Nonprofit Resources


Compliance Trends Affecting Higher Education Institutions

The changes and challenges higher education institutions navigate include several regulatory updates regarding compliance. During our work with higher education clients nationwide, we’ve noted several areas that require monitoring from institutions.

Let’s look at the impact of these changes and how they will affect institutions in 2022 and beyond. Pay particular attention to the items noted as required or mandatory.


Higher Education Emergency Relief Funds

The big challenge for institutions has been the regulations and requirements for the three tranches of Higher Education Emergency Relief Funds, commonly known as HEERF I, II, and III. Each round of funding brought new eligibility, disbursement, and reporting requirements. The U.S. Department of Education (ED) did not use a consistent method for communicating this information.

The regulations are ambiguous and subject to varying interpretations. Here are just a few examples of this ambiguity:

  • HEERF III requires institutions to use some of the funds to monitor and mitigate COVID-19. Institutions are also required to use “direct outreach” to notify students that they may be eligible for a professional judgment determination, based on the amount of income they lost during this time. However, HEERF III didn’t provide specific dollar parameters for what is considered “reasonable and necessary” costs, leaving this open to interpretation.
  • The “lost revenue” provision specified that HEERF II and III funds could not be used for certain activities of “sectarian instruction or worship.” This has implications for seminaries and Bible colleges. But does it mean that all lost revenue is disallowed for these institutions, or only when it’s related to activities of “sectarian instruction or worship”?
  • Institutions can use HEERF III funds to cover the cost of minor remodeling, but no dollar amounts were provided to define “minor remodeling.” Many institutions upgraded their HVAC systems during the pandemic to provide better air filtration. Although FAQ 24 of ED’s Higher Education Emergency Relief Fund III Frequently Asked Questions document classifies a HVAC system “installation or renovation” as permissible minor remodeling, it is typically a large capital expenditure. It seems counterintuitive that an expenditure of this size would be considered “minor” while other similar-sized expenditures may not be permissible minor remodeling.

The key: thoroughly document your institution’s rationale for decisions on spending HEERF funds, including the standards and guidance available at the time you made each decision. This will help you establish a reasonable basis to defend your position.

It’s important to be aware that spending HEERF funds makes them subject to the federal procurement rules listed in the Procurement Standards (2 CFR §200.317 – 327). As ED did not address this in its HEERF FAQs or communications, many institutions that previously only used federal funds for Title IV financial aid programs were surprised to learn that their compliance with the procurement regulations would be audited as well.

Some institutions were also unaware of the quarterly reporting required under HEERF II and III. You can learn more about these requirements and additional HEERF considerations in this article.

As your institution spends down any remaining HEERF money, carefully consider the following:

  • ED has extended the period to use HEERF funds through June 30, 2023. This blanket approval may have been issued in response to “no-cost extension” requests by many institutions.
  • Allowable uses for HEERF funds must be specifically related to COVID-19. You may want to consider using funds to help mitigate continued declines in enrollment resulting from the pandemic.
  • If you use HEERF funds for goods and services, follow the federal procurement rules and clearly document the basis for your spending decisions. This is especially important given the current supply chain issues, which may limit the number of vendors available to bid. Note these circumstances and explain your procurement procedures.
  • You can use HEERF funds for “reengagement” activities, but not for marketing or recruitment activities. See FAQ 27 in ED’s HEERF III FAQs for examples of allowable reengagement activities.
  • Expenses related to increasing cybersecurity and indirect cost recovery are also allowable.
  • You can write off a student account as lost revenue if the student was enrolled as of March 13, 2020, or later.
  • It is permissible to give additional financial support to help a student remain enrolled.
  • Continue to post the quarterly reports to your website until your HEERF funds are spent. This means reporting all funds you are spending, including both the institutional (with sub-parts) and student aid portions.
  • Be aware that under the 2021 Office of Management and Budget Compliance Supplement, the Education Stabilization Fund program (HEERF) is now required to be considered a program of higher risk. This designation will impact major program determination. This means that if an institution’s HEERF funds are classified as a Type A program, it must be audited as a major federal program. Any program that is 100% COVID-19 funding cannot qualify as a low-risk Type A program due to the mandatory “higher-risk” designation based on ED’s interpretation of the instructions provided in Appendix IV of the 2021 Compliance Supplement. This ED letter has additional details.

See ED’s HEERF III FAQs for more information on allowable ways to spend institutional funds to meet students’ basic needs.


The Gramm Leach Bliley Act

Gramm Leach Bliley Act (GLBA) compliance is not a new requirement for institutions that receive federal funds, but ED has been intentional about enforcing it.

If an institution has GLBA findings, ED will notify the Federal Trade Commission (FTC) and ED’s cybersecurity division for further follow-up. At this point, none of our clients have had follow-up from the FTC, just ED’s cybersecurity division.

Under GLBA, auditors must verify that the institution has:

  • Designated an individual as responsible for the institution’s information security program
  • Performed a risk assessment that addresses, at a minimum, the three required areas noted in 16 CFR §314.4, which are:
    • Employee training and management
    • Information systems, including network and software design, as well as information processing, storage, transmission, and disposal
    • The ability to prevent, detect, and respond to attacks, intrusions, or other system failures
  • Documented a safeguard for each risk identified during the risk assessment outlined above

You should update your risk assessment annually, as well as when you add new systems or make modifications to your existing systems.

Keep in mind that while institutions must attest to full GLBA compliance to receive federal funding, full compliance will also help secure your institution’s data and protect your students, regardless of audit requirements.

The FTC issued final rules on the standards for safeguarding customer information in December 2021. These changes, which you can read about in detail here, went into effect on January 10, 2022. We anticipate that the requirements may be subject to audit procedures in subsequent years.

