Student Financial Services Audit - University of Texas System · 17:04 Student Financial Services Audit Page 7 of 23 Audit Team: Sunna Farooq, Internal Auditor Lori Muncy, Senior

Student Financial Services Audit

Internal Audit Report 17:04

December 21, 2017

Office of Internal Audit

Table of Contents

17:04 Student Financial Services Audit Page 2 of 23

I. Executive Summary 3· Background/Scope and Objectives 3· Conclusion 5

II. Detailed Observations and Action Plans Matrix 8

III. Appendices 22· Appendix A – Risk Classifications and Definitions 22· Appendix B – Student Financial Aid Process Map 23

Executive Summary


BackgroundAt UT Southwestern, the process of student charges and payments are facilitated by three offices: the Office of Enrollment Services, the Officeof Student Financial Aid, and Accounting & Fiscal Services. Historically, the functions of OES and SFA reported to a single individual whorecently left the university after more than 20 years. In October 2016 and January 2017, respectively, a new Director of Enrollment Servicesand a new Director of Student Financial Aid (SFA) were hired.

SFA administers Federal, State and institutional aid in the form of scholarships, grants and loans for students enrolled in the Medical School,Graduate School of Biomedical Sciences, and the School of Health Professions. SFA reports to the Vice President and Chief Operating Officerfor Academic Affairs and the staffing consists of the Director, Associate Director, two Financial Aid Advisors, Financial Aid Officer, and anAdministrative Assistant.

Approximately $29 million in financial aid was awarded to 1,008 students enrolled in the three Schools for the 2017 academic year as illustratedin the chart below. Guaranteed student loans accounted for over 84% of award total. Appendix C provides a further breakdown of the typesof financial aid, eligible and actual recipients by school.

Accounting and Fiscal Services provides the student accounting function for the institution, maintaining student tuition and fee accounts andprocessing the delivery of excess funds in student accounts.

Executive Summary


Scope and ObjectivesThe Office of Internal Audit has completed its Financial Aid audit. This was a risk based audit and part of the fiscal year 2017 Audit Plan. Theoverall objective of the audit engagement was to assess financial aid processes and controls across the institution, including evaluation todetermine:

· Timely, accurate and complete awarding of student financial aid;· Processes and controls are in place to support key Financial Aid Office objectives, including scholarships, grants and federal and

institutional student loans for the Medical School, Graduate School of Biomedical Sciences, and the School of Health Professions;· Effectiveness and accuracy of external reporting;· Compliance with institutional policies, federal and state requirements; and· Adequacy of system controls, including user access, approval workflow and segregation of duties.

The scope period included Financial Aid Year 2017, which includes enrollment for the summer 2016, fall 2016 and spring 2017 semesters.The audit further covered inherent institutional risks impacting student services.

22,422,890

6,649,059

666,150

Student Financial Aid Accepted by School - Aid Year 2017

MEDICAL SCHOOL SCHOOL OF HEALTH PROFESSIONS GRADUATE SCHOOL OF BIOMEDICAL SCIENCES

Students must annually apply for financialaid by submitting the Free Application forFederal Student Aid (FAFSA) to determineif they meet qualifications for financial aid.Financial aid considerations are madewhen students are admitted to therespective schools or enrolled in goodstanding and showing satisfactoryacademic progress.

SFA receives Federal financial aid fundsvia EFT transactions to UT Southwestern.The PeopleSoft Campus Solutions systemis used to process transactions andadminister financial aid across the Schoolsand the PeopleSoft Financials AccountsPayable system is used to processpayments to student accounts. Pleaserefer to Appendix B for the “StudentFinancial Aid Process Map”.

Executive Summary


We conducted our examination according to guidelines set forth by the Institute of Internal Auditors’ International Standards for theProfessional Practice of Internal Auditing.

Conclusion

The Financial Aid Office is providing quality guidance and counseling to students in assessing their financial needs and available aid sources.

