BOARD OF TRUSTEES
COMPLIANCE, RISK AND AUDIT COMMITTEE
MAY 9, 2016 8:00 AM PRESIDENT’S CONFERENCE ROOM II ATHLETIC CENTER
AGENDA
1. Review of State Auditor’s report
2. Independent Auditor’s Selection Process ATTACHMENT
3. Risk Assessment Review ATTACHMENT
4. Compliance Report ATTACHMENT
Grant Thornton O’Connor & Drew
CohnReznick CohnReznick (CR) Revised
Audit and A-133 MOSFA Annual Escalation
$118,000 $10,000 4.0%
$70,000+$5,000 $5,500 0.0%
$87,600 $10,000 4.0%
$85,000 $7,000 2.0%
No MA public higher education institutions (financial statements auditing services)
Majority of community colleges; picked up three additional colleges
Three State Universities
FSU staff believe that CR offers in-depth familiarity with FSU’s financials & systems as a result of its longstanding relationship with the predecessor, Ercolini, coupled with the added benefits of a national firm (e.g. IT audit capabilities, independent QA review by a separate office, etc.) due to their recent merger.
National Firm Regional Firm National Firm (CR) that “absorbed” a Regional Firm (Ercolini)
Financial Auditing Services RFP Responses (Nine responses; three firms graded as “A” by system-wide review team)
Risk IT Security
Risk Owner Patrick Laughran, IT Security Council
Risk Desc.
Current Status
Measures Currently in Place
Future Measures to Address Risk
Risk Owner Action Plan
IT SECURITY ‐ 2016 Information Security Risk Management and Compliance Worksheet.xlsx
Documentation Links to any of the following ‐ P&P updated/defined/completed; any internal control updates, etc
Quality Assurance ReviewFor QA purposes, need schedule of when IT consultants coming in, etc; keeping it on radar for senior mgmt and CAR Committee.
For QA purposes, get a quarterly update.
Please see the document at the following link below. The spreadsheet also indicates the timeline in which initiatives have been completed and are scheduled, processed, underway, etc. The completed items may be subject to QA review as applicable and we will monitor the other measures as they are completed.
Failing to be in full compliance with information security related laws, regulations and/or contractual obligations ‐ including failure to fulfill the operational provisions associated with the University's internal comprehensive written information security program ‐ which could mean FSU's IT systems are not adequately protected from malware, hackers, etc. and could result in security breaches in multiple areas, such as sensitive student data and records retention.
The University has undergone 3 separate (but related) independent assessments focusing on different areas pertaining to information security within the past 18 months. One of the assessments was sponsored by "PACE" and conducted by the third party McGladrey as part of a state‐wide "Information Security Posture Assessment" of all public colleges and universities within Massachusetts. There were no "critical" risks identified as part of the McGladrey "Information Security Posture Assessment" . Compass IT Compliance also completed Payment Card Industry / Data Security Standard (PCI/DSS) and Health Insurance Portability and Accountability Act (HIPAA) / Health Information Technology for Economic and Clinical Health (HITECH) Act assessments. The PCI/DSS assessment found that the University is in compliance. The HIPAA/HITECH assessment found that "the University has established a mature system of controls for, and that relevant staff members are committed to, the protection of sensitive information such as PHI and ePHI".
The University has developed remediation plans, with the assistance of an independent third party not involved with the 3 assessments, in response to the findings and recommendations from the PACE McGladrey "Information Security Posture Assessment" as well as the Compass IT Compliance PCI/DSS and HIPAA/HITECH third party assessments. To‐date, the University has implemented 7 additional measures to improve its information security posture consistent withthe plan developed. Another 22 additional measures are either planned for or underway. Additional third party assessments are also planned for or underway. For instance, auditors for the Commonwealth of Massachusetts are conducting an audit of controls on financial systems, technology procurement and inventory at this time. Later this year another PCI/DSS compliance assessment will be conducted as well ‐ which is required annually.
The University’s Information Security Council will review and consider all recommendations and remediation plans as part of fulfilling their charter as documented within the comprehensive written information security program (a.k.a. "WISP"). Meanwhile, a request to hire a full‐time Information Security Officer has been submitted to executive staff for consideration in order to establish someone with sufficient time and expertise in a dedicated role to implement the full provisions of the University's comprehensive WISP while keeping abreast of the continually expanding scope and complexity of compliance obligations as well as the ever evolving variety of internal and external threats.
Risk Banner ‐ Performance
Risk Owner Patrick Laughran, Marsha Bryan
Risk Desc.
Current Status
Measures Currently in Place
Future Measures to Address Risk
Risk Owner Action Plan
BANNER ‐ 2016 Banner and Ancillary System Optimization Worksheet Current.xlsx
DocumentationLinks to any of the following ‐ P&P updated/defined/completed; any internal control updates, etc
Quality Assurance ReviewFor QA purposes, get a quarterly update.
Please see the document at the following link below. This spreadsheet lists out all the issues that have been resolved/unresolved. The spreadsheet also indicates the timeline in which initiatives have been completed and are scheduled, processed, underway, etc. The completed items may be subject to QA review and we will monitor the other measures as they are completed.
Current Banner functionality is not operating effectively, creating inefficiency, manual work‐arounds, and insufficient reporting that limits the ability of staff to perform key activities.
Most of the issues identified and given a "critical" designation during the third party assessment of how the University is making use of administrative and student information systems (a.k.a. "Banner" and ancillary software) have been addressed. The "critical" designation is defined as "a prerequisite to addressing some sort of unresolved issue or implementing some sort of improvement within a specified timeframe". In total, 5 of the critical isses have been addressed along with 4 others with lower priority designation.
