THE COLORADO COLLEGE AND SUBSIDIARIESHigher Education

Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 690.62 states the Pell grant for an academic year is based upon the payment and disbursement schedule published by the Secretary for each award year. The payment schedule takes into account the cost of attendance, the student’s expected family contribution (EFC) and the enrollment status of the student. Condition: One of forty students tested was underawarded Pell grant funds. Context: An erroneous computation of the student’s eligibility resulted in an underaward. Questioned costs: Known - $401. Likely - $7,953 Cause: The Pell grant was computed utilizing an outdated Pell schedule that had not been updated before awarding was locked. Effect: A student was underawarded Pell funds. Repeat Finding: No Recommendation: We recommend the College evaluate its procedures and policies around Pell grant awarding to ensure all Pell funds are awarded at proper amounts. Views of responsible officials and management’s response: The College agrees with the finding.

Criteria or specific requirement: Per 34 CFR 685.309(b)(2)(i), and as outlined in the OMB Compliance Supplement Part 5, enrollment information related to a change in status must be reported to the National Student Loan Database System (NSLDS) within 15 days whenever attendance status changes for students, unless a roster will be submitted within 60 days. Condition: During testing of underlying enrollment information, we identified the following: • One student’s status change was not submitted to the NSLDS within 60 days. Context: We tested a sample of 20 students. Of the 20 students, we noted one student had the exception noted above. Questioned costs: None. Cause: Per discussion with the College, the College submitted all degree students to their third-party servicer via a file that was processed on June 22, 2023. It was unknown by the College why the third-party servicer did not process certain students appropriately which caused them not to be reported to NSLDS in a timely manner. Effect: The College is out of compliance with National Student Loan Database System (NSLDS) reporting requirements. Repeat Finding: Yes. See 2022-002 in the summary schedule of prior audit findings. Recommendation: We recommend the College evaluate its procedures and policies around reporting to NSLDS, including oversight and inquiry of the third-party servicer, to ensure that student information is reported accurately and timely. Views of responsible officials and management’s response: The College agrees with the finding.

Criteria or specific requirement: The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The Act requires: • The information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution) that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks (16 CFR 314.4(b)). • The institution design and implement safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The minimum safeguards that the written information security program must address are summarized as follows: o Conduct a periodic inventory of data, noting where it's collected, stored, or transmitted. o Assess apps developed by the institution. o Implement multi-factor authentication (MFA) for anyone accessing customer information on the institution's system. • The institution must regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Condition: During testing we noted the following exceptions: • Safeguards were not clearly linked in their policy. o The College did not document that it conducts a periodic inventory of data, noting where it’s collected, stored, or transmitted. o There was no evidence indicating a discussion to standardize the use of MFA for end users. • The College does not have a written risk management section of their information technology policies. • There was no written policy regarding program development and software practices in relation to sensitive information. • The College does not have a written policy that identifies continuous monitoring or control testing that takes place periodically. Context: We tested the requirements of GLBA by reviewing College policy and procedures. Questioned costs: None. Cause: The College did not have policies or procedures indicating their compliance with certain aspects of GLBA. Effect: The College did not comply with GLBA requirements. Repeat Finding: No Recommendation: We recommend the College update their IT policies and procedures to follow the guidelines outlined by the GLBA. Views of responsible officials and management’s response: The College agrees with the finding.

