New Mexico Institute of Mining and Technology

2022-003 ? Special Tests and Provisions ? Gramm-Leach-Bliley Act, Significant Deficiency and Instance of Noncompliance Federal Assistance Listing Number(s): Multiple Federal Agency/Pass-through Entity ? Program Name: Student Financial Assistance Cluster Award Number: Multiple Award Year: Multiple Questioned Costs: Multiple Criteria: Per 16CFR 314.4, the Institute shall base an information security program on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks. The risk assessment shall be written and shall include: (i) Criteria for the evaluation and categorization of identified security risks or threats faced; (ii) Criteria for the assessment of the confidentiality, integrity, and availability of information systems and customer information, including the adequacy of the existing controls in the context of the identified risks or threats faced; and (iii) Requirements describing how identified risks will be mitigated or accepted based on the risk assessment and how the information security program will address the risks. Condition/Context: Per the Gramm-Leach-Bliley Act, the Institute has not completed a risk assessment as required. Cause: The Institute has not completed a risk assessment as required. Effect: Noncompliance with federal regulations. Questioned Costs: Unknown Repeat Finding: This is not a repeat finding. Recommendation: Management should complete a risk assessment to determine the organizational risks and design and implement safeguards to control identified risks. Views of Responsible Officials and Planned Corrective Actions: A risk assessment is currently in process, which will provide a holistic plan that includes Gramm-Leach-Bliley Act requirements. This assessment is scheduled for completion by December 2022, as committed in the fiscal year 2021 audit response. It is currently on track for that completion date. Once the assessment is completed, a technical suitability evaluation will be conducted to provide the most appropriate technical solutions to meet the overall needs based on the assessment findings/determinations. This will address the current deficiencies and control gaps. Responsible Person: Director of Information Technology and Communications

2021-002 ? Equipment Tracking, Significant Deficiency and Instance of Noncompliance Federal Assistance Listing Number(s): Multiple Federal Agency/Pass-through Entity ? Program Name: Research and Development Cluster Award Number: Multiple Award Year: Multiple Questioned Costs: Unknown Criteria: Per 2 CFR 200.313(d)(2), management must meet the following requirements: (1) Property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property (including the FAIN), who holds title, the acquisition date, and cost of the property, percentage of Federal participation in the project costs for the Federal award under which the property was acquired, the location, use and condition of the property, and any ultimate disposition data including the date of disposal and sale price of the property. (2) A physical inventory of the property must be taken and the results reconciled with the property records at least once every two years. (3) A control system must be developed to ensure adequate safeguards to prevent loss, damage, or theft of the property. Any loss, damage, or theft must be investigated. (4) Adequate maintenance procedures must be developed to keep the property in good condition. (5) If the non-Federal entity is authorized or required to sell the property, proper sales procedures must be established to ensure the highest possible return. Condition/Context: During our test work of equipment, we noted the following: (a) The Institute was not able to provide an equipment listing which included all the requirements listed in 2 CFR 200.313(d)(2)(1). (b) Six out of the 13 assets selected did not have a physical inventory taken within two years. Cause: The Institute failed to implement a proper tracking system that complied with federal requirements. Effect: The Institute was not maintaining proper record of federally funded property as required by statute. Questioned Costs: Unknown Repeat Finding: This is not a repeat finding. Recommendation: We recommend the Institute review and revise their established policies and procedures for maintaining federally funded property records in order to comply with requirements of 2 CFR 200.313(d)(2). Views of Responsible Officials and Planned Corrective Actions: NMT Property maintains a current policy and procedure for the tracking of equipment in support of all regulations. All changes were implemented October 21, 2021. (a) Equipment Listing ? NMT Property runs and reviews the equipment listings regularly. A listing is not generated monthly that encompasses every piece of equipment. Request for reporting is limited to smaller subsets of the listing that is driven by a single equipment custodian, usually as they are leaving NMT as their employer. As a corrective action for future support of the research equipment filing, a list of the full research equipment report will be provided to the Associate Director of Sponsored Projects for reference. (b) In 2019, a 100% equipment inventory was completed. It is NMT Property?s error for not having the date fields populated with the correct dates. Since 2020, due to State of New Mexico?s executive order to work from home and Covid-19 travel restriction, a full inventory has not been completed. The discrepancy for the date field errors was that during inventory, not all equipment is available to be scanned. Some of the inventory is maintained at off campus research locations that are out of state and are accounted for by receiving an affidavit from the equipment manager who had to cancel trips due to Covid-19 travel restrictions. The step in the process that was missed was populating the affidavit date into the date field prior to uploading the inventory results back into Banner fixed assets. For future inventories, all last inventory dates will be populated with the correct date. Responsible Person: Director of Property & Recycling

