Hawaii Pacific University

Criteria: 16 CFR Part 314 requires the University to implement information safeguard standards prescribed by the Gramm Leach Bliley Act (GLBA). GLBA requires institutions and servicers to develop, implement, and maintain a written, comprehensive information security program which contains administrative, technical, and physical safeguards that are appropriate to the size and complexity of the institution or servicer, the nature and scope of their activities, and the sensitivity of any student information.An institution’s written information security program must include the following elements: •Element 1: Designates a Qualified Individual responsible for overseeing and implementing the institution’s or servicer’s information security program and enforcing the information security program (16 C.F.R. 314.4(a)). •Element 2: Provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution or servicer) that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks (16 C.F.R. 314.4(b)).•Element 3: Provides for the design and implementation of safeguards to control the risks the institution or servicer identifies through its risk assessment (16 C.F.R. 314.4(c)). At a minimum, the written information security program must address the implementation of the minimum safeguards identified in 16 C.F.R. 314.4(c)(1) through (8). •Element 4: Provides for the institution or servicer to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 C.F.R. 314.4(d)) •Element 5: Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 C.F.R. 314.4(e)). •Element 6: Addresses how the institution or servicer will oversee its information system service providers (16 C.F.R. 314.4(f)). •Element 7: Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the information security program (16 C.F.R. 314.4(g)). •Element 8: For an institution or servicer maintaining student information on 5,000 or more consumers, addresses the establishment of an incident response plan (16 C.F.R. 314.4(h)). •Element 9: For an institution or servicer maintaining student information on 5,000 or more consumers, addresses the requirement for its Qualified Individual to report regularly and at least annually to those with control over the institution on the institution’s information security program (16 C.F.R. 314.4(i)).Context: We conducted inquiries with the University’s Information Security Officer to determine whether the University had a written information security program that addressed the elements required by GLBA. Although the University has a designated security officer (i.e. Qualified Individual) and has made progress in developing and implementing the elements of a written information security program, management confirmed that the University did not implement all required elements of the program as prescribed by the GLBA. Cause: Management indicated that there was a lack of awareness regarding the requirement to establish an information security program that addressed the required elements. Effect: The University was not in compliance with the GLBA requirement which could result in administrative action by the Department of Education and may impact the University’s participation in Title IV programs. Questioned Costs: None Identification of repeat finding: This is a repeat finding. See prior year finding 2024-002. Recommendations: We recommend that the University put in place all remaining unimplemented elements in order to complete the University’s written, comprehensive information security plan prescribed by GLBA. The University should develop and retain documentation supporting the completion and implementation of each of the required elements. Once completed, the University should conduct periodic internal assessments of the Information Security Programs’ compliance or consider engaging a third-party consultant to conduct such a review. Section III – Federal Award Findings and Questioned Costs (continued) Views of responsible officials: The University has made substantial progress toward completing the remaining elements required under the Gramm-Leach-Bliley Act (GLBA) and aligning its program with the FTC Safeguards Rule. Full implementation timelines are primarily constrained by current staffing capacity within ITS/Cybersecurity and Legal, as well as certain technical tool limitations (e.g., data discovery and validation). Despite these constraints, notable progress has been achieved across the required FTC Safeguards Program elements as summarized below: • Element 1 – Designate a Qualified Individual: Completed. Qualified individual appointed to implement and supervise the company’s information security program, reporting mechanisms to the Board established. Completion is confirmed based on oversight and execution of subsequent program elements. • Element 2 – Conduct a Risk Assessment: Completed. Initial risk assessment conducted to identify reasonably foreseeable threats; controls and priorities for Elements 3–9 is being guided by this assessment. • Element 3 – Access Controls & Data Classification: 70% complete. Policies finalized; multi-factor authentication (MFA) implemented; initial asset inventory completed. Data owner assignments and detailed access reviews are in progress. • Element 4 – Vulnerability Management: Complete. Latest penetration testing identified no critical findings. • Element 5 – Information Security Policies: Drafted and pending Legal review; Board acceptance scheduled for March 2026. • Element 6 – Third-Party Oversight: 70% complete. Policy and workflow developed. Board acceptance scheduled for March 2026. • Element 7 – Periodic Risk Assessments: 80% complete. Updated risk assessment currently in progress. • Element 8 – Incident Response Plan: 90% complete. Final reporting and approval scheduled for March 2026. • Element 9 – Qualified Individual & Board Reporting: 90% complete. Annual report scheduled for March 2026. • Red Flags Rule (Identity Theft Prevention): 50% complete. Policy drafted, complete comprehensive program, formal procedures and additional trainings still required. Remaining actions will be completed as Legal and Board approvals are obtained and staffing capacity allows. HPU will continue to develop and retain documentation supporting the completion and implementation of each safeguard element, as prescribed by GLBA. Periodic internal assessments of the Information Security Program will be scheduled following full implementation, with consideration given to engaging an independent third party for future reviews.

Criteria: 34 CFR 668.22(j)(1) requires the University to return the amount of Title IV funds for which it is responsible as soon as possible, but no later than 45 days after the date of the University’s determination that the student withdrew.34 CFR 668.22 requires the University to determine the amount of Title IV aid earned by a student who withdraws during a pay period or period in enrollment in which the student began attendance and calculate any Title IV funds to be returned to the U.S. Department of Education. Condition: The University did not return Title IV funds within the 45 days. In addition, the University did not perform a review of students who had Title IV funds disbursed and received all failing or incomplete grades to identify students who withdrew during the Fall 2024 term. Context: We selected a nonstatistical sample of 4 students from a population of 40 students who received all failing or incomplete grades for the Spring 2025 and Summer 2025 terms and had Title IV funds disbursed. Of the 4 students tested, 1 student required a Return of Title IV Funds (R2T4). For this student, the University did not calculate and return funds to the Department of Education within the required timeframe of 45 days. The University’s process to determine whether a student withdrew and required an R2T4 calculation includes reviewing students who were disbursed Title IV funds and received all failing or incomplete grades during a term. However, the University did not perform this review for the Fall 2024 term. Upon further inquiry, the University subsequently performed the Fall 2024 review and identified 22 students who required an R2T4 calculation to determine whether any Title IV funds should have been returned to the Department of Education. At the time of the audit, the University had not yet completed the R2T4 calculations for the students identified from the Fall 2024 review to determine whether additional Title IV funds were required to be returned to the Department of Education. Cause: Although the University has policies and procedures in place over the R2T4 process, management indicated that responsibility for performing the R2T4 process was transferred from the University’s Business Office to the Financial Aid Office prior to the Fall 2024 term. During this transition, the step to review students who received all failing or incomplete grades to identify potential unofficial withdrawals requiring an R2T4 calculation was overlooked for the Fall 2024 term. Effect: Failure to timely calculate and return Title IV funds resulted in noncompliance with the Return of Title IV Funds under the Special Tests and Provisions compliance requirement and increases the risk that Title IV funds may not be returned within the regulatory timeframe. Questioned Costs: None Identification of a repeat finding: This is a repeat finding. See prior year finding 2024-003.Recommendations: We recommend the University strengthen its controls over the R2T4 process to ensure that procedures used to identify students who receive all failing or incomplete grades are performed timely so that potential unofficial withdrawals are identified and evaluated within the required regulatory timeframe and funds are remitted within the required deadlines. The University should also establish procedures to ensure that responsibilities for the R2T4 process are clearly assigned and monitored during departmental or staffing transitions to prevent required reviews from being overlooked and to ensure required reports are generated and reviewed timely. Views of responsible officials: At the end of the 2023–24 award year, responsibility for generating Return of Title IV (R2T4) withdrawal lists transitioned from the Business Office to the Financial Aid Office. The Financial Aid Office began producing both official withdrawal and unofficial (non-passing grade) reports through Ellucian Banner. Because the two reports produced nearly identical student listings, it was assumed that the Banner-generated unofficial withdrawal report was effectively identifying all students who had received non-passing grades. During an internal audit conducted at the end of the Spring 2025 semester, the University identified one student who had failed all courses and was not included on either of the R2T4 lists. Upon further review, the issue was traced to a reporting limitation within Banner that excluded some students with all failing grades from the population used for R2T4 review. To resolve this, the Financial Aid Office coordinated with the Registrar’s Office to obtain a complete list of students who officially withdrew and students with all non-passing grades once final grades were submitted. R2T4 calculations were subsequently performed for applicable students identified in this additional list. Since Spring 2025, the University has institutionalized this revised procedure. The Registrar’s Office now provides the Financial Aid Office with a list of all students with non-passing grades at the end of each semester once grades are submitted. The Financial Aid Office reviews both reports to identify potential unofficial withdrawals and performs R2T4 calculations as required. To strengthen oversight and prevent future omissions during staffing transitions or process changes, the University will: • Document the revised R2T4 identification and review process in the Financial Aid operations manual. • Clearly assign responsibility for report generation, review, and follow-up between the Registrar’s Office and Financial Aid Office. • Implement a quarterly internal cross-check to confirm all required R2T4 reviews are completed.

