Board accepts FY2025 single audit; auditors flag missing written information security plan

The Vermont State Colleges Board of Trustees accepted the FY2025 single audit after the Audit & Risk Management Committee reviewed the draft audit and recommended board acceptance.

Committee chair Trustee Zeller told trustees that WHM’s auditor provided an unmodified opinion on the federal awards portion of the single audit but identified one significant deficiency: the absence of a formal written information security plan (WISP). Zeller said that while policies generally align with federal requirements, the lack of a consolidated, documented WISP prompted the finding and that the IT/cybersecurity team expects to complete the plan in the coming weeks.

The committee also recommended pausing the internal audit program for FY26 because the Workday ERP implementation requires rewriting many procedures; the committee supported a temporary hiatus and encouraged management to consider outsourcing some internal-audit design work to reduce internal burden.

Why it matters: An unmodified auditor’s report signals no material weaknesses in federal-award compliance, but the significant deficiency regarding a WISP points to a material procedural gap in documented information-security planning. Trustees said they expect the plan to be completed promptly and for updates to be provided.

Next steps: The IT/cybersecurity team to finalize and present the WISP; management to report back on internal-audit resumption plans and any outsourced audit work.