HEERF Audit Guide for Proprietary Institutions: Key Takeaways

This article was published in the May 2021 issue of Career Education Review and reproduced here with permission. Article originally posted at careereducationreview.net.

As we frequently say in our office, “Don’t ask questions that you don’t want the answer to” — and the issuance of the Guide for Compliance Attestation Engagements of Proprietary Schools Expending Higher Education Emergency Relief Fund (Guide) by the Office of Inspector General might fall into that category. We had been hearing numerous questions as to the HEERF Audit Guides timing, and, well, now it has been released during the middle of peak audit season for proprietary institutions.

Overall, we anticipated many of the requirements in the Guide, and they are consistent with the Compliance Supplement Addendum issued in December 2020, which is applicable to nonprofit institutions. However, management must be aware of several key requirements related to an institution’s documentation.

We believe institutions will need to review their documentation of policies and procedures regarding the use of the CARES Act institutional Higher Education Emergency Relief Fund (HEERF) grants prior to the audit starting. This is a critical item, and we encourage institutions to thoroughly review the Code of Federal Regulations (CFR) citations referenced in this article and engage regulatory counsel to assist in ensuring that proper documentation of policies and procedures exist. As a reminder, your auditors can’t draft this information for you, as this would be in violation of their independence.

This article will summarize the important aspects of the Guide and is not meant to be all-inclusive. Institutions are responsible for understanding the audit requirements, so this summary shouldn’t preclude your reading of the entire Guide. This article is broken down into three main sections:

1. Audit Thresholds and Timing
2. Audit Testing and Implications of CFR Provisions
3. Audit Reports and Corrective Action Plans (CAPs)

Audit Thresholds and Timing

As a reminder, the HEERF grants were distributed to institutions at the Office of Postsecondary Education ID (OPE ID) number level and were distributed to the main OPE ID number. These funds were eligible to be used for the additional locations under this main OPE ID number. The audit threshold is for each main OPE ID number and, for those institutions with multiple main OPE ID numbers, these main OPE ID numbers are not aggregated for audit purposes. Any OPE ID number is subject to an audit if the institution spent more than $500,000 for HEERF grants in the institution’s fiscal year or if the institution was on Heightened Cash Monitoring (HCM) 1 or 2 status during any part of the fiscal year. Being on HCM 1 or 2 requires an audit regardless of the dollar amount received. For future audits, the $500,000 threshold will also include HEERF II and HEERF III grants received, respectively, under the Coronavirus Response and Relief Supplemental Appropriations Act passed on December 27, 2020, and the American Rescue Plan passed on March 11, 2021.

The Audit is due in the later of 120 days from the Guide’s issuance date (March 31, 2021), or the institution’s Title IV audit submission deadline, including any extensions granted by the Department of Education (ED) for those audits. Therefore, for any OPE ID number related to an April 30, 2020, through December 31, 2020, fiscal year end institution that meet the audit requirement, the deadline is July 29, 2021. The HEERF audit will be submitted to the ED via eZ-Audit and instructions are included in the Guide as to this process, especially for the first-year audit if the audit is submitted after the annual audit submission deadline.

Institutions whose OPE ID number do not meet the audit threshold are reminded in the Guide that not having a nonfederal audit requirement doesn’t relieve an institution from any potential review or audit by ED officials. The documentation and compliance with the CFR provisions and ED’s guidance is required regardless of audit requirements. The auditing for compliance and education can be difficult, even as we share all the insights, be sure to work with an expert. 

While auditors are working to understand this Guide and the necessary procedures to be performed, institutions should be ensuring their supporting documentation, policies and procedures, and reports are thoroughly complete and accurate in advance of the audit. The initial audit deadline is basically one month after June 30 for institutions with fiscal years prior to December 31, 2020. By the time auditors have vetted the Guide, this will leave about three months to complete these HEERF audits. This isn’t a lot of time, due to this being the first year for these audits, and any audits which are not clean will most likely result in additional fees for institutions and possibly risk being filed late. Failure to meet the due date may result in administrative proceedings, leading to sanctions against the institution.

Audit Testing and Implications of CFR Provisions

The Guide requires auditors to perform a compliance attestation engagement subject to Generally Accepted Government Audit Standards (GAGAS) and, as applicable, the American Institute of Certified Professional Accountants (AICPA) Statements on Standards for Attestation Engagements (collectively referred to as the “Standards”). The Standards require certain procedures to be performed with key items as follows.

Auditors must consider internal controls over HEERF grants to help assess the risk an institution may not be in compliance with various statues and regulations. Therefore, auditors will need to gain an understanding of these controls via discussions with appropriate personnel and review of the applicable processes.

Materiality must be defined for each of the six compliance requirements for HEERF audit guide (listed below) and this definition is left to the auditor. The Guide does not define materiality, but it should be based upon qualitative and, when applicable, quantitative factors. For example, one incorrect student grant disbursement out of a population of 500 is likely not material noncompliance, but the lack of any policies and procedures to document compliance with the CFR requirements for institutional expenditures could be material noncompliance. If material noncompliance is deemed to have occurred, expanded testing may need to be performed.

An auditor will utilize sampling in testing the underlying expenditures and reports. The Guide does not define any minimum sample sizes similar to the Title IV compliance audit and therefore auditors will be relying on professional judgement subject to the Standards. We can envision sampling the student grant disbursements since the characteristics are similar for the entire population. For institutional expenditures, we may scope large items based upon our determined materiality dollar amount and then sample expenditures under this threshold depending on the size and amount of the remaining population.

6 compliance requirements in HEERF audit guide

The Guide defines the six specific compliance requirements to be tested and these areas align with the Compliance Supplement Addendum. A summary of the six compliance requirements and the audit objectives are as follows.

• Activities Allowed or Unallowed – Verifying that the HEERF grant funds were expended only for allowable activities as described in the legislation.
• Allowable Costs and Cost Principles – Verifying that the charges to the HEERF grant were allowable per the cost principles in 2 CFR Part 200. ED provided guidance on the uses of the HEERF grant expenditures, only some of which address the 2 CFR Part 200 cost principles.
• Earmarking – Verifying that at least 50% of HEERF grant funds were used to provide emergency financial aid grants to students.
• Period of Performance – Verifying that only allowable costs incurred during the grant period of performance (unless otherwise noted by the HEERF Program) were charged to the grant, and obligations were liquidated within the required time period.
• Procurement and Suspension and Debarment – Verifying procurements were in compliance with the procurement regulations in 2 CFR Part 200 and ensuring that contractors and subrecipients were not suspended, debarred, or otherwise excluded from receiving federal funds. Because the regulations require schools to have documented procurement policies and procedures and contract files reviewed and audited, the compliance requirements may pose the most risk to proprietary institutions because of the potential for a lack of documentation.
• Reporting – Verifying the timeliness, accuracy and completeness of the quarterly and annual reports are in accordance with the governing requirements.

Let’s review each of these requirements in more detail along with our consideration of any risks to institutions.

Activities Allowed or Unallowed

Activities Allowed or Unallowed should be relatively easy to meet. It is basically requiring that charges to the grants were consistent with the statutory provisions. Unless the grants were spent on ineligible students or expenditures not related to significant changes to the delivery instruction due to coronavirus (or to defray expenses associated with the coronavirus after CRRSAA was passed), a finding under this requirement would be unlikely to occur.

Allowable Costs and Cost Principles

Allowable Costs and Cost Principles is a requirement that ensures the costs claimed under the grants are necessary, uniformly applied, consistently treated, determined in accordance with generally accepted accounting principles, not claimed twice, and have adequate documentation. Specifically, these federal regulations are noted in the Guide: 2 CFR 200.403, 200.407, 200.420 to 200.476, 34 CFR 75.533 and 34 CFR 77.1. From our review, for many of the costs that institutions have likely charged to their HEERF grants, if an institution followed the ED published guidance, the costs should be allowable. In ED’s October 14, 2020 webinar, it was specifically noted that ED was trying to give as broad as guidance as possible for the use of the funds. For example, 34 CFR 77.1 has a definition for Minor Remodeling which would support reasonable changes a school made to retrofit a lab, install partitions and safety glass, add temporary walls, expand waiting areas, etc. to ensure social distancing. Based on 2 CFR 200.407, this expenditure would require prior approval from ED. However, ED waived this prior approval requirement, as noted in Question #16 of the HEERF II (a)(4) Frequently Asked Questions for some specific items. There are, however, a number of types of costs that HEERF guidance may not have addressed that may be addressed in the various regulations; whether such costs are allowable will be determined by the regulations. Overall, if institutions were prudent and conservative in their use of the institutional grant funds (remember Green-Yellow-Red from our webinars), this compliance requirements shouldn’t lead to many findings.

