Sonoran University of Health SciencesNon-Profit

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Various Award Period: October 1, 2024 through September 30, 2025 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 682.604, states that institutions must ensure that exit counseling is conducted with each Stafford Loan borrower and graduate or professional PLUS Loan borrower in person or by interactive electronic means. The exit counseling must inform the student of the various repayment options. Condition: During our testing, we noted one of the 40 students did not have completed exit counseling procedures on file. Questioned Costs: None reported Context: During our testing, it was noted the University stated they performed the procedures verbally and did not retain written documentation. Cause: The University’s processes and controls did not ensure that exit counseling procedures were appropriately documented. Effect: The University did not comply with Department of Education (ED) regulations by failing to complete exit counseling for this student. Repeat Finding: No Recommendation: We recommend the University review its controls around exit counseling procedures to ensure that all students who withdrew or graduated with a Stafford or PLUS loan had exit counseling performed for them and appropriate documentation is retained. Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: October 1, 2022 through September 30, 2023 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The written information security program (WISP) for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its written information security program are at 16 CFR 314.4. At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Condition: There were three missing items from the Written Information Security Program. We did not identify procedures in place to securely dispose sensitive information. Standards should include a two-year retention period and a requirement that the institution periodically reviews its data retention period. We also did not identify in the WISP the institution's continuous monitoring capabilities and control testing. If continuous monitoring is not in place at the institution, then the institution should include within the written information security program, its processes to perform an annual penetration test and semi-annual vulnerability assessments. Lastly, we did not identify that the WISP includes the institution's continuous monitoring capabilities and control testing. If continuous monitoring is not in place at the institution, then the institution should include within the written information security program, its processes to perform an annual penetration test and semi-annual vulnerability assessments. Questioned costs: None Context: These new GLBA requirements were applicable beginning on June 9, 2023 and there were three elements missing from their WISP. Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance. Effect: Student personal information could be vulnerable. Repeat Finding: No Recommendation: We recommend that the University review the updated GLBA requirements and ensure their WISP includes all required elements. Views of responsible officials: There is no disagreement with the audit finding.

2022-002 Common Origination Disbursement (COD) Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Aid Cluster ALN Number: 84.268 Award Period: October 1, 2021 to September 30, 2022 Type of Finding: - Significant Deficiency in Internal Control over Compliance - Other Matters Criteria or specific requirement: The Department of Education requires the College to report the disbursement dates and amounts to the COD system within 15 days of disbursing Direct Loan (34 CFR 685.309) funds to a student. Condition: During our testing, we noted 2 of the 40 disbursements tested had incorrect direct loan disbursement dates reported to the COD system. Questioned costs: None Context: The University had two disbursement dates reported incorrectly to COD. Cause: There was an error in the reporting system that resulted in the dates being incorrectly reported. Effect: Two dates were incorrectly reported to COD. Repeat finding: No Recommendation: We recommend the reporting system be reviewed to ensure the information reported is accurate. Views of responsible officials: There is no disagreement with the audit finding.

2022-003 Return of Title IV Calculations (R2T4) Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Aid Cluster ALN Number: 84.268 Award Period: October 1, 2021 to September 30, 2022 Type of Finding: - Significant Deficiency in Internal Control over Compliance - Other Matters Criteria or specific requirement: The Department of Education (ED) requires that R2T4 calculations are performed unless one module that includes 49% or more of the number of days in the payment period has been completed (34 CFR 668.22(a)). In addition, the Federal Student Aid Handbook, published by the Department of Education, states that percentages are calculated to four decimal places and is rounded to three decimal places for R2T4 calculations. Condition: During our testing, we noted 4 of the 18 students tested completed the first module which included over 49% of the days in the payment period and withdrew either before or during the second module, but incorrectly had R2T4 calculations applied, and funds returned to ED. The University also did not properly round to three decimal places for one of the student?s R2T4 calculations in the 18 students tested. The total dollars that the University returned to ED (but did not need to) was $9,588. Questioned costs: None Context: The University calculated R2T4 for modular students that had completed more than 49% of the days in the payment period. In addition, the University calculated one student's return without the form and did not properly round the completed percentage. Cause: There was a misinterpretation of the new regulations from ED. The University also did not use the form for the R2T4 calculation for every calculation. Effect: Loan funds were returned to ED that were supposed to go to the students ($9,567 in the sample) and a student's R2T4 was calculated incorrectly ($20 returned to ED over the required amount). Repeat finding: No Recommendation: We recommend the University update their R2T4 calculation process to eliminate the students that completed 49% of the payment period days in their modular classes. We also recommend the University use the R2T4 form for all calculations to avoid any potential rounding errors. Views of responsible officials: There is no disagreement with the audit finding.

