Northland Pioneer CollegeHigher Education

Criteria: Establishing a process for managing risk that follows a credible industry source, such as the National Institute of Standards and Technology, helps the District to effectively manage risk related to IT systems and data. CFR Guidance (Based on GLBA 16 CFR – 314.4) – Addresses how the institution will oversee its information system service providers (16 CFR 314.4(f)). Condition: The District’s written information security program does not include a vendor due diligence program as required by the Gramm-Leach-Bliley Act (GLBA) 16 CFR 314.4(f). Questioned Costs: None Cause: The District’s written information security program did not include established policies and standards specifically addressing vendor risk management. Effect: The District is exposed to loss of revenue, reputation damage, disclosure of non-public data, loss of technology assets as a result of the following: • Potential security breaches due to insufficient evaluation and monitoring of vendors who interact with sensitive data. • Inadequate assessment of risks associated with outsourcing services or managing services through vendors. • Establishing relationships with vendors that do not support the District’s strategic objectives, lack financial stability, or have inadequate controls. This absence makes it difficult to ensure that vendors who interact with sensitive data are properly evaluated, selected, and monitored, potentially leading to security breaches and noncompliance with regulatory requirements. Repeat Finding: Yes; 2024-004 Recommendation: The District should ensure that the written information security program includes a vendor due diligence program. This program should include: • Standards for evaluating and selecting vendors who interact with sensitive data. • Contract provisions that require third-party vendors to maintain safeguards. • Ongoing monitoring based on the risk the vendor presents. Also, appropriate policy and standards documentation should be established to support the vendor management program. View of responsible official: The District agrees with the finding, see the Corrective Action Plan.

Criteria: Per 34 CFR 690.83(b)(2), an institution must report any enrollment status changes, including the date of the change per the institution’s reporting system, to the National Student Loan Data System (NSLDS) for participating students within 60 days of the change. Condition: We found that the District did not report enrollment status changes to the NSLDS by the required federal deadlines for 40 of the 40 (100 percent) students we tested. Questioned Costs: None Cause: The District did not have adequate internal controls in place to ensure that it fully complied with federal student enrollment reporting requirements for the Title IV Student Financial Assistance program. Effect: Enrollment reporting is a critical compliance requirement for institutions participating in the federal Student Financial Assistance program. For recipients of Pell Grants, timely enrollment reporting by institutions assists with their eligibility, future disbursement amounts, and continued access to Student Financial Assistance. Failure to meet the required enrollment status change reporting timeliness increases the District’s risk of material noncompliance with federal Student Financial Assistance program requirements. Repeat Finding: No Recommendation: We recommend that the District strengthen its internal controls over reporting student enrollment changes to NSLDS to ensure that enrollment effective dates are reported to NSLDS within 60 days of an enrollment status change occurring. Views of Responsible Officials: The District agrees with the finding, see the Corrective Action Plan.

Assistance Listings number and name: 84.425E COVID-19 - Education Stabilization Fund?Higher Education Emergency Relief Fund (HEERF) Student Portion Award numbers and years: P425E201812, April 24, 2020 through June 30, 2023 Federal agency: U.S. Department of Education Compliance requirement: Activities allowed or unallowed and allowable costs/cost principles Questioned costs: None Condition?Contrary to federal guidance, the District used emergency financial assistance monies to satisfy the student?s outstanding account balance without obtaining the student?s prior consent to do so for 3 of 30 emergency financial assistance transactions we tested. Specifically, the District misapplied $500 of program monies, for a total of $1,500, to discharge each of these student?s outstanding account balance with the District rather than directly disbursing these monies to the students. However, we noted no questioned costs as a result of this noncompliance since the students were eligible to receive financial assistance monies. Effect?By the District not obtaining a student?s prior consent to discharge their outstanding account balance rather than disbursing the monies directly to the student, the program?s objective to provide students with emergency financial assistance that may be used at the student?s discretion to help defray costs for food, housing, health care, or childcare?in addition to tuition costs?may not be met. Further, the student could face undue financial hardship. Cause?The District did not have a documented process in place to ensure that it obtained a student?s prior consent for applying emergency financial assistance to the student?s outstanding account balance. Criteria?Federal guidance requires the District to obtain a student?s prior written or electronic consent prior to applying emergency financial assistance to discharge the student?s outstanding account balance with the District.1 In addition, the District must establish and maintain effective internal control over federal awards that provides reasonable assurance that it administers federal programs in compliance with all applicable laws, regulations, and award terms (2 Code of Federal Regulations [CFR] ?200.303). Recommendations?The District should: 1. Develop and implement written policies and procedures to ensure the District obtains each student?s written or electronic consent prior to applying any emergency financial assistance to the student?s outstanding account balance. 2. For those instances in which the District misapplied emergency financial assistance to students? outstanding account balances, determine if the students agree with the discharge of the outstanding account balances or want direct payment of those monies and make any necessary adjustments. The District?s corrective action plan at the end of this report includes the views and planned corrective action of its responsible officials. We are not required to and have not audited these responses and planned corrective actions and therefore provide no assurances as to their accuracy. 1 U.S. Department of Education. (2021). Higher Education Emergency Relief Fund III, Frequently Asked Questions, Question 11. https://www2.ed.gov/about/offices/list/ope/arpfaq.pdf

