Los Angeles Community College Ditrict

Special Tests and Provisions – Enrollment Reporting: Inaccurate Enrollment Effective Date Reported in the Campus-Level Record Data of the National Student Loan Data System (NSLDS) (Repeat Finding) East Los Angeles College Of the 20 students selected for testwork, we noted one (1) student had an enrollment status change from three-quarter time to half-time for which the enrollment effective date was incorrectly reported in the “Campus-Level Record” data section within NSLDS. While the District correctly reported the program enrollment date as 4/16/25 in the “Program-Level Record” data section of the NSLDS, the enrollment effective date was inaccurately reported as 5/13/2025 in the “Campus-Level Record” data in the NSLDS. Los Angeles Pierce College Of the 20 students tested selected for testwork, we noted one (1) student had an enrollment status change from three-quarter time to full-time for which the Enrollment Effective Date was incorrectly reported in the “Campus-Level Record” data section within NSLDS. While the District correctly reported the program enrollment effective date as 3/28/25 in the “Program-Level Record” data section of the NSLDS, the enrollment effective date was inaccurately reported as 4/15/25 in the “Campus-Level Record” data in the NSLDS.

Special Tests and Provisions – Return of Title IV Funds: Incorrect Calculation of Return of Title IV Funds; and Distance Education (DE) Courses – Implementation of Formal Process to Determine Accuracy of Student Withdrawal Date – Partial implementation of Prior Year Corrective Action Plan (CAP) (Repeat Finding)

Special Tests and Provisions – Gramm-Leach-Bliley Act (GLBA) – Student Information Security: Implement Data at Rest Encryption for SAP and PS SIS (Repeat Finding) Drive-level encryption is implemented and observed for a sample workstation that processes customer information. However, encryption mechanisms are not currently implemented for SAP and PeopleSoft (PS) Student Information Systems (SIS) servers. Compliance requirement 16 CFR 314.4(c)(3) requires institutions to protect by encryption of all students’ data held at rest. As of review date, implementation has been deferred to the 3rd Quarter of 2026.

Allowable Costs/ Cost Principles: Incorrect Salary Allocations Charged to Programs: Student Support Services Program (Award No. P042A201884) For 2 of 5 time and effort reports selected for allowable costs testwork at Los Angeles Southwest College, we noted the hours worked related to this grant program per the employee’s time and effort report did not agree to the employee’s payroll amount charged to the grant as follows: – One (1) time and effort report reported no hours worked on the grant program; however, 56 hours were charged to the grant program per the general ledger of expenditures. • One (1) time and effort report reported 10.5 hours worked on the grant program; however, 62 hours were charged to the grant program per the general ledger of expenditures. Talent Search Program (Award No. P044A210635) For 1 of 4 time and effort reports selected for allowable costs testwork at Los Angeles Southwest College, we noted the hours worked related to this grant program per the employee’s time and effort report did not agree to the employee’s payroll amount charged to the grant as follows: • One (1) time and effort reported 10% of the employee’s total hours were charged to the grant program; however, 24.11% of total hours were charged to the grant program per the general ledger of expenditures. As a result, the time and effort reports did not accurately support the salary costs charged to the grant programs.

Eligibility: Lack of Formal Review of Student Eligibility Determination; and Missing Student Eligibility Documentation A. Lack of Formal Review of Student Eligibility Determination Los Angeles City College (Student Support Services Program – Award No. P042A200354) For 5 out of 5 students selected for eligibility testwork, the campus utilized a web-based TRIO application that did not include evidence of review and approval by a supervising program official. While the campus coordinates with the Financial Aid Department to determine low-income and/or first-generation status and verify enrollment status and GPA at the time of application, the campus could not provide documentation demonstrating that eligibility determinations were formally reviewed and approved by the program director or other authorized official prior to the provision of TRIO services. B. Missing Student Eligibility Documentation Los Angeles Southwest College (Student Support Services Program – Award No. P042A201884) For 5 of 5 students selected for eligibility testwork, the campus was unable to locate various supporting documentation requested by the auditors, including student eligibility application forms, records of program services provided, and documentation of grant amounts awarded to students.

Reporting: Late Submission and Non-Submission of Annual Performance Reports (APR); Lack of Supporting Documentation for Student Information; and Inaccurate Key Line-Item Information A. Late Submission and Non-Submission of Annual Performance Reports (APR) Los Angeles Southwest College - Student Support Services Program – Award No. P042A201884 The 2023–2024 Annual Performance Report (APR) for the Student Support Services Program was submitted and certified on December 13, 2024, which is 7 days after the required submission deadline of December 6, 2024. Los Angeles Southwest College -Student Support Services STEM Program – Award No. P042A201432 We were informed by the campus director that the APR for fiscal year 2023-24 was not submitted, as required. B. Lack of Supporting Documentation for Student Information Los Angeles Southwest College – Student Support Services Program (Award No. P042A201884) For 5 of 5 students selected for reporting testwork, we noted that the campus was unable to locate supporting documentation. Missing documentation included student application forms, records supporting the “date of first project service”, and student transcripts. C. Inaccurate Key Line Item Information Los Angeles City College - Student Support Services Program (Award No. P042A200354) For 2 of 4 students selected for reporting testwork, we noted the following inaccurate data in the APR: • The APR data field #31 “Undergraduate Degree/Certificate Completed at Grantee Institution” was reported “8 = No degree/certificate, still enrolled at grantee institution” and should have been reported “10 = Associate’s degree only—Did not transfer from a 2- to a 4-year institution”. We noted that the students’ transcripts indicated the students earned associate degrees prior to the reporting period end. Los Angeles Valley College - Student Support Services Program (Award No. P042A201769) For 1 of 4 students selected for reporting testwork, we noted the following inaccurate data in the APR: • The APR data field #22 (Participant Status), was reported as “1 – New Participant” and should have been reported as “2 – Continuing Participant.” • The APR data field #27 (College Grade Level at End of Academic Year) was reported as “3 – Second Year/Sophomore” and should have been reported as “2 – First Year/Freshman” per the student’s transcript. In addition, we noted that the total number of participants reported in the APR (217 students) did not agree to the campus’ supporting list of participants on file (218 students).

Allowable Costs/ Cost Principles: Lack of Time and Effort Reporting: For all time and effort reports selected for allowable cost testwork at Los Angeles Southwest College (total of 22 time and effort reports) related to 7 employees, we noted time and effort certifications were not prepared to support the allocation of salaries and wages charged to the program.

Reporting: Late Submission of Annual Performance Report (APR): In performing reporting testwork for Los Angeles Mission College, we noted that the following APRs for the STEMM Academy program were submitted after the required due date: • Fiscal Year 2023–24 APR was submitted on February 21, 2025, which is 112 days after the required submission due date of November 1, 2024. • Fiscal Year 2024–25 APR was submitted on November 6, 2025, which is 5 days after the required submission due date of November 1, 2025.

Finding FA 2024-001: Special Tests and Provisions: Enrollment Reporting: Inaccurate Enrollment Effective Date Reported in the Campus-Level Record Data of the National Student Loan Data System (NSLDS) Federal Program Information: Assistance Listing Number: ALN 84.063, 84.268 Federal Program Name: Student Financial Assistance Cluster; Federal Pell Grant Program, Federal Direct Student Loans Federal Agency: U.S. Department of Education Passed Through Entity: N/A Federal Award Number: P063P210036, P268K220036 Federal Award Year: July 1, 2023, to June 30, 2024 Campuses: Los Angeles Valley College Compliance Requirement: Special Tests and Provisions – Enrollment Reporting Criteria or Specific Requirement: Per the Compliance Supplement, Enrollment Reporting – Compliance Requirements: The administration of the Title IV programs depends heavily on the accuracy and timeliness of the enrollment information reported by institutions. Institutions must review, update, and certify student enrollment statuses, program information, and effective dates that appear on the Enrollment Reporting Roster file or on the Enrollment Maintenance page of the NSLDS Professional Access (NSLDSFAP) website which the financial aid administrator can access for the auditor. The data on the institution’s Enrollment Reporting Roster, or Enrollment Maintenance page, is what NSLDS has as the most recently certified enrollment. There are two categories of enrollment information, “Campus Level” and “Program Level,” both of which need to be reported accurately and have separate record types. Institutions are responsible for accurately reporting all Campus-Level Record data elements. ED considers the following data elements to be high risk: OPEID Number, Enrollment Effective Date, Enrollment Status and Certification Date. Institutions are responsible for accurately reporting all Program-Level Record data elements. ED considers the following data elements to be high risk: OPEID Number, CIP Code, Credential Level, Published Program Length Measurement, Published Program Length, Program Begin Date, Program Enrollment Status, and Program Enrollment Effective Date. Identified Condition: Of the 20 students selected for testwork at Los Angeles Valley College, we noted 1 student that had an enrollment status change from half-time to three-quarter time that was inaccurately recorded in the “Campus -Level Record” data section in the NSLDS. While the District correctly reported the program enrollment effective date as 7/14/2024 in the “Program-Level Record” data section of the NSLDS, the enrollment effective date was inaccurately reported as 7/23/2024 in the “Campus-Level Record” data section in the NSLDS. Cause and Effect: The PeopleSoft enrollment reporting system, as delivered, did not provide a student status effective date (SSD) in cases of a change in student level load and National Student Clearinghouse (NSC) documentation states that provision of the SSD is not required. However, this condition contributed to a high volume of reporting errors, requiring manual error correction by the District’s college staff. To address this issue, the District developed a programming modification to automatically provide a date in the system for instances of a change in the student academic load. The date provided in the system, based on the NSC submission calendar, was the day prior to the file generation date (the day before the “As of Date” on the NSC submission calendar). This modification can, in some circumstances, lead to misalignment of student status effective date reported to the NSC and the effective date of the academic load change in the PeopleSoft student information system. Questioned Costs: Not applicable.

Finding FA 2024-002: Special Tests and Provisions: Return of Title IV Funds: Incorrect Calculation of Return of Title IV Funds; and Distance Education (DE) Courses – Implementation of Formal Process to Determine Accuracy of Student Withdrawal Date – Partial Implementation of Prior Year Corrective Action Plan (CAP) (Repeat Finding) Federal Program Information: Assistance Listing Number: ALN 84.063 and 84.268 Federal Program Name: Student Financial Assistance Cluster; Federal Pell Grant Program Federal Direct Student Loans Federal Agency: U.S. Department of Education Passed Through Entity: N/A Federal Award Number: P063P210033; P063P215263; P063P210034; P063P210658; P063P210035; P063P215261; P063P215260; P063P210036; P063P215262; P268K220033; P268K225263; P268K220034; P268K220658; P268K220035; P268K225261; P268K225260; P268K220036; P268K225262 Federal Award Year: July 1, 2023, to June 30, 2024 Campuses: Los Angeles City College (Repeat Finding) East Los Angeles College (Repeat Finding) Los Angeles Harbor College (Repeat Finding) Los Angeles Mission College (Repeat Finding) Los Angeles Pierce College (Repeat Finding) Los Angeles Southwest College (Repeat Finding) Los Angeles Trade Technical College (Repeat Finding) Los Angeles Valley College (Repeat Finding) West Los Angeles College (Repeat Finding) Compliance Requirement: Special Tests and Provisions – Return of Title IV Funds Criteria or Specific Requirement: Per 34 Code of Federal Regulations: 34 CFR 668.22(a) When a recipient of Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the recipient began attendance, the institution must determine the amount of Title IV aid earned by the student as of the student’s withdrawal date. If the total amount of Title IV assistance earned by the student is less than the amount that was disbursed to the student or on his or her behalf as of the date of the institution’s determination that the student withdrew, the difference must be returned to the Title IV programs as outlined in this section and no additional disbursements may be made to the student for the payment period or period of enrollment. If the amount the student earned is greater than the amount disbursed, the difference between the amounts must be treated as a post-withdrawal disbursement. 34 CFR 668.22(b) Withdrawal date for a student who withdraws from an institution that is required to take attendance: “(1).the student’s withdrawal date is the last date of academic attendance as determined by theinstitution from its attendance records. (2) An institution must document a student’s withdrawal date and maintain the documentation as of the date of the institution’s determination that the student withdrew.” 34 CFR668.22 (c) Withdrawal date for a student who withdraws from an institution that is not required to take attendance.) “(1)..a student who ceases attendance at an institution that is not required to take attendance, the student’s withdrawal date is – (i) The date, as determined by the institution, that the student began the withdrawal process prescribed by the institution; (ii) The date, as determined by the institution, that the student otherwise provided official notification to the institution, in writing or orally, of his or her intent to withdraw; (iii) If the student ceases attendance without providing official notification to the institution of his or her withdrawal in accordance with paragraph (c)(1)(i) or (c)(1)(ii) of this section, the mid-point of the payment period (or period of enrollment, if applicable); (iv) If the institution determines that a student did not begin the institution’s withdrawal process or otherwise provide official notification (including notice from an individual acting on the student’s behalf) to the institution of his or her intent to withdraw because of illness, accident, grievous personal loss, or other such circumstances beyond the student’s control, the date that the institution determines is related to that circumstance; (v) If a student does not return from an approved leave of absence as defined in paragraph (d) of this section, the date that the institution determines the student began the leave of absence; or (vi) If a student takes a leave of absence that does not meet the requirements of paragraph (d) of this section, the date that the student began the leave of absence. (2) An institution that is not required to take attendance may use as the student’s withdrawal date a student’s last date of attendance at an academically related activity provided that the institution documents that the activity is academically related and documents the student’s attendance at the activity. (3) An institution must document a student’s withdrawal date and maintain the documentation as of the date of the institution’s determination that the student withdrew. Per OMB Compliance Supplement: Title IV funds may be expended only towards the education of the students who can be proven to have been in attendance at the institution. In a distance education context, documenting that a student has logged into an online distance education platform system is not sufficient, by itself, to demonstrate attendance by the student. To avoid returning all funds for a student that did not begin attendance, an institution must be able to document “attendance at any class.” To qualify as a last date of attendance for Return of Title IV purposes, an institution must demonstrate that a student participated in class or was otherwise engaged in an academically related activity, such as by contributing to an online discussion or initiating contact with a faculty member to ask a course-related question. Per the Department of Education’s Program Integrity Q&As for Return of Title IV Funds: An Institution that is required to take attendance: An institution that collects and maintains information about students’ online activities for the purpose of tracking academic engagement is considered to be an institution that is required to take attendance for programs involving such tracking if that tracking: 1. Involves monitoring student attendance in a synchronous class, lecture, recitation, or field or laboratory activity, physically or online via a distance education platform, where there is an opportunity for interaction between the instructor and students; or 2. Is used to administratively withdraw students or to enforce an institutional attendance policy. Identified Condition: A. Incorrect Calculation of Return of Title IV Funds Los Angeles Harbor College B. Distance Education (DE) Courses – Implementation of Formal Process to Determine Accuracy of Student Withdrawal Date – Partial Implementation of Prior Year Corrective Action Plan (CAP) Los Angeles City College East Los Angeles College Los Angeles Harbor College Los Angeles Mission College Los Angeles Pierce College Los Angeles Southwest College Los Angeles Trade Technical College Los Angeles Valley College West Los Angeles College Description A. Incorrect Calculation of Return of Title IV Funds Los Angeles Harbor College We noted 2 of 20 students selected for return to Title IV funds testwork from the population of students who had withdrawn, dropped out, or never began attendance for Fall 2023 that had an incorrect calculation of return of Title IV amounts. The students had a reduction in eligible Title IV grant aid for $1,335 and $2,304, respectively, but the District did not recalculate the student and campus return of Title IV amounts based on the updated eligible Title IV grant aid amount. For these 2 students, such error resulted in: • 1 student with an understatement of institutional return of $119 and an understatement of student return of $104. The effect of the understatement did not result in questioned costs due to grant protection. • 1 student with an understatement of student return of $230 after the grant protection is applied. B. Distance Education (DE) Courses – Implementation of Formal Process to Determine Accuracy of Student Withdrawal Date – Partial Implementation of Prior Year Corrective Action Plan (CAP) In assessing the District's CAP for prior year finding FA 2023-002, we noted that during Fall 2023, the District implemented a formal process to monitor a student's active participation in an online class and engagement in academic activities related to a distance education (DE) course in order to determine the reasonableness and accuracy of a student's withdrawal date in the Student Information System (SIS). There are two types of withdrawals for DE courses: student-initiated withdrawals and instructor-initiated withdrawals. For student-initiated withdrawals, the withdrawal date used in the calculation of return of Title IV funds is the date the student initiates the withdrawal from the course in the system. For instructorinitiated withdrawals, the District implemented formal procedures beginning in Fall 2023 whereby the instructor is responsible for reviewing student rosters for DE courses at scheduled intervals (census roster date, exclusion roster date, and active enrollment roster date) throughout the term. At these scheduled interval dates, the instructor must initiate a withdrawal for a student who is deemed to no longer be academically engaged, as determined by the instructor. Additionally, the District's Internal Audit Department began conducting reviews of the instructor's data entry related to student withdrawal dates for DE courses into the SIS beginning in November 2023. During the current year, the Internal Audit Department conducted 10 independent reviews related to instructor-initiated withdrawals in order to assess the accuracy of the student withdrawal dates within the SIS after implementation of the new process. The results of such reviews identified numerous and various exceptions such as unmatched withdrawal dates between the Canvas Learning Management System (Canvas) and SIS, missing participation dates in Canvas for students re-added to course history, and instances where the last date of student participation could not be determined within the Canvas. Cause and Effect: A. Incorrect Calculation of Return of Title IV Funds Los Angeles Harbor College The Financial Aid Senior Accounting Technician who processed the Fall 2023 return to Title IV (R2T4) calculations had an oversight on clicking the save button to update the SIS R2T4 worksheet for these 2 students. The calculations and review of the R2T4 batch were accurate, but the worksheets E, F, and G award updates were not saved in the SIS, which caused the calculations to be slightly off. B. Distance Education (DE) Courses – Implementation of Formal Process to Determine Accuracy of Student Withdrawal Date – Partial Implementation of Prior Year Corrective Action Plan (CAP) Despite the best efforts of the District office to implement the active enrollment roster as well as messaging to faculty with the requirement to complete the active enrollment roster and post the students last date of attendance, internal review demonstrated that additional actions must be taken to improve compliance. The SIS is used to maintain student records and for administering aid. Incorrect information in the SIS can lead to an incorrect return of Title IV funds calculation. Without a process to determine accuracy of student withdrawal dates, there is a risk of incorrect return of Title IV calculations. Questioned Costs: A. Incorrect Calculation of Return of Title IV Funds - see schedule of findings and questioned costs. B. Distance Education (DE) Courses – Implementation of Formal Process to Determine Accuracy of Student Withdrawal Date – Partial Implementation of Prior Year Corrective Action Plan (CAP) - Not applicable.

