Overview
In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor has conducted a performance audit of certain activities of Quinsigamond Community College (QCC) for the period March 1, 2020 through June 30, 2023. When examining employee settlement agreements entered into by QCC, we extended the audit period to January 1, 2019 through December 30, 2023.
We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.
Below is a list of our audit objectives, indicating each question we intended our audit to answer; the conclusion we reached regarding each objective; and, if applicable, where each objective is discussed in the audit findings.
| Objective | Conclusion |
|---|---|
| No; see Finding 2 and Other Matters |
| Yes |
| No; see Finding 1 |
| No; see Finding 3 |
To accomplish our audit objectives, we gained an understanding of QCC’s internal control environment relevant to our objectives by reviewing applicable college policies and procedures and by interviewing QCC’s staff members and management. To obtain sufficient, appropriate evidence to address our audit objectives, we performed the procedures described below.
CARES Act, CRRSAA, and ARPA Student Portion
To determine whether QCC administered the student portion of CARES Act, CRRSAA , and ARPA funding in accordance with the United States Department of Education’s (US DOE’s) Higher Education Emergency Relief Fund (HEERF) Frequently Asked Questions (FAQ) Rollup Document, HEERF II Public and Private Nonprofit Institution (a)(1) Programs ([Catalog of Federal Domestic Assistance (CFDA)] 84.425E and 84.425F) FAQ, and HERRF III FAQ, as well as QCC’s own distribution method, we divided the population of 12,180 student grants into three categories—CARES Act, CRRSAA, and ARPA—totaling $19,662,806 for the audit period. For each category, we conducted the following procedures.
CARES Act
To determine whether QCC administered the student portion of the CARES Act in accordance with US DOE’s HEERF FAQ Rollup Document, we tested a random, statistical sample3 of 60 payments to students, totaling $40,182, from the total population of 3,782 payments to students, totaling $2,655,519, using a 95% confidence level,4 a 0% expected error rate,5 and a 5% tolerable error rate,6 for the audit period. We determined whether each student in our sample had completed a 2019–2020 Free Application for Federal Student Aid (FAFSA); was enrolled in at least one on-campus course on March 13, 2020; had maintained satisfactory academic progress;7 and had a QCC Emergency Grants Application on file. We examined QCC’s student applications, FAFSA records, and student transcripts and compared those documents to the student awards disbursement records.
Additionally, to determine whether QCC disbursed the student-portion funding in accordance with US DOE’s HEERF FAQ Rollup Document, we determined whether each student completed a 2019–2020 FAFSA and received a $270 award,8 and we examined QCC’s student academic records.
CRRSAA
To determine whether QCC administered the student portion of the CRRSAA in accordance with US DOE’s HEERF II Public and Private Nonprofit Institution (a)(1) Programs (CFDA 84.425E and 84.425F) FAQ, as well as its own method for calculating each distribution amount, we tested a random, statistical sample of 60 payments to students, totaling $112,087, from the total population of 4,261 payments to students, totaling $6,762,514, using a 95% confidence level, a 0% expected error rate, and a 5% tolerable error rate, for the audit period. We verified that each student in our sample was enrolled in at least one three-credit spring 2021 course, had maintained satisfactory academic progress, and had exceptional financial need.9 We examined QCC’s student applications, student transcripts, and student bills and compared those documents to the student award disbursement records.
Additionally, to determine whether QCC disbursed the student portion in accordance with US DOE’s HEERF II Public and Private Nonprofit Institution (a)(1) Programs (CFDA 84.425E and 84.425F) FAQ, as well as its own method for calculating each distribution amount, we determined whether each student recipient had completed a 2020–2021 FAFSA, was Pell Grant eligible, and was enrolled in at least one course for the spring 2021 semester. We determined each student’s enrollment status in our sample.10
To determine whether QCC disbursed the student portion of funding for students with outstanding balances in accordance with US DOE’s HEERF II Public and Private Nonprofit Institution (a)(1) Programs (CFDA 84.425E and 84.425F) FAQ, we determined whether recipient students had past-due bills and were enrolled in a degree or certificate program at any point between March 13, 2020 through the end of the spring 2021 semester.
To determine whether QCC awarded a single CRRSAA student-portion grant for less than the minimum of $200, we examined the CRRSAA student award disbursement records to verify that there was no single student portion awarded under $200.
ARPA
To determine whether QCC administered student requests for additional assistance from the ARPA funding in accordance with US DOE’s HERR III FAQ, as well as its own method for calculating each distribution amount, we tested a random, statistical sample of 60 payments to students, totaling $144,754, from the total population of 4,137 payments to students, totaling $10,244,773, using a 95% confidence level, a 0% expected error rate, and a 5% tolerable error rate, for the audit period. We determined whether each student had submitted an online application for additional assistance, whether the additional assistance was related to COVID-19, whether each student was enrolled in a degree or certificate program on or after March 13, 2020, and whether each student had exceptional financial need. We examined QCC’s student applications and student transcripts and compared those documents to the student award disbursement records.
