Idaho State UniversityNon-Profit

Federal Agency: US Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.268 Federal Award Identification Number: P268K250099 - 2025 Award Period: July 1, 2024 to June 30, 2025 Type of Finding: • Compliance, Other Matter • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: 34 CFR 682.604, states that a school must ensure that exit counseling is conducted with each Stafford Loan borrower and graduate or professional student PLUS Loan borrower either in person, by audiovisual presentation, or by interactive electronic means. In each case, the school must ensure that this counseling is conducted shortly before the student borrower ceases at least half-time study at the school. Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University did not properly have documentation for exit counseling notification. Context: During our testing of 40 students, we identified 1 student that did not have documentation of exit counseling notification. Questioned costs: None Cause: The University did not have proper procedures in place to ensure that notification of required exit counseling was sent to applicable students. Effect: Exit counseling helps federal student loan borrowers understand how to repay their loans and reviews deferment and repayment plans options. If students are not notified of exit counseling, they could be at risk of not understanding their rights and responsibilities regarding loan repayment. Repeat finding: No Recommendation: We recommend the University review reporting processes to ensure all students that require exit counseling receive it in a timely manner. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Federal Agency: US Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.033, 84.268, 84.063, 84.007 Federal Award Identification Number: P033A241086 - 2025, P268K250099 - 2025, P063P240099 - 2025, P007A241086 - 2025 Award Period: July 1, 2024 to June 30, 2025 Type of Finding: • Compliance, Other Matter • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Changes to said status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days. Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University did not properly report student enrollment changes for students who received federal student aid to the National Student Loan Data System (NSLDS). Context: During our testing of 40 students, we identified 1 student with an effective date reported to NSLDS that did not align with institutional records and 1 student that was reported after the 60 day requirement. Questioned costs: None. Cause: The University did not have proper procedures in place to verify students' status in NSLDS matched the institutions records accurately and reported timely. Effect: The University was not in compliance with the requirements to properly report student enrollment data correctly. Incorrect dates submitted to NSLDS may be used to determine the grace period for the repayment and interest of outstanding Title IV student loans. Repeat finding: Yes Recommendation: We recommend the University review current processes for reporting to NSLDS and implement procedures to ensure submissions are reported accurately and timely. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Federal Agency: US Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.033 Federal Award Identification Number: P033A241086 - 2025 Award Period: July 1, 2024 to June 30, 2025 Type of Finding: • Compliance, Other Matter • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 675.18(g) require institutions to use at least seven percent of the sum of its initial and supplemental Federal Work Study allocation for an award year to compensate students employed in community service activities unless a waiver is obtained from the Department of Education. Per 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University did not meet the community service requirement for its Federal Work Study program and was unable to obtain a waiver from the Department of Education releasing it from the requirement. Context: The University did not use at least 7% of its Federal Work Study (FWS) funds for students employed in community service activities. Questioned costs: None. Cause: The University did not meet the community service expenditure requirement due to decreased participation by off‑campus agencies. Effect: If the University fails to meet any of the FWS community service requirements, then they will be required to return FWS federal funds in an amount equal to the difference between the amount a school should have spent for community service and the amount it actually spent. The University could also be denied future participation in the FWS Program and possibly other FWS programs. Repeat finding: No Recommendation: We recommend the University review current processes for calculating and tracking the students employed in community service activities for its Federal Work Study funds to meet the minimum 7% requirement. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Cash Management-Subrecipient Federal Agency: U.S. Federal Government Federal Program Title: Research and Development Cluster Assistance Listing Number: 93.859; 47.074 Federal Award Identification Number and Year: 1R01GM137083 – 2024; 2317969 - 2024 Award Period: July 1, 2023 to June 30, 2024 Type of Finding: • Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Federal Government requires that when the reimbursement method is used, the Federal awarding agency or pass-through entity must make payment within 30 calendar days after receipt of the billing, unless the Federal awarding agency or pass-through entity reasonably believes the request to be improper (2 CFR section 200.305(b)(4)). In addition, per the Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University did not make payment to Subrecipients within the required 30 calendar days after receipt of the billing. Context: Three subrecipient invoices, totaling $29,306, out of 5 tested, totaling $60,038, were not paid within the required 30 days. Questioned costs: None. Cause: Procedures were not in place to ensure subrecipients were paid within 30 days of receipt of the invoices. Effect: Subrecipients did not receive their reimbursement timely. Repeat finding: Yes, 2023-002 Recommendation: We recommend the University evaluate its procedures and implement an additional control to review and approve the Subrecipient reimbursements timely. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Procurement Federal Agency: U.S. Federal Government Federal Program Title: Integrative Activities, Research and Development Cluster Assistance Listing Number: 47.083 Federal Award Identification Number and Year: CE2559-SB-873905 A2, A3 - 2024 Award Period: July 1, 2023 to June 30, 2024 Type of Finding: • Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Federal Government requires that all procurement transactions for the acquisition of property or services required under a Federal award must be conducted in a manner providing full and open competition consistent with the standards of 2 CFR section 200.319 and 2 CFR section 200.320. In addition, per the Uniform Guidance CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University did not complete documentation for reasonings of why they did not obtain price quotes or competitive bids prior to entering the transaction. Context: During our testing we identified 1 of the 5 contracts tested did not include adequate documentation to award the contracts without price quotations or a competitive bid process. Questioned costs: $39,160 Cause: Lack of training for procurement personnel regarding federal funds passed through State agencies to the University. Effect: Documentation for why the University did not obtain price quotes or competitive bids was not documented in a timely manner. Repeat finding: Yes, 2023-003 Recommendation: We recommend the University evaluate its procedures and implement an additional control to document reasons for not obtaining price quotes or competitive bids prior to entering the transaction. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Suspension Debarment Federal Agency: U.S. Federal Government Federal Program Title: Integrative Activities, Research and Development Cluster Assistance Listing Number: 47.083 Federal Award Identification Number and Year: 2320040-2024 Award Period: July 1, 2023 to June 30, 2024 Type of Finding: • Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Federal Government requires that when a non-federal entity enters into a covered transaction with an entity at a lower tier, the non-federal entity must verify that the entity, as defined in 2 CFR section 180.995 and agency adopting regulations, is not suspended or debarred or otherwise excluded from participating in the transaction. In addition, per the Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University was not able to provide a verification check occurring before entering into contract with a vendor/subrecipient. Context: During our testing of 5 contracts, we identified one vendor/subrecipient that the University could not provide a verification check prior to entering the contract. Questioned costs: None. Cause: Verification check did not occur before entering into contract with vendor/subrecipient. Effect: The University entered into contract with a vendor/subrecipient prior to performing a verification check. Repeat finding: Yes, 2023-004 Recommendation: We recommend the University evaluate its procedures and implement an additional control to ensure verification checks are occurring prior to entering into contract with a vendor/subrecipient. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Special Tests & Provisions Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Various Federal Award Identification Number and Year: Multiple Award Period: July 1, 2023 to June 30, 2024 Type of Finding: • Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Changes to said status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days. In addition per the Uniform Guidance 2 CRF 200.303, non- federal entities receiving federal awards are required to establish and maintain internal controls designed to reasonable ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University did not properly report student enrollment changes for students who received federal student aid to the National Student Loan Data System (NSLDS). Context: During our testing of 40 students, we identified two instances for which the student’s enrollment status was not correctly reported to NSLDS in a timely manner and one instance where the enrollment effective date was not reported correctly to NSLDS. Questioned costs: None Cause: The University did not have proper procedures in place to verify students status in NSLDS matched the institutions records in a timely manner. Effect: Failure to properly report enrollment status changes on NSLDS could affect the timing of the grace period for repayment of Title IV loans. Additionally, the University was not in compliance with the requirements to properly report student enrollment data correctly or timely to NSLDS. Repeat finding: Yes, 2023-007 Recommendation: We recommend that the University implement procedures to ensure that enrollment data, changes in status and effective dates within NSLDS match the records of the institution and are reported timely. And we recommend that the University implement formal review procedures to document the review process. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Eligibility - Pell Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: 84.063 Federal Award Identification Number and Year: Multiple Award Period: July 1, 2023 to June 30, 2024 Type of Finding: • Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The amount of a student's Pell Grant for an academic year is based upon the payment and disbursement schedules published by the Secretary for each award year (34 CFR 690.62) The Code of Federal Regulations (34 CFR 690.80(b)(1)) states if the student’s enrollment status changes from one academic term to another within the same award year, the institution shall recalculate the Federal Pell Grant award for the new payment period taking into account any changes in the cost of attendance. Uniform Grant Guidance (2 CFR 200.303) requires nonfederal entities receiving Federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure students are awarded and disbursed the proper federal fund amounts. Condition: The University under-awarded funds for the Pell Grant. Context: During our testing we noted one of forty students, from a statistically valid sample, were awarded and disbursed less Pell funds than should have been awarded based on the 23-24 Pell payment schedule. The Pell payment schedule considers the cost of attendance, the student's Expected Family Contribution and the enrollment status of the student. Questioned costs: None Cause: The report generated to capture Summer term students who did not self-identify for Summer Aid consideration but qualified for Pell funds did not capture this student due to system changes that were not accounted for in the SQL. Effect: Failure to properly determine and disburse Title IV funds based on eligibility for each type of aid in accordance with federal regulations may result in students receiving incorrect funds. Repeat finding: No Recommendation: We recommend the University review its current procedures for awarding Title IV funds and implement any changes necessary to ensure federal funds are awarded and disbursed in accordance with federal regulations.