Criteria or specific requirement: Code of Federal Regulations 2 CFR 200.303 Title 34, Subtitle B, Chapter VI, Part 674.19 requires that in administering its Federal Perkins Loan program, an institution shall establish and maintain an internal control system of checks and balances that ensures that no office can both authorize payments and disburse funds to students. When an institution uses a third-party servicer for its Perkins Loan program, the institution must perform due diligence to ensure that the third-party service is in compliance with the requirements for the functions the third-party servicer is performing for the institution. Such due diligence could include obtaining and reviewing the third-party servicer’s most recent Title IV compliance audit. Condition: The College utilizes a third-party service provider for Perkins Loan servicing. Federal regulations require the institution to perform due diligence on the third-party servicer to ensure they are following federal regulations. The College did not perform their due diligence for fiscal year 2023. Context: The due diligence typically performed by the College is the review of the third-party servicer’s compliance report. However, the third-party servicer was delated in having this report issued. The College did not have an alternate plan for performing due diligence over the third-party servicer. Questioned costs: None. Cause: The third-party servicer did not have their Title IV compliance audit report completed for the year ending June 30, 2023, so that the College could perform their required due diligence on the third-party servicer and the College did not have an alternate plan established. Effect: The College did not perform due diligence to ensure that the third-party service is in compliance with the requirements for the functions the third-party servicer is performing for the institution. Repeat Finding: No Recommendation: We recommend the College implement a procedure with the third-party servicer to ensure that their Title IV compliance report is completed timely or develop other due diligence procedures to meet the federal regulations. Views of responsible officials and management’s response: There is no disagreement with the audit finding.

Criteria or specific requirement: The Department of Education requires the College to report the disbursement dates and amounts to the Common Origination and Disbursement (COD) system within 15 days of disbursing Pell (34 CFR 690.83(b)(2) and Direct Loan (34 CFR 685.309) funds to a student.Condition: Per review of two student's account detail, the College did not report a Direct Loan disbursement to COD within the 15-day time requirement.Context: We tested a sample of 40 students to determine the College?s compliance with reporting requirements outlined by the Department of Education related to Common Origination and Disbursement and noted two of the disbursements were not reported within the 15-day requirement.Questioned costs: None.Cause: Due to the timing of employee turnover within the Student Financial Aid department procedures were not completed timely.Effect: The College is out of compliance with the requirement that disbursement dates and amounts are reported to the Common Origination Disbursement system within 15 days.Repeat Finding: Yes. See 2021-001.Recommendation: We recommend the College evaluate its procedures and policies around reporting Direct Loan disbursements to COD, including those that are unique in nature, to ensure that student information is reported accurately and timely.Views of responsible officials and management?s response: The College agrees with the finding.

Criteria or specific requirement: Per 34 CFR 685.309(b)(2), and as outlined in the OMB Compliance Supplement Part 5, enrollment information related to a change in status must be reported to the National Student Loan Database System (NSLDS) within 30 days or within 60 days if the student with the status change will be reported on a scheduled transmission within 60 days of the change in status. At a minimum, schools are required to certify enrollment data in NSLDS every 60 days. In addition, regulations require the status include an accurate effective date. There are two categories of enrollment information; ?Campus Level? and ?Program Level,? both of which need to be reported accurately.Condition: During testing of underlying enrollment information, we identified the following:? Two students? enrollment ?Campus Level? detail did not match the students? ?Program Level? detail according to the College?s policy,? Two students? changes in enrollment status were not submitted to the NSLDS within 60 days, and? Three students? enrollment status were not certified within 60 days.Context: We tested a sample of 24 students. Of the 24 students, we noted 7 students had the exceptions noted above.Questioned costs: None.Cause: The College?s processes and controls did not ensure that the student status changes were properly and timely reported to NSLDS.Effect: The College is out of compliance with the requirement that enrollment information related to a change in status must be reported to the National Student Loan Database System (NSLDS).Repeat Finding: Yes. See 2021-002.Recommendation: We recommend the College evaluate its procedures and policies around reporting to NSLDS, including those that are unique in nature, to ensure that student information is reported accurately and timely.Views of responsible officials and management?s response: The College agrees with the finding.

