Building the Foundation of Compliance Creating a Financial Aid Risk Assessment and Quality Control Plan

Agenda COSO model of Internal Controls Identifying areas of importance within the financial aid office Determining risk factors Assessing the risks of the areas and documenting in a risk assessment. Different types of quality control reviews and the time each type takes and information each produces. How to take the risk assessment and make a quality control review plan.

COSO Framework In 1992, the Committee of Sponsoring Organizations of the Treadway Commission (COSO) developed a model for evaluating internal controls. This model has been adopted as the generally accepted framework for internal control and is widely recognized as the definitive standard against which organizations measure the effectiveness of their systems of internal control. 

COSO Framework The COSO model defines internal control as “a process, effected by an entity’s board of directors, management and other personnel, designed to provide reasonable assurance of the achievement of objectives in the following categories: Effectiveness and efficiency of operations Reliability of financial reporting Compliance with applicable laws and regulations”  In an “effective” internal control system, the following five components work to support the achievement of an entity’s mission, strategies and related business objectives.

COSO Framework Control Environment Risk Assessment Control Activities Information and Communication Monitoring Activities

Control Environment Integrity and Ethical Values Commitment to Competence Board of Directors and Audit Committee Management’s Philosophy and Operating Style Organizational Structure Assignment of Authority and Responsibility Human Resource Policies and Procedures Code of Conduct

Risk Assessment Company-wide Objectives Process-level Objectives Risk Identification and Analysis Managing Change

Control Activities Security (Application and Network) Application Change Management Reconciliation Verifying Information Business Continuity/Backups

Information and Communication Policies and Procedures Quality of Information Effectiveness of Communication

Monitoring Activities Ongoing Monitoring Separate Evaluations Reporting Deficiencies

What is a Risk Assessment? A systematic process of evaluating the potential risks that may be involved in a projected activity or undertaking. An identified list of programs or processes that have been evaluated to determine where risks exist

Financial Aid Risk Assessment Identify programs Federal Funds (Pell, Federal Work Study, Sub Loans, etc..) State Funds (TEXAS Grant, TEOG, CAL loan, etc.) Institutional Funds (Foundation Scholarships, TPEG, etc.) Outside Funds (Alternative Loans, Outside Scholarships, etc.) Non funding programs (Financial Literacy, Identify processes Automated Processes (Disbursement, SAP, etc.) Professional Judgment Processes (SAP appeals, Dependency Overrides, etc.) User Access Manual Processes (R2T4, Verification, etc.)

Types of Risk Inherent Risk Process Risk Change in Process If everything happens correctly what are the chances that it is still wrong? Process Risk How likely is the process to work correctly? Change in Process Was the process recently changed? Was the way you handle a specific program altered recently? Regulatory Interest What does the overseeing body (ED, THECB, etc.) view as areas of high concern? Audit Concern or Prior Year findings Where are Auditors going to look and how deeply will they look

Ranking Methodology For each program and process determine: How it ranks for each type of risk High, Moderate, Low and then Assign numeric values to the ratings Any variation of this works Place weighted values on the types of risk Determine the overall risk level for each item Every School will have differences in the rankings they come up with

Quality Control Review - File Take between one day and 2 weeks Limited in scope and outcomes are specific in nature Correcting a common error, finding notes are not detailed enough Pull a sample of students that participate in the program or who have the process touch their account/file. 30 is a good starting number for statistical purposes Look at the specifics for the individual program or process for the students chosen. Document what you have seen in a testing sheet Make recommendations on the results

Quality Control Review - Process Take between 2 weeks and 3 months Broad in scope and outcomes are both specific and general Process runs before a piece of information is complete in a students file, providing additional opportunities does not result in student improvement, Pull data that covers all areas of a process or program Do data analysis on the whole data pull Look for unexpected amounts, time delays, surprising student outcomes Preform File review (see previous slide) Make recommendations on the results

Creating a Quality Control Plan Determine the number of staff and how much of their time will be used completing the reviews Take the list of identified risks - determine which risks you want to focus on Determine if you want to do file reviews or process reviews for those identified risks Create a calendar/plan that allows you to track completion.

Questions