2023-001: Reporting Federal agency: Department of Health and Human Services Federal program title: Primary Care Training and Enhancement & Every Student Succeeds Act/Preschool Development Grants Assistance Listing Number: 93.884 & 93.434 Federal Award Identification Number and Year: Multiple Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Uniform Grant Guidance (2 CFR 200.303) requires nonfederal entities receiving Federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure reports are formally reviewed by someone who did not prepare the report to verify the correct information and data is submitted. Condition & Context: The University did not have a documented or formal review and approval process in place for reports prior to submission. Questioned costs: None. Cause: Supervisory review and approval is currently undocumented and is only communicated verbally. Effect: Failure to properly review Reports could result in an improper information and data being submitted. Repeat Finding: No. Recommendation: ISU should implement formal review procedures to document review and approvals over required reports. Views of responsible officials: Management agrees with this finding.

2023-001: Reporting Federal agency: Department of Health and Human Services Federal program title: Primary Care Training and Enhancement & Every Student Succeeds Act/Preschool Development Grants Assistance Listing Number: 93.884 & 93.434 Federal Award Identification Number and Year: Multiple Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Uniform Grant Guidance (2 CFR 200.303) requires nonfederal entities receiving Federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure reports are formally reviewed by someone who did not prepare the report to verify the correct information and data is submitted. Condition & Context: The University did not have a documented or formal review and approval process in place for reports prior to submission. Questioned costs: None. Cause: Supervisory review and approval is currently undocumented and is only communicated verbally. Effect: Failure to properly review Reports could result in an improper information and data being submitted. Repeat Finding: No. Recommendation: ISU should implement formal review procedures to document review and approvals over required reports. Views of responsible officials: Management agrees with this finding.

2023-002: Cash Management-Subrecipient Federal Agency: U.S. Federal Government Federal Program Title: Research and Development Cluster Assistance Listing Number: 93.859 Federal Award Identification Number and Year: 1R01GM137083 - 2023 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Federal Government requires that when the reimbursement method is used, the Federal awarding agency or pass-through entity must make payment within 30 calendar days after receipt of the billing, unless the Federal awarding agency or pass-through entity reasonably believes the request to be improper (2 CFR section 200.305(b)(4)). In addition, per the Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University did not make payment to Subrecipients within the required 30 calendar days after receipt of the billing. Context: One subrecipient invoice, totaling $1,601, out of 8 tested, totaling $43,340, was not paid within the required 30 days. Questioned costs: None. Cause: The invoice was sent to the wrong email for approval. Effect: Subrecipients did not receive their reimbursement timely. Repeat finding: No Recommendation: We recommend the University evaluate its procedures and implement an additional control to review and approve the Subrecipient reimbursements timely. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

2023-002: Cash Management-Subrecipient Federal Agency: U.S. Federal Government Federal Program Title: Research and Development Cluster Assistance Listing Number: 93.859 Federal Award Identification Number and Year: 1R01GM137083 - 2023 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Federal Government requires that when the reimbursement method is used, the Federal awarding agency or pass-through entity must make payment within 30 calendar days after receipt of the billing, unless the Federal awarding agency or pass-through entity reasonably believes the request to be improper (2 CFR section 200.305(b)(4)). In addition, per the Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University did not make payment to Subrecipients within the required 30 calendar days after receipt of the billing. Context: One subrecipient invoice, totaling $1,601, out of 8 tested, totaling $43,340, was not paid within the required 30 days. Questioned costs: None. Cause: The invoice was sent to the wrong email for approval. Effect: Subrecipients did not receive their reimbursement timely. Repeat finding: No Recommendation: We recommend the University evaluate its procedures and implement an additional control to review and approve the Subrecipient reimbursements timely. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

