Sam Houston State University (SHSU) is in compliance with program responsibilities under Title IV of the most recent Higher Education Act and audits financial aid programs as required by federal and state regulations.
SHSU’s Office of Financial Aid and Scholarships submits federally mandated Fiscal Operations Report and Application to Participate (FISAP) reports annually to the U.S. Department of Education (ED) detailing Title IV expenditures. Recent years FISAP reports are provided [1] [2] [3] [4] [5] [6] [7]. FISAPs are used by the ED when determining initial annual program funding for the institution. For each award year, the University receives e-Campus-Based Statement of Accounts (SOA) funding authorization from ED [8] [9] [10] [11] [12] [13] [14]. In accordance with these statements, authorized federal funds for these programs are withdrawn from the University’s grantee account. The University’s Contracts and Grants Department prepares the draw-down request in the G5 system [15], and funds are then received electronically.
The SHSU Office of Financial Aid and Scholarships regularly audits its financial aid programs as required by federal and state regulations. The State Auditor’s Office (SAO) is responsible for conducting annual financial aid and federal audits of state agencies and higher education institutions. The most recent Federal Portion of the Statewide Single Audit for SHSU was performed for the year ending August 31, 2023 [16], in accordance with the Office of Management and Budget’s (OMB) Circular A-133 as required by federal law. Findings of this audit were as follows [17]:
Sam Houston State University (University) did not appropriately restrict access to its student information system. Specifically, the University did not always limit access to the student information system to only users who needed that access based on their job responsibilities. While the University had a process in place to review user access, that process was not adequately designed to ensure that the University granted the appropriate levels of access to all users based on the users’ job duties. Allowing users inappropriate or excessive access to systems increases the risk of unauthorized changes being made in those systems.
In addition, the University did not have sufficient controls over its change management process for information systems. Specifically, 1 (14 percent) of 7 changes tested lacked documentation showing that the change was properly tested or validated before it was migrated to production. Not having sufficient controls over the change management process increases the risk of unauthorized programming changes being made to critical information systems that the University uses to administer student financial assistance.
The recommendation of the auditors was to ensure the user access to its student information system is appropriately limited based on a user’s job responsibilities and to strengthen its controls over its change management process to ensure adequate validation of changes prior to implementation.
In response, SHSU limited user access to specific job functions and has verified user access was appropriately updated/removed. To address how security patches are introduced into the production environment, the University has converted those normal changes to standard changes, which are pre-authorized and address how IT is testing and/or validating whether the patches were successful [18] [19] [20].
For the finding related to Federal Direct Student Loans, the report stated the following [17]:
Based on a review of the full population of student financial assistance recipients, Sam Houston State University (University) over awarded a total of $239,932 in Unsubsidized Direct Loans to 133 students. Due to an incorrect proration methodology, the University awarded first- and second-year students in the Doctor of Osteopathic Medicine program in excess of their Unsubsidized Direct Loan annual limit. Specifically, the University prorated the sum of the annual and increased additional annual limits, instead of prorating only the increased additional annual limit. After auditors brought the errors to the University’s attention, it returned the excess Unsubsidized Direct Loan funds; therefore, there were no questioned costs.
The recommendation from the SAO was to use appropriate methodology when prorating Unsubsidized Direct Loans for eligible health professions students. In response, SHSU immediately corrected the error and provided evidence for each adjustment [18] [21] [22].
For the finding related to Special Tests and Provisions – Return of Title IV Funds, the report stated the following [17]:
For 1 (4 percent) of 24 students tested, Sam Houston State University (University) did not have evidence of academic engagement in the distance education course from which the student’s withdrawal date was determined. The University relies on the last dates of academic activity provided by instructors to determine the withdrawal date for Return of Title IV purposes for students who unofficially withdraw. The student’s record did not reflect evidence of academic activity for the distance education course, and the University asserted that the last day of attendance provided by the instructor was inaccurate. The University did not have a process in place to require instructors to provide or maintain evidence of academic engagement in distance education courses. As a result, the University did not perform a return calculation because it incorrectly determined that the student completed over 60 percent of the period. After auditors brought the issue to the University’s attention, the University performed a return calculation and returned Title IV funds as required; therefore, there were no questioned costs.
Having a process that does not consistently calculate and return the correct amount of Title IV funds increases the risk that the University could return less Title IV funds than it is required to return.
The recommendation from the SAO was to ensure that evidence of academic engagement is consistently documented for students in distance education courses and strengthen controls to ensure that there are accurate calculations for returns of Title IV funds when required. SHSU has worked to implement checks when performing return of Title IV funds (R2T4) calculations for a student enrolled in a distance education course to verify (1) that the student established attendance and (2) the last day of attendance [18] [23].
In May 2024, a follow-up audit notice was received in relation to the FY23 findings [24]. Follow-up responses were provided to the SAO [25], and the SAO tested effectiveness of the Eligibility and Return to Title IV Funds. At the time of the follow-up response and testing, the security controls and change management revisions were pending implementation (targeted for January 2025) [26]. As such, the State Auditor’s Office continued findings for General Security Controls. One osteopathic medical student was found to be over their annual loan limit. Eligibility is now compliant after creating a pre and post disbursement check for osteopathic medical students to ensure they are not awarded beyond their annual loan limit. The testing for Return of Title IV Funds identified two students who had incorrect last day of attendance reported between internet activity and the student information system, Banner. Additional procedures were put in place August 2024, however the follow up audit was for the completed 2023-2024 year. These discrepancies were corrected by the school and will be tested by the SAO for the 2024-2025 year. Management Responses were provided to the SAO acknowledging these areas and the preventative measures put in place [27]. The State Auditor's Office will publish the official report in late February 2025.