Criteria: 34 CFR 668.164(h)(2) requires that a Title IV credit balance must be paid directly to the student or parent as soon as possible, but no later than (i) 14 days after the balance occurred if the credit balance occurred after the first day of class or a payment period; or (ii) 14 days after the first day of class of a payment period if the credit balance occurred on or before the first day of class of that payment period.Condition: The University did not pay all Title IV credit balances to students or parents within the 14 days. Context: We selected a non-statistical sample of 60 Title IV credit balances. For 9 out of the 60 credit balances, payments to the student or parent were made after the 14-day requirement. In all instances identified, the Title IV credit balances were ultimately paid to the student or parent. Cause: Although the University has policies and procedures in place over the payment of Title IV credit balances, management indicated that responsibility for reviewing and processing Title IV credit balances transferred from the Business Office to the Student Accounts during the year. This transition was not supported by sufficient training or clarification of compliance requirements, resulting in misunderstandings and inconsistent execution of required procedures. Effect: Failure to timely pay Title IV credit balances to students or parents resulted in noncompliance with the special tests and provisions – disbursements to or on behalf of students requirement. Questioned Costs: None Identification of a repeat finding: This is a repeat finding. See prior year finding 2024-006. Recommendations: We recommend the University strengthen its controls over the review and processing of Title IV credit balances to ensure refunds to students or parents are issued within the required 14-day timeframe. In addition, when responsibilities related to Title IV compliance are transferred between departments, the University should implement procedures to ensure staff receive appropriate training, roles and responsibilities are clearly defined, and compliance requirements are communicated to support consistent execution of required procedures. Views of responsible officials: The officials responsible for Student Accounts acknowledge that certain student financial aid refunds were processed outside the 14-day federal deadline, primarily due to insufficient Title IV training during the initial transfer of responsibilities to Student Accounts. While a standard operating procedures (SOP) exists within the current refunds training, it is limited, focusing primarily on the reports and some of federal requirements but does not provide sufficient detail on regulations, reviews, approvals, and timelines. Student Accounts has already taken steps to address and correct the misinformation, but additional improvements are still needed. The SOP for refunds is currently in progress to fully incorporate all necessary items to ensure better and clearer training guidelines. Mandatory Title IV refund training will be provided to all Refund Representatives and included in onboarding for new hire. We shall set established expectations set for all individuals involved in the process, including their delegates, to ensure accountability and consistent application of procedures. Ongoing collaboration with Financial Aid will ensure procedures are consistently applied, questions are addressed, and staff remain current with requirements. These actions are expected to ensure compliance with the 14-day federal requirement, strengthen staff competency, and support continuous improvement in refund processing.

Criteria: 16 CFR Part 314 requires the University to implement information safeguard standards prescribed by the Gramm-Leach-Bliley Act (GLBA). GLBA requires institutions and servicers to develop, implement, and maintain a written, comprehensive information security program which contains administrative, technical, and physical safeguards that are appropriate to the size and complexity of the institution or servicer, the nature and scope of their activities, and the sensitivity of any student information. An institution’s written information security program must include the following elements: • Element 1: Designates a Qualified Individual responsible for overseeing and implementing the institution’s or servicer’s information security program and enforcing the information security program (16 C.F.R. 314.4(a)). • Element 2: Provides for the information security program to be based on a risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information (as the term customer information applies to the institution or servicer) that could result in the unauthorized disclosure, misuse, alteration, destruction, or other compromise of such information, and assesses the sufficiency of any safeguards in place to control these risks (16 C.F.R. 314.4(b)). • Element 3: Provides for the design and implementation of safeguards to control the risks the institution or servicer identifies through its risk assessment (16 C.F.R. 314.4(c)). At a minimum, the written information security program must address the implementation of the minimum safeguards identified in 16 C.F.R. 314.4(c)(1) through (8). • Element 4: Provides for the institution or servicer to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 C.F.R. 314.4(d)). • Element 5: Provides for the implementation of policies and procedures to ensure that personnel are able to enact the information security program (16 C.F.R. 314.4(e)) • Element 6: Addresses how the institution or servicer will oversee its information system service providers (16 C.F.R. 314.4(f)). • Element 7: Provides for the evaluation and adjustment of its information security program in light of the results of the required testing and monitoring; any material changes to its operations or business arrangements; the results of the required risk assessments; or any other circumstances that it knows or has reason to know may have a material impact the information security program (16 C.F.R. 314.4(g)). • Element 8: For an institution or servicer maintaining student information on 5,000 or more consumers, addresses the establishment of an incident response plan (16 C.F.R. 314.4(h)). • Element 9: For an institution or servicer maintaining student information on 5,000 or more consumers, addresses the requirement for its Qualified Individual to report regularly and at least annually to those with control over the institution on the institution’s information security program (16 C.F.R. 314.4(i)). Context: We conducted inquiries with the University’s Information Security Officer to determine whether the University had a written information security program that addressed the elements required by GLBA. Although the University has a designated security officer (i.e. Qualified Individual), management confirmed that the University did not have a written comprehensive program in place as prescribed by the GLBA. Cause: Management indicated there was a lack of awareness regarding the requirement to establish an information security program that addressed the required elements. Effect: The University was not in compliance with the GLBA requirement which could result in administrative action by the Department of Education and may impact the University’s participation in Title IV programs. Questioned Costs: None Identification of repeat finding: N/A. Recommendations: We recommend the University develop and implement an Information Security Program that includes the required elements prescribed by GLBA. The University should develop and retain documentation supporting the completion and implementation of each of the required elements. Once completed, the University should conduct periodic internal assessments of the Information Security Programs’ compliance or consider engaging a third-party consultant to conduct such a review. Views of responsible officials: The Information Security Officer has developed a comprehensive project plan to implement the core 9 elements as listed under FTC Safeguards. The plan is backed by HPU’s 3rd party risk assessment conducted in November of 2024. The addition of a new hire and a part-time resource has facilitated significant progress. Budget for necessary tools, software, and services such as penetration testing are being actively quoted for review by the Budget Office and CFO for both current and future fiscal years. Checkpoints have been established every two weeks to review and confirm substantial progress towards meeting all requirements and address any barriers or setbacks that may occur. The Vice President of Operations and CIO will review the progress support efforts to meet the requirements and targeted delivery date. The HPU Cybersecurity Committee will be provided with the 2024 Risk Assessment and the Information Security Program documentation and policies for both initial and ongoing review of the programs with the objective to further strengthen the program beyond minimum requirement.

Criteria: 34 CFR 668.22(j)(1) requires the University to return the amount of Title IV funds for which it is responsible as soon as possible, but no later than 45 days after the date of the University’s determination that the student withdrew. Condition: The University did not return all Title IV funds in a timely manner. Context: We selected a non-statistical sample of 8 students out of a population of 68 students who withdrew during the year and had Title IV funds disbursed. We noted 6 out of 8 students required a return of Title IV funds and for 5 out of the 6 students, the University did not return funds to the Department of Education within the required time frame. Cause: Although the University has policies and procedures in place over the return of Title IV funds, management indicated that staff turnover, including the resignation of the Director of Financial Aid, resulted in the remaining staff being required to take on additional responsibilities to ensure the continuity of day-to-day functions of the office. In addition, the changes required by the FAFSA simplification act caused the team to be unable to timely comply with the existing policies. Effect: Failure to timely return Title IV funds resulted in noncompliance with the special tests and provisions – return of Title IV funds requirement. Questioned Costs: None Identification of a repeat finding: N/A Recommendations: We recommend the University be more diligent in complying with its established policies and procedures for the return of Title IV funds. Where staffing shortages exist, consider crosstraining staff or temporarily engaging external resources. Views of responsible officials: This issue was initially identified by the University through HPU’s internal monitoring processes. The cause was significant staff turnover within a 6-month period (including the resignation of the Director of Financial Aid). The difficulties of temporarily reduced staffing and loss of institutional knowledge were compounded by the challenges brought by the FAFSA Simplification Act, which required many changes, placing an additional burden on a strained team. Although the University attempted to adhere to its policies and procedures to ensure that R2T4 is processed within the allotted time, the team did not succeed in completing this function. The University replaced key staff, recruited a new Director, and shifted responsibilities so that a specific staff member is responsible for R2T4 processing. These changes have enabled the University to resume processingR2T4 timely, as was accomplished in previous years.