2023-003: Procurement Federal Agency: U.S. Federal Government Federal Program Title: Research and Development Cluster Assistance Listing Number: Various Federal Award Identification Number and Year: Multiple Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Federal Government requires that all procurement transactions for the acquisition of property or services required under a Federal award must be conducted in a manner providing full and open competition consistent with the standards of 2 CFR section 200.319 and 2 CFR section 200.320. In addition, per the Uniform Guidance CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University did not have documentation for reasonings of why they did not obtain competitive bids. Context: During our testing we identified 2 of the 8 contracts tested did not include adequate documentation to award the contracts without a competitive bid process. Questioned costs: $27,287 Cause: A misunderstanding of the procurement process by grant personnel. Effect: Documentation for why the University did not obtain competitive bids was undocumented. Repeat finding: No Recommendation: We recommend the University evaluate its procedures and implement an additional control to document reasons for obtaining competitive bids. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

2023-003: Procurement Federal Agency: U.S. Federal Government Federal Program Title: Research and Development Cluster Assistance Listing Number: Various Federal Award Identification Number and Year: Multiple Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Federal Government requires that all procurement transactions for the acquisition of property or services required under a Federal award must be conducted in a manner providing full and open competition consistent with the standards of 2 CFR section 200.319 and 2 CFR section 200.320. In addition, per the Uniform Guidance CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University did not have documentation for reasonings of why they did not obtain competitive bids. Context: During our testing we identified 2 of the 8 contracts tested did not include adequate documentation to award the contracts without a competitive bid process. Questioned costs: $27,287 Cause: A misunderstanding of the procurement process by grant personnel. Effect: Documentation for why the University did not obtain competitive bids was undocumented. Repeat finding: No Recommendation: We recommend the University evaluate its procedures and implement an additional control to document reasons for obtaining competitive bids. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

2023-004: Suspension Debarment Federal Agency: U.S. Federal Government Federal Program Title: Research and Development Cluster Assistance Listing Number: Various Federal Award Identification Number and Year: Multiple Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Federal Government requires that when a non-federal entity enters into a covered transaction with an entity at a lower tier, the non-federal entity must verify that the entity, as defined in 2 CFR section 180.995 and agency adopting regulations, is not suspended or debarred or otherwise excluded from participating in the transaction. In addition, per the Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University was not able to provide a verification check occurring before entering into contract with a vendor/subrecipient. Context: During our testing of 5 contracts out of a population of 14 vendors/subrecipients, we identified one vendor/subrecipient that the University could not provide a verification check prior to entering the contract. Questioned costs: None. Cause: Verification check did not occur before entering into contract with vendor/subrecipient. Effect: The University entered into contract with a vendor/subrecipient prior to performing a verification check. Repeat finding: No Recommendation: We recommend the University evaluate its procedures and implement an additional control to ensure verification checks are occurring prior to entering into contract with a vendor/subrecipient. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

2023-004: Suspension Debarment Federal Agency: U.S. Federal Government Federal Program Title: Research and Development Cluster Assistance Listing Number: Various Federal Award Identification Number and Year: Multiple Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Federal Government requires that when a non-federal entity enters into a covered transaction with an entity at a lower tier, the non-federal entity must verify that the entity, as defined in 2 CFR section 180.995 and agency adopting regulations, is not suspended or debarred or otherwise excluded from participating in the transaction. In addition, per the Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University was not able to provide a verification check occurring before entering into contract with a vendor/subrecipient. Context: During our testing of 5 contracts out of a population of 14 vendors/subrecipients, we identified one vendor/subrecipient that the University could not provide a verification check prior to entering the contract. Questioned costs: None. Cause: Verification check did not occur before entering into contract with vendor/subrecipient. Effect: The University entered into contract with a vendor/subrecipient prior to performing a verification check. Repeat finding: No Recommendation: We recommend the University evaluate its procedures and implement an additional control to ensure verification checks are occurring prior to entering into contract with a vendor/subrecipient. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

2023-005: Special Tests & Provisions Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Various Federal Award Identification Number and Year: Multiple Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Department of Education, 2 CFR part 200 section 200.303, requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The Code of Federal Regulations, 34 CFR 688.164, requires any Title IV federal funds disbursed to a student or parent that are not received or negotiated must be returned to the appropriated federal financial aid program no later than 240 days after the check or electronic fund transfer (EFT) was issued. If a check or an EFT is returned, the University may make additional attempts to deliver the funds, provided that those attempts are made no later than 45 days after the funds were returned or rejected. In case where the University does not make another attempt, the funds must be returned before the end of the initial 45-day period. The University must cease all attempts to disburse the funds and return them no later than 240 days after the date it issued the first check. Under no circumstances may unclaimed Title IV FSA funds escheat to the state, or revert to the University, or any other third party. Condition: The University was not in compliance with the federal financial aid regulations requirement that any Title IV federal funds disbursed to a student or parent that are not received or negotiated must be returned to the appropriated federal financial aid program no later than 240 days after the check or electronic fund transfer (EFT) was issued. Context: During the testing of the outstanding Title IV student check listing totaling 76 outstanding checks, we identified eight instances of stale checks that were aged greater than 240 days. Questioned costs: $14,949.02 Cause: The University did not have a process in place to monitor the checks throughout the year. Effect: The University is not in compliance with Department of Education requirements. Repeat finding: No Recommendation: We recommend that the University review the requirement and implement a monitoring control to monitor the checks throughout the year. In addition, for the checks outstanding greater than 240 days, the University should return the funding to the U.S. Department of Education. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

2023-005: Special Tests & Provisions Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Various Federal Award Identification Number and Year: Multiple Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Department of Education, 2 CFR part 200 section 200.303, requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The Code of Federal Regulations, 34 CFR 688.164, requires any Title IV federal funds disbursed to a student or parent that are not received or negotiated must be returned to the appropriated federal financial aid program no later than 240 days after the check or electronic fund transfer (EFT) was issued. If a check or an EFT is returned, the University may make additional attempts to deliver the funds, provided that those attempts are made no later than 45 days after the funds were returned or rejected. In case where the University does not make another attempt, the funds must be returned before the end of the initial 45-day period. The University must cease all attempts to disburse the funds and return them no later than 240 days after the date it issued the first check. Under no circumstances may unclaimed Title IV FSA funds escheat to the state, or revert to the University, or any other third party. Condition: The University was not in compliance with the federal financial aid regulations requirement that any Title IV federal funds disbursed to a student or parent that are not received or negotiated must be returned to the appropriated federal financial aid program no later than 240 days after the check or electronic fund transfer (EFT) was issued. Context: During the testing of the outstanding Title IV student check listing totaling 76 outstanding checks, we identified eight instances of stale checks that were aged greater than 240 days. Questioned costs: $14,949.02 Cause: The University did not have a process in place to monitor the checks throughout the year. Effect: The University is not in compliance with Department of Education requirements. Repeat finding: No Recommendation: We recommend that the University review the requirement and implement a monitoring control to monitor the checks throughout the year. In addition, for the checks outstanding greater than 240 days, the University should return the funding to the U.S. Department of Education. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