Finding FA 2024-003: Special Tests and Provisions – Gramm-Leach-Bliley Act (GLBA) - Student Information Security: Perform Timely Access Revocation and Strengthen User Access Reviews; Maintain and Review Logs of Users’ Activity for both SAP and PeopleSoft Student Information System (PS SIS); and Implement Data-at-Rest Encryption for SAP and PS SIS Federal Program Information: Assistance Listing Number: ALN 84.007, 84.003, 84.063, 84.268, 93.364 Federal Program Name: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Passed Through Entity: N/A Federal Award Number: Various Federal Award Year: July 1, 2023, to June 30, 2024 Compliance Requirement: Special Tests and Provisions – Gramm Leach Bliley Act – Student Information Security Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act because they appear to be significantly engaged in wiring funds to consumers (16 CFR 313.3(k)(2)(vi)). Institutions agree to comply with GLBA in their Program Participation Agreement with ED. Institutions must protect student financial aid information, with particular attention to information provided to institutions by ED or otherwise obtained in support of the administration of the Federal student financial aid programs (16 CFR 314.3; HEA 483(a)(3)(E) and HEA 485B(d)(2)). On December 9, 2021, the FTC issued final regulations for 16 CFR Part 314 to implement the GLBA information safeguarding standards that institutions must implement. These regulations significantly modified the requirements that institutions must meet under GLBA. The regulations established minimum standards that institutions must meet. The FTC stated that it “believes many of the requirements set forth in the Final Rule are so fundamental to any information security program that the information security programs of many financial institutions will already include them if those programs are in compliance with the current Safeguards Rule.” Institutions are required to be in compliance with the revised requirements no later than June 9, 2023. Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The written information security program for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). In the preamble to the Final Rule, the FTC stated, “Proposed § 314.4 [Elements] altered the current Rule’s required elements of an information security program and added several new elements.” The FTC also stated, “the elements for the information security programs set forth in this section [16 CFR 314.4} are high-level principles that set forth basic issues the programs must address, and do not prescribe how they will be addressed.” The elements that an institution must address in its written information security program are at 16 CFR 314.4. At a minimum, an institution’s written information security program – • Designates a qualified individual responsible for overseeing and implementing the institution’s information security program and enforcing the information security program in compliance (16 CFR 314.4(a)). • Provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution) that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks (16 CFR 314.4(b)). • Provides for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The eight minimum safeguards that the written information security program must address are summarized as follows: – Implement and periodically review access controls. – Conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted. – Encrypt customer information on the institution’s system and when it’s in transit. – Assess apps developed by the institution – Implement multi-factor authentication for anyone accessing customer information on the institution’s system – Dispose of customer information securely – Anticipate and evaluate changes to the information system or network. – Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. • Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). • Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). • Addresses how the institution will oversee its information system service providers (16 CFR 314.4(f)). • Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). The first element that an institution’s written information security program must address is the designation of an individual with responsibility for implementing and enforcing an institution’s written information security program. The regulations refer to this individual as the Qualified Individual. If an institution has not designated a Qualified Individual, it is not in compliance with the GLBA requirements. The Qualified Individual has ultimate responsibility and accountability for implementing and enforcing the institution’s information security program (16 CFR 314.4(a)). The regulations do provide for an institution to use a service provider as the Qualified Individual. In cases where an institution uses a service provider as the Qualified Individual, the institution must: • Retain responsibility for compliance with GLBA; • Designate a senior member of its personnel responsible for direction and oversight of the Qualified Individual; and • Require the service provider or affiliate to maintain an information security program that protects the institution in accordance with the requirements of the regulations at 16 CFR Part 314(a)(1) through (3). Because the written information security program may be in one or more readily accessible parts and the Qualified Individual is responsible for implementing and monitoring the information security program, it is ED’s expectation that the Qualified Individual would be able to provide the written information security program that addresses the elements required for the written information security program to the auditors. Identified Condition: A. Perform Timely Access Revocation and Strengthen User Access Reviews (Repeat finding) Based on test of controls to verify that access of terminated employees is timely removed in PS SIS, SAP and Active Directory (AD), we noted that out of the terminated employees subject for testing: 1. 17 users were still active in PS SIS, 10 of whom have logged in after their termination. 2. 27 users were still active in SAP, nine (9) of whom have logged in after their termination. 3. 45 users were active in AD, 20 of whom have logged in after their termination. Moreover, while a privileged user access review is performed for PS SIS, SAP and AD, there is no review performed to check the validity of regular users for these systems. Employee functions and/or responsibilities may change over time; thus, previously provisioned access may no longer be valid. B. Maintain and Review Logs of Users’ Activity for both SAP and PS SIS (Repeat finding) A compliance requirement that requires institutions to monitor and log the activity of authorized users and detect unauthorized access or use of, or tampering with, customer information by such users [16 CFR 314.4(c)(8)], is not currently implemented by the District. C. Implement Data-at-Rest Encryption for SAP and PS SIS Servers (Repeat finding) Drive-level encryption is implemented and observed for a sample workstation that processes customer information. However, encryption mechanisms are not currently implemented for SAP and PS SIS servers. Compliance requirement 16 CFR 314.4(c)(3) requires institutions to protect by encryption all students’ data held at rest. Cause and Effect: A. Perform Timely Access Revocation and Strengthen User Access Reviews Failure to deactivate or remove accounts of terminated employees timely may result in unauthorized access to the District’s resources and sensitive information. Furthermore, the lack of user access reviews for regular users increases the risk of inappropriate users or access remaining undetected over time which may be used to process unauthorized transactions or view confidential information. B. Maintain and Review Logs of Users’ Activity for both SAP and PS SIS Without adequate logging and monitoring of users’ activity, security incidents, including suspicious and unauthorized activities may not be detected and responded to in a timely manner. C. Implement Data-at-Rest encryption for SAP and PS SIS Servers Data that is held to servers without encryption is vulnerable to unauthorized access specially if physical and logical controls are compromised. In the event of a breach, sensitive data, such as students’ information may be exposed.

Finding FA 2024-004: Special Tests and Provisions – Verification: Late Reporting of Verification Results Federal Program Information: Assistance Listing Number: ALN 84.007, 84.033, 84.063, 84.268 Federal Program Name: Student Financial Assistance Cluster; Federal Supplement Educational Opportunity Grants (FSEOG), Federal Work Study Program, Federal Pell Grant Program, Federal Direct Student Loans Federal Agency: U.S. Department of Education Passed Through Entity: N/A Federal Award Number: P007A210457, P033A210457, P063P210036, P268K220036 Federal Award Year: July 1, 2023, to June 30, 2024 Campuses: Los Angeles Harbor College Los Angeles Trade Technical College Los Angeles Valley College Compliance Requirement: Special Tests and Provisions – Verification Criteria or Specific Requirement: Per Application and Verification Guide of 2023-2024 Federal Student Aid Handbook, Chapter 4, Title Verification, Updates, and Corrections, the institution must report the verification results of identity for any student for whom the institution (1) receives an ISIR with tracking flag V4 or V5-as selected by the Central Processing System (CPS), and (2) request verification documentation. The institution reports this information on the FAA Access to CPS Online website. For the 2023–2024 award year, the institution will then enter one of the following numeric codes that most applies: Code 1 – Verification completed in person, no issues found Code 2 – Verification completed remotely, no issues found Code 3 – Verification attempted; issues found with identity. Code 5 – No response from applicant or unable to locate The institution is required to report results no more than 60 days following the first request to the student for documentation of identity. Inaccurate and untimely reporting may subject the institution to findings because of the annual compliance audit or a program review. If there is a change in a result the institution has already submitted, the institution can submit the new code using the above process and must make that change within 30 days of becoming aware that a change occurred. The most recent submission will supplant prior award year submissions. Because the Financial Aid Administrator (FAA) Access website does not store a list of these verification results for the institution to retrieve, ED recommends the institution to print and keep the confirmation page for its records. Identified Condition: Los Angeles Harbor College, Los Angeles Trade Technical College, and Los Angeles Valley College Of the 60 students selected for verification test work, we noted 10 students with verification codes (tracking flags) V4 and V5 whose files were reviewed and verification results submitted to CPS beyond the required 60-day timeframe following the campuses’ initial request to the student for identity documentation. See schedule of identified condition. Cause and Effect: Los Angeles Harbor College, Los Angeles Trade Technical College, and Los Angeles Valley College Due to many unexpected FAFSA Simplification rollout issues for FY 2024-25, the Financial Aid Technicians could not start reviewing 2023-24 files until late into the summer term, and V4/V5 verification data was not reported until after file review had begun. Questioned Costs: Not applicable.

Finding FA 2024-005: Level of Effort: Performance Outcomes Not Met Federal Program Information: Assistance Listing Number: ALN 17.268 Federal Program Name: H-1B Job Training Grant Federal Agency: U.S. Department of Labor (DOL) Passed Through Entity: N/A Federal Award Number: HG-33046-19-60-A-6 Federal Award Year: July 1, 2023, to June 30, 2024 Campuses: West Los Angeles College Compliance Requirement: Level of Effort Criteria or Specific Requirement: Per the DOL’s Employment and Training Awards (ETA) Handbook, page 24: ETA places a very high priority on maximizing successful grant performance and relies heavily on frequent performance reporting to measure and track your success toward achieving satisfactory outcomes. ETA grantees are required to submit quarterly progress reports which track performance throughout the entire lifetime of the grant. These include a performance report comprised of data related to a number of performance targets and measurements specifically designed to align with the grant’s Statement of Work (SOW) and individual performance objectives: 1) Total grant participants served; 2) Total participants beginning and completing education/training activities; 3) Total number of credentials attained by participants; and 4) Total number of participants who secured and/or retained employment. Per the SOW and Modified Contract, see schedule for the performance outcomes / key outcomes that were identified and planned for the program. Per FOA-ETA-18-08 Apprentice Training and Employment Performance Outcomes: Applicants must include comprehensive numerical outcome projections for each of the seven outcome measures. The targets must be provided for each year of the grant, as well as for the total grant period. While applicants are required to propose goals for the seven outcome categories identified in Section IV.B.3.a.(2) Expected Outcomes and Outputs, which are specific to this Funding Opportunity Award (FOA), they will also be required to report outcomes in alignment with outcomes identified in Workforce Innovation and Opportunity Act (WIOA), as applicable. Per Section IV.B.3.a.(2) of the Funding Opportunity Award for the H-1B Job Training Grant (FOA-ETA-18-08), grantees must meet measurable performance targets in key areas, including apprenticeship enrollment, program completion rates, job placement, wage increases, and retention within high-demand fields. These performance goals must correspond to the scope of each project’s funding level to ensure program impact and sustainability. Identified Condition: The District was able to achieve success in meeting and exceeding four out of six key performance outcomes, demonstrating effective management in several critical areas, including Participants Enrolled, Begin Education/Training, Entered Employment, and Expenditures. However, two key performance outcomes-Completed Education/Training and Attained Credential-were not met, reflecting areas of underperformance as of the modified grant contract projections for the grant period ended June 30, 2024. See schedule for key outcome identified. Cause and Effect: The District implemented effective management strategies that resulted in success in four out of six key performance outcomes, including Participants Enrolled, Begin Education/Training, Entered Employment, and Expenditures. These outcomes benefited from efficient program delivery, resource allocation, and targeted interventions. However, the goals related to training completion and credential attainment were influenced by several factors outside the District’s control, such as the COVID 19 pandemic and participants’ personal circumstances, which may lead them to alter their commitment to the program. Despite not fully meeting the targets for training completion and credentialing, the program’s overall success remained unaffected, as it exceeded its original Funding Opportunity Announcement required performance outcome by placing over 5,000 participants into the job market. Questioned Costs: None.

Finding FA 2023-001: Eligibility: Incorrect Federal Pell Grant Amounts Awarded (Repeat Finding) Federal Program Information Assistance Listing Number: ALN 84.063 Federal Program Name: Student Financial Assistance Cluster. Federal Pell Grant Program Federal Agency: U.S. Department of Education Passed Through Entity: N/A Federal Award Number: P063P200033 (Steve to Confirm) Federal Award Year: July 1, 2022, to June 30, 2023 Campus: West Los Angeles College Compliance Requirement: Eligibility Criteria or Specific Requirement: Per 34 Code of Federal Regulations (CFR) 690.62 Calculation of a Federal Pell Grant, the amount of a student’s Pell Grant for an academic year is based upon the payment and disbursement schedules published by the Secretary for each award year. The Uniform Guidance Compliance Supplement states that the Department of Education provides institutions with Payment and Disbursement Schedules for determining Pell awards each year. The Payment or Disbursement Schedule provides the maximum annual amount a student would receive for a full academic year for a given enrollment status, Expected Family Contribution (EFC), and Cost of Attendance (COA). The Payment Schedule is used to determine the annual award for full-time, three-quarter-time, half-time, and less-than-half-time students. 2 CFR section 200.303 requires that non-Federal entities receiving Federal awards establish and maintain internal control over the Federal awards that provide reasonable assurance that the non-Federal entity is managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal awards. Identified Condition: Of the twenty (20) students selected for eligibility test work at West Los Angeles College, we noted the following: • 1 student had an incorrectly calculated Federal Pell Grant award, which resulted in an understatement of the disbursement to the student by $773. The student was eligible to receive $1,273 yet received $500 in Winter 2023. Cause and Effect: The institution has reviewed the student’s award and determined that the student was inadvertently disbursed $500 instead of $1,273 which is considered to be an underpayment. Once identified by the auditors, the award has since been corrected and refunded to the student. The Central Financial Aid Systems Unit and the District’s Student Information System (SIS) Information Technology department have reviewed both system controls and manual intervention, but the cause remains undetermined. Questioned Costs: See schedule of findings and questioned costs The District has a known net understatement of Pell Grant award disbursements of ($773). The projected total net understatement of the Pell Grant award disbursements is $186,345 as follows: See schedule of findings and questioned costs This is computed by dividing the error found in the samples per term (Fall/Winter term – net underpayment ($773) and Spring/Summer terms – $0) over the total Pell awards disbursed in the sample size per term (Winter term – $64,577, and Spring/Summer terms – $81,046) multiplied by the total Pell awards disbursed for the identified colleges per term (Fall/Winter term – $15,567,394 and Spring/Summer terms – $14,958,472). The computation is made on a per-term basis on a campus level and not on a district-wide level. Recommendation: We recommend that the District make the necessary system modifications to the PeopleSoft SIS to ensure student awards are properly calculated. This will help ensure that Federal Pell grants are properly awarded to students who meet the eligibility requirements. Views of Responsible Officials and Planned Corrective Actions: The District believes this error was an isolated incident and the effect is minimal as we performed an extensive review of all nine campuses’ Pell grant award disbursements for the term and found that this was the only similar award. The District will monitor disbursements and will perform reconciliation on a monthly basis. Personnel Responsible for Implementation: FA Office and the Central Financial Aid Unit. Position of Responsible Personnel: FA Managers Expected Date of Implementation: Already Implemented

