Audit of the Massachusetts College of Art and Design Objectives, Scope, and Methodology

An overview of the purpose and process of auditing the Massachusetts College of Art and Design

Overview

In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor has conducted a performance audit of certain activities of Massachusetts College of Art and Design (MassArt) for the period March 1, 2020 through June 30, 2021.

We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Below is a list of our audit objectives, indicating each question we intended our audit to answer; the conclusion we reached regarding each objective; and, if applicable, where each objective is discussed in the audit findings.

Objective	Conclusion
	Did MassArt administer the student portion of funding under Section 18004(a)(1) of the Coronavirus Aid, Relief, and Economic Security (CARES) Act in accordance with Sections C, D, and E of the United States Department of Education’s (US DOE’s) Higher Education Emergency Relief Fund (HEERF) Frequently Asked Questions (FAQ) Rollup Document?	Yes
	Did MassArt administer the institutional portion of CARES 18004(a)(1) funding in accordance with Section F of US DOE’s Higher Education Emergency Relief Fund (HEERF) Frequently Asked Questions (FAQ) Rollup Document?	Yes
	Did MassArt administer the student portion of funding under Section 314(a)(1) of the Coronavirus Response and Relief Supplemental Appropriations Act (CRRSAA) in accordance with US DOE’s Higher Education Emergency Relief Fund (HEERF) II Public and Private Nonprofit Institution (a)(1) Programs ([Catalog of Federal Domestic Assistance, or CFDA] 84.425E and 84.425F) Frequently Asked Questions?	Yes
	Did MassArt administer the institutional portion of funding under Section 314(a)(1) of the CRRSAA in accordance with US DOE’s Higher Education Emergency Relief Fund (HEERF) II Public and Private Nonprofit Institution (a)(1) Programs (CFDA 84.425E and 84.425F) Frequently Asked Questions?	Yes
	Did MassArt administer Governor’s Emergency Education Relief (GEER) funding in accordance with US DOE’s Frequently Asked Questions about the Governor’s Emergency Education Relief Fund (GEER Fund) and/or “Attachment A—Terms of Performance and Justifications” within the Massachusetts Department of Higher Education’s (MDHE’s) interdepartmental service agreement?	Yes
	Did MassArt update its internal control plan (ICP) to address the 2019 coronavirus (COVID-19) pandemic in accordance with the Office of the Comptroller of the Commonwealth’s “COVID-19 Pandemic Response Internal Controls Guidance,” dated September 30, 2020?	Yes
	Did MassArt employees handling COVID-19 funding in MassArt’s Administration and Finance Department complete required cybersecurity awareness training in accordance with Sections 6.2.3 and 6.2.4 of the Executive Office of Technology Services and Security’s (EOTSS’s) Information Security Risk Management Standard IS.010?	No; see Finding 1

 

To achieve our objectives, we gained an understanding of the internal controls related to the objectives by reviewing applicable policies and interviewing MassArt officials. We evaluated the design and implementation of controls over MassArt’s process for disbursing student- and institutional-portion funding and tested the operating effectiveness of these controls.

• To determine whether MassArt had properly set up the account for the CARES 18004(a)(1) student-portion funding, we obtained screenshots of the funding authorization in the Federal Funds Information for States (FFIS) federal grant system and the allocation of funding in the Colleague² trial balance. We compared these totals to the total in the grant account that had been set up. In addition, we verified that the CARES Act student-portion total matched the amount in the federal grant award notification letter from US DOE to the vice president of MassArt’s Administration and Finance Department. After the review, we determined that MassArt had appropriately received and recorded the CARES 18004(a)(1) student-portion funding.
• To determine whether MassArt had expended CARES 18004(a)(1) student-portion funding in accordance with US DOE’s Higher Education Emergency Relief Fund (HEERF) Frequently Asked Questions (FAQ) Rollup Document, we selected a statistical, random sample, with a 95% confidence level, 0% error rate, and 7.5% tolerable error rate, of 40 student payments, totaling $16,000, from a population of 1,411 that totaled $564,400. To determine whether MassArt had expended CARES 18004(a)(1) student-portion funding in accordance with US DOE’s Higher Education Emergency Relief Fund (HEERF) Frequently Asked Questions (FAQ) Rollup Document, we reviewed each student’s institutional student information record (ISIR) to verify that the student had completed a Free Application for Federal Student Aid (FAFSA) or that the student had not filed a FAFSA but was eligible to do so. In addition, we verified that payments to students were made by checks, which were an approved payment method, and examined student transcripts to verify that the students were not enrolled in an online-only program on March 13, 2020.
• To determine whether MassArt had properly set up the account for the CARES 18004(a)(1) institutional-portion funding, we obtained screenshots of the funding authorization in FFIS and the allocation of funding in the Colleague trial balance. We compared these totals to the total in the grant account that was set up. In addition, we verified that the CARES Act institutional-portion total matched the amount in the federal grant award notification letter from US DOE to the vice president of MassArt’s Administration and Finance Department. After the review, we determined that MassArt had appropriately received and recorded the CARES 18004(a)(1) institutional-portion funding.
• To determine whether MassArt had expended CARES 18004(a)(1) institutional-portion funding in accordance with US DOE’s Higher Education Emergency Relief Fund (HEERF) Frequently Asked Questions (FAQ) Rollup Document, we selected a random, nonstatistical sample of 28 expense transactions, totaling $129,964, from a population of 223 that totaled $755,132. We reviewed whether expenses were related to significant changes in the delivery of instruction due to the COVID-19 pandemic—for example, whether approved expenses were related to remote learning; whether an appropriate staff member (the vice president or assistant vice president of the Administration and Finance Department) approved the expenses; and whether the expenses were allowable under the requirements of HEERF I funding. In addition, we compared the vendor names, amounts, and descriptions to vouchers, invoices, purchase orders, check registers, payroll information, receipts, credit card statements, and accounts payable cover sheets to verify that the expenses were properly supported.
• To determine whether MassArt had properly set up the account for the CRRSAA 314(a)(1) student-portion funding, we obtained screenshots of the funding authorization in FFIS and the allocation of funding in the Colleague trial balance. We compared the CRRSAA student-portion total to the total in the grant account that was set up. In addition, we verified that the CRRSAA student-portion total matched the amount in the federal grant award notification letter from US DOE to the vice president of MassArt’s Administration and Finance Department. After the review, we determined that MassArt had appropriately received and recorded the CRRSAA 314(a)(1) student-portion funding.
• To determine whether MassArt had expended CRRSAA 314(a)(1) student-portion funding in accordance with US DOE’s Higher Education Emergency Relief Fund (HEERF) II Public and Private Nonprofit Institution (a)(1) Programs (CFDA 84.425E and 84.425F) Frequently Asked Questions, we selected a statistical, random sample, with a 95% confidence level, 0% error rate, and 7.5% tolerable error rate, of 40 student payments, totaling $16,000, from a population of 1,295 that totaled $518,000. In accordance with US DOE guidance, MassArt administrative personnel had established a methodology to determine student need-based eligibility. Personnel determined whether students were registered for at least one credit for the spring 2021 term and met federal aid requirements based on their completed 2020–2021 FAFSAs. If they did not complete FAFSAs, personnel determined whether the students would have met federal aid requirements. We reviewed the methodology to determine whether MassArt applied the right criteria to ensure that the appropriate students received aid.
• To determine whether students met MassArt’s student-need eligibility requirements, we reviewed their ISIRs to verify that they had completed FAFSAs and been determined to have met financial need requirements or (if they did not file FAFSAs) that they were eligible for federal aid. We reviewed whether the payment method was approved by US DOE, and we reviewed the students’ transcripts to verify that each student was enrolled in a class earning at least one credit.
• To determine whether MassArt had properly set up the account for the CRRSAA Section 314(a)(1) institutional-portion funding, we obtained screenshots of the funding authorization in FFIS and the allocation of funding in the Colleague trial balance. We compared the CRRSAA institutional-portion total to the total in the grant account that was set up. In addition, we verified that the total matched the amount in the federal grant award notification letter from US DOE to the vice president of MassArt’s Administration and Finance Department. After the review, we determined that MassArt had appropriately received and recorded the CRRSAA Section 314(a)(1) institutional-portion funding.
• To determine whether MassArt had expended CRRSAA Section 314(a)(1) institutional-portion funding in accordance with US DOE’s Higher Education Emergency Relief Fund (HEERF) II Public and Private Nonprofit Institution (a)(1) Programs (CFDA 84.425E and 84.425F) Frequently Asked Questions, we selected a random, nonstatistical sample of 33 expense transactions, totaling $508,991, from a population of 480 that totaled $962,695. We reviewed the selected expense transactions to determine whether each of the expenses was related to significant changes in the delivery of instruction due to the COVID-19 pandemic, whether an appropriate staff member (the vice president or assistant vice president of the Administration and Finance Department) approved the expenses, and whether the expenses were allowable under HEERF II funding requirements. In addition, we reviewed vendor names, amounts, and descriptions on invoices, payment vouchers, purchase orders, receipts, and payroll documents to verify that the expenses were properly supported.
• To determine whether MassArt had properly set up the accounts for the institutional GEER funding, we compared the total received according to the MDHE interdepartmental service agreement to the Colleague trial balance. After the review, we determined that MassArt had appropriately received and recorded the institutional GEER funding.
• To determine whether MassArt had expended the institutional portion of GEER funding in accordance with US DOE’s Frequently Asked Questions about the Governor’s Emergency Education Relief Fund (GEER Fund) and “Attachment A—Terms of Performance and Justifications” within the MDHE interdepartmental service agreement, we selected a random, nonstatistical sample of 4 transactions, totaling $79,746, from a population of 17 that totaled $99,400. We reviewed whether expenses were related to campus safety and remote learning, whether an appropriate staff member (the vice president or assistant vice president of the Administration and Finance Department) approved the expenses, and whether expenses were allowable under guidance issued by US DOE and/or “Attachment A—Terms of Performance and Justifications” within the MDHE interdepartmental service agreement. In addition, we reviewed vendor names, amounts, and descriptions on payment vouchers, invoices, purchase orders, check registers, receipts, credit card statements, accounts payable cover sheets, and payroll information to verify that the expenses were properly supported and were incurred during the funding period (March 1, 2020 through December 31, 2020).
• To determine whether MassArt complied with the Office of the Comptroller of the Commonwealth’s “COVID-19 Pandemic Response Internal Controls Guidance,” which was released September 30, 2020 for all state agencies, we requested the fiscal year 2020 and fiscal year 2021 ICPs from MassArt. MassArt did not have an updated fiscal year 2020 ICP to review. However, we reviewed the fiscal year 2021 ICP for compliance with the guidance, including whether COVID-19’s impact on internal controls was addressed.
• To determine whether MassArt conducted required annual cybersecurity awareness training for its employees in accordance with EOTSS requirements, we requested a list of cybersecurity awareness training provided as well as any evidence (such as attendance lists and certifications) of cybersecurity awareness training attendance by Administration and Finance Department personnel who handled COVID-19 funding.

We used a combination of nonstatistical and statistical sampling methods for our audit objectives and did not project the results from the samples to the populations.

Data Reliability

Colleague is designed to link various integrated modules, including modules for registration, student billing, and financial aid, to MassArt’s financial system. At MassArt, Ellucian is the managed service provider³ for Colleague. To gain an understanding of Colleague and its controls, we interviewed knowledgeable personnel who were responsible for oversight of the system and its data. We randomly selected 40 students who received HEERF I grants and 40 who received HEERF II grants. We checked the students’ names and the semesters for which they filed FAFSAs in the Colleague lists of student-portion funding disbursements and compared them to the ISIR documentation received from US DOE for accuracy. We assessed the completeness of the data by reconciling the disbursement lists for CARES Act and CRRSAA student and institutional funding for the audit period to the total federal funding received according to the general ledger, trial balances, and fiscal year 2021 audited financial statements.

We randomly selected 20 institutional expenditures of HEERF I funding from the Colleague general ledger report and traced them to invoices and vouchers to ensure that the dates, amounts, and vendor names matched. We randomly selected 40 institutional expenditures of HEERF II funding from the Colleague general ledger report and traced those to the associated invoices and vouchers to ensure that the dates, amounts, and vendor names matched. We randomly selected five GEER Fund expenditures and traced them from the Colleague general ledger report to matching invoices and vouchers to ensure that the dates, amounts, and vendor names matched. To assess the reliability of the system’s controls, we relied on Ellucian’s System and Organization Controls 1 and 2 reports⁴ and bridge letter⁵ and confirmed the completion of testing, with no issues found, for the following general information technology controls: access controls, configuration management, contingency planning, and segregation of duties.

As a result of our data reliability procedures, we found that the data on the Colleague lists were sufficiently reliable for the purpose of our audit objectives.

2.     Colleague is the database system for MassArt’s administrative activities, accounting, and student files.

 

3.     As a managed service provider, Ellucian provides information technology services for Colleague, such as cloud services, which include remote database administration, application management, and backup and disaster recovery services.

4.    These reports review the effectiveness of internal controls over a service organization’s information systems and are conducted by independent certified public accountants or accounting firms.

5.    A bridge letter is made available by a service organization (such as Ellucian) to inform stakeholders (such as MassArt) that system controls have not undergone significant changes or had issues since the last System and Organization Controls report.