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. 2 CFR 200.313(d)(1) requires “property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property…” Condition: The University did not complete a full physical inventory at least once every 2 years as required and did not reconcile the results with its property records. Additionally, one equipment item did not have a fixed asset tag. Context: The University’s Fixed Asset Policy and related procedures require inventories of property and equipment to be conducted at least once every 2 years. In addition, each equipment item is required to have a unique identifier or a fixed asset tag. The University has 22 departments for which a physical inventory was required. We noted that in fiscal years 2023 and 2024, physical inventories were conducted for 12 and 20 departments, respectively. In 2025, physical inventories for the remaining 2 departments were completed. However, as of June 30, 2024, the inventory results had not been reconciled to the property records. Further, in testing a non-statistical sample of seven equipment items we noted that one item did not have a unique identifier or a fixed asset tag. Cause: Although the University has established policies and procedures in place for the physical inventory and reconciliation of property and equipment and fixed asset tagging, management indicated that staffing limitations, combined with a campus relocation, closure of the Hawai‘i Loa campus and ongoing construction of its science laboratories, hindered the University’s ability to complete the inventories and reconciliations within the required timeframe. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years, and failure to properly tag equipment items resulted in noncompliance with the equipment and real property management requirements which increases the risk of misappropriation, loss, or inaccurate reporting of federally funded assets. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2023-003. Recommendations: We recommend the University review and update its current fixed asset inventory and tagging processes to ensure compliance with the requirements. Specifically, we recommend the following: 1. Developing and implementing a corrective action plan to address the barriers that prevented timely completion of the physical inventory and reconciliations, including: • Assessing staffing needs and allocating adequate resources, whether through additional personnel, temporary assistance, or reallocation of responsibilities, to ensure physical inventories and reconciliations are completed timely. • Establishing a formal timeline and monitoring process for conducting and reconciling physical inventories of all departments within the required two-year cycle. • Identifying opportunities to leverage technology or asset management software to streamline and document the inventory and reconciliation process. 2. Ensuring that all equipment items are appropriately tagged or assigned unique identifiers in accordance with its Fixed Asset Policy and 2 CFR 200.313(d)(1). 3. Providing training and guidance to responsible staff on the inventory process, reconciliation procedures, and tagging requirements to reinforce accountability and ensure consistent application of policies. Views of responsible officials: The University initiated a thorough inventory process, including a requirement to tag and photograph all assets, during the fiscal year ended June 30, 2024. The inventory process was started on schedule in May 2024, and departments were asked to complete their inventory procedures and sign off on the inventory reports by June 2024. Despite the additional complications created by the University’s campus relocation project necessitated by the closure of the Hawai‘i Loa campus and the construction of the science laboratories, 91% of the departments completed their inventories prior to June 30, 2024. The remaining 9% of departments completed their inventories after requesting an extension and/or providing additional details on the requested inventory items in the meantime, and these inventories were completed during the fiscal year ending June 30, 2025. These results demonstrate improvement and progress compared to the prior year’s finding in this area and illustrate the University’s commitment to adhering to tits fixed asset inventory processes and procedures. The University is committed to addressing these issues promptly and effectively to ensure compliance with federal regulations. Accordingly, the University will conduct a thorough review of its inventory procedures, timing, technologies, training resources, and resource allocations to ensure that the next inventory process is designed to enable completion and reconciliation prior to the fiscal-year end, to include the tagging and identification of all inventory items.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. 2 CFR 200.305 requires the non-federal entity must minimize the time elapsing between the transfer of funds from the U.S. Treasury and disbursement of funds by the recipient. Condition: The University drew down funds related to an expenditure that had previously been drawn down. Context: We selected a non-statistical sample of 60 expenditures, totaling $471,734, for which reimbursement was requested and received. We noted one expenditure for $80,996 was previously reimbursed through a prior reimbursement request. Cause: Despite the University’s established policies and procedures for cash management, an error occurred in the original posting of the invoice, necessitating a journal entry correction. During the correction process, Business Office accounting staff inadvertently recorded the journal entry as an expense to the grant for the second time. Typically, transactions to the grant are posted through subledgers and reviewed by the Office of Sponsored Projects (OSP) for accuracy. However, the error was not detected during the OSP review process, as their review does not encompass journal entries posted directly to the general ledger. Consequently, the expenditure was charged to the grant twice and erroneously included in a reimbursement request. Effect: Failure to adequately review the cash drawdown requests resulted in a duplicate draw down for an expenditure that was previously drawn down and noncompliance with the cash management requirement. Questioned Costs: $80,996 Identification of a repeat finding: N/A Recommendations: We recommend the University modify or revise its review process to ensure that the reviews conducted by the Business Office and Office of Sponsored Projects take into consideration journal entry postings. Views of responsible officials: The University has policies and procedures to ensure the review of expenditures charged to federal grants prior to draw downs. However, the University failed to identify a mistake in a journal entry which resulted in a duplicate expense posting to the grant until after the draw down request had been made. Specifically, the University charged prepaid amortization to a grant fund, although the expenditure had already been fully recorded to the grant fund. This resulted in a duplicated expense posting, one for the actual payment, and a second for the expense amortization. The University discovered the mistake after the duplicated expense had been drawn down. To correct this error, the University initiated the process to reduce a subsequent draw for the grant to ensure that overall, the grant is not overdrawn. Management reviewed the conditions which contributed to this error and is establishing the following controls to address this error: 1. The University will incorporate an additional review step for any journal entries posted to federal grants. The Office of Sponsored Projects and Business Office management will sign off on any journal entries which are posted to federal grants prior to the posting taking place. 2. The Business Office will reinforce existing procedures to all accounting staff responsible for prepaid expense accounting to ensure that prepaid expense is not recorded to federal grant funds. 3. The Office of Sponsored Projects will adjust its review process and train staff to ensure thorough review of all activities impacting grants, including journal entries made by the Business Office, before authorizing drawdowns.