Earmarking

Earmarking is very simple and straight-forward in that the only step is to ensure that at least 50% of the HEERF I grants were used for emergency grants to students. It’s simple math. One risk is if you expended 50% of the HEERF I grant on institutional uses and you subsequently voided uncashed HEERF I student grant disbursements which weren’t reissued. If this occurred, the institution could potentially have not met the 50% requirement for emergency grants to students. We anticipate all institutions to meet this requirement.

Period of Performance

Period of Performance is also a fairly straight-forward area in which the auditor is verifying the costs charged to the grant were incurred within the requisite time frame. In this case, assuming no extension was obtained, it would be the one-year anniversary from the date of the Grant Award Notification, or “GANniversary,” as we have termed it. After the end of the year-long period of performance, institutions have an additional 90 calendar days to liquidate their obligations made during the period as part of the grant closeout procedures. The Guide also does reference 2 CFR 200.458 and 34 CFR 75.263, which relate to pre-award costs. ED’s guidance specifically indicated that the expenditures had to be related to costs incurred on or after March 13, 2020. Upon the passage of HEERF II, which allowed for expanded uses of remaining HEERF I grants, ED waived the pre-award requirements so these funds could be used for costs incurred prior to December 27, 2020 (but not before March 13, 2020). This was the Notice of Interpretation released by ED on March 19, 2021. Again, we envision findings likely to be low in this area, based upon our discussions and conversations with institutions.

Procurement, Suspension and Debarment

Procurement, Suspension and Debarment requires institutions to have followed certain procedures for contracts, subcontracts and subawards under federal grants. The majority of proprietary institutions were probably unaware of these requirements due to limited experience related to federal grants. This area has some substantial risk of findings, and institutions must review this area in-depth prior to beginning their HEERF audit(s), which should be obtained in compliance with the same procurement requirements if the institution plans to charge the cost of the audit to the grant. As follows, a series of federal regulations are cited, and we broke them into three sections.

The procurement standards at 2 CFR 200.318 to 200.326 are really the heart of the necessary policies and procedures institutions must document related to the institutional expenditures. The fact that a cost was otherwise allowable may be moot if the proper procurement regulations weren’t followed and/or required documentation does not exist. While the extent of the procedures may vary depending on the size of the institution, no institution is exempt from these requirements.

• 318 – Requires that documented procurement procedures exist and are followed. This includes oversight of contractors’ performance, maintaining written standards of conduct for employees involved in contracting, awarding contracts only to responsible contractors, and maintaining records to document history of procurements.
• 319 & 200.320 – Require the use of competitive bids in most situations and set the ceiling for purchasing thresholds that can be used for certain procurement methods.
  • Micro-purchases – An informal procurement method where competitive bids are not required if the institution considers the price to be reasonable; this method may be used only if the acquisition of supplies or services in the aggregate does not exceed the entity’s micro-purchase threshold, which can be no higher than $10,000.
  • Small Purchases – An informal procurement method where acquisition of property or services exceeds the entity’s micro-purchase threshold but does not exceed the entity’s simplified acquisition threshold, which can be no higher than $250,000. This methodology requires an adequate number of quotations from qualified sources for prices or rates.
  • Acquisitions exceeding the entity’s simplified acquisition threshold must have formal procurements seeking competitive bids or proposals. The method seeking sealed bids is to be used for construction and/or if other conditions are met; the method seeking proposals must be used when sealed bids are not appropriate.
  • A noncompetitive procurement is allowed when certain circumstances are met — one of which is there being only a single source vendor. This could be applicable for specialized classroom and education equipment (e.g. simulators). Another is the “public exigency or emergency for the requirement will not permit a delay results from publicizing a competitive solicitation.” The Guide also specifically notes this later item as an exception and that institutions must specifically document rationales and determinations to do so. The Guide indicates that exceptions are more likely to be acceptable the closer the procurement occurred to March 13, 2020. Similarly, ED indicated on the October 14 ,2020 webinar how they encouraged institutions to spend the funds due to the national emergency and single sourcing is allowed for certain events. However, ED reminded schools to be more cognizant of the regulations the farther we get from March 13,
• 200.324 – Requires that the institution conduct a cost or price analysis for each acquisition above the simplified acquisition threshold that it charges to the grant. This requires that the institution has made an independent estimate before it received bids or proposals. This also requires that institutions follow certain obligations when awarding cost-based contracts or when negotiating profit.