2023-006: Eligibility Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Various Federal Award Identification Number and Year: Multiple Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Other Matters • Material Weakness Criteria or specific requirement: The Department of Education requires the institution must notify the student, or parent, in writing of (1) the date and amount of the disbursement; (2) the student’s right, or parent’s right, to cancel all or a portion of that loan or loan disbursement and have the loan proceeds returned to the holder of that loan or the TEACH Grant payments returned to ED; and (3)the procedure and time by which the student or parent must notify the institution that he or she wishes to cancel the loan, TEACH Grant, or TEACH Grant disbursement. The notification requirement for loan funds applies only if the funds are disbursed by EFT payment or master check (34 CFR 668.165). In addition, per the Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University did not properly notify students when loans were disbursed and credited to student’s accounts. Context: During our Eligibility testing of 40 students, we identified that there were 29 students that received loan disbursements however, all 29 students did not receive the required notification for each loan disbursement. Questioned costs: None Cause: The college did not send loan disbursement notifications, notifications were only provided when aid amounts changed from their initial award letter. Effect: Tailored award disbursement notifications inform the student or parent of the right to cancel all or a portion of that loan or loan disbursements and have the loan proceeds returned to the holder of that loan. The notifications also outline the procedure and time by which the student or parent must notify the institution that he or she wishes to cancel the loan. Repeat finding: No Recommendation: We recommend the University evaluate its procedures around disbursements of loans and ensure that notifications of disbursements are sent and contain all of the required elements outlined in the FSA handbook. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

2023-006: Eligibility Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Various Federal Award Identification Number and Year: Multiple Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Other Matters • Material Weakness Criteria or specific requirement: The Department of Education requires the institution must notify the student, or parent, in writing of (1) the date and amount of the disbursement; (2) the student’s right, or parent’s right, to cancel all or a portion of that loan or loan disbursement and have the loan proceeds returned to the holder of that loan or the TEACH Grant payments returned to ED; and (3)the procedure and time by which the student or parent must notify the institution that he or she wishes to cancel the loan, TEACH Grant, or TEACH Grant disbursement. The notification requirement for loan funds applies only if the funds are disbursed by EFT payment or master check (34 CFR 668.165). In addition, per the Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University did not properly notify students when loans were disbursed and credited to student’s accounts. Context: During our Eligibility testing of 40 students, we identified that there were 29 students that received loan disbursements however, all 29 students did not receive the required notification for each loan disbursement. Questioned costs: None Cause: The college did not send loan disbursement notifications, notifications were only provided when aid amounts changed from their initial award letter. Effect: Tailored award disbursement notifications inform the student or parent of the right to cancel all or a portion of that loan or loan disbursements and have the loan proceeds returned to the holder of that loan. The notifications also outline the procedure and time by which the student or parent must notify the institution that he or she wishes to cancel the loan. Repeat finding: No Recommendation: We recommend the University evaluate its procedures around disbursements of loans and ensure that notifications of disbursements are sent and contain all of the required elements outlined in the FSA handbook. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

2023-007: Special Tests & Provisions Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Various Federal Award Identification Number and Year: Multiple Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Changes to said status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days. In addition per the Uniform Guidance 2 CRF 200.303, non-federal entities receiving federal awards are required to establish and maintain internal controls designed to reasonable ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University did not properly report student enrollment changes for students who received federal student aid to the National Student Loan Data System (NSLDS). Context: During our testing of 40 students, we identified one instance for which the student’s enrollment status was not correctly reported to NSLDS, two instances where the enrollment effective date was not reported correctly to NSLDS and nine instances where the status changes were not reported timely to NSLDS. Questioned costs: None Cause: The University did not have proper procedures in place to verify students status in NSLDS matched the institutions records in a timely manner. Effect: Failure to properly report enrollment status changes on NSLDS could affect the timing of the grace period for repayment of Title IV loans. Additionally, the College was not in compliance with the requirements to properly report student enrollment data correctly or timely to NSLDS. Repeat finding: No Recommendation: We recommend that the University implement procedures to ensure that enrollment data, changes in status and effective dates within NSLDS match the records of the institution and are reported timely. And we recommend that the College implement formal review procedures to document the review process. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

2023-007: Special Tests & Provisions Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Various Federal Award Identification Number and Year: Multiple Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Changes to said status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days. In addition per the Uniform Guidance 2 CRF 200.303, non-federal entities receiving federal awards are required to establish and maintain internal controls designed to reasonable ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University did not properly report student enrollment changes for students who received federal student aid to the National Student Loan Data System (NSLDS). Context: During our testing of 40 students, we identified one instance for which the student’s enrollment status was not correctly reported to NSLDS, two instances where the enrollment effective date was not reported correctly to NSLDS and nine instances where the status changes were not reported timely to NSLDS. Questioned costs: None Cause: The University did not have proper procedures in place to verify students status in NSLDS matched the institutions records in a timely manner. Effect: Failure to properly report enrollment status changes on NSLDS could affect the timing of the grace period for repayment of Title IV loans. Additionally, the College was not in compliance with the requirements to properly report student enrollment data correctly or timely to NSLDS. Repeat finding: No Recommendation: We recommend that the University implement procedures to ensure that enrollment data, changes in status and effective dates within NSLDS match the records of the institution and are reported timely. And we recommend that the College implement formal review procedures to document the review process. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

2023-001: Reporting Federal agency: Department of Health and Human Services Federal program title: Primary Care Training and Enhancement & Every Student Succeeds Act/Preschool Development Grants Assistance Listing Number: 93.884 & 93.434 Federal Award Identification Number and Year: Multiple Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Uniform Grant Guidance (2 CFR 200.303) requires nonfederal entities receiving Federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure reports are formally reviewed by someone who did not prepare the report to verify the correct information and data is submitted. Condition & Context: The University did not have a documented or formal review and approval process in place for reports prior to submission. Questioned costs: None. Cause: Supervisory review and approval is currently undocumented and is only communicated verbally. Effect: Failure to properly review Reports could result in an improper information and data being submitted. Repeat Finding: No. Recommendation: ISU should implement formal review procedures to document review and approvals over required reports. Views of responsible officials: Management agrees with this finding.

