Pacific Lutheran UniversityHigher Education

FINDING 2021-001 Special Tests and Provisions ? Gramm-Leach-Bliley Act Significant Deficiency in Internal Control over Compliance, Non-compliance U.S. Department of Education Federal Assistance Listing Number: Various Federal Program Name: Student Financial Assistance Cluster Award Year: 2021 Criteria: An institution must perform a risk assessment that addresses the three required areas noted in 16 CFR 314.4 (b), which are (1) employee training and management; (2) information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) detecting, preventing and responding to attacks, intrusions, or other systems failures. An institution must also document a safeguard for each risk identified. Condition and Context: During our testing of the University's compliance with the Gramm-Leach-Bliley Act (GLBA), we noted that the University's risk assessment policy did not specifically address the GLBA requirements. Additionally, management is not reviewing the policy to ensure compliance on an annual basis. Statistical sampling was not used. Questioned costs: None to be reported. Effect: This could result in noncompliance with GLBA requirements. Cause: There is no formal GLBA risk assessment policy in place. Repeat finding: No. Recommendation: We recommend that the University follow and enhance existing policies to ensure GLBA requirements and risk assessment are properly met and performed on a regular basis. Views of responsible officials and planned corrective actions: During an audit of the University?s compliance with the Uniform Guidance pertaining to Student Financial Assistance, our auditors noted that the University?s risk assessment policy did not specifically address the Gramm Leach Bliley (GLBA) requirements, and that the policy was not being reviewed annually to ensure compliance. Members of the Administration met on September 20, 2021 to create an action plan to resolve the deficiency. During this meeting, it was noted that the University recently approved the hiring of an Information Security Officer position. While this act alone does not mitigate risk or result in compliance, GLBA proponency will be within the scope of this position where in the past, it resided across several different departments. The group also noted that while more formalized policies are needed, many important risk mitigation measures were already in place, even if not codified in a formal risk assessment. Completion of the risk assessment will be an immediate priority for the new ISO position. If the University is unable to fill the position by December of 2021, it will outsource the completion of the risk assessment until the position is filled.

FINDING 2021-002 Special Tests and Provisions ? Enrollment Reporting Significant Deficiency in Internal Control over Compliance, Non-compliance U.S. Department of Education Federal Assistance Listing Number: Various Federal Program Name: Student Financial Assistance Cluster Award Year: 2021 Criteria: An institution must promptly notify the Department of Education, guaranty agencies, or lenders, as appropriate, and National Student Loan Data System (NSLDS) of changes in student status in a timely and accurate manner. Condition and Context: We selected a sample of students who had received Federal Aid and had withdrawn, graduated, or experienced a change in attendance level from the University during the 2020-21 fiscal year. We compared the enrollment information and status change date per the University?s records to the information reported to the NSLDS. We noted an exception with three students tested. These students were not reported as graduated due to completing more than one degree. Students who graduate with more than one degree are automatically rejected from the National Student Clearinghouse (NCS), which is a third-party servicer used by the University for the enrollment reporting process. During the audit, it was noted that proper controls were not in place within the Registrar?s Office, the office designated with oversight for this, to identify this type of graduate and rejection by NSC and assure that the change in status was reported timely to the NSLDS. Of the 28 student status changes tested, three were not reported timely to NSLDS. Upon further investigation, a total of 33 students who completed more than one degree were not reported timely to NSLDS.Questioned costs: None to be reported. Effect: This could result in an error or late reporting of the information reported to the NSLDS. Cause: This occurred because of lack of controls to identify this specific group of graduated students. Repeat finding: No. Recommendation: We recommend that the University follow and enhance existing policies to ensure student?s change in status is reviewed timely and submitted within the required time frame. We recommend the University identify the various potential types of status change instances, aside from traditional withdrawals and graduates, and implement a policy to address these groups. This policy should specifically address the personnel assigned to various tasks (data entry and review), related completion timelines for these tasks, and an overall review of the process. Views of responsible officials and planned corrective actions: In order to report changes in student status to relevant parties, including NSLDS, the University relies on a monthly file sharing process between the National Student Clearinghouse (NSC) and NSLDS. To report graduates to NSC, the Office of the Registrar submits a DegreeVerify file through NSC?s `G from Degree? process. This process updates the included students? statuses to graduated in the NSC database which are subsequently reported to NSLDS by NSC. Once the file is submitted, the Office of the Registrar?s Systems Manager receives an acknowledgement email from NSC with indication that the file cannot include errors or rejected records and an error report is not provided. Upon discovering that a small number of student statuses were not correctly updated, the Systems Manager contacted NSC and learned of an error report that indicated that students receiving multiple degrees are automatically rejected by NSC and must be manually updated in their database. Notably, this error report was not mentioned in recent webinars that the Systems Manager attended specifically to ensure the process was being performed correctly. It is also important to note that these students were correctly included in the file sent by the University to NSC. To ensure student statuses are correctly reported, the Systems Manager will review the error report after each graduate file submission and make any manual updates necessary to correctly report all graduated students. Additionally, once degrees are reported to NSLDS each term, the Student Financial Services? Systems Analyst will request a report from NSLDS of all students with a graduated status for the corresponding effective date. They will then compare this report to the list of students with graduated statuses in the Banner database who also received federal aid and would therefore need to be reported to NSLDS. Finally, they will work with the Registrar?s Systems Manager to resolve any discrepancies.