Criteria or specific requirement: Per the American Rescue Plan (ARP), Public Law 117-2, an institution receiving funds under Higher Education Emergency Relief Fund (HEERF III) is required to publicly post on the institution?s website certain key information on a quarterly basis. This reporting is required for both the institutional and the student portion of funding.Condition: During testing to determine if the required quarterly reports (both the student funding reports and the institutional funding reports) were both timely and accurate/supported by the College?s books and records, we noted for the three quarterly student funding reports, the College did not have records to support the estimated total number of students eligible to receive emergency financial aid grants reported. As such, the amounts reported could not be substantiated.Context: Of the three student funding quarterly reports tested, the estimated total number of students eligible to receive emergency financial aid grants could not be substantiated.Questioned costs: None.Cause: When obtaining the number of eligible students reported on the student funding quarterly reports, a snapshot of eligible students was obtained. The student aid database, PowerFAIDS, doesn?t track by date or quarter in a way that would allow the recreation of the total eligible students nor was a report kept for future reference.Effect: The College is not in compliance with all statutory or regulatory provisions as it pertains to the HEERF student quarterly reporting.Repeat Finding: Yes. See 2021-003.Recommendation: For any reports required by federal grants or programs, the College should establish procedures that include ensuring an audit trail remains for information reported. Those who review after prepared should trace back to such information.Views of responsible officials and management?s response: The College agrees with the finding.

Criteria or specific requirement: Per guidance: 2 CFR 200.430, (i) Standards for Documentation of Personnel Expenses, (1) Charges to Federal awards for salaries and wages must be based on records that accurately reflect the work performed. These records must: (i) Be supported by a system of internal control which provides reasonable assurance that the charges are accurate, allowable, and properly allocated.Condition: We noted the College?s Time and Effort is originally based upon an estimate at the beginning of the year. While the employee does later certify the estimate is correct (or submits any adjustments), this certification is only completed once a year and it is not reviewed or approved by anyone other than the employee. There was no control in place to detect if the employee?s certification was incorrect.Questioned costs: None.Context: We tested 40 employees and noted for all tested, while the employee certified their time and effort, this certification occurred once a calendar year from one to four months after the calendar year end. In addition, there was no review control to ensure certification was accurate, allowable, and properly allocated.Cause: The College was not aware there should be a distinct internal control over time and effort reporting.Effect: The College?s system of time and effort reporting does not have internal controls to provide reasonable assurance that payroll charges are based upon actual time incurred. As such, it could inadvertently be allocating personnel expenses inaccurately and improperly to federal awards.Repeat finding: No.Recommendation: We recommend that the College increase the time and effort certification process to be more timely and implement a review process over the time and effort certification process.View of responsible official: The College agrees with the finding.

Criteria or specific requirement: Non-federal entities other than states, including those operating federal programs as subrecipients of states, must follow the procurement standards set out at 2 CFR sections 200.318 through 200.326. They must use their own documented procurement procedures, which reflect applicable state and local laws and regulations, provided that the procurements conform to applicable federal statutes and the procurement requirements identified in 2 CFR Part 200.Condition: The College had a procurement policy that conformed to 2 CFR Part 200. Yet, during our testing, we noted that the College?s procurement policies were not followed. There was a single vendor who provided similar goods and services across two grants which had cumulative purchases over $10,000 within the fiscal year. This triggered Small Purchase compliance requirements to be followed; however, there was no documentation to support compliance.Questioned costs: None.Context: We tested a sample of five vendors and noted one vendor had the exception noted above.Cause: The College focused on the individual amounts being charged to the separate grants, not the cumulative amount paid to the vendor for the goods and services being provided.Effect: The College is not in compliance with their policy, nor are they in compliance with the prescribed methods of procurement as outlined in 2 CFR Part 200.320 to ensure reasonable price or rate.Repeat finding: No.Recommendation: We recommend that the College ensure its policies and procedures over procurement are being enforced to ensure reasonable prices and rates. Specifically, the College should consider training employees that regulations do apply when a single vendor is being used for a good or service, yet the charges are split amongst various funding sources.View of responsible official: The College agrees with the finding.