ED hasn’t addressed these updates yet but we expect to see more communication regarding the final rules on standards for protecting student information.


Return of Title IV Funds

The return of Title IV (R2T4) funds has always been complex, and ED has implemented changes for modular withdrawals of R2T4 funds. These new rules, which were adopted on September 2, 2020, became effective on July 1, 2021, and early implementation was allowed. We have only seen a few institutions elect to early implement these changes so the new requirements will be tested during this audit cycle.

We expect the new rules to simplify the return process. Under the new rules, withdrawal exemptions are for programs that are offered in modules. For more on these exemptions and modules, see the Withdrawals and the Return of Title IV Funds section of the 2021-2022 Federal Student Aid Handbook from the Federal Student Aid office.

The key is if a student completes 49% of the payment period, no R2T4 is required. Students are not considered to have withdrawn if they successfully complete:

  • One module that includes 49% or more of the number of days in the payment period, excluding scheduled breaks of five or more consecutive days and all days between modules
  • A combination of modules that together contain 49% or more of the number of days in the payment period, excluding scheduled breaks of five or more consecutive days and all days between modules
  • Coursework for the payment period equal to or greater than the coursework required for the institution’s definition of a half-time student under § 668.2

For example, if a student successfully completes the first eight weeks of the academic period in an eight-week/eight-week modular scenario before ceasing enrollment, it isn’t considered a withdrawal for Title IV purposes and no R2T4 is required.

Another key point to remember is that for both standard and nonstandard terms, the student must begin attendance in the module to be eligible for a Pell Grant for that module.


Pell and Federal Direct Loan Reconciliations

ED continues to focus on institutions performing internal and external Pell Grant and Federal Direct Loan (FDL) reconciliations. Institutions are required to reconcile Pell and FDL monthly or, for smaller institutions, in the months that they disburse aid.

This involves:

  • A reconciliation of the Student Information Systems (SIS) to the Common Origination and Disbursement System (COD), which is an external reconciliation
  • The reconciliation of SIS to student accounts, which is an internal reconciliation

While much of this information is integrated, the institution is required to do both internal and external reconciliations. Remember that you must complete the reconciliations for all three systems monthly on a student-by-student basis if your institution has made distributions.

This doesn’t mean that the reconciliation has to zero out, but rather that your institution must know what the differences are. Auditors are required to look at both internal and external reconciliations and will review them as they perform their procedures.


Perkins Loans

ED issued updated Perkins Loan Program guidance in August 2021 and while it requires institutions to start assigning loans in default for two years or more to ED by June 30, 2023, it does not require institutions to liquidate the program. Learn more about the updated guidance here.


2022 Compliance Supplement

Institutions with fiscal years that begin after June 30, 2021, are subject to the 2022 Office of Management and Budget Compliance Supplement. Institutions with fiscal year-ends prior to June 30, 2022, still fall under the 2021 Compliance Supplement.

As in prior years, the 2022 Compliance Supplement identifies certain processes auditors must test annually, including student eligibility, R2T4, satisfactory academic progress, need analysis, and Pell calculations.

However, it also places a new focus on the following:

  • Eligible programs – This emphasis first appeared in the 2021 Compliance Supplement with an audit focus and continues in the 2022 version. When your academic advisory committee is reviewing new academic programs, ensure a member of the financial aid department is included so the department is aware when any new programs are developed. This is particularly important if the institution is on heightened cash monitoring (HCM) or a provisional program participation agreement because it’s mandatory to have ED approve the new program before Title IV student financial aid dollars are awarded to students in the program. See pages 5-3-65 to 5-3-66 of the 2022 Compliance Supplement for the general program eligibility requirements, 34 CFR §668.8 for eligible program requirements, and 34 CFR §668.232 for program eligibility requirements. It’s also important for the financial aid department to know when new programs have been approved by your institution’s accreditor.
  • Academic engagement in distance education – Merely logging in is not considered academic engagement for distance education. The 2022 Compliance Supplement notes that there must be an electronic record of students engaging in activities such as participating in a chat or taking a quiz. See 34 CFR §600.2 for specific activities that qualify as academic engagement.

Also note that if a student in a distance program doesn’t have a passing grade, your institution must be able to show that the student had sufficient academic activity and completed the period, or they must be treated as a withdrawal. See pages 5-3-66 to 5-3-68 of the 2022 Compliance Supplement for all distance education requirements and pages 5-3-38 to 5-3-43 for the R2T4 withdrawal requirements.

  • Distance program evaluation and accreditation – Due to COVID-19, ED temporarily waived the requirement for distance programs to be evaluated and accredited for effective delivery. However, the 2022 Compliance Supplement notes that the waiver will cease once the federally declared national emergency related to COVID-19 is rescinded.

When this happens, the institution must have already had its distance education programs evaluated and accredited by an outside accreditation agency, as noted in 34 CFR §668.8(m). This is true whether the programs are offered entirely or partially through distance education. See pages 5-3-67 and 5-3-68 of the 2022 Compliance Supplement for more on this requirement.

  • Cash management – Finally, under the Education Stabilization Fund-HEERF program, the 2022 Compliance Supplement requires cash management to be audited. See pages 4-84.425-ESF-31 and 4-84.425-ESF-38 for cash management cost principles.

It’s important to understand these compliance trends and their impact on your institution now and in the future.

Please contact us with any questions or if you would like to discuss how these changes may affect your institution.

Lisa R. Saul

Lisa Saul serves as Partner and Uniform Guidance Director. She joined CapinCrouse in 1999 and has over 20 years of experience in performing and supervising Uniform Guidance audits of Department of Education student financial aid programs and a variety of federal funding, as well as program audits and agreed-upon procedure engagements of various state-funded programs. Lisa oversees the firm’s more than 80 Uniform Guidance audits.

Leave a Comment