Criteria: 34 CFR 668.164(h)(2) requires that a Title IV credit balance must be paid directly to the student or parent as soon as possible, but no later than – (i) 14 days after the balance occurred if the credit balance occurred after the first day of class or a payment period; or (ii) 14 days after the first day of class of a payment period if the credit balance occurred on or before the first day of class of that payment period. Condition: The University did not pay Title IV credit balances to 3 students or parents in a timely manner. Context: We selected a non-statistical sample of 60 students with disbursements for special tests and provisions – disbursements to or on behalf of students testing, of which 41 students had Title IV credit balances. For 3 out of the 41 credit balances, payments to the student or parent were made after the 14-day requirement. The 3 instances were related to credit balances that were created in December 2023 and paid out in January 2024. Cause: Although the University has policies and procedures in place for the payment of Title IV credit balances, there was a failure to follow its policies and procedures. Management indicated that the credit balances were created in December, directly preceding the University’s holiday break. The University is closed during this period and staffing is generally limited. Management followed its ordinary procedures to pause disbursements prior to break to ensure the credit balances are paid to students or parents in a timely manner. However, one staff member was unaware of this requirement and manually disbursed aid resulting in credit balances for 3 students which required repayment during the holiday break. Effect: Failure to timely pay Title IV credit balances to students or parents resulted in noncompliance with the special tests and provisions – disbursements to or on behalf of students requirement. Questioned Costs: None Identification of a repeat finding: N/A Recommendations: We recommend the University establish clear procedures to ensure timely and effective communication with staff regarding alternative disbursement schedules. Views of responsible officials: The University has an automated process in place to disburse aid daily. That process is set to stop on a certain day before the University’s scheduled Winter Break to allow the refund processing team time to generate and distribute refunds within the allotted timeframe and maintain compliant with related regulations despite the University’s scheduled closure. According to established procedures, the process was stopped as scheduled. However, one of the University’s Financial Aid Counselors manually authorized and disbursed aid for a small number of students after the process was halted for the semester because they were unaware of the reason why aid was not disbursing, and they were attempting to help students who were calling the Financial Aid office. Once management became aware of this issue, the Director of Financial Aid immediately approached the staff member and explained the reason why the University stopped making disbursements. The Director instructed the team member to not override these established controls and explained the importance of adhering to the policies in place. The staff member acknowledged that they understood the consequences of their actions and the need to adhere to policies. In the future, the University will take extra steps to communicate with all team members when this control is initiated prior to Winter Break to ensure collective understanding of the reason for pausing disbursement.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: During our testing of the HEERF Program, for payroll and non-payroll expenditures, management did not provide sufficient support to justify the allocation of these costs to the program. Consequently, we were unable to audit the allowability of these costs. Context: For payroll-related expenditures, we selected a non-statistical sample of 6 payroll items representing $26,078, all of which did not have documentation of the justification supporting the allocation. Total payroll expenditures for the program were $110,525. Management estimated the time each departments’ employees spent on allowable COVID-related activities; however, the documentation of the calculation and allocation related to the rationale, basis and final allocations were not provided. For nonpayroll expenditures, we selected a non-statistical sample of 8 items representing $181,428, of which, 5 items representing $97,367 did not have documented justification supporting their allowability. Total nonpayroll expenditures for the program were $367,323. Management did not consistently document the justification supporting the allocation of costs to the program. Cause: Management indicated that due to the urgency in ensuring funds were distributed as quickly as possible, documented policies and procedures to administer the program were not developed and therefore not all supporting justifications were documented. Effect: Expenditures could be disbursed for unallowable costs. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2022-001. Recommendations: The HEERF Program has ended for the University. We recommend that should similar programs become available in the future, that management develop documented policies and procedures to administer the program and that management maintain documentation to demonstrate compliance with its policies and procedures. Views of responsible officials: For payroll-related expenditures, management reviewed the duties of individuals and estimated the percentage of their time allocable to the program based upon knowledge of office functions, job duties, and additional demands and tasks related to the COVID-19 pandemic. This review and discussions within the management team resulted in the amounts allocated to the HEERF program; the percentage allocations assigned were documented in the calculations used to support the payroll activity recorded during the fiscal year ended June 30, 2023. For non-payroll related expenditures, documented policies were not developed for the HEERF program expenditures and as a result supporting justifications were not consistently documented or maintained. For all expenditures associated with the HEERF program, when documentation was not obtained or maintained, management was basing decisions on all regulations available at the time and decisions made did not violate the intent of the program. The HEERF awards were fully expended as of June 30, 2022 for the Student Portion and as of September 30, 2022 for the Institutional Portion. Should similar programs become available in the future, management will develop, in advance of expending funds, documented policies and procedures to administer the program and will maintain documentation demonstrating compliance with program requirements and related institutional policy and procedure.

Criteria: There are three components to reporting for HEERF: 1) public reporting on the (a)(1) Student Aid; 2) public reporting on the (a)(1) Institutional Portion (a)(2) and (a)(3) subprograms (Quarterly Reporting Form), as applicable; and 3) the annual report (Annual Report). The Coronavirus Aid, Relief, and Economic Security (CARES) Act 18004(e) and the Coronavirus Response and Relief Supplemental Appropriations Act (CRRSAA) 314(e) requires an institution receiving funds under HEERF I and HEERF II to submit a report to the secretary, at such time in such a manner as the secretary may require. While American Rescue Plan (ARP) does not explicitly identify procedures by which institutions must report on their uses of HEERF grant funds, ED exercises this reporting authority under 2 CFR section 200.328 and 2 CFR section 200.329. Condition: For one quarterly report, the supporting documentation maintained did not agree to the information included in the report. Additionally, the Annual Report for 2022 was not prepared. Context: For quarterly reporting, we selected a non-statistical sample of two Quarterly Reporting Forms for testing, noting that for one report, discrepancies between the supporting documentation and the information in the report existed in 3 out of 6 lines of data. For annual reporting, management indicated that they did not believe they were required to prepare the Annual Report for 2022 as all program funds were expended prior to December 31, 2022. Cause: Management indicated that due to the urgency in ensuring funds were distributed as quickly as possible, it was necessary to gather information from various sources within the University. However, the turnover of staff resulted in a lack of retention of this information in a manner conducive to easy retrieval, compilation and reconciliation with reported amounts. Effect: The Quarterly Reporting Forms that were completed may contain inaccurate or incomplete data. In addition, the University was not compliant with the requirement to submit the Annual Report for 2022. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2022-002. Recommendations: As the HEERF Program has ended for the University, we recommend that if similar programs become available in the future, management should develop well-documented policies and procedures. These should be detailed enough to ensure that essential knowledge and information for report preparation, including information sources, can withstand significant staff turnover. Views of responsible officials: The HPU Office of Sponsored Projects (OSP) and the Office of Financial Aid endeavor to follow all applicable reporting regulations and guidance mandated for federally funded grant and contract programs. The HEERF awards were fully expended as of June 30, 2022 for the Student Portion and as of September 30, 2022 for the Institutional Portion. Should similar programs become available in the future, management will develop, in advance of expending funds, documented policies and procedures to administer the program and will maintain documentation demonstrating compliance with program requirements and related institutional policy and procedure.

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. 2 CFR 200.313(d)(1) requires “property records must be maintained that include a description of the property, a serial number or other identification number, the source of funding for the property…” Condition: The University did not complete a full physical inventory as required and did not complete a reconciliation of the results to its property records. Additionally, the University did not have a fixed asset tag on 3 equipment items. Context: The University’s Fixed Asset Policy and related procedures require a periodic inventory of property and equipment. In addition, each equipment item is required to have a unique identifier or a fixed asset tag. The University instructed its departments, via an organization-wide communication dated May 3, 2023, to complete an inventory of their property and equipment by May 31, 2023. We noted that a physical inventory was completed for 12 out of 21 departments during the fiscal year ended June 30, 2023. Additionally, a physical inventory for two departments was completed subsequent to June 30, 2023. We further noted that one equipment item acquired with federal awards was transferred to another university, however, the item was improperly included in the University’s property records as of June 30, 2023. In addition, we also selected a non-statistical sample of 5 equipment items to observe and noted 3 items that did not have a unique identifier and were not properly tagged. Cause: Although the University has policies and procedures in place over the physical inventory of property and fixed asset tagging, there was a lack of diligence in complying with the policies and procedures. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years and failure to properly tag equipment items resulted in noncompliance with the equipment and real property management requirement. Questioned Costs: None Identification of a repeat finding: N/A. Recommendations: We recommend the University be more diligent in complying with its established policies and procedures for the physical inventory ensuring all departments timely complete the physical inventory and reconcile the results with its property records. The University should also be more diligent in ensuring its equipment items all have unique identifiers or are properly tagged. Views of responsible officials: The HPU Business Office will initiate and ensure the completion and reconciliation of the physical inventory of all fixed assets which were acquired using federal funds at least every two years, to include the tagging of items in accordance with the university’s inventory and fixedasset related policy.

Criteria: 2 CFR 200.320 requires the non-Federal entity to have and use documented procurement procedures that are consistent with the standards outlined in that section. If small purchase procedures are used, 2 CFR 200.320(a)(2) requires price or rate quotations must be obtained from an adequate number of qualified sources. For acquisitions exceeding the simplified acquisition threshold, the non-federal entity must use one of the methods prescribed by 2 CFR 200.320(b) or (c): the sealed bid method; the competitive proposals method; or the noncompetitive proposals method (i.e., solicit a proposal from only one source) but only when one or more of four circumstances are met, in accordance with 2 CFR 200.320(c)). The University has adopted a Procurement Policy for Purchases Using Federal Funds that complies with the applicable procurement requirements. If purchases are over the micro-purchase threshold of $10,000, a Vendor Justification Form (VJF) must be completed and documentation maintained to support the selection of a vendor. For procurements above the micro-purchase threshold, the VJF requires a minimum of two bids; three preferred, for competitive purchase/bid procurements or documentation supporting noncompetitive purchase/bid procurements. Condition: Procurement documentation for one vendor was not prepared, failing to support compliance with the regulations above and the University’s procurement policy. Context: We selected a non-statistical sample of three procurements out of a population of fourteen vendors with total expenditures exceeding the micro-purchase threshold during the fiscal year. For one selection, the University’s VJF documenting and approving the small purchase procurement was not prepared. Cause: Despite having established procurement policies and procedures, there was a misunderstanding regarding their application in this particular instance. Management believed that having the vendor explicitly specified in the approved grant application exempted the University from following its procurement policy. Effect: Failure to properly perform the procedures required under the procurement process resulted in noncompliance with the procurement requirement. Questioned Costs: None Identification of a repeat finding: N/A. Recommendations: We recommend the University follow their procurement policies and procedures for purchases using federal funds and maintain evidence that the required procurement procedures were completed. Views of responsible officials: The HPU Office of Sponsored Projects (OSP) will strengthen its internal control to ensure that the procurement policy for purchases using federal funds is followed and that the documents required for procurement are completed and maintained, including in circumstances where the vendor was explicitly identified in an approved grant application. The Vendor Justification Form will be enforced for all purchases meeting the specific threshold amount when procuring using federal funds.