Criteria or specific requirement: The Department of Education requires the College to report the disbursement dates and amounts to the Common Origination and Disbursement (COD) system within 15 days of disbursing Pell (34 CFR 690.83(b)(2) and Direct Loan (34 CFR 685.309) funds to a student. Condition: Per review of one student?s account detail, the College did not report a Direct Loan disbursement to COD within the 15-day time requirement. Context: We tested a sample of 40 students to determine the College?s compliance with reporting requirements outlined by the Department of Education related to Common Origination and Disbursement and noted one of the disbursements was not reported within the 15-day requirement. Questioned costs: None. Cause: The student was originated in September 2020, but then due to not having a completed entrance counseling, disbursement was not made. When the entrance counseling was completed in early December, it prompted the disbursement to the student account, but the disbursement was not sent to the Common Origination Disbursement System. This was outside of the College?s normal process where Origination and Disbursement happen on the same day. Effect: The College is out of compliance with the requirement that disbursement dates and amounts are reported to the Common Origination Disbursement system within 15 days. Repeat Finding: No. Recommendation: We recommend the College evaluate its procedures and policies around reporting Direct Loan disbursements to COD, including those that are unique in nature, to ensure that student information is reported accurately and timely. Views of responsible officials and management?s response: The College agrees with the finding.

Criteria or specific requirement: Per 34 CFR 685.309(b)(2)(i), and as outlined in the OMB Compliance Supplement Part 5, enrollment information related to a change in status must be reported to the National Student Loan Database System (NSLDS) within 15 days whenever attendance status changes for students, unless a roster will be submitted within 60 days. Condition: During testing of underlying enrollment information, we identified the following: ? Two students? status changes were not submitted to the NSLDS, ? One student?s status change in enrollment status was not submitted to the NSLDS within 60 days nor was the enrollment certified within 60 days, ? Eleven students? changes in enrollment status were not submitted to the NSLDS within 60 days, and ? One student?s status was not certified within 60 days. Context: We tested a sample of 24 students. Of the 24 students, we noted 15 students had the exceptions noted above. Questioned costs: None. Cause: The College noted a large fluctuation in individual student?s enrollment activity, as they were enrolling then dropping, due to the COVID-19 pandemic. Effect: The College is out of compliance with the requirement that enrollment information related to a change in status must be reported to the National Student Loan Database System (NSLDS). Repeat Finding: Yes. Recommendation: We recommend the College evaluate its procedures and policies around reporting to NSLDS, including those that are unique in nature, to ensure that student information is reported accurately and timely. Views of responsible officials and management?s response: The College agrees with the finding.

Criteria or specific requirement: Per the CARES Act 18004(e) and the CRRSAA 314(e), an institution receiving funds under Higher Education Emergency Relief Fund (HEERF) I and HEERF II are required to publicly post on the institution?s website certain key information on a quarterly basis. This reporting is required for both the institutional and the student portion of funding. Condition: During testing to determine if the required quarterly reports (both the student funding reports and the intuitional funding reports) were both timely and accurate/supported by the College?s books and records, we noted the following: ? For the four quarterly student funding reports, the College did not have records to support the estimated total number of students eligible to receive emergency financial aid grants reported. As such, the amounts reported could not be substantiated. ? For one institutional funding report, one of the reports was publicly posted to the institution?s website 26 days late. Context: Of the four student funding quarterly reports tested, the estimated total number of students eligible to receive emergency financial aid grants could not be substantiated. Of the three institutional funding quarterly reports tested, one was posted to the institution?s website late. Questioned costs: None. Cause: When obtaining the number of eligible students reported on the student funding quarterly reports, a snapshot of eligible students was obtained. The student aid database, PowerFAIDS, does not track by date or quarter in a way that would allow the recreation of the total eligible students nor was report kept for future reference. The late submission of the institutional funding December 2020 quarterly report was due to the timing of the College?s winter break. Effect: The College is not in compliance with all statutory or regulatory provisions as it pertains to the HEERF quarterly reporting. Repeat Finding: No. Recommendation: For any reports required by federal grants or programs, the College should establish procedures that include ensuring an audit trail remains for information reported. Those who review after prepared should trace back to such information. Secondly, the College should establish procedures to ensure such reports are submitted timely. Views of responsible officials and management?s response: The College agrees with the finding.