Work is currently underway or planned for to address the 3 remaining issues given a "critical" priority designation with a target completion date of June 30, 2016. The same is true of the other 5 unresolved issues given a lower priority designation.
The University continually identifies unmet and anticipated needs associated with the application of technology for managing of administrative and student information. Continued investments in a combination of professional development and hands‐on training, software upgrades and configuration changes, and procurement of new solutions (where necessary) are all part of the ongoing planning and coordination that takes place within the University and with third party product and service providers in order to address the unmet and anticipated needs identified through third party assessments and internal continuous improvement efforts.
Risk Sub‐Optimization of Banner
Risk Owner Patrick Laughran, Marsha Bryan
Risk Desc.
Current Status
Measures Currently in Place
Future Measures to Address Risk
Risk Owner Action Plan
BANNER ‐ 2016 Banner and Ancillary System Optimization Worksheet Current.xlsx
DocumentationLinks to any of the following ‐ P&P updated/defined/completed; any internal control updates, etc
Quality Assurance ReviewFor QA purposes, get a quarterly update.
Please see the document at the following link below. This spreadsheet lists out all the issues that have been resolved/unresolved. The spreadsheet also indicates the timeline in which initiatives have been completed and are scheduled, processed, underway, etc. The completed items may be subject to QA review and we will monitor the other measures as they are completed.
While Banner has been in place for 8 years, FSU may not be using Banner optimally, particularly around analytics/reporting. Many financial/administrative processes and associated controls are still manual, making them more difficult to monitor and test. Moreover, there are still issues managing access to specific modules.
Please refer to the response to "Banner ‐ Performance " (previous tab). Additionally,… There are 330 reports available with 58 being "canned" Banner reports delivered by Ellucian as part of the software solution. There are 45 requests for assistance with some aspect or another of report development or modification in queus; 12 in progress, 3 pending, 19 input requested and 11 approval requested (verification that the report is complete, accurate and fulfills the original requirement). There were 203 requests for assistance with generating or modifying reports fulfilled by Information Technology Services within the past 18 months. There are another 81 automated workflows actively in use as well. Another 3 requests for additional automated workflows have been submitted but not yet fulfilled; 1 pending user testing, 1 pending request details, 1 pending development. There were a total 7 of requests for new automated workflows fulfilled within the past 18 months. Another 33 pre‐existing worfflows were updated.
Please refer to the response to "Banner ‐ Performance " (previous tab). Additionally,… The University has adopted the "Data Cookbook" solution for managing requests for assistance with the development of new or modified reports. The Data Cookbook serves as a central repository of data definitions and a data governance tool which includes documentation of reporting specifications. Having one location to store FSU's agreed upon terminology used to define reports, data elements and specifications improves the visibility of exisiting reports and provides clear, agreed‐upon terms for the creation of new ones.
Please refer to the response to "Banner ‐ Performance " (previous tab). Additionally, … Requests for two "funkie tech" positions (or two dedicated full‐time staff with a blend of both functional expertise and technical skills) has been submitted for consideration among executive staff. Both positions would augment the technical skills resident within the University's Information Technology Services and supplement the functional know‐how within Finance and Enrollment Management (respectively). This would improve the ability to generate reports using the tools already available, increase the ability to institute process improvements within the functional areas, and establish the capacity to adopt and make optimal use of additional software solutions and reporting tools as may be needed over time.
Risk Student Retention
Risk Owner Linda Vaden‐Goad
Risk Desc.
Current Status
Measures Currently in Place
Future Measures to Address Risk
Risk Owner Action Plan 1) Trend Analysis of Student Retention in the past five years2) Hired Coordinator of Retention and Student Success in Winter 20163) Interviews of the first and second year students who left will be conducted by Summer 2016. Results will be shared in Fall 20164) "Two Week Plan" will begin with Deans in Fall 20165) "Leading for Change" initiative underway and continues in FY176) Introduction and implementation of Starfish in Fall 20167) Planning for World of Work program in FY17; implementation of program starts Fall 2017
Documentation N/A
Quality Assurance Review N/A for QA Review
Administrators and faculty overseeing these initiatives will send the Provosot mid‐year and year‐end reports featuring practices and progress on promoting student retention. The Provost will share updates of these initiatives with Exec. Staff. The Coordinator of Retention and Student Success will prepare an annual executive summary of the initiatives. RASC will monitor the impact initiatives are having on student retention.
The focus of enrollment management is traditionally to bring in more students. FSU is currently leveling off with student enrollment, however, there is declining enrollment shown in the external market place. Therefore, if the University does not take steps to manage its high attrition rate (e.g., by doing more to proactively understand why students are leaving so they can target outreach to susceptible students more proactively to prevent them from leaving if possible), then the University’s enrollment may potentially decline with impacts on tuition cost, programs, infrastructure, etc.
First, FSU needs to address retention in new ways or else it would, without question, represent a serious risk to enrollment levels and student success. Second, if we do not consider new ways of conceiving of and managing recruitment and enrollment, we likely would lose enrollment and be out of touch with the changing world in which we live and serve.
New initiatives to address retention: 1) we have hired our new Coordinator of Retention and Graudation Success, Lauren Keville. Already has she begun investigating the "low hanging fruit" and with a committee that has been established, she is beginning to make changes. For example, she is creating a new dataset that will represent a shared baseline for change that can be used by the committee and others. 2) Lauren is setting up interviews with first and second year students who left (were not retained) to find out more. 2) the Academic Deans have established a new system to work with students who are are "extended probation." We are caling it "The Two Week Plan." Students create a "contract" with their dean re what they will do and how they will approach their work and every two weeks they drop by to show the dean how they are doing. 4) We were accepted into the AASCU "Resdesigning the First Year." We are one of forty state univervities and colleges across the nation who will work together, develop and share best practices and data. The first meeting begins 2/4 ‐ 2/6 in Austin in 2016. 5) We are part of the Bridgewater State initiative Leading for Change, where we commit to student success for all (with a special focus on underrepresented groups). Many new initiatives have arisin out of this. We are interested in recruiting more Latino and Hispanic sutdents, more African American students, and international students.