Criteria: Beginning on May 6, 2020, the U.S. Department of Education required institutions that received a HEERF 18004(a)(1) Student Aid Portion award to publicly post certain information on their website no later than 30 days after award, and update that information every 45 days thereafter (by posting a new report). Auditors should determine if an institution was both timely and accurate in publicly posting its Section 18004(a)(1) Student Aid Portion Reports from May 6, 2020 forward. Condition and Context: Student counts and dollar values of amounts disbursed were inaccurately posted for the May, July, and August 2020 student aid publication updates. The May 20, 2020 update was originally posted accurately, but was overwritten with inaccurate data on the June 23,2020 update. Updates subsequent to August 2020 were accurate. Statistical sampling was not used. Questioned costs: None to be reported. Effect: The May 20, 2020 posting inaccurately reported that $215,000 of aid was disbursed to students; however, actual disbursements for the period were $194,750. Cause: The information reported on the external website was not accurate as management did not have a process in place to ensure appropriate information was being reported. Repeat finding: No. Recommendation: We recommend that management ensure a process is established and accurately followed to ensure all reporting is accurate. Views of responsible officials: Initially, the awarding of CARES Act funding and the website reporting were being handled by two separate staff members. When the person awarding funding assumed control of the website, a reporting error was committed in the transition. As of the issuance date, all of the University?s CARES Act funding has been expended, and further updates to the CARES Act reporting website are unnecessary. Should a reporting website become necessary for HEERF II or HEERF III, those awarding will also make any website updates to ensure accuracy.

FINDING 2019-001 Eligibility Significant Deficiency in Internal Control over Compliance Student Financial Assistance Cluster U.S. Department of Education CFDA Number: 84.063 Federal Program Name: Federal Pell Grant Program Award Year: 2018-19 Criteria: Per 34 CFR ?690.62, the amount of a student's Pell Grant award for an academic year is based upon the payment and disbursement schedules published by the Secretary for each award year. These schedules detail out the maximum Pell award amount a student would receive for a full academic year for a given enrollment status, expected family contribution (EFC), and cost of attendance (COA). Condition and Context: Our test work over the Eligibility compliance requirement included testing a random sample of 30 students from the total population of students receiving Federal aid. One student in the sample had an EFC of $5,403 and COA of $49,283, based on full time enrollment, yet did not receive any 2018-19 Pell grant disbursements. Based on the final payment and disbursement schedules published by the Secretary for 2018-19, the student in question should have received Pell payments totaling $652. Upon further review by the University, two more students should have received Pell payments of $652 each. A total of three students were under awarded by $1,956. Statistical sampling was not used when making sample selections. Questioned costs: None to be reported. Effect: Inaccurate Pell eligibility determinations can result in students not receiving the correct amount Pell grant money based on their financial need. The three students affected were under awarded by $652 each and each will need to be disbursed this amount immediately. Cause: The 2018-19 awards for the three students affected were packaged in February 2018 based on 2017-18 Pell award amounts. The 2018-19 maximum Pell award was revised on March 23, 2018, requiring a revision to and re-release of the 2018-19 Federal Pell grant payment and disbursement schedules. The maximum Pell-eligible EFC was revised from $5,328 to $5,486, thus making the 3 students with EFCs in this range, Pell eligible for 2018-19. A control requiring the review and reassessment of 2018-19 Pell eligibility based on expected family contributions of $5,328 (the maximum Pell EFC for 2017-18 awards) through $5,486 (the maximum Pell EFC for 2018-19 awards) was not in place. Repeat finding: No. Recommendation: We recommend the University implement a process and control in which a review for Pell eligibility of EFCs close to the maximum Pell amount for the applicable award year, and perform this process at least once per term. This review should occur upon the finalization of the published payments and disbursement schedules. We recommend the University closely monitor all students' EFCs to ensure all students are evaluated for Federal award eligibility and those receiving Federal assistance are disbursed the correct amounts. Views of responsible officials and planned corrective actions: The 2018-19 Pell payment and disbursement schedule was revised in March 2018, after many of our students had already been packaged for the 2018-19 academic year. Whereas the previous schedule awarded Pell to students with an EFC of $5,328 or lower, the new schedule awarded Pell to students with an EFC of $5,486 or lower. Three students who had already been packaged by March 2018 had EFCs between $5,328 and $5,486. As a result, they each should have been awarded $652 in Pell for the 2018-19 academic year. At the time, we did not have a process to identify such students, and these three were not awarded Pell. Upon discovery of these three students during the audit, we immediately awarded and disbursed $652 in the Federal Pell Grant to each of them. Going forward, we have created a report to identify all students with a Pell eligible EFC and the amount of Pell each student has been awarded. As soon as the new Pell payment and disbursement chart is released each year, we will begin running the report monthly to identify anyone who is missing a Pell award or whose Pell award needs to be adjusted. We will run the report through the end of the award year, and we will update it annually to reflect any revisions to the Pell payment and disbursement schedule. Michael Frechette, Director of Student Financial Services, is responsible for this corrective action plan, and it will be completed by November 30, 2019.

GSA_MIGRATION

GSA_MIGRATION