Additionally, to determine whether QCC disbursed student-portion funds in accordance with US DOE’s HERRF III FAQ, as well as its own method for calculating each distribution amount, we determined whether each student was enrolled in summer 2021 and/or fall 2021 courses, had a 2020–2021 FAFSA on file, and was Pell Grant eligible. We also determined their enrollment status.
To determine whether QCC awarded any ARPA student-portion grants less than the $200 minimum, we examined the ARPA student award disbursement records to verify that there was no single student-portion grant awarded under $200. We verified that payments to students were made via checks to determine whether the payment method for the students awarded through the QCC Emergency Grant Application and the student-portion grant process was in accordance with a method approved by US DOE.
We examined the cumulative total disbursements for each student for all the HEERF awards (CARES Act, CRRSAA, and ARPA) to determine whether QCC disbursed to students an excess of $7,000 cumulatively (excluding grants that covered outstanding balances at QCC).
During our testing, we noted that QCC did not have an adequate segregation of duties over the calculation, distribution, and publication of the HEERF grants to students. This led to questionable computations of student awards. See Other Matters.
CARES Act, CRRSAA, and ARPA Institutional Portion
To determine whether QCC administered the institutional portion of CARES Act, CRRSAA, and ARPA funding in accordance with US DOE’s HEERF FAQ Rollup Document, HEERF II Public and Private Nonprofit Institution (a)(1) Programs (CFDA 84.425E and 84.425F) FAQ, and HERRF III FAQ, we examined a random, statistical sample of 60 institutional transactions, totaling $129,418, from the total population of 1,810 transactions, totaling $9,216,220, using a 95% confidence level, a 0% expected error rate, and a 5% tolerable error rate, for the audit period. We obtained QCC’s cost center report and, for each sampled transaction, we inspected purchase orders, vouchers, invoices or bills, emails, payment vouchers, and/or receipts to determine the reason for the transaction, whether the transaction was related to the disruption of campus operations because of COVID-19, whether the documentation adequately supported the need for each item or service, and whether the transaction was allowable.
Lost Revenue
To determine whether lost revenue recovered by QCC, totaling $6,248,440, was calculated in accordance with US DOE’s Higher Education Emergency Relief Fund (HEERF I, II, and III) Lost Revenue FAQ, we obtained QCC’s loss of revenue rationale, calculations, methodology, underlying data, budgets, and projections for fiscal years 2021 and 2022 to determine whether the institutional-funds portion was used, the source of revenue, and whether the loss of revenue was associated with COVID-19. We reperformed QCC’s calculation of lost revenue recovered, for accuracy, and verified that the budget to actual method was used to determine the recovery amount.
Governor’s Emergency Education Relief Student Funding
To determine whether QCC administered the student portion of the Governor’s Emergency Education Relief (GEER) funding under the CARES Act in accordance with US DOE’s FAQ about the GEER Fund, we examined a random, nonstatistical sample11 of 40 student awards, totaling $25,652, out of the total population of 367 GEER student awards totaling, $198,269. For each student transaction, we determined whether the student was a Massachusetts resident, was enrolled in a degree or certificate program for the semester awarded, completed a FAFSA, had an emergency grant application on file or received a QCC Financial Aid email outreach notification, had maintained satisfactory academic progress, had a self-certification of need for assistance due to COVID-19, and had not earned a baccalaureate or professional degree. We examined student FAFSA and emergency grant applications, email outreach notifications, student transcripts, student satisfactory academic progress records, and student education records. Additionally, we examined the student award disbursement records to determine whether any transactions granted for the fall 2020 and spring 2021 semesters exceeded $1,000. We also reperformed QCC’s calculation of GEER student awards to ensure accuracy.
GEER Institutional Funding
To determine whether QCC administered the institutional portion of GEER funding in accordance with US DOE’s FAQ about the GEER Fund and the GEER institutional interdepartmental service agreement between the Massachusetts Department of Higher Education and QCC, we selected a random, nonstatistical sample of 20 institutional transactions, totaling $108,927, from the population of 78, totaling $595,175. We examined QCC’s GEER institutional journal entries and inspected purchase orders, vouchers, emails, quotes, invoices or bills, and/or receipts to determine whether each expense was incurred between March 1, 2020 and December 30, 2020; what the purpose of each expense was; whether each transaction was related to the disruption of campus operations due to COVID-19; whether funding was used for staff members, student services, or building services; and whether each transaction was allowable.
We noted no significant exceptions in testing. Therefore, we concluded that, for items sampled for the audit period, QCC received and administered Education Stabilization Funds that were authorized through the CARES Act, the CRRSAA, and the ARPA in accordance with the guidance that was provided by the respective funding entities.
ICP COVID-19 Updates
To determine whether QCC updated its ICP to address the effects of COVID-19, as required by CTR’s “COVID-19 Pandemic Response Internal Controls Guidance,” we received and reviewed internal control questionnaires from fiscal years 2020, 2021, and 2022 and compared them to QCC’s ICPs that were in effect as of June 30, 2020, June 30, 2021, and June 30, 2022. For fiscal years 2020, 2021, and 2022, we also compared the internal control questionnaires to the ICPs to determine whether QCC updated its risk assessments related to COVID-19.
We noted no exceptions in testing. Therefore, we concluded that, during the audit period, QCC updated its ICP as required by CTR’s “COVID-19 Pandemic Response Internal Controls Guidance.”
Cybersecurity Awareness Training
To determine whether QCC provided its employees during the audit period with annual cybersecurity awareness training or initial cybersecurity awareness training, in accordance with EOTSS’s Information Security Risk Management Standard IS.010, we interviewed QCC employees on how QCC administers and tracks the completion of its initial and annual cybersecurity awareness training. Additionally, we reviewed the completion report from the third-party company that QCC uses to provide this training to its employees to determine whether all newly hired employees completed the initial training and whether all employees completed the training annually. We examined the human resources employee list that was provided to us by QCC’s executive director of human resources to determine which employees were required to take QCC’s annual cybersecurity training. We also examined this list to determine the population of newly hired employees. From the list of 1,843 employees, we determined that 1,258 employees were required to take QCC’s annual cybersecurity awareness training by reviewing whether the employee was hired on or before the date the training was implemented. We examined 37 newly hired employees who were hired after the annual training, between March 10, 2023 and June 30, 2023.
During the audit, we noted that QCC did not require its employees to complete cybersecurity awareness training before February 16, 2023. After QCC established a March 10, 2023 deadline, we determined that 553 employees (44%) did not complete the training and that 138 employees (11%) completed the training late. Also, QCC did not require the 37 employees hired between March 10, 2023 and June 30, 2023 to complete the cybersecurity awareness training within 30 days of hire. See Finding 1.
Employee Settlement Agreements
To determine whether QCC had internal policies and procedures in place for (a) the review and approval of employee settlement agreements, including the language used, and (b) the reporting of employee settlement agreements to CTR, we interviewed QCC’s executive director of human resources. QCC stated that it follows CTR’s Settlements and Judgments Policy for any employee settlement agreements involving monetary payments.
To determine whether QCC entered into employee settlement agreements that included non-disclosure, non-disparagement, or similarly restrictive clauses, we reviewed language in all 20 employee settlement agreements that QCC entered into from January 1, 2019 through December 30, 2023. For all 20 settlement agreements, totaling $116,710, we determined whether there was a copy of an executed settlement agreement retained for each settlement. Additionally, we reviewed all 20 employee settlement agreements to determine whether any resulted in an employee’s receiving a monetary payment. We determined that 6 settlement agreements were nonmonetary and 14 resulted in monetary settlement agreements in the form of lump-sum payments or back-pay damages. All 14 monetary settlement agreements were processed through CTR.
For all 14 monetary employee settlement agreements, we determined whether the settlement was handled in accordance with CTR’s Settlements and Judgments Policy by reviewing supporting documentation for the following:
- whether QCC’s legal counsel or the chief financial officer was listed as the central point of contact on the SJ Authorization Form;
- whether the claimant or claimant’s attorney was provided with “Notice of Settlement/Judgment Tax Reporting and Withholdings, Claimant Receipt of W-2, 1099-MISC or 1099-INT Forms”;
- whether signatures and payment amounts were complete and accurate by examining a copy of the SJ Authorization Form, which was submitted to CTR for each settlement;
- whether CTR approved payment of each settlement claim by examining a copy of the approval email from CTR; and
- whether the settlement requests were sent to CTR within two weeks after the SJ Authorization Form was signed by QCC’s counsel.
Additionally, we took a random, nonstatistical sample of two out of six no-rehire provisions comprising one out of five monetary and the one nonmonetary employee settlements. We examined QCC’s human resources “watch list”12 to ensure that these former employees’ names were listed.
During our testing, we noted that QCC did not have a documented, transparent, or accountable process related to employee settlement agreements, including those containing non-disclosure, non-disparagement, or similarly restrictive clauses. See Finding 3.
We used a combination of statistical and nonstatistical sampling methods for testing, and we did not project the results of our testing to any corresponding populations.
Data Reliability Assessment
COVID-19 Funding
To determine the reliability of the data from QCC’s campus-wide administrative application, database, and financial system, we interviewed QCC officials who were knowledgeable about the datasets for institutional and student transactions and system users. To ensure data accuracy and completeness, we verified formulas and examined for hidden rows and columns in each spreadsheet. We also tested certain general information system controls (including security management, access controls, configuration management, segregation of duties, and contingency planning) over QCC’s accounting and finance system.
To determine the reliability of the student awards and institutional transactions, we reconciled each award amount for HEERF institutional and student portions (CARES Act, CRRSAA, and ARPA) to the Grant Award Notifications from US DOE, the total detailed transaction list of institutional expenditures, and the detailed student awards list. For the GEER student portion, we reconciled the GEER student awards list to the GEER Community College Award Notification letter. For the GEER institutional portion, we reconciled the institutional transaction report to the GEER Institutional interdepartmental service agreement between QCC and the Massachusetts Department of Higher Education from CTR.
Additionally, we tested the CARES Act, CRRSAA, ARPA, and GEER Fund student grant lists for hidden rows and columns, duplicate records, and records outside the audit period. We also traced a sample of 20 student HEERF (CARES, CRRSAA, and ARPA) awards and a sample of 10 student GEER awards from the list provided by the associate vice president of finance at QCC to each student’s application. Since there were no physical applications, we traced back a random sample of 20 student HEERF (CARES, CRRSAA, and ARPA) electronic applications and a sample of 10 student GEER electronic applications to the award list. We tested the CARES Act, CRRSAA, ARPA, and GEER Fund institutional transaction lists for hidden rows and columns, duplicate records, and records outside the audit period.
For HEERF institutional transactions, we took a random sample of 20 transactions and traced those expenditures from the transaction list back to the corresponding invoices. We sampled 20 HEERF institutional invoices back to the transaction list. For the GEER institutional portion, we traced a random sample of 10 expenditures from the transaction list to the corresponding invoices. To ensure completeness, we reconciled the GEER institutional expenditures to QCC’s fiscal year 2021 Single Audit, which was itemized on the Schedule of Expenditures of Federal Awards.
To determine the reliability of QCC’s accounting and finance system user list, we compared the system user list to the list of employees provided by QCC’s Human Resources Department. For our information systems controls testing, we also requested access request documentation for users who have access to the accounting portion of the system.
Cybersecurity Awareness Training
To determine the reliability of the cybersecurity awareness training records we obtained from KnowBe4, we reviewed System and Organization Control Reports13 covering the audit period. We ensured that certain information system control tests (access controls, security management, configuration management, contingency planning, and segregation of duties) had been performed without exception. We received and examined the list of 1,843 employees from QCC’s executive director of human resources. We then reduced the population by 585 employees who were either hired outside the audit period or separated employment before the March 10, 2023 deadline. We tested 1,258 employees who were active during the period. We reviewed the date of any employee terminations to ensure that corresponding employees were not terminated before the beginning of the audit period. We reconciled the active employees list to the cybersecurity awareness training list. We also examined the spreadsheets for hidden rows and columns.
Employee Settlement Agreements
To determine the reliability of the list of employee settlement agreements created by QCC during the extended audit period of January 1, 2019 through December 30, 2023, we reviewed the original list of all 16 original employee settlement agreements that we received from QCC. We also examined the spreadsheet for hidden rows and columns. After requesting further documentation from QCC, we found that there were four additional nonmonetary settlements that were not included in the original employee settlement agreement list, which resulted in a total of 20 employee settlement agreements for the audit period. We determined that 6 of the 20 employee settlement agreements did not result in monetary payments. We further determined that these were not processed through CTR. Additionally, we determined that 13 out of the 20 employee settlements resulted in lump-sum payments and 1 out of the 20 employee settlements resulted in back-pay damages, which were all processed for payment through CTR. We examined CTR’s settlements and judgments transparency quarterly reports for the audit period. We then verified that any of the 14 employee settlement agreements that resulted in a lump-sum payment or back-pay damages were the only monetary employee settlement agreements listed on QCC’s independent list. Additionally, we found two other monetary settlements that were not on QCC’s independent list, which we confirmed were for nonemployees (student, visitor, or vendor) and, therefore, were not included for our review.
Based on the results of the data reliability assessment procedures described above, we determined that the information we obtained was sufficiently reliable for the purposes of our audit. However, we did identify several information technology general control issues we believe warrant QCC’s attention, which we have disclosed as a finding in this audit report. See Finding 2.
| Date published: | April 4, 2025 |
|---|