Shasta-Tehama-Trinity Joint Community College District

Finding #2019-002: TRIO Cluster ? Student Contacts Federal Program Information Federal Catalog Number: TRIO Cluster ? CFDA 84.042 and CFDA 84.047 Federal Program Name: TRIO ? Student Support Services Criteria or Specific Requirement: Per the Uniform Guidance, it is required that non-Federal entities receiving Federal awards establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR Section 200.514 requires auditors to obtain an understanding of the non-Federal entity?s internal control over Federal programs, and plan the testing of internal control over major programs for the assertions relevant to the compliance requirements for each major program and perform testing of internal control as planned. Identified Condition: We noted that 1 out of 25 TRIO students selected (1 out of 9 selections pertaining to Educational Talent Search) was not provided with any contacts during the 2018-19 year due to program operational limitations. Causes and Effect: A program advisor was needed at the Trinity Preparatory Academy location, but not hired until late in the 2018-19 year. Questioned Costs: The District?s TRIO program?s funded budget from the Department of Education for the 2018-19 year is $256,455 for 500 students, resulting in a questioned cost of $512.91 for the one student impacted by this deficiency per the results of our testing. Recommendation: We recommend that the College monitor staffing at all program sites to ensure that services are provided to all enrolled students. Corrective Action Plan: The District agrees with this finding and recommendation. Review procedures will be implemented to ensure that all TRIO sites receive sufficient support for all participating students. Personnel responsible for implementation: Sue Huizinga Position of responsible personnel: Program Director Date of Implementation: Fall 2019

Finding #2019-003: Gramm-Leach-Bliley Act Compliance Criteria or Specific Requirement: The Gramm-Leach Bliley Act (GLBA) requires districts to have a documented response to the Safeguards Rule. Specifically, this response covers key requirements including: ?Designate an information security officer and related oversight responsibilities for the institution?ssecurity. ?Assess the risks to confidential information, assess the level of mitigating controls in place, andidentify action plans to accept or further mitigate remaining risks. ?Implement an information security program, including various technical and physical underlyingcontrols, such as data encryption and secure shredding processes. ?Oversee vendor relationships to ensure confidential data are secured at their locations whenapplicable and access is controlled when vendors connect to the institution. ?Perform an ongoing evaluation of their program to keep content current with an ever-evolvingsecurity environment. Condition: We noted that the development of the response is currently underway with anticipated completion and implementation during 2019-20. Questioned Costs: Not applicable Context: Compliance with GLBA requirements. Effect: The intent of the GLBA Safeguards Rule is to enhance security over confidential information. Without a documented response to all applicable requirements, the District is more susceptible to IT vulnerabilities than it would be following full implementation. Cause: Steps taken in response to GLBA compliance requirements, new for the 2018-19 year, require extensive administrative efforts to implement. Recommendation: The District should continue towards full implementation of its documented response to the GLBA Safeguards Rule in the 2019-20 year. Corrective Action Plan: The District agrees with this finding and recommendation. A documented response to the GLBA Safeguards Rule is currently underway and is projected for completion during 2019-20.