Audit of Bristol Community College Objectives, Scope, and Methodology

An overview of the purpose and process of auditing Bristol Community College.

Overview

In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor has conducted a performance audit of certain activities of Bristol Community College (BRC) for the period March 1, 2020 through June 30, 2023.

We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Below is a list of our audit objectives, indicating each question we intended our audit to answer; the conclusion we reached regarding each objective; and, if applicable, where each objective is discussed in the audit findings.

Objective	Conclusion
Did BRC administer the student portion of funding under Section 18004(a)(1) of the Coronavirus Aid, Relief, and Economic Security (CARES) Act in accordance with Sections C, D, and E of the United States Department of Education’s (US DOE’s) Higher Education Emergency Relief Fund (HEERF) Frequently Asked Questions (FAQ) Rollup Document?	Yes
Did BRC administer the student portion of funding under Section 314(a)(1) of the Coronavirus Response and Relief Supplemental Appropriations Act (CRRSAA) and Section 2003(a)(1) of the American Rescue Plan Act (ARPA) in accordance with the HEERF II Public and Private Nonprofit Institution (a)(1) Programs (Catalog of Federal Domestic Assistance [CFDA] 84.425E and 84.425F) FAQ and HEERF III FAQ?	Yes
Did BRC administer the institutional portion of funding in accordance with US DOE’s HEERF I, II, and III FAQs?	Yes
Did BRC update its internal control plan to address the COVID-19 pandemic in accordance with the Office of the Comptroller of the Commonwealth’s (CTR’s) “COVID-19 Pandemic Response Internal Controls Guidance,” dated September 30, 2020?	Yes
Did BRC adhere to Sections 6.2.3 and 6.2.4 of the Executive Office of Technology Services and Security’s Information Security Risk Management Standard IS.010 with regard to cybersecurity awareness training?	No; see Finding 1
Did BRC have internal policies and procedures in place for (a) the review and approval of employee settlement agreements, including the use of non-disclosure, non-disparagement, or similarly restrictive clauses, and (b) the reporting of monetary employee settlements to CTR in accordance with Sections 5.06 and 5.09 of Title 815 of the Code of Massachusetts Regulations?	No; see Finding 2

To accomplish our audit objectives, we gained an understanding of the aspects of BRC’s internal control environment relevant to our objectives by reviewing applicable policies and procedures, by reviewing BRC’s internal control plan, and by interviewing BRC management and employees.

To obtain sufficient, appropriate evidence to address our audit objectives, we performed the procedures described below.

CARES Act Student Funds

To determine whether BRC administered the student portion of funding under Section 18004(a)(1) of the CARES Act in accordance with the guidance provided in Sections C, D and E of US DOE’s HEERF I FAQ Rollup Document, we performed the procedures described below.

We obtained a list of all 5,001 students who received CARES Act student-portion funding, totaling $2,346,557, during the audit period from BRC’s Banner system. From this list, we selected a random, statistical sample³ of 60 students, using a 95% confidence level,⁴ a 0% expected error rate,⁵ and a 5% tolerable error rate⁶ for testing. The total amount of CARES Act student-portion funding associated with our sample was $28,206 (1.2%). For each student in our sample, we reviewed BRC’s electronic student account records, including each student’s financial aid awards, account information, and course credit details. We determined whether each student was enrolled during the spring or fall 2020 semester, had certified that they were impacted by the COVID-19 pandemic, and had attended at least one class in person and were, therefore, eligible to receive CARES Act student-portion funding.

To determine whether the amount of CARES Act student-portion funding that each student received was accurate, we reviewed BRC’s electronic student account records to verify the number of registered credit hours for each student and determined whether each student had received a Pell Grant, which is a federal grant for students with the highest financial need. We calculated the amount each student should have received using BRC’s established distribution methodology, which had different tiers based on each student’s registered credit hours and whether they had received a Pell Grant.

For the spring 2020 semester, eligible students received the higher of two calculated amounts as their CARES Act student award: either 25% of their Pell Grant–awarded amount or their registered credit hours multiplied by $25. The minimum award amount was $250, meaning eligible students would receive at least $250 even if both calculations resulted in a lower amount.

For the fall 2020 semester, eligible students’ award amounts were determined by two factors: their Pell Grant status and the number of their registered credit hours. The payments were as follows:

• Students received $858 if they were Pell Grant recipients with 12 or more registered credit hours.
• Students received $546 if they were Pell Grant recipients with fewer than 12 registered credit hours.
• Non–Pell Grant students received $312 if they had 12 or more registered credit hours.
• Non–Pell Grant students received $156 if they had fewer than 12 registered credit hours.

We compared each of our calculated amounts to the actual amounts students received from BRC for agreement.