2021-003 ? Reporting, Significant Deficiency and Instance of Noncompliance Federal Assistance Listing Number(s): Multiple Federal Agency/Pass-through Entity ? Program Name: Research and Development Cluster Award Number: Multiple Award Year: Multiple Questioned Costs: Unknown Criteria: Per Higher Education Emergency Relief Fund guidance, a quarterly public report must be uploaded to the Institution?s website no later than 10 days after the end of each calendar quarter for both the Institutional Portion and the Student Aid Portion. Condition/Context: During our test work of the Institute?s compliance over reporting requirements, we noted the following: (a) One out of three of the selected quarterly public reporting (Institutional Portion) was posted after the due date (b) For two out of two of the selected quarterly public reporting (Student Aid Portion), we were unable to obtain supporting documentation for the posting date. We were therefore unable to verify timely posting. Cause: The Institute failed to implement a proper system of internal controls to ensure timely posting of public reporting requirements that complied with federal requirements. Effect: Noncompliance with public reporting requirements. Questioned Costs: None Repeat Finding: This is not a repeat finding. Recommendation: The Institute should ensure their established control system is operating effectively in order to ensure all reports are prepared and submitted in accordance with the federal requirements. Views of Responsible Officials and Planned Corrective Actions: The NMT financial system did not close the month until two days later. We assume that providing and posting accurate information is more important than delaying the release by a few days. This information has been provided to the federal agent. In the future, we will make certain that the required reporting date is met. The CARES Act was an entirely new process, and the reporting requirements were not clear until later period. Therefore, we had to make adjustments accordingly. Initially, the website was set up to list the report information directly on the webpage. As further guidance was given, it became apparent that the webpage alone would not work as the information would be mixed together and difficult to understand. After further reading related guides and articles, it was determined that separate reports for each quarter would be necessary to effectively report the information. Moving forward, separate reports will be created and posted for each quarter and, in addition, additional steps will be taken to capture information regarding the date that it is posted for compliance. These changes were implemented July 1, 2021. Responsible Person: Director of Financial Aid

2020-003 ? Significant Deficiency in Internal Controls over Compliance, Non-Compliance ? Special Tests and Provisions ? Enrollment Reporting (Previously reported as 2019-001) Federal Agency: Department of Education Federal Programs: CFDA 84.063 & 84.268 ? Student Financial Assistance Cluster Criteria: Under the Pell grant and ED loan programs per Pell, 34 CFR 690.83(b)(2), institutions must complete and return within 15 days the Enrollment Reporting roster file placed in their Student Aid Internet Gateway mailboxes sent by ED via NSLDS. The institution determines how often it receives the Enrollment Reporting roster file with the default set at a minimum of every 60 days. Once received, the institution must update for changes in student status, report the date the enrollment status was effective, enter the new anticipated completion date, and submit the changes electronically through the batch method or the NSLDS website. Condition/Context: For 1 of 5 students tested, the Institute did not report status changes to NSLDS when required. Management?s Progress: The report update error was completed August 2019. The process to capture the additional graduating students was implemented October 1, 2020. Cause: The report is only being run to capture spring, fall, and summer graduations only; therefore, off cycle graduations are not being captured in the report and the status changes are not being reflected. Effect: New Mexico Institute of Mining and Technology is not in compliance with enrollment reporting guidelines required by the Department of Education. Questioned Costs: None Recommendation: New Mexico Institute of Mining and Technology should ensure their established control system is operating effectively in order to ensure all enrollment reports are prepared and submitted in accordance with the federal requirements and captures all student changes regardless of graduation date. Views of Responsible Officials and Planned Corrective Actions: Students who graduated in the semester prior to the one reported on but had a graduation date outside of that semester were not getting picked up for reporting. This caused an inaccurate enrollment status at the National Student Loan Data System (NSLDS). Beginning October 1, 2020, the process is now updated to request a graduation report from the Registrar?s Office on a monthly basis. Any off-cycle graduations will be updated manually in NSLDS. Person Responsible: Financial Aid Director

