No Safeguards Rule Audit Objective For FY18 Confirmed

Last month, EDUCAUSE reported, per our friends at the Council on Governmental Relations (COGR), that the FY18 federal single audit process was very unlikely to include a Gramm-Leach-Bliley Act (GLBA) Safeguards Rule audit objective as previously expected. In its June community update, COGR now confirms that the FY18 single audit guidance does not include a Safeguards Rule objective. (Please see "Securing Student Information, Department of Education (ED).")

In addition, the U.S. Department of Education section of the FY18 audit guidance, as provided by the Association of International Certified Professional Accountants (AICPA) based on the full "compliance supplement" produced by the federal Office of Management and Budget (OMB), contains no references to the Safeguards Rule or an audit objective related to it.

With that, EDUCAUSE members may rest assured that the FY18 federal single audit process, with which most colleges and universities have to contend, will not address Safeguards Rule compliance. It is reasonable to assume, though, that the Office of Federal Student Aid (FSA) at the U.S. Department of Education will seek to include a Safeguards Rule objective in the FY19 single audit process.

EDUCAUSE, NACUBO, COGR, and other groups negotiated audit objective text with FSA and OMB in 2017, and EDUCAUSE will continue to work with our partners to confirm that this is the text FSA and OMB will ultimately use. (Please see "GLBA Audit Objective Text Online"; skip the hyperlink to the FSA site and scroll down to the copy of the text provided in the post.) In the meantime, EDUCAUSE members should use that text as the basis for conversations with their business offices and institutional audit firms about how best to prepare for a Safeguards Rule audit objective in the FY19 single audit process.

Jarret Cummings is Director of Policy and Government Relations at EDUCAUSE.