Overview
In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor has conducted a performance audit of certain activities of Fitchburg State University (FSU) for the period March 1, 2020 through December 31, 2021.
We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.
Below is a list of our audit objectives, indicating each question we intended our audit to answer; the conclusion we reached regarding each objective; and, if applicable, where each objective is discussed in the audit findings.
|
Objective |
Conclusion |
|
Yes |
|
Yes |
|
Yes |
|
Yes |
|
Yes |
|
Yes |
|
Yes |
|
Yes |
|
No; see Finding 1 |
To achieve our objectives, we gained an understanding of FSU’s internal control environment related to our objectives by reviewing applicable FSU policies and procedures and interviewing FSU management. In addition, we performed the following procedures to address the objectives.
CARES Act Student Portion
We determined whether FSU administered the student portion of funding under Section 18004(a)(1) of the CARES Act in accordance with Sections C, D, and E of US DOE’s Higher Education Emergency Relief Fund (HEERF) Frequently Asked Questions (FAQ) Rollup Document. To do this, we did the following:
- We obtained, from FSU’s director of student accounts, a list of 2,266 students who received CARES Act student-portion funding, totaling $1,955,463, from FSU during the audit period. From the list of 2,266 students, we selected a statistical, random sample of 60 students, with a 95% confidence level, a 0% expected error rate, and a 5% tolerable error rate. The total amount of CARES Act student-portion funding associated with our sample was $49,800.
- For each student in our sample, we reviewed FSU’s electronic student account records, including students’ financial aid awards, financial aid enrollments for each semester, account details, and applications for admission. We determined whether each student was enrolled during the spring 2020 semester, had filed a Free Application for Federal Student Aid, and had attended at least one class in person and was, therefore, eligible to receive CARES Act student-portion funding.
- To determine whether the amount of student-portion funding that each student received was correct, we reviewed FSU’s electronic student account records to verify the number of credit hours each student was enrolled in (full-time or part-time enrollment status) and determine whether each student received a Pell Grant, a federal grant for students with the highest financial need.
- We calculated the amount each student should have received using FSU’s established distribution model, which had different tiers based on a student’s enrollment status and whether they received a Pell Grant.
- We compared each of our calculated amounts to each of the amounts students received from FSU for agreement.
We noted no exceptions in our testing; therefore, we conclude that the CARES Act student-portion funding that we tested was used for its allowable and intended purposes.
CARES Act Institutional Portion
We determined whether FSU administered the institutional portion of funding under Section 18004(a)(1) of the CARES Act in accordance with Section F of US DOE’s Higher Education Emergency Relief Fund (HEERF) Frequently Asked Questions (FAQ) Rollup Document. To do this, we did the following:
- We obtained, from FSU’s director of student accounts, a list of 2,373 credits provided to students for their housing and/or meal plan accounts, totaling $3,554,579 (of which $1,955,462 was paid for by CARES Act institutional-portion funding), for unused housing and/or meal plans because of the COVID-19 pandemic. These credits were applied to students’ account balances. From the list of 2,373 credits, we selected a statistical, random sample of 60 credits, with a 95% confidence level, a 0% expected error rate, and a 5% tolerable error rate. The total amount of CARES Act institutional-portion funding associated with our sample was $99,857.
- For each credit in our sample, we reviewed FSU’s electronic student account records to determine whether each student was billed for housing and/or meal plans before the issuance of the CARES Act institutional-portion credits, and, therefore, whether each student was eligible for the credit.
- We used a formula provided by FSU (which determined the percentage of days the campus was closed during the spring 2020 semester because of the COVID-19 pandemic) to calculate what the amount of each CARES Act institutional-portion funding payment FSU issued to students should have been.
- We compared each of our calculated amounts to each of the payment amounts that FSU issued to each student.
We noted no exceptions in our testing; therefore, we conclude that the CARES Act institutional-portion funding that we tested was used for its allowable and intended purposes.
