RMASFAA Conference An Auditor s Viewpoint of Financial Aid Compliance October 16, 2017 Your Presenters Brent Stevens, CPA, CGMA Partner in Charge Higher Education Practice Brent.Stevens@rubinbrown.com 314.290.3428 Corey Robinson, CPA Senior Accountant Higher Education Practice Corey.Robinbson@Rubinbrown.com 816.859.7943 2 1
Agenda Broad overview of Auditor s role in the financial aid process What s New for 2018 Cash Management Verification 3 Auditor s Role Compliance Internal Controls over Compliance Single Audit Opinion 4 2
Auditor s Role Testing Compliance Sampling Methodology Attempt to represent population Generally, 40 or less students per area, per institution Testing Attributes Derived from Compliance supplement Relatively high level in nature Testing Controls over Compliance Generally, tested in conjunction with compliance sample Focus on following components of a typical control structure Control Environment Risk Assessment Control Activities Information and Communication Monitoring Activities 5 Discussion on Common Financial Aid Internal Controls Control Environment Enforcement and communication of University Handbook Tone at the top Conflict of interest policy Whistleblower mechanism and protection Job descriptions and hiring policies Risk Assessment Quantification of resources necessary to achieve compliance Common compliance gaps Control Activities Proper setup of access in ERP system, segregation of incompatible duties Detailed awarding policies and procedures, updated annually Checks & balances Information and Communication Whistle blower Dissemination of Policy documents Utilization of ERP system Cross departmental meetings Monitoring Internal Audit Function, or similar Performance reviews Log of compliance issues and corrective actions Curbing systemic or recurring issues 6 3
Auditor s Resources Compliance Supplement Published Annually by Office of Management and Budget Prescribes specific items and areas of student financial aid to test Leaves certain items to each auditors judgement Sample sizes Materiality Published Student Financial Aid Handbook Best practices and methodologies noted at similar institutions Common findings published by the Department of Education 7 What s New for 2018 Gramm Leach Bliley Act More commonly known as GLBA Regulation originally aimed at financial institutions to secure customer information Higher education was included in the regulation in 2003 Some crossover of provisions in FERPA with GLBA Compliance required as a part of your Program Participation Agreement with ED Key provisions Comprehensive written information security program Perform a risk assessment Establish safeguards to control risks identified Designate a security program coordinator Establish a system security plan Employee training programs Will be included in 2018 Financial Aid Audit Compliance supplement Discussion: types of questions your auditor may ask 8 4
Cash Management Compliance Supplement Guidance No specific audit procedures published, Auditor must exercise judgement on what, how much Guidance in supplement (1.5 pages vs. 19 pages of handbook) focuses on: Methodology for reimbursement Advance: Focuses on applying funds to student account w/in 3 days of draw down, $250 limit of excess cash earnings Reimbursement: Implies testing necessary to prove that funds applied to students accounts occurs prior to draws, and draws do not exceed amounts applied at any given time Heightened Cash Monitoring: No specific guidance Reference to G5, implying that auditor should view external award activity report Implications related to establishment of separate, interest bearing bank account for federal funds Handbook Guidance Advance: A school that draws down FSA grant or Direct Loan funds under the advanced payment method must disburse those funds no later than three business days following the date the school receives them. If, after a school draws down FSA grant or Direct Loan funds, but before the school disburses them, the school discovers that it cannot disburse all the funds because one of the students for whom the funds were intended has not begun classes, the school must return those funds within the three-day period unless it can disburse them to another eligible borrower or as described under Excess Cash in Chapter 1. (SFA Handbook 4-63 Chapter 3) Frequency of Findings RARE Discussion: proving you re on the reimbursement method 9 Cash Management Common Compliance Testing Examine timing of application of Fall and Spring aid awarded to student account detail (sample basis) Obtain copy of G5 draw down amounts, by date, for award period Review actual deposits in bank account Discussion on student credit balance refunds Common Internal Controls over Compliance Leave a good trail! Match of G5 to COD ERP system has scheduled posting of awards to student accounts, with limited, controlled access of which users can adjust System access, authorizations and user setup is key Business office completes a reconciliation of the batch of aid awarded to student accounts to the requested G5 draw down A copy of the reconciliation is reviewed, signed and retained by Controller 10 5