(1) We are in the process of purchasing Starfish, and we are ready with a very positive committee that crosses all divisions in the university. Faculty, staff, administrators, students all will be involved. (2) We also will be bringing on‐board the World of Work program that will help us create the kind of university that brings students steadily forward into their futures, helping them take the right steps in understanding themselves, understanding the employment sector of interest to them, and learning how to "make things happen" in that setting. This is a very comprehensive and collaborative program that involves all (students, faculty, staff, community and top employers), and it culminates in a World of Work Certificate (non‐credit), the awarding of which is ultimately determined by trained industry partners. (3) All of those items listed in the cell immediately to the left are ongoing goals and processes, so they are a part of our future work. (4) We are streamlining the curriculum at a steady rate so that it always is in a state of being more in tune with students needs. (5) We are focusing on inclusive excellence and the strengths that brings to our community and our community's future. We do believe that diversifying our faculty, for example, will make a positive difference for our students' success.
Risk Potential for Declining Enrollments
Risk Owner Lorretta Holloway, Jeremy Spencer, Enrollment Planning Group
Risk Desc.
Current Status
Measures Currently in Place
Future Measures to Address Risk
Risk Owner Action Plan 1) Enrollment Trend Analysis in the past 5 years2) Creation of Enrollment Data Team for target recruitment and target support (this is currently in the works). Team will have expertise in data mapping, geographic informational systems, spatial data analysis, predictive statistics, and variable analysis. With this, the team can help develop the proper metrics to‐
a) Determine possible metrics that predict success, struggle, and failure at FSUb) Develop a report to show historic demographic shifts in MA and also forecast future shiftsc) Develop a predictive model that we can use for undergraduate recruitment and retention efforts
Documentation Trend Analysis
Quality Assurance Review N/A ‐ management review
Losing revenue because we're not significantly prepared for the societal shifts that will change the characteristics of our future student enrollment/market. Further, a reduction in enrollment would impact funding.
There is a projected decline in public high school graduates (forecasts done by the Western Interstate Commission for Higher Education (WICHE). Specific to MA, the projected decline in public high school graduates (2008‐09 actual to 2027‐28 projected) is 14.45%, which equates to 8180 fewer students. Given nuances in the aggregate WICHE data projections, it is important to identify available data resources and understand how to leverage information with enrollment planning. FSU currently lacks a sophisticated customer resource management (CRM) tool that is needed to communicate a diverse student population (e.g., matric, non‐matric, non‐traditional, UG/grad) at various stages of the recruitment process. Given the potential mitigating effects of enrolling non‐traditional students (e.g., adult students), FSU currently doesn't possess the admissions staff infrastructure to fully support growing the graduate and continuing education enrollment. Lastly, FSU doesn't possess the staff infrastructure to fully leverage available technological resources (e.g., Banner) with enrollment processes. We also are just managing with the services we have. With the changing demographic, we will have an increased number of students who have financial, academic, and emotional needs that we will need to meet to not only recruit but to retain. The newer student will cost more than traditional students in the past because of the kind of wrap around services they will need to apply, enroll, and succeed. It is also important to note that FSU has only recently had a small decline (0.8%). FSU has had a significant increase in enrollment in the past few years and it has just leveled off recently.
Internal controls and policies do not exist to mitigate a declining high school graduation rate. That said, we do have the ability to review undergraduate admissions standards, financial aid policies (merit vs. need‐based aid), and recruitment strategies to address the changing demographics; in addition to developing academic programs and enrollment strategies directed at non‐traditional (age 24+) students. Enrollment management leadership is diligently working to mitigate the risk through education and resource planning. The important need for a strategic enrollment data team, CRM, technical functional specialist to support Banner and current/new enrollment technology solutions, and comprehensive undergraduate and graduate recruitment plan that involves Academic Affairs has been shared at the executive staff level. Calibrating recruitment targets to align with declining high school graduates and changing demographics continues to be a topic of conversation.
Other matters that should be addressed in the future‐ recruitment strategies should be re‐assessed annually to be in line with the external market place (i.e. demographics of students, needs of students, etc). Planning for for FY16 Strategic Plan is currently being done and this will be taken into consideration.
Risk Campus Violence
Risk Owner John Santoro, Emergency Planning Committee
Risk Desc.
Current Status
Measures Currently in Place
Future Measures to Address Risk
Risk Owner Action Plan Meet with TAT Group to discuss the following ‐1) Finish written protocol/write‐up of policies & procedures for the group (Summer 2016)2) Identify any formal trainings needed for this group on an annual basis (discuss to plan for AY2016‐2017)
Classroom Management ‐ 1) Need to discuss with CASA re: the following
a) Provide training to new faculty members via CELTSS workshopb) Classroom management information should be made available on Universty's website to faculty
Active Shooter Training ‐ 1) Discuss at Emergency Planning Committee meeting
a) Need to make training mandatory for the entire campus community (faculty, staff, students, and contractors)b) Make online trainings available via FSU website (Run. Hide. Fight & FEMA training)
Documentation When available ‐ TAT Group ‐ written protocol when finished
Quality Assurance Review Review annually, that everyone is going to active shooter trainingReview any written documents (TAT Group, etc)
If FSU is not prepared to respond to campus violence – such as an active shooter or explosives – then the risk to personnel safety and security should be increased. FSU’s reputation could also be damaged if there is a perception that it may not have done enough to protect students and staff.
