Saint Martin's University

Gramm-Leach-Bliley Act – Student Information Security – Significant Deficiency in Internal Controls over Compliance Student Financial Assistance Cluster U.S. Department of Education Federal Assistance Listing Number: 84.063, 84.268, 84.007, 84.033, 84.379, 84.038 Federal Program Name: Federal Pell Grant Program, Federal Direct Student Loans, Federal Supplemental Educational Opportunity Grants, Federal Work-Study Program, Teacher Education Assistance for College and Higher Education Grants Federal Award Number: P063P230416, P268K240416, P007A234401, P033A234401, P379T240416 Award Year: 2023-24, 2022-23 Criteria: Per 16 CFR 314.3, institutions subject to the requirement shall develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts and contains administrative, technical, and physical safeguards that are appropriate to the size and complexity, the nature and scope of their activities, and the sensitivity of any customer information at issue. The information security program shall include the elements set forth in 16 CFR 314.4 and shall be reasonably designed to achieve the objectives of 16 CFR 314.3(b). These requirements were effective as of June 9, 2023. Condition/context: Based on our review of the information provided by the University, they are currently in the process of reviewing and finalizing their information security program. The written draft provided did not appear to have been updated in several years and did not clearly address all of the required elements in 16 CFR 314.4. Questioned costs: None. Cause/effect: The Integrated Technology Services department has experienced staff shortages which have contributed to the delay in implementation of this standard. The absence of a well-designed and documented policy addressing the standards set forth under the act could put the security, confidentiality, and integrity of student information at risk. Repeat finding: Yes, 2023-002 Recommendation: We recommend the University review the compliance requirements and update their written policy to ensure that it addresses all the required elements. Views of responsible officials and planned corrective actions: Saint Martin’s University management agrees with the finding. The University will review the requirements of 16 CFR 314.4, update our written policy to ensure that it addresses all the required elements 16 CFR 314.3(b), and perform an annual review of our updated policy to ensure that it continues to comply with all relevant regulations. The University is currently in the process of formally adopting a cybersecurity framework as well as securing a vendor to perform an IT security assessment. This ongoing work in the interest of the security, confidentiality, and integrity of student information will position us well to make the recommended updates to our policy.

Gramm-Leach-Bliley Act – Student Information Security – Significant Deficiency in Internal Controls over Compliance – Federal Assistance Listing Number 84.063, 84.268, 84.007, 84.033, 84.379, 84.038 Recommendation: The auditors recommend the University review the compliance requirements and update our written policy to ensure that it addresses all the required elements. Action taken: The CIO, Mary Donahoo, worked in conjunction with prior CFO to create a timeline for implementation for the requirements of GLBA. The Information Technology Services (ITS) department had begun policy development pertaining to the Gramm-Leach- Bliley Act (GLBA) specific elements in 16 CFR 314.4 during fiscal year 2024 but was unable to complete all the required implementations. The ITS department implemented, during fiscal year 2024, improvements to cyber security and minor elements of GLBA, including multifactor authentication. The action plan anticipates completion of all elements of GLBA by the end of the calendar year. Name of Responsible Party: Mary Donahoo Anticipated completion date: 12/31/2024

2023-002

Special Tests and Provisions – Enrollment Reporting – Significant Deficiency in Internal Controls over Compliance Student Financial Assistance Cluster U.S Department of Education Federal Assistance Listing Number: 84.063, 84.268 Federal Program Name: Federal Pell Grant Program, Federal Direct Student Loans Federal Award Number: P063P230416, P268K240416 Award Year: 2023-24 Criteria: Uniform Guidance requires institutions to have internal controls in place to ensure attendance changes for students are reported to the National Student Loan Data System (NSLDS) within at least 60 days of when the student attendance change occurs. It is the University's responsibility to update students' enrollment information timely and accurately as outlined in 34 CFR section 685.309. Condition/context: A sample of 40 students who were borrowers of Federal Direct student loans or recipients of Pell grants and had withdrawn or graduated from the University during the 2023-2024 fiscal year were selected. The enrollment information and withdrawal or graduation date per the University's records was compared to the information reported to the NSLDS. We noted that of the 40 students sampled, 19 students who had graduated and 3 students who had withdrawn from the University were not properly reported to NSLDS within the 60 day requirement. Our sample was not, and was not intended to be, statistically valid. Questioned costs: None Cause/effect: This occurred as a result of lack of well-documented controls over timely reporting to NSLDS. This resulted in late reporting of the information to NSLDS. The enrollment information reported to NSLDS is utilized by ED, the Direct Loan program, lenders, and other institutions to determine in-school status. Repeat finding: No Recommendation: We recommend the University further educate and train those involved in the reporting of enrollment status changes to the NSLDS. We also recommend the University review their documented policies and procedures and ensure controls exist and are well documented in order to ensure enrollment data is reported timely and accurately to NSLDS. Views of responsible officials and planned corrective actions: Saint Martin’s University management agrees with the finding. The Director of Financial Aid will continue education on enrollment reporting requirements. The Director and the Registrar will continue to work together on enrollment reporting requirements. The Director of Financial Aid will now report withdrawals due to return to title IV, as well as conferrals, to the National Student Loan Data System directly once the University receives notice of either withdrawal or completion of a degree. Weekly, withdrawals for return to title IV are monitored and reported and now student financial aid will report directly to NSLDS to avoid any lag time in relying on reporting to the Clearinghouse. At the end of each term, after the Registrar has conferred degrees, student financial aid will also acquire the list of students who have graduated and report their graduation status to NSLDS.