Based on the results of our testing, we determined that, during the audit period, BRC appropriately administered the student portion of funding that we sampled under Section 18004(a)(1) of the CARES Act in accordance with Sections C, D, and E of US DOE’s HEERF FAQ Rollup Document. Because we used statistical sampling, we believe the results of our analysis accurately represent the larger population.

CARES Act, CRRSAA, and ARPA Institutional Funds

To determine whether BRC administered the student portion of funding under Section 314(a)(1) of the CRRSAA and Section 2003(a)(1) of the ARPA in accordance with US DOE’s HEERF II Public and Private Nonprofit Institution (a)(1) Programs (CFDA 84.425E and 84.425F) FAQ and Section B of US DOE’s HEERF III FAQ, we performed the procedures described below.

We obtained a list of all 15,928 students who received CRRSAA and/or ARPA (HEERF II and HEERF III) student-portion funding, totaling $11,339,187, during the audit period from BRC’s Banner system. From this list, we selected a random, statistical sample of 60 students, using a 95% confidence level, a 0% expected error rate, and a 5% tolerable error rate for testing. The total amount of CRRSAA and ARPA student-portion funding associated with our sample was $42,300 (0.37%). For each student in our sample, we reviewed BRC’s electronic student account records, including each student’s financial aid awards, account information, and course credit details. We determined whether each student was enrolled during the spring 2021 through the spring 2023 semesters, had certified that they were impacted by COVID-19, and were, therefore, eligible to receive CRRSAA and/or ARPA student-portion funding.

To determine whether the amount of CRRSAA and/or ARPA student-portion funding that each student received was accurate, we reviewed BRC’s electronic student account records to verify the number of registered credit hours for each student and determined whether each student received a Pell Grant. We calculated the amount that each student should have received using BRC’s established distribution methodology, which had different tiers based on students’ registered credit hours and whether they received a Pell Grant. We then compared each of our calculated amounts to the actual amounts students received from BRC for agreement.

For the fall 2021 semester, payments were as follows:

• Students received $750 if they were Pell Grant recipients with 12 or more registered credit hours.
• Students received $550 if they were Pell Grant recipients with between 3 and 12 registered credit hours.
• Students received $400 if they were Pell Grant recipients with fewer than 3 registered credit hours.
• Non–Pell Grant students received $400 as long as they had registered credit hours.

For the spring 2022 semester, payments were as follows:

• Students received $1,000 if they were Pell Grant recipients with 12 or more registered credit hours.
• Students received $800 if they were Pell Grant recipients with between 3 and 12 registered credit hours.
• Students received $450 if they were Pell Grant recipients with fewer than 3 registered credit hours.
• Non–Pell Grant students received $450 if they had 12 or more registered credit hours.
• Non–Pell Grant students received $350 if they had between 3 and 12 registered credit hours.
• Non–Pell Grant students received $250 if they had fewer than 3 registered credit hours.

For the summer 2022 semester, payments were as follows:

• Students received $1,000 if they were Pell Grant recipients with 12 or more registered credit hours.
• Students received $750 if they were Pell Grant recipients with between 3 and 12 registered credit hours.
• Students received $500 if they were Pell Grant recipients with fewer than 3 registered credit hours.
• Non–Pell Grant students received $600 if they had 12 or more registered credit hours.
• Non–Pell Grant students received $400 if they had between 3 and 12 registered credit hours.
• Non–Pell Grant students received $250 if they had fewer than 3 registered credit hours.

For the fall 2022 semester, payments were as follows:

• Students received $1,600 if they were Pell Grant recipients with 12 or more registered credit hours.
• Students received $1,100 if they were Pell Grant recipients with fewer than 12 registered credit hours.
• Non–Pell Grant students received $750 if they had 12 or more registered credit hours.
• Non–Pell Grant students received $400 if they had fewer than 12 registered credit hours.

For the spring 2023 semester, payments were as follows:

• Students received $1,500 if they were Pell Grant recipients with 12 or more registered credit hours.
• Students received $1,100 if they were Pell Grant recipients with between 3 and 12 registered credit hours.
• Students received $700 if they were Pell Grant recipients with fewer than 3 registered credit hours.
• Non–Pell Grant students received $1,000 if they had 12 or more registered credit hours.
• Non–Pell Grant students received $700 if they had between 3 and 12 registered credit hours.
• Non–Pell Grant students received $500 if they had fewer than 3 registered credit hours.

Based on the results of our testing, we determined that BRC appropriately administered the student portions of funding that we sampled under Section 314(a)(1) of the CRRSAA and Section 2003(a)(1) of the ARPA during the audit period. Because we used statistical sampling, we believe the results of our analysis accurately represent the larger population.