Criteria: 2 CFR 180.300 requires the non-Federal entity to verify that a person (defined as any individual, corporation, association, unit of government, or legal entity, however organized) they are entering into a covered transaction with is not suspended or debarred by: (a) checking SAM Exclusions; or (b) collecting a certification from that person; or (c) adding a clause or condition to the covered transaction with that person. Condition: Verification that an entity was not suspended or debarred was not performed timely for one entity. Context: The University entered into covered transactions with five entities during the fiscal year. We selected a non-statistical sample of two entities for testing, noting verification that the entity was not suspended or debarred was not performed timely for one entity. The procurement occurred in September 2022, however, the verification that the entity was not suspended or debarred was not performed until August 2023. We reviewed the subsequent verification and noted the entity did not have any exclusion records, indicating they were not suspended or debarred. Cause: Although the University has established policies and procedures in place over the procurement and suspension and debarment process, there was a lack of diligence in complying with the policies and procedures. Effect: Failure to perform required verification procedures could result in noncompliance with the procurement and suspension and debarment requirement. Questioned Costs: None Identification of a repeat finding: N/A. Recommendations: We recommend the University follow their procurement policies and procedures for purchases using federal funds and perform the required procurement procedures in a timely manner. Views of responsible officials: The HPU Office of Sponsored Projects will work collaboratively with the departments to ensure that the required procedure for verification of Suspension and Debarment is conducted timely. The Office of Sponsored Projects will strengthen its procedures so that verification from SAM is obtained prior to confirming procurement, as is required by existing policy. The Principal Investigator will work collaboratively with the Office of Sponsored Projects to ensure that the documentation is obtained in a timely manner. The Manager for Grants and Contracts will timely check SAM.gov for Suspension and Debarment and will maintain the documentation as required. The Assistant Vice President overseeing the Office of Sponsored Projects will review the documentation and ensure compliance with this requirement.

Criteria: 2 CFR 200.303(a) requires the non-Federal entity to establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. Condition: During our testing of the HEERF Program, for non-student related payroll and non-payroll expenditures, management did not provide sufficient support for justification for the allocation of these costs to the program. Consequently, we were unable to audit the allowability of these costs. Additionally, for expenditures related to financial aid grants to students, there was no independent review to ensure allowability of costs prior to disbursement. Context: For the non-student payroll-related expenditures, management indicated that department heads and the University?s Office of Sponsored Projects (OSP) held discussions to determine estimates of the time each departments? employees spent on allowable COVID-related activities; however, the discussion related to the rationale, basis and final allocations were not consistently documented. We selected a non-statistical sample of 20 payroll items representing $90,009 of which 17 items representing $75,564 had no documentation of the justification supporting the allocation. Total payroll expenditures for the program were $3,890,213. For non-student non-payroll expenditures, management did not consistently document the justification supporting the allocation of costs to the program. We selected a non-statistical sample of 15 items representing $659,611 of which 5 items representing $76,035 did not have documentation of the justification supporting the allocation. Total non-student non-payroll expenditures for the program were $2,899,106. For the financial aid grants to students, we noted that one person prepares the listing for disbursement with no independent review. Total financial aid grants to students was $4,301,887. Cause: Management indicated that due to the urgency in ensuring funds were distributed as quickly as possible, documented policies and procedures to administer the program were not developed and therefore not all supporting justifications were documented. For financial aid grants to students, management did not design a control to allow to provide for an independent review of allowability prior to disbursement. Effect: Expenditures for non-student related payroll, non-payroll items and financial aid grants to students could be disbursed for unallowable costs. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2021-002. Recommendations: The HEERF Program has ended for the University. We recommend that should similar programs become available in the future, that management develop documented policies and procedures to administer the program and that management maintain documentation to evidence the internal controls. Views of responsible officials: The HPU Financial Aid Office works hard to follow all federal regulations and guidance mandated for the Title IV Federal Student Aid programs. In regards to the distribution of the Federal HEERF fund to HPU students, the HPU Financial Aid Director relied on reports from the SIS (Banner system), Institutional Research, and Accounts Receivable to determine students eligible for HEERF funds. The HPU Financial Aid Office and Office of Sponsored Projects worked hard, and diligently, to award funds to students and expend Institution portion based on the regulations that were provided at the time and not violating the intent of the program, as evidenced by there not being any non-compliance over allowability of costs charged to Federal HEERF fund. For future awards, the Principal Investigator with the assistance of the Office of Sponsored Projects will review diligently the expenditure to be sure the expenditures are within the allowability and terms and conditions of the federal awards. Both offices will work collaboratively so that the internal controls over allowability are strengthened and that the documentation will be strongly implemented and retained. For future programs, the HPU Financial Aid will work to strategically plan, organize, and disburse funds to students and expend Institution funds within the requirements mandated by the United States Department of Education, including strengthening our internal controls over compliance, and increasing the documentation and maintenance of documentation over our existing internal controls for compliance.

Criteria: There are three components to reporting for HEERF: 1) public reporting on the (a)(1) Student Aid Portion (Quarterly Student Report); 2) public reporting on the (a)(1) Institutional Portion (a)(2) and (a)(3) subprograms (Quarterly Institutional Reports), as applicable; and 3) the annual report (Annual Report). The Coronavirus Aid, Relief, and Economic Security (CARES) Act 18004(e) and the Coronavirus Response and Relief Supplemental Appropriations Act (CRRSAA) 314(e) requires an institution receiving funds under HEERF I and HEERF II to submit a report to the secretary, at such time in such a manner as the secretary may require. While American Rescue Plan (ARP) does not explicitly identify procedures by which institutions must report on their uses of HEERF grant funds, ED exercises this reporting authority under 2 CFR section 200.328 and 2 CFR section 200.329. Per the Form Instructions included on the ?Quarterly Budget and Expenditure Reporting for HEERF I, II, and III (a)(1) Institutional Portion, (a)(2), and (a)(3), if applicable? form, the completed form must be conspicuously posted on the institution?s primary website no later than 10 days after the end of each calendar quarter. Additionally, the Form Instructions include that reports must be maintained for at least three years after the submission of the final report. Condition: Management did not provide sufficient documentation to support the data included in the Annual Report, Quarterly Institutional Reports and Quarterly Student Reports. In addition, for one quarter, a Quarterly Institutional Report and a Quarterly Student Report was not retained on the University?s website. Context: Management provided documentation to support the information included in the reports; however, in several instances, the information provided either did not agree to the data included in the reports or it was unclear as to how the information supported the reports. In addition, the Quarterly Institutional Report and Quarterly Student Report for the quarter ended September 30, 2021 was prepared and posted on the University?s website; however, the reports were erroneously removed. Cause: Management indicated that due to the urgency in ensuring funds were distributed as quickly as possible, documented policies and procedures over reporting for the program were not developed. Additionally, due to staff turnover, information was not retained in a manner that allowed it to be easily retrieved and compiled in a manner supporting the reports. Effect: The reports that were completed could contain inaccurate or incomplete data. In addition, the University was not compliant with the requirement to maintain the reports on the University?s website. Questioned Costs: None Identification of a repeat finding: This is a repeat finding of 2021-003. Recommendations: As the HEERF Program has ended for the University, we recommend that should similar programs become available in the future, that management develop documented policies and procedures to administer the program and that management maintain documentation to evidence the internal controls. Views of responsible officials: The HPU Office of Sponsored Projects (OSP) and Office of Financial Aid work to follow all federal reporting regulations and guidance mandated for the Federal grant & contract programs. For future programs, the Institutional Research, the Office of Sponsored Projects and the Financial Aid Office will generate the reports and will implement layers of review procedure to ensure that the reports are accurate, complete, submitted timely, and if needed, posted in HPU website. For the Institution portion, the Manager for Grants and Contracts will prepare the grant report and this report will be reviewed by the Assistant VP for OSP. For the student portion the periodic reports will be prepared by the staff of the Office of Financial Aid and will be reviewed by the Director of the Financial Aid office. The Business Office will perform a high-level independent review for completeness and accuracy. Finally, moving forward, all the files and documents that support the grant report will be retained.

Criteria: 2 CFR 200.320 requires the non-Federal entity to have and use documented procurement procedures that are consistent with the standards of that section. If small purchase procedures are used, 2 CFR 200.320(a)(2) requires price or rate quotations must be obtained from an adequate number of qualified sources. For acquisitions exceeding the simplified acquisition threshold, the non-federal entity must use one of the methods prescribed by 2 CFR 200.320(b) or (c): the sealed bid method; the competitive proposals method; or the noncompetitive proposals method (i.e., solicit a proposal from only one source) but only when one or more of four circumstances are met, in accordance with 2 CFR 200.320(c)). The University has adopted a Procurement Policy for Purchases Using Federal Funds that complies with the applicable procurement requirements. If purchases are over the micro-purchase threshold of $10,000, a Vendor Justification Form (VJF) must be completed and documentation maintained to support the selection of a vendor. The VJF requires a minimum of two bids; three preferred, for competitive purchase/bid procurements above the micro-purchase threshold. Condition: Procurement documentation for two vendors were not prepared and/or retained to support compliance with the regulations above and the University?s procurement policy. Context: We selected a non-statistical sample of three procurements out of a population of twelve vendors with total expenditures greater than the micro-purchase threshold during the fiscal year. For two selections, the University?s VJF documenting and approving the procurement was not prepared. Additionally, one small purchase selection did not include quotes from more than one vendor. Cause: Although the University has established policies and procedures in place over the procurement process, there was a lack of diligence in complying with and/or retaining documentation supporting compliance with the policies and procedures. Effect: Failure to perform and retain documentation of the procurement process resulted in noncompliance with the procurement requirement. Questioned Costs: None Identification of a repeat finding: N/A Recommendations: We recommend the University follow their procurement policy for purchases using federal funds and maintain evidence that the required procurement procedures were completed. Views of responsible officials: The HPU Office of Sponsored Projects (OSP) will work on strengthening its internal control to ensure that the procurement policy for purchases using federal funds is followed and that the documents required for procurement are completed and maintained. The Vendor Justification Form will be strictly enforced for purchases meeting the specific threshold amount when procuring using federal funds.

Criteria: 2 CFR 200.313(d)(2) requires the non-Federal entity take a physical inventory of property and reconcile the results with the property records at least once every two years. Condition: The physical inventory was not conducted as required. Context: In October 2021, the University conducted a physical inventory of all of its fixed assets which includes property acquired with federal funds. To facilitate the inventory, the University distributed a memo to all department heads detailing the procedures needed to conduct a physical inventory and instructed them to perform a physical inventory in their respective departments by December 1, 2021. During our audit, it was noted that the physical inventory was not completed by all departments. Based on the information provided by management there were 16 property items that were subject to inventory; however, because the inventory documentation provided did not cover all departments, only 1 property item was identified through the physical inventory. Cause: Although the University has procedures in place over the physical inventory of property, there was a lack of diligence in complying with the procedures. Effect: Failure to perform physical inventory of property and reconcile the results with the property records at least once every two years results in noncompliance with the equipment and real property management requirement. Questioned Costs: None Identification of a repeat finding: N/A Recommendations: We recommend the University follow their procedures for the physical inventory of equipment and ensure all departments timely complete the physical inventory. Views of responsible officials: The HPU Fixed Asset Accountant, Federal Grant Project Investigator and Office of Sponsored Projects will work collaboratively to ensure that the physical inventory of all fixed assets which were acquired using federal funds are conducted and completed periodically. This physical inventory monitoring will be done at least, every two years. The team will work on getting all departments covered in the periodic inventory to confirm that the fixed asset listing is complete, updated and maintained.

Criteria: 2 CFR 180.300 requires the non-Federal entity to verify that a person (defined as any individual, corporation, association, unit of government, or legal entity, however organized) they are entering into a covered transaction with is not suspended or debarred by: (a) checking SAM Exclusions; or (b) collecting a certification from that person; or (c) adding a clause or condition to the covered transaction with that person. Condition: Verification that an entity was not suspended or debarred was not performed for one entity. Context: The University entered into covered transactions with six entities during the fiscal year. We selected a non-statistical sample of two entities for testing, noting verification that the entity was not suspended or debarred was not performed for one entity. We re-performed the verification and noted the entity did not have any exclusion records, indicating they were not suspended or debarred. Cause: Although the University has established policies and procedures in place over the procurement and suspension and debarment process, there was a lack of diligence in complying with obtaining or retaining documentation supporting compliance with the policies and procedures. Effect: Failure to perform and retain documentation of the procurement process could result in noncompliance with the procurement and suspension and debarment requirement. Questioned Costs: None Identification of a repeat finding: N/A Recommendations: We recommend the University follow their procurement policy for purchases using federal funds and maintain evidence that the required procurement procedures were completed. Views of responsible officials: The HPU Office of Sponsored Projects will work collaboratively with the department to ensure that the required procedure for verification of Suspension and Debarment is consistently conducted and evidence of such procedure is maintained. The OSP Office will strengthen its policies and procedures so that the SAM screenshot for all covered transactions is complete and retained. The Principal Investigator should work collaboratively with the OSP to ensure that the documentation for suspension and debarment for vendors meeting this requirement is obtained and maintained. The Manager for Grants and Contracts will be sure to check the SAM.gov for suspension and debarment and will maintain the documentation. The Assistant VP of the Office of Sponsored Projects will review the documentation.

Criteria: 2 CFR 200.332 provides the various requirements for subrecipient monitoring. 2 CFR 200.332(f) requires pass-through entities to ?verify that every subrecipient is audited as required by Subpart F of this part when it is expected that the subrecipient?s Federal awards expended during the respective fiscal year equaled or exceeded the threshold set forth in ? 200.501.? The University has adopted a subrecipient monitoring policy which addresses the subrecipient monitoring requirements prescribed by 2 CFR 200.332 and includes a provision that the ?Office of Sponsored Projects (OSP) compiles an annual listing of all accounts with expenditures in sub-recipient account codes and requests audit reports from appropriate sub-recipients. The audit reports are reviewed by OSP and any exceptions are noted and reviewed with the sub-recipient. If findings of noncompliance are identified as a result of an audit, sub-recipients are required to provide copies of responses to auditors' reports and a plan for corrective action.? Condition: For one subrecipient the University did not obtain the single audit report and consequently, did not review for any applicable audit findings pertaining to the Federal award provided to the subrecipient. Context: The University had subrecipient agreements with two entities expected to have single audits. We selected one subrecipient for testing and noted that although the University performed the monitoring activities on the subrecipient during the year, the University did not obtain the single audit report for the entity. Cause: Although the University performed certain subrecipient monitoring procedures and has procedures in place to annually obtain and review single audit reports from applicable subrecipients, there was a lack of diligence in complying with the procedures. Effect: Failure to obtain and review the single audit reports of subrecipients, and consequently, not reviewing for any applicable audit findings pertaining to the Federal award provided to the subrecipient, could result in noncompliance with the subrecipient monitoring requirement. Questioned Costs: None Identification of a repeat finding: N/A Recommendations: We recommend the University follow their procedures for subrecipient monitoring to obtain and review single audit reports for subrecipients expected to obtain a single audit and review any applicable audit findings. Views of responsible officials: The HPU Office of Sponsored Projects will work collaboratively with the Principal Investigators together to ensure that the required procedure for subrecipient monitoring is conducted and evidence of such procedure is maintained. The OSP staff will strengthen its policies and procedures so that the required subrecipient single audit report is obtained and reviewed periodically to confirm that the recipient is in compliance with all the applicable federal regulations.

2021-001 ? Internal control and compliance finding over the proper reporting of beginning loan balances on the Schedule of Expenditures of Federal Awards Identification of the federal program: Assistance Listing Number 84.038 Federal Perkins Loan (FPL) ? U.S. Department of Education Assistance Listing Number 93.364 Nursing Student Loans - U.S. Department of Health and Human Services Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR 200.303 requires that a non-federal entity must (a) establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States and the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). 2 CFR Section 200.502(a) states, ?The determination of when a Federal award is expended must be based on when the activity related to the Federal award occurs? 2 CFR Section 200.502(b) states, ?Loan and loan guarantees (loans). Since the Federal Government is at risk for loans until the debt is repaid, the following guidelines must be used to calculate the value of Federal awards expended under loan programs? (2) Beginning of the audit period balance of loans from previous years for which the Federal Government imposes continuing compliance requirements.? Condition: On the preliminary Schedule of Expenditures of Federal Awards (SEFA) for the fiscal year ended June 30, 2021 (FY21), Hawai?i Pacific University did not account appropriately for certain items when calculating the beginning outstanding loan balances. Cause: Hawai?i Pacific University did not have effective internal controls to ensure the beginning outstanding loan balances were reported appropriately for the preliminary SEFA. Effect or potential effect: This condition resulted in an overstatement of the beginning outstanding loan balances in the amount of $934,676 ($703,707 for Federal Perkins Loan and $230,969 for Nursing Student Loans) on the preliminary SEFA for FY21. Questioned costs: No questioned costs, as the updated SEFA, as presented in this report, was adjusted for the items noted in the Context section below. Context: Hawai?i Pacific University?s preliminary SEFA included beginning outstanding loan balances that exceeded actual outstanding loan balances by $703,707 for the Federal Perkins Loan program and $230,969 for the Nursing Student Loans program. The preliminary SEFA for these two programs has been updated, as presented on the SEFA in this report, to reflect the appropriate amounts of actual outstanding loan balances for the items noted above (net $934,676 decrease to the Student Financial Assistance Cluster). Identification as a repeat finding, if applicable: No. Recommendation: We recommend that Hawai?i Pacific University implement processes and internal controls to ensure that the SEFA and footnotes to the SEFA report expenditures accurately. Views of responsible officials: The current year SEFA includes beginning loan balances, which are actual balances that are subject to compliance for the audit period, plus any new loans made in the year under audit. We will continue to present our SEFA in this manner on a go-forward basis.

2021-002 ? Internal control deficiency over the review of allowable or unallowable costs for the HEERF Institution and Student Portions Identification of the federal program: Assistance Listing Number 84.425E and F, Education Stabilization Fund COVID-19 Higher Education Emergency Relief Fund (HEERF) ? Student Portion and Institutional Portion US Department of Education Identification of the federal program: Award numbers: P425F200312 (May 4, 2020 ? May 17, 2022) and P42E200406 (April 24, 2020 ? May 17, 2022) Criteria or specific requirement (including statutory, regulatory or other citation): Title 2, Subtitle A Chapter II Part 200 Subpart D 200.303 Internal controls. The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Condition: During our testing over the HEERF Institutional Portion allowability testing, management noted that transaction level controls were in place and that a monthly control was in place to detail review expenditures before drawing down funds. However, we were not able to obtain and test documentation that these controls were in place and operating over certain allowable costs. When testing the HEERF Student Portion for allowability, we noted that one person prepared and disbursed the funds to students, with no separate review control in place. Cause: For the HEERF Institutional Portion, internal controls were not sufficiently documented. For the HEERF Student Portion, internal controls were not designed sufficiently over HEERF allowability for the period under audit. Effect or potential effect: The expenditure of both the HEERF Institutional and Student Portions could be expended for unallowable costs. Questioned costs: None noted. Context: HEERF Institutional Portion expenditures for which internal controls were not tested was $1,531,880. HEERF Student Portion expenditures for which internal controls were not tested was $1,192,600. No non-compliance was noted during our compliance testing. Identification as a repeat finding, if applicable: No. Recommendation: The HEERF Program has ended for the University. We recommend that should similar programs become available in the future, that management implement internal controls and processes to review expenditure transactions for allowability at a detailed level and throughout the period of availability, and that management maintain documentation to evidence the internal controls. Views of responsible officials: The HPU Financial Aid Office works hard to follow all federal regulations and guidance mandated for the Title IV Federal Student Aid programs. In regards to the distribution of the Federal HEERF fund to HPU students, the HPU Financial Aid Director relied on reports from the SIS (Banner system), Institutional Research, and Accounts Receivable to determine students eligible for HEERF funds. The HPU Financial Aid Office worked hard, and diligently, to award funds to students based on the regulations that were provided at the time and not violating the intent of the program, as evidenced by there not being any non-compliance over allowability of costs charged to Federal HEERF fund. For future programs, the HPU Financial Aid office will work to strategically plan, organize, and disburse funds to students within the requirements mandated by the United States Department of Education, including strengthening our internal controls over compliance, and increasing the documentation and maintenance of documentation over our existing internal controls over compliance.

2021-003 ? Internal control deficiency and noncompliance over the Annual and Quarterly reporting for the HEERF program Identification of the federal program: Assistance Listing Number 84.425E and F, Education Stabilization Fund COVID-19 Higher Education Emergency Relief Fund (HEERF) ? Student Portion and Institutional Portion US Department of Education Award numbers: P425F200312 (May 4, 2020 ? May 17, 2022) and P42E200406 (April 24, 2020 ? Criteria or specific requirement (including statutory, regulatory or other citation): Title 2, Subtitle A Chapter II Part 200 Subpart D 200.303 Internal controls. The non-Federal entity must: (a) Establish and maintain effective internal control over the Federal award that provides reasonable assurance that the non-Federal entity is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award. These internal controls should be in compliance with guidance in ?Standards for Internal Control in the Federal Government? issued by the Comptroller General of the United States or the ?Internal Control Integrated Framework?, issued by the Committee of Sponsoring Organizations of the Treadway Commission (COSO). The CARES Act 18004(e) and the CRRSAA 314(e) requires an institution receiving funds under HEERF I and HEERF II to submit a report to the secretary, at such time in such a manner as the secretary may require. Condition: During our testing over the Annual HEERF Report and the HEERF Institutional Quarterly Reports, management noted that once the report is prepared, several members of management perform a review of the report prior to submission. However, there is no evidence maintained to support that the review of the report occurred. In addition, for the Annual HEERF Report, we were unable to agree certain key items to supporting documentation. During our testing over the HEERF Student Quarterly Reports, we noted that there is no evidence maintained to support that a separate review control occurred. We also noted that the Student Quarterly Reports is one cumulative report, which is posted to the University?s website. The report is updated each quarter and prior versions of the report are overwritten. We were able to test a few key items related to the June 30, 2021, year in the cumulative Student Quarterly Report, including key items as of September 30, 2020. However, we were unable to obtain support to tie out certain December 31, 2020, key items, and key items for March 31, 2021 and June 30, 2021, were overwritten and not reported on the report Cause: There is no evidence of the review control in place over the Annual HEERF Report, the HEERF Institutional Quarterly Reports, and the HEERF Student Quarterly Reports. The HEERF Student Quarterly Reports were overwritten for March 2021 and June 2021. Effect or potential effect: The various HEERF reports could contain inaccurate or incomplete data. The HEERF Student Quarterly Reports are not able to be reviewed for March 2021 and June 2021. Questioned costs: None noted. Context: The Annual HEERF Report had no evidence of review. In addition, we were unable to agree a few items to supporting documentation. The HEERF Institutional Quarterly Reports had no evidence of review. We were able to tie out all items in the report to supporting documentation. The HEERF Student Quarterly Reports had no evidence of review. The March 2021 and June 2021 Student Quarterly Reports were not available for testing, as they were overwritten. For the December 2020 Student Quarterly Report, we were unable to agree key items #3 ? #5 to supporting documentation. In addition, for the September 2020 Student Quarterly Report we were unable to agree key item #4 to supporting documentation. Identification as a repeat finding, if applicable: No. Recommendation: The HEERF Program has ended for the University. We recommend that should similar programs become available in the future, that management implement internal controls and processes to maintain evidence of the review, maintain copies of each required report, and maintain supporting details for each required report. Views of responsible officials: The HPU Office of Sponsored Projects (OSP) works to follow all federal regulations and guidance mandated for the Federal grant & contract programs. In regards to the distribution of the Federal HEERF fund to HPU, the HPU Assistant Vice President-OSP relied on reports from the COGNOS Fiscal Reporting program, Institutional Research, divisional leaders [e.g., Deans, VPs, and/or directors] and HPU Business Office to determine a unit?s eligibility for HEERF funds. The HPU Office of Sponsored Projects worked diligently to award funds to units based on the regulations that were provided at the time and not violating the intent of the program. For future programs, the HPU Office of Sponsored Projects will work to strategically plan, organize, and disburse funds to university units within the requirements mandated by the United States Department of Education. As part of the tactical plan, we will look into adding a layer of review for federal reports for any future programs. Reports will be reviewed by the Assistant Vice President of the Office of Sponsored Research. The Business Office will perform a high-level review for completeness and accuracy.

Finding 2019-001 Internal control deficiency and noncompliance over L. Reporting ? Financial Reporting: timely submission of Pell payment data to the Common Origination and Disbursement (COD) System. Information on the federal program: Student Financial Assistance Cluster (fiscal year ended June 30, 2019); 84.063 Federal Pell Grant Program, United States Department of Education. Criteria or specific requirement (including statutory, regulatory or other citation): 34 CFR section 690.83 (3) (b)(2) states that ?An institution shall submit, in accordance with deadline dates established by the Secretary, through publication in the Federal Register, other reports and information the Secretary requires and shall comply with the procedures the Secretary finds necessary to ensure that the reports are correct.? Per the Federal Register?s 2018-2019 Award Year Deadline Dates for Reports and Other Records Associated with the Free Application for Federal Student Aid (FAFSA), an institution must submit Pell Grant disbursement records to COD, ?no later than 15 days after making the disbursement or becoming aware of the need to adjust a previously reported disbursement.? Condition: During our testing over the COD System process of Pell payment data, we noted that for 9 students who received Pell grants, the reporting of their Pell data was made after the 15-day limit. Cause: Management did not have controls and procedures in place to ensure Pell payment data were reported within the 15-day limit. Effect or potential effect: Pell payment data were not reported timely to the Department of Education. Questioned costs: None. Context: During our testing over the COD System process of Pell payment data, we noted that for 9 students who received Pell grants ($16,721) out of our sample of 40 students who received Pell grants ($158,824), the reporting of their Pell data was made after the 15-day limit. These 9 Pell reports were made between 26 and 91 days after the Pell grants were paid to the students. Identification as a repeat finding, if applicable: Yes, 2018-002. Recommendation: We recommend management implement controls and procedures to report Pell payment data within the required 15-day period after disbursement of Pell grant funds. Views of responsible officials: The Associate Director of Financial Aid has been educated on the reporting requirement and the purpose for timely reporting. Files will be sent to COD on a weekly basis going forward. A new process will also be implemented by keeping an internal log of files sent/received via COD on a shared drive that can be reviewed by the Director of Financial Aid on a periodic basis to ensure timely reporting is being completed.

Finding 2019-002 Internal control deficiency and noncompliance over N4. Enrollment Reporting ? Timely submission of the Enrollment Reporting roster file to the National Student Loan Data System (NSLDS). Information on the federal program: Student Financial Assistance Cluster (fiscal year ended June 30, 2019); CFDA No. 84.007 Federal Supplemental Educational Opportunity Grants; 84.038 Federal Perkins Loan (FPL) ? Federal Capital Contributions; 84.063 Federal Pell Grant Program; 84.268 Federal Direct Student Loans; 84.379 Teacher Education Assistance for College and Higher Education Grants (TEACH Grants); United States Department of Education. Criteria or specific requirement (including statutory, regulatory or other citation): 34 CFR 682.610(c)(2) states that, ?Unless it expects to submit its next updated enrollment report to the Secretary within the next 60 days, a school must notify the Secretary within 30 days after the date that the school discovers that: (i) A loan under title IV of the Act was made to or on behalf of a student who was enrolled or accepted for enrollment at the school, and the student has ceased to be enrolled on at least a half-time basis or failed to enroll on at least a half-time basis for the period for which the loan was intended; or (ii) A student who is enrolled at the school and who received a loan under title IV of the Act has changed his or her permanent address.? Also see 34 CFR 685.309(b)(2). Condition: During our testing over enrollment reporting, we noted that for 1 student out of 25 who had a change in status, the Enrollment Reporting roster was not submitted until after the 30 and 60-day limits. It was discovered by management that an additional 421 students were not submitted until after the 30 and 60-day limits. The students were submitted on September 27, 2019, 145 days after the graduation date of May 5, 2019, making their submission 85 days subsequent of the 60-day reporting requirement. In addition, we noted that the University?s control: ?The Registrar?s Office, in cooperation with the Financial Aid Office, conducts monthly audits of the compulsory NSC Fall and Spring Enrollment files with a sample of 25 students per month. [N5.1]? was not in operation during the year ended June 30, 2019. Cause: Management did not have controls and procedures in place to ensure Enrollment Reporting rosters were reported within the 30 and 60-day limit. Effect or potential effect: Enrollment Reporting roster data was not reported timely to the Department of Education. Questioned costs: None. Context: During our testing over the enrollment reporting process, we noted that 1 out of our sample of 25 students who had a status change, the Enrollment Reporting roster was submitted 131 days after the 30 and 60-day limit. In addition, management noted that for all Spring 2019 graduates (421 students), the Enrollment Reporting roster was not submitted until September 27, 2019, 85 days after the 60-day timeline, and 145 days after the Spring 2019 graduate date of May 5, 2019. In addition, we noted that management?s monthly control: ?The Registrar?s Office, in cooperation with the Financial Aid Office, conducts monthly audits of the compulsory NSC Fall and Spring Enrollment files with a sample of 25 students per month. [N5.1]? was not in operation during the year ended June 30, 2019. Identification as a repeat finding, if applicable: Not a repeat finding. Recommendation: We recommend management implement controls and procedures to submit the Enrollment Reporting rosters within the required 30 and 60- day period after student status changes occur. We also recommend that management perform their N5.1 monthly control to conduct an audit of 25 enrollment files, by sampling students per month. Views of responsible officials: Beginning with the September 2019 reporting cycle, a review of the reporting process was implemented, completed, and additional evaluation check points were implemented. HPU determined that to ensure compliance with the NSLDS reporting requirements it reports to the NSC every 30 days and responds within 5 business days to NSLDS error reports via the NSC website. To audit the accuracy of our enrollment reporting, the Registrar?s Office has established a partnership to implement the Enrollment Reporting (ER) Graduated/Withdrawn Campus Report (SCHEC1) that can extract and validate the campus enrollment at a specific point in time and validate compliance. A monthly random sample of 25 students who receive federal aid will be conducted with Financial Aid to review current NSLDS enrollment reported statuses. The Registrar?s Office will verify that each of the selected student?s enrollment status with NSLDS is accurately reflected in the Banner system and in the NSC reporting file. This random audit should take place around the 25th day of each month, beginning the close of the 1st quarter on 31 March 2020.

Finding 2019-003 Internal control deficiency and noncompliance over F. Equipment and Real Property Management ? Physical tagging of federally purchased equipment. Information on the federal program: Research and Development Cluster, CFDA 11.609 ? Measurement and Engineering Research and Standards, Award 60NANB12D224, 2014, U.S. Department of Commerce; CFDA 93.859, Biomedical Research and Research Training, Award KA130009, 2015 and 2017, U.S. Department of Health and Human Services. Criteria or specific requirement (including statutory, regulatory or other citation): 2 CFR section 200.313(d)(1) and (3) state that ?(1) Property records must be maintained that include a serial number or other identification number. (3) A control system must be developed to ensure adequate safeguards to prevent loss, damage, or theft of the property.? Condition: During our testing over the equipment process, we noted that for four equipment items, there was not a physical asset tag or any other identifying number on the asset which could be traced back to the property records. Cause: Management had controls and procedures in place to tag federal equipment items but did not always follow the documented controls. Effect or potential effect: Certain federal equipment cannot be identified by asset tag or identification number. Questioned costs: None. Context: During our testing over the equipment process, we noted that for four federal equipment items ($51,175) out of our sample of eight federal equipment items ($183,157), there was no physical asset tag or identifying number on the asset. Total net book value of federal equipment at the University is $188,183. Identification as a repeat finding, if applicable: Not a repeat finding. Recommendation: We recommend management follow their documented controls and procedures, and physically tag all federal equipment items with a serial number or identifying number as required by 2 CFR section 200.213. Views of responsible officials: Management will review and update the fixed asset policy to cover assets that will not be tagged for justifiable reasons, conduct a physical inventory and update the fixed asset master listing to ensure each asset has a unique identifier. Department Heads will be contacted to identify and provide Business Office with unique identifiers (e.g. serial number, vin, etc.) found on assets that will be included in the master listing. For assets without unique identifiers, a tag (sticker label) will be provided by the Business Office to the Department Heads.

GSA_MIGRATION

GSA_MIGRATION