Colorado Mountain College

Criteria or Specific Requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). In accordance with 34 CFR 668.22(a)(1), when a recipient of Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the recipient began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student’s withdrawal date. If the total amount of Title IV assistance earned by the student is less than the amount that was disbursed to the student or on his or her behalf as of the date of the institution’s determination that the student withdrew, the difference must be returned to the Title IV programs. The determination of the difference is often referred to as Return of Title IV (R2T4) calculations. Condition: There was one out of eighteen students tested where an input error in the Return of Title IV(R2T4) funds included in the calculation resulting in an error. In addition, there was not an observable internal control over the R2T4 process to prevent errors. Questioned Costs: 84.063 – Federal Pell Grant Programs – $132 Context: The institution does not have internal controls in place to ensure compliance with the Return of Title IV compliance requirement. In addition, during the testing of R2T4 funds, we identified one out of eighteen students tested where the College’s manual calculation included an input error resulting in and underpayment of Title IV funds to the Department of Education. Cause: There are no internal controls in place to prevent and detect errors in the R2T4 process in a timely manner. Effect: Errors in the R2T4 process could go undetected or not be identified in a timely manner. Repeat finding: No Recommendation: The college should implement policies and procedures to ensure compliance with Return of Title IV compliance requirements. Views of responsible officials: There is no disagreement with the audit finding.

Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The Code of Federal Regulations, 34 CFR 688.164, requires any Title IV federal funds disbursed to a student or parent that are not received or negotiated must be returned to the appropriated federal financial aid program no later than 240 days after the check or electronic fund transfer (EFT) was issued. If a check or an EFT is returned, the College may make additional attempts to deliver the funds, provided that those attempts are made no later than 45 days after the funds were returned or rejected. In case where the College does not make another attempt, the funds must be returned before the end of the initial 45-day period. The College must cease all attempts to disburse the funds and return them no later than 240 days after the date it issued the first check. Under no circumstances may unclaimed Title IV FSA funds escheat to the state, or revert to the College, or any other third party. Condition: During our testing of the 240-day requirement, we identified the College was not in compliance with the federal financial aid regulations requirement that any Title IV federal funds disbursed to a student or parent that are not received or negotiated must be returned to the appropriated federal financial aid program no later than 240 days after the check or electronic fund transfer (EFT) was issued. Questioned costs: $49,049. Context: During our testing, we identified 27 out of 57 outstanding student checks were Title IV federal funds checks that were not returned within the 240-day limit. Cause: The College did not have adequate processes in place to monitor outstanding Title IV disbursement checks throughout the year. Effect: The College is not in compliance with Department of Education requirements. Repeat finding: No Recommendation: CLA recommends that the College review the requirements and implement a monitoring control to monitor and return the checks throughout the year. Views of Responsible Officials: There is no disagreement with the audit finding.

Criteria or specific requirement: Per 2 CFR section 200.303(a), a non-Federal entity must: Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in “Standards for Internal Control in the Federal Government” issued by the Comptroller General of the United States or the “Internal Control Integrated Framework”, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Institutions are required to report enrollment status information of students under the Pell grant and the Direct loan programs via the National Student Loan Data System (NSLDS) (OMB No. 1845-0035), (Pell, 34 CFR 690.83(b)(2); Direct Loan, 34 CFR 685.309). The administration of the Title IV programs depends heavily on the accuracy and timeliness of the enrollment status information reported by institutions to NSLDS. Institutions must review, update, and certify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website which the financial aid administrator can access for the auditor. The data on the institution’s Enrollment Reporting Roster, or Enrollment Maintenance page, is what NSLDS has as the most recently certified enrollment. There are two categories of enrollment information, “Campus Level” and “Program Level, both of which need to be reported accurately and have separate record types. At a minimum, institutions are required to certify enrollment every 60 days or every other month. Condition: There were instances in which the College did not report status changes timely. Questioned costs: None. Context: In our statistically valid sample of 40 students selected for NSLDS enrollment reporting testing, we identified that status change for 34 selections was not reported timely nor was their enrollment certified every 60 days. Cause: Colorado Mountain College did not have proper procedures in place to ensure NSLDS enrollment reporting was proper and timely. Effect: Failure to properly and timely report enrollment status changes on NSLDS impacts the Department of Education’s ability to administer Title IV programs. Repeat finding: No. Recommendation: We recommend that the College work with their third-party servicer and implement procedures and internal controls to ensure that enrollment data, changes in status and effective dates within NSLDS are reported timely. Views of responsible officials: There is no disagreement with the audit finding.

2020-001: Gramm-Leach-Bliley Act Requirements Federal Agency: Department of Education Federal Program: Student Financial Assistance Cluster CFDA Numbers: 84.007 ? Federal Supplemental Education Opportunity Grants 84.033 ? Federal Work Study Program 84.063 ? Federal Pell Grant Program 84.268 ? Federal Direct Student Loans Award Period: July 1, 2019 to June 30, 2020 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Compliance, Other Matter Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (GLBA) (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as ?financial institutions? and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Under an institution?s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Requirements of the Act include: ? Institution has designated an individual to coordinate the information security program. ? Institution has performed a risk assessment that addresses the three required areas noted in 16 CFR 314.4 (b), which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures. ? Institution has documented a safeguard for each risk identified above. Condition: While the College had certain security controls in place, a formal risk assessment in compliance with the Act was not performed by the College. Context: The College did not formally perform and document a risk assessment that addresses the three areas noted in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The College had various security measure in place and had thought they were in compliance with applicable regulations. Yet, the College did not formally perform and document a risk assessment that addressed the three areas noted in 16 CFR 314.4 (b). Effect: Personal information could be vulnerable without identifying all potential risks and applying necessary safeguards. In addition, the College is not in compliance with all statutory and regulatory provisions as it pertains to safeguarding sensitive data. Recommendation: We recommend that the College designate an individual to perform the risk assessment for the three areas required by the Gramm-Leach-Bliley Act and ensure that there are documented safeguards for identified risks. Repeat Finding: No Questioned Costs: None View of Responsible Official: There is no disagreement with the audit finding.

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION