CRISWELL COLLEGE

Finding Number: 2019-001 Need Analysis Planned Corrective Action: Criswell College has reviewed the incorrect Federal Direct Loan need analysis finding and has formally switched to from CAMS student information system (SIS) to PowerFAIDS SIS effective Fall 2019. The awarding process and procedures are in development to compliment the increased automation capacity of the new software. The processes and procedures are continuously reviewed and for possible improvement as best practices are shared by other schools using the same software. PowerFAIDS is a robust SIS that enables the financial aid department to automate most financial aid processes through the creation of Put Into Target (PIT) rules and selection sets. PIT rules allow processes to initiate manually or by creating a scheduling system to be executed at pre-determined frequencies or specific dates. Selection sets allow users to identify a specific population of students with pre-defined logic-based qualifiers using specific data fields stored in the database. Automating the awarding process has significantly reduces the potential for error via mistake or oversight. PowerFAIDS allows users to create algorithms to automatically generate individual student budgets based on enrollment and living situation. A subsequent process is initiated to dynamically redetermine each student?s budget anytime an enrollment update takes place. The budget adjustment initiates a recalculation of need and remaining need simultaneously. The corrective action plan is currently being developed and solidified using best practices provided by the PowerFAIDS community. Currently the college is working to determine the ideal frequency for enrollment updates. Enrollment updates drive tuition costs and subsequent changes to financial aid awards. These factors attributed to the three errors found for need analysis of the 51 students tested along with late outside scholarship awards. Enrollment updates can be initiated at any time to compare the current enrollment status of each student compared to initial enrollment. The corrective action has been implemented to include the addition of a miscellaneous award in PowerFAIDS to account for all outside scholarships. The business office has always provided a hard copy of each scholarship received by each individual student to be placed in the financial aid file. CAMs did not allow the creation of a financial aid award that was not tied to a specific account for tracking purposes only. This award addition in the PowerFAIDS system has helped tremendously while tracking need-based aid for the Fall 2019 term. The PowerFAIDS consultant just completed a site visit 10/16/19 to train the Financial Aid Director to setup the new award year and assist with creating additional quality assurance check points through the development of additional PIT rules and selections sets. Person Responsible for Corrective Action Plan: Jimmy Criswell, Director of Financial Aid Anticipated Date of Completion: Continuous

Finding Number: 2019-002 Incorrect Verification Planned Corrective Action: Criswell College has reviewed the verification finding for one of the 21 audit files that was not properly verified. Criswell College has a robust verification procedure in place. Criswell College invests in ongoing training for financial aid staff year-round. This finding was due to human error. The financial aid department is considered fully staffed with two employees. This allows each employee to manage a population of 125 students or less. This also allows the financial aid department to have secondary reviews for all verification files. The financial aid office lost a staff member the first week of May leading into peak awarding season. This position was filled the beginning of September which allowed a second staff member to review files selected for verification. The current published procedure involves the following steps: 1. Financial Aid Officer gathers verification documents and completes verification. 2. Financial Aid Director reviews all verification files for approval and signs off. 3. Financial aid officer reviews the file a second time after the director signoff occurs. 4. Financial Aid Officer signs the verification checklist to document the file has been reviewed by more than one person. Secondary or additional review is a major factor to ensure accuracy of the verification process. The financial aid director is working with the vice president of student affairs to get additional support for the verification process by hiring a 3rd party for verification review and file auditing. The financial aid director is interviewing two financial aid consulting firms to determine cost and qualification level of staff who assist with verification review. Person Responsible for Corrective Action Plan: Jimmy Criswell, Director of Financial Aid Anticipated Date of Completion: 01/01/2020

2018-002

Finding Number: 2019-003 Gramm-Leach-Bliley Act Compliance Planned Corrective Action: GLBA: The Safeguards Rule requires financial institutions under FTC jurisdiction to have measures in place to keep customer information secure. In addition to developing their own safeguards, companies covered by the Rule are responsible for taking steps to ensure that their affiliates and service providers safeguard customer information in their care. Key compliance requirements include: ? Designating an employee to coordinate an information security program. ? Identifying risks to the security of customer information (including a risk assessment of computer information systems). ? Contractually requiring service providers to implement and maintain safeguards. Colleges and universities are deemed to be in compliance with the privacy provisions of the GLB Act if they are in compliance with the Family Educational Rights and Privacy Act (FERPA). However, higher education institutions are still subject to the provisions of the GLB Act related to the administrative, technical, and physical safeguarding of customer information. To comply with GLBA Criswell Colleges implements the following practices: ? The College has a yearly security audit from an internal perspective and uses Trustwave to scan for external threats every quarter. Financial Resources are allocated to fund the security audit and to make any changes necessary to solve any problems that are discovered in the auditing process. The most recent security audit was completed in September 2019. ? The Senior Director of Information serves as the responsible party to ensure customer information security. ? College employees must complete a FERPA training before gaining access to personally identifiable information of students. They are only given access to said information on the basis of an educational need to know. ? Employees who are significantly engaged in financial activities that involve the collection or utilization of customer financial information must identify themselves to the Senior Director of Information. Examples of activities that GLB would apply to include administering financial aid, processing of credit card information, and collecting of any other form of customer financial information. Collection activities are documented by the office of Financial Aid and the Office of Accounts Receivable. No actual financial data is saved or stored anywhere on campus. The college assesses the current customer information practices of each third party on an annual basis, during this assessment the school identifies vulnerabilities, and takes appropriate measures to secure customer information. This includes but is not limited to PCI compliance standards. Person Responsible for Corrective Action Plan: Scott Shiffer, Director of Information Technology Anticipated Date of Completion: October 2019

GSA_MIGRATION

GSA_MIGRATION

2017-003

GSA_MIGRATION

2016-002

GSA_MIGRATION

2016-003

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION