Audit of the Worcester State University Objectives, Scope, and Methodology

An overview of the purpose and process of auditing the Worcester State University

Overview

In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor has conducted a performance audit of certain activities of Worcester State University (WSU) for the period March 1, 2020 through March 31, 2021. When testing WSU’s use of grant funds received through the Coronavirus Response and Relief Supplemental Appropriations Act (CRRSAA), we extended the audit period through June 30, 2021, capturing all CRRSAA-related financial activity as of the time of our fieldwork.

We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Below is a list of our audit objectives, indicating each question we intended our audit to answer and the conclusion we reached regarding each objective.

Objective	Conclusion
Did WSU administer the student portion of funding under Section 18004(a)(1) of the Coronavirus Aid, Relief, and Economic Security (CARES) Act in accordance with Sections C, D, and E of the United States Department of Education’s (US DOE’s) Frequently Asked Questions (FAQ) Rollup Document2 and its own distribution methodology?	Yes
Did WSU administer the institutional portion of CARES 18004(a)(1) funding in accordance with Section F of the Frequently Asked Questions (FAQ) Rollup Document?	Yes
Did WSU administer the student portion of funding under Section 314(a)(1) of CRRSAA in accordance with the guidance issued by US DOE and its own distribution methodology?
Did WSU administer the institutional portion of funding under Section 314(a)(1) of CRRSAA in accordance with the guidance issued by US DOE?	Yes
Did WSU administer Governor’s Emergency Education Relief (GEER) funding in accordance with the Massachusetts Department of Higher Education (MDHE) interdepartmental service agreement (ISA)?3	Yes
Did WSU ensure that employees with access to its Colleague Finance system received cybersecurity awareness training in accordance with Sections 6.2.3 and 6.2.4 of the Executive Office of Technology Services and Security’s (EOTSS’s) Information Security Risk Management Standard IS.010?	Yes

 

To achieve our objectives, we gained an understanding of WSU’s internal control environment related to the objectives by reviewing applicable policies and procedures, as well as conducting inquiries with WSU’s staff and management. We reviewed and tested the operating effectiveness of internal controls over the administration of CARES Act and CRRSAA grant funds.

To obtain sufficient, appropriate audit evidence to address our audit objectives, we conducted further audit testing as follows.

• To determine whether WSU had expended CARES 18004(a)(1) student-portion funding in accordance with the guidance issued by US DOE and its own distribution methodology, we performed the following procedures.

• From Colleague Finance (the information system containing financial and student records used at the university), we obtained a report of all CARES Act payments made directly to students. We selected a random, statistical sample, with a 95% confidence level and a 0% expected error rate, of 30 of the 3,752 payments for testing. To determine whether the student who received each payment was eligible for the disbursement received, we examined each student’s institutional student information record (ISIR) and student transcripts to determine whether the student (1) was enrolled as an undergraduate or graduate student on March 17, 2020 (the date of the start of the campus distribution due to the 2019 coronavirus, or COVID-19), (2) was not enrolled exclusively in online courses, and (3) had completed a “Free Application for Federal Student Aid.” We also determined whether WSU had placed each student in the appropriate tier based on the number of credit hours the student took in the spring 2020 semester and whether the amount each student received agreed with WSU’s credit-based calculation.

