(a) The board, in consultation with affected stakeholders, shall adopt rules to establish an agency-wide, risk-based compliance monitoring function for:
(1) funds allocated by the board to institutions of higher education, private or independent institutions of higher education, and other entities, including student financial assistance funds, academic support grants, and any other grants, to ensure that those funds are distributed in accordance with applicable law and board rule; and
(2) data reported by institutions of higher education to the board and used by the board for funding or policymaking decisions, including data used for formula funding allocations, to ensure the data is reported accurately.
(b) For purposes of this section, student financial assistance includes grants, scholarships, loans, and work-study.

(c) After considering potential risks and the board’s resources, the board shall review a reasonable portion of the total funds allocated by the board and of data reported to the board. The board shall use various levels of monitoring, according to risk, ranging from checking reported data for errors and inconsistencies to conducting comprehensive audits, including site visits.
(d) In developing the board’s risk-based approach to compliance monitoring under this section, the board shall consider the following factors relating to an institution of higher education or private or independent institution of higher education:
(1) the amount of student financial assistance or grant funds allocated to the institution by the board;
(2) whether the institution is required to obtain and submit an independent audit;
(3) the institution’s internal controls;
(4) the length of time since the institution’s last desk review or site visit;
(5) past misuse of funds or misreported data by the institution;
(6) in regard to data verification, whether the data reported to the board by the institution is used for determining funding allocations; and
(7) other factors as considered appropriate by the board.
(e) The board shall train compliance monitoring staff to ensure that the staff has the ability to monitor both funds compliance and data reporting accuracy. Program staff in other board divisions who conduct limited monitoring and contract administration shall coordinate with the compliance monitoring function to identify risks and avoid duplication.
(f) If the board determines through its compliance monitoring function that funds awarded by the board to an institution of higher education or private or independent institution of higher education have been misused or misallocated by the institution, the board shall present its determination to the institution’s governing board, or to the institution’s chief executive officer if the institution is a private or independent institution of higher education, and provide an opportunity for a response from the institution. Following the opportunity for response, the board shall report its determination and the institution’s response, together with any recommendations, to the institution’s governing board or chief executive officer, as applicable, the governor, and the Legislative Budget Board.
(g) If the board determines through its compliance monitoring function that an institution of higher education has included errors in the institution’s data reported for formula funding, the board:
(1) for a public junior college, may adjust the appropriations made to the college for a fiscal year as necessary to account for the corrected data; and
(2) for a general academic teaching institution, a medical and dental unit, or a public technical institute, shall calculate a revised appropriation amount for the applicable fiscal year based on the corrected data and report that revised amount to the governor and Legislative Budget Board for consideration as the basis for budget execution or other appropriate action, and to the comptroller.
(h) In conducting the compliance monitoring function under this section, the board may partner with internal audit offices at institutions of higher education and private or independent institutions of higher education, as institutional resources allow, to examine the institutions’ use of funds allocated by, and data reported to, the board. To avoid duplication of effort and assist the board in identifying risk, an internal auditor at an institution shall notify the board of any audits conducted by the auditor involving funds administered by the board or data reported to the board. The board by rule may prescribe the timing and format of the notification required by this subsection. The board by rule shall require a private or independent institution of higher education to provide to the board the institution’s external audit involving funds administered by the board. The private or independent institution of higher education’s external audit must comply with the board’s rules for auditing those funds.
(i) The board may seek technical assistance from the state auditor in establishing the compliance monitoring function under this section. The state auditor may periodically audit the board’s compliance monitoring function as the state auditor considers appropriate.
(j) In this section:
(1) “Desk review” means an administrative review by the board that is based on information reported by an institution of higher education or private or independent institution of higher education, including supplemental information required by the board for the purposes of compliance monitoring, except that the term does not include information or accompanying notes gathered by the board during a site visit.
(2) “Site visit” means an announced or unannounced in-person visit by a representative of the board to an institution of higher education or private or independent institution of higher education for the purposes of compliance monitoring.