2023-001: Reporting Federal agency: Department of Health and Human Services Federal program title: Primary Care Training and Enhancement & Every Student Succeeds Act/Preschool Development Grants Assistance Listing Number: 93.884 & 93.434 Federal Award Identification Number and Year: Multiple Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Uniform Grant Guidance (2 CFR 200.303) requires nonfederal entities receiving Federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure reports are formally reviewed by someone who did not prepare the report to verify the correct information and data is submitted. Condition & Context: The University did not have a documented or formal review and approval process in place for reports prior to submission. Questioned costs: None. Cause: Supervisory review and approval is currently undocumented and is only communicated verbally. Effect: Failure to properly review Reports could result in an improper information and data being submitted. Repeat Finding: No. Recommendation: ISU should implement formal review procedures to document review and approvals over required reports. Views of responsible officials: Management agrees with this finding.

2023-002: Cash Management-Subrecipient Federal Agency: U.S. Federal Government Federal Program Title: Research and Development Cluster Assistance Listing Number: 93.859 Federal Award Identification Number and Year: 1R01GM137083 - 2023 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Federal Government requires that when the reimbursement method is used, the Federal awarding agency or pass-through entity must make payment within 30 calendar days after receipt of the billing, unless the Federal awarding agency or pass-through entity reasonably believes the request to be improper (2 CFR section 200.305(b)(4)). In addition, per the Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University did not make payment to Subrecipients within the required 30 calendar days after receipt of the billing. Context: One subrecipient invoice, totaling $1,601, out of 8 tested, totaling $43,340, was not paid within the required 30 days. Questioned costs: None. Cause: The invoice was sent to the wrong email for approval. Effect: Subrecipients did not receive their reimbursement timely. Repeat finding: No Recommendation: We recommend the University evaluate its procedures and implement an additional control to review and approve the Subrecipient reimbursements timely. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

2023-002: Cash Management-Subrecipient Federal Agency: U.S. Federal Government Federal Program Title: Research and Development Cluster Assistance Listing Number: 93.859 Federal Award Identification Number and Year: 1R01GM137083 - 2023 Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Federal Government requires that when the reimbursement method is used, the Federal awarding agency or pass-through entity must make payment within 30 calendar days after receipt of the billing, unless the Federal awarding agency or pass-through entity reasonably believes the request to be improper (2 CFR section 200.305(b)(4)). In addition, per the Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University did not make payment to Subrecipients within the required 30 calendar days after receipt of the billing. Context: One subrecipient invoice, totaling $1,601, out of 8 tested, totaling $43,340, was not paid within the required 30 days. Questioned costs: None. Cause: The invoice was sent to the wrong email for approval. Effect: Subrecipients did not receive their reimbursement timely. Repeat finding: No Recommendation: We recommend the University evaluate its procedures and implement an additional control to review and approve the Subrecipient reimbursements timely. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

2023-003: Procurement Federal Agency: U.S. Federal Government Federal Program Title: Research and Development Cluster Assistance Listing Number: Various Federal Award Identification Number and Year: Multiple Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Federal Government requires that all procurement transactions for the acquisition of property or services required under a Federal award must be conducted in a manner providing full and open competition consistent with the standards of 2 CFR section 200.319 and 2 CFR section 200.320. In addition, per the Uniform Guidance CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University did not have documentation for reasonings of why they did not obtain competitive bids. Context: During our testing we identified 2 of the 8 contracts tested did not include adequate documentation to award the contracts without a competitive bid process. Questioned costs: $27,287 Cause: A misunderstanding of the procurement process by grant personnel. Effect: Documentation for why the University did not obtain competitive bids was undocumented. Repeat finding: No Recommendation: We recommend the University evaluate its procedures and implement an additional control to document reasons for obtaining competitive bids. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

2023-003: Procurement Federal Agency: U.S. Federal Government Federal Program Title: Research and Development Cluster Assistance Listing Number: Various Federal Award Identification Number and Year: Multiple Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Federal Government requires that all procurement transactions for the acquisition of property or services required under a Federal award must be conducted in a manner providing full and open competition consistent with the standards of 2 CFR section 200.319 and 2 CFR section 200.320. In addition, per the Uniform Guidance CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University did not have documentation for reasonings of why they did not obtain competitive bids. Context: During our testing we identified 2 of the 8 contracts tested did not include adequate documentation to award the contracts without a competitive bid process. Questioned costs: $27,287 Cause: A misunderstanding of the procurement process by grant personnel. Effect: Documentation for why the University did not obtain competitive bids was undocumented. Repeat finding: No Recommendation: We recommend the University evaluate its procedures and implement an additional control to document reasons for obtaining competitive bids. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

2023-004: Suspension Debarment Federal Agency: U.S. Federal Government Federal Program Title: Research and Development Cluster Assistance Listing Number: Various Federal Award Identification Number and Year: Multiple Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Federal Government requires that when a non-federal entity enters into a covered transaction with an entity at a lower tier, the non-federal entity must verify that the entity, as defined in 2 CFR section 180.995 and agency adopting regulations, is not suspended or debarred or otherwise excluded from participating in the transaction. In addition, per the Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University was not able to provide a verification check occurring before entering into contract with a vendor/subrecipient. Context: During our testing of 5 contracts out of a population of 14 vendors/subrecipients, we identified one vendor/subrecipient that the University could not provide a verification check prior to entering the contract. Questioned costs: None. Cause: Verification check did not occur before entering into contract with vendor/subrecipient. Effect: The University entered into contract with a vendor/subrecipient prior to performing a verification check. Repeat finding: No Recommendation: We recommend the University evaluate its procedures and implement an additional control to ensure verification checks are occurring prior to entering into contract with a vendor/subrecipient. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