This section also covers suspension and debarment. Institutions are prohibited from awarding contracts or making subawards that are covered transactions to parties that are suspended, debarred, or otherwise excluded from receiving federal funds. Covered transactions include contracts for goods and services awarded under a non-procurement transaction (e.g. grant or cooperative agreement) that are expected to equal or exceed $25,000. In addition, the HEERF guide notes that institutions that have contracts with the federal government must comply with FAR 52.209-6 if they will award a subcontract that will exceed $30,000 and the subcontract is not for a commercially available off-the-shelf item.

Reporting

Reporting is final compliance requirement and relates to the testing of the quarterly reports posted to the institution’s website and the annual report submitted to ED by February 8, 2021. Think of these items as testing of the FISAP in the annual Title IV compliance audit. Auditors are required to test the annual report and a sample of the quarterly reports. The quarterly reports include student and institution grants and auditors must pick at least one of each. For June 30, 2020 year end institutions, no institutional quarterly reports will exist to test in this first audit cycle and possibly only one student report was published. We believe findings could occur in this area if the reports are not accurate and don’t reconcile to the underlying data. We expect auditors will obtain the quarterly reports from the institution’s website as proof of the postings.

Audit Reports and CAPs

As expected, many of the requirements in this section are similar to the annual Title IV compliance audit. Auditors will be rendering an accountant’s report, which will opine as to the institution’s compliance or noncompliance with the HEERF grant requirements. All instances of noncompliance must be reported. An audit finding should reference a statute, regulation, or term / condition and the audit finding should have a criterial, condition, cause, effect and recommendation along with the views of the school’s responsible officials. The audit finding format will closely mirror the Title IV compliance audit findings. The audit finding should report the number of units in error and the applicable dollar amount. In addition, the number of units and dollar amount of the population and sample size must be disclosed. The Guide is using the term “units” generically to describe expenditures. Thus a “unit” could be an emergency financial grant disbursement for a student expenditure or an invoice for an institutional expenditure.

For any audit findings, a school must prepare a CAP. The CAP must be signed by a responsible official which the Guide defines as the person who prepares the CAP. The CAP must include contact information as to the applicable title, telephone number, and email address of the responsible official. The CAP should indicate whether the responsible official concurs or doesn’t concur with the finding along with actions or plans to correct the finding. For planned actions, an anticipated completion date must be included. We envision that the responsible official would most likely be someone in the financial aid or  business office, or potentially a senior executive.

One item which is not clear is whether an audit would need to be filed in year two if the expenditures are below $500,000 but a finding existed in year one. This question isn’t imperative at the moment and can be reviewed at a later time.

As you have gathered, the requirements of this Guide pose risks to institutions as to the likelihood of there being findings. Prior to the beginning of the audit, each institution must review this Guide and assess where a potential risk exists. Institutions should take action now to ensure expenditures are allowable, procurement policies and procedures are documented that meet the CFR standards, and that the posted and submitted reports are correct.

As always, the advisors at McClintock & Associates and Thompson Coburn are available for questions and advice.

This article was co-authored by Ted Blendermann, CPA, CFP, Jayna Rust, and Scott Goldschmidt.

More on HEERF from McClintock & Associates