CRRSAA Student Portion
We determined whether FSU administered the student portion of funding under Section 314(a)(1) of the CRRSAA in accordance with US DOE’s Higher Education Emergency Relief Fund (HEERF) ll Public and Private Nonprofit Institution (a)(1) Programs (CFDA 84.425E and 84.425F) Frequently Asked Questions. To do this, we did the following:
- We obtained, from FSU’s director of student accounts, a list of 2,765 students who received CRRSAA student-portion funding, totaling $1,934,750, during the audit period. From the list of 2,765 students, we selected a statistical, random sample of 60 students, with a 95% confidence level, a 0% expected error rate, and a 5% tolerable error rate. The total amount of CRRSAA student-portion funding associated with our sample was $41,800.
- We reviewed FSU’s electronic student account records for each student in our sample and determined whether the student was enrolled during the spring 2021 semester as an undergraduate or graduate and, therefore, was eligible to receive CRRSAA student-portion funding during the audit period.
- To determine whether the amount each student received was correct, we reviewed FSU’s electronic student account records and verified the number of credit hours each student was enrolled in (full-time or part-time enrollment status), whether they received previous CARES Act funding and institutional awards (e.g., scholarships), and whether they received a Pell Grant.
- We calculated the amount that each student should have received using FSU’s established distribution model, which had different tiers based on (1) a student’s enrollment status, (2) whether they received previous CARES Act funding and institutional awards, and (3) whether they received a Pell Grant.
- We compared each of our calculated amounts to each of the amounts students received from FSU for agreement.
We noted no exceptions in our testing; therefore, we conclude that the CRRSAA student-portion funding that we tested was used for its allowable and intended purposes.
CRRSAA and ARP Act Institutional Portion
We determined whether FSU administered the institutional portion of funding under Section 314(a)(1) of the CRRSAA in accordance with US DOE’s Higher Education Emergency Relief Fund (HEERF) II Public and Private Nonprofit Institution (a)(1) Programs (CFDA 84.425E and 84.425F) Frequently Asked Questions. We also determined whether FSU administered the institutional portion of funding under Section 2003(a)(1) of the ARP Act in accordance with Section C of US DOE’s Higher Education Emergency Relief Fund lll Frequently Asked Questions. To do this, we did the following:
- We obtained, from FSU’s comptroller, a list of 49 combined CRRSAA and ARP Act institutional‑portion expenditures, totaling $594,133, that were made during the audit period. From these 49 CRRSAA and ARP Act institutional-portion expenditures, we judgmentally selected a nonstatistical sample of 11 expenditures, totaling $264,355, for testing purposes. We examined FSU’s supporting documentation (such as invoices, contracts, payment vouchers, and purchase orders) to determine whether each CRRSAA and ARP Act institutional-portion expenditure was related to the disruption of campus operations because of the COVID-19 pandemic and whether the documentation supported the need for each item or service, making each transaction allowable.
- For the lost revenue recovered by FSU through CRRSAA and ARP Act institutional-portion funding during the audit period, we interviewed FSU’s comptroller to identify the methodology used for the lost revenue calculation. We reviewed FSU’s lost revenue calculation and traced all the amounts used in its calculation to FSU’s audited financial statements and related financial reports, such as summary trial balances and department operating reports, for agreement. We compared the revenue sources FSU used in its lost revenue calculation to the allowable uses according to US DOE’s Higher Education Emergency Relief Fund (HEERF I, II, and III) Lost Revenue Frequently Asked Questions. We compared the “Quarterly Budget and Expenditure Reporting for HEERF I, II, and III (a)(1) Institutional Portion, (a)(2), and (a)(3), if applicable” report filed with US DOE for the fiscal quarter ending December 31, 2021 and verified that it was in agreement with the amount of lost revenue FSU reported for fiscal years 2020 and 2021.
We noted no exceptions in our testing; therefore, we conclude that the CRRSAA and ARP Act institutional-portion funding that we tested was used for its allowable and intended purposes.
ARP Act Student Portion
We determined whether FSU administered the student portion of funding under Section 2003(a)(1) of the ARP Act in accordance with Section B of US DOE’s Higher Education Emergency Relief Fund (HEERF) lll Frequently Asked Questions. To do this, we did the following:
- We obtained, from FSU’s director of student accounts, a list of 6,431 students who received ARP Act student-portion funding, totaling $2,906,850, from FSU during the audit period. From the list of 6,431 students, we selected a statistical, random sample of 60 students, with a 95% confidence level, a 0% expected error rate, and a 5% tolerable error rate. The total amount of ARP Act student-portion funding associated with our sample was $27,700.
- To determine each student’s eligibility for student-portion funding, we reviewed FSU’s electronic student account records for each student in our sample and determined whether the student was enrolled during the fall 2021 semester as an undergraduate or graduate student.
- To determine whether the amount each student received was correct, we reviewed FSU’s electronic student account records and determined the number of credit hours each student was enrolled in (full-time or part-time enrollment status) and whether each student was a Pell Grant recipient.
- We calculated the amount each student should have received using FSU’s established distribution model, which had different tiers based a student’s enrollment status and whether they received a Pell Grant.
- We compared each of our calculated amounts to each of the amounts students received from FSU for agreement.
We noted no exceptions in our testing; therefore, we conclude that the ARP Act student-portion funding that we tested was used for its allowable and intended purposes.
GEER Funding
We determined whether FSU administered GEER funding in accordance with US DOE’s Frequently Asked Questions about the Governor’s Emergency Education Relief (GEER) Fund and/or Attachment A—Terms of Performance and Justifications of its interdepartmental service agreement with the Massachusetts Department of Higher Education. To do this, we obtained, from FSU’s comptroller, a list of all four GEER funding expenditures, totaling $280,875, made during the audit period. We reviewed supporting documentation for all four GEER funding expenditures, which consisted of 10 invoices (because each expenditure had multiple invoices attached to it), to ensure that the invoice dates and payment dates were within the timeframe allowed according to its interdepartmental service agreement with the Massachusetts Department of Higher Education. In addition, we verified that the reasons for the expenditures were allowed according to the terms of the interdepartmental service agreement and were related to the COVID-19 pandemic.
We noted no exceptions in our testing; therefore, we conclude that the GEER funding that we tested was used for its allowable and intended purposes.
Internal Control Plan
To determine whether FSU updated its internal control plan to address the COVID-19 pandemic in accordance with CTR’s “COVID-19 Pandemic Response Internal Controls Guidance,” dated September 30, 2020, we inspected the 2020 and 2021 Internal Control Questionnaires that FSU submitted to CTR. Specifically, we reviewed the Internal Control Questionnaire questions that addressed COVID-19 preparedness, as well as CTR’s COVID-19 guidance. We obtained and reviewed FSU’s most recent internal control plan and all FSU’s policy updates to address the COVID-19 pandemic, and we determined whether FSU addressed the five objectives outlined in CTR’s “COVID-19 Pandemic Response Internal Controls Guidance.”
We noted no exceptions in our testing; therefore we conclude that FSU updated its internal control plan to address the COVID-19 pandemic.
Cybersecurity Awareness Training
We determined whether FSU ensured that employees responsible for the management of COVID-19 funds within the Administration and Finance Department, Student Accounts Department, Financial Aid Department, and the Registrar’s Office received cybersecurity awareness training in accordance with Sections 6.2.3 and 6.2.4 of the Executive Office of Technology Services and Security’s Information Security Risk Management Standard IS.010. To do this, we obtained from FSU’s chief information security officer a list of 49 FSU employees from the four key departments with access to FSU’s accounting and finance system and selected a nonstatistical, random sample of 10 employees. We interviewed FSU management to determine whether the selected employees received cybersecurity awareness training during the audit period. We also reviewed the two Microsoft PowerPoint presentations that FSU officials told us they used to provide cybersecurity awareness training to their employees (one for new hires and one for all other employees) during the audit period. (Please see Finding 1 for the results of this testing.)
We used a combination of statistical and nonstatistical sampling methods for testing. Where nonstatistical sampling methods were used, we did not project the results of our testing to the entire population.
Data Reliability Assessment
To determine the reliability of the data received from FSU’s accounting and finance system, we interviewed FSU officials who were knowledgeable about the data. We also reviewed certain general information system controls (including security management, access controls, configuration management, segregation of duties, and contingency planning) over FSU’s accounting and finance system.
We obtained the following three lists of students from FSU’s director of student accounts: (1) 2,266 students who received CARES Act student-portion funding payments, totaling $1,955,463; (2) 2,765 students who received CRRSAA student-portion funding payments, totaling $1,934,750; and (3) 6,431 students who received ARP Act student-portion funding payments, totaling $2,906,850. To determine the completeness of these lists, we compared the total amount of each list to the related FSU trial balance for the fiscal year in which the funds were distributed. To determine the accuracy of the lists, we selected a random sample of 20 students from each list and traced the students’ names, student identification numbers, COVID-19 funding type received (CARES Act, CRRSAA, or ARP Act), and payment amounts to the students’ award notifications (emails or letters) or the students’ account activity screens. We also reviewed each list for duplicates, identifying whether a student’s name appeared more than once within a particular list. Following our testing, we removed all of the students’ personally identifiable information from our audit workpapers.
We obtained a list of 2,373 credits to students for housing and/or meal plan accounts, totaling $3,554,579, of which $1,955,462 was paid for by CARES Act institutional-portion funding, from FSU’s director of student accounts. From this list, we selected a random sample of 20 students who received credits. For the selected sample, we obtained screenshots of each student’s account and compared their names, student identification numbers, term codes (for the semester the funds were disbursed), detail codes for the funding source (CARES Act, CRRSAA, or ARP Act), and credit amounts to the list of credits for accuracy. Following our testing, we removed all of the students’ personally identifiable information from our audit workpapers.
FSU combined the institutional portions of funding from the CRRSAA and ARP Act for reporting purposes. We obtained, from FSU’s comptroller, a list of 49 transactions, totaling $252,916, that took place during the audit period. From this list, we selected a random sample of 5 transactions. We obtained FSU’s Detailed Voucher Transaction Report and compared the object expense classification codes, expense voucher numbers, expense descriptions, and amounts to the transaction list for accuracy. Additionally, for the lost revenue recovered during the audit period by CRRSAA and ARP Act institutional-portion funding, totaling $9,779,835, we interviewed FSU’s comptroller to identify and gain an understanding of the methodology that FSU used for the lost revenue calculation.
We obtained, from FSU’s comptroller, a list of all four expenditures, totaling $280,875, of GEER funding. These four expenditures were associated with 10 invoices. To determine the completeness of the GEER funding list, we reconciled the list to the FSU trial balance. We also reviewed the list for duplicate invoices. To determine the accuracy of the data, we compared all four expenditures on the Detailed Voucher Transaction Report to the Departmental Operating Report.
To determine the reliability of the list of 49 FSU employees responsible for the management of COVID-19 funds within the Administration and Finance Department, Student Accounts Department, Financial Aid Department, and Registrar’s Office, we ran a query in the Human Resources / Compensation Management System, the state’s human resource and payroll system, to identify the total number of employees who worked at FSU during the audit period. We compared the employee names, hire dates, and termination dates (where applicable) from the list of 49 FSU employees that we obtained from FSU’s chief information security officer to the Human Resources / Compensation Management System query results for agreement.
Based on the data reliability procedures described above, we determined that the data obtained were sufficiently reliable for the purposes of our audit.
| Date published: | September 15, 2023 |
|---|