2021-002 Reporting Federal Agency: U.S. Department of Education Federal Program Title: Higher Education Emergency Relief Funds ALN Number: 84.425 Award Period: October 1, 2020 to September 30, 2021 Type of Finding: - Significant Deficiency in Internal Control over Compliance - Other Matters Criteria or specific requirement: Per Uniform Guidance 2 CFR 200.303, non-federal entities receiving federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with federal laws, regulations and program compliance requirements. The initial reporting for this grant requires the report to be submitted to the college or university?s website within 30 days of the signed Certification Agreement or 30 days after the electronic announcement dated May 6, whichever is later. Colleges and universities were then required to update their websites every 45 days after initial upload. This was changed to quarterly on August 31, 2020. In addition, an annual report is required. Condition: We tested 1 out of 1 annual reports, 2 out of 4 quarterly student reports, and 2 out of 4 quarterly institutional reports. During our testing, we noted: - For the December 31, 2020 annual report, the supporting documentation provided did not tie to the eligible students reported by 6 students as well as the institutional expenditures support did not tie to the amount reported by $10,525. - For the September 30, 2020 quarterly institutional support, the student expenditures were included but should not have been. The supporting documentation provided did not tie to the expenditures reported by $283. The report was also not reviewed and approved prior to submission. - For the June 30, 2021 quarterly institutional support, the student expenditures were included but should not have been. The supporting documentation provided did not tie to the expenditures reported by $1,023 as well as the awarded amount on the report was missing the HEERF II allocation. Lastly, the report was not reviewed and approved prior to submission. - For the September 30, 2020 quarterly student support, the supporting documentation provided did not tie to the eligible students reported by 6 students. The report was also not reviewed and approved prior to submission. - For the June 30, 2021 quarterly student support, the report was missing the requirement to acknowledge that the institution signed and returned to the Department the certification and agreement and the assurance that the institution has used, or intends to use, no less than 50% of the funds to provide emergency grants to students. For the total amount of funds received, the total amount of emergency grants disbursed, and the total number of students who have received a grant, the institutional expenditures were included and should not have been. Lastly, the report was also not reviewed and approved prior to submission. Questioned costs: None Context: A control system to prevent and detect errors in the reporting process was not created at the time the reports were filed and the College did not have a process to track the reporting requirements. In addition, there was a general lack of guidance from ED on reporting requirements. Cause: The College did not have someone tracking the requirements to ensure that they posted the reporting timely and accurately. Effect: The College did not comply with ED regulations by reporting accurate information as well as retaining support for the information reported to ensure accuracy. Repeat finding: No Recommendation: We recommend the College review their reporting procedures to ensure all required steps are included as well as the supporting documentation to prepare the report is retained. The reports should be reviewed by someone other than the preparer of the report and this review should be documented. Views of responsible officials: There is no disagreement with the audit finding.

2021-003 Procurement and Suspension and Debarment Federal Agency: U.S. Department of Education Federal Program Title: Higher Education Emergency Relief Funds ALN Number: 84.425 Award Period: October 1, 2020 to September 30, 2021 Type of Finding: - Significant Deficiency in Internal Control over Compliance - Other Matters Criteria or specific requirement: The Code of Federal Regulations section 215.44 states written selection procedures require solicitations for goods or services incorporate a clear and accurate description of the technical requirements for the material, product, or service to be procured, identify all requirements for the material, product, or service to be procured, identify all requirements that the offerors must fulfill, and include all other factors to be used in evaluating bids or proposals. In addition, per Uniform Guidance 2 CFR sections 200.212 and 200.318(h); 2 CFR section 180.300; 48 CFR section 52.209-6, a non-federal entity must have procedures for verifying that an entity with which it plans to enter into a covered transaction is not debarred, suspended, or otherwise excluded. Condition: During our testing, we noted the College did not have properly documented procurement regulations that met the federal requirements. They also did not have a conflict of interest policy that met federal requirements. We were unable to verify any procurement methods used for the three vendors tested. In addition, during our testing, we noted for one out of the one vendors over $25,000 tested, there was not documented suspension and debarment procedures. Questioned costs: None Context: The College did not have documented procurement procedures or procedures in place to verify vendors had not been suspended or debarred. They were not following procurement requirements under Uniform Guidance. Cause: The College was not aware of the requirements of the Uniform Guidance. Effect: The lack of documented procurement regulations and policies over these compliance requirements provides an opportunity for noncompliance. In addition, the College could enter into a covered transaction with a vendor who is suspended or debarred. Repeat finding: No Recommendation: We recommend the College document suspension and debarment procedures going forward for any vendors with federal expenditures over $25,000. We also recommend a procurement policy be implemented that meets the requirements of Uniform Guidance as well as the conflict of interest policy is updated to conform with Uniform Guidance. Lastly, we recommend documentation be retained as it relates to the methodology chosen for procurement in accordance with the procurement policy. Views of responsible officials: There is no disagreement with the audit finding.

