San Francisco Conservatory of Music

2019-001 NSLDS Student Enrollment Status Reporting CFDA Number: Student Financial Aid Cluster, Department of Education, CFDA# Various Criteria (1) According to 34 CFR 682.610(b), (1) Upon receipt of an enrollment report from the Secretary, a school must update all information included in the report and return the report to the Secretary ? (i) In the manner and format prescribed by the Secretary; and (ii) Within the timeframe prescribed by the Secretary. (2) Unless it expects to submit its next updated enrollment report to the Secretary within the next 60 days, a school must notify the Secretary within 30 days after the date the school discovers that ? (i) A loan under title IV of the Act was made to or on behalf of a student who was enrolled or accepted for enrollment at the school, and the student has ceased to be enrolled on at least a half-time basis or failed to enroll on at least a half-time basis for the period for which the loan was intended; or (ii) A student who is enrolled at the school and who received a loan under title IV of the Act has changed his or her permanent address. Condition The SFCM did not report a change in enrollment status to the National Student Loan Clearinghouse for a student within the required 60 days. Context During our testing, we noted that 2 of 23 students tested had a change in enrollment status that was not reported to NSLDS. Cause Noncompliance was the result of the use of an inaccurate report that did not include the correct enrollment status for a student. Effect Noncompliance may cause a delay in the loan repayment process for the student borrowers that withdraw from the SFCM. Questioned Costs There were no questioned costs associated with this finding. Recommendation We recommend that the SFCM implement a procedure to ensure that all student enrollment status changes are accurately reported in a timely manner. View of Responsible Officials The Registrar?s Office creates a report regarding student status from the Student ERP system prior to reporting enrollment status to the National Student Loan Clearinghouse. Unfortunately, it was discovered that the report was pulling from the incorrect field regarding the current student enrollment status. The Registrar?s office consulted and worked with the Institution?s IT department to correct the issue. The Registrar?s Office has also initiated a procedure to confer with the Business Office and Financial Aid Office at the deadline to drop classes within a semester to ensure that all enrollment reports are the same and show that a student receiving any aid is at the necessary level of enrollment.

2019-002 Gramm-Leach-Bliley Act CFDA Number: Student Financial Aid Cluster, Department of Education, CFDA #Various Criteria Under the SFCM?s Program Participation Agreement and the Gramm-Leach-Bliley Act (GLBA), schools must protect student financial aid information, with particular attention to information provided to institutions by the Department or otherwise obtained in support of the administration of the federal student financial aid. According to 16 CFR 314.4(b), a school must identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information that could result in the unauthorized disclosure, misuse, alteration, destruction or other compromise of such information, and assess the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risks in each relevant area of your operations, including: (i) Employee training and management; (ii) Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and (iv) Detecting, preventing and responding to attacks, intrusions, or other systems failures. Condition The SFCM has not performed an in-depth risk assessment to identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer/student information and to assess the sufficiency of any safeguards in place to control these risks. Context During our review of the SFCM?s IT system, we inquired if the SFCM has performed a risk assessment that addresses the three required areas noted above. Although there appear to be certain policies and procedures in place and a limited Risk Matrix, we were unable to obtain the documentation of an in-depth risk assessment being performed as well as the existence of certain required elements of policies and procedures. Cause The SFCM has not performed an in-depth risk assessment of key IT controls relating to the security of customer/student information. Effect Customer/student information may be at risk of unauthorized disclosure, misuse, alteration, destruction or other compromise of such information. Questioned Costs There were no questioned costs related to this finding. Recommendation We recommend that the SFCM consider bringing in an outside resource to independently evaluate and develop a formal risk assessment, along with recommendations for remediation of any open items and/or deficiencies. The SFCM could perform this process on its own but having objective outside assistance with experience in this type of assessment may be preferable. View of Responsible Officials SFCM takes the safeguarding of student and other constituent data very seriously and has many security procedures external and internal in place. We recognize the need to perform a risk assessment. By May 31, we will have identified the form of the risk assessment and how and who should perform it with the goal of completing the assessment in the summer of 2020 and creating a plan for the remediation of any deficiencies identified.

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION