1. Building the Foundation of Compliance
Creating a Financial Aid Risk Assessment and Quality Control Plan

2. Agenda COSO model of Internal Controls
Identifying areas of importance within the financial aid office
Determining risk factors
Assessing the risks of the areas and documenting in a risk assessment.
Different types of quality control reviews and the time each type takes and information each produces.
How to take the risk assessment and make a quality control review plan.

3. COSO Framework
In 1992, the Committee of Sponsoring Organizations of the Treadway Commission (COSO) developed a model for evaluating internal controls. This model has been adopted as the generally accepted framework for internal control and is widely recognized as the definitive standard against which organizations measure the effectiveness of their systems of internal control. 

4. COSO Framework
The COSO model defines internal control as “a process, effected by an entity’s board of directors, management and other personnel, designed to provide reasonable assurance of the achievement of objectives in the following categories:
Effectiveness and efficiency of operations
Reliability of financial reporting
Compliance with applicable laws and regulations” 
In an “effective” internal control system, the following five components work to support the achievement of an entity’s mission, strategies and related business objectives.

5. COSO Framework Control Environment Risk Assessment Control Activities
Information and Communication
Monitoring Activities

6. Control Environment Integrity and Ethical Values
Commitment to Competence
Board of Directors and Audit Committee
Management’s Philosophy and Operating Style
Organizational Structure
Assignment of Authority and Responsibility
Human Resource Policies and Procedures
Code of Conduct

7. Risk Assessment Company-wide Objectives Process-level Objectives
Risk Identification and Analysis
Managing Change

8. Control Activities Security (Application and Network)
Application Change Management
Reconciliation
Verifying Information
Business Continuity/Backups

9. Information and Communication
Policies and Procedures
Quality of Information
Effectiveness of Communication

10. Monitoring Activities
Ongoing Monitoring
Separate Evaluations
Reporting Deficiencies

11. What is a Risk Assessment?
A systematic process of evaluating the potential risks that may be involved in a projected activity or undertaking.
An identified list of programs or processes that have been evaluated to determine where risks exist

12. Financial Aid Risk Assessment
Identify programs
Federal Funds (Pell, Federal Work Study, Sub Loans, etc..)
State Funds (TEXAS Grant, TEOG, CAL loan, etc.)
Institutional Funds (Foundation Scholarships, TPEG, etc.)
Outside Funds (Alternative Loans, Outside Scholarships, etc.)
Non funding programs (Financial Literacy,
Identify processes
Automated Processes (Disbursement, SAP, etc.)
Professional Judgment Processes (SAP appeals, Dependency Overrides, etc.)
User Access
Manual Processes (R2T4, Verification, etc.)

13. Types of Risk Inherent Risk Process Risk Change in Process
If everything happens correctly what are the chances that it is still wrong?
Process Risk
How likely is the process to work correctly?
Change in Process
Was the process recently changed? Was the way you handle a specific program altered recently?
Regulatory Interest
What does the overseeing body (ED, THECB, etc.) view as areas of high concern?
Audit Concern or Prior Year findings
Where are Auditors going to look and how deeply will they look

14. Ranking Methodology For each program and process determine:
How it ranks for each type of risk
High, Moderate, Low and then Assign numeric values to the ratings
Any variation of this works
Place weighted values on the types of risk
Determine the overall risk level for each item
Every School will have differences in the rankings they come up with

15. Quality Control Review - File
Take between one day and 2 weeks
Limited in scope and outcomes are specific in nature
Correcting a common error, finding notes are not detailed enough
Pull a sample of students that participate in the program or who have the process touch their account/file.
30 is a good starting number for statistical purposes
Look at the specifics for the individual program or process for the students chosen.
Document what you have seen in a testing sheet
Make recommendations on the results

16. Quality Control Review - Process
Take between 2 weeks and 3 months
Broad in scope and outcomes are both specific and general
Process runs before a piece of information is complete in a students file, providing additional opportunities does not result in student improvement,
Pull data that covers all areas of a process or program
Do data analysis on the whole data pull
Look for unexpected amounts, time delays, surprising student outcomes
Preform File review (see previous slide)
Make recommendations on the results

17. Creating a Quality Control Plan
Determine the number of staff and how much of their time will be used completing the reviews
Take the list of identified risks - determine which risks you want to focus on
Determine if you want to do file reviews or process reviews for those identified risks
Create a calendar/plan that allows you to track completion.

18. Questions