Audit of the University of Massachusetts Amherst Objectives, Scope, and Methodology

An overview of the purpose and process of auditing the University of Massachusetts Amherst

Overview

In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor has conducted a performance audit of certain activities of the University of Massachusetts (UMass) Amherst for the period July 1, 2014 through December 31, 2016.

We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Below is a list of our audit objectives, indicating each question we intended our audit to answer; the conclusion we reached regarding each objective; and, if applicable, where each objective is discussed in the audit findings.

Objective	Conclusion
Is UMass Amherst information technology (IT) equipment that was purchased at a cost of more than $2,000 during the audit period properly tagged?	Yes
Does UMass Amherst do the following?
a. ensure that canceled procurement cards (Procards) are not used	Yes
b. comply with its Procard User Guide regarding restricted commodities such as gift cards, memberships, automotive services, gasoline, IT equipment, and furniture	No; see Finding 2
c. restrict dovetailing1 of Procard transactions	No; see Finding 1
Has UMass Amherst developed an emergency evacuation plan that takes into account the needs of students with various disabilities, made it known to all relevant parties, and trained those parties on it?	No; see Finding 3
Has UMass Amherst taken appropriate measures to ensure that students with disabilities have access to supplemental learning aids, services, and alternative learning and testing formats?	Yes
Has UMass Amherst taken appropriate action to rectify complaints from students with disabilities?	No; see Finding 4

 To achieve our objectives, we gained an understanding of the internal controls we determined to be significant to our audit objectives. We evaluated the design and effectiveness of controls in the following areas: IT inventory purchased at a cost of more than $2,000 during the audit period; Procards; and student access to supplemental learning aids, services, and alternative learning and testing formats provided under the Americans with Disabilities Act of 1990 (ADA).

In addition, we performed the following procedures to obtain sufficient, appropriate evidence to address our audit objectives.

IT Inventory

We sampled and examined IT items that were purchased at a cost of more than $2,000 during the audit period and that we deemed most vulnerable to theft or misuse (e.g., laptop computers, projectors, and tablet computers). The population consisted of 1,220 IT items, purchased for a total of $7,927,945. From this population, we selected a nonstatistical random sample of 145 items to verify that they existed, were accurately recorded on UMass Amherst’s IT inventory list, and were properly tagged with asset identification numbers where applicable.

Procards

To determine whether UMass Amherst ensured that canceled Procards were not used during the audit period, we selected a nonstatistical random sample of 35 out of a total of 743 canceled Procards to verify that no purchases were made with the cards after the dates they were canceled.

To determine whether UMass Amherst complied with its Procard User Guide regarding restricted commodities such as gift cards, memberships, automotive services, gasoline, IT equipment that cost more than $400, and furniture, we obtained a list of all 228,393 Procard transactions dated within our audit period from Citibank. These transactions totaled $29,844,025. We performed multiple keyword searches on the list of transactions to identify purchases that were restricted according to the UMass Amherst Procard User Guide. We searched for keywords in transaction types, vendor names, and merchant classification codes (the codes used to classify the type of services provided by vendors).

Based on a risk analysis, we identified six different categories of Procard purchases (gift cards, memberships, automotive services, gasoline, IT equipment that cost more than $400, and furniture) as our population to perform transaction receipt testing. The population of all such transactions during the audit period consisted of 2,891 transactions, totaling $1,022,589. From five of the categories in this population, we selected a nonstatistical random sample of a total of 130 transactions. From the remaining category (IT equipment with a cost of more than $400), we selected a nonstatistical judgmental sample of 35 transactions. For each sample, we tested whether transactions were made by authorized users, were accurately recorded, were business related, and had supporting documentation that matched the monthly Procard statements. We also tested to determine whether the purchases were allowable according to the university’s Procard User Guide.

To determine whether UMass Amherst restricted dovetailing of Procard purchases, we analyzed the entire population of 228,393 Procard transactions from the audit period to identify possible dovetail purchases. We identified 463 possible instances of dovetailing and selected a nonstatistical judgmental sample of the 26 most recent possible instances within the audit period to determine whether cardholders received prior approval to spend beyond their purchase limits.

Student Disability Services

To determine whether the university had effectively planned to assist students covered by the ADA in emergencies, we requested personal emergency action plans for students with disabilities living in residence halls, reviewed documentation for fire drills conducted in 51 residence halls in fall 2017, and reviewed sprinkler-system and fire-alarm tests conducted at all 52 residence halls during the audit period. In addition, we selected a nonstatistical judgmental sample of 6 out of 13 students with disabilities who were on the university’s evacuation list and living in residence halls to determine whether each residence hall had an evacuation list in the fire panel box that included the name, room number, and disability of the selected student.

To determine whether the university took appropriate measures to ensure that students with disabilities had access to supplemental learning resources such as learning aids, services, and alternative learning and testing formats, also known as accommodations, we selected a nonstatistical random sample of 70 out of 1,341 students who had identified themselves as having disabilities and had registered to receive accommodations during the audit period. We verified that UMass Amherst provided accommodations to these students and that the students provided documentation of their disabilities before receiving accommodations. We defined “appropriate measures” as those that were in accordance with the procedures listed under Students on the UMass Disability Services website. Additionally, we reviewed each student file (hardcopy and/or Clockwork² file) to verify that it was supported by an intake form, an accommodation request form, and medical documentation from a licensed medical practitioner to verify a need for accommodation.

To verify that the university had taken appropriate action to rectify complaints from students with disabilities, we reviewed all complaints filed by students during the audit period for conformance to the UMass Amherst Grievance Policy and Procedures. We defined appropriate action as action that was in agreement with the policy and procedures.

Data Reliability

We used UMass’s PeopleSoft system at both the UMass President’s Office in Shrewsbury and the UMass Amherst campus. This system contains employee and student records, the inventory of fixed assets, and Procard transactions. We determined the reliability of data from PeopleSoft by performing observations, comparing PeopleSoft data to other sources for agreement, and testing certain general IT controls over security management, access controls, and configuration management. We determined that the data were sufficiently reliable for the purposes of audit testing.

We also used UMass Amherst’s Clockwork system. We determined the reliability of data obtained from Clockwork by performing observations and testing certain IT controls over security management, access controls, and configuration management. We determined that the information in Clockwork was sufficiently reliable for the purposes of audit testing.

Whenever sampling was used, we applied a nonstatistical approach, and therefore we were not able to project our results to the entire populations.

1. According to Chapter 1 of the Procard User Guide, dovetail purchases occur “when the combined dollar amount of purchases from a single vendor in the same day” exceeds a cardholder’s approved single-purchase limit for the card.
2. The Clockwork system contains records of all students enrolled in disability services.

Date published:	October 29, 2018