Finding FA 2023-002: Special Tests and Provision: Return of Title IV Funds: Incorrect Calculation of Return of Title IV Funds, Untimely Notification of Grant Overpayment to Students and Secretary, Distance Education Courses – Lack of Formal Process to Determine Accuracy of Student Withdrawal Date (Repeat Finding) Federal Program Information Federal Catalog Number: ALN 84.007, 84.033, 84.038, 84.048, 84.063 and 84.268 Federal Program Name: Student Financial Assistance Cluster; Federal Pell Grant Program Federal Direct Student Loans Federal Agency: U.S. Department of Education Passed Through Entity: N/A Federal Award Number: P007A210456, P063P215260, P268K225260 P007A210676, P063P215262, P268K225262, 21-C01-740 Federal Award Year: July 1, 2022, to June 30, 2023 Campuses: Los Angeles City College (Repeat Finding) East Los Angeles College (Repeat Finding) Los Angeles Harbor College (Repeat Finding) Los Angeles Mission College (Repeat Finding) Los Angeles Pierce College (Repeat Finding) Los Angeles Southwest College (Repeat Finding) Los Angeles Trade Technical College (Repeat Finding) Los Angeles Valley College (Repeat Finding) West Los Angeles College (Repeat Finding) Compliance Requirement: Special Tests and Provisions – Return of Title IV Funds Criteria or Specific Requirement: Per 34 Code of Federal Regulations 668.22 (a)(1) through (a)(5): When a recipient of Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the recipient began attendance, the institution must determine the amount of Title IV aid earned by the student as of the student’s withdrawal date. If the total amount of Title IV assistance earned by the student is less than the amount that was disbursed to the student or on his or her behalf as of the date of the institution’s determination that the student withdrew, the difference must be returned to the Title IV programs as outlined in this section and no additional disbursements may be made to the student for the payment period or period of enrollment. If the amount the student earned is greater than the amount disbursed, the difference between the amounts must be treated as a post-withdrawal disbursement. Per the Uniform Guidance Compliance Supplement: Withdrawal Date: If an institution is required to take attendance, the withdrawal date is the last date of academic attendance, as determined by the institution from its attendance records. An institution is required to take attendance if: a. The institution is required to take attendance for some or all of its students by an entity outside of the institution (such as the institution’s accrediting agency or state agency); b. The institution itself has a requirement that its instructors take attendance; or c. The institution or an outside entity has a requirement that can only be met by taking attendance or a comparable process, including, but not limited to, requiring that students in a program demonstrate attendance in the classes of that program or a portion of that program (34 CFR 668.22(b)(3)). Note: As provided in the Department’s Program Integrity Q&As for Return of Title IV Funds, the monitoring of whether online students log into classes does not by itself result in an institution being an institution that is required to take attendance for Title IV, HEA program purposes because monitoring logins alone is not monitoring academic engagement (as defined under 34 CFR 600.2). However, an institution that collects and maintains information about students’ online activities for the purpose of tracking academic engagement is considered to be an institution that is required to take attendance for programs involving such tracking if that tracking: 1. Involves monitoring student attendance in a synchronous class, lecture, recitation, or field or laboratory activity, physically or online via a distance education platform, where there is an opportunity for interaction between the instructor and students; or 2. Is used to administratively withdraw students or to enforce an institutional attendance policy. If an institution is not required to take attendance, the withdrawal date is (1) the date, as determined by the institution, that the student began the withdrawal process prescribed by the institution; (2) the date, as determined by the institution, that the student otherwise provided official notification to the institution, in writing or orally, of his or her intent to withdraw; (3) if the student ceases attendance without providing official notification to the institution of his or her withdrawal, the midpoint of the payment period or, if applicable, the period of enrollment; (4) if the institution determines that a student did not begin the withdrawal process or otherwise notify the institution of the intent to withdraw due to illness, accident, grievous personal loss or other circumstances beyond the student’s control, the date the institution determines is related to that circumstance; (5) if a student does not return from an approved leave of absence, the date that the institution determines the student began the leave of absence; or (6) if the student takes an unapproved leave of absence, the date that the student began the leave of absence. Notwithstanding the above, an institution that is not required to take attendance may use as the withdrawal date, the last date of attendance at an academically related activity as documented by the institution (34 CFR668.22(c) and (l)). Title IV funds may be expended only towards the education of the students who can be proven to have been in attendance at the institution. In a distance education context, documenting that a student has logged into an online distance education platform or system is not sufficient, by itself, to demonstrate attendance by the student. To avoid returning all funds for a student that did not begin attendance, an institution must be able to document “attendance at any class.” To qualify as a last date of attendance for Return of Title IV purposes, an institution must demonstrate that a student participated in class or was otherwise engaged in an academically related activity, such as by contributing to an online discussion or initiating contact with a faculty member to ask a course-related question. Timing of Return of Title IV Funds Returns of Title IV funds are required to be deposited or transferred into the SFA account or electronic fund transfers initiated to ED as soon as possible, but no later than 45 days after the date the institution determines that the student withdrew. Returns by check are late if the check is issued more than 45 days after the institution determined the student withdrew or the date on the canceled check shows the check was endorsed more than 60 days after the date the institution determined that the student withdrew (34 CFR 668.173(b)). An institution that is not required to take attendance must determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew (34 CFR 668.22(j)). The institution must also notify the recipient of Title IV loans returned (34 CFR 685.306(a)(2)). Identified Condition: See schedule of findings and questioned costs Description A. Incorrect Calculation of Return to Title IV Funds East Los Angeles College We noted 1 of 15 students selected for return of Title IV funds test work from the population of students who had withdrawn, dropped out, or never began attendance that had an incorrect calculation of percentage of completion for Spring 2023 based on the student’s actual number of days completed during the enrollment period. The student was enrolled in a session module course, which is a program that does not span the entire length of the payment period or period of enrollment. For this type of course, the student’s “actively enrolled days” should have been used in the return of Title IV funds calculation. This error resulted in an overstatement of the institutional return by $13 and an overstatement of the student’s return by $21. The effect of the overstatement of the student’s return did not result in a questioned cost due to grant protection. Los Angeles Southwest College We noted 6 of 20 students selected for return of Title IV funds test work from the population of students who had withdrawn, dropped out or never began attendance for Fall 2022 that had had an incorrect calculation of the percentage of completion based on the student’s number of days completed during the enrollment period. For 3 students, these errors resulted in: • 1 student with an understatement of institutional return of $37 and an understatement of student return of $287. • 1 student with an understatement of institutional return of $11 and an understatement of student return of $197. • 1 student with an overstatement of institutional return of $10 and overstatement of student return of $20. The effect of the above overstatement of the student return did not result in questioned costs due to grant protection. For the remaining 3 students, we noted these students were enrolled in a session module course, which is a program that does not span the entire length of the payment period or period of enrollment. For this type of course, the student’s “actively enrolled days” should have been used in the return of Title IV funds calculation These errors resulted in: • 1 student with an overstatement of institutional return of $30. • 1 student with an overstatement of institutional return of $187. • 1 student with an overstatement of institutional return of $21 and an overstatement of student return of $9. The effect of the overstatement of the student return did not result in questioned costs due to grant protection. B. Untimely Notification of Grant Overpayment to the Secretary We noted that 1 out of 15 students selected for compliance test work at East Los Angeles College that owed an overpayment of $187 as a result of the student’s withdrawal was referred to the Secretary of the Department of Education beyond the 30-day timeframe from the date of the institution’s determination that the student withdrew and owed overpayments as a result of the student’s withdrawal. The required notification was submitted to the National Student Loan Data System (NSLDS) 260 days late. C. Distance Education Courses – Lack of Formal Process to Determine Accuracy of Student Withdrawal Date The District has not yet implemented a formal process in place to monitor a student’s active participation in an online class and engagement in academic activities related to a distance education (DE) course in order to determine the reasonableness and accuracy of the student’s withdrawal date in the system. Currently, the withdrawal date used in the calculation of return to Title IV funds is the actual date the student initiates the withdrawal from the course in the system. Cause and Effect: A. Incorrect Calculation of Return to Title IV Funds East Los Angeles College The Financial Aid Technician who processed the Spring 2023 return to Title IV had an oversight on that record during his review process. He had a family emergency during that period and had to leave in the middle of his review process. As a result, he forgot to deduct the spring break period from the total number of days for the enrollment period. This caused the calculation to be slightly off. Los Angeles Southwest College The person who was assigned the role of handling the return to Title IV program received limited training before he assumed the duties of return to Title IV calculations while also having to maintain his full load as a Financial Aid Technician. In addition to the limited training, there were changes as to how the program was administered and modules were calculated. This is an arduous task for a seasoned professional and a very challenging task for a novice at best. As with all newly assigned duties, given more time he would have become an expert in handling this program with minimal to zero errors. B. Untimely Notification of Grant Overpayment to the Secretary Every two weeks a new batch of return to Title IV report is released to be processed. The urgency for each report to be completed within a certain time frame created confusion for the NSLDS reporting due date. The same Financial Aid Technician was in charge of completing each step of the process. East Los Angeles College has the largest return to Title IV population. The demand to meet the deadline process caused an oversight for the NSLDS report. C. Distance Education Courses – Lack of Formal Process to Determine Accuracy of Student Withdrawal Date The calculation of return to Title IV funds is a complex process. The District has invested significant resources to improve the accuracy of the process. The District is centralizing and automating the return to Title IV process to minimize potential errors. However, there are still manual aspects to the process. In particular, distance education courses (DE) require faculty to withdraw students from Canvas, the online content delivery application, and Peoplesoft, the District’s student information system. Peoplesoft is used to maintain student records and for administering aid. Incorrect information entered into either system can lead to an incorrect return to Title IV calculation, resulting in institutional liability and/or disciplinary action taken by the U.S. Department of Education. Questioned Costs: A. Incorrect Calculation of Return to Title IV Funds See schedule of findings and questioned costs The District has a known net understatement of the amount due from the student of $434 and a known net overstatement of the amount due from the District of $213. The Projected total net understatement of amounts due from both the student and District is $4,006 as follows: See schedule of findings and questioned costs. This is computed by dividing the errors found in samples per term (Summer term – net understatement $0 and Fall/Spring terms – net understatement $221 over the total Pell awards disbursed in the sample size per term (Summer term – $5,000 and Fall/Spring terms – $176,293) multiplied by the total Pell awards disbursed for the identified colleges per term (Summer term – $67,595 and Fall/Spring terms – $3,195,662). The computation is made on a per-term basis on a campus level and not on a district-wide level. B. Untimely Notification of Grant Overpayment to the Secretary None. C. Distance Education Courses – Lack of Formal Process to Determine Accuracy of Student Withdrawal Date None. Recommendation: We recommend that the District evaluate and improve its existing process and control procedures related to the return of Title IV funds, including notification and return due date requirements. This will help ensure 1) that the returns of Title IV funds are accurately calculated and 2) compliance with the notification and return due date requirements, in accordance with the Uniform Guidance and the Code of Federal Regulation. We recommend that the District implement additional controls at the course instructor level to effectively monitor student participation and engagement in academic activities related to DE courses in order for the instructor to determine the reasonableness and accuracy of a student’s withdrawal date listed in the system. This will help ensure that the withdrawal date used in the calculation of the return of Title IV funds is accurate. Views of Responsible Officials and Planned Corrective Actions: A. Incorrect Calculation of Return to Title IV Funds East Los Angeles College The corrective action plan that will be put in place is to develop a chart with a predetermined number of days based on the enrollment period. This will avoid the manual counting of the number of days for each student. We also trained an additional staff member to help with the workload. This will ensure that errors will be caught before the completion of the review process. Implementation will begin in Spring 2024. Staff is currently being trained. Personnel Responsible for Implementation: Gavino Herrera Position of Responsible Personnel: Financial Aid Supervisor Expected Date of Implementation: Spring 2024 Los Angeles Southwest College The corrective action that we are implementing to remediate this finding is to move the campus return to Title IV processing to the “R2T4 Unit” at the District Office. Personnel Responsible for Implementation: Muniece R. Bruton Position of Responsible Personnel: Financial Aid Manager Expected Date of Implementation: December 1, 2023 B. Untimely Notification of Grant Overpayment to Students and Secretary East Los Angeles College The Corrective Action plan is being implemented by providing an additional staff member to assist with the return to Title IV process along with helping with the validation to ensure calculation, notification, and reporting to NSLDS will be completed on a timely basis. A reminder is set in the Financial Aid Technician Outlook calendar to help remind them to help meet the deadline of the reporting requirement. Personnel Responsible for Implementation: Gavino Herrera Position of Responsible Personnel: Financial Aid Supervisor Expected Date of Implementation: Fall 2023 C. Distance Education Courses – Lack of Formal Process to Determine Accuracy of Student Withdrawal Date In the fall 2022 term, the District implemented training for all Distance Education (DE) faculty members to reduce the risk of data entry errors. DE faculty receive follow-up notifications at the beginning of every term). In addition, the District attempted to conduct random sampling to ensure the accuracy of the data entry. However, the District did not have the authorization or resources to perform sampling during the audit period. As a result, the corrective action plan (CAP) was only partially implemented during fiscal year 2023. In fall 2023, the District secured the human resources and required authorizations to conduct random sampling of the faculty data entry. The District’s Internal Audit Department (IAD) is performing random sampling of all campuses. As of fall 2023, all corrective actions have been fully implemented. Personnel Responsible for Implementation: Steve Giorgi, Betsy Regalado, Keyna Crenshaw Position of Responsible Personnel: Financial Aid Manager, Associate Vice Chancellor of Educational Programs and Institutional Effectiveness, LACCD Supervising Auditor) Expected Date of Implementation: Fall 2023

Finding FA 2023‑03: Special Tests and Provision: Gramm Leach Bliley Act ‑ Student Information Security – Formally Establish and Document Risk Acceptance Process, Perform Regular Backup Restoration Tests, Perform Timely Access Revocation and Regular Access Reviews, Perform Necessary Due Diligence to Regularly Evaluate All Third-party Safeguards, Maintain and Review Logs of Users' Activity for both SAP and PS SIS, Implement Data-at-Rest Encryption for Devices Storing Customer Data, Enforce Strict Compliance on Controls over SAP Direct to Production Changes (Repeat Finding) Federal Program Information Assistance Listing Number: ALN 84.007, 84.033, 84.038, 84.048, 84.063 and 84.268 Federal Program Name: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Passed Through Entity: N/A Federal Award Number: Various Federal Award Year: July 1, 2022, to June 30, 2023 Compliance Requirement: Special Tests and Provisions – Gramm Leach Bliley Act – Student Information Security Criteria or Specific Requirement: The Gramm-Leach-Bliley Act (Pub. L. No. 106-102) (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). The Federal Trade Commission considers Title IV-eligible institutions that participate in Title IV Educational Assistance Programs as “financial institutions” and subject to the Gramm-Leach-Bliley Act because they appear to be significantly engaged in wiring funds to consumers (16 CFR 313.3(k)(2)(vi)). Institutions agree to comply with GLBA in their Program Participation Agreement with ED. Institutions must protect student financial aid information, with particular attention to information provided to institutions by ED or otherwise obtained in support of the administration of the Federal student financial aid programs (16 CFR 314.3; HEA 483(a)(3)(E) and HEA 485B(d)(2)). On December 9, 2021, the FTC issued final regulations for 16 CFR Part 314 to implement the GLBA information safeguarding standards that institutions must implement. These regulations significantly modified the requirements that institutions must meet under GLBA. The regulations established minimum standards that institutions must meet. The FTC stated that it “believes many of the requirements outlined in the Final Rule are so fundamental to any information security program that the information security programs of many financial institutions will already include them if those programs are in compliance with the current Safeguards Rule.” Institutions are required to be in compliance with the revised requirements no later than June 9, 2023. Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The written information security program for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). In the preamble to the Final Rule, the FTC stated, “Proposed § 314.4 [Elements] altered the current Rule’s required elements of an information security program and added several new elements.” The FTC also stated, “[t]he elements for the information security programs set forth in this section [16 CFR 314.4} are high-level principles that set forth basic issues the programs must address, and do not prescribe how they will be addressed.” The elements that an institution must address in its written information security program are at 16 CFR 314.4. At a minimum, an institution’s written information security program: • Designates a qualified individual responsible for overseeing and implementing the institution’s information security program and enforcing the information security program in compliance (16 CFR 314.4(a)). • Provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution) that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks (16 CFR 314.4(b)). • Provides for the design and implementation of safeguards to control the risks the institution identifies through its risk assessment (16 CFR 314.4(c)). At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8). The eight minimum safeguards that the written information security program must address are summarized as follows: – Implement and periodically review access controls. – Conduct a periodic inventory of data, noting where it’s collected, stored, or transmitted. – Encrypt customer information on the institution’s system and when it’s in transit. – Assess apps developed by the institution. – Implement multi-factor authentication for anyone accessing customer information on the institution’s system. – Dispose of customer information securely – Anticipate and evaluate changes to the information system or network. – Maintain a log of authorized users’ activity and keep an eye out for unauthorized access. • Provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)). • Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 CFR 314.4(e)(1)). • Addresses how the institution will oversee its information system service providers (16 CFR 314.4(f)). • Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the institution’s information security program (16 CFR 314.4(g)). The first element that an institution’s written information security program must address is the designation of an individual with responsibility for implementing and enforcing an institution’s written information security program. The regulations refer to this individual as the Qualified Individual. If an institution has not designated a Qualified Individual, it is not in compliance with the GLBA requirements. The Qualified Individual has ultimate responsibility and accountability for implementing and enforcing the institution’s information security program (16 CFR 314.4(a)). The regulations do provide for an institution to use a service provider as a Qualified Individual. In cases where an institution uses a service provider as the Qualified Individual, the institution must: • Retain responsibility for compliance with GLBA. • Designate a senior member of its personnel responsible for direction and oversight of the Qualified Individual; and • Require the service provider or affiliate to maintain an information security program that protects the institution in accordance with the requirements of the regulations at 16 CFR Part 314(a)(1) through (3). Because the written information security program may be in one or more readily accessible parts and the Qualified Individual is responsible for implementing and monitoring the information security program, ED expects that the Qualified Individual would be able to provide the written information security program that addresses the elements required for the written information security program to the auditors. Identified Conditions: A. Formally Establish and Document Risk Acceptance Process (repeat finding) The District’s Written Information Security Program does not explicitly define the criteria for accepting potential risks. A related process document, which was committed to be completed in the prior year, is still in development as of September 2023. B. Perform Regular Backup Restoration Tests (repeat finding) The District performed a comprehensive Tabletop Disaster Recovery (DR) exercise for both SAP and SIS during the audit period. As part of the exercise, the DR Team simulated a scenario, fully supported with recovery considerations, steps, results, recovery challenges, and key recommendations to improve moving forward – the exercise was also reviewed and approved by the Vice Chancellor and Chief Information Officer. However, a key activity which is the actual backup restoration testing was not performed as part of the tabletop exercise or at any point during the audit period. C. Perform Timely Access Revocation and Regular Access Reviews (repeat finding) Based on a test of controls to verify that access of terminated employees is timely removed in Active Directory (AD), SAP, and PeopleSoft Student Information System (PS SIS), we noted that out of the terminated employees subject to testing: 1. 13 users were active in AD, three (3) of whom have logged in after their termination. 2. 76 users were still active in SAP, 19 of whom have logged in after their termination. 3. 81 users were still active in PS SIS, 42 of whom have logged in after their termination. Moreover, while a privileged user access review is performed for AD, there is no review performed to check the validity of regular users in AD and the validity and appropriateness of users in SAP and SIS. Employee functions and/or responsibilities may change over time; thus, previously provisioned access may no longer be valid. Furthermore, a new compliance requirement, which requires institutions to perform periodic access reviews for physical access in the data centers where the critical student information systems are hosted [16 CFR 314.4(c)(1)], was also not performed during the audit period. D. Perform Necessary Due Diligence to Regularly Evaluate All Third-party Safeguards 16 CFR 314.4(f), a new compliance requirement, requires institutions to periodically assess service providers based on the risk they present and the continued adequacy of their safeguards. However, we noted that contracts for the following service providers were renewed by the District without sufficient information security review from 2020 to 2022 and the period thereafter. a. XAP – used for requesting, sending, and receiving electronic transcripts. b. Bank Mobile – used for student refund processing. c. Campus Logic – used for student online verification processing. These contracts were instituted before the adoption of the District’s Information Security Program and thus, were adopted and renewed thereafter without an Information Security Review. E. Maintain and Review Logs of Users’ Activity for both SAP and PS SIS A new compliance requirement, which requires institutions to monitor and log the activity of authorized users and detect unauthorized access or use of, or tampering with, customer information by such users [16 CFR 314.4(c)(8)], is not currently implemented by the District. F. Implement Data-at-Rest Encryption for Devices Storing Customer Data A new compliance requirement, which requires institutions to protect by encryption all students’ data held at rest [16 CFR 314.4(c)(3)], is not currently implemented by the District (e.g., SAP and SIS servers). G. Enforce Strict Compliance on Controls over SAP Direct to Production Changes SAP production client was opened on 10/03/2022 and 11/09/2022 without sufficient documentation that it was authorized and approved. Opening the production client, if not controlled, carries a significant risk since changes can be made directly to the production environment without transport requests, thereby circumventing any established change management controls. Cause and Effect: A. Formally Establish and Document Risk Acceptance Process The absence of a formal risk acceptance process can lead to inappropriate risk treatment and a lack of oversight in managing risks, resulting in inconsistent approaches that may not align with the District’s overall risk tolerance. B. Perform Regular Backup Restoration Tests Lack of proper restoration testing may hinder the District from recovering its data completely and accurately. C. Perform Timely Access Revocation and Regular Access Reviews Failure to deactivate or remove accounts of terminated employees timely may result in unauthorized access to the District’s resources and sensitive information. Furthermore, the absence of user access reviews increases the risk of inappropriate users or access remaining undetected over time which may be used to process unauthorized transactions or view confidential information. D. Perform Necessary Due Diligence to Regularly Evaluate All Third-party Safeguards Non-performance of review may result in the District relying on IT service providers with ineffective information security controls making them susceptible to data breaches. A breach in a third-party system may expose the District to financial, operational, legal, and reputational damages. E. Maintain and Review Logs of Users’ Activity for both SAP and PS SIS Without adequate logging and monitoring of users’ activity, security incidents, including suspicious and unauthorized activities may not be detected and responded to in a timely manner. F. Implement Data-at-Rest encryption for Devices Storing Customer Data Data that is held to devices without encryption is vulnerable to unauthorized access, especially if physical and logical controls are compromised. In the event of a breach, sensitive data, such as students’ information may be exposed. G. Enforce Strict Compliance on Controls over SAP Direct to Production Changes Insufficient controls over client opening may result in the implementation of unauthorized changes directly into the production environment. This increases the risk that changes to the system may not follow the District’s change management process (documentation, authorization, testing, and approval) prior to the implementation of the change to the production environment. Recommendation: A. Formally Establish and Document Risk Acceptance Process We recommend that the District establish and implement the District’s Risk Acceptance process that details the criteria and conditions for accepting potential risks. We also recommend that the District ensure this is aligned with the District’s objectives, overall risk tolerance, and current practices in identifying, assessing, and mitigating risks. B. Perform Regular Backup Restoration Tests Together with the DR tabletop exercises, we recommend that backup restoration tests should be performed at least once per year. Detailed testing schedules should be drafted based on DRP specifications and required restoration of the critical systems. Documentation of such tests should be maintained for full management awareness and approval. C. Perform Timely Access Revocation and Regular Access Reviews 1. We recommend that the District revoke the access of terminated employees and review the activities performed by those accounts after their termination date to ensure the validity and appropriateness of activities/transactions performed by these accounts, if any. 2. Concurrently, the District should improve the account termination procedures to ensure that access to terminated employees is timely revoked. 3. We also recommend that regular access reviews for AD, SAP, PS SIS, and the physical accesses to data centers where these systems are hosted, are performed, and documented (for both regular and privileged users) to ensure that only valid and appropriate users remain in the system and have access to relevant information. The review may include, but is not limited to the following: a. Document management control over the completeness and accuracy of the reports used in the review. b. Define designated functions/roles to perform the review. c. Monitor timeliness of the performance of the review and execution of corrective actions as a result of the review D. Perform Necessary Due Diligence to Regularly Evaluate All Third-party Safeguards Revisit the District’s current practices for evaluating third-party provider’s information security to ensure that all third-party are reviewed and evaluated regularly. At the minimum, the process should involve continuous monitoring, contractual provisions summarizing security requirements, and a strategy for addressing security vulnerabilities identified during reviews. E. Maintain and Review Logs of Users’ Activity for both SAP and PS SIS Formally establish a process for logging and monitoring users’ activity which includes collection, retention, regular review, and documentation of user activity logs. The review should be aligned with the District’s access management practices to ensure that only authorized users are allowed to access information that is aligned with their functions and responsibilities. F. Implement Data-at-Rest encryption for Devices Storing Customer Data The District should establish and implement data-at-rest encryption for endpoint devices to ensure that data is inaccessible to unauthorized users in cases when logical and physical measures are compromised. G. Strictly Implement Processes and Control for Direct Changes in the SAP Production Environment Ensure that production client openings, particularly those related to direct production changes, strictly adhere to the District’s Change Management Procedure. These client openings and the related changes should be properly documented, authorized, and validated prior to implementation. Views of Responsible Officials and Planned Corrective Actions: A. Formally Establish and Document Risk Acceptance Process Requirements for risk assessments and risk acceptance processes to comply with GLBA were expanded in June of 2023. The District engaged a third-party consultant to conduct a GLBA-compliant risk assessment and advise on recommended changes to the District’s Written Information Security Plan (WISP) to comply with the new requirements. The findings and recommendations were presented to the District in October of 2023 and are currently under review. The District will initiate a project to formalize risk acceptance by December 31st, 2023, and implement the risk acceptance process by June 30, 2024. B. Perform Regular Backup Restoration Tests The District has engaged with a third party to build a testing environment to physically test restoration of the SIS environment. Initiation of the project is pending processing of the Purchase Order. The District anticipates completion of the restoration by December 31st, 2023. With respect to SAP, the District is currently engaged in an effort to migrate the SAP database to HANA. When this project is complete, the same test environment will be capable of performing physical recovery tests for SAP. The HANA migration is estimated to be completed on February 28th, 2024. C. Perform Timely Access Revocation and Regular Access Reviews With respect to the District’s Single Sign-On (ADFS or SSO) environments, the District engaged professional services consultants to address this item by automating the disablement of employee accounts based upon the termination of assignment. The work is currently underway. The target completion of the process is December 15, 2023. With respect to the SAP environment, the District has engaged with a vendor to implement Multifactor Authentication (MFA) in the SAP environment. Work will begin upon processing the Purchase Order. Once both efforts are complete, disabling employee accounts in SSO, SIS and SAP will be performed automatically based upon the termination of assignments according to criteria established by Human Resources. With respect to access reviews of SIS and SAP, the District is currently researching the export of user audit logs to the District’s analysis environment to enable regular reviews. The new target to perform regular access reviews for SAP and SIS is the end of Q1 2024. With respect to physical access reviews, the District Information Security Team will perform an annual review of relevant operational protocols for data center access with the appropriate internal teams and perform an audit of data access at a minimum of once per year. The first annual protocol review will be completed by December 1st, 2023. The first annual audit will commence no later than March 1st, 2024. D. Perform Necessary Due Diligence to Regularly Evaluate All Third-party Safeguards To prevent recurrence, the LACCD Information Security Team will coordinate an annual review of Administrative Protocol 3723A: Information Security Evaluation of Third-Party Providers with District Financial Aid, Procurement and Educational Programming and Institutional Effectiveness (EPIE) leadership teams to help assure future relevant contracts are provided to the Information Security Team prior to renewal to allow for timely security review. E. Maintain and Review Logs of Users’ Activity for both SAP and PS SIS The District is currently researching the export of user audit logs to the District’s analysis environment to enable regular reviews. The new target to perform regular access reviews for SAP and SIS is the end of Q1 2024. F. Implement data encryption for Devices Storing Customer Data The District engaged a third-party consultant to perform a comprehensive review of PeopleSoft security controls, including the implementation of encryption of financial aid data within PeopleSoft. The results are pending. Based upon those recommendations, the District will work with encryption providers to develop and implement field-level encryption of financial aid data in SIS as appropriate. With respect to end-user devices storing sensitive data, the District recently adopted workstation hardening requirements that include whole-disk encryption for desktop and laptop computers used by personnel who routinely access sensitive information, including financial aid data. The District will implement the standards on workstations used by employees in financial aid and institutional research by June 30, 2024. Once this is complete, additional workstations will be encrypted in order of potential risk. G. Strictly Implement Processes and Control for Direct Changes in the SAP Production Environment The requests for direct changes in SAP production will be tracked and included in our help desk requests so that an auditable trail can be created leading to the purpose and completion of the production changes. Additionally, direct production change requests will be reviewed and approved following the LACCD Change Control process. Minor updates that do not fall within the change control guidelines will require managerial approval within the help desk system. Personnel Responsible for Implementation: Carmen V. Lidz Position of Responsible Personnel: Vice Chancellor & Chief Information Officer

Finding FA 2023-004: Special Tests and Provisions – Using a Servicer or Financial Institution to Deliver Title IV Credit Balances to a Card or Other Access Device – Failure to Submit URL to the Secretary of Education for Publication in a Centralized Database Accessible to the Public Federal Catalog Number: ALN 84.007, 84.033, 84.038, 84.063, and 93.364 Federal Program Name: Student Financial Assistance Cluster: Federal Supplement Educational Opportunity Grants (FSEOG) Federal Work-Study Program (FWS) Federal Perkins Loan Program Federal Pell Grant Program Federal Direct Student Loans Nursing Student Loans (NSL) Federal Agency: U.S. Department of Education (ED) Passed Through Entity: N/A Federal Award Number: FSEOG P007A210450, P007A210365, P007A210451, P007A210452, P007A210453, P007A210455, P007A210456, P007A210457, P007A210676 FWS P033A210450, P033A210365, P033A210451, P033A210452, P033A210453, P033A210455, P033A210456, P033A210457, P033A210676 Pell P063P210033, P063P215263, P063P210034, P063P210658, P063P210035, P063P215261, P063P215260, P063P210036, P063P215262 NSL P268K220033, P268K225263, P268K220034, P268K220658, P268K220035, P268K225261, P268K225260, P268K220036, P268K225262 Federal Award Year: July 1, 2022, to June 30, 2023 Campuses: Los Angeles Community College District Compliance Requirement: Special Tests and Provisions: Using a Servicer or Financial Institution to Deliver Title IV Credit Balances to a Card or Other Access Device Criteria or Specific Requirements: Per 34 Code of Federal Regulations 668.164 Disbursing Funds: In Tier One (T1) arrangement, an institution located in a State has a contract with a third-party servicer under which the servicer performs one or more of the functions associated with processing direct payments of Title IV, HEA program funds on behalf of the institution. The institution or third-party servicer makes payments to one or more financial accounts that are offered to students under the contract; a financial account where information about the account is communicated directly to students by the third-party servicer, or the institution on behalf of or in conjunction with the third-party servicer; or a financial account where information about the account is communicated directly to students by an entity contracting with or affiliated with the third-party servicer. Institutions with a T1 arrangement should ensure that no later than September 1, 2017, and then no later than 60 days following the most recently completed award year thereafter, disclose conspicuously on the institution’s Website and in a format established by the Secretary of Education the total consideration for the most recently completed award year, monetary and non-monetary, paid or received by the parties under the terms of the contract; and for any year in which the institution’s enrolled students open 30 or more financial accounts under the T1 arrangement, the number of students who had financial accounts under the contract at any time during the most recently completed award year, and the mean and median of the actual costs incurred by those account holders. The institution should also provide the Secretary with an up-to-date Uniform Resource Locator (URL) for the contract and contract data as described above for publication in a centralized database accessible to the public. Identified Condition: We noted that the District’s URL link to the contract with BMTX, Inc. (BankMobile) and other required information was not included in the latest Cash Management Contracts Database published by ED on March 2022 as the District was unable to provide the URL link to ED for the award year ended June 30, 2023. Cause and Effect: Due to a miscommunication between the District staff and Bankmobile staff, the website link was not submitted to the Department of Education, although the report was published and available to the public. Questioned Costs: None. Recommendation: We recommend that the District review its roles and responsibilities with Bankmobile and implement control procedures to ensure that the District remains compliant with the requirements of Uniform Guidance and the Code of Federal Regulation. Views of Responsible Officials and Planned Corrective Actions: The District has taken responsibility for providing the Department of Education with the website link and will provide that going forward. Personnel Responsible for Implementation: Nyame-Tease Prempeh Position of Responsible Personnel: Assistant Director of Accounting Expected Date of Implementation: November 1, 2023

Finding FA 2023-005: Reporting – Untimely and Incomplete Posting of Quarterly Reports to the College’s Website and Inaccurate Reported Expenditures Captured in the Published Website’s Quarterly Reports. Federal Catalog Number: ALN 84.425E, 84.425F, and 84.425L Federal Program Name: Higher Education Emergency Relief Fund Federal Agency: U.S. Department of Education Passed Through Entity: N/A Federal Award Number: P425E200844, P425F202148, P425L200439, P425E204139, P425F203076, P425L200440 Federal Award Year: July 1, 2022, to June 30, 2023 Campuses: Los Angeles Pierce College Los Angeles Trade Technical College Compliance Requirement: Reporting Criteria or Specific Requirements: Per U.S. Department of Education Notice of Public Posting Requirement of Grant Information for Higher Education Emergency Relief Fund (HEERF) Grantees: The Certification and Agreements for the Coronavirus Response and Relief Supplemental Appropriations Act of 2021 (CRRSAA) and American Rescue Plan (ARP) (a)(1) and (a)(4) funds provide that each institution applying for HEERF funds must promptly and timely provide a detailed accounting of the use and expenditure of the funds in such manner and with such frequency as the Secretary may require. Each HEERF participating institution must post the information listed below on the institution’s primary website, as an initial report under the CRRSAA and ARP (a)(1) and (a)(4) programs. This report is associated with the approved information collection under OMB control number 1801–0005. This information must appear in a format and location that is easily accessible to the public. This information must also be updated no later than 10 days after the end of each calendar quarter (September 30, December 31, March 31, and June 30) thereafter, unless the Secretary specifies an alternative method of reporting. Identified Condition: A. Untimely Posting of Quarterly Reports on the College’s Website We noted that Los Angeles Pierce College’s Quarterly Budget and Expenditure Report for all HEERF I, II, and III grant funds covering the quarter ending December 31, 2022, and March 31, 2023, were not publicly posted on the college’s primary website. B. Incomplete Posting of Published Links Related to the Quarterly Report on the College’s Website We noted that Los Angeles Trade Technical College’s Quarterly Budget and Expenditure Report for all HEERF I, II, and III grant funds covering the quarter ending June 30, 2023, was not completely posted on the college’s primary website. The link to the quarterly report ending June 30, 2023, was published on time, but the link incorrectly redirects to the March 31, 2023, quarterly report. C. Inaccuracy of Quarterly Expenditures Reported on the College’s Website We noted that the expenditures reported in Los Angeles Pierce College’s Quarterly Budget and Expenditure Report for all HEERF I, II, and III grant funds covering the quarter ending December 31, 2022, and June 30, 2023, were inaccurate. • For the quarter ending December 31, 2022, the expenditures were overstated by $284,593 due to the inclusion of the expenditures already reported from the previous quarter ending September 30, 2022. Per inquiry, the preparer inadvertently reported the expenditures on a cumulative basis. • For the quarter ending June 30, 2023, the expenditures were erroneously reported at zero amounts which resulted in an understatement by the actual expenditures incurred amounting to $2,007,950. Cause and Effect: Los Angeles Trade Technical College The reports were posted to the website on time. However, due to a clerical error, the link for the June 30, 2023, report directed users to the March 31, 2023, report. The effect was that, although the correct file existed on the server, there was no link for users to access it. This has been corrected. Los Angeles Pierce College The college experienced a break in the coordination of the report review which resulted in an error on the published report. There was also a misunderstanding about accumulating data from prior reported periods. Questioned Costs: None. Recommendation: We recommend that the campuses review their approval process prior to posting the reports online by having formal preparer and approver signoffs to ensure that the supporting documents correctly match the reports posted online. Additionally, we recommend the campuses enhance coordination between the report approver and the website manager to ensure that the reports are properly linked in the backend of the website and are timely posted if already prepared. Views of Responsible Officials and Planned Corrective Actions: Los Angeles Trade Technical College The cause of the incorrect link was a clerical error, and the error has since been corrected, the condition no longer exists and is resolved. Personnel Responsible for Implementation: LATTC – Charalambos Ziogas/Daniel Friedman Position of Responsible Personnel: VPAS/CFA Expected Date of Implementation: October 16, 2023 Los Angeles Pierce College The college will work with District staff to update the process of reviewing, approving, and publishing or providing the reports to appropriate websites and agencies. Personnel Responsible for Implementation: Ron Paquette Position of Responsible Personnel: Associate Vice President, Admin Services Expected Date of Implementation: November 1, 2023

Finding FA 2023-006 Reporting: Untimely Submission of Quarterly Financial Reports Federal Program Information Federal Catalog Number: ALN 17.268 Federal Program Name: H-1B Job Training Grant Federal Agency: U.S. Department of Labor Passed Through Entity: N/A Federal Award Number: HG-33046-19-60-A-6 Federal Award Year: July 1, 2022 to June 30, 2023 Campus: West Los Angeles College Compliance Requirement: Reporting Criteria or Specific Requirement: Per the terms and conditions of the grant agreement, with the U.S. Department of Labor (DOL) – Employment and Training Administration (ETA), all ETA recipients are required to report quarterly financial data on the ETA-9130 Form. ETA-9130 reports are due no later than 45 calendar days after the end of each specified reporting quarter. Identified Condition: We noted that 2 out of 4 quarterly financial reports ETA-9130 were certified late on the U.S. Department of Labor website as follows: See schedule of findings and questioned costs. Per inquiry with the District, the Accounting Department attempted to certify the quarterly reports before the due date but encountered log-in issues on the U.S. DOL website which prevented certifying timely. The District requested a reporting extension from Joshua Hodges, Federal Project Officer for the Office of Special Initiatives and Demonstrations, U.S. DOL-ETA. Mr. Hodges did not authorize the extension and suggested submitting the quarterly reports via the Payment Management System (PMS) and coordinating with the agency’s technical team to resolve issues. Cause and Effect: The District’s approval officers were available to certify the reports, however, due to technical issues with the PMS system, certification could not be completed within the allotted time. Questioned Costs: None. Recommendation: We recommend the district schedule and finalize its quarterly reports submission a week or two before the due date to ensure that sufficient time is available to resolve unforeseen issues, such as the technical problems with the U.S DOL website. Otherwise, an authorized waiver from the agency must be secured for late reporting. Views of Responsible Officials and Planned Corrective Actions: The District will review reporting timelines and reschedule to allow additional time for unforeseen issues. Personnel Responsible for Implementation: Nyame-Tease Prempeh Position of Responsible Personnel: Assistant Director of Accounting Expected Date of Implementation: November 1, 2023

Finding FA 2022-001: Eligibility: Incorrect Federal Pell Grant Amounts Awarded (Repeat Finding) Federal Program Information Assistance Listing Number: ALN 84.063 Federal Program Name: Student Financial Assistance Cluster: Federal Pell Grant Program Federal Agency: U.S. Department of Education Passed Through Entity: N/A Federal Award Number: P063P200033 Federal Award Year: July 1, 2021, to June 30, 2022 Campus: Los Angeles City College Compliance Requirement: Eligibility Criteria or Specific Requirement: Per 34 Code of Federal Regulations (CFR) 690.62 Calculation of a Federal Pell Grant, the amount of a student?s Pell Grant for an academic year is based upon the payment and disbursement schedules published by the Secretary for each award year. The Uniform Guidance Compliance Supplement states that the Department of Education provides institutions Payment and Disbursement Schedules for determining Pell awards each year. The Payment or Disbursement Schedule provides the maximum annual amount a student would receive for a full academic year for a given enrollment status, Expected Family Contribution (EFC), and Cost of Attendance (COA). The Payment Schedule is used to determine the annual award for full-time, three-quarter time, half-time, and less-than-half-time students. 2 CFR section 200.303 requires that non-Federal entities receiving Federal awards establish and maintain internal control over the Federal awards that provides reasonable assurance that the non-Federal entity is managing the Federal awards in compliance with Federal statutes, regulations, and the terms and conditions of the Federal awards. Identified Condition: Of the 15 students selected for eligibility testwork at Los Angeles City College, we noted that 1 student had an incorrectly calculated Federal Pell grant award, which resulted in an understatement of the disbursement to the student by $419. The student was eligible to receive $419 yet received none in Summer 2020. Causes and Effect: One overpayment was identified during the audit period due to a class withdrawn after Pell disbursement. In addition, the underpayment identified related to the summer term is due to manual processing. The summer term is unique because it requires District staff to manually review Pell awards from two aid years to ensure the student receives the highest award. The process is labor intensive and complex. Incorrect awards can result in institutional liability. Questioned Costs: See schedule of findings and Questioned Costs The District has a known net understatement of Pell grant award disbursements of $419. The projected total net understatement of the Pell grant award disbursements is $117,592 as follows: See schedule of findings and Questioned Costs This is computed by dividing the error found in the samples per term (Summer term ? net underpayment ($419) and Fall/Spring terms ? $0) over the total Pell awards disbursed in the sample size per term (Summer term - $26,361 and Fall/Spring terms - $545,632) multiplied by the total Pell awards disbursed for the identified colleges per term (Summer term - $7,398,149 and Fall/Spring terms - $103,509,698). The computation is made on a per-term basis on a campus level and not on a district-wide level. Recommendation: We recommend that the District make the necessary system modifications to the PeopleSoft Student Information System (SIS) to ensure student awards are properly calculated. This will help ensure that Federal Pell grants are properly awarded to students who meet the eligibility requirements. Views of Responsible Officials and Planned Corrective Actions: The District has already developed an automated summer Pell solution. The solution has been tested by the field and Central Financial Aid Unit (CFAU) and will be implemented Summer 2023. Personnel responsible for implementation: Steve Giorgi Position of responsible personnel: CFAU Financial Aid Manager Expected date of Implementation: Summer 2023

Finding FA 2022-002: Special Tests and Provision: Return of Title IV Funds: Incorrect Calculation of Return of Title IV Funds, Untimely Notification of Grant Overpayment to Students and Secretary, and Distance Education Courses ? Lack of Formal Process to Determine Accuracy of Student Withdrawal Date (Repeat Finding) Federal Program Information Federal Catalog Number: ALN 84.063 and 84.268 Federal Program Name: Student Financial Assistance Cluster: Federal Pell Grant Program Federal Direct Student Loans Federal Agency: U.S. Department of Education Passed Through Entity: N/A Federal Award Number: P063P210033, P063P215263, P063P210034, P063P210658, P063P210035, P063P215261, P063P215260, P063P210036, P063P215262, P268K220033, P268K225263, P268K220034, P268K220658, P268K220035, P268K225261, P268K225260, P268K220036, P268K225262 Federal Award Year: July 1, 2021, to June 30, 2022 Campuses: Los Angeles City College (Repeat Finding) East Los Angeles College Los Angeles Harbor College (Repeat Finding) Los Angeles Mission College Los Angeles Pierce College (Repeat Finding) Los Angeles Southwest College (Repeat Finding) Los Angeles Trade Technical College (Repeat Finding) Los Angeles Valley College (Repeat Finding) West Los Angeles College (Repeat Finding) Compliance Requirement: Special Tests and Provisions ? Return of Title IV Funds Criteria or Specific Requirement: Per 34 Code of Federal Regulations 668.22 Treatments of Title IV Funds. A. When a recipient of Title IV grant or loan assistance withdraws from an institution during a payment period or period of enrollment in which the recipient began attendance, the institution must determine the amount of title IV grant or loan assistance that the student earned as of the student's withdrawal date in accordance with paragraph (e) of 34 Code of Federal Regulations 668.22. Per the Unform Guidance Compliance Supplement: - If an institution is required to take attendance, the withdrawal date is the last date of academic attendance, as determined by the institution from its attendance records. - If an institution is not required to take attendance, the withdrawal date is (1) the date, as determined by the institution, that the student began the withdrawal process prescribed by the institution; (2) the date, as determined by the institution, that the student otherwise provided official notification to the institution, in writing or orally, of his or her intent to withdraw; (3) if the student ceases attendance without providing official notification to the institution of his or her withdrawal, the midpoint of the payment period or, if applicable, the period of enrollment; (4) if the institution determines that a student did not begin the withdrawal process or otherwise notify the institution of the intent to withdraw due to illness, accident, grievous personal loss or other circumstances beyond the student?s control, the date the institution determines is related to that circumstance; (5) if a student does not return from an approved leave of absence, the date that the institution determines the student began the leave of absence; or (6) if the student takes an unapproved leave of absence, the date that the student began the leave of absence. Notwithstanding the above, an institution that is not required to take attendance may use as the withdrawal date, the last date of attendance at an academically related activity as documented by the institution (34 CFR668.22(c) and (l)). Title IV funds may be expended only towards the education of the students who can be proven to have been in attendance at the institution. In a distance education context, documenting that a student has logged into an online distance education platform or system is not sufficient, by itself, to demonstrate attendance by the student. To avoid returning all funds for a student that did not begin attendance, an institution must be able to document ?attendance at any class.? To qualify as a last date of attendance for Return of Title IV purposes, an institution must demonstrate that a student participated in class or was otherwise engaged in an academically related activity, such as by contributing to an online discussion or initiating contact with a faculty member to ask a course-related question. The Uniform Guidance Compliance Supplement requires auditors to identify a sample of students who received Title IV assistance who withdrew, dropped out, or never began attendance during the audit period. Auditors are to review the return of Title IV funds determinations/calculations for conformity with Title IV requirements. B. Within 30 days of the date of the institution?s determination that the student withdrew, an institution must send a notice to any student who owes a title IV, HEA grant overpayment as a result of the student?s withdrawal from the institution in order to recover the overpayment in accordance with paragraph (h)(4)(i) of this section. An institution must refer to the Secretary, in accordance with procedures required by the Secretary, an overpayment of Title IV, HEA grant funds owed by a student as a result of the student?s withdrawal from the institution if? (A) The student does not repay the overpayment in full to the institution, or enter a repayment agreement with the institution or the Secretary in accordance with paragraph (h)(4)(i) of this section within the earlier of 45 days from the date the institution sends a notification to the student of the overpayment or 45 days from the date the institution was required to notify the student of the overpayment; C. For an institution that is not required to take attendance, an institution must determine the withdrawal date for a student who withdraws without providing notification to the institution no later than 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew. D. The institution must disburse directly to a student any amount of a post-withdrawal disbursement of grant funds that is not credited to the student's account. The institution must make the disbursement as soon as possible, but no later than 45 days after the date of the institution's determination that the student withdrew, as defined in paragraph (l)(3) of this section. E. Title IV funds may be expended only towards the education of the students who can be proven to have been in attendance at the institution. In a distance education context, documenting that a student has logged into an online distance education platform or system is not sufficient, by itself, to demonstrate attendance by the student. To avoid returning all funds for a student that did not begin attendance, an institution must be able to document ?attendance at any class.? To qualify as a last date of attendance for Return of Title IV purposes, an institution must demonstrate that a student participated in class or was otherwise engaged in an academically related activity, such as by contributing to an online discussion or initiating contact with a faculty member to ask a course-related question. Per 668.173 Refund reserve standards. A. In accordance with procedures established by the Secretary or FFEL Program lender, an institution returns unearned title IV, HEA program funds timely if? 1) The institution deposits or transfers the funds into the bank account it maintains under ?668.163 no later than 45 days after the date it determines that the student withdrew; 2) The institution initiates an electronic funds transfer (EFT) no later than 45 days after the date it determines that the student withdrew; 3) The institution initiates an electronic transaction, no later than 45 days after the date it determines that the student withdrew, that informs an FFEL lender to adjust the borrower?s loan account for the amount returned; or 4) The institution issues a check no later than 45 days after the date it determines that the student withdrew. An institution does not satisfy this requirement if? i. The institution?s records show that the check was issued more than 45 days after the date the institution determined that the student withdrew; or ii. The date on the canceled check shows that the bank used by the Secretary or FFEL Program lender endorsed that check more than 60 days after the date the institution determined that the student withdrew. Identified Condition: Summary No. Identified Condition Campus A. B. Incorrect Calculation of Return of Title IV Funds Untimely Notification of Grant Overpayment to Students and Secretary West Los Angeles College Los Angeles Southwest College Los Angeles Trade Technical College C. Distance Education Courses - Lack of Formal Process to Determine Accuracy of Student Withdrawal Date Los Angeles City College East Los Angeles College Los Angeles Harbor College Los Angeles Mission College Los Angeles Pierce College Los Angeles Southwest College Los Angeles Trade Technical College Los Angeles Valley College West Los Angeles College Description A. Incorrect Calculation of Return of Title IV Funds West Los Angeles College We noted 1 of 15 students selected for return of Title IV funds testwork from the population of students who had withdrawn, dropped out, or never began attendance that had an incorrectly determined withdrawal date in Summer 2022, the effect of which decreased the amount due from school by $681. B. Untimely Notification of Grant Overpayment to Students and Secretary Los Angeles Southwest College We noted that 2 of 15 students selected for compliance testwork were notified beyond 30 days from the date of the institution?s determination that the student withdrew and owed overpayments as a result of the students? withdrawal. The required notification was submitted to both students 11 days after the institution?s determination date. Los Angeles Trade Technical College We noted that 1 of 15 students selected for compliance testwork was never provided with a Post Withdrawal Disbursement notification. Consequently, no disbursement was made to the student. C. Distance Education Courses - Lack of Formal Process to Determine Accuracy of Student Withdrawal Date For distance education (DE) courses, we noted that the withdrawal date used in the calculation of return to Title IV funds is the actual date the student initiated the withdrawal from the course in the system. The District does not currently have a formal process in place to monitor a student?s active participation in an online class and engagement in academic activities related to a DE course in order to determine the reasonableness and accuracy of the student?s withdrawal date in the system. Causes and Effect: A. Incorrect Calculation of Return of Title IV Funds The incorrect calculation of Return of Title IV (R2T4) funds was caused by human error. Staff failed to create the R2T4 worksheet timely, which could result in disciplinary action taken by the U.S. Department of Education. B. Untimely Notification of Grant Overpayment to Students and Secretary Untimely notification of grant overpayment to students and secretary was caused by human error. FA Technicians failed to send overpayment notifications timely, which may result in untimely return of unearned Title IV funds. Untimely notifications and untimely result of Title IV aid can result in institutional liability and disciplinary action taken by the U.S. Department of Education C. Distance Education Courses - Lack of Formal Process to Determine Accuracy of Student Withdrawal Date The calculation of return to Title IV funds is a complex manual process. An incorrect calculation can result in institutional liability and/or disciplinary action taken by the U.S. Department of Education. Questioned Costs: A. Incorrect Calculation of Return of Title IV Funds See schedule of findings and Questioned Costs The District has a known net overstatement of the amount due from the student of $108 and known net understatement of the amount due from District of ($457). The projected total net understatement of amounts due from both the student and District is $2,358 as follows: See schedule of findings and Questioned Costs This is computed by dividing the errors found in samples per term (Summer term ? net understatement $350 and Fall/Spring terms ? net understatement $0 over the total Pell awards disbursed in the sample size per term (Summer term - $31,869 and Fall/Spring terms - $83,972) multiplied by the total Pell awards disbursed for the identified colleges per term (Summer term - $214,918 and Fall/Spring terms - $3,097,004). The computation is made on a per-term basis on a campus level and not on a district-wide level. The District has a known net overstatement of the post-withdrawal disbursement by $6. Not all students accept post-withdrawal disbursements. As such, questioned cost is not extrapolated. B. Untimely Notification of Grant Overpayment to Students and Secretary Refer to item A. above. C. Distance Education Courses ? Lack of Formal Process to Determine Accuracy of Student Withdrawal Date None. Recommendation: We recommend that the District implement additional controls at the course instructor level to effectively monitor student participation and engagement in academic activities related to DE courses in order for the course instructor to determine the reasonableness and accuracy of a student?s withdrawal date listed in the system. This will help ensure that the withdrawal date used in the calculation of return of title IV funds is accurate. Additionally, we recommend that the District evaluate and improve its existing process and control procedures related to the return of Title IV funds, including notification and return due date requirements. This will help ensure 1) that the returns of Title IV funds are accurately calculated and 2) compliance with the notification and return due date requirements, in accordance with the Uniform Guidance and the Code of Federal Regulation. . Views of Responsible Officials and Planned Corrective Actions: A. Incorrect Calculation of Return of Title IV Funds The student in question has an unusual circumstance because the college canceled the last enrolled class. The student was correctly identified as a withdrawal through an external student information system (SIS) query designed to identify students with unusual circumstances not currently identified by the R2T4 program. Unfortunately, the R2T4 worksheet was not manually added to the SIS due to an inadvertent oversight. We believe this is an isolated incident, but in order to automate the manual process, CFAU requested the Office of Information Technology to incorporate the external query logic into the R2T4 program. The worksheet has been manually added. Note that the internal controls have been substantially strengthened which has reduced the number of students impacted year-over-year. B. Untimely Notification of Grant Overpayment to Students and Secretary The college inadvertently failed to report the student overpayment to NSDLS timely. Due to SIS communication limitations with this last batch for the summer 2022 term, the District was unable to send the notification through SIS and had to send the R2T4 OP notification outside of SIS manually resulting in the late notification. C. Distance Education Courses ? Lack of Formal Process to Determine Accuracy of Student Withdrawal Date With regards to student withdrawal dates as it relates to DE courses, the District will provide communications to all faculty throughout the semester instructing them to assess individual student participation in the class and to exclude students from the class if prior to exclusion deadlines, or drop students if exclusion deadlines have passed. The communications will refer to the Academic Senate guidelines on regular and substantive interaction and use of authentic assessments to ensure that active participation is being effectively evaluated. Communications will be times around core deadlines for enrollment and financial aid processes. The DE Coordinators will be informed of the new standard to supplement the existing required and optional trainings currently provided to teaching faculty. This process will be implemented in Fall 2022. Personnel responsible for implementation: Steve Giorgi Position of responsible personnel: CFAU Financial Aid Manager Expected Date of Implementation: Fall 2022