2023-004: Suspension Debarment Federal Agency: U.S. Federal Government Federal Program Title: Research and Development Cluster Assistance Listing Number: Various Federal Award Identification Number and Year: Multiple Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Federal Government requires that when a non-federal entity enters into a covered transaction with an entity at a lower tier, the non-federal entity must verify that the entity, as defined in 2 CFR section 180.995 and agency adopting regulations, is not suspended or debarred or otherwise excluded from participating in the transaction. In addition, per the Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University was not able to provide a verification check occurring before entering into contract with a vendor/subrecipient. Context: During our testing of 5 contracts out of a population of 14 vendors/subrecipients, we identified one vendor/subrecipient that the University could not provide a verification check prior to entering the contract. Questioned costs: None. Cause: Verification check did not occur before entering into contract with vendor/subrecipient. Effect: The University entered into contract with a vendor/subrecipient prior to performing a verification check. Repeat finding: No Recommendation: We recommend the University evaluate its procedures and implement an additional control to ensure verification checks are occurring prior to entering into contract with a vendor/subrecipient. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

2023-005: Special Tests & Provisions Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Various Federal Award Identification Number and Year: Multiple Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Department of Education, 2 CFR part 200 section 200.303, requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The Code of Federal Regulations, 34 CFR 688.164, requires any Title IV federal funds disbursed to a student or parent that are not received or negotiated must be returned to the appropriated federal financial aid program no later than 240 days after the check or electronic fund transfer (EFT) was issued. If a check or an EFT is returned, the University may make additional attempts to deliver the funds, provided that those attempts are made no later than 45 days after the funds were returned or rejected. In case where the University does not make another attempt, the funds must be returned before the end of the initial 45-day period. The University must cease all attempts to disburse the funds and return them no later than 240 days after the date it issued the first check. Under no circumstances may unclaimed Title IV FSA funds escheat to the state, or revert to the University, or any other third party. Condition: The University was not in compliance with the federal financial aid regulations requirement that any Title IV federal funds disbursed to a student or parent that are not received or negotiated must be returned to the appropriated federal financial aid program no later than 240 days after the check or electronic fund transfer (EFT) was issued. Context: During the testing of the outstanding Title IV student check listing totaling 76 outstanding checks, we identified eight instances of stale checks that were aged greater than 240 days. Questioned costs: $14,949.02 Cause: The University did not have a process in place to monitor the checks throughout the year. Effect: The University is not in compliance with Department of Education requirements. Repeat finding: No Recommendation: We recommend that the University review the requirement and implement a monitoring control to monitor the checks throughout the year. In addition, for the checks outstanding greater than 240 days, the University should return the funding to the U.S. Department of Education. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

2023-005: Special Tests & Provisions Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Various Federal Award Identification Number and Year: Multiple Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Department of Education, 2 CFR part 200 section 200.303, requires that non-Federal entities receiving Federal awards (i.e., auditee management) establish and maintain internal control designed to reasonably ensure compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. The Code of Federal Regulations, 34 CFR 688.164, requires any Title IV federal funds disbursed to a student or parent that are not received or negotiated must be returned to the appropriated federal financial aid program no later than 240 days after the check or electronic fund transfer (EFT) was issued. If a check or an EFT is returned, the University may make additional attempts to deliver the funds, provided that those attempts are made no later than 45 days after the funds were returned or rejected. In case where the University does not make another attempt, the funds must be returned before the end of the initial 45-day period. The University must cease all attempts to disburse the funds and return them no later than 240 days after the date it issued the first check. Under no circumstances may unclaimed Title IV FSA funds escheat to the state, or revert to the University, or any other third party. Condition: The University was not in compliance with the federal financial aid regulations requirement that any Title IV federal funds disbursed to a student or parent that are not received or negotiated must be returned to the appropriated federal financial aid program no later than 240 days after the check or electronic fund transfer (EFT) was issued. Context: During the testing of the outstanding Title IV student check listing totaling 76 outstanding checks, we identified eight instances of stale checks that were aged greater than 240 days. Questioned costs: $14,949.02 Cause: The University did not have a process in place to monitor the checks throughout the year. Effect: The University is not in compliance with Department of Education requirements. Repeat finding: No Recommendation: We recommend that the University review the requirement and implement a monitoring control to monitor the checks throughout the year. In addition, for the checks outstanding greater than 240 days, the University should return the funding to the U.S. Department of Education. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

2023-006: Eligibility Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Various Federal Award Identification Number and Year: Multiple Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Other Matters • Material Weakness Criteria or specific requirement: The Department of Education requires the institution must notify the student, or parent, in writing of (1) the date and amount of the disbursement; (2) the student’s right, or parent’s right, to cancel all or a portion of that loan or loan disbursement and have the loan proceeds returned to the holder of that loan or the TEACH Grant payments returned to ED; and (3)the procedure and time by which the student or parent must notify the institution that he or she wishes to cancel the loan, TEACH Grant, or TEACH Grant disbursement. The notification requirement for loan funds applies only if the funds are disbursed by EFT payment or master check (34 CFR 668.165). In addition, per the Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University did not properly notify students when loans were disbursed and credited to student’s accounts. Context: During our Eligibility testing of 40 students, we identified that there were 29 students that received loan disbursements however, all 29 students did not receive the required notification for each loan disbursement. Questioned costs: None Cause: The college did not send loan disbursement notifications, notifications were only provided when aid amounts changed from their initial award letter. Effect: Tailored award disbursement notifications inform the student or parent of the right to cancel all or a portion of that loan or loan disbursements and have the loan proceeds returned to the holder of that loan. The notifications also outline the procedure and time by which the student or parent must notify the institution that he or she wishes to cancel the loan. Repeat finding: No Recommendation: We recommend the University evaluate its procedures around disbursements of loans and ensure that notifications of disbursements are sent and contain all of the required elements outlined in the FSA handbook. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

2023-006: Eligibility Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Various Federal Award Identification Number and Year: Multiple Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Other Matters • Material Weakness Criteria or specific requirement: The Department of Education requires the institution must notify the student, or parent, in writing of (1) the date and amount of the disbursement; (2) the student’s right, or parent’s right, to cancel all or a portion of that loan or loan disbursement and have the loan proceeds returned to the holder of that loan or the TEACH Grant payments returned to ED; and (3)the procedure and time by which the student or parent must notify the institution that he or she wishes to cancel the loan, TEACH Grant, or TEACH Grant disbursement. The notification requirement for loan funds applies only if the funds are disbursed by EFT payment or master check (34 CFR 668.165). In addition, per the Uniform Guidance 2 CFR 200.303, nonfederal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University did not properly notify students when loans were disbursed and credited to student’s accounts. Context: During our Eligibility testing of 40 students, we identified that there were 29 students that received loan disbursements however, all 29 students did not receive the required notification for each loan disbursement. Questioned costs: None Cause: The college did not send loan disbursement notifications, notifications were only provided when aid amounts changed from their initial award letter. Effect: Tailored award disbursement notifications inform the student or parent of the right to cancel all or a portion of that loan or loan disbursements and have the loan proceeds returned to the holder of that loan. The notifications also outline the procedure and time by which the student or parent must notify the institution that he or she wishes to cancel the loan. Repeat finding: No Recommendation: We recommend the University evaluate its procedures around disbursements of loans and ensure that notifications of disbursements are sent and contain all of the required elements outlined in the FSA handbook. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

