Quadrivium College, an undergraduate institution of higher education, maintains student records on a server operated by its information technology department. Due to a programming mistake, the system made it possible for anybody, with a little effort, to access and tamper with student grades from the school’s website. As far as anyone knows, no one actually exploited the vulnerability. Nevertheless, recognizing that disclosure of grades to inappropriate persons could violate the Family Education Rights and Privacy Act of 1974 (FERPA), the college’s president retained an outside consultant to investigate. Her hope was that by launching an investigation before news came out about any breach, the school might receive leniency in any subsequent enforcement action by the U.S. Department of Education. Unfortunately, the consultant accidentally deleted the information that would have made it possible to determine whether grades had been disclosed. What do you recommend?