CRRSAA and ARPA Student Funds

To determine whether BRC administered the institutional portion of funding in accordance with US DOE’s HEERF I, II, and III FAQs, we performed the following procedures:

• We obtained a list of all 7,036 CARES Act, CRRSAA, and ARPA transactions, totaling $17,566,434, classified as the institutional-portion transactions during the audit period. We then stratified the population into the following two subpopulations:
  • One subpopulation had 97 transactions, with each valued more than $50,000.
  • The other subpopulation had 6,939 transactions, with each valued less than or equal to $50,000.
• We selected a random, nonstatistical sample of 20 transactions, totaling $1,857,315 (11%), from the subpopulation of 97 transactions over $50,000.
• We selected a random, statistical sample of 60 transactions, totaling $21,592 (0.12%), from our subpopulation of transactions under $50,000, using a 95% confidence level, a 0% expected error rate, and a 5% tolerable error rate.
• For our total of 80 sampled transactions, we requested and reviewed hardcopy supporting documentation (purchase orders, general journal entries, invoices/bills, emails, payroll records, receipts, etc.) to identify the nature of the expense and to determine whether the expense was related to COVID-19 and allowable under the CARES Act, CRRSAA, and ARPA.

Based on the results of our testing, we determined that, during the audit period, BRC appropriately administered the institutional portion of funding (that we sampled) under the CARES Act, CRRSAA, and ARPA.

Internal Control Plan COVID-19 Updates

To determine whether BRC updated its internal control plan to address the effects of COVID-19 in accordance with CTR’s “COVID-19 Pandemic Response Internal Controls Guidance,” dated September 30, 2020, we obtained BRC’s Internal Control Questionnaires submitted to CTR for fiscal years 2021, 2022, and 2023, as well as BRC’s internal control plan in place during the audit period. We also obtained BRC’s COVID-19 policy updates made during the audit period. We reviewed this documentation for evidence that the five objectives outlined in CTR’s “COVID-19 Pandemic Response Internal Controls Guidance” were addressed.

Based on the results of our testing, we determined that BRC appropriately updated its internal control plan during the audit period. BRC created and updated its policies and procedures in accordance with the five objectives of CTR’s “COVID-19 Pandemic Response Internal Controls Guidance.”

Cybersecurity Awareness Training

To determine whether BRC adhered to Sections 6.2.3 and 6.2.4 of the Executive Office of Technology Services and Security’s Information Security Risk Management Standard IS.010 with regard to cybersecurity awareness training, we selected a random, statistical sample of 60 employees, using a 95% confidence level, a 0% expected error rate, and a 5% tolerable error rate, from the population of 1,644 employees active during the audit period. We reviewed the KnowBe4 training results data to determine whether employees completed the required annual cybersecurity awareness training.

Additionally, we selected a random, nonstatistical sample of 50 employees from the population of 508 employees newly hired during the audit period. We determined whether each employee completed initial cybersecurity awareness training within 30 days of their hire date.

See Finding 1 for more information regarding the results of our testing related to cybersecurity awareness training.

Employee Settlement Agreements

To determine whether BRC had internal policies and procedures in place for (a) the review and approval of employee settlement agreements, including the language used, and (b) the reporting of employee settlement agreements to CTR, we interviewed BRC’s vice president of administration and finance. BRC stated that it follows CTR’s Settlements and Judgments Policy for the processing of payments for employee settlement agreements. According to CTR’s Settlements and Judgments Policy, BRC is only required to report monetary employee settlements to CTR. Nonmonetary settlements are not required to be reported.

To determine whether BRC included non-disclosure, non-disparagement, or similarly restrictive clauses in employee settlement, we obtained a list of all 14 employee settlements (5 monetary and 9 nonmonetary) executed during the audit period. We requested and reviewed the language in the associated employee settlement agreements, documenting any instances of restrictive language.

See Finding 2 for more information regarding the use of employee settlement agreements by BRC.

To determine whether BRC properly reported monetary settlements to CTR, we requested and reviewed copies of the settlement documentation. We determined whether the employee settlement agreements were signed by authorized representatives of both the employee and BRC. For the five monetary settlements, we determined whether the SJ Authorization Form detailed the terms of the settlement claim payment and was signed by BRC’s chief financial officer and general counsel. We also determined whether the emails from CTR documented the review and approval of the settlement claim for payment. These emails served as evidence that the required documentation was reported to CTR. In the event that an employee settlement agreement, SJ Authorization Form, or CTR email could not be provided by BRC, we looked for the settlement’s inclusion as part of CTR’s quarterly Settlements and Judgments Transparency Report,⁷ which applies only to monetary settlements, to serve as evidence that the settlement was reported.

Based on the results of our testing, we determined that BRC appropriately reported all 5 monetary employee settlements to CTR for approval, as required by Section 5.00 of Title 815 of the Code of Massachusetts Regulations.

We used a combination of statistical and nonstatistical sampling methods for testing, and we did not project the results of our testing to the corresponding populations.

Data Reliability Assessment

Banner System Data—Students and COVID-19 Funding

To determine the reliability of the data obtained from BRC’s Banner system, we interviewed BRC officials who were knowledgeable about the data. We also reviewed certain general information system controls (including security management, access controls, configuration management, segregation of duties, and contingency planning) over BRC’s Banner system.

We obtained a list of all students registered at BRC during the audit period. Students who received grant funds and students who did not receive grant funds were included in this list, as well as their total credits (in-person credits and online credits), eligible grant-award amounts, and grant-award amounts paid. There were 58,043 registered student records from the audit period, across nine different semesters, with award amounts totaling $13,685,744. We reviewed a random sample of 20 students. We traced each student’s enrollment information, award amounts, and credits to the records maintained by the student accounts office. We reviewed canceled checks or direct deposit confirmations (where applicable) to verify the amounts paid to students.

We also obtained a list of CARES Act, CRRSAA, and ARPA institutional transactions (totaling $17,566,434) made during the audit period from BRC’s special grants accountant. We traced a random sample of 20 transactions from our population to the hardcopy invoices, and we traced the information from a random sample of 20 hardcopy invoices from within the audit period to the list of transactions. For all 40 of the sampled transactions, we verified payment amounts by reviewing hardcopy direct deposit confirmations and canceled checks (when applicable). In addition, we checked these lists for hidden rows and columns, missing values in key data fields, and duplicate records. We compared each expenditure total by fiscal year against the reported total amount expended in BRC’s audited financial statements. We also compared the expenditure amounts against the Grant Award Notifications⁸ that BRC received from US DOE.

Cybersecurity Awareness Training

To determine the reliability of the cybersecurity awareness training records we obtained from KnowBe4, we reviewed System and Organization Control Reports⁹ covering the audit period. We ensured that certain information system control tests (access controls, security management, configuration management, contingency planning, and segregation of duties) had been performed without exception.

To determine the reliability of the list of 1,644 unique full-time and part-time employees that we obtained from BRC, we verified that the employee names, identification numbers, and employment date information for a sample of 20 employee records matched personnel files. We then traced employee information from a sample of 20 personnel files to the employee list. We accessed the Human Resources Compensation Management System, the Commonwealth’s official payroll system, to append employment start dates and end dates (if applicable) to the list of employees.

As part of our review, we also ensured that the format of dates was correct, checked for employment start and end dates outside the audit period, checked for missing values in key data fields, and checked for duplicate records within the list.

Employee Settlement Agreements

BRC’s vice president of administration and finance provided a list of 14 records representing employee settlement agreements entered into between current or former employees and BRC during the audit period. 

To ensure the accuracy of the list, we traced each employee name, settlement date, amount, and type of confidentiality language included in the list to source documents (copies of the settlement agreement and SJ Authorization Form). To ensure the completeness of the monetary settlements, we traced each employee name, date, amount, and funding source from CTR’s Settlements and Judgments Access data from the period to BRC’s settlement list. 

As of part of our review, we also ensured that the formats of dates and dollar amounts were correct, checked for settlement dates outside the audit period, checked for missing values in key data fields, and checked for duplicate records within the list.

Based on the results of the data reliability assessment procedures described above, we determined that the information we obtained was sufficiently reliable for the purposes of our audit.

3.    Auditors use statistical sampling to select items for audit testing when a population is large and contains similar items. Auditors generally use a statistical software program to choose a random sample when sampling is used. The results of testing using statistical sampling, unlike those from judgmental sampling, can usually be used to make conclusions or projections about entire populations.

4.    Confidence level is a mathematically based measure of the auditor’s assurance that the sample results (statistic) are representative of the population (parameter), expressed as a percentage.

5.    Expected error rate is the number of errors that are expected in the population, expressed as a percentage. It is based on the auditor’s knowledge of factors such as prior year results, the understanding of controls gained in planning, or a probe sample.

6.    The tolerable error rate (which is expressed as a percentage) is the maximum error in the population that is acceptable while still using the sample to conclude that the results from the sample have achieved the objective.

7.    In accordance with Section 2 of Chapter 28 of the General Laws, CTR is required to submit quarterly reports each fiscal year on payments from the Settlements and Judgments Reserve Account. These reports provide information on payees, amounts, and the associated Commonwealth of Massachusetts department or agency for settlements and judgments paid from appropriation account under line item 1599-3384 in the state budget.

8.    This notification is a legally binding document that informs the grantee (the institution) and others that an award has been made, contains or references all terms and conditions of the award, and documents the obligation of federal funds.

9.    A System and Organization Control report is a report on controls, issued by an independent contractor, about a service organization’s systems relevant to security, availability, processing integrity, confidentiality, or privacy.

Date published:	March 26, 2025