Cluster name: Student Financial Assistance Cluster Assistance Listings numbers and names: 84.007 Federal Supplemental Educational Opportunity Grants 84.033 Federal Work-Study Program 84.063 Federal Pell Grant Program Award numbers and years: P007A180127; P033A180127; P063P183482; July 1, 2019 through June 30, 2020 Federal agency: U.S. Department of Education (U.S. ED) Compliance requirement: Special tests and provisions Questioned costs: N/A Condition?The District did not document that it identified reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of its student financial aid information and that it implemented safeguards for each risk identified. Effect?Without correcting these deficiencies, the District?s administration and information technology (IT) management may put the District?s operations and IT systems and data, including student financial aid information, at unintended and unnecessary risk. Cause?The District designated an individual to coordinate its information security program over its student financial aid information but relied on an informal and undocumented process to manage, assess, and respond to IT risks. Criteria?The District?s Program Participation Agreement with the U.S. ED requires the District to protect student financial aid information by designating an employee to coordinate its information security program. The District must also perform a risk assessment and document a safeguard for each risk identified. (Title 16 U.S. Code of Federal Regulations, Parts 313 and 314, as required by the Gramm-Leach-Bliley Act, P.L. 106-102) Recommendations?To help ensure that the District protects student financial aid information, the District should: 1. Develop, document, and implement entity-wide risk assessment written policies and procedures. 2. Perform a risk assessment to identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of student financial aid information that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information. The risk assessment should consider risks related to: o Employee training and management. o Information systems, including network and software design, as well as information processing, storage, transmission, and disposal. o Detecting, preventing, and responding to attacks, intrusions, or other system failures. 3. Document and implement a safeguard for each risk identified. The District?s responsible officials? views and planned corrective action are in its corrective action plan at the end of this report. This finding is similar to prior-year finding 2019-101.

2019-101 Cluster name: Student Financial Assistance Cluster CFDA numbers and names: 84.007 Federal Supplemental Educational Opportunity Grants 84.033 Federal Work-Study Program 84.063 Federal Pell Grant Program Award numbers and years: P007A180127; P033A180127; P063P183482; July 1, 2018 through June 30, 2019 Federal agency: U.S. Department of Education Compliance requirement: Special tests and provisions Questioned costs: N/A Condition and context?The District had no evidence that it had performed the required risk assessment and documented safeguards of the student financial aid information it maintains. Criteria?The District?s agreement with the U.S. Department of Education requires the District to protect student financial aid information by designating an employee to coordinate its information security program. The District must also perform a risk assessment and document a safeguard for each risk identified. (Gramm-Leach-Bliley Act, Title 16 U.S. Code of Federal Regulations, Part 314). Effect?Without correcting these deficiencies, the District?s administration and information technology (IT) management may put the District?s operations and IT systems and data, including student financial aid information, at unintended and unnecessary risk. Cause?The District designated an individual to coordinate its information security program over its student financial aid information but relied on an informal and undocumented process to manage, assess, and respond to IT risks. Recommendation?To help ensure that the District protects student financial aid information, the District should: ? Perform a risk assessment to identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of student financial aid information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information. The risk assessment should consider risks related to: o Employee training and management. o Information systems, including network and software design, as well as information processing, storage, transmission and disposal. o Detecting, preventing and responding to attacks, intrusions, or other system failures. ? Document and implement a safeguard for each risk identified. ? Monitor the effectiveness of the safeguards? key controls, systems, and procedures on a periodic basis. ? Evaluate and adjust the information security program in light of the testing and monitoring results, any significant changes to the District?s operations or business arrangements, and any other circumstances that may have a significant impact on the information security program. The District?s responsible officials? views and planned corrective action are in its corrective action plan at the end of this report.