Northland Pioneer College

Criteria: Establishing a process for managing risk that follows a credible industry source, such as the National Institute of Standards and Technology, helps the District to effectively manage risk related to IT systems and data. CFR Guidance (Based on GLBA 16 CFR – 314.4) – Addresses how the institution will oversee its information system service providers (16 CFR 314.4(f)).

Condition: The District’s written information security program does not include a vendor due diligence program as required by the Gramm-Leach-Bliley Act (GLBA) 16 CFR 314.4(f).

Questioned Costs: None

Cause: The District’s written information security program did not include established policies and standards specifically addressing vendor risk management.

Effect: The District is exposed to loss of revenue, reputation damage, disclosure of non-public data, loss of technology assets as a result of the following:

• Potential security breaches due to insufficient evaluation and monitoring of vendors who interact with sensitive data. • Inadequate assessment of risks associated with outsourcing services or managing services through vendors. • Establishing relationships with vendors that do not support the District’s strategic objectives, lack financial stability, or have inadequate controls.

This absence makes it difficult to ensure that vendors who interact with sensitive data are properly evaluated, selected, and monitored, potentially leading to security breaches and noncompliance with regulatory requirements.

Repeat Finding: Yes; 2024-004

Recommendation: The District should ensure that the written information security program includes a vendor due diligence program. This program should include:

• Standards for evaluating and selecting vendors who interact with sensitive data. • Contract provisions that require third-party vendors to maintain safeguards. • Ongoing monitoring based on the risk the vendor presents.

Also, appropriate policy and standards documentation should be established to support the vendor management program.

View of responsible official: The District agrees with the finding, see the Corrective Action Plan.

Criteria: Per 34 CFR 690.83(b)(2), an institution must report any enrollment status changes, including the date of the change per the institution’s reporting system, to the National Student Loan Data System (NSLDS) for participating students within 60 days of the change.

Condition: We found that the District did not report enrollment status changes to the NSLDS by the required federal deadlines for 40 of the 40 (100 percent) students we tested.

Questioned Costs: None

Cause: The District did not have adequate internal controls in place to ensure that it fully complied with federal student enrollment reporting requirements for the Title IV Student Financial Assistance program.

Effect: Enrollment reporting is a critical compliance requirement for institutions participating in the federal Student Financial Assistance program. For recipients of Pell Grants, timely enrollment reporting by institutions assists with their eligibility, future disbursement amounts, and continued access to Student Financial Assistance. Failure to meet the required enrollment status change reporting timeliness increases the District’s risk of material noncompliance with federal Student Financial Assistance program requirements.

Repeat Finding: No

Recommendation: We recommend that the District strengthen its internal controls over reporting student enrollment changes to NSLDS to ensure that enrollment effective dates are reported to NSLDS within 60 days of an enrollment status change occurring.

Views of Responsible Officials: The District agrees with the finding, see the Corrective Action Plan.