Oklahoma State UniversityHigher Education

Federal Agency: National Science Foundation, U.S. Department of Transportation, U.S. Department of Energy, U.S. Department of Commerce Federal Program Name: Research & Development Assistance Listing Number: 11.469, 20.000, 47.083 and 81.089 Federal Award Identification Number and Year: 1946093 - 2025, 692Ml5-20-T-00029 - 2025, DEFE0031776 - 2025, NA23NWS4690009 – 2025 Pass-Through Agency: Iowa State University Pass-Through Number: 692M15-20-T-00029 PASS THRU 023063C Award Period: July 1, 2024 to June 30, 2025 Type of Finding: - Significant Deficiency in Internal Control over Compliance - Other Matters Criteria or specific requirement: Uniform Grant Guidance (2 CFR Section 200.305(b)(3)) requires that when the reimbursement method is used, the Federal awarding agency or pass-through entity must make payment within 30 calendar days after receipt of the billing, unless the Federal awarding agency or pass-through entity reasonably believes the request to be improper. Per Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: Oklahoma State University Stillwater (OSU STW) did not make payments to subrecipients within 30 days after receipt of invoices. Questioned costs: None. Context: During our testing we identified 7 subrecipient payments from OSU STW out of 40 payments that did not process payment requests from the subrecipients timely. Cause: OSU STW did not process payment requests from the subrecipient timely. Effect: Subrecipients on federal awards do not receive timely payment for federal contract work. Repeat Finding: No Recommendation: We recommend OSU STW review and update policies and procedures to allow for more timely payment to subrecipients for work the University contracts them to perform. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Federal Agency: U.S. Department of Health and Human Services Federal Program Name: Research & Development Assistance Listing Number: 93.859 Federal Award Identification Number and Year: 5P20GM109097 - 2025 Award Period: July 1, 2024 to June 30, 2025 Type of Finding: - Significant Deficiency in Internal Control over Compliance - Other Matters Criteria or specific requirement: Uniform Grant Guidance, 2 CFR 200.313(d)(2), procedures for managing equipment (including replacement equipment), whether acquired in whole or in part under a Federal award, until disposition takes place will, as a minimum, meet the following requirements: a physical inventory of the property must be taken and the results reconciled with the property records at least once every two years. Per Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: Oklahoma State University Center for Health Sciences (OSU CHS) did not properly maintain physical inventory of property purchased with federal funds. Questioned costs: None. Context: During our testing, we identified 1 out of 40 equipment items sampled that were purchased with federal funds did not have documentation of a completed physical inventory and could not be physically observed, as the equipment was reported to be misplaced. Cause: OSU CHS did not have effective controls in place to ensure that equipment purchased with federal funds was subject to a timely physical inventory and appropriately tracked, including procedures to ensure equipment could be located for observation. Effect: As a result, OSU CHS was unable to demonstrate the existence and proper safeguarding of equipment purchased with federal funds, increasing the risk that equipment may not be properly monitored, safeguarded, or used in accordance with federal requirements. Repeat Finding: No Recommendation: We recommend that OSU CHS implement and consistently perform procedures to ensure that all equipment purchased with federal funds is subject to a physical inventory at least once every two years, with results properly documented and reconciled to equipment records. We further recommend that OSU CHS strengthen controls over tracking equipment locations to ensure that federally funded equipment can be readily identified and physically located when required. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Federal Agency: U.S. Department of Transportation and U.S. Treasury Federal Program Name: Research & Development and Coronavirus State and Local Fiscal Recovery Funds Assistance Listing Number: 20.000 and 21.027 Federal Award Identification Number and Year: 692Ml5-20-T-00029-2025 and SLFRP4646-2025 Pass-Through Agency: Iowa State University Pass-Through Number: 692M15-20-T-00029 PASS THRU 023063C Award Period: July 1, 2024 to June 30, 2025 Type of Finding: - Significant Deficiency in Internal Control over Compliance - Other Matters Criteria or specific requirement: Per Uniform Guidance 2 CFR 200.318(i), the recipient must maintain records sufficient to detail the history of each procurement transaction. These records must include the rationale for the procurement method, contract type selection, contractor selection or rejection, and the basis for the contract price. Per Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: Oklahoma State University Stillwater (OSU STW) and Oklahoma State University Center for Health Sciences (OSU CHS) did not go through procurement procedures prior to entering into a