Special Tests and Provisions – Enrollment Reporting – Significant Deficiency in Internal Controls over Compliance - Federal Assistance Listing Number 84.063, 84.268 Recommendation: The auditors recommend the University further educate and train those involved in the reporting of enrollment status changes to the NSLDS. The auditors also recommend the University review our documented policies and procedures and ensure controls exist and are well documented in order to ensure enrollment data is reported timely and accurately to NSLDS. Action taken: The Director of Financial Aid will continue education on enrollment reporting requirements. The Director and the Registrar will continue to work together on enrollment reporting requirements. The Director of Financial Aid will now report withdrawals due to R2T4, as well as conferrals, to the National Student Loan Data System directly once the University receives notice of either withdrawal or completion of a degree. Weekly, withdrawals for R2T4 are monitored and reported and now SFA will report directly to NSLDS to avoid any lag time in relying on reporting to the Clearinghouse. At the end of each term, after the Registrar has conferred degrees, SFA will also acquire the list of students who have graduated and report their graduation status to NSLDS. Name of Responsible Party: Erin Schaffer Anticipated completion date: 9/30/2024

2023-001 – Return of Title IV Funds – Significant Deficiency in Internal Controls over Compliance Student Financial Assistance Cluster U.S Department of Education Federal Assistance Listing Number: 84.063, 84.268 Federal Program Name: Federal Pell Grant Program, Federal Direct Student Loans Federal Award Number: P063P220416, P268K230416 Award Year: 2022-23 Criteria: When a recipient of Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the recipient began attendance, the institution must determine the amount of Title IV grant or loan assistance that the student earned as of the student's withdrawal date (34 CFR 668.22). Per 34 CFR 668.22(c)(4), An institution not required to take attendance must document a student's withdrawal date determined in accordance with 34 CFR 668.22(c) paragraphs (1), (2) & (3) and maintain the documentation as of the date of the institution's determination that the student withdrew as defined in 34 CFR 668.22(l)(3). Condition/context: A sample of 7 students (6 official and 1 unofficial) out of a population of 35 students who were identified by the University as having withdrawn from the institution during the fiscal year was selected for testing. For the 6 official withdrawal selections, the University was unable to provide sufficient evidence to support the withdrawal date used in the calculation of Title IV funds to be returned. Our sample was not, and was not intended to be, statistically valid. Questioned costs: Undetermined Cause/Effect: This occurred because of a lack of implementation of procedures and controls to ensure records used in the calculation of title IV funds to be returned were properly maintained. There was turn over during the fiscal year in the student financial aid department, and the University was also utilizing third parties to assist in some student financial aid functions in the interim. Because procedures and controls were not operating as intended, the University is unable to support the dates used to determine the amount of Title IV funds earned and to be returned. Repeat finding: No Recommendation: We recommend the University further educate and train those involved in the Financial Aid department regarding the return to Title IV requirements. We also recommend that the University review procedures and controls and ensure they are properly designed and implemented to ensure calculations are occurring accurately and timely, and that the support used to complete calculations, including indication of withdrawal date, is properly documented and maintained. Views of responsible officials and planned corrective actions: As of June 2023, the Financial Aid department has a full-time Director, who is responsible for the Return to Title IV (R2T4) determinations. Following the regulations set forth by the Department of Education on R2T4 calculations for schools not required to take attendance, we have reviewed procedures and controls to ensure they are properly designed and implemented to ensure calculations are occurring accurately and timely. Going forward, we will ensure maintenance of proper documentation on students requiring a calculation, including indication of withdrawal date. Potential R2T4 calculations audits are now run multiple times a week, and will continue to be, in order to address timely calculations. The Director plans to continue education in the area of R2T4 calculations to maintain the most accurate and updated information on the topic