2023-007: Special Tests & Provisions Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Various Federal Award Identification Number and Year: Multiple Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Changes to said status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days. In addition per the Uniform Guidance 2 CRF 200.303, non-federal entities receiving federal awards are required to establish and maintain internal controls designed to reasonable ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University did not properly report student enrollment changes for students who received federal student aid to the National Student Loan Data System (NSLDS). Context: During our testing of 40 students, we identified one instance for which the student’s enrollment status was not correctly reported to NSLDS, two instances where the enrollment effective date was not reported correctly to NSLDS and nine instances where the status changes were not reported timely to NSLDS. Questioned costs: None Cause: The University did not have proper procedures in place to verify students status in NSLDS matched the institutions records in a timely manner. Effect: Failure to properly report enrollment status changes on NSLDS could affect the timing of the grace period for repayment of Title IV loans. Additionally, the College was not in compliance with the requirements to properly report student enrollment data correctly or timely to NSLDS. Repeat finding: No Recommendation: We recommend that the University implement procedures to ensure that enrollment data, changes in status and effective dates within NSLDS match the records of the institution and are reported timely. And we recommend that the College implement formal review procedures to document the review process. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

2023-007: Special Tests & Provisions Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Various Federal Award Identification Number and Year: Multiple Award Period: July 1, 2022 to June 30, 2023 Type of Finding: • Other Matters • Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless of if they receive aid from the institution or not. Changes to said status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days. In addition per the Uniform Guidance 2 CRF 200.303, non-federal entities receiving federal awards are required to establish and maintain internal controls designed to reasonable ensure compliance with federal laws, regulations, and program compliance requirements. Condition: The University did not properly report student enrollment changes for students who received federal student aid to the National Student Loan Data System (NSLDS). Context: During our testing of 40 students, we identified one instance for which the student’s enrollment status was not correctly reported to NSLDS, two instances where the enrollment effective date was not reported correctly to NSLDS and nine instances where the status changes were not reported timely to NSLDS. Questioned costs: None Cause: The University did not have proper procedures in place to verify students status in NSLDS matched the institutions records in a timely manner. Effect: Failure to properly report enrollment status changes on NSLDS could affect the timing of the grace period for repayment of Title IV loans. Additionally, the College was not in compliance with the requirements to properly report student enrollment data correctly or timely to NSLDS. Repeat finding: No Recommendation: We recommend that the University implement procedures to ensure that enrollment data, changes in status and effective dates within NSLDS match the records of the institution and are reported timely. And we recommend that the College implement formal review procedures to document the review process. Views of responsible officials: Management agrees with the finding and has developed a plan to correct the finding.

Federal agency: Department of Education Federal program title: Student Financial Assistance Cluster Assistance Listing Number: 84.007/84.033/84.038/84.063/84.268 Award Period: July 1, 2021 to June 30, 2022 Criteria or specific requirement: Uniform Grant Guidance (2 CFR 200.303) requires nonfederal Type of Finding: Significant Deficiency in Internal Control over Compliance entities receiving Federal awards establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations, and program compliance requirements. Effective internal controls should include procedures to ensure G5 drawdowns are formally reviewed by someone who did not prepare the drawdown to verify the correct amount is requested. Condition & Context: The University did not have a formal documented review process in place to ensure G5 drawdowns were reviewed prior to submitting the drawdown request. Questioned costs: None. Cause: Supervisory review is currently undocumented and is only communicated verbally. Effect: Failure to properly review Cash Management drawdowns could result in an improper amount of funds being requested. Repeat Finding: Yes, see 2021-003 for the prior year finding. Recommendation: ISU should implement formal review procedures to document that the Cash Management drawdown reviews are being performed to correct errors in a timely manner and to minimize the likelihood of errors going undetected. Views of responsible officials: Management agrees with this finding.

2021-002: EligibilityFederal agency: Department of EducationFederal program title: Student Financial Assistance ClusterAssistance Listing Number: 84.007/84.033/84.038/84.063/84.268Award Period: July 1, 2020 to June 30, 2021Type of Finding:? Compliance, Other Matter? Significant Deficiency in Internal Control over ComplianceCriteria or specific requirement: The Code of Federal Regulations (34 CFR ? 668.34(a)) requiresinstitutions to establish a reasonable satisfactory academic progress policy for determining whether anotherwise eligible student is making satisfactory academic progress in his or her educational programand may receive assistance under Title IV, HEA programs.ISU's Satisfactory Academic Progress Policy - Standards for Financial Aid Eligibility, effective 2020-2021, states that students are expected to complete degree requirements in a timely fashion. Themaximum number of attempted credits allowed for a degree or certificate will be up to 150% of thecredits needed to complete the degree. When a student is a Post Baccalaureate and is pursuing a 2ndor 3rd Bachelor's Degree, the maximum number of attempted credits allowed is 90Condition & Context: During our testing of 40 students, we noted one student (3%) was notmaintaining SAP and was not identified by ISU's internal controls. This student was pursuing a secondbachelor's degree and was receiving financial aid but had exceeded the attempted credit hour limit forpost-baccalaureate students (90) and was therefore not maintaining SAP. Student was not notifiedabout their SAP violation until the issue was identified during testing.Questioned costs: None.Cause: SAP rules in Banner were unable to catch post baccalaureate students who were notmaintaining SAP due to the lower attempted credit limit.Effect: Failure to properly identify students in violation of SAP could result in ineligible studentsreceiving Title IV funds.Repeat Finding: No.Recommendation: We recommend the University review internal controls related to Eligibility andensure appropriate checks are in place to identify students who are not meeting the University'squalitative and quantitative criteria for maintaining SAP.Views of responsible officials: Management agrees with this finding.

