Audit of the Bunker Hill Community College Objectives, Scope, and Methodology

An overview of the purpose and process of auditing the Bunker Hill Community College

Overview

In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor has conducted a performance audit of certain activities of Bunker Hill Community College (BHCC) for the period March 1, 2020 through June 30, 2021.

We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Below is a list of our audit objectives, indicating each question we intended our audit to answer; the conclusion we reached regarding each objective; and, if applicable, where each objective is discussed in the audit findings.

Objective	Conclusion
Did BHCC administer the student portion of funding under the Coronavirus Aid, Relief, and Economic Security (CARES) Act and the Coronavirus Response and Relief Supplemental Appropriations Act (CRRSAA) in accordance with Sections C(13), (14), and (15); D(18); and E(19), (20), and (21) of the United States Department of Education’s (US DOE’s) Higher Education Emergency Relief Fund (HEERF) Frequently Asked Questions (FAQ) Rollup Document and Question 6 of US DOE’s Higher Education Emergency Relief Fund (HEERF II) Public and Private Nonprofit Institution (a)(1) Programs ([Catalog of Federal Domestic Assistance, or CFDA] 84.425E and 84.425F) Frequently Asked Questions?	Yes
Did BHCC record and report the institutional portions of CARES Act, CRRSAA, and Governor’s Emergency Education Relief (GEER) funding in accordance with Sections 200.302(b)(1) and (b)(2) of Title 2 of the Code of Federal Regulations (CFR), which the federal Office of Management and Budget (OMB) uses in its Uniform Guidance (2014)?	No; see Finding 1
Did BHCC calculate lost revenue that it recovered in accordance with Questions 9 and 10 of US DOE’s Higher Education Emergency Relief Fund (HEERF I, II, and III) Lost Revenue Frequently Asked Questions?	Yes
Did BHCC provide the student portion of GEER funding to eligible students in accordance with Attachment A of the interdepartmental service agreement (ISA) between the Massachusetts Executive Office of Education (EOE) and the Massachusetts Department of Higher Education?	Yes
Did BHCC update its internal control plan (ICP) to address the impact of the 2019 coronavirus (COVID-19) pandemic as required by the Office of the Comptroller of the Commonwealth’s (CTR’s) “COVID-19 Pandemic Response Internal Controls Guidance,” dated September 30, 2020?	No; see Finding 2
Did BHCC implement an enterprise-wide cybersecurity awareness training program as required by Sections 6.2.1.1 and 6.2.1.2 of the Executive Office of Technology Services and Security’s (EOTSS’s) Information Security Risk Management Standard IS.010?	No; see Finding 3

 

To achieve our objectives, we gained an understanding of the internal controls related to the objectives by reviewing applicable policies and interviewing BHCC officials. We evaluated the design and implementation of controls over BHCC’s purchasing process, its ICP, and any cybersecurity awareness training. In addition, we performed the following procedures to address the objectives.

