Cornish College of the ArtsNon-Profit

Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster ALN Numbers: Various Award Period: June 1, 2024 through May 31, 2025 Type of Finding: Significant Deficiency in Internal Control over Compliance (Other Matters) Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 685.309(b), states schools must have some arrangement to report student enrollment data to NSLDS through an enrollment roster file. The school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date. Also, the Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless if they receive aid from the institution or not. Changes to said status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 day. There are two categories of enrollment information; "Campus Level" and "Program Level," both of which need to be reported accurately and have separate record types. Condition: During our detail testing of NSLDS Enrollment Reporting we noted two out of 11 students tested, the enrollment effective date per institution records did not match the NSLDS enrollment effective date. Four out of 11 students tested, the campus-level enrollment effective date did not match their program-level enrollment effective date and three out of 11 students tested did not have their student change updated timely. Questioned costs: None. Context: The enrollment roster file contained dates that were incorrect for the Enrollment and Program Level effective dates. In the cases of this error the enrollment information should have been the date per institution's records for the Campus and Program Level. There were also instances where the information on the Enrollment and Program level were inconsistent with the College's records. Finally, Updates to NSLDS were not completed in a timely manner and some were not updated at all. Cause: The College did not have a review process in place to ensure that NSLDS reports are being properly reported. Effect: The NSLDS system is not updated with the student information which can cause a student to not properly enter the repayment period. Repeat Finding: Yes, prior year finding 2024-004. Auditor’s Recommendation: We recommend the College review its reporting procedures to ensure the students’ statuses are accurately and timely reported to NSLDS as required by regulations. Views of responsible officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Aid Cluster ALN Numbers: 84.007 Award Period: June 1, 2024 through May 31, 2025 Type of Finding: Significant Deficiency in Internal Control over Compliance (Other Matters) Criteria or specific requirement: Per the Code of Federal Regulations, 34 CFR 673.5, students may not be awarded need based aid in excess of their calculated need. Condition: During our testing of 40 students, it was noted that one student received $290 of college work study when they were not eligible for need-based aid. Questioned costs: None. Context: One student was incorrectly awarded $290 of college work study when they were not eligible for need-based aid. Cause: The College incorrectly awarded this student based on their financial need. Effect: Students may be awarded need based aid in excess of their calculated need. Repeat Finding: No. Auditor’s Recommendation: We recommend the College implement policies to review all student award packages at the start of the academic year to ensure no overawards exist. Views of responsible officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 668.164(h)(2) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. Condition: During our testing, we noted one check totaling $419.00 related to student refunds of Title IV federal financial aid were outstanding more than 240 days as of May 31, 2024. Questioned Costs: $419.00 Context: During our testing, it was noted the College does not have a process in place to ensure timeliness and accuracy of checks refunded to ED after 240 days outstanding. Cause: The College did not have a process in place to ensure all outstanding checks over 240 days was properly returned to the ED. Effect: The College is not in compliance with Department of Education requirements that all student refund checks that are outstanding for more than 240 days be returned to the Department. Repeat Finding: Yes Auditor’s Recommendation: We recommend that the College review its procedures related to outstanding student refund checks to ensure they are being returned to the Department of Education after 240 days. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 674.16 states that before an institution makes its first disbursement to a student, the student shall sign the promissory note and the institution shall provide the student with certain repayment information. Condition: During our testing, we noted that none of the students tested in the Perkins loan program could be supported as having completed a promissory note or entrance counseling. Questioned Costs: None Context: During our testing, it was noted the College was unable to find MPNs for any student with Perkins that have not been assigned. Cause: The College is not able to locate the MPNs for outstanding Perkins loans that have not already been assigned. Effect: The College cannot provide documentation showing proper completion of promissory note as required by DOE requirements. Repeat Finding: No Auditor’s Recommendation: We recommend that the College review their records to locate the missing promissory notes. If the signed promissory notes cannot be located, the College should assess if there is sufficient documentation to support the loan such as repayment history, documentation showing the original payment was accepted by the student, etc. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The written information security program (WISP) for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its written information security program are at 16 CFR 314.4. At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). Condition: During our testing, we noted several steps missing from the Written Information Security Program (WISP). Questioned Costs: None Context: These new GLBA requirements were applicable beginning on June 9, 2023 and there were several elements missing from their WISP. Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance. Effect: Student personal information could be vulnerable. Repeat Finding: No Auditor’s Recommendation: We recommend that the College review the updated GLBA requirements and ensure their WISP includes all required elements. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2023 – May 31, 2024 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 685.309(b), states schools must have some arrangement to report student enrollment data to NSLDS through an enrollment roster file. The school is required to report changes in the student’s enrollment status, the effective date of the status, and an anticipated completion date. Also, the Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless if they receive aid from the institution or not. Changes to said status are required to be reported within 30 days of becoming aware of the status change, or with the next scheduled transmission of statuses if the scheduled transmission is within 60 days. There are two categories of enrollment information; "Campus Level" and "Program Level," both of which need to be reported accurately and have separate record types. Condition: During our testing we noted the following errors, three out of the fourteen student’s enrollment status per institutions records did not match the NSLDS enrollment status. Furthermore, four out of the fourteen student’s enrollment effective date per institutions records did not match the NSLDS enrollment effective date. Lastly, one out of the fourteen students did not have their student change updated timely. Questioned Costs: None Context: The enrollment roster file contained dates that were incorrect for the Enrollment and Program Level effective dates. In the cases of this error the enrollment information should have been the date per institution's records for the Campus and Program Level. There were also instances where the information on the Enrollment and Program level were inconsistent with the University's records. Finally, Updates to NSLDS were not completed in a timely manner and some were not updated at all. Cause: The College did not have a review process in place to ensure that NSLDS reports are being properly reported. Effect: The NSLDS system is not updated with the student information which can cause a student to not properly enter the repayment period. Repeat Finding: No Auditor’s Recommendation: We recommend the University review its reporting procedures to ensure the students’ statuses are accurately and timely reported to NSLDS as required by regulations. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2022 – May 31, 2023 Type of Finding: • Material Weakness in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: Per the Uniform Guidance regulations, entities that expend more than $750,000 of federal funds must submit an audit within nine months of the entities year end. Condition: Due to turnover in the business office, the audit was submitted late. Questioned Costs: None Context: Approximately halfway through the fiscal year, the College hired a new controller. Unfortunately, that controller did have the skills needed to be able to accurately assemble a complete set of financial statements. Two weeks before the deadline, the controller terminated employment with the College. At that time, it was determined that additional work needed to be completed to accurately present the financial statements and additional time was needed to ensure that the financial statements were accurate. Cause: Due to the limited resources of the business office and the lack of qualified candidates in the marketplace, the College was forced to accept a lessor qualified candidate whose employment was ultimately terminated. Effect: The Uniform Guidance reports were submitted late. Repeat Finding: No Auditor’s Recommendation: We recommend that the College immediately start the search process for a replacement controller and potentially look into outsourcing that position if necessary. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster Federal Assistance Listing Number: Various Federal Award Identification Number and Year: N/A Pass-Through Agency: N/A Pass-Through Number: N/A Award Period: June 1, 2022 – May 31, 2023 Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 668.164(h)(2) states that an institution that attempts to disburse funds by check and the check is not cashed, the institution must return the funds to the Secretary no later than 240 days after the date it issued that check. Condition: Three checks totaling $11,567 related to student refunds of Title IV federal financial aid were outstanding more than 240 days as of May 31, 2023. Questioned Costs: $11,567 Context: During our testing, it was noted the College does not have a process in place to ensure timeliness and accuracy of checks refunded to ED after 240 days outstanding. Cause: The College did not have a process in place to ensure all outstanding checks over 240 days was properly returned to the ED. Effect: The College is not in compliance with Department of Education requirements that all student refund checks that are outstanding for more than 240 days be returned to the Department. Repeat Finding: No Auditor’s Recommendation: We recommend that the College review its procedures related to outstanding student refund checks to ensure they are being returned to the Department of Education after 240 days. Views of Responsible Officials and Planned Corrective Actions: There is no disagreement with the audit finding.

2022 ? 002 Federal Agency: U.S. Department of Education Federal Program Title: Student Financial Assistance Cluster Assistance Listing Number: Various Award Period: June 01, 2021 - May 31, 2022 Type of Finding: - Significant Deficiency in Internal Control over Compliance - Other Matters Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 685.309(b), states schools must have some arrangement to report student enrollment data including campus level and program level detail to NSLDS through an enrollment roster file. The school is required to report changes in the student's enrollment status, the effective date of the status, and an anticipated completion date. Also, the Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless if they receive aid from the institution or not. Changes to said status are required to be reported within 30 days of becoming aware of the status change, or within the next scheduled transmission of statuses if the scheduled transmission is within 60 days. Condition: Information being sent to NSLDS is not accurate. Questioned costs: None known. Context: During our testing of 22 students, CLA noted the following: - Four students? enrollment status per NSLDS didn?t match the College?s records. - The program begin date for one student per the Program Enrollment Detail in NSLDS didn?t match the College?s records. - Six student's Enrollment Effective Date per NSLDS did not match the College's records. Cause: Systems were not in place to be able to ensure all required enrollment reporting details were timely and accurately reported. Effect: The College is not in compliance with the Department of Education (ED) regulations relating to the reporting of student enrollment data to NSLDS. Repeat Finding: Yes. Recommendation: CLA recommends the College implement a procedure to ensure the program begin date aligns with the first date of attendance, and inquire with the Clearinghouse when Effective Dates per NSLDS do not match the College's records. Views of responsible officials: There is no disagreement with the audit finding.