Criteria or specific requirement: Per the CARES Act, in order to receive emergency funding, disbursements prior to the Department of Education?s final ruling, December 27, 2020, only students who are or could be eligible to participate in programs under Section 484 in Title IV of the Higher Education Act of 1965, as amended (HEA), may receive emergency financial aid grants. If a student has filed a Free Application for Federal Student Aid (FAFSA), then the student has demonstrated eligibility to participate in programs under Section 484 the HEA. Students who have not filed a FAFSA but who are eligible to file a FAFSA also may receive emergency financial aid grants. The criteria to participate in programs under Section 484 of the HEA include but are not limited to the following: U.S. citizenship or eligible noncitizen; a valid Social Security number; registration with Selective Service (if the student is male); and a high school diploma, GED, or completion of high school in an approved homeschool setting. Condition: Per review of one student?s eligibility to participate in Section 484 of Title IV programs, the student was deemed ineligible. The disbursement was on August 14, 2020, prior to the Department of Education?s final ruling. Context: We tested 60 students to determine the College?s compliance with HEERF requirements outlined by the Department of Education and noted one student was ineligible to receive the funding. Questioned costs: $750 Cause: The College had two funding sources for COVID-19 student emergency aid, the federal HEERF funding and the institution?s own direct funding. During the process of receiving student emergency requests and separating those eligible for federal funding from those to be paid from the College?s own funding, the student was misplaced to the federally funded aid. Effect: The College is not in compliance with all statutory or regulatory provisions as it pertains to the HEERF student aid portion of emergency aid. Repeat Finding: No. Recommendation: When implementing new funding streams that have eligibility requirements for distributions, we recommend implementing a control that would prevent distribution to ineligible participants. This could be a review control or an automated information technology control. Views of responsible officials and management?s response: The College agrees with the finding.

Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 674.19(e) states that Institutions must retain original, true, and exact copies of promissory and master promissory notes (MPN), repayment records, and cancellation and deferment requests for each Perkins loan made. An original electronically signed MPN must be retained by the institutions for three years after all the loans made on the MPN are satisfied. Condition: During our testing, we noted one of the Perkins files in which the MPN was not retained on file for three years after the loan was paid in full. Context: We tested record retention for 40 student Perkins Loans. Of the 40, we identified one student?s MPN was not maintained for at least three years after the loan was paid in full as required by the regulations. Questioned costs: None. Cause: The record was lost or misplaced. Effect: The College was not in compliance with the Perkins recordkeeping regulations. Repeat Finding: No. Recommendation: We recommend that the College implement procedures to ensure all documentation is being maintained as required by federal regulations. Views of responsible officials and management?s response: The College agrees with the finding.

Criteria or specific requirement: The Department of Education requires the College to report the disbursement dates and amounts to the Common Origination and Disbursement (COD) system within 15 days of disbursing Pell (34 CFR 690.83(b)(2) and Direct Loan (34 CFR 685.309) funds to a student. Condition: Per review of one student's account detail, the College did not report a Pell disbursement to COD within the 15 day time requirement. Context: We tested a sample of 30 students to determine the College?s compliance with reporting requirements outlined by the Department of Education related to Common Origination and Disbursement and noted one of the disbursements was not reported within the 15 day requirement. Questioned costs: None. Cause: The student was originally awarded and disbursed Pell in August 2019. Due to a professional judgment adjustment, there was additional Pell awarded to the student on October 15, 2019. The student?s ISIR was then retransmitted as a result of the Pell adjustment. Prior to the corrected ISIR being received (October 24, 2019), the Student Accounts Department disbursed the additional Pell Grant funds to the student?s account on October 22, 2019. The unusual sequence of events caused a delay in the notification of the disbursement to the Common Origination Disbursement. The Student Financial Aid Department identified that the notification needed to occur outside the 15 day window and reported the disbursement to the Common Origination and Disbursement System on November 12, 2020. Effect: The College is out of compliance with the requirement that disbursement dates and amounts are reported to the Common Origination Disbursement system within 15 days. Repeat Finding: No. Recommendation: We recommend the College evaluate its procedures and policies around reporting Pell disbursements to COD, including those that are unique in nature, to ensure that student information is reported accurately and timely. Views of responsible officials and management?s response: The College agrees with the finding.

