Framingham State University

This is a state audit of Framingham State University covering July 1, 2010 through September 30, 2011.

“We conducted this performance audit, which covered the period July 1, 2010 through September 30, 2011, in accordance with generally accepted government auditing standards.”

The audit happened because Framingham State University reported that two people were on its student health plan even though they were not students.

“The Chapter 647 report submitted by FSU disclosed a situation in May 2011 in which FSU administrators identified two individuals enrolled in FSU’s student health insurance plan who were not students at FSU and therefore were not eligible to receive health insurance benefits.”

The issue matters because weak account controls let an employee use old student accounts to add ineligible people to a health insurance plan.

“This employee was able to enroll these former students by adding the charges for the health care plan to each of their individual student accounts, which were still accessible even though they have been inactive for over eight years.”

For taxpayers and students, the audit is about making sure university benefits go only to people who qualify and that old accounts cannot be misused.

“To be eligible for the health insurance, a student must be enrolled in at least three classes at FSU.”

The auditor found no other fraud or abuse in the areas tested, and the university changed its procedures.

“For the areas tested, our audit revealed no other occurrences of fraud or abuse regarding enrollment of ineligible individuals.”

FSU said it would review whether inactive student records need more security and make sure monitoring is documented.

“The University will carefully consider the recommendation of the Auditor to determine what additional security enhancements can be instituted regarding inactive students’ records.”

The larger lesson is that keeping inactive student accounts open without restrictions can create a real opportunity for misuse.

“We also learned that FSU maintains all student accounts indefinitely with no restrictive access to inactive accounts.”

“Internal controls” means the rules, checks, and monitoring that should stop unauthorized or inaccurate activity in systems like student accounts.

“We recommend that FSU management reexamine its internal controls over inactive student accounts and determine whether additional controls are needed to ensure that access to student accounts after they become inactive is properly restricted, secured from unauthorized access, and periodically monitored to identify inaccurate or inconsistent activity.”