Audit of the Department of Higher Education
June 27, 2022 · Department of Higher Education · Read the full official report on mass.gov ↗
Published June 27, 2022 Audit covers March 27, 2020 – February 28, 2021 Under Suzanne M. Bump · 2011–2023
source
“Below is a summary of our findings and recommendations, with links to each page listed.”
Read the plain-English breakdown
This is a state performance audit of the Massachusetts Department of Higher Education covering March 27, 2020 through February 28, 2021.
“This report details the audit objectives, scope, methodology, findings, and recommendations for the audit period, March 27, 2020 through February 28, 2021.”
Auditors checked whether the department properly managed certain COVID emergency education funds, updated internal controls, ensured cybersecurity training, and followed review and reporting rules for the MassTransfer Commonwealth Commitment Program.
“In this performance audit, we determined the following:”
The issues matter because weak cybersecurity training can put protected information at risk, and missed program reviews can prevent problems or needed improvements from being identified.
“A lack of such training may lead to user error and compromise the integrity and security of protected information in DHE’s information technology systems.”
For ordinary residents, this affects confidence that public higher education programs and emergency education money are being overseen carefully, and that student transfer programs are being reviewed for problems and improvements.
“MassTransfer offers cost savings to help individuals attend community college to earn associate’s degrees and then transfer to a state college or university to earn their bachelor’s degrees.”
The department passed some audit checks, but failed three: cybersecurity training completion, annual review meetings for the Commonwealth Commitment program, and reporting those reviews to the Board of Higher Education.
“DHE did not provide reports or communications to BHE regarding CCAB’s review of the MassTransfer Commonwealth Commitment Program.”
The auditor recommended stronger training controls, a clear person or department responsible for training oversight, annual program reviews, updated procedures if responsibilities changed, and annual reporting to the Board of Higher Education.
“DHE should provide BHE, at least annually, with reports or communications about the review of the MassTransfer Commonwealth Commitment Program by CCAB or the group appointed to assume its responsibilities.”
The audit is significant because the department oversees public higher education policy support and programs touching community colleges, state universities, and University of Massachusetts campuses.
“The system of public higher education includes 15 community colleges, nine state universities, and five University of Massachusetts campuses.”
GEER means federal Governor’s Emergency Education Relief money for education during COVID-19; CCAB was the advisory group meant to help review the Commonwealth Commitment transfer program; BHE is the state Board of Higher Education; DHE is the Department of Higher Education.
“Under the Governor’s Emergency Education Relief Fund (GEER Fund), [US DOE] awards grants to Governors for the purpose of providing local educational agencies (LEAs), institutions of higher education (IHEs), and other education related entities with emergency assistance as a result of the Novel Coronavirus Disease 2019 (COVID-19).”
What the Auditor checked
- Complied Did DHE ensure that each institution of higher education (IHE) signed an interdepartmental service agreement (ISA) or standard contract form (SCF) for the amount of Governor’s Emergency Education Relief (GEER) funding it was to receive as determined by Massachusetts’s Executive Office of Education (EOE)?
- Complied Did DHE ensure that the guidance for the appropriate use of GEER funding outlined in its ISA with EOE was incorporated into the ISAs and SCFs for IHEs receiving GEER funding?
- Did not comply Did DHE employees who were responsible for managing and administering GEER Fund grants complete cybersecurity awareness training as required by Section 6.2.4 of the Executive Office of Technology Services and Security’s Information Security Risk Management Standard IS.010?
- Did not comply Did DHE meet, at least annually, with the Commonwealth Commitment Advisory Board (CCAB) to monitor and review the MassTransfer Commonwealth Commitment Program, as required by its “Commonwealth Commitment to College Access, Affordability, and Completion” memorandum of understanding with Massachusetts’s public IHEs?
- Did not comply Did DHE provide a report to Massachusetts’s Board of Higher Education (BHE) regarding DHE’s meetings with CCAB, as required by the “Commonwealth Commitment to College Access, Affordability, and Completion” memorandum of understanding?
What the Auditor found
Why it matters: A lack of training could lead to user error and compromise protected information in DHE’s information technology systems.
Standard: Section 6.2.4 of the Executive Office of Technology Services and Security’s Information Security Risk Management Standard IS.010 ( Section 6.2.4 of the Executive Office of Technology Services and Security’s Information Security Risk Management Standard IS.010 )
2 recommendations
- DHE should develop internal controls to ensure that all employees complete the required training annually.
- DHE should designate a department or individual to be responsible for overseeing the assignment and completion of required training.
Agency response & Auditor reply
Agency: "The DHE acknowledges the . . . finding that five of the ten employees did not timely complete their annual cybersecurity training during the audit period of March 27, 2020 to February 28, 2021."
Auditor: "Based on its response, it appears that DHE is taking the recommended actions to correct the deficiencies noted during the audit and prevent their reoccurrence."
Why it matters: The program may not operate effectively because necessary or recommended changes may not be identified and made.
Standard: The “Commonwealth Commitment to College Access, Affordability, and Completion” memorandum of understanding and DHE’s MassTransfer Procedures Manual ( “Commonwealth Commitment to College Access, Affordability, and Completion” memorandum of understanding; DHE’s MassTransfer Procedures Manual )
2 recommendations
- DHE should meet with CCAB at least annually to review the MassTransfer Commonwealth Commitment Program and make recommendations about its improvement.
- Alternatively, if DHE’s commissioner has approved the disbanding of CCAB and changes to the nature and frequency of reviews, DHE should update the MassTransfer Procedures Manual to accurately identify the group responsible for the review of the MassTransfer Commonwealth Commitment Program and the frequency and nature of the review.agency: agreed
Agency response & Auditor reply
Agency: "The Commonwealth Commitment Advisory Board (CCAB) was absorbed by the MassTransfer Statewide Committee, and the program has been an item on the meeting agendas and a continued topic of conversation at systemwide meetings since the CCAB was dissolved."
Auditor: "No documentation was provided to us detailing the evaluation that took place."
Why it matters: BHE may not be aware of program performance, institutional feedback, or needed changes for the program’s continued success.
Standard: The “Commonwealth Commitment to College Access, Affordability, and Completion” memorandum of understanding and DHE’s MassTransfer Procedures Manual ( “Commonwealth Commitment to College Access, Affordability, and Completion” memorandum of understanding; DHE’s MassTransfer Procedures Manual )
1 recommendation
- DHE should provide BHE, at least annually, with reports or communications about the review of the MassTransfer Commonwealth Commitment Program by CCAB or the group appointed to assume its responsibilities.
Agency response & Auditor reply
Agency: "During the audit period, which paralleled the beginning and height of the global COVID-19 pandemic, the Board met six times and agendas were predominantly focused on matters related to responding to the pandemic, such as supporting institutions and keeping students, faculty and staff safe."
Auditor: "We reiterate our recommendation that DHE provide BHE, at least annually, with reports or communications about the review of the MassTransfer Commonwealth Commitment Program by CCAB or the group appointed to assume its responsibilities."
More audits of this entity
Other Office of the State Auditor reports on Department of Higher Education .
-
Audit of Settlement Agreements and Confidentiality Clauses Across Multiple State Agencies - Department of Higher Education (January 28, 2025)State Agency / Office · January 28, 2025 - Audit of the Department of Higher EducationState Agency / Office · August 29, 2018
- Department of Higher Education's Optional Retirement ProgramState Agency / Office