contract with the vendor. Questioned costs: None. Context: During our testing of the Research & Development Cluster, we identified 1 transaction from OSU STW out of 40 transactions that did not go through the proper procurement procedures. During our testing of the Coronavirus State and Local Fiscal Recovery Funds Program, we identified 1 transaction from OSU CHS out of 6 transactions that did not go through the proper procurement procedures. Cause: OSU STW and OSU CHS did not have an effective control in place to ensure that the purchases went through the procurement procedures. Effect: OSU STW and OSU CHS were not in compliance with the regulation to go through the procurement procedures prior to entering a contract. Repeat Finding: No Recommendation: We recommend that OSU STW and OSU CHS review policies and procedures for procurement to ensure that every applicable transaction is going through the proper procurement procedures. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Federal Agency: Federal Government Federal Program Name: Research & Development and Economic Development Cluster Assistance Listing Number: Multiple Federal Award Identification Number and Year: Multiple Pass-Through Agency: Multiple Pass-Through Number: Multiple Award Period: July 1, 2024 to June 30, 2025 Type of Finding: - Material Weakness in Internal Control over Compliance Criteria or specific requirement: 2 CFR 200.403: Factors affecting allowability of costs; 2 CFR 200.413: Direct costs; 2 CFR 200.414: Indirect costs, OSU Policy 4-0135. Per Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: Oklahoma State University’s (OSU) policies were not consistently followed related to Professional Engineering Service (PES) rates charged by Oklahoma Aerospace Institute for Research and Education (OAIRE), a department within OSU. Questioned costs: Up to $2,853,832 of which approximately $935,974 occurred in FY2025. Of this $2,853,832, $1,333,596 was related to cost-reimbursable agreements, $1,159,037 to time and materials agreements, $221,613 to fixed price agreements, and $139,586 to undefined agreements. Context: OAIRE developed (PES) rates, which are the types of hourly rates typically used by contractors in time-and-materials type federal agreements. In some instances, OAIRE charged these fixed hourly rates for PES work in cost-reimbursable federal agreements, which resulted in OAIRE charging more than its actual costs incurred for such PES work. In addition, the PES rates were not consistent with OSU’s facilities and administration (F&A) rate agreement in that they included costs typically charged as indirect in its direct cost labor rates without justification and defining special circumstances when bidding contract rates. Certain labor rates were also calculated based on an understated number of available hours, which resulted in an overstated PES rate. Cause: Professional services rates were developed without documented review or attestation by subject matter experts in research administration or sponsored programs. Effect: Failure to adhere to costing principles may result in questioned costs and overbilling to sponsors. Repeat Finding: No Recommendation: We recommend that OSU should notify the applicable sponsors and federal agencies regarding the calculated questioned costs and make any necessary repayments or adjustments. Further, OSU should develop and document a process to ensure the PES rates are developed and billed in accordance with OSU Policy, applicable federal regulations, and the requirements of OSU’s Federal Agreements. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Federal agency: Department of Education Federal program title: Student Financial Assistance Cluster Assistance Listing Number: 84.268 Federal Award Identification Number and Year: P268K243215 - 2023 Award Period: July 1, 2023, to June 30, 2024 Type of Finding: Compliance, Other Matter Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: 34 CFR 668.21(a) states that the institution must return all title IV, HEA program funds that were credited to the student's account at the institution or disbursed directly to the student for the payment period. The institution must return those funds no later than 30 days after the date that the institution becomes aware that the student will not or has not begun attendance. Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: Oklahoma State University Oklahoma City (OSU OKC) incorrectly calculated Return to Title IV (R2T4) calculations. Context: During our testing of 5 students at OSU OKC, we identified 2 students had incorrect number of break days used in R2T4 calculation. Questioned costs: $65 Cause: OSU OKC was incorrectly calculating the appropriate number of scheduled break days in Fall Semester. Effect: The University could return incorrect amounts based off of their calculations and incorrect calculations could affect student repayment amounts based off of amount earned. Repeat finding: No Recommendation: We recommend OSU-OKC review its current process for determination of break days and ensure that their calculations are following compliance requirements. Views of responsible official: Management agrees with the finding and has developed a plan to correct the finding.

