Sonoran University of Health Sciences

Federal Agency: Department of Education

Federal Program Title: Student Financial Assistance Cluster

Assistance Listing Number: Various

Award Period: October 1, 2024 through September 30, 2025

Type of Finding: • Significant Deficiency in Internal Control over Compliance • Other Matters

Criteria or Specific Requirement: The Code of Federal Regulations, 34 CFR 682.604, states that institutions must ensure that exit counseling is conducted with each Stafford Loan borrower and graduate or professional PLUS Loan borrower in person or by interactive electronic means. The exit counseling must inform the student of the various repayment options.

Condition: During our testing, we noted one of the 40 students did not have completed exit counseling procedures on file.

Questioned Costs: None reported

Context: During our testing, it was noted the University stated they performed the procedures verbally and did not retain written documentation.

Cause: The University’s processes and controls did not ensure that exit counseling procedures were appropriately documented.

Effect: The University did not comply with Department of Education (ED) regulations by failing to complete exit counseling for this student.

Repeat Finding: No

Recommendation: We recommend the University review its controls around exit counseling procedures to ensure that all students who withdrew or graduated with a Stafford or PLUS loan had exit counseling performed for them and appropriate documentation is retained.

Views of Responsible Officials: There is no disagreement with the audit finding.

Federal Agency: Department of Education Federal Program Title: Student Financial Assistance Cluster ALN Numbers: Various Award Period: October 1, 2022 through September 30, 2023 Type of Finding: • Significant Deficiency in Internal Control Over Compliance • Other Matters

Criteria or specific requirement: The Gramm-Leach-Bliley Act (GLBA) requires financial institutions to explain their information-sharing practices to their customers and to safeguard sensitive data (16 CFR 314). Institutions are required to develop, implement, and maintain a comprehensive information security program that is written in one or more readily accessible parts. The regulations require the written information security program to include nine elements for institutions with 5,000 or more customers, (16 CFR 314.3(a)). The written information security program (WISP) for institutions with fewer than 5,000 customers must address seven elements (16 CFR 314.3(a) and 16 CFR 314.6). The elements that an institution must address in its written information security program are at 16 CFR 314.4. At a minimum, the institution’s written information security program must address the implementation of the minimum safeguards identified in 16 CFR 314.4(c)(1) through (8) including: Assess apps developed by the institution. In addition, the written security program provides for the institution to regularly test or otherwise monitor the effectiveness of the safeguards it has implemented (16 CFR 314.4(d)).

Condition: There were three missing items from the Written Information Security Program. We did not identify procedures in place to securely dispose sensitive information. Standards should include a two-year retention period and a requirement that the institution periodically reviews its data retention period. We also did not identify in the WISP the institution's continuous monitoring capabilities and control testing. If continuous monitoring is not in place at the institution, then the institution should include within the written information security program, its processes to perform an annual penetration test and semi-annual vulnerability assessments. Lastly, we did not identify that the WISP includes the institution's continuous monitoring capabilities and control testing. If continuous monitoring is not in place at the institution, then the institution should include within the written information security program, its processes to perform an annual penetration test and semi-annual vulnerability assessments.

Questioned costs: None

Context: These new GLBA requirements were applicable beginning on June 9, 2023 and there were three elements missing from their WISP.

Cause: There was not a formal process in place to review against all the new GLBA requirements to ensure compliance.

Effect: Student personal information could be vulnerable.

Repeat Finding: No

Recommendation: We recommend that the University review the updated GLBA requirements and ensure their WISP includes all required elements.

Views of responsible officials: There is no disagreement with the audit finding.