2021 ? 001 Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Assistance Listing Number: 84.SFA Award Period: June 01, 2020 - May 31, 2021 Type of Finding: - Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Code of Federal Regulations, 34 CFR 685.309(b), states schools must have some arrangement to report student enrollment data including campus level and program level detail to NSLDS through an enrollment roster file. The school is required to report changes in the student's enrollment status, the effective date of the status, and an anticipated completion date. Also, the Code of Federal Regulations, 34 CFR 682.610, states that institutions must report accurately the enrollment status of all students regardless if they receive aid from the institution or not. Changes to said status are required to be reported within 30 days of becoming aware of the status change, or within the next scheduled transmission of statuses if the scheduled transmission is within 60 days. Condition: Information being sent to NSLDS is not accurate and/or is not being sent timely. Questioned costs: None known. Context: During our testing of 23 students, CLA noted the following: - One student was not certified to NSLDS at least every 60 days. - The program begin date for ten students per the Program Enrollment Detail in NSLDS reflected the date the student applied and was accepted at the institution rather than the date the student started attending courses towards the degree. - One student was not reported within the required 30 days of becoming aware of the status change, or within the next scheduled transmission of statuses if the scheduled transmission is within 60 days. - One student's Enrollment Effective Date per NSLDS did not match the Institution's records. Cause: Systems were not in place to be able to ensure all required enrollment reporting details were timely and accurately reported. Effect: The College is not in compliance with the Department of Education (ED) regulations relating to the reporting of student enrollment data to NSLDS. Repeat Finding: No. Recommendation: CLA recommends the College implement a procedure to ensure students are being certified at least every 60 days, implement a procedure to ensure the program begin date aligns with the first date of attendance, and inquire with the Clearinghouse when Effective Dates per NSLDS do not match the Institution's records. Views of responsible officials: There is no disagreement with the audit finding.

2021 ? 002 Federal agency: U.S. Department of Education Federal program title: HEERF Student and Institutional Portion Assistance Listing Number: 84.425E & F Award Period: June 01, 2020 - May 31, 2021 Type of Finding: - Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: Per Uniform Guidance 2 CFR 200.303, non-Federal entities receiving Federal awards are required to establish and maintain internal controls designed to reasonably ensure compliance with Federal laws, regulations and program compliance requirements. In addition, the initial reporting for this grant requires the report to be submitted to the Institution?s website within 30 days of the signed Certification Agreement or 30 days after the electronic announcement dated May 6, whichever is later. Reports are then required every 45 days after the initial 30 day report. On August 31, 2020, the Federal Registrar changed reporting from every 45 days to each calendar quarter. Each quarterly report is due 10 days after the end of the quarter. Condition: During our testing of the student funds and the reporting, we were unable to identify a specific control in place to ensure that any errors would be prevented or detected in a timely manner. During our testing of the reports, we noted there were no 45 day or quarterly reports for the quarters ending September 30, 2020 and December 31, 2020. We also noted the reports were not uploaded to the website within 10 days after the end of the reporting quarter. Lastly, during our testing of the 7 steps required to be included in each report, we noted step 7 was not included in all three reports, step 3 and 5 was not included in one of the three reports tested, and there was no support for step 4. Questioned costs: None known. Context: A control system to prevent and detect errors in the student disbursement list and reporting process was not created at the time the disbursements were made or the reports were filed. Cause: The College did not have someone reviewing the disbursement listings or tracking the requirements to ensure that they followed the disbursement plan or posted the reporting timely. In addition, the College did not have a review process to ensure that the reports included all required items. Effect: It is possible for errors to occur and not be caught in a timely manner. The reports were not submitted in a timely manner or did include the requirement components. Repeat Finding: No. Recommendation: CLA recommends someone other than the preparer of the reports review the reports for accuracy and all required items are included prior to submission. CLA also recommends the college establish a system to track due dates of reports to ensure timely submission. Views of responsible officials: There is no disagreement with the audit finding.

2020 ? 001 Federal agency: U.S. Department of Education Federal program title: Student Financial Aid Cluster CFDA Number: Various Award Period: June 01, 2019 to May 31, 2020 Type of Finding: -Significant Deficiency in Internal Control over Compliance Criteria or specific requirement: The Gramm-Leach-Bliley Act (Public Law 106-102) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data. (16 CFR 314) The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as ?financial institutions? and subject to the Gramm-Leach-Bliley Act (16 CFR 313.3(k)(2)(vi). Condition: Under an institution?s Program Participation Agreement with the Department of Education and the Gramm-Leach-Bliley Act, schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid programs. Questioned costs: None Context: During our audit procedures, it was noted that the College did not perform a risk assessment that addresses the three areas noted in 16 CFR 314.4 (b) which are (1) Employee training and management; (2) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (3) Detecting, preventing and responding to attacks, intrusions, or other systems failures and document safeguards for identified risks. Cause: The organization did not perform an IT risk assessment tailored specifically to the organization, identify risks or address risks identified as required by the Gramm-Leach-Bliley Act. Effect: The student personal information could be vulnerable. Repeat Finding: No Recommendation: We recommend that the College engage a third party or perform the risk assessment for the three areas required by the Gramm-Leach-Bliley Act and ensure that there are documented safeguards for identified risks. Views of responsible officials: There is no disagreement with the audit finding.

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION