Audit of Mount Wachusett Community College (December 27, 2024)

This is a Massachusetts State Auditor performance audit of Mount Wachusett Community College covering mostly March 1, 2020 through June 30, 2023, with a longer review period for employee settlement agreements.

“In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor has conducted a performance audit of Mount Wachusett Community College (MWCC) for the period March 1, 2020 through June 30, 2023.”

Auditors checked whether the college followed rules for COVID-19 relief funding, updated its internal controls for the pandemic, trained employees on cybersecurity, and properly handled employee settlement agreements.

“The purpose of our audit was to determine the following:”

The issues matter because weak controls, unclear settlement practices, and incomplete cybersecurity training can expose a public college to risks, including poor oversight, security attacks, and reputational harm.

“Without educating all employees on their responsibility of protecting the security of information assets, MWCC may be exposed to a higher risk of cybersecurity attacks and financial and/or reputational losses.”

If you are a student, employee, taxpayer, or local resident, the audit shows that COVID-19 aid was generally handled correctly, but it also calls for stronger safeguards around public accountability, employee settlements, and cybersecurity.

“Based on the results of our testing, we determined that, during the audit period, MWCC administered the student portion of funding under Section 2003(a)(1) of the ARPA in accordance with Section B of US DOE’s HEERF III FAQ.”

The college passed the audit’s tests on COVID-19 relief spending, but failed in three areas: pandemic-related internal controls, employee settlement agreement oversight, and evidence of cybersecurity training completion.

“MWCC did not update its internal control plan with a COVID-19 pandemic response plan.”

The auditor says MWCC is taking steps to fix the problems, and the auditor’s office plans to follow up in about six months.

“As part of our post-audit review process, we will follow up on this matter in approximately six months.”

The most serious concern is not misuse of COVID-19 aid; it is that weak documentation and oversight could make it harder to prevent or detect problems in settlements, cybersecurity, and agency controls.

“If MWCC does not have a transparent and accountable process to handle employee settlement agreements, especially those containing non-disclosure, non-disparagement, or similarly restrictive clauses, it cannot ensure that employee settlement agreements are handled in an ethical, legal, or appropriate manner.”

An internal control plan is basically a written plan for spotting risks and setting up checks to reduce them so an agency can do its job.

“An internal control plan identifies objectives and risks and identifies control activities to mitigate risks that may prevent an agency from accomplishing its public mission.”