Finding FA 2022 003: Special Tests and Provision: Gramm Leach Bliley Act Student Information Security Perform Regular Backup Restoration Tests, Improve Server and Network Security, Perform Timely Access Revocation and System Access Review, Strengthen Password Controls ? Optimize Account Lockout Configuration in SAP Database, and Establish and Document Approval of IT Policies and Procedures Federal Program Information Assistance Listing Number: ALN 84.007, 84.033, 84.063, 84.264, 93.364 Federal Program Name: Student Financial Assistance Cluster Federal Agency: U.S. Department of Education Passed Through Entity: N/A Federal Award Number: Various Federal Award Year: July 1, 2021, to June 30, 2022 Compliance Requirement: Special Tests and Provisions ? Gramm Leach Bliley Act ? Student Information Security Criteria or Specific Requirement: Per GLB Act Safeguards Rule, Title 16 CFR Part 314, institutions are required to develop, implement, and maintain a comprehensive information security plan that is written and describes their program to protect sensitive information. In addition to developing their own safeguards, institutions covered by the Rule are responsible for taking steps to ensure that their affiliates and service providers safeguard sensitive information in their care. As part of its plan, the institution must: a) Designate an employee or employees to coordinate its information security program. b) Identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of student information that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromises of such information, and assess the sufficiency of any safeguards in place to control these risks. At a minimum, such a risk assessment should include consideration of risks in each relevant area of operations, including: ? Employee training and management; ? Information systems, including network and software design, as well as information processing, storage, transmission and disposal; and ? Detecting, preventing and responding to attacks, intrusions, or other systems failures c) Design and implement information safeguards to control the risks you identify through risk assessment, and regularly test or otherwise monitor the effectiveness of the safeguards' key controls, systems, and procedures. d) Oversee service providers, by: ? Taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the student information at issue; and ? Requiring your service providers by contact to implement and maintain such safeguards. e) Evaluate and adjust your information security program in light of the results of the testing and monitoring required by paragraph (c) of this section; any material changes to your operations or business arrangements; or any other circumstances that you know or have reason to know may have a material impact on your information security program. Also, per sections 501 and 505 (b)(2) of the GLB Act, institutions are required to comply with standards set forth for developing, implementing, and maintaining reasonable administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of student information. This part applies to all sensitive information in the institution?s possession, regardless of whether such information pertains to individuals with whom the institution has a student relationship or pertains to the students of other financial institutions that have provided such information to the institution. The objectives of section 501(b) of the Act, and of this part, are to: (1) Ensure the security and confidentiality of student information; (2) Protect against any anticipated threats or hazards to the security or integrity of such information; and (3) Protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any student. Identified Conditions: A. Perform regular backup restoration tests The District performed a comprehensive Tabletop Disaster Recovery (DR) exercises for both SAP and SIS during the audit period. As part of the exercise, the DR Team simulated a scenario, fully supported with recovery considerations, steps, results, recovery challenges, and key recommendations to improve moving forward ? the exercise was also reviewed and approved by Vice Chancellor and Chief Information Officer. However, a key activity which is the actual backup restoration testing was not performed as part of the tabletop exercise or at any point during the audit period. B. Improve server and network security (Repeat Finding) Server and network security can be further improved. While the District has taken steps on securing systems, we noted the following: i. The latest SAP server vulnerability reports showed one (1) critical and one (1) high vulnerability which remains outstanding since its last scan on September 24, 2022. Based on the vulnerability scan policy, a reasonable effort shall be made to remediate high and critical vulnerabilities within 30 calendar days of discovery. The longer the vulnerability issues remain unaddressed, the higher the security risks that the District faces. ii. We noted that a critical security update for SIS Database Server released on August 9, 2022, was installed on October 16, 2022. Based on the District?s policy, patches designated as "Critical" by the manufacturer must be installed as soon as feasible without introducing instability or impacting service availability of production systems, and no later than thirty days after release. (Repeat finding) iii. We noted that the firewall rules included telnet which can lead to potential sniffing or eavesdropping attacks as the privileged credentials are sent in the network in clear text. This was subsequently removed by IT as of November 2022. C. Perform timely access revocation and system access review (Repeat Finding) Based on test of controls to verify that access of terminated employees are timely removed in Active Directory (AD), SAP, and SIS, we noted that out of the 30 terminated employees selected for testing: i. One (1) user was active in AD ii. Two (2) users were still active in SAP iii. 16 users were still active in SIS Moreover, while a privileged user access review is performed for AD, there is no review performed to check the validity of regular users in AD, and the validity and appropriateness of users in SAP and SIS. The purpose of properly establishing periodic user access review, coupled with limiting and monitoring administrative access within the system, is to ensure management?s understanding of the overall systems operation, its internal workflow requirements, and the segregation of duties within the systems that is required so that employees are not granted excessive, incompatible system access levels and workflow capabilities. D. Strengthen password controls ? optimize account lockout configuration in SAP Database Inspection of password configuration for SAP Database revealed that account lockout duration and threshold are set to unlimited. Based on the District?s password standard, account lockout duration and threshold should be set at 15 minutes and 10 invalid logon attempts, respectively. E. Establish and document approval of IT policies and procedures (Repeat finding) Inspection of IT-related policies and procedures showed the following documentations committed in the prior year, but are still in development as of November 2022: ? Risk Acceptance Process ? Portable Media Restriction Cause and Effect: A. Perform regular backup restoration tests Lack of proper restoration testing may hinder the District to recover its data completely and accurately. B. Improve server and network security Vulnerabilities in the systems may be exploited leading to malicious or unauthorized activities that could impact system and data integrity, or disclosure of confidential or sensitive information. C. Perform timely access revocation and system access review The risk of unauthorized access and security incidents or violations within the systems may occur. Furthermore, unauthorized or inappropriate access in the system increases the risk that unauthorized activities, including viewing and/or disclosure of confidential information, and fraudulent activities may be performed and not be detected and corrected on time. D. Strengthen password controls ? optimize account lockout configuration in SAP Database Inadequate security and password settings may lead to unauthorized access to the relevant IT environment that may result in the processing of unauthorized transactions or viewing of confidential information. E. Establish and document approval of IT policies and procedures With policies and procedures not yet fully reviewed, approved and implemented, the District may face the risk of obsolete operational procedures within the IT function which may result in processes and controls not being consistently performed across teams within the critical IT processes of the organization. As a result, tasks that must be performed regularly to ensure the proper utility of IT resources, protection and confidentiality of data, and system management measures may not be performed. Recommendation: A. Perform regular backup restoration tests Together with the DR tabletop exercises, we recommend that backup restoration tests should be performed at least once per year. Detailed testing schedules should be drafted based on DRP specifications and required restoration of the critical systems. Documentation of such tests should be maintained for full management awareness and approval. B. Improve server and network security To significantly improve security, we recommend that the District should revisit and strictly enforce appropriate and adequate vulnerability and patch management processes and controls. Standard protection measures might not provide ample security due to the rising cases of malware attacks. Proper patch management and updating operating systems of servers is necessary to combat various forms of cyber-attacks. C. Perform timely access revocation and system access review 1. We recommend that Management revoke the access of terminated employees and review the activities performed by those accounts after their termination date to ensure the validity and appropriateness of activities/transactions performed by these accounts, if any. 2. Concurrently, Management should improve the account termination procedures to ensure that access of terminated employees is timely revoked. 3. We also recommend that regular access review is performed and documented (for both regular and privilege users) to ensure that only valid and appropriate users remain in the system. The review may include, but are not limited to the following: a. Document management control over completeness and accuracy of the reports used in the review b. Define designated functions/roles to perform the review c. Monitor timeliness of the performance of the review and execution of corrective actions as a result of the review D. Strengthen password controls ? optimize account lockout configuration in SAP Database To further improve the security of SAP Database, we recommend for the District to align the current password configuration of SAP Database with the District?s password standards. E. Establish and document approval of IT policies and procedures Management should ensure that IT policies and procedures have been adequately developed and approved for the proper guidance and execution of IT functions. Committing the policies and procedures to writing would ensure a higher level of operational compliance and would provide grounds for the District?s action if operational procedures do not meet their objectives. A management review of all policies and procedures should be performed, at least, on an annual basis to ensure the capture of new changes and deletions of processes and technologies. Views of Responsible Officials and Planned Corrective Actions: A. Perform regular backup restoration tests i. The District is planning to complete a backup restoration by the end of Q1 2023. B. Improve server and network security i. The District has completed reviewing the changes needed to address the identified critical vulnerabilities. The vulnerability patch will be applied by the end of the 2022 calendar year. ii. The District completed the high vulnerability patch on November 10, 2022. iii. The District completed the critical patch updates outside of the identified 30 calendar day window due to minimizing substantial business impact. The patching periods fell under the critical business time period. Verbal approval was provided but the District will strictly follow procedure to obtain written authorization from the VC/CIO for delaying the patching. C. Perform timely access revocation and system access review i. The District has undergone a comprehensive discovery of our current environments and scoped out opportunities to optimize the deprovisioning synchronization. This scope has been incorporated into a public solicitation which completed early Fall 2022. Currently, the District awaits board authorization on issuing a professional services contract to begin the effort. The target is to initialize a project in January to automate deprovisioning synchronization of employees across the multiple EPR systems. Meanwhile, regular access reviews of SAP and SIS will be a separate process that will be regularly conducted. The target completion is early Q2 2023. D. Strengthen password controls ? optimize account lockout configuration in SAP Database i. The SAP Database accounts identified are system accounts that are not used for any type of interactive login. The password policy has been applied to interactive login accounts only thus these accounts were not included. The District is currently exploring the feasibility of applying these policies to the system accounts without impact to downstream automated processes. E. Establish and document approval of IT policies and procedures i. The LACCD Office of Information Technology Information Security Team has completed the initial draft of the Operational Protocol for Portable Media, which is currently under review. The OIT anticipates implementation will be completed by March 31, 2023. ii. An Operational Protocol for Risk Acceptance of SIS Permissions requires finalizing a formal Role-Based Access Control (RBAC) model for SIS. This process was delayed due to leadership changes in the Office of Educational Programs and Institutional Effectiveness (EPIE), the main process stakeholder, that occurred during the audit year. The OIT anticipates that the RBAC will be finalized and a Risk Acceptance Process for SIS permissions will be finalized and implemented by June 30, 2023. Personnel responsible for implementation: Carmen V. Lidz Position of responsible personnel: Vice Chancellor & Chief Information Officer

Finding FA 2022-004: Activities Allowed or Unallowed and Allowable Costs / Cost Principles: Expenditures Recorded In Incorrect Period Federal Program Information Federal Catalog Number: ALN 17.268 Federal Program Name: H-1B Job Training Grant Federal Agency: U.S. Department of Labor Passed Through Entity: N/A Federal Award Number: HG-33046-19-60-A-6 Federal Award Year: July 1, 2021 to June 30, 2022 Campus: West Los Angeles College Compliance Requirement: Activities Allowed or Unallowed and Allowable Costs / Cost Principles Criteria or Specific Requirement: Per Title 2, Part 200, Subpart E, ?200.403- Factors affecting allowability of costs, except where otherwise authorized by statute, costs must meet the following general criteria in order to be allowable under Federal awards: (e) Be determined in accordance with generally accepted accounting principles (GAAP), except, for state and local governments and Indian tribes only, as otherwise provided for in this part. Identified Condition: At West Los Angeles College, we noted that 2 out of 25 expenditures sampled were recorded in the incorrect period, for a total of $146,328. The expenditures were related to subrecipient payments that were incurred in fiscal year 2021 but were incorrectly recorded in fiscal year 2022. Causes and Effect: Per inquiry with the District, the cost is still within the program?s period of performance. The grant period is from July 15, 2019 to June 30, 2024. For the year ended June 30, 2021, the program team did not have a monitoring control in place to ensure expenses were recorded in the correct period. As a result, some expenses incurred near the end of the fiscal year are reported in the incorrect period. Questioned Costs: None. Recommendation: We recommend that the District implement a monitoring control that would identify expenditures incurred near the end of the fiscal year and ensure that they are recorded in the proper period. Views of Responsible Officials and Planned Corrective Actions: The Accounting Office will require all program personnel to complete a checklist of all expenditures incurred close to the end of the fiscal year in order to identify any expenditures that need to be accrued. Personnel responsible for implementation: Nyame-Tease Prempeh Position of responsible personnel: Assistant Director of Accounting Date of Implementation: July 1, 2023

Los Angeles City College Of the 15 students selected for eligibility testwork, we noted the following: - 1 student had an incorrectly calculated Federal Pell grant award, which resulted in a total understatement of the disbursement to the student by $48. The student was eligible to receive $394 yet received $2,380 in Fall 2020. The student was eligible to receive $3,172 yet received $1,138 in Spring 2021. - 1 student had an incorrectly calculated Federal Pell grant award, which resulted in an understatement of the disbursement to the student by $407. The student was eligible to receive $407 yet received none in Summer 2020. - 1 student had an incorrectly calculated Federal Pell grant award, which resulted in an understatement of the disbursement to the student by $724. The student was eligible to receive $724 yet received none in Summer 2021. - 1 student had an incorrectly calculated Federal Pell grant award, which resulted in an overstatement of the disbursement to the student by $2,779. The student was eligible to receive $394 yet received $3,173 in Fall 2020. - 1 student had an incorrectly calculated Federal Pell grant award, which resulted in an overstatement of the disbursement to the student by $796. The student was eligible to receive $394 yet received $1,190 in Spring 2021. Los Angeles Harbor College We noted 1 of the 20 students selected for eligibility had an incorrectly calculated Federal Pell grant award, which resulted in an understatement of the disbursement to the student by $407. The student was eligible to receive $407 yet received none in Summer 2020. Los Angeles Mission College Of the 15 students selected for eligibility testwork, we noted the following: - 1 student had an incorrectly calculated Federal Pell grant award, which resulted in an understatement of the disbursement to the student by $394. The student was eligible to receive $394 yet received none in Summer 2020. - 1 student had an incorrectly calculated Federal Pell grant award, which resulted in an overstatement of the disbursement to the student by $1,180. The student was eligible to receive $407 yet received $1,587 in Summer 2021. Los Angeles Southwest College Of the 15 students selected for eligibility testwork, we noted the following: - 1 student had an incorrectly calculated Federal Pell grant award, which resulted in an understatement of the disbursement to the student by $1,587. The student was eligible to receive $1,587 yet received none in Spring 2021. - The student had an incorrectly calculated Federal Pell grant award, which resulted in an understatement of the disbursement to the student by $599. The student was eligible to receive $2,397 yet received $1,798 in Spring 2021. Los Angeles Trade Technical College Of the 20 students selected for eligibility testwork, we noted the following: - 1 student had an incorrectly calculated Federal Pell grant award, which resulted in an overstatement of the disbursement to the student by $793. The student was eligible to receive $1,586 yet received $2,379 in Spring 2021. - 1 student had an incorrectly calculated Federal Pell grant award, which resulted in an overstatement of the disbursement to the student by $873. The student was eligible to receive $874 yet received $1,747 in Spring 2021. West Los Angeles College Of the 15 students selected for eligibility testwork, we noted the following: - 1 student had an incorrectly calculated Federal Pell grant award, which resulted in an understatement of the disbursement to the student by $1986. The student was eligible to receive $2,380 yet received $394 in Summer 2021. - 1 student had an incorrectly calculated Federal Pell grant award, which resulted in an understatement of the disbursement to the student by $394. The student was eligible to receive $394 yet received none in Summer 2020.

Of the 13 students selected for verification testwork at Harbor College, we noted 1 student with incorrect federal income tax paid information which resulted in an understatement of the expected family contribution (EFC) by $123 and an overpayment of Pell grant award disbursement by $200.

A. Incorrect Calculation of Return to Title IV Funds Los Angeles City College We noted 1 of 15 students selected for return of Title IV funds testwork from the population of students who had withdrawn, dropped out, or never began attendance that had an incorrectly determined withdrawal date in Fall 2020, the effect of which decreased the amount due from school by $201. Los Angeles Harbor College Of the 20 students selected for return of Title IV funds testwork from the population of students who had withdrawn, dropped out, or never began attendance, we noted the following: - 2 students had incorrect Total Aid Disbursement in Fall 2020, the effect of which did not result in questioned cost. - 1 student had an incorrectly determined withdrawal date in Fall 2020, the effect of which increased the amount of post-withdrawal disbursement by $69. - 1 student did not begin attendance in Fall 2020 yet received disbursement of $1,190, the effect of which increased the amount due from school by $111 and decreased the amount due from student by $796. Of the 20 students selected for return of Title IV funds testwork from the population of students who received Title IV assistance for which no return of Title IV funds was made, we noted the following: - 1 student had an incorrect Total Aid Disbursement in Fall 2020, the effect of which decreased the amount due from school by $118, decreased the amount due from student by $783 and increased the amount of post-withdrawal disbursement by $102. - 1 student had an incorrect Total Aid Disbursement in Spring 2021, the effect of which decreased the amount due from school by $114, decreased the amount due from student by $387 and increased the amount of post-withdrawal disbursement by $113. Los Angeles Pierce College We noted 2 of 15 students selected for return of Title IV funds testwork from the population of students who had withdrawn, dropped out, or never began attendance did not begin attendance in Summer 2021 yet were determined to be eligible to receive Title IV aid, the effect of which increased the post-withdrawal disbursements by $208 and $203, respectively. Los Angeles Southwest College Of the 15 students selected for return of Title IV funds testwork from the population of students who had withdrawn, dropped out, or never began attendance, we noted the following: - 1 student had an incorrectly determined withdrawal date in Fall 2020, the effect of which decreased the amount due from school by $80. - 1 student had an incorrectly determined withdrawal date in Summer 2021, the effect of which increased the amount of post-withdrawal disbursement by $87. We also noted 1 of 15 students selected for return of Title IV funds testwork from the population of students who received Title IV assistance for which no return of Title IV funds was made had an incorrectly determined total Title IV aid in Spring 2021, the effect of which decreased the amount of post-withdrawal disbursement by $614. Los Angeles Trade Technical College Of the 20 students selected for return of Title IV funds testwork from the population of students who had withdrawn, dropped out, or never began attendance, we noted the following: - 1 student had an incorrect calculation for the return of Title IV funds due to incorrectly determined withdrawal date in Spring 2021, the effect of which decreased the amount due from school by $94. - 1 student did not begin attendance in Spring 2021 yet was determined to be eligible to receive Title IV aid, the effect of which increased the amount of post-withdrawal disbursement by $453. - 1 student did not begin attendance in Spring 2021 yet received disbursement of $1,587, the effect of which decreased the amount due from student by $1,587. - 1 student did not begin attendance in Summer 2021 yet was determined to be eligible to receive Title IV aid, the effect of which increased the amount of post-withdrawal disbursement by $6. Los Angeles Valley College Of the 20 students selected for return of Title IV funds testwork from the population of students who had withdrawn, dropped out, or never began attendance, we noted the following: - 1 student had an incorrect calculation for the return of Title IV funds due to incorrectly determined withdrawal date in Fall 2020, the effect of which increased the post-withdrawal disbursement by $11. - 1 student had an incorrect calculation for the return of Title IV funds due to incorrectly determined withdrawal date in Fall 2020, the effect of which decreased the amount due from school by $53. - 1 student had an incorrect calculation for the return of Title IV funds due to incorrectly determined withdrawal date in Fall 2020, the effect of which decreased the amount due from student by $400 and increased the post-withdrawal disbursement by $793. - 1 student had an incorrect calculation for the return of Title IV funds due to incorrectly determined withdrawal date in Fall 2020, the effect of which decreased the amount due from student by $979. - 1 student did not begin attendance in Fall 2020 yet determined to be eligible to receive Title IV aid, the effect of which increased the post-withdrawal disbursement by $4. - 1 student had an incorrect calculation for the return of Title IV funds due to incorrectly determined withdrawal date in Spring 2021, the effect of which decreased the amount due from student by $1,374. West Los Angeles College Of the 15 students selected for return of Title IV funds testwork from the population of students who had withdrawn, dropped out, or never began attendance, we noted the following: - 1 student had an incorrect calculation for the return of Title IV funds due to incorrectly determined withdrawal date in Fall 2020, the effect of which did not result to questioned cost. - 1 student did not begin attendance in Spring 2021 yet received disbursement of $407, the effect of which decreased the amount due from student by $407. - 1 student did not begin attendance in Summer 2021 yet was determined to be eligible to receive Title IV aid, the effect of which increased the post-withdrawal disbursement by $11. B. Untimely Notification of Grant Overpayment to Students and Secretary Los Angeles City College Of the 15 students selected for compliance testwork, we noted the following: - 1 student was notified beyond 30 days from the date of the institution?s determination that the student withdrew and owed an overpayment as a result of the student?s withdrawal. The required notification was submitted 69 days after the institution?s determination date. - 1 student that owed an overpayment as a result of the student?s withdrawal was not notified and was not referred to the Secretary of the Department of Education via NSLDS as required. - 1 student that owed an overpayment as a result of the student?s withdrawal was not referred to the Secretary of the Department of Education via NSLDS as required. West Los Angeles College We noted that 1 of 15 students selected for compliance testwork was notified beyond 30 days from the date of the institution?s determination that the student withdrew and owed overpayments as a result of the student?s? withdrawal. The required notification was submitted 198 days after the institution?s determination date. This same student was also not referred to the Secretary of the Department of Education via NSLDS as required. C. Untimely Determination of Withdrawal Date Los Angeles Valley College We noted 2 of 20 students selected for compliance testwork that had the withdrawal dates determined beyond 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the students withdrew, or (3) educational program from which the students withdrew in Fall 2020. The required withdrawal date determinations were made after 58 days. Los Angeles Southwest College We noted 1 of 15 students selected for compliance testwork that had the withdrawal date determined beyond 30 days after the end of the earlier of the (1) payment period or period of enrollment, (2) academic year in which the student withdrew, or (3) educational program from which the student withdrew in Summer 2021. The required withdrawal date determination was made after 173 days. D. Untimely Payment of Post-Withdrawal Disbursement Los Angeles City College We noted 1 of 15 students selected for compliance testwork accepted a post-withdrawal disbursement and received the payment beyond 45 days from the date of the institution?s determination that the student withdrew. The disbursement was made 55 days after the date of the institution?s determination that the student withdrew.

Los Angeles Trade Technical College We noted 1 of the 4 monthly SAS reconciliations selected for compliance testwork was not reviewed for reasonableness and accuracy. West Los Angeles College We noted 1 of 15 students selected for compliance testwork that had a disbursement date of 3/25/2021 which was inaccurately reported as 10/1/2020 and 2/9/2021 to the DLSS via the COD report.

We noted 1 of 20 students selected for compliance testwork at Los Angeles Trade Technical College had a disbursement date of 4/21/2021 which was inaccurately reported as 5/10/2021 via the Common Origination and Disbursement (COD) report.

In performing testwork over the enrollment reporting, we noted the following: East Los Angeles College Of the 15 students selected for compliance testwork, we noted: - 1 student had an incorrect effective date reported. - 7 students had status changes that were reported late to the NSLDS. This late reporting ranged from 3 to 17 days. Los Angeles City College Of the 15 students selected for compliance testwork, we noted 3 students had status changes that were reported late to the NSLDS. This late reporting ranged from 1 to 18 days. Los Angeles Harbor College Of the 20 students selected for compliance testwork, we noted 2 students had status changes that were reported late to the NSLDS. This late reporting ranged from 1 to 14 days. Los Angeles Pierce College Of the 15 students selected for compliance testwork, we noted 1 student had a status change that was reported late to the NSLDS. This late reporting was 101 days late. Los Angeles Trade Technical College Of the 20 students selected for compliance testwork, we noted 2 students had incorrect effective dates reported. Los Angeles Valley College Of the 20 students selected for compliance testwork, we noted the following: - 2 students had status changes that were reported late to the NSLDS. This late reporting was 5 days late. - 2 students had inaccurately reported effective dates for the programs the students attended. - 2 students had no support for the reported Published Program Lengths of the programs the students attended. - 4 students had no support for the reported Classification of Instructional Programs (CIP) codes of the programs the students attended.

Los Angeles Harbor College Of the 21 students selected for compliance testwork, we noted 1 student did not have retained repayment record as required. Los Angeles Trade Technical College Of the 22 students selected for compliance testwork, we noted 4 students did not have retained repayment records as required. Los Angeles Valley College Of the 25 students selected for compliance testwork, we noted 4 students did not have retained repayment record as required.

A. Update the Disaster Recovery Plan (DRP) and perform regular Disaster Recovery (DR) and backup restoration tests The District established the Administrative Procedure 3724 Information Technology ? Disaster Recovery (DRP) to document the strategy to support and recover critical information and systems in the event of a disaster. During our review, the DRP was in draft state and was subsequently reviewed and approved on December 21, 2021. The following observations were noted for the DRP to be comprehensive and effective: 1. The application tiering or criticality was based on an internal risk assessment performed by the Office of Information Technology (IT). The criticality of the systems should be driven by a business impact assessment (BIA) performed by relevant stakeholders, such as system users, process owners, and risk management, among others, to ensure that all critical systems are identified, and appropriate strategies are developed and tested. 2. All the necessary supporting infrastructure and security systems, were not included in the DRP, such as network switches, routers, firewall, network and endpoint security systems relevant to ensure the availability and security of the critical systems. 3. The criteria necessary for measuring effectiveness of the DRP were not documented in the DRP. The criteria should include recovery time objective and recovery point objective, among others, aligned with the stakeholder requirements in the BIA. In addition, the plan to resume to normal operations after the disaster is not documented in the DRP. 4. Recovery and restoration of SAP and SIS have not been effectively tested. DRP testing for SAP and authentication systems has not yet been performed while testing for SIS has been partially performed. On June 25, 2020, IT performed restoration of all components of SIS using the backup from a non-production environment with a copy of the full production data. While the SIS restoration test provided a way to measure the effectiveness of the strategy and learn about improvement areas, its effectiveness cannot be completely ascertained unless the actual secondary production system was restored. Moreover, DRP testing did not involve relevant business stakeholders to test system functionalities and data integrity, and sign-off on the successful completion of the DRP testing. Lastly, the DRP test did not include the plan to resume to normal operations following the disaster. B. Improve server and network security Server and network security can be further improved. While the District has taken steps on securing systems, we noted the following: 1. There were 3 SAP servers with Windows 2008 operating system which has an end of life and support last 1/14/2020. This was subsequently remediated by IT as of January 21, 2022. 2. During the audit, the vulnerability report for SAP servers showed 9 critical and 11 high severity vulnerabilities that were outstanding for more than 30 days after it was first discovered. Based on the vulnerability scan policy, reasonable effort will be made to remediate high and critical vulnerabilities within 30 calendar days of discovery. The longer the vulnerability issues remain unaddressed, the higher the risk that these vulnerabilities can be exploited, and the systems compromised. The IT was able to remediate the vulnerabilities and to date, only 3 vulnerabilities remain outstanding. 3. We noted that the latest SIS and SAP servers? patches as of October 2021 are applied in August and May 2021, respectively. Based on policy, new patches should be applied within one month of release by the manufacturer. 4. We noted that one of the firewall rules allowed traffic through telnet that allows attackers to use sniffing or eavesdropping attacks, thereby exposing privileged credentials sent in clear text through the network. C. Enhance password policy and strengthen password controls There were no established password security standards governing all password settings for AD, SAP, and SIS. Standards for the following password settings should be adequately documented and enforced: ? Minimum password length ? Password complexity ? Maximum password age ? Minimum password age ? Password history ? Idle time ? Account lockout duration ? Account lockout threshold ? Reset account lockout counter after In addition, all password settings for AD, SIS, and SAP could be improved through assessment and alignment with applicable industry security baselines deemed appropriate by the District. D. Document approval of IT process documentation Evidence of formal approval for IT protocols were not existing at the time of the audit. The use of protocols serves as guidelines to help ensure the technology-enabled components and processes of the organization will function as intended and ensure proper succession planning, and training of future IT personnel. In addition, up to date process documentation enables proper IT governance. It was noted that the following process documentation committed in the prior year plan of action and milestones (POAM) have not yet been approved: ? Risk Acceptance Process ? User Access Review ? Portable Media Restriction ? Technology Hardening Standards The IT signified that these are scheduled to be completed in 2022. E. Perform timely access revocation and system access review Based on testwork to verify existence of terminated employees in Active Directory (AD), SAP, and SIS, we noted that out of the 30 terminated employees selected for testwork: i. One user was active in AD ii. 18 were still active in SAP iii. 28 were still active in SIS, of which 13 logged into the system after their termination date Moreover, while a privilege user access review is performed for AD, there is no regular and documented review to ensure that all regular users of AD, SAP and SIS are valid. The purpose of properly establishing periodic user access review, coupled with limiting and monitoring administrative access within the system, is to ensure management?s understanding of the overall systems operation, its internal workflow requirements, and the segregation of duties within the systems that is required so that employees are not granted excessive, incompatible system access levels and workflow capabilities. F. Document approval of HR process documentation Evidence of formal approval for HR guides and protocols were not existing at the time of the audit. The use of process documentation serves as management guidelines to help ensure the processes of the organization will function as intended and ensure proper succession planning, and training of future HR personnel. In addition, up to date HR process documentation enable proper HR governance. It was noted that the following process documentation have not yet been approved: ? Employee Separations ? Death of Employee ? Completion of Assignment ? Open Ended Adjunct Assignment ? Job Change

In performing reporting compliance testwork, we noted the following campuses posted their student aid reports on their respective websites beyond the required 10 day timeframe as follows: Campus Quarter Ended Due Due Date Date Posted Number of days late East Los Angeles College D e c e m b e December 31, 2020 June 30, 2021 January 10, 2021 July 10, 2021 January 20, 2021 July 12, 2021 10 days 2 days Los Angeles Trade Tech College June 30, 2021 July 10, 2021 July 13, 2021 3 days Los Angeles Valley College December 31, 2020 June 30, 2021 January 10, 2021 July 10, 2021 January 19, 2021 July 12, 2021 9 days 2 days

In performing allowable costs testwork over payroll at Los Angeles Harbor College, we noted that for 3 of 25 payroll expenditure transactions selected, there were no supporting documents that would show evidence of allowability of these payroll expenditures charged to the grant.

Identified Condition: East Los Angeles College Of the 15 students selected for eligibility testwork, we noted 1 student that had an incorrectly calculated Federal Pell grant award, which resulted in an understatement of the disbursement to the student by $525. The student was eligible to receive $525, yet the student received none in Summer 2019. Los Angeles Mission College We noted 1 of 15 students selected for eligibility testwork that had an incorrectly calculated Federal Pell grant award, which resulted in an understatement of the disbursement to the student by $513 and a decrease in post-withdrawal disbursement by $8. The student was eligible to receive $513, yet the student received none in Summer 2019. The student was inadvertently excluded from the return to Title IV funds population of Summer 2020 which resulted in a decrease in post-withdrawal disbursement by $8. Los Angeles Pierce College We noted 1 of 15 students selected for eligibility testwork that had an incorrectly calculated Federal Pell grant award, which resulted in an understatement of the disbursement to the student by $1,005. The student was eligible to receive $1,549, yet the student received $544 in Summer 2019. Los Angeles Southwest College Of the 20 students selected for eligibility testwork, we noted the following: ? 1 student had an incorrectly calculated Federal Pell grant award, which resulted in an understatement of the disbursement to the student by $1,524. The student was eligible to receive $1,524, yet received none in Summer 2019. ? 1 student had an incorrectly calculated Federal Pell grant award, which resulted in an understatement of the disbursement to the student by $762. The student was eligible to receive $1,524, yet received $762 in Summer 2019. Los Angeles Trade Technical College Of the 15 students selected for eligibility testwork, we noted the following: ? 2 students had an incorrectly calculated Federal Pell grant award, which resulted in a total understatement of the disbursement to the students by $1,114. The students were eligible to receive $557 each, yet received none in Summer 2019. ? 1 student had an incorrectly calculated Federal Pell grant award, which resulted in an overstatement of the disbursement to the student by $1,548. The student was eligible to receive $1,549, yet received $3,097 in Spring 2020. West Los Angeles College Of the 20 students selected for eligibility testwork, we noted the following: ? 1 student had an incorrectly calculated Federal Pell grant award, which resulted in an understatement of the disbursement to the student by $1,549. The student was eligible to receive $1,549, yet received ? 1 student had an incorrectly calculated Federal Pell grant award, which resulted in an understatement of the disbursement to the student by $1,524. The student was eligible to receive $1,524, yet received none in Summer 2019. none in Summer 2019. ? 1 student had an incorrectly calculated Federal Pell grant award, which resulted in an understatement of the disbursement to the student by $544. The student was eligible to receive $544, yet received none in Summer 2019.

Identified Condition: Los Angeles Southwest College We noted 1 of 20 students selected for compliance testwork at Los Angeles Southwest College, that had a disbursement date of 4/21/20 which was inaccurately reported as 2/11/20 and was reported late to the DLSS via the COD report. The required report was submitted 20 days after the disbursement was made to the student. West Los Angeles College Of the 20 students selected for compliance testwork, we noted the following: ? 1 student?s disbursements made on 1/17/20 and 2/21/20 were reported inaccurately as 10/1/19 and 2/11/20, respectively. The disbursement record on 2/21/20 was also reported late to the DLSS via the COD report. The required reports were submitted 31 days after the respective disbursements were made to the student. ? 1 student?s disbursements made on 1/14/20 and 2/12/20 were reported inaccurately as 10/1/19 and 2/11/20, respectively. The disbursement record on 2/12/20 was also reported late to the DLSS via the COD report. The required report was submitted 40 days after the disbursement was made to the student. ? 1 student?s disbursements made on 12/11/19, 1/14/20, and 2/12/20 were reported inaccurately as 10/1/19, 10/1/19, and 2/11/20, respectively. The disbursement record on 2/12/20 was also reported late to the DLSS via the COD report. The required reports were submitted 40 days after the respective disbursements were made to the student.

A Incorrect Calculation of Return of Title IV Funds East Los Angeles College We noted 1 of 15 students selected for return of Title IV funds testwork from the population of students who received Title IV assistance, for which no return of Title IV funds was made that had an incorrectly determined Total Title IV Aid in Spring 2020, the effect of which would increase the amount of post-withdrawal disbursement by $29. Los Angeles City College Of the 25 students selected for return of Title IV funds testwork from the population of students who had withdrawn, dropped out, or never began attendance, we noted the following: ? 1 student had incorrect Total Days information in Spring 2020, the effect of which did not result in questioned cost due to grant protection. ? 1 student had incorrect Total Aid Disbursement information in Summer 2020, the effect of which did not result in questioned cost due to grant protection. ? 1 student was inadvertently excluded from the return of Title IV funds population of students who had withdrawn, dropped out, or never began attendance in Summer 2020. This resulted in a decrease of post-withdrawal disbursement by $23. ? 1 student had an incorrectly determined withdrawal date in Summer 2020, the effect of which resulted in to decrease in the post-withdrawal disbursement by $278. Los Angeles Mission College We noted 1 of 15 students selected for return of Title IV funds testwork from the population of students who had withdrawn, dropped out, or never began attendance that had an incorrect Total Aid Disbursement in Spring 2020, the effect of which would increase the amount due from the student by $812 and decrease the amount of post-withdrawal disbursement by $68. Los Angeles Pierce College Of the 15 students selected for return of Title IV funds testwork from the population of students who had withdrawn, dropped out, or never began attendance, we noted the following: ? 1 student had incorrect Total Aid Disbursement information in Fall 2019, the effect of which would decrease the amount due from the institution by $105, decrease the amount due from the student by $231, and increase the amount of post-withdrawal disbursement by $306. ? 1 student was inadvertently excluded from the return of Title IV funds population of students who had withdrawn, dropped out, or never began attendance in Fall 2019. This resulted in a decrease of post-withdrawal disbursement by $314. Los Angeles Southwest College Of the 25 students selected for return of Title IV funds testwork from the population of students who had withdrawn, dropped out, or never began attendance, we noted the following: ? 1 student had an incorrect Total Aid Disbursement and Total Grant Aid information in Fall 2019, the effect of which did not result in questioned cost due to grant protection. This resulted in an untimely return of unearned Title IV funds due to incorrect disbursement and aid information. ? 1 student had an incorrect status at the withdrawal date in Fall 2019, the effect of which did not result in questioned cost due to grant protection. We also noted 1 of 25 students selected for return of Title IV funds testwork from the population of students who received Title IV assistance, for which no return of Title IV funds was made that had an incorrectly determined withdrawal date in Summer 2020, the effect of which would decrease the post-withdrawal disbursement by $287. Los Angeles Trade Technical College Of the 15 students selected for return of Title IV funds testwork from the population of students who had withdrawn, dropped out, or never began attendance, we noted the following: ? 1 student had an incorrect calculation for the return of Title IV funds due to incorrectly determined Total Title IV Aid in Spring 2020, the effect of which would decrease the amount due from the institution by $250 and the amount due from the student by $139. ? 1 student had an incorrect calculation for the return of Title IV funds due to incorrectly determined Total Title IV Aid in Spring 2020, the effect of which would increase the amount of post-withdrawal disbursement by $2. West Los Angeles College Of the 25 students selected for return of Title IV funds testwork from the population of students who had withdrawn, dropped out, or never began attendance, we noted the following: ? 1 student had an incorrectly determined status at the withdrawal date in Fall 2019, the effect of which would increase the amount due from the institution by $118 and would decrease the post-withdrawal disbursement by $328. The student accepted the post-withdrawal disbursement and received the payment beyond 45 days from the date of the institution?s determination that the student withdrew in Fall 2019 as a result of the error. ? 1 student had an incorrectly determined status at the withdrawal date in Fall 2019, the effect of which would increase the amount due from the student by $1,549. ? 1 student had an incorrectly determined withdrawal date in Spring 2020, the effect of which did not result in questioned cost due to grant protection. ? 1 student had an incorrectly determined withdrawal date in Spring 2020, the effect of which would decrease the amount due from the student by $992 and increase the post-withdrawal disbursement by $14. As a result of this error, the student was notified beyond 30 days from the date of the institution?s determination that the student withdrew and owed overpayments and the overpayment was not referred to the Secretary of the Department of Education via NSLDS as required. ? 1 student had an incorrectly determined withdrawal date in Summer 2020, the effect of which would decrease the post-withdrawal disbursement by $255. We also noted 1 of 25 students selected for return of Title IV funds testwork from the population of students who received Title IV assistance, for which no return of Title IV funds was made that had an incorrectly determined status at the withdrawal date in Spring 2020, the effect of which would decrease the post-withdrawal disbursement by $459.

West Los Angeles College In performing reporting compliance testwork, we noted the following line items in Part V (Federal Work-Study Program) of the Fiscal Year 2020 FISAP report that did not agree to the related supporting documentation

Identified Condition: Los Angeles Pierce College We noted 1 of 15 students selected for compliance testwork that was reported late and has inaccurate disbursement dates via the Common Origination and Disbursement (COD) report. The disbursements made on 11/12/19, 11/14/19, 2/3/20, and 2/12/20 were reported as 2/12/20, 8/28/19, 8/28/19, and 4/21/20, respectively. The disbursement records were reported after 22 to 176 days or were late by 7 to 201 days from the actual dates of disbursement made to the student. Los Angeles Southwest College We noted 1 of 20 students selected for compliance testwork that was reported late and has an inaccurate disbursement date via the Common Origination and Disbursement (COD) report. The disbursement was made on 5/18/20 and was reported on 6/8/20, which was 29 days after the actual date of disbursement made to the student. The submittal was late by 14 days.