Criteria or specific requirement: Per 2 CFR 668.51 through 668.61, the institution shall require each applicant whose application is selected by ED to verify the information required for the Verification Tracking Group to which the applicant is assigned. Condition: During our testing over compliance related to verification, we noted that the College did not release changes to a student's ISIR generated by the verification process to the federal government. Context: We tested a sample of 21 students to determine the College's compliance with reporting requirements outlined by the Department of Education related to verification procedures, and noted one instance of an amended ISIR not being released to the Department of Education. Questioned costs: None. Cause: The College performed the verification procedures and made the necessary amendments to the student's ISIR prior to disbursing grants and loans, but the final step of releasing the amended ISIR to the Department of Education was not performed. Effect: While the aid awarded was not impacted, the College originated and disbursed grants and loans to students without adhering to verification regulations. Repeat Finding: No. Recommendation: We recommend the College evaluate its procedures relating to the verification process to ensure there is a control step in place to verify that any changes to student information generated from the verification process are released to the Department of Education. Views of responsible officials and management?s response: The College agrees with the finding.

Criteria or specific requirement: Per 34 CFR 685.309(b)(2)(i), and as outlined in the OMB Compliance Supplement Part 5, enrollment information related to a change in status must be reported to the National Student Loan Database System (NSLDS) within 15 days whenever attendance status changes for students, unless a roster will be submitted within 60 days. Condition: During testing of underlying enrollment information, one student?s change in enrollment status was not submitted to the NSLDS. Context: We tested a sample of 22 students and discovered that one student was found to have a change in enrollment status that was not reported to the NSLDS. Questioned costs: None. Cause: The College uploaded all students to the NSLDS at the beginning of the fall semester. Through a meeting the College had with their servicer, National Student Clearinghouse (or NSC), it was found that the College was missing social security numbers in the student information system, Banner, where the enrollment reporting data is generated by the College. The enrollment reports that were uploaded by the College to the National Student Clearinghouse was missing key student information that prevented the student?s enrollment status from being properly reflected on NSLDS. Effect: The College is out of compliance with the requirement that enrollment information related to a change in status must be reported to the National Student Loan Database System (NSLDS). Repeat Finding: No. Recommendation: We recommend the College ensure complete and accurate information is uploaded to the NSC. In order to ensure accuracy (until an electronic upload can be relied upon), the College should implement a process to pull reports from the NSC to ensure that all necessary student information is being properly uploaded to the NSC. Views of responsible officials and management?s response: The College agrees with the finding.