• To determine whether BHCC administered the student portion of the CARES Act funding in accordance with Sections C, D, and E of US DOE’s Higher Education Emergency Relief Fund (HEERF) Frequently Asked Questions (FAQ) Rollup Document and Question 6 of US DOE’s Higher Education Emergency Relief Fund (HEERF II) Public and Private Nonprofit Institution (a)(1) Programs (CFDA 84.425E and 84.425F) Frequently Asked Questions, we used the CARES Act student disbursement data from Colleague² and selected a statistical, random sample of 60 disbursements (totaling $46,798) out of 13,668 disbursements (totaling $11,067,254), using a 95% confidence level, a 5% tolerable error rate, and a 0% expected error rate. Of the 60 transactions sampled, 50 were related to the block grant (an award of funds that was provided to all eligible BHCC students from HEERF I funding), and 10 were related to the emergency fund grant (an award of funding to students who applied, based on financial hardships caused by the COVID-19 pandemic). We reviewed the institutional student information record (ISIR) for each student to verify that the student had completed a Free Application for Federal Student Aid for the 2019–2020 academic year. To verify that students had enrolled in in-person classes by March 13, 2020, we reviewed student transcripts and obtained a written testimonial statement from BHCC attesting that it had not offered online classes before the pandemic. We reviewed the request for for each student who had received the emergency fund grant to verify that the purpose of each payment was allowable. To determine whether payment methods were allowable, we verified that payments to students were made by a method approved by US DOE, and we reviewed issued checks and electronic fund transfer detail summaries from BHCC’s banking institutions to determine whether the amounts disbursed matched the approved amounts.
• To determine whether BHCC recorded and reported the institutional portions of CARES Act, CRRSAA, and GEER funding in accordance with 2 CFR 200.302(b)(1) and (b)(2), which OMB uses in its Uniform Guidance (2014), we conducted a detailed analysis of the required Quarterly Budget and Expenditure Reports for CARES Act and CRRSAA funding. During the audit period, BHCC generated three of these quarterly reports, using data on spreadsheets that were independently maintained by its staff, for the fiscal quarters ended September 30, 2020; December 31, 2020; and March 31, 2021. We performed analytical procedures that compared these Quarterly Budget and Expenditure Reports to Quarterly Budget and Expenditure Reports for the same fiscal quarters that BHCC had updated in November 2021 to identify the differences between them. We then performed analytical procedures that compared data on the independently maintained spreadsheets to institutional fund expenditures recorded in Colleague to identify the federal grants with which institutional expenditures were associated.
• To determine whether lost revenue recovered by BHCC was calculated in accordance with Higher Education Emergency Relief Fund (HEERF I, II, and III) Lost Revenue Frequently Asked Questions, we reperformed BHCC’s calculation of lost revenue recovered for accuracy and analyzed the method used to determine the recovery amount.
• To determine whether BHCC provided the student portion of GEER funding in accordance with Attachment A of the ISA between EOE and the Massachusetts Department of Higher Education, we selected a random, nonstatistical sample of 50 student disbursements (totaling $42,820), using the TeamMate+ Analytics software program,³ from a population of 340 (totaling $288,720). We reviewed each student’s ISIR to verify that the student had completed a Free Application for Federal Student Aid for the academic year, and we reviewed copies of each student’s request form to verify that the purpose of the payment was allowable. We examined transcripts to verify that the students were Massachusetts residents, had satisfactory academic progress in accordance with BHCC’s academic policy, and had not earned bachelor’s or professional degrees.
• To determine whether BHCC had updated its ICP to address the effect of COVID-19, as required by CTR’s “COVID-19 Pandemic Response Internal Controls Guidance” (dated September 30, 2020), we selected BHCC staff members who administered the ICP. From BHCC’s comptroller, associate vice president of administration and finance, and vice president of administration and finance, we obtained testimonial evidence of noncompliance with the requirement of updating the ICP.
• To determine whether BHCC implemented an enterprise-wide cybersecurity awareness training program as required by Sections 6.2.1.1 and 6.2.1.2 of EOTSS’s Information Security Risk Management Standard IS.010, we selected BHCC staff members who would have administered any such program. We obtained testimonial evidence of noncompliance with the requirement from BHCC’s vice president of administration and finance, chief information officer, and associate vice president of human resources and labor relations.

When using nonstatistical sampling, we could not project the results to the entire population.

Data Reliability

To gain an understanding of the data in Colleague, we reviewed BHCC policies related to certain general information technology controls, including access controls, personnel screening, and account management. In addition, we obtained and reviewed a System and Organization Controls Report⁴ and gap letter⁵ from BHCC to ensure that controls operated effectively.

We assessed the completeness and accuracy of the CARES 18004(a)(1), CARES 18004(a)(2), and GEER Fund student disbursement lists extracted from Colleague by performing data integrity tests to identify blank fields, data outside our audit period, and duplicate data. We also observed the financial aid director retrieving student records, which contained student applications for grants and financial aid, from the electronic file cabinet⁶ where they were stored. We traced a sample of 20 payment records from the Colleague CARES Act and GEER Fund student disbursement lists to these student records. Next, we traced a sample of 20 student records from the electronic file cabinet back to the CARES Act and GEER Fund disbursement lists from Colleague.

As a result of these procedures, we determined that the data obtained were sufficiently reliable for the purpose of our audit.

We obtained data related to institutional fund expenditures provided by BHCC staff members, including spreadsheets maintained by BHCC staff members; data from Colleague for the period March 1, 2020 through June 30, 2020; and data related to the Colleague institutional fund expenditures for the period July 1, 2020 through June 30, 2021. We identified issues related to the reliability of these data that we discuss in Finding 1.

2.    Colleague is the database system for BHCC’s administrative activities, accounting, and student files.

3.    This is an Excel-based data analytics tool that allows auditors to execute advanced data analysis.

 

4.    This is a report on an independent review of the information system controls of software to attest to the security of the software for a specific period of time.

5.    We obtained the gap letter because the System and Organization Controls Report did not cover the entire our audit period. It attests to the security of the software for the missing period, stating that no changes to the system had been made that would compromise its security.

6.    An electronic file cabinet is software that collects information submitted by an outside user and does not alter the entered information.

Date published:	June 13, 2022