• From Colleague Finance, we obtained a report of all CARES Act supplemental emergency payments made to students. We randomly selected a nonstatistical sample of 35 of 149 payments for testing. To determine whether the student who received each payment was eligible for the disbursement received, we reviewed each student’s ISIR and student transcripts to determine whether the student met the eligibility requirements mentioned above. We also reviewed each student’s completed WSU “CARES Act Supplemental Fund Application” and supporting documentation (such as receipts, bills, and proof of loss of income) to determine whether (1) the purpose and/or need for each payment was related to COVID-19, (2) the dates of the supporting documentation fell within the COVID-19-related period, and (3) the dollar amounts according to the supporting documentation equaled or exceeded the amount of the disbursement.
• To determine whether WSU administered CARES 18004(a)(1) institutional funding in accordance with the guidance issued by US DOE, we obtained from Colleague Finance a report of all CARES Act institutional expense transactions. We selected a judgmental, nonstatistical sample of 40 of the 387 transactions for testing. We examined WSU’s supporting documentation (such as invoices, payment vouchers, and purchase orders) to determine whether each transaction was related to the disruption of campus operations due to COVID-19; whether the documentation supported the need for each item or service; and whether each transaction was allowable.
• To determine whether WSU expended CRRSAA 314(a)(1) student-portion funding in accordance with the guidance issued by US DOE and its own distribution methodology, we performed the following procedures.
• From Colleague Finance, we obtained a report of all CRRSAA payments made directly to students as of June 30, 2021. We selected a random, statistical sample, with a 95% confidence level and a 0% expected error rate, of 60 of the 5,184 payments for testing. To determine whether each student was eligible for the disbursement received, we examined each student’s ISIR and student transcripts to determine whether the student was enrolled as an undergraduate or graduate student with any number of spring 2021 credits on April 1, 2021. We also determined whether WSU had placed each student in the appropriate tier based on the number of credit hours taken in the spring 2021 semester and whether the amount each student received agreed with the student’s credit hours and the calculations based on the student’s expected family contribution.
• From Colleague Finance, we obtained a report of all CRRSAA supplemental emergency payments made to students as of June 30, 2021. We randomly selected a nonstatistical sample of 35 of the 116 payments for testing. To determine whether each student was eligible for the disbursement received, we reviewed each student’s ISIR and student transcripts to determine whether the student had any number of spring 2021 credits on April 1, 2021. We also reviewed each student’s completed WSU “CRRSAA HEERF II Supplemental Fund Application” and supporting documentation (such as receipts, bills, and proof of loss of income) to determine whether (1) the purpose and/or need for each payment was related to COVID-19, (2) the dates of the supporting documentation fell within the COVID-19-related period, and (3) the dollar amounts according to the supporting documentation equaled or exceeded the amount of the disbursement.
• To determine whether WSU administered CRRSAA 314(a)(1) institutional funding in accordance with the guidance issued by US DOE, we obtained from Colleague Finance a report of all CRRSAA institutional expense transactions as of June 30, 2021. We selected a judgmental, nonstatistical sample of 50 of the 528 total transactions for testing. We examined WSU’s supporting documentation (invoices, payment vouchers, and purchase orders) to determine whether each transaction was related to the disruption of campus operations due to COVID-19; whether the documentation supported the need for each item or service; and whether each purchase was allowable.
• To determine whether WSU administered GEER funding in accordance with its ISA with MDHE, we obtained from Colleague Finance a report of all GEER expense transactions and selected all six transactions for testing. We examined WSU’s supporting documentation (invoices, payment vouchers, and purchase orders) to determine whether each transaction was allowable under the terms and conditions of the ISA.
• To determine whether users of WSU’s financial system received cybersecurity awareness training (using a training system called KnowBe4) in accordance with standards issued by EOTSS, we performed the following procedures.
• We obtained a report of all 197 users who had access to Colleague Finance during the audit period. Of the 197 users, we identified 10 who were hired during the audit period. We compared electronic training records with new hire orientation dates to determine whether each of these 10 users completed initial cybersecurity awareness training within 30 days of new hire orientation.
• We selected a nonstatistical, random sample of 35 of the other 187 users. We obtained electronic cybersecurity awareness training records to determine whether these users completed cybersecurity awareness training annually during the audit period.

Where nonstatistical sampling was used, we could not project the results of our testing to the overall populations.

Data Reliability

We assessed the reliability of the data obtained from Colleague Finance by tracing samples of records from each data population to and from original source documents such as invoices, payment vouchers, purchase orders, and student grant funding approval letters. In addition, we tested each data population for duplicate records. For each data population, we also matched totals on the electronic data provided to us to the required expenditure reports submitted by WSU to US DOE for accuracy. Further, we reviewed System and Organization Controls (SOC) reports⁴ for Colleague Finance that covered our audit period and ensured that certain information system control tests had been performed. We also tested certain security management controls over Colleague Finance.

To confirm the completeness of the list of users who had access to Colleague Finance during the audit period, we randomly selected five weeks of the audit period and obtained system user activity reports for each week. From each report, we judgmentally selected a sample of 10 users and traced them to the list. To confirm the accuracy of the list of users, we traced a judgmental sample of 20 users from the list to documentation from WSU’s Human Resources Department and Information Technology Services Department. In addition, we tested the data for duplicate records.

We assessed the reliability of the cybersecurity awareness training records obtained from KnowBe4 by reviewing SOC reports for the system that covered our audit period and ensuring that certain information system control tests had been performed. We also interviewed WSU’s KnowBe4 administrator, who is responsible for monitoring training completion.

Based on the data reliability procedures described above, we determined that the data obtained for our audit period were sufficiently reliable for the purposes of our audit work.

Conclusion

Our audit revealed no significant instances of noncompliance that must be reported under generally accepted government auditing standards.

2.    Because of the federal mandate to accelerate the distribution of money from the Higher Education Emergency Relief Fund to students, there was not sufficient time to develop detailed guidance to govern the administration of these funds. Guidance was provided through a series of documents responding to frequently asked questions. In October 2020, US DOE issued a Frequently Asked Questions (FAQ) Rollup Document that combined all prior frequently asked questions into one document. We used this document as a criterion in conducting the audit.

3.    MDHE issued an interdepartmental service agreement that accompanied the GEER award to each recipient for institutional costs. The agreement noted requirements for administering the funds.

4.    These reports review the effectiveness of internal controls over a service organization’s information systems and are conducted by independent certified public accountants or accounting firms.

Date published:	March 11, 2022