• It should be mandatory that all faculty, staff and students attend one of our active shooter response trainings yearly (in FY15‐ 154 faculty and staff attended one of the three sessions offered); currently, it is not mandatory for required attendance of staff, faculty and students. • The police department has made tremendous efforts to get the message out to faculty, staff and students.• The police department has made great strides at ensuring that their department members are trained to respond.
• Sworn members of our department have been armed since August of 2012. This will help in the type of response we will provide in such a situation.• Our sworn members of our department go through active shooter training at least once per year. Some years we have had two training sessions.• Our full‐time dispatchers have gone through active shooter training for dispatchers.• We have MOUs in place with FPD and MSP for many scenarios including active shooter response.• Our department has policies and procedures in place for active shooter incidents.• Our department has been offering campus wide active shooter trainings to faculty, staff and students for several years. These training occur several times of the year.• Our department has active shooter training available to faculty, staff and students on our website.• Faculty and staff training on best practice classroom management practices.• Able to identify at‐risk individuals early on.• Managing difficult interactions and situations.
• An increase in staffing levels for our department would help with these types of incidents.• Deployment of foot patrols as a proactive measure, by being highly visible to show the university as being a hard target vs. a lax target environment.• We will continue to train our department personnel on how to respond to these types if incidents.• We will continue to train faculty, staff and students on how to respond in these types of incidents.• The equipping of our officers with specialized firearms will help us in the appropriate response to these types of incidents. • Equipping officers with tactical patrol shields to enhance officer safety when responding to situations involving an active shooter.• The TAT group should undergo enhanced training on evaluating and assessing threats; perceived and real.
Risk Retention & Succession
Risk Owner Erin Nechipurenko
Risk Desc.
Current Status
Measures Currently in Place
Future Measures to Address Risk
Risk Owner Action Plan
HR will provide to the President’s Executive Staff a snapshot of the percentage of faculty and staff who are currently eligible to retire under the SERS requirements (ORP employees are vested immediately and do not receive a state pension). As many factors go into an individual's decision to retire, these percentages will not be indicative of expected turnover due to retirement. It may however give a general long‐term outlook regarding our current workforce. For privacy purposes, this information will only be shared with the President’s Executive Staff. HR recommends accessing this data no more than once every 3‐5 years.
HR will ask to place succession planning on the agenda for discussion at a President’s Cabinet Meeting in FY17. During the discussion the HR Office will recommend that the members of the cabinet identify critical positions in their respective areas, work with their respective units to identify top talent, and to explore ways that talent may develop skills to prepare them to move into leadership roles in the future.
Also, HR recommends each department develop a succession planning strategy which may include the documentation of internal department procedures and protocols, transition documentation created by employees voluntarily leaving positions, regular archiving of work products and email accounts, and cross training within the department. HR will create a template to use for this purpose in administrative departments.
HR will continue offering full‐time employees, who are voluntarily separating from employment at the University, the opportunity to do an exit interview. We will also provide an optional exit questionnaire to outgoing part‐time contract employees. Individual concerns made known to HR through this process will be kept as private as possible and will be shared on a confidential, need‐to‐know basis, with supervisors. If anecdotal trends are identified, these trends will be shared with the appropriate unit Vice President and/or Executive Staff member.
Documentation
2) One‐time snapshot of retirement eligible faculty and staff, prepared in February every three years. Shared with Executive Staff.
3) During FY17, HR will develop a document for administrative departments to use for succession planning.
Quality Assurance Review N/A ‐ Executive Staff review
In many departments, there is high turnover among staff due to pay that is not competitive with other employers. Also, key staff members are leaving FSU without documenting and/or sharing their institutional knowledge, which could lead to inefficiencies if new staff members lack that knowledge and aren’t able to get things done quicker/easier. As a result, institutional knowledge is often lost or difficult to build in the first place, which can hinder performance.
The turnover rates for ALL full‐time employees in calendar year 2015 was 8.81% (Full‐time Staff calculation =11.88%) and 6.07% (Full‐Time Staff calculation =7.25%) for calendar year 2014. The increase from year to year was primarily attributable to the early retirement incentive that was offered. When employees leave the University, managers develop transitions plans, and in some cases, employees are appointed to acting positions, to keep the continuity of operations. Other departments hire temporary employees. And, some ask existing members of the department to assist with specific tasks.
The Office fo Human Resources conducts exit interviews for full‐time staff positions and provides feedback regarding areas of concern, as appropriate, with managers and senior leadership. Currently, we are working on identifying best practices with respect to how to use/display/share this data to assist with retention of high performing staff. With respect to succession planning for senior level positons, we do not have formal plans. However, we have been able to identify internal talent (or recently retired talent) to temporarily fill key positions while searches have been conducted. For example, the positions of President, Vice President for Academic Affairs, and Vice President for Enrollment and Student Development, have all turned over within the past 6 years. (Note: When the auditors were here they mentioned that you typically see succession plans for key/senior leadership roles, not for all positions.) For all professional positions, as part of the annual performance evaluation process, administrators are supposed to develop a plan for professional development. And, with both professional and support staff positions, managers and supervisors are enouraged to discuss career develpment goals and objectives for the future. Also, each year talent is identified/selected by Executive Staff to attend two separate leaderhip programs. And, many professional staff are active with their professional organizations and participate in ongoing professional development.
While anecdotal feedback was utilized to initially identify this risk, a review of data actual data is needed to verify this information. Our plan moving forward is as follows:
1) Each February, HR will prepare a calendar‐year turnover snapshot for all full‐time empoloyees and share it with Executive Staff.
Risk Staffing Levels
Risk Owner Erin Nechipurenko
Risk Desc.
Current Status
Measures Currently in Place
Future Measures to Address Risk
Risk Owner Action Plan
In FY17, HR will develop a template worksheet for individual departments to use in assessing current staffing levels, primary and secondary services, current indicators of responsiveness, future initiatives, and anticipated staffing needs over the next five to ten years.
Given the current procedures in place for approving new positions, departments will be able to use this template to inform their respective Executive Staff Members of staffing requests/justifications.
Documentation
a) Office of Academic Affairs provides information on current faculty staffing and anticipated needs. b) Office of Human Resources provides information on current administrative and support staff staffing levels. c) Office of Institutional Research provides information on student enrollment levels.
Quality Assurance Review N/A ‐ senior management review
Multiple departments are constrained in their ability to deliver services because staffing levels (insufficient number of staff coupled with high turnover in certain positions) are not commensurate with a growing workload driven by several years of enrollment growth, as well as increases in regulatory compliance expectations.
Staffing Levels compared to student enrollment are reviewed regularly by the Executive Vice President of Administration, Finance, and Technolgy. Over the past 5 years (AY12‐AY16), Total Staff FTE increased by 3.3% annually, higher than the average annual increase in student enrolmment by 3.0%. The 5 year forecast includes growth in FTE for staff positions at a lower rate (1.1 annually), but at a level more commensurate with expectations for student enrollment (0.0% annually).
The President's Executive Staff reviews requests for new positions annually and identifies, within budget limitations, which positions will be filled for the next fiscal year. In addition, for the past two years, each time a staff position is vacated, the Executive Staff discusses the need to fill the position and/or reorganize areas to better address current needs.
While anecdotal feedback was utilized to initially identify this risk, a review of actual data is needed to verify this information. Our plan moving forward is as follows:
HR will develop a template worksheet for departments to use to document anticipated departmental staffing needs. Prior to determining the budget for new positions, each year the Executive Vice President of Administration and Finance will prepare a snapshot of staffing levels compared to student enrollment. The information for the snapshot is provided by the following areas:
Annually, during the month of February, HR will provide the President’s Executive Staff with a snapshot of aggregate turnover rates for full‐time employees. If HR becomes aware of readily available benchmarking data for MA public institutions of higher education, HR will provide these benchmarks when reporting turnover. (Currently this data does not exist.)
Risk Customer Service
Risk Owner Jeremy Spencer and Rachel Trant
Risk Desc.
Current Status
Measures Currently in Place
Future Measures to Address Risk
Risk Owner Action Plan 1) Development of an SSC student transaction survey (by end of semester)2) Solicit direct student feedback via an SSC listening tour to SGA, Residence Hall Council, etc3) Development of a process to track service volume (partially happening as of 4/26)4) Installation of SSC signage to showcase functional areas (as of 4/26 ‐ waiting on facilities)5) Installation of sound dampening tiles to manage noise in SSC (as of 4/26 ‐ waiting on facilities) 6) Implement recommendations from SIG visiting campus (when complete)
Documentation Policies and Procedures when above action plan is in place (any business process improvements etc)
Quality Assurance Review Review when action plan is in place
Current staffing levels do not allow FSU to provide sufficient customer services to students and their families due to time spent on a growing workload .
Given the broad nature of this risk, the assumption based on the risk owner assignment of Rachel Trant and Jeremy Spencer is that this risk is associated with the Student Services Center (SSC). Since the creation of the SSC in 2012, there has not been a clear, consistent mechanism to collect data and/or evaluate SSC customer service. Customer service feedback has been primarily based on observation, anecdotes, and direct interactions with unsatisfied students.The University currently lacks a full understanding of how the SSC is perceived from a customer service perceptive in addition to a full understanding of customer service expectations (i.e., areas where we exceed, meet, and fall short of expectations). FSU is aware that it might not be fully leveraging the technology resources (e.g. Banner); however FSU does not have the internal resources or expertise to fully identify and/or solve these potential limitations.
Student Accounts was realigned with the Business Office in fall 2015 to strengthen business processes and leverage Banner/technology resources. An SSC Office Manager was identified to coordinate front‐counter service, educational signage, and service volume (walk‐in, email, and telephone calls/voicemail). SSC extended office hours at the start of the fall/spring semester (M‐R) in addition to extended hours (M‐T) the rest of the calendar year to serve students during non‐traditional times.
Development of an SSC student transactional survey; possibly solicit direct student feedback via a SSC listening tour to SGA, Residence Hall Council, and other student venues; development of a process to track service volume (walk‐in, email, and telephone calls/voicemail); installation of SSC signage to showcase functional areas (financial aid, registrar, student accounts); installation of sound dampening tiles to manage noise in the SSC; Strata Information Group (SIG) visiting campus in February 2016 to assist with business processes/Banner leveraging; procuring an online resource to assist with financial aid education and understanding financial aid processes/requirements; SSC staff development (e.g., shared calendar, transactional flow‐chart, FAQs, consistent area staff meetings that involve frontline staff, professional development sessions relating to customer service, etc.)
Risk State Appropriation Cuts
Risk Owner Dale Hamel
Risk Desc.
Current Status
Measures Currently in Place
Future Measures to Address Risk N/A
Risk Owner Action Plan Trend Analysis Development of Pro Forma Budget Alternatives
Documentation Trend Analysis
Quality Assurance Review N/A ‐ subject to Board review
State budgetary pressure continue to pose a risk to Universities as education appropriations may be reduced or reallocated according to performance based criteria.
State funding for public higher education in Massachusetts is volatile; over the past five years, annual changes in state support have ranged from ‐8% to +10%. It also appears that increases in state funding in the next few years will be tied to a performance‐based formula that was first utilized in FY16 (FSU had the highest percentage increase of all the state universities in FY16 but this was largely due to year‐over‐year increases in graduation numbers that hit a high mark last year).
Adjustments to FSU's long‐range pro forma budget have been made to account for lower forecasted levels of future state appropration increases (as well as elimination of anticipated enrollment growth); the current pro forma budget is based on a 3.0% state appropriation increase assumption for FY17. In order to address the resulting reductions in forecasted revenues, potential reductions in projected expenditures have been identified by the Budget and Planning Committee (BPC) including reductions in projected growth of new faculty and staff positions as well as certain trust fund and selected activities reductions. Recommended adjustments to the budger formula have been submitted for BHE consideration that would also reduce variability and uncertainty in institutional allocations.
Risk Shifting Regulatory Landscape
Risk Owner Rita Colucci
Risk Desc.
Current Status
Measures Currently in Place
Future Measures to Address Risk
Risk Owner Action Plan 1) Complete grid of federal laws and regulations that apply to University. 2) Start to develop a list of state laws and regulations that apply to the University. FSU will ask the state auditors if they have a listing of state laws & regulations and start with that.
Documentation The grids, when complete.
Quality Assurance Review 1) Initially, ensure we have complete information
2) Then, start to sample/test some to ensure the University is in compliance with laws and regs. More attention will be given to ones that are not typically reviewed/audited by an external agency. However, when external agencies cite the University for certain findings, these will merit more attention then.
Continually evolving laws and regulations can make it hard to understand FSU’s compliance obligations and then to implement them effectively and efficiently, so that the University avoids non‐compliance ‐ particularly the large number of new Federal guidelines on grants. For example, some PI's are not well equipped to deal with the rules and regulations of grants.
The internal CAR committee has been working on a comprehensive compliance grid that lists all the federal laws to which higher education is required to be in compliance. Completion of the grid (expected in March, 2016) will provide us with a clear snapshot of where the noncompliance lies. Next, we will move onto creating a compliance grid that will address state law requirements.
Directors whose functional areas are affected by compliance requirements have been asked to provide information. They have been notified of the compliance requirements and know that addressing those areas will need to happen.
Risk Continuity of Operations
Risk Owner John Santoro, Emergency Planning Committee / Warren Fairbanks (facilities)
Risk Desc.
Current Status
Measures Currently in Place
Future Measures to Address Risk
Risk Owner Action Plan Meeting with EOC team to discuss‐1) Schedule COOP/COG training in conjunction with the Massachusetts Emergency Management Agency (MEMA) for the summer or Fall 2016. 2) Develop a template for the COOP plans.3) Provide training/assistance to departments on writing up COOP/COG plans.4) Develop a team to monitor them annually to ensure they are properly updated, etc.
Documentation Departmental COOP/COGs
Quality Assurance Review Review annually
Unanticipated loss of essential infrastructure services (heat, electricity, data, etc.) due to a major widespread disaster such as extreme weather, power loss, or terrorism could limit FSU's ability to maintain continuity of essential services for students and faculty. Lack of clear emergency preparedness procedures could also hinder FSU's ability to quickly respond to/recover from disasters, which could compound the impacts of those events.
The University, as a whole, needs to continue to work towards mitigating this risk. All departments should develop continuity of operations/continuity of government (COOP/COG) plans for their respective areas.
The FSUPD has policies, procedures and contingency plans in place for such events. The Emergency Planning Committee (EPC) meets at least once per semester to discuss campus wide plans for such incidents. The University has had practices various plans during practice drills and real life situations.
Regarding mitigating the risk of any unanticipated loss of essential infrastructure services, the following are being done: 1) Emergency generators have been replaced over the past 12 yrs and just finished replacing the last one in FY15. Each generator is tested weekly. 2) Currently in design phase for replacement of campus utilities that pass through a utility tunnel that runs from the power plant to May Hall (construction to start in Spring 2016).
• All departments should develop COOP/COG plans for their respective areas.• These copies plans should be kept both on and off campus for reference.• The university is in talks with Mass Bay Community College (MBCC) to have each school be the backup location for off campus Emergency Operations Centers (EOCs) during emergencies.
Risk Graduate and Continuing Education
Risk Owner Yaser Najjar, Scott Greenberg
Risk Desc.
Current Status
Measures Currently in Place
Future Measures to Address Risk
Risk Owner Action Plan 1) 5 Year Goals ‐ for graduate & DGCE 2) New Marketing Committee formed; meets regularly to discuss, review and evaluate advertising.3) FSU hired an educational marketing firm to develop a new brand for FSU and make recommendations for future marketing.4) A new bachelor's completion program, FSU@MassBay will begin at Mass Bay in Fall 2016.5) Dean of Graduate Studies is working with Program Coordinator to development and implement a five‐year master's degree.6) Dean of Graduate Studies meets regularly with graduate admissions staff to review and monitor recruitement and graduate applications.7) Marketing Plan is currently being developed. After is it developed, FSU will need to develop metrics to measure the success of marketing. (Marketing Plan will be finished June, 2016).8) Use Google Analytics to analyze traffic on the website (effective July, 2016).9) Determine student retention and completion rates for both graduate students and CE undergraduate students (to be completed by Dec, 2016). 10) Develop a system for contacting students in good standing who withdrew before completing the degree (once CRM is implemented by Admissions in AY16‐17).11) Review graduate enrollment by program on an annual basis and propose eliminating programs that have had several years of low enrollment (ongoing review basis by the Graduate Enrollment Team in AY16‐12) Provide funding to support development of new graduate programs that meet workforce needs in the MetroWest region (conduct marketing analysis of potential new graduate programs in AY16‐17).
