significant deficiencies in internal control over compliance and therefore, material weaknesses or significant deficiencies may exist that were not identified. We did not identify any deficiencies in internal control over compliance that we consider to be material weaknesses. However, as discussed below, we did identify certain deficiencies in internal control over compliance that we consider to be material weaknesses and significant deficiencies.

A deficiency in internal control over compliance exists when the design or operation of a control over compliance does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance with a type of compliance requirement of a federal program on a timely basis. A material weakness in internal control over compliance is a deficiency, or a combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a type of compliance requirement of a federal program will not be prevented, or detected and corrected, on a timely basis. We consider the deficiency in internal control over compliance described in the accompanying schedule of findings and questioned costs as item 2022-017 to be a material weakness.

A significant deficiency in internal control over compliance is a deficiency, or a combination of deficiencies, in internal control over compliance with a type of compliance requirement of a federal program that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention by those charged with governance. We consider the deficiencies in internal control over compliance described in the accompanying schedule of findings and questioned costs as items 2022-006 through 2022-016, 2022-018, and 2022-019 to be significant deficiencies.

Our audit was not designed for the purpose of expressing an opinion on the effectiveness of internal control over compliance. Accordingly, no such opinion is expressed.

Government Auditing Standards requires the auditor to perform limited procedures on the University's response to the internal control over compliance findings identified in our compliance audit described in the accompanying schedule of findings and questioned costs. The University's response was not subjected to the other auditing procedures applied in the audit of compliance and accordingly, we express no opinion on the response.

The purpose of this report on internal control over compliance is solely to describe the scope of our testing of internal control over compliance and the results of that testing based on the requirements of Uniform Guidance. Accordingly, this report is not suitable for any other purpose.

Blue & Co., LLC

Lexington, Kentucky April 15, 2024

112.