Identified Condition: Los Angeles City College We noted 1 of 20 students selected for compliance testwork that had an incorrect calculation of COA. The tuition fee budgeted for the student was $4,055. However, the tuition fee amount used in the calculation of the student?s COA was $4,277. Therefore, the COA and unmet need were overstated by $222. The student?s awards exceeded the amount that would have been allowed had the unmet need been properly calculated by $13. East Los Angeles College We noted 1 of 20 students selected for compliance testwork that had an incorrect calculation of financial resources reasonably available. The total awards available for the student was $8,289. However, the amount used in the calculation of the student?s financial resources reasonably available was $6,197. The unmet need was overstated by $2,093. West Los Angeles College Of the 20 students selected for compliance testwork, we noted the following: ? 1 student had an incorrect calculation of COA. The tuition fee budgeted for the student was $4,055. However, the amount used in the calculation of the student?s COA was $4,277. The COA and unmet need were overstated by $222. ? 1 student had an incorrect calculation of COA. The tuition fee budgeted for the student was $4,055. However, the amount used in the calculation of the student?s COA was $4,888. The COA and unmet need were overstated by $833.

Identified Condition: In performing testwork over the enrollment reporting, we noted the following: East Los Angeles College Of the 15 students selected for compliance testwork, we noted 1 quarter-time student that was reported as a full-time student. Los Angeles City College Of the 20 students selected for compliance testwork, we noted: ? 2 quarter-time students were reported as full-time students. ? 3 students had inaccurately reported Published Program Lengths for the programs the students attended. Los Angeles Pierce College Of the 15 students selected for compliance testwork, we noted 1 less-than-half-time student that was reported as a half-time student.

Identified Conditions: A. Outdated IT Policies The District?s existing Administrative Regulations related to IT remain outdated. However, we noted that work to strengthen identified NIST 800-171 controls is underway. The following Plan of Action and Milestones (POAM) items and their respective timelines were identified: a) POAM Items to be Completed in 2020 ? Data Governance Committee ? completed ? RBAC Refresh ? completed ? Functional Security Training ? initial training completed on January 28, 2021 ? Risk Acceptance Process ? in progress and to be completed in Q1 2021 ? User Access Review ? to be completed in Q1-Q2 2021 b) POAM Items to be Completed in 2021 ? Data Classification Standard ? Portable Media Restriction ? Technology Hardening Standards ? Security Awareness Training ? Log Aggregation and Alerting ? HR Termination/Job Change Process ? MFA for Privileged/Remote Access ? Annual Security Control Review ? Consistent Maintenance Activities ? Change Management Process ? Review Legacy Technology Practices c) POAM Item to be Completed in 2022 ? Secondary Operating Site B. Inadequate Systems Hardening to Reduce Security Risk While the District has taken steps on technology hardening, we noted the following areas for improvement: a) While annual vulnerability and PCI scanning has been noted to be completed, annual penetration testing has yet to be conducted. (partial repeat finding) b) While we noted no issues concerning the current state of the primary and secondary servers used for Student Information Systems (SIS), we also noted that the operating systems on some non-SIS servers, virtual machines, desktop, and mobile devices do not have the latest version or are not up to date thereby making them vulnerable to operational issues and security concerns. (repeat finding) Corrective plan is in place for this. c) We noted that the latest SIS and SAP server vulnerability reports identified issues, some of which were critical or high in severity. While some of the critical or high severity issues were remediated during the period in scope, some are still waiting to be remediated in March and April 2021. The longer the vulnerability issues remain unaddressed, the higher the security risks that the District faces. d) While a Disaster Recovery Testing was conducted during the year based on current business requirements, this testing was not based on an official Disaster Recovery Plan since the Administrative Regulation covering Disaster Recovery has not yet been updated. Moreover, we also noted that Business Continuity and Emergency Preparedness for College is outdated and still in draft. e) We noted that the District was not able to perform timely deletion/disabling of some user accounts pertaining to separated/terminated employees. As a response to this, the District has created a corrective action plan for reviewing the Human Resources (HR) separation business process and policy development. The said plan includes the following: ? Meeting with IT and HR to study the existing processes, separation actions, and identify programming points preventing the actions from being disabled or deleted ? Reviewing HR guides and protocols on: o Employee Separations o Death of Employee Adjunct Hiring o Additional Assignments o Mass Separations ? Reviewing Employee Sub-Groups ? Training campus level personnel on review of separation codes and assignment conclusion

In performing reporting compliance testwork, we noted the following colleges posted their student aid reports on their respective websites beyond the required 30 day timeframe. The website posting must be within 30 days of the date the institution received its allocation from the Department, as indicated by the institution?s ?Certification and Agreement? to the Department.

Identified Condition In performing allowable costs testwork over payroll at Los Angeles Harbor College, we noted that for all 3 of the payroll expenditures selected, there was not appropriate supporting documents for evidence of allowability of these payroll expenditures charged to the grant.

Identified Condition In performing allowable costs testwork over payroll-related expenditures charged to the grant, we noted that for 9 out of 25 employees sampled, there was no timesheet documentation evidencing the time and effort expended on the program. We noted that these 9 employees were identified in the contract budget as authorized to charge time to the program fund.

East Los Angeles College Of the 30 students selected for eligibility test work, we noted the following: ? 1 student that had an incorrectly calculated Federal Pell grant award, which resulted in an overstatement of the disbursement to the student by $25. The student was eligible to receive $1,063, yet the student received $1,088 during the academic year. ? 1 student that had an incorrectly calculated Federal Pell grant award, which resulted in an understatement of the disbursement to the student by $13. The student was eligible to receive $544, yet the student received $532 in Summer 2018. ? 1 student that had an incorrectly calculated Federal Pell grant award, which resulted in an overstatement of the disbursement to the student by $762. The student was eligible to receive $2,286, yet the student received $3,048 in Fall 2018. Los Angeles Mission College Of the 30 students selected for eligibility test work, we noted the following: ? 1 student that had an incorrectly calculated Federal Pell grant award, which resulted in an overstatement of the disbursement to the student by $381. Based on the estimated family contribution (EFC), the student was ineligible to receive a Pell grant award, yet the student received $381 in Fall 2018. ? 1 student that had an incorrectly calculated Federal Pell grant award, which resulted in an overstatement of the disbursement to the student by $937. The student was eligible to receive $475, yet the student received $1,412 in Spring 2019. ? 1 student that had an incorrectly calculated Federal Pell grant award, which resulted in an understatement of the disbursement to the student by $532. The student was eligible to receive $532, yet the student received none in Summer 2019. ? 1 student that had an incorrectly calculated Federal Pell grant award, which resulted in an understatement of the disbursement to the student by $980. The student was eligible to receive $1,524, yet the student received $574 in Spring 2019. Los Angeles Pierce College Of the 30 students selected for eligibility test work, we noted 1 student that had an incorrectly calculated Federal Pell grant award, which resulted in an understatement of the disbursement to the student by $544. The student was eligible to receive $544, yet the student received none in Summer 2019. Los Angeles Trade Technical College Of the 14 students selected for eligibility test work, we noted 1 student that had an incorrectly calculated Federal Pell grant award, which resulted in an overstatement of the disbursement to the student by $762. The student was eligible to receive $2,285, yet the student received $3,047 in Spring 2019.

Of the 30 students selected for eligibility testwork at each college, we noted the following number of students that received disbursements prior to receiving a formal notification of disbursement from the respective college: ? East Los Angeles College ? 7 out of 30 students ? Los Angeles Mission College ? 5 out of 30 students ? Los Angeles Pierce College ? 3 out of 30 students

We reviewed all FSEOG student recipients (total of 9,534 students) at West Los Angeles College and noted 2 students who were not recipients of Federal Pell Grants. These students should have been included only in the second selection group after all FSEOG awards had been initially awarded to Federal Pell Grant recipients for not all Federal Pell Grant recipients in the campus had received FSEOG for the current award year.

East Los Angeles College Of the 30 students selected for verification test work, we noted 1 student with an incorrect Adjusted Gross Income (AGI). This resulted in an understatement of Expected Family Contribution (EFC) by $54, but did not have an impact on the student?s Federal Pell Grant award. Los Angeles Pierce College Of the 30 students selected for verification test work, we noted 1 student with an incorrect number of household members, which resulted in an understatement of Expected Family Contribution (EFC) by $1,116. This resulted in an overstatement of Federal Pell Grant disbursement by $1,081.

Of the 30 students selected for compliance test work at Los Angeles Mission College, we noted that 1 student was reported late to the DLSS via the COD report. The required report was submitted 42 days after the disbursement was made to the student and, therefore, the submission was 27 days late.

A. Incorrect Calculation of Return to Title IV Funds East Los Angeles College Of the 30 students selected for return of Title IV funds test work from the population of students who had withdrawn, dropped out, or never began attendance, we noted the following: ? 1 student that had an incorrectly calculated amount of Title IV assistance earned, the effect of which would decrease the amount due from the student by $762. ? 1 student that had an incorrectly calculated amount of Title IV assistance earned, the effect of which would decrease the amount due from the student by $1,524. The college has already returned the money after the fact, thus no questioned cost. Los Angeles Harbor College Of the 5 students selected for return of Title IV funds test work from the population of students who received Title IV assistance, for which no returns of Title IV funds were made, we noted the following: ? 1 student that had an incorrectly calculated amount of Title IV assistance earned, the effect of which would increase the amount due from the student by $219. ? 1 student that had an incorrectly calculated amount of Title IV assistance earned, the effect of which would increase the amount due from the student by $762. Los Angeles Mission College Of the 30 students selected for return of Title IV funds test work from the population of students who had withdrawn, dropped out, or never began attendance, we noted the following: ? 1 student that had an incorrectly calculated amount of Title IV assistance earned, the effect of which would increase the amount due from the institution by $127 and would decrease the post-withdrawal disbursement by $22. ? 1 student that had an incorrectly calculated amount of Title IV assistance earned, which did not result in any questioned cost due to the grant protection. Los Angeles Pierce College Of the 30 students selected for return of Title IV funds test work from the population of students who had withdrawn, dropped out, or never began attendance, we noted the following: ? 1 student that had an incorrectly calculated amount of Title IV assistance earned, the effect of which would increase the amount due from the student by $992. ? 1 student that had an incorrectly calculated amount of Title IV assistance earned, the effect of which would decrease the amount due from the institution by $97. ? 1 student that had an incorrectly calculated amount of Title IV assistance earned, the effect of which would decrease the amount due from the institution by $24. ? 1 student that was not included in the calculation of the amount of Title IV assistance earned, the effect of which would increase the post-withdrawal disbursement by $27. Los Angeles Trade Technical College Of the 11 students selected for return of Title IV funds test work from the population of students who had withdrawn, dropped out, or never began attendance, we noted 1 student that had an incorrectly calculated amount of Title IV assistance earned, the effect of which would increase the amount due from the student by $611. Los Angeles Valley College Of the 14 students selected for return of Title IV funds test work from the population of students who had withdrawn, dropped out, or never began attendance, we noted 1 student was not included in the calculation of the amount of Title IV assistance earned, the effect of which would increase the amount due from the institution by $106 and increase the amount due from student by $142. B. Untimely Notification of Grant Overpayment to Students and Secretary East Los Angeles College Of the 30 students selected for compliance test work, we noted the following: ? 2 students were notified beyond 30 days from the date of the institution?s determination that the students withdrew and owed overpayments as a result of the students? withdrawals. The required notifications were submitted 37 and 54 days after the institution?s determination date. The notifications were late by 7 and 24 days. 2 students did not repay the overpayment in full to the institution or enter a repayment agreement. These students were not referred to the Secretary within the required timeframe (the earlier of 45 days from the date the institution sent a notification to the student of the overpayment or 45 days from the date the institution was required to notify the student of the overpayment). Notifications were sent 211 and 252 days after the date the institution was required to notify the students of the overpayments. The notifications were late by 166 and 207 days. Los Angeles Harbor College We noted that 2 of 5 students selected for compliance test work were notified beyond 30 days from the date of the institution?s determination that the students withdrew and owed overpayments as a result of the students? withdrawals. The required notifications were submitted 311 days after the institution?s determination date. The notifications to the students were late by 281 days. Los Angeles Mission College We noted that 2 of 30 students selected for compliance test work were notified beyond 30 days from the date of the institution?s determination that the students withdrew and owed overpayments as a result of the students? withdrawals. The required notifications were submitted between 133 and 303 days after the institution?s determination date. The notifications were late by 103 and 273 days. Los Angeles Trade Technical College Of the 11 students selected for compliance test work, we noted the following: ? 2 students were notified beyond 30 days from the date of the institution?s determination that the students withdrew and owed overpayments as a result of the students? withdrawals. The required notifications were submitted 242 days after the institution?s determination date. The notifications were late by 212 days. ? 1 student did not repay the overpayment in full to the institution or enter a repayment agreement. This student was not referred to the Secretary within the required timeframe (the earlier of 45 days from the date the institution sent a notification to the student of the overpayment or 45 days from the date the institution was required to notify the student of the overpayment). The notification was sent 106 days after the date the institution was required to notify the students of the overpayments. The notification was late by 61 days. C. Untimely Return of Unearned Title IV funds Los Angeles Mission College We noted that 4 of 30 students selected for compliance test work had the untimely return of unearned Title IV funds. The District returned unearned title IV funds 46 to 134 days after the dates it determined that the students withdrew. The required returns were late by 1 to 89 days.

In performing test work over enrollment reporting, we noted the following: East Los Angeles College Of the 30 students selected for compliance test work, we noted: ? 8 students had status changes that were reported late to the NSLDS. This late reporting ranged from 11 to 122 days late. Los Angeles Mission College Of the 30 students selected for compliance test work, we noted: ? 6 students had status changes that were reported late to the NSLDS. This late reporting ranged from 5 to 11 days late. ? 4 students had no reported status to NSLDS due to late reporting to the District?s third-party servicer, National Student Clearinghouse (NSC). ? 1 student had a change in enrollment that was not reported to NSLDS due to late reporting to NSC. ? 1 student had an incorrect effective date reported. Los Angeles Pierce College Of the 30 students selected for compliance test work, we noted: ? 7 students had status changes that were reported late to the NSLDS. This late reporting ranged from 10 to 56 days late. ? 3 students had no reported status to NSLDS due to late reporting to NSC. ? 1 withdrawn student was reported as a half-time student. ? 1 half-time student was reported as a full-time student. ? 1 student had an incorrect effective date reported. Los Angeles Southwest College Of the 4 students selected for compliance test work, we noted: ? 1 student had a status change that was reported late to the NSLDS. This late reporting was 23 days late. ? 1 student that had a status change and had an incorrect effective date reported. ? 1 student who had a full-time status was not reported to NSLDS due to late reporting to NSC. Los Angeles Trade Technical College Of the 8 students selected for compliance test work, we noted: ? 5 students had status changes that were reported late to the NSLDS. This late reporting ranged from 10 to 40 days late. ? 1 student has no reported status to NSLDS due to late reporting to NSC. Los Angeles Valley College Of the 9 students selected for compliance test work, we noted: ? 3 students had status changes that were reported late to the NSLDS. This late reporting was 10 days late. ? 1 less-than-half-time student was reported as a quarter-time student. West Los Angeles College ? Of the 5 students selected for compliance test work, we noted 1 student has no reported status to NSLDS due to late reporting to NSC.

Lack of Written Information Security Plan and Outdated IT policies We noted that no written Information Security Plan has been developed to support the District's security program to protect sensitive information. Annual review of security, availability and processing integrity is currently not being performed for service level agreements and related contracts with third-party IT and Data service providers. The District's existing Administrative Regulations related to IT are outdated and inadequate. The following Administrative Regulations were noted: ? B-27 ? Use of District and College Computing Facilities ? B-27 ? Append ? B-28 ? Network Security Policy ? E-47, E-99, and S-8 ? Retention of ASO Records Additionally, we found no existing Administrative Regulations in place related to: ? Information and Data classification ? Data Privacy ? Incident Response and Resolution Management B. Improve Configuration Management to Reduce Security Risk The District has taken limited steps to harden default workstations, servers and network device configurations. Misconfigurations present a target for attackers to gain access and elevate privileges. a) The District has yet to establish a Vulnerability Management Program. Annual vulnerability scanning, PCI scanning or penetration testing are not being conducted. b) While we noted no issues concerning the current state of the primary and secondary servers used for Student Information Systems (SIS), we also noted several operating systems on some non-SIS servers, virtual machines, desktop, and mobile devices do not have the latest OS version or are not upto- date which caused latest definitions to not being pushed to a significant number of machines thereby making them vulnerable to operational issues and security concerns. c) While we noted that SIS servers were consistently updated and patched, we also noted a significant number of non-SIS machines were last updated in the first quarter of the calendar year 2018. d) While we noted SIS servers have adequate procedures to protect information systems and technology from malicious software, we also noted insufficient detective and corrective controls are in place to protect non-SIS information systems and supporting technologies from malicious software. The frequency and thoroughness of detective and corrective controls currently configured allow threats to reside on a resource attached to the network longer than it is recommended prior to detection and remediation of a threat. e) Annual

Of the 30 students selected for compliance test work at Los Angeles Pierce College, we noted that 1 student disbursement data was reported inaccurately to the Department of Education?s Common Origination and Disbursement (COD). The actual disbursement amounted to $1,524 but only $992 was reported to COD.

In performing test work over payroll-related expenditures charged to the grant, we noted that 2 out of 12 personal services expenditures did not have timesheets as proof of time charges made in the sampled period. There is no questioned costs as we noted that these employees were identified in the contract budget as authorized to charge time to the program fund. This is an internal control finding related to the preparation of timesheets as proof of actual time charges.

A. Expenditure Recorded in Incorrect Period At West Los Angeles College, we noted that 1 out of 11 expenditures was recorded in the incorrect period. The expenditure is related to a bus transportation cost that was incurred in fiscal year 2018 but was incorrectly recorded in fiscal year 2019. B. Lack of Documented Approval of Timesheet At West Los Angeles College, we noted that 1 out of 7 payroll expenditures samples did not have evidence of supervisor approval on the employee?s timesheet, which is used to charge salaries to the grant program.

In performing testwork over equipment management at Los Angeles Pierce College, we noted the following: ? 3 out of 10 equipment samples did not have ?LACCD tags? attached to the equipment. While these three items properly had Perkins tags, the equipment did not have the LACCD tag identifiers, as required by District policy in order to easily identify ownership of the asset as well as prevent loss, theft or damage to the property. ? 2 out of 10 equipment samples were initially labeled with the wrong LACCD tag and serial number. While these two items had the proper Perkins tags, the attached LACCD tags did not relate to the equipment asset. Once identified as part of the audit, the correct LACCD tags were subsequently attached to the two equipment assets by the Program Asset Custodian / Perkins Specialist.

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION

GSA_MIGRATION