Criteria or specific requirement: Per 34 CFR 674.33(b)(1) An institution shall send a first overdue notice within 15 days after the due date for a payment if the institution has not received?(i) A payment (ii) A request for deferment; or (iii) A request for postponement or for cancellation. Condition: The College utilizes a third party servicer, University Accounting Service, LLC (UAS), for its Perkins Loan servicing. This is a very common practice for colleges and universities in order to provide the most efficient and effective means to not only collect loans but meet the federal regulations for servicing student Perkins Loans. In auditing the compliance features for the loan servicing, CLA utilizes the external compliance report performed for UAS issued by other auditors. We noted within the UAS compliance audit report for the year ended June 30, 2020, there was a finding for not sending students past due notices within the required timeframes. The audit did not specify the students that were not contacted within the required guidelines and UAS is one of the largest third party servicer for federal student loans. As such, CLA selected a sample of two out of four Colorado College Students who entered Perkins Loan repayment during the award year to determine if those students were notified timely. During our testing, we noted that neither of the two students selected for testing were sent the past due notice within the required timeframe. Context: We noted the University?s third party servicer, UAS, failed to comply with notifying the students selected for testing of their overdue notice within 15 days after the due date of the payment. Questioned costs: None. Cause: UAS, the third-party servicer, did not have controls in place to ensure they complied with Department of Education Rules and Regulations in regards to timely engagement with students with federal loans, which resulted in the failure to comply with notifying the students selected for testing of their overdue notice within 15 days as required. Effect: The College is not in compliance with all statutory or regulatory provisions as it pertains to the notification of overdue loan repayments. Repeat Finding: No. Recommendation: We recommend that the College implement a thorough review process of all third-party servicer attestation reports to ensure they comply with all Department of Education Rules and Regulations. Views of responsible officials and management?s response: The College agrees with the finding.

2019-001 Federal agency: Department of Education Federal program title: Student Financial Assistance Cluster CFDA Numbers: 84.268 ? Federal Direct Loans Award Period: July 1, 2018 to June 30, 2019 Eligibility ? Parent PLUS Loans Type of Finding: ? Compliance, Other Matter ? Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: 34 CFR 668.164(e)(1) states that whenever an institution disburses Title IV, HEA program funds by crediting a student's account and the total amount of all Title IV, HEA program funds credited exceeds the amount of tuition and fees, room and board, and other authorized charges the institution assessed the student, the institution must pay the resulting credit balance directly to the student or parent as soon as possible but (1) no later than 14 days after the balance occurred if the credit balance occurred after the first day of class of a payment period; or (2) no later than 14 days after the first day of class of a payment period if the credit balance occurred on or before the first day of class of that payment period. Condition: Per review of one student's account detail, Parent PLUS loans were distributed to the student account on January 21, 2019, which created a credit balance in the account of $2,190. The student account detail showed that the credit balance was not refunded until February 12, 2019, which was outside the prescribed 14-day window. Context: We tested a sample of 30 students for Direct Loan eligibility and discovered that one student was found to have a credit balance in their account created by a Parent PLUS Loan disbursement for greater than the allowable 14 days. Questioned costs: None. Cause: This was a manual error in the College?s student accounts review process. Financial Aid and student accounts have a process in place to review student accounts for credit balances created by Title IV aid, but this particular instance was overlooked in the process. Effect: A credit balance on a student account was not remedied within the prescribed 14-day window creating an instance of noncompliance. Repeat Finding: No. Recommendation: We recommend that the Student Financial Aid Office work with the Student Accounts Office to implement a review process for Title IV Aid recipients' accounts who hold a credit balance to ensure that proper action is taken place within the prescribed window of 14 days. Views of responsible officials and management?s response: The College agrees with the finding.

2019-002 Federal agency: Department of Education Federal program title: Student Financial Assistance Cluster CFDA Numbers: 84.268 ? Federal Direct Student Loans Award Period: July 1, 2018 to June 30, 2019 Eligibility ? Direct Loans Type of Finding: ? Compliance, Other Matter ? Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Chapter 5, Special Cases, of The Federal Student Aid (FSA) Handbook published by the Department of Education, states that if institutions adjust a data element, they must use the resulting expected family contribution (EFC) consistently for all FSA funds awarded to that student. Condition: During testing of a student?s award package, we noted that the student?s original award was generated using an EFC of $2,221, but the EFC was later adjusted to $1,664. The adjustment to the EFC triggered additional need for Direct loans of $127. During our review of the records, the student was never offered the additional need based aid causing an under-awarding of aid. Context: We tested a sample of 30 students for Direct Loan eligibility, awarding and disbursement, and we noted that one student was under-awarded possible Direct loans by $127. Questioned costs: One student was under-awarded $127. Cause: When the student?s EFC was adjusted, the student?s Pell award was adjusted properly, but no adjustment of the Direct Loans (need-based) aid was made. Effect: The student was eligible for more aid than disbursed to the student. Repeat Finding: No. Recommendation: We recommend the Student Financial Aid Office work to implement a process that reviews the full award package for Title IV recipients who have an adjustment to their EFC. Views of responsible officials and management?s response: The College agrees with the finding.