Action taken: As of June 2023, the Financial Aid department has a full-time Director, who is responsible for the Return to Title IV (R2T4) determinations. Following the regulations set forth by the Department of Education on R2T4 calculations for schools not required to take attendance, we have reviewed procedures and controls to ensure they are properly designed and implemented to ensure calculations are occurring accurately and timely. Going forward, we will ensure maintenance of proper documentation on students requiring a calculation, including indication of withdrawal date. Potential R2T4 calculations audits are now run multiple times a week, and will continue to be, in order to address timely calculations. The Director plans to continue education in the area of R2T4 calculations to maintain the most accurate and updated information on the topic. Name of Responsible Party: Erin Schaffer, Director of Financial Aid Anticipated completion date: 12/31/2023

2023-002 – Gramm-Leach-Bliley Act – Student Information Security – Significant Deficiency in Internal Controls over Compliance Student Financial Assistance Cluster U.S Department of Education Federal Assistance Listing Number: 84.063, 84.268, 84.007, 84.033, 84.379, 84.038 Federal Program Name: Federal Pell Grant Program, Federal Direct Student Loans, Federal Supplemental Educational Opportunity Grants, Federal Work-Study Program, Teacher Education Assistance for College and Higher Education Grants Federal Award Number: P063P220416, P268K230416, P007A224401, P033A224401, P379T230416 Award Year: 2022-23 Criteria: Per 16 CFR 314.3, institutions subject to the requirement shall develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts and contains administrative, technical, and physical safeguards that are appropriate to the size and complexity, the nature and scope of their activities, and the sensitivity of any customer information at issue. The information security program shall include the elements set forth in 16 CFR 314.4 and shall be reasonably designed to achieve the objectives of 16 CFR 314.3(b). These requirements were effective as of June 9, 2023. Condition/context: Based on our review of the information provided by the University, they are currently in the process of reviewing and finalizing their information security program. The written draft provided did not appear to have been updated in several years and did not clearly address all of the required elements in 16 CFR 314.4. Questioned costs: None. Cause/Effect: The Integrated Technology Services, the department primarily charged with oversight of Saint Martin’s information security program, has experienced turnover in recent years including the unexpected death of a staff member in spring 2023. The staff shortages have contributed to the delay in implementation of this standard. The absence of a well-designed and documented policy addressing the standards set forth under the act could put the security, confidentiality, and integrity of student information at risk. Repeat finding: No Recommendation: We recommend the University review the compliance requirements and update their written policy to ensure that it addresses all the required elements. Views of responsible officials and planned corrective actions: Saint Martin’s University will review the requirements of 16 CFR 314.4, update our written policy to ensure that it addresses all the required elements 16 CFR 314.3(b), and perform an annual review of our updated policy to ensure that it continues to comply with all relevant regulations. The University is currently in the process of formally adopting a cybersecurity framework as well as securing a vendor to perform an IT security assessment. This ongoing work in the interest of the security, confidentiality, and integrity of student information will position us well to make the recommended updates to our policy.

Action taken: Saint Martin’s University will review the requirements of 16 CFR 314.4, update our written policy to ensure that it addresses all the required elements 16 CFR 314.3(b), and perform an annual review of our updated policy to ensure that it continues to comply with all relevant regulations. The University is currently in the process of formally adopting a cybersecurity framework as well as securing a vendor to perform an IT security assessment. This ongoing work in the interest of the security, confidentiality, and integrity of student information will position us well to make the recommended updates to our policy Name of Responsible Party: Mary Donahoo, Chief Information Officer Anticipated completion date: 3/31/2024

FINDING 2021-001 Special Tests and Provisions ? Enrollment Reporting ? Significant Deficiency in Internal Control over Compliance Student Financial Assistance Cluster U.S. Department of Education Federal Assistance Listing Numbers: 84.268, 84.063 Federal Program Name: Federal Direct Student Loans and Federal Pell Grant Program Award Year: 2020-21 Criteria: Uniform Guidance requires institutions to have internal controls in place to ensure attendance changes for students are reported to the National Student Loan Data System (NSLDS) within at least 60 days of when the student attendance change occurs. It is the University's responsibility to update students' enrollment information timely and accurately as outlined in 34 CFR section 685.309. Condition and context: A sample of 40 students who were borrowers of Federal Direct student loans and recipients of Pell Grants and had withdrawn or graduated from the University during the 2020-2021 fiscal year were selected. The enrollment information and withdrawal or graduation date per the University's records was compared to the information reported to the NSLDS. In our sample, we noted that one graduated student who was a Federal borrower and Pell recipient was considered as graduated by the University, however the attendance change was not reported to NSLDS within the 60 day requirement. Random, not statistical, sampling was used. Questioned costs: None. Cause: This occurred due to the degree not being conferred until 60 days after the change of status date per the student record. Effect: This resulted in late reporting of the information to NSLDS. The enrollment information reported to NSLDS is utilized by ED, the Direct Loan program, lenders, and other institutions to determine in-school status. Repeat finding: No Recommendation: We recommend that the University modify its current policies and procedures for graduated students whose degrees are not conferred upon the student's completion of the coursework. These types of graduates should be reported as withdrawn upon the student's completion of the coursework. Once the University has determined that the student meets all graduation requirements, they should retroactively report the student as graduated. Views of responsible officials and planned corrective actions: The University concurs with this finding. The University has reviewed this process and identified key personnel responsible for ensuring timely submission and accuracy of records. To ensure timely identification and accurate reporting of student changes, the University is working to improve coordination between the parties involved in the degree reporting, which includes Financial Aid, MIS, and the registrar?s office. In addition, calendar due dates and deadlines will be added to the appropriate calendars to ensure timely reporting. Finally, additional staff will be trained on file generation and error correction for the ?Degree Verify? files to ensure corrections to NSLDS are fixed in a timely manner.

