Preparing for the Compliance Audit

The number one rule when preparing for an audit is to not wait until the last minute to start. Institutions should lay the groundwork for the audit throughout the year by reviewing the list provided by the auditors which outlines all the things that should be prepared. By keeping the list and revisiting it monthly, schools can gather the information over time instead of scrambling for it at the end of the year.

Here are a few tips for higher education institutions to better prepare for the compliance audit.

Keep an Audit File Organized

Schools should consider creating an audit file with a checklist, either paper or electronic, to store information for impending audits. For example, if an institution’s program participation agreement expired during the year and was subsequently renewed, schools should put a copy of the documentation into the audit file. The same should be done with other paperwork during the year, such as campus security disclosures, cohort default letters, annual FISAP forms, academic calendars, the cost of attendance budgets, etc.

Items in the audit file should be kept in the same order every year. This will help validate the completion of the folder and make the process easier for auditors.

Institutions should also make a habit of cleaning up files and documenting items right away. For example, if there are changes in a student’s file, that change should be documented right away when the information is fresh rather than later when details may be challenging to recall.

Look at Internal Control Documentation

Schools should gather al policy and procedure documentation used and put them into a central location. Each month, one area should be updated. By consistently updating one area per month, institutions can avoid doing them all just before the auditors come on-site.

Furthermore, anytime schools have employee turnover or hire new employees, they should update internal controls. Often, responsibilities shift with staff changes, which presents a great time to see if the controls are still applicable. Roles and permissions for all position changes should be updated in software as well.

Prepare for the Auditor's Visit

Three months before an audit, institutions should request a digital version of the list of requirements for the audit from the auditor for storage in a central digital folder. This way, schools can assign staff for each item and everyone can see the details needed. This also presents an opportunity to include folks from other departments, like the Bursar Office or the Registrar’s Office, to handle a few requirements.

The list of requirements should be broken down into manageable pieces with deadlines assigned throughout the next several months. For instance, institutions should create a timeline with items eight weeks before the visit, six weeks before the visit, etc.

Institutions can hold ongoing meetings during the preparation time to make sure everyone is being held accountable for their assigned items. This way, there will be no surprises or missing information when the auditors arrive.

Being organized before the auditors arrive makes it easier for the auditors to do their job, which simplifies the whole process and takes less time.

When the Auditors Arrive

When the time the auditors are on site, the schedule should include the time each day when auditors provide their questions as well as the time when answers will be provided. That way, there are minimal interruptions with one-off queries, making the process less disruptive and more productive for everyone.

The Auditors Found Something, Now What?

Just because the auditors found an error, it doesn’t have to be an automatic finding. Institutions should do their due diligence by obtaining details from the auditors and do their own research. Maybe the auditor is missing a piece of supporting information that should have been in the file, which would relieve the finding. Often, once the auditor identifies a potential issue and they discuss it with the school, it becomes a non-issue because there was missing information or miscommunication.

Likewise, the error may be an exception the auditor isn’t aware of. If an institution disagrees with an issue raised by the auditor, it should be discussed and supported by references to regulations or the FSA Handbook.

Schools shouldn’t wait until the auditors are ready to issue to dispute something. It should be brought up right away, supported by information or research, and be left as an open item for schools to get back to the auditor.

How to Reduce Findings

The best way to reduce findings is through preparation, such as taking self-audits. Institutions should consider going to the FSA assessment page on the IFAP website, which provides great checklists for self-audits regarding all the policies and procedures that the Department of Education (DOE) requires. There are several checklists around different areas, including student eligibility, consumer information, direct loans, etc.

Schools may want to visit the website every month, select a checklist, and go thought it. This is a great way to identify any weaknesses and determine if any findings are expected during an audit.

How to Prepare for a Program Review

Institutions shouldn’t panic when they receive a notice from the DOE. The best thing to do is to reschedule the program review for a later date, which provides more time for preparation. Schools should use this time to review policies and procedures to identify any weaknesses and update them.

Next, institutions should let their auditors know about the program review. Auditing firms have many customers which may be going through a program review. They can ask those customers what the DOE is focusing on, and any areas of focus.

Also, schools should notify other vendors that have a direct impact on financial aid processing, including their software vendor, which may have a support person available during the audit to help address any questions. The right financial aid software will help institutions maintain the tracking and reporting to ease the audit.