Documentation Trend AnalysisMarketing Plan
Quality Assurance Review N/A ‐ senior management review
If the continuing education programs continue to experience declining enrollment, there could be significant impacts on overall institutional performance and revenue. Since FY2012, enrollment in FSU's continuing education programs has declined by 14.4%.
Enrollment in graduate courses increased slighlty in AY2015‐16, but undergraduate CE enrollment continued to decline. The National Center for Educational Statistics found that the number of students over age 24 attending four‐year public higher ed decreased by 4.1% over the past three years.
The University has hired a full‐time Director of Marketing who oversees the marketing of all programs, include graduate and CE; the Admissions Office has taken an active role in graduate student recruitment; the new FSU@Mass Bay partnership should help to increase the number of CE undergraduate students.
Risk Student Collections
Risk Owner Rachel Trant
Risk Desc.
Current Status
Measures Currently in Place
Future Measures to Address Risk
Risk Owner Action Plan Update/improve collections process (in progress now)
Documentation Provide updated policies and procedures / internal controls for the collections process.
Quality Assurance Review After completed, initially do an annual/semi‐annual review of process improvement in collection amounts.
Current collection processes may not accommodate the different needs and circumstances of different student populations, leading to frustration on the part of students and a lower likelihood of receiving the full amount of payments owed.
The University has an established collections procedure and annually evaluates it's related Allowance for Doubtful Accounts. Regarding the financial aid loans default rate, they are the following: 2012‐2013 cohort default rate for the FFEL/Direct Loan is 5%. The Perkins loan default rate for FY15 is 20.38%.
Current University policy divides the collections effort into 2 types of efforts based upon the student's status of active vs. inactive. Payment plan options are available to active students. Non‐payment or lack of adherence to agreed upon payment plans will result in an active student being placed on Hold, prohibiting their registration for classes.A collections process is currently in place for inactive students. This collections process utilizes a 30‐60‐90‐120 day notifications, transferrence to an external collections agency at approximately the 120 day point in time and then transferrence to the Commonwealth's Intercept program, should the external collections effort be exhausted.
The Collections Process is being reviewed and compared to other universitys' best practices as a part of the Strata Information Group consulting engagement. Modifications to our existing approach will be based upon these findings. Additionally we have recently had discussions with the Office of the State Comptroller regarding additional use of the Intercept process in order to enhance our collections efforts.
Risk Risk Owner Risk Description Action Plan Timeline/Due Date
IT SecurityPatrick Laughran, IT Security Council
Failing to be in full compliance with IT security laws and regulations could result in security breaches in multiple areas, such as student data and records retention.
•As IT is a heavily audited/regulated area, IT will give QA all of the final reports from external agency audits/reviews and also update QA with current and future iniatives that are in place. •Approval of new position for IT security.
Quarterly
Banner ‐ Performance
Patrick Laughran, Marsha Bryan
If current Banner functionality is not operating effectively, it could create ineffiencies, manual work‐arounds, and insufficient reporting that may limit staff to perform key activities.
•Third party assessments of Banner functionality has occurred and FSU is continually striving to create efficiencies with departments' IT needs.
Quarterly
Sub‐Optimization of Banner
Patrick Laughran, Marsha Bryan
FSU may not be using Banner optimally, particularly around analytics/reporting; many processes are still manual.
•IT has a current request process in place for reports and other efficiency requests. Currently there are 12 critical requests (9 complete, 3 underway) and 7 lower priority requests (3 complete, 4 underway).
Quarterly
Student Retention Linda Vaden‐GoadFSU should take steps in managing the retention rate and ensure that FSU's retention strategies are in line with current practice.
•5 Year Trend Analysis of Student Retention•Marketing efforts •Tracking new initiatives•Implementation of Starfish
Annual
Potential for Declining Enrollment
Lorretta Holloway, Enrollment
Planning Group
With enrollment declining nation‐wide, FSU should be better prepared for the societal shifts that will change the characteristics of the future student enrollment/market.
• Establishment of Enrollment Data Team• 5‐Year Enrollment Trend Analysis• Tracking progress
Annual
Campus Violence
John Santoro, Emergency Planning
Committee
If FSU is not prepared to respond to campus violence, such as an active shooter or explosives, then the risk to personnel safety and security should be increased. FSU's reputation could also be damaged if there is a perception that it may not have done enough to protect students and staff.
• Meeting with Threat Assessment Team (TAT) to go over mandatory active shooter training, formal threat assessment training for TAT group, draft written policies and procedures, etc.
In Progress Now
Retention & Succession
Erin Nechipurenko
High turnover rates without the proper succession planning or retention efforts could result in institutional knowledge leaving the University without proper documentation/cross‐training.
• Provide faculty/staff retirement eligibility to Executive Staff to provide long‐term outlook regarding current workforce. • Start succession planning with President’s Cabinet in FY17 to identify critical positions in respective areas, etc. • Create template for departments to use (i.e. checklist of items for succession planning, such as documenting internal procedures, etc). • Offer exit interviews to departing full‐time employees and provide optional exit questionnaire to outgoing part‐time contract employees.
FY2017
Staffing LevelErin
Nechipurenko
Staffing level may not be growing at the same rate as growing workload drivey by several years of enrollment growth, as well as increases in regulatory compliance expectations.
