES Act requires institutions to use no less than 50 percent of the funds received from Section 18004(a)(1) of the CARES Act to provide Emergency Financial Aid Grants to students for expenses related to the disruption of campus operations due to coronavirus (including eligible expenses under a student?s cost of attendance such as food, housing, course materials, technology, health care, and child care). The Certification and Agreement directs each institution applying for HEERF funds to comply with Section 18004(e) of the CARES Act and submit an initial report (the ?30-day Fund Report?) to the Secretary thirty (30) days from the date of the institution?s Certification and Agreement to the Department. Condition We noted that all eleven (11) of the University Units published their initial report after 30 days of the Certification and Agreement (?CAN?) date and the Allocation date. Exceptions and Instances of Noncompliance Unit Grant Award CAN Date Days Since CAN Allocation Dates Days from Allocation RRP P425E200186 4/9/2020 57 4/9/2020 57 RUM P425E200957 4/23/2020 39 4/9/2020 53 RCM P425E202801 4/20/2020 50 4/9/2020 61 CAY P425E200388 4/11/2020 41 4/9/2020 43 HUM P425E202573 4/14/2020 45 4/9/2020 50 AGU P425E201512 4/13/2020 56 4/9/2020 60 UTU P425E200736 4/13/2020 59 4/9/2020 63 CAR P425E202891 4/21/2020 51 4/9/2020 63 ARE P425E200779 3/22/2020 58 4/9/2020 40 PON P425E201235 4/13/2020 39 4/9/2020 43 BAY P425E201258 4/14/2020 58 4/9/2020 63 Cause The process and controls over the reporting request are not in place to ensure that the University complies with the requirement to submit required reports timely. Effect The University did not comply with timing of reporting requirements, which could lead to funds disallowance. Questioned Costs Not applicable.

Program Student Financial Assistance Cluster (Various CFDA numbers) Category Internal Control / Compliance Compliance Requirement Special Tests and Provisions ? Enrollment Reporting Criteria Under the Pell Grant and Education Department (ED) loan programs, institutions must complete and return within 15 days the Enrollment Reporting roster file [formerly the Student Status Confirmation Report (SSCR)] placed in their Student Aid Internet Gateway (SAIG) (OMB No. 1845-0002) mailboxes sent by ED via NSLDS (OMB No.1845-0035). The institution determines the Enrollment Reporting roster file with the default set at minimum of every 60 days. Once received, the institution must update for changes in student status, report the date the enrollment status was effective, enter the new anticipated completion date, and submit the changes electronically through the batch method or the NSLDS website. Institutions are responsible for timely reporting, whether they report directly or via a third-party servicer. A student?s enrollment status determines eligibility for in-school status, deferment, and grace periods, as well as for the payment of interest subsidies to FFEL Program loan holders by ED. Enrollment Reporting in a timely and accurate manner is critical for effective management of the programs. Enrollment information must be reported within 30 days whenever attendance changes for students, unless a roster will be submitted within 60 days. These changes include reductions or increases in attendance levels, withdrawals, graduations, or approved leaves-of-absence. As explained in the NSLDS Enrollment Reporting Guide, the Enrollment Reporting roster file is due within 15 days from the creation of the file that is placed in the institution?s SAIG (PELL, 34 CFR section 690.83(b)(2); FFEL, 34 CFR section 682.610; Direct Loan, 34 CFR section 685.309). Per 34 CFR Section 682.610 for the Federal Family Education Loan (FFEL) and 34 CFR Section 685.309 for the Direct Loans Program, schools must complete and return within 30 days the Enrollment Reporting roster file [formerly the Student Status Confirmation Report (SSCR)] placed in their Student Aid Internet Gateway (SAIG) mailboxes sent by U.S Department of Education (ED) via National Student Loan Data System (NSLDS) (OMB No. 1845-0035). The institution determines how often it receives the Enrollment Reporting roster file with the default set at every two months, but the minimum is twice a year. Once received, the institution must update for changes in student status, report the date the enrollment status was effective, enter the new anticipated completion date, and submit the changes electronically through the batch method or the NSLDS web site. Institutions are responsible for timely reporting, whether they report directly or via a third-party servicer. Unless the school expects to complete its next roster within 60 days, the school must notify the lender or the guaranty agency within 30 days, if it discovers that a student who received a loan either did not enroll or ceased to be enrolled on at least a half-time basis (FFEL, 34 CFR section 682.610; Direct Loan, 34 CFR section 685.309). Condition We noted that for eleven (11) students selected for testing, the University was not in compliance with the requirement as follows: Exceptions and Instances of Noncompliance A- The status change of the student was not reported to the U.S. Department of Education (DOE) within 30 days (unless roster was to be submitted within 60 days) as required. B- The status change was never reported to National Student Loan Data System (NSLDS) which is the DOE central database for student aid. C- The student was reported as withdrawn instead of graduated. Item Number Campus Exceptions 2312 RCM A, C 2322 RCM A, C 2450 RCM A, C 2473 RCM A, C 429 Rio Piedras A 553 Rio Piedras A 565 Rio Piedras A 1344 Rio Piedras A 47 Rio Piedras B 2948 Carolina A 3006 Arecibo A Cause The process and controls over the enrollment reporting of the student status change to the U.S. Department of Education are not in place to ensure that the University timely complies with this requirement. An incorrect enrollment status and/or status date reported could cause a student's loan to be inappropriately delayed in being converted to repayment status. Effect This condition prevents the University from reporting a student?s status in a timely manner to the NSLDS, which can cause funds being awarded to individuals who are not entitled to receive student financial assistance. Questioned Costs Not applicable. Context Our sample consisted of 60 items (out of a population of 2,017 students that withdrew, never attended and requested graduation for fiscal year 2019). Since several exceptions were identified, we concluded that these items do not represent non-systematic occurrences. Identification as a repeat finding, if applicable 2018-002 Recommendation We recommend that the University establishes procedures to ensure that enrollment status changes are updated and accurately reported in a timely manner in the NSLDS database. Management?s Response and Planned Corrective Actions The University of Puerto Rico concurs with this finding. Refer to separately issued Corrective Action Plan.

Program Student Financial Assistance Cluster (Various CFDA numbers) Category Internal Control / Compliance Compliance Requirement Special Tests and Provisions ? Gramm-Leach-Bliley Act ? Student Information Security Criteria 2 CFR 200.303 requires that a non-federal entity must ?(a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 16 CFR 314.4 (b) requires institutions to ?Identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information, and assess the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risks in each relevant area of your operations, including: (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures.? 16 CFR 314.4(c) requires institutions to ?Design and implement information safeguards to control the risks you identify through risk assessment, and regularly test or otherwise monitor the effectiveness of the safeguards? key controls, systems, and procedures.? Condition The University did not perform a risk assessment that addresses the three required areas as noted in 16 CFR 314.4(b), which are 1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other systems failures. Further, since a risk assessment was not completed, the University did not document safeguards as required by 16 CFR 314.4(c). Cause The University does not have policies and procedures, including internal controls, addressing the requirements of 16 CFR 314.4(b) and (c). Effect The absence of policies and procedures could result in the loss or improper storage of student account information. Questioned Costs Not applicable. Context Total expenditures for the SFA cluster in total were $249,098,768 for the year ended June 30, 2019. Identification as a repeat finding, if applicable Not applicable. Recommendation We recommend that management implement policies and procedures, including internal controls, to ensure that they are in compliance with 16 CFR 314.4(b) and (c). Management?s Response and Planned Corrective Actions The University of Puerto Rico concurs with this finding. Refer to separately issued Corrective Action Plan.

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION