Audit Education Institutions: Jan. 8

Representative Hope Duke Good afternoon, members. We’re going to get this started today. Welcome to House and Senate Legislative Audit. We’re going to start with Representative Painter who’s going to lead us in prayer. If you all will stand and join us. 

Representative Stetson Painter Please pray with me. Dear Lord, thank you so much for letting us gather here today. And Lord, just help us remind us that we represent you and your kingdom, Lord, and let us do the people’s will today. And we just ask that you forgive us where we fall short of you. In your son’s name, Jesus, amen. 

Representative Hope Duke Thank you. Okay, whoop, I think I knocked my microphone off too. All right, we are going to need to adopt the minutes from our December 11 meeting. Do I have a motion? Got a motion. And a second? All in favor? All right. Minutes– I guess the motion has passed. What’s our next– review of reports. All right, I’m going to turn it over to staff. Thank you. 

University of Arkansas System: FAFSA fraud, Upward Bound, UAPB

Staff Thank you, Madam Chair, and good afternoon. Today there are four higher education audit reports for the committee’s review. We did not have any deferred reports from the previous meeting. We will begin with the University of Arkansas System report, which contained three findings and was certified to the governmental bonding board and referred to the applicable prosecuting attorney and attorney general. 

All three findings were the result of the University of Arkansas System’s internal audit division that were required to be reported to the PA and the AG. Instead of reading each finding, which is detailed in your packet there, I will provide a brief summary of the issues noted. 

Finding one was related to unauthorized purchases made in the University of Arkansas at Pine Bluff Facility Management Department. After being notified of unauthorized purchases by the university’s management, the systems internal audit division conducted a review of vendor purchases and reported a total loss of $37,000 due to unauthorized purchases made to a vendor. The individual responsible for these unauthorizes purchases was terminated from employment. 

Finding two was related to a fraud scheme regarding students’ Free Application for Federal Student Aid and falsified transcripts at the University of Arkansas East Arkansas Community College. Management of the college notified the system’s internal audit division of the fraud, and upon review, internal audit reported a total loss of $66,000. 

Finding three was related to unallowable charges made to the Veterans Upward Bound program at the University of Arkansas at Fayetteville. University management notified internal audit of the potential misappropriation. And upon review, $8,500 in unallowable transactions were noted. 

The university was able to recover $6,700, leaving an outstanding balance of $1,800 as of the audit report date. This concludes the findings for the University of Arkansas System. Management has provided a response to each finding. Although system officials were not required to be present, they are here to answer any questions the committee may have. 

Representative Hope Duke All right. Members, I don’t know if you all have any questions. I know I have a few, so if you wouldn’t mind joining us at the table and identifying yourselves. Thank you. 

Laura Cheak I’m Laura Cheak. I’m the chief audit executive for the University of Arkansas System. 

Ben Beaumont Ben Beaumont, director of policy for the University of Arkansas System. 

Cathie Cline Good afternoon, Cathie Cline, Chancellor, University of Arkansas, East Arkansas Community College. 

Rebecca Haley Rebecca Haley, University of Arkansas at Fayetteville, Government Relations. 

Student aid identity theft

Representative Hope Duke Thank you. And I don’t see any members with questions yet, so I guess I’ll go ahead and start off with mine. So, my question, first of all, I want to commend you guys, because I guess these were caught by your internal audit division. And so I do think that’s great that you guys saw these things and addressed them to begin with. Is there anything, I guess, before I start my questions, anything you guys would like to say to start off?

Laura Cheak Just that some of the issues identified were identified by management prior to us being notified. 

Representative Hope Duke Anybody else? Okay. Well, thank you. So my question, I guess, starts with the one at the East Arkansas Community College. And so initially these were not students or they were not legitimate students at all. They were completely fraudulent? Were they students? Were you able to track anybody down? Do you have any idea as far as the status on that? 

Cathie Cline They would be– this is basically identity theft is what I would say that it is. And so they would steal transcripts from others. And we were able to– I want to commend our staff. This was a new type of crime that emerged in fall of ’24. And they were like dogs with a bone when they started seeing irregularities and dug out 39 students that had submitted falsified transcripts. 

And all but seven of those were unenrolled from the college as it were or it could have been worse. And once we found that there was this potential for fraud, because I really wasn’t sure all the ins and outs of that, we engaged with the UA audit team to assist us. Are suspicions correct? What do we need to do? Here’s the actions that we’ve taken to pull on the threads, to investigate, to discover that these people had submitted documents as a basis for admission that were not correct. But we don’t have at this point any way to know who the actual person is that did it, because it would be a form of identity theft. 

Representative Hope Duke So were they, the identities that were stolen, were they students that were in that system already? Or were they just– do you have any idea? 

Cathie Cline No way of knowing. I mean, we have four and a half pages of red flags that we follow through now with a student validity team that we have created. So it’s a nationwide problem, just like credit card theft or any other type of identity fraud. We do a lot of effort, a lot of outreach, a lot of use of public records to just keep trying to figure out is a person who they say they are. 

And then again, we had to use our common sense and our experience and get together and compile a giant list of red flags and then get the assistance of the audit team for additional help and scrutiny and tightening up our policies. Luckily, we did have policies in place that prevented admissions based on fraudulent records. And I have spoken with prosecutor Todd Murray about this briefly and now it’s in their hands. And certainly I’d be thrilled if they caught the bad actors. 

Representative Hope Duke So was there something in particular that you all were looking for? Had you been trained on looking for this? Or this was just people who just caught things, instincts, caught their eye or–? 

Cathie Cline Good people who are passionate about students and are– I will be honest with you– absolutely personally and professionally appalled that there are people who would take financial aid away from those who need it noticed some things that were irregular and just kept following like a dog with a bone. 

And the more we pulled, we just dug deeper until we knew we really needed some assistance to move forward. Someone else besides us needed to be brought in at some point. We could go so far with just kicking them out. And I will reiterate, the federal FAFSA system awarded them all aid. We stopped them by saying, no, we’re kicking you out from admittance to the college based on falsified records. 

Representative Hope Duke So do you have something implemented now that you are going to use to help identify that? And I assume it’s sharing across the systems. But do you know if that, as far as just the other universities across our state and across our country, is that something that people are also working on? And I think the staff might be able to speak a little bit. I’m just kind of curious, how do we make sure this doesn’t happen, not only to you all, but across our states? 

Cathie Cline Well, I won’t make you fall asleep by reading you four and a half pages of red flags, but they go to great lengths. There’s a student validity team. It’s cross-departmental. There is training constantly with everyone that touches a student’s admission record or financial aid record. We have to use a lot of common sense of everyone plus some things we thought of, plus some suggestions from auditors, plus things we researched. 

There are a lot of tools out there. It does take a lot of man hours though. Because things like, you text and they don’t text back. Things like, you ask them, once you start seeing red flags, something that doesn’t match up. I’ve got a high school transcript from Corning and now I live in Brooklyn, and I’m asserting I’m trying to go to school in Forrest City. It’s not that a student can’t do that. 

So we have to be cautious and try to help good students who need help. Students can do that. But for our area, that’s unusual. So that would be something, Well, let’s go further. Let’s set up a personal meeting or a Zoom or Teams meeting. Let them show their ID, make sure that the pictures match. Let’s look up their address. Where is that? Oh, is it a vacant lot or a burnout or business? 

We just keep following all the means that we can follow until we can– we reach out to high schools very often. And sometimes there’s something hinky there once we talk to the high school. Arkansas is small. So if you reach out to a small high school, they may even go, Oh, no, I know him. He lives next door to me. He’s not going to school in Forrest City. 

So it’s just good people, very dedicated, who feel a personal passion. And yes, thankfully being in the UA system, we’ve been assisted in summarizing our long list of red flags and protocols we use and then sharing them throughout. And it’s a nationwide problem that really emerged and escalated, I think, in the fall of ’24. And we’re all having to work together to tackle it. 

Representative Hope Duke All right, thank you. Did you have something you wanted to add?

Laura Cheak  Cathie mentioned it. We have shared this with all the other campuses within our system, what Cathie’s team has done, and have provided fraud alerts to our campuses so that everyone’s aware and is cognizant that they need to be ready to identify this. 

Representative Hope Duke Okay. Representative Mayberry, you’re recognized.

Representative Julie Mayberry There we go, okay. So you actually referenced fall of ’24. My mind, before you even said that, was going there because that’s when federally FAFSA went through major changes and there was huge backlogs. I was trying to get my own children registered for FAFSA and we had to wait a few months. And then it was just, it was a mess. I’m sure you all know more than I know about how much it was mess. 

So, but that system was done to make it less complicated to apply for FASFA, so you could get through it quicker. I don’t know if it makes it easier or not, but is some of that the cause of what you’re seeing now? I mean, you made reference to this kind of starting in fall of ’24, and I just wonder if there’s something federally that has made it easier for that identity to be–? 

Cathie Cline First of all, I’m so glad that you– thank you for those words. And I’m so glad you’ve had the pain of the FAFSA, too. 

Representative Julie Mayberry Many times. 

Cathie Cline Even in my own home, we had me arguing with my husband while we tried to figure out our FAFSA for our child. And you got the simplified one. 

Representative Julie Mayberry I’ve had both ends. 

Cathie Cline You’ve had them. 

Representative Julie Mayberry And I still don’t think simplified was really simplified, but anyway. 

Cathie Cline Anyway, you may have hit on something that– our student teams that handle financial aid and admissions were certainly already overwhelmed with changes or working hard to accommodate that, as was everyone. So I can’t say for certain. My personal belief is that this type of crime, identity theft types of crime, of fraud, are just, bad actors are finding new ways to do that. 

Every day that we’re sitting here with the cyber information that’s out there now, and for whatever reason, that’s when it began to really escalate and start to be, subsequent to that, be seen in publications and stuff. And I will say, since that time, no students have gotten past our very thorough protocols that we follow. And so we’re very proud of that. It’s time consuming. It takes a brain. It takes people working together. It takes shared information. But it’s worth it 100%. 

Representative Julie Mayberry Just wondering if there was something on a national level that really needed to be done to make sure. Because, I mean, if they’ve simplified it, maybe they’re skipping a really important step to verify. 

Cathie Cline I would be thrilled if they would catch them before we had to catch them. Because we’re almost an investigative body now, and that’s certainly not something that we wanted to be. And we can only go so far. There are private records here. We have to protect that. We have to protect good students. And we have to go into it with the mindset of the student validity team is to validate the valid students. We have to go into it with a good mindset as well. You can’t go into a different type of mindset. 

Representative Julie Mayberry Is there any concern that as someone is filling out those forms, which I have actually just had this conversation with my daughter saying, Oh, we need to do yours before we get too late now, before she heads back to school next week. But any concern that actually filling out the forms now could potentially open us up to more identity theft for whatever reason? Is there? 

Cathie Cline That is such at the federal level, I would be hesitant to state an opinion since I’ve not worked in Dallas at the FAFSA office before. I can read journals, read publications. But for us, we have to use our local Arkansas smarts is all I can say. 

Representative Julie Mayberry I mean, we hope it’s safe. I mean, we have to do it. I hope our identity is being safe. But what safeguards are there?

Cathie Cline  And we have to be safe with the student information when we’re trying to validate their identity. So we have to be very careful with that. So at times it can be a bit of a tight rope, I would guess, for them. Because you’re wanting– but again, that’s why we want to approach it with the correct mindset when we were doing this. 

Representative Hope Duke Representative Painter, did you have a question? 

Veterans Upward Bound

Representative Stetson Painter Yes, Madam Chair. I first want to say thank you for you guys catching these mistakes. Also, Ms. Haley, I know we talked before we came in, but I just wanted on the record. I wanted to talk about the Veterans Upward Bound Program. I know there were some issues there, but just want to make sure on record that no veterans were kicked out, suffered, or anything else. Were they able to move somewhere else? So can you kind of explain that so we have that on the record? 

Rebecca Haley Absolutely. Thank you, sir. Yes. So we decided to close the program through the audit with Miss Cheak. It is a federally funded program. So coming back from covid, the University of Arkansas at Fayetteville went test optional. So a lot of these programs are not enrolled– or a lot of these students are not involved in any institution yet when they come through this program. 

So, a lot of what we were doing at Fayetteville was preparing them for the ACT and all of that. We have two other Veteran Upward Bound programs in the state at Arkansas Tech and Pulaski Tech that are fantastic. So what we did is making sure these students, if they reach out to us, we push them to those programs to help those students. And then we have a huge veteran center on our campus that supports the veterans that are enrolled or if they reach out to get enrolled. 

Representative Stetson Painter Thank you, Madam Chair. 

Representative Hope Duke Thank you. Senator Dees. 

Student aid theft continued

Senator Tyler Dees Thank you, Madam Chair. Thank you again for being here. Just a few questions back to EACC. So the 39 students, how many total students are on in that campus, on that program? How many total are in that program or on that campus? 

Cathie Cline Well, fall enrollment for the traditional fall semester was right over 1,500. That was our first time to crack 1,500, so it was actually a big celebration. 

Senator Tyler Dees Okay, so these 39 students, it’s self-reported, you guys caught it yourself. And structurally, the steps when you find an instance or a suspicion of fraud, is this where you communicate to Ms. Cheak’s team with AID? Is that how I follow that? 

Laura Cheak Yes, if there’s a suspicion of fraud or a loss that’s identified, they communicate to us as well as to Legislative Audit as well. But as far as self-reporting, they also reported to the Department of Education. 

Senator Tyler Dees I think that’s what I want to understand a little bit more, Ms. Cheak. So it’s in unison with you and your team and Leg Audit at the same time when a suspicion of fraud happens? 

Laura Cheak That’s correct. 

Senator Tyler Dees And then kind of understanding that further. If this wasn’t found or seen at the same timeline, when would Leg Audit have access to this? Or potentially, when would they find it if it wasn’t self-reported? How would I understand the timeline of maybe when– it’s hard to know maybe when. And this may be a question for staff. But when would you guess that Leg Audit would have found it if you didn’t report it? 

Laura Cheak Well, our campuses are very good about reporting. And so usually if there is something identified that, in accordance with the law, they have to report within five business days. And so we are meeting that requirement pretty regularly. If Cathie’s team hadn’t identified this and reached out to us, then I guess Leg Audit may have identified it later. 

Senator Tyler Dees Maybe in an annual reporting structure timeline? 

Laura Cheak In an annual review, when they do their annual reviews. 

Senator Tyler Dees So that’s kind of, I guess, another safety net is that there’s always a next reporting cycle or structure. And then, I had one more on that. Does your team make recommendations to prosecutors or is that only through Leg Audit? 

Laura Cheak It’s a combination of both. It depends sometimes on the case. We may involve the prosecutor early. And also if the campus law enforcement is involved early, they also may reach out to the prosecutors. So sometimes it is already to the prosecutor before it gets to Legislative Audit. 

Senator Tyler Dees Do any of these 39 students have any commonalities? They’re the same major, they’re family related, they’re from the same area? 

Cathie Cline I don’t know. I mean there could be groups of commonalities. The thing to look for is like three or four students sharing the same address with no obvious relationship or three or students sharing the bank account number with no obvious relationship. Again, that in and of itself is not fraudulent and there’s nothing wrong with that. These are red flags to start checking against all the giant list of red flags that we now have and seeing and confirming and going step farther, step farther, step farther. 

Senator Tyler Dees What about visa and US citizenship? 

Cathie Cline They were all US citizens. As far as the FAFSA, again, we don’t have a way of knowing who the person that committed the fraud really was. But the FAFSA, federal government system– maybe you can help me explain that better– has already validated them and had awarded them all federal financial aid. So they were US citizens 100% as far as I know. We don’t have a big visa student population where we live. 

Representative Hope Duke Representative Beaty, you’re recognized. 

Representative Howard Beaty  Thank you, Madam Chair. Just a question for staff. In the past, has this been anything that Leg Audit has noticed or has it been a finding in the past? And is this something that’s included in your scope of review? 

Staff It’s not something that we’ve noticed in the past. As Dr. Cline mentioned, it’s something that’s really taken off in the last couple of years. As far as it being in the scope of our review, that’s hard to say because we’re not testing 100 percent. So it would be difficult, I think, for an auditor to come in and find it when they have experts at the institution do this. And management ultimately is responsible for any fraud that could occur. 

Representative Howard Beaty  I guess a follow up also, this did not result in any loss, financial loss to the state of Arkansas, correct? 

Cathie Cline So there are two things. There was $2,500 that we had to pay back because some students got through and got federal financial aid. Those were the seven, I’m noting, that we didn’t get out before they got financial aid distributed. Now there’s unrealized income. Had the students stayed in, they would owe us, or do still owe us, tuition and fees because we didn’t kick them out until after classes had started. So you kind of have to understand the cycle of college billing there a little bit. But certainly if the prosecutors find any of these people or the state police or whomever, then they can recoup some of that. But that would be the loss. 

Representative Howard Beaty Well, it is a Thursday, and I may be being a little bit slow. So these were actually students that attended class at the campus? 

Cathie Cline No, no, no. This is all online. 

Representative Howard Beaty All online. 

Cathie Cline And so they would log in just enough to still be an active student. It took us a while to come to the understanding. First you start thinking AI, always in this day and time. No, these are humans and they’re committing fraud. And they log in. I’m sure they do this at what, five, ten schools, Lord only knows. And log in just enough just to remain enrolled. And again, we caught all but seven and kicked them out before they could get financial aid. 

Representative Howard Beaty Okay, because I was looking at there were 39, but you’re saying out of the seven. 

Cathie Cline Right, right. Out of the 39, we caught all but seven before the federal government could disburse their financial aid to them. But seven were doing just enough and had a sophisticated enough package that they were harder to uncover, especially in this initial– as you mentioned, it was a new FAFSA year– in this, initial, wait a minute, something is hinky here. Let’s start seeing what’s going on. Let’s bring in audit to confirm, are we seeing what we think we’re seeing? Because, it’s quite elaborate, what they go through. 

Representative Howard Beaty Well, I’m just trying to get back to that the university had to reimburse $2,500 worth of tuition for something that FAFSA approved. And you went through your normal steps. Is it a mandate that the University where that financial aid is received goes back and verifies all the information that was submitted to FAFSA was correct information? 

Cathie Cline People independently submit their information. 

Representative Howard Beaty I understand that. 

Cathie Cline So, now we did immediately reach out to the Office of Financial Aid and said, These people gained admissions. That’s the piece for us that was falsified or fraudulent. They gained admissions using a transcript that was not theirs or was falsified in some way. And so we were able to kick them out. What the federal government and FAFSA, they tie in with income tax returns– and, honestly, the mechanics of how it works at that upper level are a little bit beyond me. 

But to me, I guess I’m most annoyed about the 2,500 that was the seven students that slipped by and certainly unrealized income. You want, as a chancellor, you want all the income you can get. And per Arkansas law, if they found them, if they had assets, they could get that at some point. But I would say I’m most annoyed about the 2,500. 

Representative Howard Beaty And final line of question, any appeal process to that $2,500 reimbursement? Did they give any options other than just reimburse it to the system? 

Cathie Cline Well, no. The federal government wouldn’t view this as their problem. That may be a bit of a broad statement. But our relationship is not that they would ever reimburse us if a student fraudulently got financial aid in any way. I’m sure back in the days of all paper, nationwide, there were people who wrote fake checks to themselves and carried it to a bank, a fake physical check. 

And probably some of them got far enough along to get some money out of a bank with those. The federal government would not have reimbursed a college for that any more than they would reimburse us in this digital age. 

Representative Howard Beaty Okay, thank you. 

Representative Hope Duke Members, are there any other questions? Representative Long, you’re recognized. 

Representative Wayne Long Thank you, Madam Chairman. I was wondering, since you mentioned that all these were online students, do you all have a way to check the IP addresses of these people to make sure that it’s kind of matching up with where they say they are at? 

Cathie Cline That is one of the things to check on our list of protocols. However, many students today use a VPN, which means their IP address changes often. And that has to be specifically– just like a physical address, right? You live at number 1 Main Street, Corning. Well, there’s nothing wrong with you living in number 1 Main Street, Corning.

But if we put it in Zillow– we took the time to stop, put it in Zillow and found out that was an empty lot, then we know we need to keep digging. So, an IP address would have to be looked up, but that is one of the protocols that we have, one of the many things we can pursue, yes. 

Representative Wayne Long Of course, you could maybe require them to turn their VPN off so you could verify they live pretty close to where they say they live. I just thought that might be something to look into. 

Cathie Cline We can do those, yes, all of those things, but they’re sophisticated. I’m not going to sugar coat that in any way. They’re smart enough. They probably ought to get a job in cyber security instead of trying to defraud people. They’re sophisticated criminals, but that is one of the things that we do check or can check. 

We can get them on a Teams meeting and then look that up later. We can look and see sometimes that several applications came in at the same time, say 1:30 in the morning from the same IP address. Well, I don’t want to give away all our red flags right now. And I’m sure the rest of my fellow colleges don’t necessarily want me doing that. So that’s something where you go, huh, hmm, this is unusual. 

Now again, there’s nothing wrong with that. A group of students could live together and could all decide to do their applications together at 1:30 in the morning from the same iPad or computer or whatever they use. For us, it’s a red flag because that would be unusual. 

Representative Wayne Long Thank you, ma’am. 

Representative Hope Duke Any other questions? Staff, I do have one question. Is there a way that universities and colleges can be notified through you all or made aware of this issue that is occurring? Some of them may already be, have their red flags, I guess. But the success, I guess, they had in finding and identifying them, so that they can maybe even reach out to them as far as, what did you do, to help empower us to try and find some of this ourselves. 

Staff I don’t want to speak for them. I know Laura and I discussed this issue when we had meetings at the insurance conference. But I think they are aware of the issue because it is a national issue. I would think that at some of the higher ed trainings it’s discussed as well. And I’m getting nodded yes, so I do think they’re aware. 

Laura Cheak We did discuss it throughout with all the campuses in the system. And I know our chancellors are part of other organizations where it has also been discussed. And it is a national issue. In California and in Minnesota and Michigan there’s been lots of money that has been lost because of these fraudulent students. 

Cathie Cline We definitely shared with our colleagues in Arkansas. But some of the red flags might be different for different colleges. For example, we used our smarts and expertise and then we use the expertise that we were thankfully able to call upon at the UA and our fellow chancellors and just continue to develop red flags and protocols. But I think all campuses are tackling this in the way that works best for their type of campus. 

Representative Hope Duke I just want to say, I think I speak for all the members, we appreciate your work on this. And we do realize it’s almost a moving target in what’s happening in technology and in that fraudulent era. 

And so we just appreciate what you all did in catching that and can commend the people that are working for you, your staff, that you reference as the Arkansas smarts in doing that. And so, we’re proud of them. Thank you. Members, without objection, we will file this report. Thank you. Alright members, without objection, we would like to go ahead and defer the report for Northwest Arkansas Community College. Alright, thank you. Moving on. 

Staff The next reports after Northwest Arkansas Community College contain findings that were not referred to a prosecuting attorney, and they did not contain repeat findings. And those are Southeast Arkansas College and Southern Arkansas University Tech. They had findings related to misstatements in their financial statements. 

College personnel at both institutions corrected the financial statements during audit fieldwork. Additionally, SAU Tech had a finding related to unauthorized withdrawals. The college discovered these unauthorized withdrawals and they were able to recover the funds. This concludes the reports for review on the committee’s agenda. Staff would recommend that these reports be refiled as reviewed, and I can answer any questions that you may have. 

Representative Hope Duke Members, are there any questions about any of these findings? All right, seeing none, without objection, we will file these reports. All right. Members, thank you for your hard work today and all the questions. And I guess we’ll see you tomorrow morning. Meeting is adjourned.