Comprehensive Guide to Quality Audits for Proprietary Schools and Servicer Engagements

1. Session 36 OIG Proprietary SchoolAudit Guide OIG Non-Federal Audit Team | Nov.-Dec. 2017 U.S. Department of Education 2017 FSA Training Conference for Financial Aid Professionals

2. Presenters

3. What We Will Cover • Introduction and Background • The importance of a quality audit • Considerations for hiring an auditor • Changes made to the School/Servicer Audit Guide • Common audit quality issues in engagements performed under the School/Servicer Audit Guide

4. Important Note • This session focuses on compliance audits of proprietary schools (for-profits) and servicer attestation engagements performed under the ED Audit Guide • This session Does NOT cover single audits of states, local governments, and/or not-for-profit organizations subject to single audits that participate in the Student Financial Assistance programs

5. Non-Federal Audit Team • Locations in DC (headquarters), Dallas, Philadelphia, and Kansas City • Responsibilities stemming from Inspector General Act and others • To assure the quality and usefulness of the non-Federal audit process • To ensure that non-Federal audits meet requirements and are reliable and effective tools to improve the integrity and effectiveness of ED programs

6. Non-Federal Audit Team • Oversee Quality Control Review (QCR) process • Provide technical assistance • Issue Audit Guides • Participate in Compliance Supplement revision process • Participate in post-audit activities • Represents ED at interagency meetings related to government-wide audit issues

7. The Importance of a Quality Audit • Significant part of ED’s monitoring process • ED cannot perform on-site visits to every school each year • A quality audit is needed to: • Assist management in improving operations • Lower the risk of future non-compliance • Protect taxpayers’ dollars

8. The Importance of a Quality Audit • Compliance audits: • Determine compliance with ED requirements • Identify and address non-compliance and control deficiencies • Financial Statement Audit • Determine whether school is financially responsible • Assists ED in identifying and monitoring schools at risk of closure due to financial issues

9. Considerations for Hiring an Auditor • An independent auditor must conduct the annual compliance audit and financial statement audit in accordance with Generally Accepted Government Auditing Standards (GAGAS) • GAGAS auditor qualification requirements: • Independence • Licensing • Professional Education • Peer Review

10. Considerations for Hiring an Auditor GAGAS Requirements: • Independence • In all matters related to the audit work, the audit firm and individual auditors must be independent • Independence of Mind and Independence in Appearance • Licensing • Auditors must be licensed CPA’s or working for licensed CPA firms • Firms must meet licensing requirements of the appropriate State(s) • Verify license(s) and look for actions taken against the CPA on State Board of Accountancy websites

11. Considerations for Hiring an Auditor GAGAS Requirements: • Professional Education • Auditors must maintain professional competence through continuing professional education (CPE) • Ask the auditor for CPE records and evaluate • Peer Review • Firm must have a peer review once every three years to evaluate system of quality control • Ask for a copy of most recent Peer Review

12. Considerations for Hiring an Auditor Other considerations: • Experience • Ask what types of engagements the firm conducts • Quantity does not always dictate quality • Ask for references and check them • Professional Organizations and State Societies • State CPA Societies, AICPA, Governmental Audit Quality Center • Membership indicates a commitment to competence

13. Considerations for Hiring an Auditor Other considerations: • Prior QCR Results • Ask if the auditor has been subject to QCR process by ED or another agency • Results are generally not publicly available • Once you’ve selected an auditor, obtain an engagement letter to document the terms of the engagement • Audit Guide lists engagement letter requirements

14. Audit Guide Issuance Guide for Audits of Proprietary Schools and For Compliance Attestation Engagements of Third-Party Servicers Administering Title IV Programs (Audit Guide)

15. Audit Guide Issuance • Issued September 2016 • Effective for fiscal years beginning after June 30, 2016 • Supersedes January 2000 Audit Guide and Dear CPA Letters 07-03, 07-01, 99-01, and 99-02 • Available at OIG Non-Federal Audit website

16. Major Changes from Prior Version • Statutory and regulatory changes effective for period beginning July 1, 2016 • Requires a compliance audit for proprietary schools • Previously required an examination-level attestation engagement • Changes to auditing standards made them more robust and focused on compliance audits • Continues to require attestation engagement for third-party servicers

17. Major Changes from Prior Version • Presumptively Mandatory Procedures • Perform procedure unless ineffective • Document reasons for departure and alternative procedures performed • Changes should result in more consistent auditing and more accurate reporting

18. Additional Guidance Provided • Direct fraud reporting • Use of internal auditors • Coordinating financial and compliance audits • Privacy rights of students and parents

19. Financial Statement Audit Changes Related Party Transactions • Expanded testing requires review of records and discussion with management • Report as finding • Undisclosed related parties • Inadequate detail in footnote

20. Financial Statement Audit Changes 90/10 Revenue Percentage • Emphasizes calculation is made by school, NOT auditor • Expanded testing requires review of student-by-student calculation • Report as finding • Incorrect calculation, any amount of misstatement • Auditor is not able to determine compliance

21. School Compliance Audit Changes • Sampling methodology • Increased sample size • Notification of sample prior to on-site work is prohibited • Site visits • Locations where 50 percent of a program is offered • Physical site-visits every two years with some exceptions • Verifying existence and whether location could support instruction

22. School Compliance Audit Changes • Reporting Non-compliance • Finding for all non-compliance, whether identified by school or auditor • Use of third-party servicer • Auditor should obtain an understanding of school and servicer relationship • Review of contract and servicer audit, interview of servicer

23. Servicer Compliance Audit Changes • Services audited as part of school’s compliance audit • Example: School audit covers functions performed by interim management and staffing • Servicer asserts, and auditor must confirm, that services are audited at school • Finding detail • Identify affected schools • Summarize the effect • Sample should be documented

24. New Compliance Testing • Institutional Eligibility • Legal authority to operate • Agreements with ineligible schools or organizations • School code of conduct • Reporting • Gainful employment reporting

25. New Compliance Testing • Student Eligibility • Ability-to-Benefit and Eligible Career Pathways Program • Prior degrees • Dependency overrides • Attendance at a distance education program • Student confirmation requirement

26. New Compliance Testing • Disbursements • Student and borrower notifications • Transfer students • Federal Work-Study disbursements • Using a servicer or financial institution to deliver credit balances • Return of Title IV Funds • Return of funds for students that do not begin attendance

27. New Compliance Testing • G5 and Cash Management • Draw and disbursement procedures by funding method • Administrative Requirements • Job placement rates • Gainful employment disclosures and student warnings • Close-Out Audit • Disbursements after participation ends

28. Proposed Compliance Testing Security and Confidentiality of Customer Information • ED working to get testing into Compliance Supplement and Audit Guide • Institutions are subject to provisions of Gramm-Leach-Bliley Act • In PPA, institutions agree to comply with implementing regulations at 16 CFR part 314 (Safeguards Rule) • Dear Colleague Letters GEN-15-18 and GEN-16-12

29. Common QCR Findings General and Planning Requirements • Continuing Professional Education requirements not met • Engagement letter missing required elements • Management’s assertions and/or representations not obtained, not complete • Understanding of internal control not sufficiently documented • Control risk not assessed, or not assessed by compliance area • Materiality not considered, or not considered by compliance area

30. Common QCR Findings Financial Statement Audit Requirements • 90/10 calculation not adequately verified • Related party footnote lacking sufficient detail

31. Common QCR Findings Compliance Audit Requirements • Institutional Eligibility • Program lengths and durations • Reporting • Monthly Direct Loan reconciliations • Enrollment Reporting • Student Eligibility • Student confirmations

32. Common QCR Findings Compliance Audit Requirements • Disbursements • Second and subsequent disbursements • Entrance and exit counseling • Credit balances • Return of Title IV Funds • Enrollment status • Testing calculation and timeliness

33. Common QCR Findings Compliance Audit Requirements • G5 and Cash Management • Net draws traceable to accounting records • Disbursements within three days, excess cash • Administrative Capability • Direct Loan Quality Assurance Program • Satisfactory progress policy • Annual security report • Graduation rates

34. QUESTIONS? • oignon-federalaudit@ed.gov