Audit of Bristol Community College (March 26, 2025)

This is a Massachusetts State Auditor performance audit of Bristol Community College covering March 1, 2020 through June 30, 2023.

“In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor has conducted a performance audit of Bristol Community College (BRC) for the period March 1, 2020 through June 30, 2023.”

Auditors checked whether Bristol followed rules for federal COVID education funds, updated internal controls for the pandemic, trained employees on cybersecurity, and handled employee settlements properly.

“The purpose of our audit was to determine the following:”

The problems matter because weak cybersecurity training can raise the risk of cyberattacks, and unclear settlement practices can reduce public accountability.

“If BRC does not ensure that all of its employees complete cybersecurity awareness training, then it may expose itself to an increased risk of cybersecurity attacks and financial and/or reputational losses.”

For students, staff, and taxpayers, the audit says COVID aid spending tested by auditors was handled appropriately, but the college needs stronger safeguards for data security and settlement oversight.

“Based on the results of our testing, we determined that, during the audit period, BRC appropriately administered the institutional portion of funding (that we sampled) under the CARES Act, CRRSAA, and ARPA.”

The audit’s bottom line is that Bristol passed the COVID funding and pandemic-control checks, but failed the checks on cybersecurity training and settlement-agreement policies.

“Did BRC adhere to Sections 6.2.3 and 6.2.4 of the Executive Office of Technology Services and Security’s Information Security Risk Management Standard IS.010 with regard to cybersecurity awareness training?”

Bristol agreed with the recommendations and said it is improving cybersecurity training and creating a settlement policy; the auditor plans to follow up in about six months.

“As part of our post-audit review process, we will follow up on this matter in approximately six months.”

The most serious concern is that public money and public institutions need clear oversight, especially when settlements include confidentiality-type language that could hide misconduct or appear to do so.

“Furthermore, public dollars could be abused to cover up harassment, discrimination, or other forms of misconduct, while protecting perpetrators of abuse in BRC’s employ, in reality or in appearance.”

HEERF means federal emergency higher-education relief money related to COVID-19, and Banner is Bristol’s system for administrative, accounting, and student records.

“Banner is the database system for BRC’s administrative activities, accounting, and student files.”