FINDINGS ? FEDERAL AWARD PROGRAMS AUDITS U.S. Department of Education 2021-001 ? Special Tests and Provisions ? Enrollment Reporting ? Significant Deficiency in Internal Control over Compliance ? CFDA No. 84.268, 84.063 Recommendation: The auditors recommend that the University modify its current policies and procedures for graduated students whose degrees are not conferred upon the student?s completion of the coursework. These types of graduates should be reported as withdrawn upon the student?s completion of the coursework. Once the University has determined that the student meets all graduation requirements, they should retroactively report the student as graduated. Action taken: The CFO, Controller, and Grant Compliance Officer of the University met with the IT and Registrar?s departments to go over the NSLDS reporting requirements as the university now has a new Registrar. All the parties were brought up to speed regarding compliance requirements and an internal procedures and check list were developed to acknowledge the necessary steps and avoid any reporting delays due to staff outage or turnover. Name of Responsible Party: Ronda Vandergriff, Registrar, Michael Fox, CIO Anticipated completion date: December 2021

2019-001 ? Special Tests and Provisions ? Enrollment Reporting ? Significant Deficiency in Internal Controls over Compliance Federal Program: Student Financial Assistance Cluster - Federal Pell Grant Program (CFDA #84.063), Federal Perkins Loan (CFDA #84.037), Federal Direct Student Loans (CFDA #84.268) Federal Agency: Department of Education Award Year: 2018-19 Criteria ? Uniform Guidance requires institutions to have internal controls in place to ensure updates for attendance changes for students are reported to the National Student Loan Data System (NSLDS) within at least 60 days of when the student attendance change is identified by the University. Condition/Context ? We selected a sample of 30 students from a population of 332 students who had received Federal Aid and had officially withdrawn, received zero credits, were a Perkins borrower who entered repayment during the year or graduated from the University during the 2018-19 fiscal year. We noted during the testing that 12 of 30 students sampled had an attendance change that was not reported to NSLDS within at least 60 days. Our sample was a statistically valid sample. Questioned Cost ? None to be reported. Cause/Effect ? This occurred because of lack of controls and oversight of the process. This significant deficiency resulted in late attendance changes being reported to NSLDS. Recommendation ? Moss Adams recommends that the University develop and implement policies and procedures to ensure that all student status changes are reported to NSLDS within at least 60 days. Views of responsible officials and planned corrective action ? To ensure student status notifications are sent within a timely manner to NSLDS, management plans to employ several measures.

CORRECTIVE ACTION PLAN The following represents Saint Martin?s University corrective action plan for the finding identified in the audit of the June 30, 2019 financial statements in accordance with 2 CFR 200.511(c): Finding Control Number: FS 2019-001 Special Tests and Provisions ? Enrollment Reporting ? Significant Deficiency in Internal Controls over Compliance Criteria ? Uniform Guidance requires institutions to have internal controls in place to ensure updates for attendance changes for students are reported to the National Student Loan Data System (NSLDS) within at least 60 days of when the attendance change occurred. Condition/Context ? We noted during our testing of the University?s major program that 12 of 30 students sampled had an attendance change that was not reported to NSLDS within at least 60 days. Cause/Effect ? This occurred because of a lack of controls and oversight of the process. This significant deficiency resulted in late attendance changes being reported to NSLDS. Recommendation ? Moss Adams recommends that the University develop and implement policies and procedures to ensure that all student status changes are reported to NSLDS within at least 60 days. Planned Corrective Action: To ensure student status notifications are sent within a timely manner to NSLDS, we will be employing several measures. Our Information Technology Office and the Office of the Register will meet and collaboratively develop procedures, and internal controls to ensure enrollment rosters are submitted to the National Student Clearinghouse within the 30-day requirement. The Information Technology office will also assign an additional staff member to monitor report timeliness and ensure that the processes are completed on time. The Office of the Registrar will also develop a process to confirm with the Information Technology office that information has been sent timely. Name of Responsible Party: Greg Davis, Associate Vice President, CIO Anticipated Completion Date: September 30, 2019