Audit of the University of Massachusetts Chan Medical School (September 6, 2024)

This is a state performance audit of UMass Chan Medical School covering July 1, 2021 through December 31, 2022.

“In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor has conducted a performance audit of the University of Massachusetts (UMass) Chan Medical School (Chan) for the period July 1, 2021 through December 31, 2022.”

Auditors checked whether UMass Chan followed rules for bank card purchases and cybersecurity awareness training.

“We also determined whether UMass Chan adhered to its “Privacy and Security Training Policy” regarding cybersecurity awareness.”

Weak controls over credit card records and cybersecurity training can increase the risk of fraud, mistakes, cyberattacks, and damage to the school’s finances or reputation.

“If UMass Chan does not educate all workforce members on their responsibility to protect information assets by requiring cybersecurity awareness training, then UMass Chan is exposed to a higher-than-acceptable risk of cybersecurity attacks, which could cause financial and/or reputational losses.”

For ordinary Massachusetts residents, this matters because UMass Chan is a public institution that receives state funding and handles public resources, so its spending controls and cybersecurity practices affect public accountability.

“Also during fiscal year 2022, UMass Chan had $1,017,143,000 in revenue, which included $60,392,000 in state appropriations,1 and $1,007,677,000 in expenses.”

The school generally had systems in place, but auditors found gaps: some bank card records were not handled as required, and some required cybersecurity trainings were late or not completed.

“UMass Chan did not ensure that workforce members completed cybersecurity awareness training in a timely manner.”

The auditor recommended that UMass Chan tighten its bank card documentation process and make sure all workers with network access complete cybersecurity training when required.

“UMass Chan should ensure that all workforce members who have access to its computer network complete cybersecurity awareness training in a timely manner, upon hire and annually thereafter.”

The findings are significant because auditors saw repeated documentation and training issues, not just one isolated mistake: 42 sampled bank card reconciliations were late, and multiple sampled workers completed training late or not at all.

“Of the 127 requisitions related to our sample of transactions, 2 requisitions were never created in the UMass system’s online bank card transaction repository, while 42 were submitted after the allowable 30 days.”

A “bank card” means a university-paid commercial credit card used for approved purchases, emergency purchases, or travel costs instead of reimbursing employees later.

“The UMass Bank Card is a commercial credit card.”