Opportunities for improvement were identified at the institutional levels, specifically, roles and responsibilities among the key student servicesfunctions – Office of Enrollment Services, Student Financial Aid and Cash Management – are not segregated to protect against the risk ofloss of funds (i.e. conflicting Cash Management functions) or to detect errors in vital student information (i.e. review and approval of edits tostudent account activities). This was attributed to the previous leader responsible for both Enrollment Services and Student Financial Aid,which is now reorganized into two independent functions. Additionally, the unofficial Bursar’s role currently performed by Cash Managementis undergoing assessment to improve functionality, student communication and services. Campus Solutions system security access requiresupdates to ensure appropriate segregation of duties and periodic monitoring is in place to apply only minimum necessary access.

SFA monitoring of key compliance provisions for federal financial aid by the previous leadership was not adequate. The current Director ofFinancial Aid has identified improvement steps going forward to ensure awards are made only to eligible awardees and conforms to keyprovisions. Other improvements in oversight and monitoring implemented since the Director of Financial Aid came on board included:

· Review of existing financial aid programs and requirements for compliance and reporting adequacy,· Review of financial aid sub-ledgers to ensure appropriate account balances,· Recommendations to discontinue financial aid programs that are deemed no longer applicable,· Update and conversion of financial aid policies and procedures manual into electronic format.

The following table provides a summary and grouping of the Institutional and Financial Aid observations noted, along with the respectivedisposition of these observations within the Medical Center Internal Audit risk definition and classification process. See Appendix A for RiskRating Classifications and Definitions.

Priority (0) High (2) Medium (4) Low (1) Total (7)

Institutional Observations

n #1 Establish Segregation of Duties for Student Services Functions – Student services functions are not clearly defined amongEnrollment Services, Student Financial Aid and Student Accounting to protect against the risk of loss of funds or detect errors in vitalstudent information.

Executive Summary


n #2 Align System Access For Appropriate Segregation of Duties and Establish Periodic System Access Monitoring – Accessto student services functions in the PeopleSoft Campus Solutions system does not allow for appropriate segregation of duties and aprocess to periodically monitor access is not in place, which increases risk of unauthorized transactions.

n #3 Improve Reconciliation Between PeopleSoft Financials and Campus Solutions Modules – Incomplete reconciliation ofdisbursement transactions between PeopleSoft Financials and Campus Solutions resulted in duplicate payments of credit balancesto students.

n #4 Assess Student Fees Structure – The method by which fees are assessed to students does not ensure proportional funding tothe Schools in which the student is enrolled.

Student Financial Aid Observations

n #5 Improve Loan Monitoring Timeliness – Inactive loan sub ledger accounts have not been routinely monitored to ensureborrowing criteria is met and funds are promptly refunded if criteria is not met. This has resulted in the accumulation of three milliondollars in funds and the assessment of penalties.

n #6 Safeguard Student Award Checks – Scholarship checks are received and remain in the custody of the Financial Aid office foran extended period of time until pickup from students, increasing the risk of lost or stolen checks.

Management has plans to address the issues identified in the report and in some cases has already implemented corrective actions. Theseresponses, along with additional details for the key improvement opportunities listed above and other low risk observations are listed in theDetailed Observations and Action Plans Matrix (Matrix) section of this report.

We would like to take the opportunity to thank the departments and individuals included in this audit for the courtesies extended to us and fortheir cooperation during our review.

Sincerely,

Valla F. Wilson, Associate Vice President for Internal Audit, Chief Audit Executive

Executive Summary


Audit Team:Sunna Farooq, Internal AuditorLori Muncy, Senior Internal AuditorGabriel Samuel, Senior IT AuditorVan Nguyen, Supervisor of Internal AuditJeffrey Kromer, Director, IT & Specialty Audit ServicesMelinda Lokey, Director of Internal Audit

cc: Melody Bell, Assistant Vice President, Academic Information SystemsBrandon Bays, Endowment Funds Manager, Office of the PresidentArnim E. Dontes, Executive Vice President, Business AffairsJ. Gregory Fitz, M.D., Executive Vice President Academic Affairs & Provost Dean, Southwestern Medical SchoolCharles M. Ginsburg, M.D., Vice Provost and Senior Associate Dean for EducationKay Hardgrave, Assistant Director, Office of the PresidentJulia Kanellos, Director, Office of the PresidentMelet Leafgreen, Director, Student Financial AidSharon Leary, Assistant Vice President, Accounting and Fiscal ServicesJodi Levy, Assistant Vice President, Administrative SystemsJohn Malanowski, Associate Vice President, Human ResourcesMarc Milstein, Vice President, Information Resources and Chief Information OfficerHeather Mishra, Interim Associate Vice President, Information ResourcesWade Radicioni, Director of Operations & Analytics, Academic AffairsMichael Serber, Vice President, Financial AffairsJulie Sirkin, Assistant Vice President of Compensation, Benefits and Human Resource Information Systems (HRIS)Cameron Slocum, Vice President and Chief Operating Officer, Academic AffairsJoshua Spencer, Associate Vice President and Chief Information Security OfficerThomas Spencer, Assistant Vice President, Information Resources Operations and ComplianceShannon Williams, Director, Enrollment Services

Detailed Observations and Action Plans MatrixObservation Recommendation Management Response


Risk Rating: High n

1. Establish Segregation of Duties forStudent Services FunctionsStudent services functions are not clearlydefined among Enrollment Services, StudentFinancial Aid and Student Accounting due tothe previous Registrar performing dual roles.Changes have been made over the past yearto enhance functional independence,however, conflicting duties were identified asfollows:

· Office of Enrollment Services isresponsible for managing student recordsand also performs key StudentAccounting activities such as applyingtuition waivers and authorizing paymentsto students.

· Cash Management is responsible forportions of the Student Accountingfunction, such as billing tuition and fees,disbursing financial aid funds approvedby the Office of Student Financial Aid,collecting student payments, andmaintaining student accounting records.Cash Management also controlsincoming and outgoing wire transactionsfor the Medical Center.

1. Establish optimal state of studentservices. Perform a comprehensiveassessment of student services functionsto ensure appropriate alignment of dutiesand responsibilities, enhanced studentsupport and communication.

2. Implement plan to separate key functionsbetween Enrollment Services, StudentFinancial Aid and Student Accounting(formerly Cash Management).

3. Update system security access based onassessment and implementation of planto update roles and responsibilities.

Management Action Plans:1. Assessment of key responsibilities has

been defined for each of the threegroups. A sample of highlights include:

A. Accounting and Fiscal Services iscreating a Student Accountingfunction that will be separate fromCash Management and will include acustomer service function to addressstudent inquiries regarding accountbalances.

B. Office of Enrollment Services willevaluate requests for tuition and feewaivers in coordination with StudentFinancial Aid and once approved willsend to Student Accounting forprocessing.

C. Requests for Leave of Absence willbe initiated by the Schools, providedto Student Financial Aid for studentcounseling of impact and then sent toEnrollment Services for processingwithin the system.



· The Office of Student Financial Aidperforms student account review andaddresses student inquiries, functionstypically performed by StudentAccounting.

· System security access for all threefunctions is greater than minimumnecessary and does not allow foradequate segregation of duties.

Inadequate segregation of duties for keyprocesses increases the risk of errors in vitalstudent information or loss of funds and increasesthe risk of non-compliance with the HigherEducation Act of 1965, title IV1.

1 Higher Education Act of 1965, Title IV 34 CRF part 668 (Federal Student Aid Office, Department of Education):To participate in federally funded student financial aid programs, a schoolmust be able to demonstrate that adequate checks and balances are inplace. A school’s internal control system should, at a minimum, include:

a) separating the functions of authorizing and awarding FSA aid anddisbursing FSA program funds

b) tracking trial balances to determine accounts are in balancec) reconciling cash between ledger balance and bank balanced) reconciling federal funds to ensure drawn down are disbursed or

returned within the allowed time framese) maintaining adequate electronic data processing (EDP) controls

Action Plan Owners:Vice President and Chief Operating Officerfor Academic Affairs

Senior Associate Dean, AcademicAdministration

Assistant Vice President, Accounting &Financial Reporting

Target Completion Date:Completed

Management Action Plans:2. Implement plan to separate key functions:

A. Next step is to assign responsibleparties for key responsibilities withineach area.

B. Develop/update operatingprocedures for key responsibilities.



Action Plan Owners:Vice President and Chief Operating Officerfor Academic Affairs

Senior Associate Dean, AcademicAdministration

Assistant Vice President, Accounting &Financial Reporting

Target Completion Date:January 31, 2018

Management Action Plans:3. Update system access permissions

based on key responsibilities andassigned responsible parties.

Action Plan Owners:Assistant Vice President, AcademicInformation Systems

Target Completion Date:April 30, 2018



Risk Rating: High n

2. Align System Access For AppropriateSegregation of Duties and EstablishPeriodic System Access MonitoringAccess to student services functions in thePeopleSoft Campus Solutions system doesnot provide appropriate segregation of duties.Additionally, a process to periodically monitoraccess is not in place. These situationspresent a risk of unauthorized access, whichmay lead to inappropriate transactions ormisappropriation of funds.

· The Director of Financial Aid has editoraccess in Student Financials module to keyfunctions when only read access is required.

· Update access to Financial Aid menus aregranted to users in several departmentsoutside SFA, including Student Accountingand Enrollment Services, when only readaccess is required.

1. Coordinate with Information Resources toensure that elevated access granted tothe Student Financial menus is reducedto view only access where appropriate.

2. Review the access granted to thedepartments for appropriateness andconsider reducing access to read only.Where more than read access is needed,a business justification should beprovided.

3. Submit termination transaction forcontractor and periodically reviewnonemployee access to ensure promptdeactivation of access when no longerneeded.

4. Going forward, implement procedures toperiodically review access for all FinancialAid users.

Management Action Plans:1. We have identified all Financial Aid

menus to which access for the Director ofFinancial Aid can be reduced to view onlyand will coordinate with InformationResources to implement those changes.

Action Plan Owners:Director, Office of Student Financial Aid

Assistant Vice President, AcademicInformation Systems


Management Action Plans:2. We have identified all Financial Aid

menus to which access for otherdepartment users can be reduced andwill coordinate with InformationResources to implement those changes.






· A contractor maintained access but had takenfamily leave in May 2017 and did not return tothe contract firm. This was not timely detecteddue to the following control breakdowns:

· HR monitoring reports to verify the activestatus were not routed to the appropriateSFA management supervising their workdue to incorrect designation of theirsupervisor in the HCM system.

· The contractor’s job record in HCM did nothave an expected end date after whichtheir access would be automaticallyremoved as required by policy ISR-111System Access Management.

5. Coordinate with HR, BusinessAdministrative Systems and InformationSecurity to evaluate options to improvepolicies and procedures for establishingand monitoring non-employee accessincluding: (1) ensuring their “Reports To”manager is designated as their directsupervisor in the department where theyare performing services wheneverpossible, and (2) ensuring job records inHCM include an expected end date nolonger than one year in the future asrequired by policy ISR-111 SystemAccess Management.

Management Action Plans:3. Termination transaction was submitted for

the contract employee as of December 1,2017. HR Active Employee Listingreports will be monitored monthly.



Target Completion Date:Completed

Management Action Plans:4. Going forward, we will coordinate with

Information Resources to annually reviewFinancial Aid access.



Target Completion Date:August 31, 2018



Management Action Plans:5. Representatives from HR, Business

Administrative Systems and InformationSecurity will evaluate options, formulate aplan and implement identifiedimprovements to policies and proceduresfor establishing and monitoring non-employees. A plan will be finalized byJanuary 31, 2018. Actions not requiringIR resources will be completed by March31, 2018. Other actions requiring IRresources to be completed by December31, 2018.

Action Plan Owners:Assistant Vice President, Compensation,Employee Benefits and HR InformationSystems

Assistant Vice President, BusinessAdministrative Systems

Associate Vice President and ChiefInformation Security Officer

Target Completion Date:January 31, 2018 – develop plan

March 31, 2018 - Actions not requiring IRresources

December 31, 2018 - actions requiring IRresources



Risk Rating: Medium n

3. Improve Reconciliation BetweenPeopleSoft Financials and CampusSolutions

Duplicate student credit balance paymentswere made due to incorrect student directdeposit bank routing numbers within thestudent’s academic profile. These errors werenot detected in a timely manner due to thelack of timely reconciliation between thePeopleSoft Financials (PS) and CampusSolutions (CS) systems. Currently thisreconciliation is performed annually.

Three reissued financial aid disbursements tostudents totaling $34k were erroneouslyduplicated due to the original paymenttransactions not properly voided or reversedbefore the reissued transactions wereprocessed.

Lack of timely reconciliation between thesemodules can increase the risk of inaccurate orunauthorized transactions.

1. Notify the two students receivingduplicate ACH payments forreimbursement or repayment plan.Coordinate with Accounts Payable tocancel the outstanding check.

2. Implement additional requirements forreconciling PS payment vouchers andprocedures for resolving exceptions (i.e.require reconciling PS Financials andCampus Solutions for a returned ACHbefore reprocessing). Coordinate with IRAdministrative Systems and AcademicInformation Systems to enhancereconciliation controls and identifypossible enhancements to systemcontrols.

Management Action Plans:1. One of the duplicated ACH payments was

collected in December when the secondhalf of the student’s financial aid becameavailable. The second student hasconfirmed the error and willreimburse. Accounting and FiscalServices (A&FS) has fully canceled theoutstanding check in the third case.

2. A&FS is coordinating with IRAdministrative Systems andAdministrative Information Systems toensure the error doesn’t happenagain. We have determined the followingcontrols will be or have been put in placeto reduce the risk of this occurring again:A. ACH - If a routing number

fails, A&FS will not cancel thepayment in CS, and will ask thestudent to update their informationand let the payment clear. A&FS willwait three business days and verifythat the payment has been sent toPS. Additionally, the ACH will not bereissued until the cancellation isconfirmed. This was implemented asof December 7, 2017.



Specific details related to the three paymentsare as follows:· Two of the payments were direct deposit

(ACH) payments that were held insuspense in Campus Solutions and notposted in PS due to an incorrect bankrouting number. When the studentcorrected their bank routing number in CS,the original transaction processed forpayment in PS.

· One of the duplicated payments, a papercheck, was not properly canceled. Thecheck cancellation process is a manualprocess using a paper form. In this case,the paper form was never received inAccounts Payable. Cash Managementproperly defaced the paper check with theVoid stamp and the student did not receivethe duplicated payment.

B. Cancellation of payments – Theprocess for canceling checks nowgoes through ServiceNow to ensureforms are not lost. This process wasimplemented in May 2017. We willalso add ACH cancellations to thatprocess and this was implemented byDecember 7, 2017.

C. For all types of payments – The PSsupport team will create a query toallow for better reconciliation betweenthe systems. A&FS will increase thereconciliation of the two systems tomonthly to catch differencestimely. Will begin reconciling with theDecember 2017 close.

D. Academic Information Systems (AIS)will turn off internal routing numbervalidation in PS/CS to allow theCashPro banking system to providean error message. This is the sameprocess as a broken account numberand is more robust than currentprocesses. Error messages shouldbe received in two business days. AISwill implement by February 28, 2018.



Action Plan Owners:

Assistant Vice PresidentOffice of Accounting and Fiscal Services

Assistant Vice President, AdministrativeSystems

Assistant Vice President, Academic InformationSystems

Target Completion Date:

1. Completed

2A. Completed

2B. Completed

2C. January 31, 2018

2D. February 28, 2018




4. Assess Student Services Fee StructureThe student fee structure is not aligned with thebenefits applied to the respective Schools anddegree programs.

There is a surplus of approximately $3.1 million inseveral sub ledger accounts, as follows:

· The Bryan Williams Student Centeroperations sub ledger has a credit balanceof $2.8 million from student services feescontributed by all three schools. Two-thirdsof this amount is held in reserve for generaland capital needs use.

· The Student Center Discount Fund carries acredit balance of $300k that appears to beinactive.

· The Central Accounting Office sub ledgershave combined credit balances of $40k fromannual lab fees assessed to medicalstudents and other school students.

In addition, the student microscope feerequires review as technologicaladvancements and migration to digital imageshas reduced the need for traditionalmicroscopes. Students are currently assesseda microscope fee ranging from $75 per schoolterm to $150 per year based on the students’degree program and program year.

Finalize and implement plan with input fromthe Student Leadership Council toincorporate the following options:

· Allocate surplus funds to the respectiveschools

· Sponsor campus activities to benefitstudents

· Upgrade current amenities or introduceadditional student amenities.

Management Action Plans:

The Provost’s Office has commenced ananalysis of student fee accounts to reviewoptions for returning a portion of the balanceto the students via sponsored studentactivities, amenities or lower assessed fees.

Action Plan Owner:Vice President and Chief Operating Officerfor Academic Affairs

Director of Operations & Analytics, AcademicAffairs

Target Completion Date:

April 30, 2018



Student Financial Aid Observations




5. Improve Loan Monitoring TimelinessFinancial aid funds intended for studentassistance were not adequately monitored toensure required borrowing criteria were met.These funds were allowed to accumulate overtime, which the current aggregate balance of$3.7 million is subject to federal governmentassessed penalties and required refunding tothe funding source. To avoid future penalties,the university must exit the program andreturn funds to the funding source.

· The federal Department of Health andHuman Services (DHHS) Student FinancialAid Primary Care Loan program is notactive but carries a balance of $3 millionbecause UTSW has not met loan criteria ofattaining primary care commitment of 50%or more by enrolled medical students. Thepenalty assessed in 2017 was $80k.

· The DHHS Health Professions StudentLoan Fund with a balance of $686K hasbeen in an inactive status since 1992 andshould be returned to the lender.

· The Texas Public Education Grants (TPEGfunds) has a credit balance of $877k whilethe Student Emergency Loan Fund has adebit balance of $791k (net balance of$86k combined) requiring reconciliation.

1. Obtain approval from Dean and ProvostOffice to exit the loan programs.

2. Update account reconciliation andmonitoring procedures to include periodicquality review of loan programs with highbalances or fluctuation.

3. Close out sub ledger accounts andensure balances are zero oncerepayments have been processed.

4. Going forward, implement monitoringprocedures to ensure compliance withkey lender provisions prior to acceptingfunds.

Management Action Plans:1. The University is seeking exit from theDHHS program and has received the FinalLiability letter detailing the required paymentto exit the program. This is currently inreview for approval to pay the liability.

We are coordinating with the Provost’s Officeto address the remaining TPEG and StudentEmergency Loan sub ledger balances.

2-4. We will implement reconciliation andmonitoring procedures to ensure compliancewith key lender provisions going forward.

Action Plan Owner:Director, Office of Student Financial Aid

Target Completion Date:1. Completed

2 – 4. March 31, 2018




6. Safeguard Student Award ChecksScholarship checks issued by theSouthwestern Medical Foundation are madepayable to student recipients and are mailedto the Financial Aid Office for distribution,which has been a standard practice. Thesechecks are in the custody of the Financial Aidoffice for an extended period of time until theyare picked up by the student, increasing therisk of lost or stolen checks as well asinstitutional exposure to undesirable publicity.

Southwestern Medical Foundation scholarshipchecks totaling $207k were awarded to 173students during Financial Aid Year 2017.

Maintaining hard copy checks for an extendedperiod of time increases the risk of lost orstolen checks.

Coordinate with the Office of Endowment tomail scholarship checks directly to studentrecipients.

Management Action Plan:The Office of Student Financial Aid willcoordinate with the Endowment office toensure scholarship checks are mailed directlyto the student recipients.


Target Completion Date:May 31, 2018



Risk Rating: Low n

7. Ensure Compliant Financial Aid AwardsTwo forms of financial aid awarded in schoolyear 2016-2017 did not meet qualificationrequirements:

· Students enrolled in the School of HealthProfessions Radiation Therapy Certificateprogram have been receiving federalfinancial aid and required reporting is notin place for the loan program. Title IV rulesrequire institutions to publish consumerinformation required for gainingemployment to qualify. This affects five ofeight students enrolled for 2016-2017 for atotal of $123k.

· The Diversity Initiative Scholarshipprogram is not consistent with the federalnon-discrimination statute. These awardstotaled $20k to Graduate School ofBiomedical Sciences and School of HealthProfessions students in 2016-2017. TheStudent Financial Aid Office isrecommending discontinuation of this formof scholarship.

Awarding scholarships that are not incompliance with key provisions results inpenalties.

1. Implement recommendations approvedby the Provost’s Office to wind downthese programs, including payment ofpenalties and fees assessed.

2. Develop recommendation for applicableexternal communication/reporting (i.e.Fiscal Operations Report and Applicationto Participate or FISAP).

Management Action Plans:1A.The Provost Office has agreed tograndfather the Radiation Therapy CertificateProgram students for the upcoming year withfinancial aid and then cease awarding aid tostudents in this program completely. No newRadiation Therapy (RT) students will beawarded financial aid for 2017-2018 andbeyond.

1B.The Student Financial Aid Office hasrecommended the discontinuation of theDiversity Initiative Scholarship programbeginning with school year 2017-2018.

Action Plan Owner:

Vice President and Chief Operating Officerfor Academic AffairsDirector, Student Financial Aid

Target Completion Date:1A. Completed

1B. March 31, 2018

Management Action Plans2. Management agrees and will complete

required FISAP reporting.


Target Completion Date:October 1, 2018

Appendix A – Risk Classifications and Definitions


As you review each observation within the Detailed Observations and Action Plans Matrix of this report, please note that we have included a color-coded depiction as to the perceived degree of risk represented by each of the observations identified during our review. The following chart isintended to provide information with respect to the applicable definitions and terms utilized as part of our risk ranking process:

Risk Definition- The degreeof risk that exists basedupon the identifieddeficiency combined withthe subsequent priority ofaction to be undertaken bymanagement.

Degree of Risk and Priority of Action

PriorityAn issue identified by Internal Audit that, if not addressed immediately, has a highprobability to directly impact achievement of a strategic or important operationalobjective of a UT institution or the UT System as a whole.

High

A finding identified by Internal Audit that is considered to have a high probabilityof adverse effects to the UT institution either as a whole or to a significantcollege/school/unit level. As such, immediate action is required by managementin order to address the noted concern and reduce risks to the organization.

Medium

A finding identified by Internal Audit that is considered to have a mediumprobability of adverse effects to the UT institution either as a whole or to acollege/school/unit level. As such, action is needed by management in order toaddress the noted concern and reduce the risk to a more desirable level.

Low

A finding identified by Internal Audit that is considered to have minimal probabilityof adverse effects to the UT institution either as a whole or to a college/school/unitlevel. As such, action should be taken by management to address the notedconcern and reduce risks to the organization.

It is important to note that considerable professional judgment is required in determining the overall ratings presented on the subsequent pages ofthis report. Accordingly, others could evaluate the results differently and draw different conclusions.

It is also important to note that this report provides management with information about the condition of risks and internal controls at one point intime. Future changes in environmental factors and actions by personnel may significantly and adversely impact these risks and controls in waysthat this report did not and cannot anticipate.

Appendix B – Student Financial Aid Process Map


Documents

Student Financial Services Audit - University of Texas System · 17:04 Student Financial Services Audit Page 7 of 23 Audit Team: Sunna Farooq, Internal Auditor Lori Muncy, Senior