• Annual snapshot of turnover rates to President’s Executive Staff every February. • HR will provide benchmarking data for MA public institutions, if it ever becomes available (currently doesn’t exist).• HR will develop a template worksheet for individual departments to use in accessing current staffing levels and anticipated staffing needs over next 5‐10 years.
FY2017
Customer ServiceJeremy Spencer, Rachel Trant
Current staffing levels and other variables may not allow FSU to provide sufficient customer services to students and their families due to time spent on growing workload.
• Development of an SSC student transaction survey and solicit direct student feedback via different student avenues.• Development of a process to track service volume.• Implement recommendations from SIG visiting campus.
In Progress Now
State Appropriation Cuts
Dale HamelState budgetary pressure continue to pose a risk to Universities as education appropriations may be reduced or reallocated according to performance based criteria.
•5 Year Trend Analysis •Development of Pro Forma Budget Alternatives Annual
Shifting Regulatory Landscape
Rita ColucciContinually evolving laws and regulations can make it difficult to understand FSU's compliance obligations and then to implement them effectively and efficiently so that FSU avoids non‐compliance.
• Complete grid of federal laws and regulations that apply to the University.• Create a list of state laws and regulations that apply to the University.
FY2017
Continuity of Operations
John Santoro, Emergency Planning
Committee
Lack of clear emergency preparedness procedures could hinder FSU's ability to quickly respond to/recover from disasters, which could compound the impacts of those events.
• Meeting with the Emergency Planning Committee (EPC) to discuss plans to have every department have a Continuity of Operations Plan (COOP).• Update on MassBay Community College (MBCC) being back up location as Emergency Operating Centers during emergencies.
FY2017
Graduate and Continuing Education
Yaser Najjar, Scott Greenberg
If continuing education programs continue to experience declining enrollment, there could be significant impacts on overall insitutional performance and revenue.
• 5‐year goals for DGCE and graduate• 5‐year trend analysis• Developing the marketing plan (currently in the works)• After marketing plan is created, develop a plan on measuring success in regards to marketing actions.• Reporting to senior management
In Progress Now
Student Collection Rachel Trant
Current collection processes may not accommodate the different needs and circumstances of different student populations, leading to frustrating on the part of students and a lower likelihood of receiving the full amount of payments owed.
• Currently reviewing the collections process• Implement new process • Update policies and procedures to reflect new process
January 2017
Academic Year 2015-2016 Report on Federal Law Compliance
Beginning in September 2015, the University established an internal compliance, audit and risk committee. This committee undertook a comprehensive review of the University’s compliance with federal laws pertaining to higher education. The committee used two tools to guide its review: a matrix found on the National Association of College and University website and a matrix that was developed by the Federal Student Aid division of the Department of Education.
The NACUA matrix is divided by subject matter (grants, human resources, academics, etc.) and lists 260 federal laws, or subsections of federal laws, which apply to higher education (see appendix A for a complete list of subject matters). The committee reviewed all 260 laws to determine which applied to Framingham State. Then, after reviewing existing policies, practices, and protocols, the committee made determinations as to whether the University was in compliance with the respective laws.
The results of that review are as follows:
• In compliance or N/A – 82% (214) • Working toward compliance – 5% (11) • Still investigating compliance status – 13% (35)
Those areas where the University is working toward compliance include:
• copyright and trademark • environment and health and safety • financial aid • wages
Those areas where the University is still investigating its compliance status include:
• accounting • athletics • campus safety • contracts and procurement • copyright and trademark • governance • grants management • IT • privacy and information security • program integrity rules • wages
The committee also looked at federally mandated consumer information disclosures, working from a matrix that was developed by the Federal Student Aid division of the Department of Education (see Appendix A for subject matter list). The matrix sets forth 56 laws and regulations that govern disclosures colleges and universities must make to students, prospective students and members of the public. These disclosures are mainly found on the website, although some laws require that paper copies be made available as well.
The internal review of these disclosure requirements found the following:
• In compliance or N/A – 80% (45) • Working toward compliance – 12% (7) • Still investigating compliance status – 7% (4)
Those areas where the University is working toward compliance include:
• copyright • student body diversity • athletics • employment placement • Clery act • missing person • veteran services
Those areas where the University is still investigating its compliance status include:
• completion/graduate rates • job placement rates • graduate and professional programs of alumni • program integrity
The University will continue to work on compliance efforts through the summer and will present another report in the fall.
APPENDIX A
MATRIX OF FEDERAL LAWS
CONSUMER DISCLOSURE REQUIREMENTS
Academic programs Financial Aid Accounting Disability Services Accreditation Cost Admissions Refund Policy Athletics Academic Programs Auxilliary Services Transfer of Credits Athletics Copyright Infringement Campus Safety Written Arrangements Contracts/Procurement Accreditation Copyright and Trademark Vaccinations Policy Disabilities College Navigator website Diversity and Affirm Action Student Body Diversity Env. Hlth and Occup Safety Net Price Calculator Ethics Textbook information Export Controls Information for Students Financial Aid College Bookstores Fundraising and Dev Books and Supplies Governance Teacher programs Grants Management Voter registration Hlth Care & Ins Constitution day Housing Drug and Alcohol abuse prev HR: Discrimination Completion Rates for Athletes
receiving financial aid HR: Employee Benefits Athletic participation and
financial support data HR: Recruitment, Hiring & Term Employment Placement HR: Retirement Graduate and Prof Programs HR: Unions Retention rates Wages Security Report Immigration Disciplinary action for sexual
misconduct Info Tech Student record privacy Intellectual Prop & Techn Trans Fire safety report International Activities & Prog Fire Log Lobbying and Political Action Gainful employment Privacy and Info Security Veterans Program Integrity Rules Student Loans Research Preferred Lender lists Sexual Misconduct Tax