2021-004 Student Refund Checks Outstanding Greater than 240 Days Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Aid ALN Number: Student Financial Aid Cluster Award Period: October 1, 2020 to September 30, 2021 Type of Finding: - Significant Deficiency in Internal Control over Compliance - Other Matters Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 668.164(h)(2) states that a college or university that attempts to disburse funds by check and the check is not cashed, the college or university must return the funds to the Secretary no later than 240 days after the date it issued that check. Condition: During our testing, we noted there were four checks greater than 240 days that were not returned to the Department of Education (ED). Questioned costs: $5,353 Context: During our testing, we noted four checks related to student refunds of Title IV federal financial aid was outstanding more than 240 days as of September 30, 2021. Cause: Management is continuing to work on refining their policies and procedures around this area and there were checks missed during the current process. Effect: The College is not in compliance with ED requirements that all student refund checks that are outstanding for more than 240 days be return to ED. Repeat finding: No Recommendation: We recommend the College review their procedures and implement processes to ensure that all outstanding refund checks caused by Federal funds are returned to the ED within the required 240 days. Views of responsible officials: There is no disagreement with the audit finding.

2020-002 National Student Loan Data System (NSLDS) Enrollment Reporting Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Aid CFDA Number: Student Financial Aid Cluster Award Period: October 1, 2019 to September 30, 2020 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless if they receive aid from the institution or not. This includes the enrollment effective date and related enrollment status, which must be reported for both the Campus-Level and the Program-Level as well as enrollment must be verified every 60 days. Condition: During our testing, we noted for 3 out of the 40 students tested, the enrollment effective date did not match the enrollment effective date per the College?s records. We also noted for 32 out of the 40 students tested, the enrollment was not verified every 60 days. Questioned costs: None Context: During our testing, it was noted the College does not have a process in place to ensure timeliness and accuracy of NSLDS reporting. Cause: The College did not timely or properly report student enrollment information to NSLDS through their third-party servicer, National Student Clearinghouse (NSC). Effect: The College did not comply with Department of Education (ED) regulations by reporting student enrollment status changes and information accurately and timely. Repeat finding: No Recommendation: We recommend the College reevaluate its procedures and review policies surrounding reporting status changes and other enrollment information to NSLDS to ensure timely and accurate reporting. Views of responsible officials: There is no disagreement with the audit finding.

2019-001 Student Refund of Credit Balance within 14 days Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Aid CFDA Number: Student Financial Aid Cluster Award Period: October 1, 2018 to September 30, 2019 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria: The Code of Federal Regulations, 34 CFR 668.164(e) states that whenever an institution disburses title IV, HEA program funds by crediting a student?s account and the total amount of all title IV, HEA program funds credited exceeds the amount of tuition and fees, room and board, and other authorized charges the institution assessed the student, the institution must pay the resulting credit balance directly to the student or parent as soon as possible but? (1) No later than 14 days after the balance occurred if the credit balance occurred after the first day of class of a payment period; or (2) No later than 14 days after the first day of class of a payment period if the credit balance occurred on or before the first day of class of that payment period. Condition and Context: During our testing, we noted 27 of 40 students tested did not have the credit balance resulting from federal funds refunded within the 14 day period. Questioned Costs: None Cause: The College did not post adjustments to student accounts within the College?s add/drop period. Noted all adjustments are made to student ledgers after 14 days. Effect: The College did not refund students within 14 days for credit balances that arose from federal funds as required by Department of Education regulations. Recommendation: We recommend the College put a process in place to refund student credit balances that arise from federal funds within 14 days. We also recommend posting to student accounts for institutional charges for each payment period be posted and dated prior to disbursing federal funds to limit the number of refund checks. View of Responsible Officials: There is no disagreement with the audit finding.

2019 ? 002 Gramm-Leach-Bliley Act Federal agency: Department of Education Federal program title: Student Financial Aid CFDA Numbers: Student Financial Aid Cluster Award Period: October 1, 2018 through September 30, 2019 Type of Finding: ? Significant Deficiency in Internal Control over Compliance ? Other Matters Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as ?financial institutions? and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution?s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the College did not perform a risk assessment that addresses the three areas noted in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The organization uses a third-party IT service provider for IT related tasks and relied on that service provider to ensure all compliance requirements are met. However, the organization should have an individual designated internally to assure compliance with the requirements of the Gramm-Leach- Bliley Act. The organization did not perform an IT risk assessment tailored specifically to the organization, identify risks, or address risks identified as required by the Gramm-Leach-Bliley Act. Effect: The student personal information could be vulnerable. Repeat Finding: No Recommendation: We recommend that the College engage a third party or perform the risk assessment for the three areas required by the Gramm-Leach-Bliley Act and ensure that there are documented safeguards for identified risks. Views of responsible officials: There is no disagreement with the audit finding.