Audit of the Massachusetts College of Art and Design

This is a Massachusetts State Auditor performance audit of Massachusetts College of Art and Design covering March 1, 2020 through June 30, 2021.

“This report details the audit objectives, scope, methodology, findings, and recommendations for the audit period, March 1, 2020 through June 30, 2021.”

Auditors checked whether MassArt followed the rules for federal COVID relief money and whether it updated internal controls and cybersecurity training practices.

“The purpose of our audit was to determine whether MassArt administered CARES Act and CRRSAA funding it received in accordance with the criteria established by US DOE and MDHE.”

The audit matters because COVID relief funds were meant to support students and college operations during the pandemic, and weak cybersecurity training can put public systems and money at risk.

“Without educating all system users on their responsibility of protecting the security of information assets, MassArt is exposed to a higher risk of cybersecurity attacks and financial and/or reputation losses.”

For an ordinary citizen, the report says public COVID relief funds reviewed by auditors were administered properly, while also pointing to a cybersecurity weakness the college needed to fix.

“Below is a list of our audit objectives, indicating each question we intended our audit to answer; the conclusion we reached regarding each objective; and, if applicable, where each objective is discussed in the audit findings.”

The main problem found was not misuse of COVID relief funding; it was that MassArt lacked a requirement and records for cybersecurity awareness training for all relevant staff.

“Although MassArt does provide voluntary cybersecurity awareness training, the college does not maintain employee training attendance records.”

The auditor recommended that MassArt require cybersecurity training for new and current employees and keep proof that each employee completed it.

“MassArt should maintain a record of completion of cybersecurity awareness training for each employee.”

The report is significant because MassArt had millions in federal COVID-related awards, and the audit identified one governance weakness while finding the tested funding areas compliant.

“Below is a summary of MassArt’s financial activity related to federal COVID-19 funding during the audit period.”

HEERF was federal COVID emergency funding for higher education, including student aid and institutional costs related to the pandemic.

“The HEERF consists of three separate grants related to the 2019 coronavirus pandemic emergency that were directly funded from US DOE under the CARES Act (HEERF I), CRRSAA (HEERF II), and American Rescue Plan (HEERF III).”