Federal Agency: US Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063, 84.268, Federal Award Identification Number and Year: P268K242046 - 2024, P063P232046 - 2024, P268K246759 - 2024 Award Period: July 1, 2023, to June 30, 2024 Type of Finding: Compliance, Other Matter Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Additionally, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Changes to said status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days. Condition: The Oklahoma State University Center for Health Sciences (OSU CHS) did not properly report student enrollment changes for students who received federal student aid to the National Student Loan Data System (NSLDS). Context: During our testing of 2 students at OSU CHS, we identified 1 student that had incorrect program enrollment effective date. Questioned costs: None Cause: OSU CHS did not have proper procedures in place to verify students' status in NSLDS matched the institutions records in a timely manner. Effect: The University was not in compliance with the requirements to properly report student enrollment data correctly. Repeat finding: No Recommendation: We recommend OSU CHS review current processes for reporting to NSLDS and implement procedures to ensure program enrollment submissions are reported accurately. View of responsible official: Management agrees with the finding and has developed a plan to correct the finding.

Federal Agency: US Department of Education Federal Program Title: Improvement of Postsecondary Education Funding Assistance Listing Number: 84.116 Identification Number and Year: P116Z230208-2023 & P116Z230252-2023 Award Period: July 1, 2023, to June 30, 2024 Type of Finding Compliance, Other Matter Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 200.308(f)(3) the Federal Government required a recipient of federal awards must receive prior written approval from the Federal agency for the disengagement of key personnel from a project for more than three months, or a 25% reduction in time and effort devoted to the Federal award. Condition: During the testing of Special Tests and Provisions, 2 of the 3 grants tested did not meet the key personnel level of effort requirements stipulated in the award documents, as the key personnel listed in the award documents did not have time and effort tracked towards the grant projects. Context: During the testing of 3 grants with Level of Effort provisions in the grant award notification, 2 grants did not meet the level of effort for key personnel required by the Federal agency. Questioned costs: None Cause: The University was unaware of the level of effort requirement stated on the grant agreements. Effect: Key personnel listed in the award documents did not have time and effort tracked towards the grant projects. Repeat finding: No Recommendation: The University should continue to review budgets and key personnel submitted with grants proposal to Federal agencies. View of responsible official: Management agrees with the finding and has developed a plan to correct the finding.

Federal agency: Department of Education Federal program title: Student Financial Assistance Cluster Assistance Listing Number: 84.007, 84.063, 84.268, 84.033 Federal Award Identification Number and Year: P268K236759 - 2023, P033A223433 – 2023, P007A223442 - 2023, P063P222046 - 2023, P268K232046 - 2023, P033A223442 - 2023 Award Period: July 1, 2022, to June 30, 2023 Type of Finding: Compliance, Other Matter Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 180.300, when entering into a covered transaction with another person (an individual, corporation, partnership, association, unit of government, or legal entity), you must verify that the person with whom you intend to do business is not excluded or disqualified. Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University did not retain proper documentation for suspension and debarment verification. Context: During our testing, we noted one out of five vendors tested did not have proper documentation for suspension and debarment verification. Questioned costs: None. Cause: The University doesn't have proper controls in place to ensure suspension and debarment requirements are monitored and reviewed. Effect: Failure to assess suspension and debarment could lead to the University working with unqualified vendors. Repeat finding: No Recommendation: We recommend the University review procedures to monitor and retain documentation for suspension and debarment verification. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Federal Agency: US Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007, 84.063, 84.268, 84.033 Federal Award Identification Number and Year: P007A223440 - 2023, P063P223215 - 2023, P268K233215 - 2023, P033A223440 – 2023, P007A223442 - 2023, P063P222046 - 2023, P268K232046 - 2023, P033A223442 - 2023 Award Period: July 1, 2022, to June 30, 2023 Type of Finding: Compliance, Other Matter Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Code of Federal Regulations (34 CFR 685.309) requires enrollment status changes for students be reported to NSLDS within 30 days or within 60 days if the student with the status change will be reported on a scheduled transmission within 60 days of the change in status. Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: Oklahoma State University Oklahoma City (OSU OKC) and Oklahoma State University Institute of Technology (OSUIT) did not properly report student enrollment changes for students who received federal student aid to the National Student Loan Data System (NSLDS). Context: During our testing of 5 students at OSU OKC, we noted all 5 student's status changes were reported after the 60-day reporting requirement. During our testing of 3 students at OSUIT we noted all 3 student's status changes were reported after the 60-day reporting requirement. Questioned costs: None Cause: The Student Financial Aid Office does not have a process in place to ensure all enrollment changes are reported within 60 days to NSLDS. Effect: If the NSLDS system is not updated with the student information, over awards could occur should the student transfer to another institution and the student may not properly enter the repayment period. Repeat finding: No Recommendation: We recommend OSU OKC and OSUIT review current processes for reporting to NSLDS and implement procedures to ensure submissions are reported timely and accurately. View of responsible official: Management agrees with the finding and has already implemented a corrective plan.

