Audit of Fitchburg State University (September 15, 2023)

This is a Massachusetts State Auditor performance audit of Fitchburg State University covering March 1, 2020 through December 31, 2021.

“In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor has conducted a performance audit of Fitchburg State University (FSU) for the period March 1, 2020 through December 31, 2021.”

Auditors checked whether the university followed federal and state rules when using COVID-19 education relief funds, and whether it had proper controls and cybersecurity training.

“The purpose of our audit was to determine whether FSU administered the CARES Act, CRRSAA, and ARP Act funding it received in accordance with the criteria established by the Massachusetts Department of Higher Education and US DOE, as well as with its own student grant distribution method.”

The issue matters because employees who are not confirmed as trained may make mistakes that put protected information at risk.

“If FSU does not retain documentation to confirm that its employees complete cybersecurity awareness training, it cannot ensure that employees complete this training, which may lead to user error and compromise the integrity and security of protected information in FSU’s information security systems.”

For students and taxpayers, the audit provides some assurance that the COVID-19 aid reviewed was used for allowed purposes, while also pointing out a records problem the university needs to fix.

“We noted no exceptions in our testing; therefore, we conclude that the CARES Act student-portion funding that we tested was used for its allowable and intended purposes.”

The only finding was about missing proof of cybersecurity training completion, not misuse of the COVID-19 funds tested.

“Although Fitchburg State University (FSU) provided us some documentation, such as attendance sheets, to confirm that the employees responsible for handling COVID-19 funds completed cybersecurity awareness training, this documentation was incomplete.”

The auditor recommended that FSU keep attendance records and monitor that those records are retained; FSU said it has already started using online cybersecurity training software.

“FSU should implement monitoring controls to ensure that it retains attendance sheets for its cybersecurity awareness training.”

The audit found that FSU received about $22.5 million in COVID-19 education relief awards and had disbursed about $19.4 million during the audit period, so the oversight covered a large amount of public funding.

“Below is a summary of FSU’s financial activity related to COVID-19 funding during the audit period.”

HEERF means federal emergency higher-education relief money tied to COVID-19, including grants from the CARES Act, CRRSAA, and ARP Act.

“The Higher Education Emergency Relief Fund (HEERF) consists of three separate grants related to the COVID-19 pandemic that were directly funded from US DOE under the CARES Act (HEERF I), CRRSAA (HEERF II), and ARP Act (HEERF III).”