Compliance Supplement Guidance specifically included in special tests and provisions, implying a heightened sense of importance Suggested audit procedures spelled out in guide (2-3 pages vs. 326 pages of NSLDS enrollment guide) : Review, evaluate and document procedures for updating student status for Pell and DL recipients, including how often said updates occur Determine if the school is meeting reporting requirements by having the school access NSLDS website and create the SCHER1. Compare dates the roster files were sent to the return dates to verify that the school returned the roster files within 15 days, and report any discrepancies related to the timeliness of the roster files Test accuracy and timeliness of the enrollment data certification by selecting a sample of students. Compare data in the NSLDS enrollment detail to the student s academic files, and verify that the institution is reporting accurate attendance changes within 30 days (unless roster file will be submitted within 60 days). Handbook/Enrollment Guide Excerpts CONTRACTS WITH THIRD-PARTY SERVICERS Schools are permitted to contract with consultants for assistance in administering the FSA programs. However, the school ultimately is responsible for the use of FSA funds and will be held accountable if the consultant mismanages the programs or program funds. 11 12 6
13 Handbook/Enrollment Guide Excerpts A third-party servicer administers any aspect of the school s FSA participation. Examples of functions that thirdparty servicers perform are: processing student financial aid applications, performing need analysis, and determining student eligibility or related activities; certifying loans, servicing loans, or collecting loans; processing output documents for payment to students, and receiving, disbursing, or delivering FSA funds; conducting required student consumer information services; preparing and certifying requests for cash monitoring or reimbursement funding; preparing and submitting notices and applications required of eligible and participating schools, or preparing the Fiscal Operations Report and Application to Participate (FISAP); and processing enrollment verification for deferment forms or NSLDS enrollment reporting. Frequency of Findings PERVASIVE 14 7
Common Compliance Testing Sample of 25-40 students that withdrew or graduated in the award year Comparison of graduation date or date of determination to NSLDS transmission date Completion/documentation of exit interviews Common Findings Institutions roster was uploaded to clearinghouse within 60 day window, clearinghouse submission to NSLDS did not occur timely Incomplete status change reporting yielded untimely submissions Backdating award of degrees (common in allied health field) Common Internal Controls over Compliance ERP system designed to generate a daily log of student status changes Thorough understanding of regs & NSLDS guide Weekly meetings between financial aid and registrars office Working the error reports from NSLDS (access to email and communication of information) Reconciliation between students with status changes and most recent roster file submitted to NSLDS ERP system designed to create file with correct attributes for roster upload to Clearinghouse Timing of roster submission to provide cushion for Clearinghouse to NSLDS submission issues Development of an institution wide master compliance date calendar Leave a good trail! 15 16 8
Verification Compliance Supplement Suggested audit procedures are spelled out in special tests and provisions Detailed steps Review the institution s policies and procedures for verifying student applications and verify that they meet the requirements of the applicable regulations or the institution s QAP If the institution has a QAP, select a sample of applications and review records to ensure that the processes required under the approved QAP were applied If the Institution does not have a QAP, select a sample of applications that were selected by ED for verification and review the student aid files to ascertain: Acceptable documentation to verify information required for the Verification Tracking Group to which the applicant is assigned Matched information on the documentation to the student aid application If necessary, submitted corrections to central processor and recalculated awards Frequency of Findings Unusual 17 Verification Common Tests for Compliance Most file review checklists developed by auditor s have a section for verification flags A small sample of the 25-40 overall students may be selected In cases when no students in the file testing population were required to be verified, a separate selection would be made Auditor will review student file, and focus on verification form, robust nature of supporting documentation, and presence of authorizations/signatures/etc. Common Internal Controls Over Compliance Internal Audit function sample file review Designating an official with the appropriate skills, knowledge and expertise to sign off on verified information Common findings Missing student/parent signature Missing or poor student file documentation 18 9