2021-003: Cash ManagementFederal agency: Department of EducationFederal program title: Student Financial Assistance ClusterAssistance Listing Number: 84.007/84.033/84.038/84.063/84.268Award Period: July 1, 2020 to June 30, 2021Type of Finding:? Significant Deficiency in Internal Control over ComplianceCriteria or specific requirement: Uniform Grant Guidance (2 CFR 200.303) requires nonfederalentities receiving Federal awards establish and maintain internal controls designed to reasonablyensure compliance with Federal laws, regulations, and program compliance requirements. Effectiveinternal controls should include procedures to ensure G5 drawdowns are formally reviewed bysomeone who did not prepare the drawdown to verify the correct amount is requested.Condition & Context: During our testing of 6 Cash Management drawdowns, we noted thatauthorization of all samples were prepared by the same person, with no documentation of supervisoryreview. Additionally, four of the six (67%) samples showed the same person as both the preparer andauthorizer, therefore there was no documentation of independent review.Questioned costs: None.Cause: Supervisory review is currently undocumented and is only communicated verbally.Effect: Failure to properly review Cash Management drawdowns could result in an improper amount offunds being requested.Repeat Finding: No.Recommendation: ISU should implement formal review procedures to document that the CashManagement drawdown reviews are being performed to correct errors in a timely manner and tominimize the likelihood of errors going undetected.Views of responsible officials: Management agrees with this finding.

2021-004: NSLDS Enrollment ReportingFederal agency: Department of EducationFederal program title: Student Financial Assistance ClusterAssistance Listing Number: 84.007/84.033/84.038/84.063/84.268Award Period: July 1, 2020 to June 30, 2021Type of Finding:? Compliance, Other Matter? Significant Deficiency in Internal Control over ComplianceCriteria or specific requirement: Uniform Grant Guidance (2 CFR 200.303) requires nonfederalentities receiving Federal awards establish and maintain internal controls designed to reasonablyensure compliance with Federal laws, regulations, and program compliance requirements. Effectiveinternal controls should include procedures to ensure students' information and change in status areupdated timely and reported correctly to NSLDS.Condition & Context: The University did not properly report the student enrollment changes forstudents who received federal student aid to the National Student Loan Data System (NSLDS).One student out of 40 (3%) had an incorrect program begin date reported to NSLDS.Two students out of 40 (5%) had an incorrect withdrawal date reported to NSLDS, though the correctwithdrawal date was used internally.Three students out of 40 (8%) had a change in status reported to NSLDS more than 30 days after ISUdetermined the change in status.One student out of 40 (3%) did not have their enrollment verified with NSLDS every 60 days.Two students out of 40 (5%) had their status incorrectly reported to NSLDS as Three Quarters Timeinstead of Graduated.One student out of 40 (3%) had different Program Enrollment Effective Dates reported to NSLDS forEnrollment Detail and Program Enrollment Detail reports.Questioned costs: None.Cause: These instances were related to human error and changes in staffing.Effect: Failure to properly report withdrawal dates on NSLDS could affect the timing of the grace periodfor repayment of Title IV loans. Failure to ensure the NSLDS system is updated with accurate studentinformation could cause overawards to occur if the student transfers to another institution.Repeat Finding: No.Recommendation: ISU should review current processes for reporting to NSLDS and implementprocedures to ensure submissions are reported timely and accurately.Views of responsible officials: Management agrees with this finding.

2021-005: Return of Title IV FundsFederal agency: Department of EducationFederal program title: Student Financial Assistance ClusterAssistance Listing Number: 84.007/84.033/84.038/84.063/84.268Award Period: July 1, 2020 to June 30, 2021Type of Finding:? Compliance, Other Matter? Significant Deficiency in Internal Control over ComplianceCriteria or specific requirement: Uniform Grant Guidance (2 CFR 200.303) requires nonfederalentities receiving Federal awards establish and maintain internal controls designed to reasonablyensure compliance with Federal laws, regulations, and program compliance requirements. Effectiveinternal controls should include procedures to ensure students are awarded aid within the prescribedlimits and include a documented formal review to ensure the accuracy of all Return of Title IVcalculations.Condition & Context: All 40 students (100%) lacked appropriate documentation of review of the R2T4calculation.Additionally, one student out of 40 (3%) had an incorrect withdrawal date used in their R2T4calculation.Questioned costs: None.Cause: R2T4 review procedures were in effect but there was no formal documentation for the review toverify that it occurred for every student.Effect: Without a documented formal review of withdrawal calculations, incorrect amounts of Title IVaid could be returned.Repeat Finding: No.Recommendation: ISU should implement formal review procedures to document that the Return ofTitle IV calculations are being performed to minimize the likelihood that errors may go undetected andnot be corrected in a timely manner.Views of responsible officials: Management agrees with this finding.

2021-006: Graham-Leach-Bliley ActFederal agency: Department of EducationFederal program title: Student Financial Assistance ClusterAssistance Listing Number: 84.007/84.033/84.038/84.063/84.268Award Period: July 1, 2020 to June 30, 2021Type of Finding:? Compliance, Other Matter? Significant Deficiency in Internal Control over ComplianceCriteria or specific requirement: The Standards for Safeguarding Customer Information, required bythe Gramm-Leach-Bliley Act (GLBA) (16 CFR 314.4 (b)), require customers to identify reasonableforeseeable internal and external risks to the security, confidentiality, and integrity of customerinformation that could result in the unauthorized disclosure, misuse, alteration, destruction or othercompromise of such information, and assess the sufficiency of any safeguards in place to control theserisks. At a minimum, such a risk assessment should include consideration of risk in each relevant areaof operations, including:(1) Employee training and management;(2) Information systems, including network and software design, as well as information processing,storage, transmission and disposal; and(3) Detecting, preventing and responding to attacks, intrusions, or other system failures.Condition: As a requirement under the University?s Program Participation Agreement with theDepartment of Education, ISU must protect student financial aid information. During our testing, wenoted ISU did not have a formally documented risk assessment as required by the DOE SFA testing forGLBA compliance. Additionally, ISU did not complete a risk assessment for year ended June 30, 2021;therefore, risks have not been properly assessed to ensure adequate controls have been implementedfor protecting student information.Context: ISU did not have a formally documented risk assessment as required by the DOE SFA testingfor GLBA compliance. Additionally, ISU did not complete a risk assessment for year ended June 30,2021, therefore risks have not been properly assessed to ensure adequate controls have beenimplemented for protecting student information.Questioned costs: None.Cause: According to ISU officials, ISU maintains information security policies and standards thataddress the provisions of the GLBA although resources have not been allocated to document a riskassessment related to students' informationEffect: The student personal information could be vulnerable.Repeat Finding: No.Recommendation: We recommend that ISU designate an individual to oversee the informationsecurity function, engage a third party, or perform the risk assessment for the three areas required bythe Gramm-Leach-Bliley Act and ensure that there are documented safeguards for identified risks.Views of responsible officials: Management agrees with this finding.