Federal Agency: US Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.007, 84.038, 84.063, 84.268, 84.379, 84.033 Federal Award Identification Number and Year: Various Award Period: July 1, 2022, to June 30, 2023 Type of Finding Compliance, Other Matter Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Gramm-Leach Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The regulation states that the college must designate a qualified individual responsible for overseeing and implementing your information security program and enforcing your information security program.(16 CFR 314.4(a)). The entity shall have a Written Information Security Program (WISP) that outlines the design and implementation of the risk assessment procedures. (16 CFR 314.4(b)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The university was missing all of the requirements from the Gram-Leach-Bliley Act except for having a WISP, implementation of multi-factor authentication, and implementation of policies and procedures to ensure personnel are able to enact information security program. Context: These new GLBA requirements were applicable beginning on June 9, 2023, and there were multiple elements missing from their Written Information Security Program. Questioned costs: None Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance Effect: The University could fail to address risks related to the University’s IT safeguards as stated in the Gramm-Leach-Bliley act. Repeat finding: No Recommendation: CLA recommends that the University review the updated GLBA requirements and ensure their WISP includes all required elements. View of responsible official: Management agrees with the finding and has already implemented a corrective plan.

Federal Agency: US Department of Education Federal Program Title: Education Stabilization Fund Assistance Listing Number: 84.425 Federal Award Identification Number and Year: Various Award Period: July 1, 2022, to June 30, 2023 Type of Finding Compliance, Other Matter Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per 2 CFR 180.300, when entering into a covered transaction with another person (an individual, corporation, partnership, association, unit of government, or legal entity), you must verify that the person with whom you intend to do business is not excluded or disqualified. Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University did not retain proper documentation for suspension and debarment verification. Questioned costs: None. Cause: The University doesn't have proper controls in place to ensure suspension and debarment requirements are monitored and reviewed. Effect: Failure to assess suspension and debarment could lead to the University working with unqualified vendors. Repeat finding: No Recommendation: We recommend the University review procedures to monitor and retain documentation for suspension and debarment verification. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Criteria or specific requirement: Uniform Grant Guidance (2 CFR 200.303) requires nonfederal entities receiving Federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. The U.S. Department of Education (Department) published an Information for Financial Aid Professionals (IFAP) Electronic Announcement (EA) that describes the public reporting requirements for Emergency Financial Aid Grants to Students under the Coronavirus Response and Relief Supplemental Appropriations Act, 2021 (CRRSAA) and American Rescue Plan Act, 2021 (ARP) section (a)(1) and (a)(4) programs. The institution?s HEERF report must also be updated no later than 10 days after the end of each calendar quarter (September 30, and December 31, March 31, June 30) thereafter, unless the Secretary specifies an alternative method of reporting. Condition: The University did not submit the 12/31/21 student quarterly report for the Stillwater campus in a timely manner. Context: During our testing of 8 student quarterly public disclosure reporting, from a statistically valid sample, we noted one quarterly report was uploaded to the University's website after the required due date of January 10,2022, posted on February 14, 2022. This does not include the 8 quarterly financial reports, or 4 annual reports submitted as required. Questioned costs: None. Cause: The Quarterly HEERF Report was not on the OSU Office of Scholarships and Financial Aid (OSFA) Compliance Calendar, which is reviewed weekly by OSFA leadership to ensure compliance for recurring processes. Effect: The University was noncompliant with the funding agency requirements. Repeat finding: No Recommendation: We recommend that the University review and update current procedures to ensure HEERF program student reporting requirements are completed timely.

Criteria or specific requirement: Uniform Grant Guidance (2 CFR 200.303) requires nonfederal entities receiving Federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. The Department of Education requires grantees to conspicuously post quarterly reports on the institution?s website no later than 10 days after the calendar quarter. Effective internal controls should include procedures to ensure reports are submitted timely. Uniform Grant Guidance (2 CFR 170 Appendix A(I)(2)(ii)) requires subaward information be reported no later than the end of the month following the month in which the obligation was made. Condition: The University did not submit the Federal Funding Accountability and Transparency Act (FFATA) reports in a timely manner and there was no documentation of review. Context: During our testing of 8 subawards reported to FSRS, from a statistically valid sample, we noted all 8 reports were not submitted by the required due date and did not have documentation of review. Questioned costs: None Cause: The timing of FFATA report submissions were related to a delay in receiving information from the college. The college was not providing the fully executed subawards in Cayuse, a web-based software package that is designed to simplify the preparation and electronic submission of proposals. Effect: The University was not in compliance with FFATA reporting requirements Repeat finding: No Recommendation: We recommend that the University review and update current procedures to ensure the program reporting requirements are completed timely and to ensure review of reports are documented.

Criteria or specific requirement: Uniform Grant Guidance (2 CFR 200.303) requires nonfederal entities receiving Federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. The Department of Education requires grantees to conspicuously post quarterly reports on the institution?s website no later than 10 days after the calendar quarter. Effective internal controls should include procedures to ensure reports are submitted timely. Uniform Grant Guidance (2 CFR 200.305(b)(3)) when the reimbursement method is used, the Federal awarding agency or pass-through entity must make payment within 30 calendar days after receipt of the billing, unless the Federal awarding agency or pass-through entity reasonably believes the request to be improper. Condition: The University did not make payments to subrecipients within 30 days after receipt of invoices. Context: During out testing of 40 subrecipient payments, from a statistically valid sample, we noted 11 payments were not submitted within 30 days after receiving invoice from the subrecipients. Questioned costs: None Cause: Departments are responsible for entering requisitions and invoices as they are received. In these cases, there were delays in the administrative workflow which caused the invoices to not be paid timely. Effect: The University was not in compliance with the regulation to make payments to subrecipients within the required timeframe. Repeat finding: No Recommendation: We recommend that the University review and update current procedures to ensure subrecipient payments are paid timely.

CFDA Number 93.301 Small Rural Hospital Improvement Grant Program; U.S. Department of Health and Human Services, Health Resources and Services Administration; Year 2019-2020. Criteria or Specific Requirement ? Subrecipient Monitoring. Condition ? The University receives Small Rural Hospital Improvement Grant funding as a pass through entity, to provide funding for hospitals that are deemed subrecipients. The University's system of internal control did not identify this grant as having subawards, thus they did not initiate their standard subrecipient monitoring procedures. As a result, certain information required to be provided to the subrecipients was not included in the subaward documents and monitoring did not include determining whether the subrecipients complied with the single audit requirements. Questioned costs ? None. Context ? Based on the grant budget, the University believed the disbursements to be contractual in nature, and not a subaward. Our testing demonstrated that a portion of the required subrecipient monitoring procedures were performed by University personnel. Effect ? The University did not perform certain procedures to address all subrecipient monitoring duties including inquiry as to whether the subrecipients were suspended or debarred; inquiry as to whether the subrecipients received an audit to allow the University to know whether follow up action was required related to findings, and the CFDA number was not provided to the subrecipients in their communications. Cause ? Based on the grant budget, the University believed the disbursements to be contractual in nature, and not a subaward. This resulted in the University not initiating their protocol for subrecipient monitoring. Recommendation ? The University should strengthen the internal controls surrounding identification of subawards. Views of Responsible Officials and Planned Corrective Actions ? Management believes the original SHIP grant was set up correctly as a professional contract. The Agency awarded the funds as contractual services which precluded the need for any sub recipient monitoring or additional measures. While the Agency has provided conflicting answers to this issue, they have stated that issuing the COVID-SHIP funds as professional services is acceptable and that FFATA reporting was not applicable to the original SHIP grant since the program was authorized prior to the FFATA reporting requirement. Management will continue to work with the Agency to determine if any changes need to be made to the SHIP and/or COVID-SHIP grants going forward.

GSA_MIGRATION