2019-003 Federal agency: Department of Education Federal program title: Student Financial Assistance Cluster CFDA Numbers: 84.038 ? Federal Perkins Loan Award Period: July 1, 2018 to June 30, 2019 Type of Finding: ? Compliance, Other Matter ? Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Code of Federal Regulation, 34 CFR 674.42 requires an institution to contact a Perkins Loan borrower for the first time 90 days after the commencement of any grace period. The institution shall remind the borrower of his or her responsibility to comply with the terms of the loan. The institution is then required at 150 days and 240 days after the commencement of the grace period to remind the borrower of his/her responsibility to comply with the terms of the loan. Condition: The College utilizes University Accounting Service, LLC (UAS) for its third party Perkins Loan servicing. This is a very common practice for colleges and universities in order to provide the most efficient and effective means to not only collect loans but meet the federal regulations for servicing student Perkins Loans. In auditing the compliance features for the loan servicing, CLA reviewed the external compliance report performed for UAS by other auditors. We noted within the UAS compliance audit report for the year ended June 30, 2019, there was a finding for not contacting the student within the required timeframes. The audit did not specify the students that were not contacted within the required guidelines and UAS is one of the largest third party servicer for federal student loans. CLA selected a sample of Colorado College Students who entered Perkins Loan repayment during the award year, and noted that none of the six students selected for testing were sent the notice by the third party servicer (UAS) of required repayment. Context: Of the six students selected for testing, the University?s third party servicer, UAS, failed to notify the students of his/her responsibility to comply with terms of the loan during the required timeframes. Questioned Costs: None. Cause: UAS, the third-party servicer, did not have controls in place to ensure students were notified of responsibilities under terms of his/her loan in accordance with the required timeline discussed above. Effect: The College was not in compliance with regulatory provisions as it pertains to the notification of students exiting the Perkins Loan grace period. Repeat Finding: No. Recommendation: We recommend that the College monitor the actions of third-party service organizations to ensure they comply with Department of Education Rules and Regulations. Views of responsible officials and management?s response: The College agrees with the finding.

2019-004 Federal agency: Department of Education Federal program title: Student Financial Assistance Cluster CFDA Numbers: 84.063, 84.007, 84.033, 84.038, 84.268 Award Period: July 1, 2018 to June 30, 2019 Type of Finding: ? Compliance, Other Matter ? Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as ?financial institutions? and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Under an institution?s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Requirements of the Act include: ? Institution has designated an individual to coordinate the information security program. ? Institution has performed a risk assessment that addresses the three required areas noted in 16 CFR 314.4 (b), which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures. ? Institution has documented a safeguard for each risk identified above. Condition: While the College had certain security controls in place, documentation to support compliance with the Act was not produced by the College. Questioned costs: None Context: The College did not formally perform and document a risk assessment that addresses the three areas noted in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The College did not formally perform and document a risk assessment that addressed the three areas noted in 16 CFR 314.4 (b). Effect: The College is not in compliance with all statutory and regulatory provisions as it pertains to safeguarding sensitive data. Repeat Finding: No Recommendation: We recommend that the College perform and document an annual risk assessment against the three areas noted in 16 CFR 314.4 (b), then identify and document safeguards to address the risks identified in the risk assessment process. Views of responsible officials: There is no disagreement with the audit finding.

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION