Audit of the Massachusetts Educational Financing Authority Objectives, Scope, and Methodology

An overview of the purpose and process of auditing the Massachusetts Educational Financing Authority.

Overview

In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor has conducted a performance audit of certain activities of the Massachusetts Educational Financing Authority (MEFA) for the period July 1, 2022 through June 30, 2024.

We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Below is a list of our audit objectives, indicating each question we intended our audit to answer; the conclusion we reached regarding each objective; and, if applicable, where each objective is discussed in the audit findings.

Objective	Conclusion
Did MEFA ensure that loan recipients met the established eligibility requirements in accordance with Section 5(e) of Chapter 15C of the General Laws and with Appendix XII of the MEFA Student Loan Operations Manual?	Yes
Did MEFA provide the required loan disclosure information to approved applicants within the timeframes specified under Sections 32.46(4)(a)–(c) and 32.47(2)(a)–(c) of Title 209 of the Code of Massachusetts Regulations (CMR)?	Partially; see Finding 1
To what extent did MEFA ensure that eligible students, coborrowers, and the general public were made aware of MEFA’s State-Supported Supplemental Education Loan Programs as required by Section 5C of Chapter 15C of the General Laws?	To a sufficient extent

To accomplish our audit objectives, we gained an understanding of the MEFA internal control environment relevant to our objectives by reviewing applicable policies and procedures and relevant contracts, as well as by conducting interviews and walkthroughs with MEFA management. We evaluated the design and implementation of the internal controls significant to our audit objectives. We also tested the operating effectiveness of application controls related to the processing of student loan applications and the approval of loan disclosures for applicants who were approved. In addition, to obtain sufficient, appropriate evidence to address our audit objectives, we performed the procedures described below.

Student Loan Eligibility Requirements

To determine whether MEFA ensured that loan recipients met the established eligibility requirements in accordance with Section 5(e) of Chapter 15C of the General Laws and with Appendix XII of the MEFA Student Loan Operations Manual, we took the following actions. First, we obtained a dataset containing detailed information³ on all 35,217 loans approved and accepted during the audit period from MEFA’s loan origination software, which is used to process loan applications. From this dataset, we selected a statistical⁴ sample of 60 loans, using a 95% confidence level,⁵ a 0% expected error rate,⁶ and a 5% tolerable error rate.⁷

For each of the 60 loans in our sample, we confirmed that the corresponding student had a certificate of admission or enrollment at a participating institution of higher education by reviewing screenshots of school certifications stored in MEFA’s loan origination software.

We reviewed the credit application results for each applicant to confirm that MEFA assessed their credit history for any education loan defaults, bankruptcies, or foreclosures within the past 60 months. We also determined whether each applicant met MEFA’s minimum FICO score requirements as specified in the MEFA Student Loan Operations Manual’s credit criteria by comparing the FICO scores of the student borrower and any coborrowers against the required thresholds, which ranged from 670 to 710 during the audit period.

In addition, we confirmed that the combined income of the borrower and any coborrower(s) met or exceeded the federal poverty guidelines by comparing the applicants’ reported income amounts to MEFA’s required thresholds.

For this objective, we found no significant issues during our testing. Therefore, we concluded that, based on our testing, MEFA ensured that loan recipients met the eligibility requirements established in Section 5(e) of Chapter 15C of the General Laws.

Loan Disclosure Information

To determine whether MEFA provided the required loan disclosure information to approved applicants within the timeframes specified under 209 CMR 32.46(4)(a)–(c) and 32.47(2)(a)–(c), we took the following actions. We used the same statistical sample of 60 loans that we selected for our eligibility testing, drawn from the dataset of 35,217 loans approved and accepted during the audit period.

For each of the 60 loans in our sample, we reviewed the loan disclosure documents to ensure that approved applicants received the required disclosures before loan approval. We determined whether the approval disclosure date matched the approval completion date recorded in MEFA’s loan origination software. We also confirmed that the disclosure documents included required information such as payment terms, loan amounts, and associated fees, and that the loan agreements, which detail the consequences of defaulting, were signed by the borrower and any coborrower(s). Finally, we ensured that the loan term stated in the final disclosure matched the term outlined in the signed loan agreement by comparing both documents.

For this objective, we found certain issues during our testing; namely, that MEFA did not always provide borrowers with consistent information regarding their loan repayment terms. See Finding 1 for more information.

Marketing and Outreach of State-Supported Supplemental Loan Program

To determine to what extent MEFA ensured that eligible students, coborrowers, and the general public were made aware of MEFA’s State-Supported Supplemental Education Loan Programs as required by Section 5C of Chapter 15C of the General Laws, we took the following actions. First, we interviewed MEFA officials to discuss their marketing and outreach strategies for publicizing these loan programs. We also inquired whether MEFA had key performance indicators or internal metrics in place to measure the effectiveness of its outreach efforts, and how management reviewed these metrics.

We obtained and examined MEFA’s marketing plans that were in effect during the audit period to determine whether outreach activities were both planned and executed. We selected a judgmental,⁸ nonstatistical sample of 10 events out of a population of 28 planned financial aid and college loan marketing events. We reviewed supporting documentation (e.g., webinar recordings and attendance records) to confirm that these events took place. In addition, we examined the general ledger and supporting invoices totaling $825,808 for fiscal year 2023 and $773,296 for fiscal year 2024 to determine whether MEFA incurred marketing expenses to support its loan awareness campaigns.

We also reviewed loan performance reports containing key performance indicators such as email open rates, paid media campaign results, and website traffic. Additionally, we examined meeting calendars to determine whether MEFA held regular meetings to discuss and monitor its marketing campaigns.

For this objective, we found no significant issues during our testing. Therefore, we concluded that, based on our testing, MEFA sufficiently ensured that eligible students, coborrowers, and the general public were made aware of MEFA’s State-Supported Supplemental Education Loan Programs as required by Section 5C of Chapter 15C of the General Laws.

We used a combination of statistical and nonstatistical sampling methods for testing. Where we used nonstatistical sampling methods, we did not project the results of our testing to any populations.

Data Reliability Assessment

Loan Origination Software

To determine the reliability of the data within MEFA’s loan origination software, we conducted interviews and system walkthroughs with MEFA management and staff members who were knowledgeable about the data and responsible for its oversight, in order to gain an understanding of the system’s controls and data management processes.

We reviewed System and Organization Control reports⁹ covering the audit period. We also tested the data to ensure that it did not contain certain dataset issues (i.e., duplicate records, blank fields, and data corresponding to dates outside the audit period). Additionally, we conducted a gap analysis to determine whether loan application numbers appeared in sequential order. Further, we compared the total number of records in the dataset we received to the number observed during the data extraction process to confirm completeness.

We selected a random sample of 20 approved and accepted loans and traced the applicant identification, applicant name, loan type, and loan amount to the signed loan agreements to determine accuracy.

Finally, we confirmed that the number of loan types in the dataset matched the number of MEFA loan types advertised on the MEFA website.

Marketing and Outreach Plans

To determine the reliability of the marketing plans we conducted interviews with MEFA management and staff members who were knowledgeable about the marketing plans and responsible for their oversight, in order to gain an understanding of how they were developed. We examined the plans for gaps by counting the weeks included in each plan to ensure that they covered the full duration of the audit period. We also randomly selected five planned financial aid and college loan marketing events and traced their dates, titles, and descriptions to MEFA webinar recordings on YouTube to determine their accuracy.

Based on the results of the data reliability assessment procedures described above, we determined that the information we obtained during the course of our audit was sufficiently reliable for the purposes of our audit.

3.    The dataset included details such as loan application identifications, student and coborrower names, loan types and descriptions, loan award amounts, and disbursement dates.

4.    Auditors use statistical sampling to select items for audit testing when a population is large (usually over 1,000) and contains similar items. Auditors generally use a statistics software program to choose a random sample when statistical sampling is used. The results of testing using statistical sampling, unlike those from judgmental sampling, can usually be used to make conclusions or projections about entire populations.

5.    Confidence level is a mathematically based measure of the auditor’s assurance that the sample results (statistic) are representative of the population (parameter), expressed as a percentage. A 95% confidence level means that 95 out of 100 times, the statistics accurately represent the larger population.

6.    Expected error rate is the number of errors that are expected in the population, expressed as a percentage. It is based on the auditor’s knowledge of factors such as prior audit results, the understanding of controls gained in planning, or a probe sample. In this case, we are assuming there are no errors in the data provided to us by the auditee.

7.    The tolerable error rate (which is expressed as a percentage) is the maximum error in the population that is acceptable while still using the sample to conclude that the results from the sample have achieved the objective.

8.    Auditors use judgmental sampling to select items for audit testing when a population is very small, the population items are not similar enough, or there are specific items in the population that the auditors want to review. Auditors use their knowledge and judgment to select the most appropriate sample. For example, an auditor might select items from areas of high risk. The results of testing using judgmental sampling cannot be used to make conclusions or projections about entire populations; however, they can be used to identify specific issues, risks, or weaknesses.

9.    A System and Organization Control report is a report on controls about a service organization’s systems relevant to security, availability, processing integrity, confidentiality, or privacy.

Date published:	November 26, 2025