Finding 2019-001 ? Significant Deficiency in Internal Controls over Compliance, Non-Compliance ? Special Tests and Provisions ? Enrollment Reporting Federal Agency ? Department of Education Federal Programs ? CFDA 84.063 & 84.268 ? Student Financial Assistance Cluster Criteria ? Under the Pell grant and ED loan programs per Pell, 34 CFR 690.83(b)(2), institutions must complete and return within 15 days the Enrollment Reporting roster file placed in their Student Aid Internet Gateway mailboxes sent by ED via NSLDS. The institution determines how often it receives the Enrollment Reporting roster file with the default set at a minimum of every 60 days. Once received, the institution must update for changes in student status, report the date the enrollment status was effective, enter the new anticipated completion date, and submit the changes electronically through the batch method or the NSLDS website. Condition/Context ? For 20 of 25 students tested, the Institute (1) did not report status changes to NSLDS when required, or (2) did not report status changes to NSLDS in a timely manner. Specifically, the Institute: ? Did not report three students? graduated status because that student enrolled in a subsequent term. ? Did not report 17 students? status changes in a timely manner. The status changes for those students were reported between 81 and 236 days after their effective dates. Cause ? System issues caused the enrollment reporting roster file to export outdated data resulting in status changes being reported late. Effect ? New Mexico Institute of Mining and Technology is not in compliance with enrollment reporting guidelines required by the Department of Education. Questioned Costs ? None Recommendation ? New Mexico Institute of Mining and Technology should ensure their established control system is operating effectively in order to ensure all enrollment reports are prepared and submitted in accordance with the federal requirements. Management Response ? The enrollment reporting process is run every 60 days. The first file for Spring 2019 was processed and submitted on January 11, 2019 to the National Student Loan Data System (NSLDS). This file reported the final updated status of students from Fall 2018 semester. This report processed correctly and the status of students was reported accurately. Running the process in Banner was producing a file identified as ?sfrsubm.dat? which the Financial Aid staff emailed to themselves for the purpose of submitting to NSLDS. After the January process, the file produced changed the identification of the file to ?sfrsscr?. The email process continued to send the original ?sfrsubm.dat? to Financial Aid to submit, resulting in the same file (no updates) being submitted on March 6 and May 5th, 2019.The error was discovered in July when the submission was rejected because the report date, a field in the submission, was over six months old. Upon discovery of the error, Ellucian was contacted to determine the cause of the name change. Ellucian was unable to provide an answer. Financial Aid personnel modified the procedure that sends the email so that it pulled the newly named file correctly. The corrective action applied by ITC is working and NMT is continuing to monitor the files for accuracy. Additionally, NMT has contracted with the National Student Loan Clearinghouse (NSLC) to become our third party servicer for enrollment reporting. NSLC will test the files prior to submitting them to NSLDS, providing an additional level of oversight. Reporting through NSLC will also be done on a monthly, versus a bi-monthly, basis. This issue has been addressed as of August 2019. Person Responsible: Financial Aid Director, and Director of ITC

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION