Implementing a risk-based Title IV audit program Presented by: Jarod Paulson, Compliance Manager Erin Hage, Audit and Compliance Specialist

2

Agenda Compliance framework Identifying and assessing risk Measuring compliance results Using audit results to continuously improve Capella’s risk based TIV audit program Questions 3

Compliance framework Maintaining TIV compliance is essential – Non-compliance threatens your institution’s ability to participate in TIV, can result in fines, and damage to brand. The external regulatory environment is fluid – Negotiated rulemaking, Reauthorization An audit program should Identify compliance gaps, Measure effectiveness, and provide visibility to needed improvements – Changing behavior vs. providing information 4

Identifying and assessing risk Risk Based Approach – Risk Assessment Top 10 audit and program review findings Prior Audit Findings or Program review findings NASFAA or ED assessment tools FSA handbook, Bluebook & CFR – Risk Rating Determine which rules are most impactful for your institution and design controls in response to residual risk. – Sampling Methodology Sample sizes should be risk based and used to identify; not control risk. e.g. 20, 40, 60 risk based, SOX methodology 5

Measuring compliance results Individual quality monitoring Process monitoring Mock audits Monitoring schedule for non-operational requirements 6

7

Using audit results to continuously improve Coaching – Individual performance and accountability Training – Job aid resources – Policy and Procedures Reporting – Provide visibility to process owners and key stakeholders Remediation tracking – Lean methodology 8

Using audit results to continuously improve Process Improvement principles – Redesign – Eliminate – Standardize – Integrate – Automate – Off-load – Clarify 9

10

Capella’s risk based TIV audit program Individual Audits – Purpose Quality Assurance TIV Compliance Performance Improvement Visibility to competencies on an individual level 11

What’s next? 1.Identify tasks 2.Risk rate each task 3.Divide tasks into groups 4.Establish a sample size 5.Create testing attributes 6.Create goals 7.Create reporting 8.Create a remediation plan 12

Identify Tasks Determine what is considered a task – e.g. Verification, R2T4 Ensure you have visibility to all potential “tasks” at your school 13

Risk rating The following factors can be used to determine the risk of each task: – Audit Risk – Complexity – Business Environment – Volume – Impact 14

Risk rating 15 Use a scale of 1-3 for each factor – Example: Complexity 3 – Complex ( multiple steps, multiple people involved, multiple dependencies/inputs 2 – Mildly Complex (less than 3 core steps to the process/handoffs) 1 – Simple (low dependency on other processes)

Risk Rating Average the 5 risk ratings for each task to determine the final risk rate. 16 Audit RiskComplexity Business EnvironmentVolumeImpactAverage R2T4 Calculations Awarding TEACH Grant

Divide tasks into test groups Find similarities among the tasks and begin to group similar ones together – e.g. R2T4 and PWD calculations could be combined into one test group Other example test groups may be: – Federal Grants – Application – Award Adjustments 17

Establish Sample Size Choose a relevant sample size – 20,40,60 How many hours can be dedicated to this audit? 18

Create testing attributes Test GroupAttribute 1Attribute 2 Attribute 3Attribute 4 Federal Grants Learner is eligible for the grant awarded Learner was awarded the correct Grant amount Experienced Teacher Letter/Test Score is sufficient (if applicable) If funds were authorized, learner is eligible for the disbursement 19 Identify what makes a task correct For example: Student meets eligibility requirements Correct award amount

Create goals Set an Error Rate or Success Rate goal for individuals and the team Delivering a success rate instead of an error rate to individuals may create a more positive feeling surrounding audit results – e.g. 3% error rate = 97% success rate 20

Create Reporting What do you want to report? – Employee error rates – Team error rates How frequently will you report the results? – Monthly, Quarterly, Annually 21

Create Reporting Methods – Monthly result meetings – Charts/graphs – Summary by test group 22

Create Reporting – Monthly Error Rates Test Group Name Federal Grant Test Group Month Name January Processor Items FailedItems TestedError Rate Employee 1 000% Employee % Employee % Employee 4 050% Employee 5 000% Employee 6 000% Employee 7 000% Employee % Employee % Employee % Team Totals 1452% 23

Create Reporting – Monthly Error Rate Test Group NameFederal Grant Test Group Month NameJanuaryFebruaryMarchYTD Processor Total Failed Total Tested Error Rate Total Failed Total Tested Error Rate Total Failed Total Tested Error Rate Total Failed Total Tested Error Rate Employee 1 000% Employee %0100%0100%0300% Employee %11010%11010%33010% Employee 4 050% % Employee 5 000% Employee 6 000% Employee 7 000% Employee %11010%0100%1303% Employee % %0270% Employee % Team Totals 1452%2385%1452%41283% 24

Create Reporting – Isolating the issue Federal Grant Test GroupR2T4 Test GroupAward Adj Test Group YTD Error Rate Employee 1 0% Employee 2 0% 5% Employee 3 10%0%5% Employee 4 0%5%4% Employee 5 0% 2% Employee 6 0% 4% Employee 7 0% 5% Employee 8 3%0%2% Employee 9 0% 5% Employee 10 0% 5% Team Totals 3% 4% 25

Create reporting – Individual employee 26

Create a remediation plan Identify who is accountable for taking action on the data Communicate results to individual processors Determine if training or coaching sessions need to scheduled Track your remediation plan Report the outcomes 27

Capella’s risk based TIV audit program Monthly self-audit – Process based audits – Test frequency and sample size determined by risk rating – Red, Yellow, Green tracking Rolling results, quarterly trending and root cause. – University wide partnership in remediation – Deficiencies are given high visibility Department and university leadership, cross functional compliance committee, BOD audit committee. Other Audits (based on annual audit plan) 28

Capella remediation structure 29

30

key learnings TIV compliance is an institutional responsibility (partnerships across the university) Risk assessment should be ongoing Devoted resources Zero findings mindset (you will never be perfect) Respectful of people, reward good results, error rate vs. quality score, explain the why. 31

Results Continued and increased investment in the program Stronger partnerships with other departments Strong Compliance results and reputation 32

Questions? 33