Why Wipfli?
Wipfli offers a wide range of services, from audit and leadership development to cybersecurity and energy incentive advisory, all delivered by a team that includes former educational institution professionals.
We understand your challenges, and we know that your mission is rooted in your students and community. We’re ready to bring that same level of commitment to our work with you, providing personalized attention and tailored support.
Go beyond compliance with Wipfli’s audit and assurance services. Our team applies our extensive education sector experience to help you meet your financial statement and Uniform Guidance audit needs and identify opportunities to improve your institution.
From navigating increased cybersecurity regulations to adopting AI and other innovations, Wipfli’s higher education technology consulting services can help you create a digital strategy that moves your institution forward while keeping sensitive data secure.
Wipfli’s experienced tax team can help you address your tax challenges and maximize opportunities. If you’re working on new facilities, our team of architects, engineers and tax professionals can help you realize the full value of your energy credits.
Get support for managing your finances, talent and technology so that you can focus on creating a better student experience. Wipfli’s outsourced services give you access to experienced talent and effective strategy at the level your institution needs.
Create and realize an effective vision for your institution with Wipfli’s organizational performance services. We help you gain a holistic view of your institution, guiding you in higher education strategic planning and best practices for your people, processes and technology challenges.
Wipfli can help you identify and mitigate risks and potential fraud at your institution. Our multidisciplinary team brings integrated perspectives and strategies to help you manage internal control and compliance needs across your institution.
Reach out to our team
Let’s talk about how your higher education institution can evolve and adapt to overcome today’s challenges, operate more effectively and deliver stronger outcomes for your students.
Insights and resources
ARTICLE
Does your school need a new accounting system?
Many private preK-12 schools run on legacy accounting systems. These often involve a combination of older software and spreadsheets and have often been in place for decades. But are those systems still worth the hassle? Increasingly, no. Keep reading to learn more about the major accounting challenges schools face as a result of their existing systems, plus what to do about them. How are legacy accounting systems causing problems for private schools? Legacy accounting systems provide several major challenges for school administrators. Among other issues, administrators struggle with cumbersome reporting, limited integration and a heavy back-office workload. Slow and cumbersome reporting: It’s hard to actually extract information from legacy systems and turn it into a user-friendly, digestible report. If you’re using older software, you might have to manually pull data from the system and put it into a spreadsheet before you can even start doing any analysis. Poor integration: Legacy software doesn’t play nice with other systems. You’ll have a hard time integrating donor, tuition management, or even bank feed systems into your legacy accounting system, leaving your team fumbling for workarounds. Heavy workload: Your team is spending many hours a month on manual processes that newer systems could automate. This generates burnout and also keeps your team members from focusing on more interesting, higher-value work. Poor visibility: Slow reporting means that school leaders have little to no real-time visibility on your school’s financials. This limits your strategic decision-making capabilities. Limited support: Aging software systems are probably not getting updated or patched with any regularity, if at all, creating operational and security challenges . You’ll also have a harder time finding IT professionals trained on supporting those systems. Disorganized information storage: Legacy systems typically store information piecemeal — scattered between software and spreadsheets. This gets messy even in the best of times, but becomes even more challenging if a team member departs, as vital data often gets lost in the transition. Difficult onboarding for new team members: Bringing on new people to your team is harder because legacy systems often rely heavily on the working knowledge of existing team members rather than SOPs. Younger employees may also strongly prefer to work with newer systems, creating a recruiting challenge as well. How does migrating to a cloud-based ERP help private schools? Migrating to a modern, cloud-based enterprise resource planning (ERP) platform will help your school solve the challenges caused by a legacy accounting system. An ERP essentially allows your whole administrative team to operate more efficiently and effectively, automate cumbersome tasks through AI and make smarter strategic decisions. School leaders considering an ERP transition should consider specific benefits like: Time saving You’ll be able to automate data collection and reporting, eliminating slow, manual tasks. This will free up a significant amount of time that your team can then put towards higher-level work. Clearer visibility A modern ERP gives you access to dashboards showing real-time financial data. This allows your leadership team to have a much clearer sense of what’s going on to facilitate smarter decisions and manage costs . Faster collections Modern systems make it easier to collect tuition. You can track accounts receivable in real time and offer online bill pay for a faster, smoother experience. Better family experience It’s not just your accounting team that will appreciate online bill pay. Your families will too, enjoy better visibility into their own billing details via an online payment portal, plus the ability to pay with a credit card. Smoother audits Having all of your financial data in one centralized, cloud-based system makes it much simpler to prepare for audits. You’ll also face a reduced risk of errors in your data, helping you get a clean bill of health from your auditor. Incorporates innovative tools like AI Cloud-based systems now typically incorporate AI, which legacy systems are not able to do due to technology limitations. AI functions inside modern ERPs are also regularly updated, allowing your capabilities in areas like automation to evolve alongside AI technology. Outsourcing ready Finally, if your school is curious about outsourcing certain services ( payroll is an increasingly popular example ), a modern accounting system makes that easier to do. Outsourcing can be a useful option for schools that are having trouble filling accounting roles as veteran team members retire, and can give you access to an entire accounting team for the cost of a single in-house salary. Next steps If you’re a school CFO or finance director who’s curious about whether an ERP or modern accounting system could help your school operate more efficiently and effectively, don’t start scheduling tech demos right away. First, reach out to an advisory firm, for guidance, that understands enterprise technology and has specific experience working with schools. An advisor can help you assess your current systems, identify specific pain points and decide whether it makes sense to transition to a modern ERP. Your advisor can also help you implement a new system and complementary solutions like outsourcing. Read more Why are more schools turning to outsourced payroll? Boosting cybersecurity in schools after the PowerSchool data breach 6 steps for effective succession planning in schools
ARTICLE
Is your higher education institution at risk from payroll fraud? Here’s what to know and how to prepare.
More higher education institutions are reporting incidents of payroll fraud. And the damage often goes beyond just financial , with your reputation and employee morale also at risk. Is your institution at risk? Keep reading to find out — and learn how to strengthen your cybersecurity to protect against an attack. How common is payroll fraud in higher education? Leaders at colleges, universities and other higher education institutions are typically hesitant to speak publicly about any payroll fraud or other cybersecurity incidents they have experienced. That makes hard data difficult to come by. This doesn’t mean these incidents don’t happen. In fact, 2025 saw a major payroll fraud attack by a group known as Storm-2657. During this attack, members of the group gained access to 11 separate user accounts at three different universities. They then used that access to send phishing emails to roughly 6,000 employees at dozens of other universities, dramatically increasing the scope of risk. This attack made enough of a ripple that Microsoft felt compelled to publish a blog post on how it was responding to the problem . Other similar attacks have also been documented . Of the 500 employees who received one specific email sent during the Storm-2657 attack, only 10% reported it as a phishing attempt. How does payroll fraud typically occur in higher education? Payroll fraud can be carried out by employees within an organization. But most recently reported higher education payroll fraud has come via an external cyberattack, typically a phishing scam. Here’s how it usually works: You get a phishing email with a link. When you click on the link, hackers use it to gain access to your email. They then change your setting to automatically delete emails coming from your HR system, use your credentials to access your HR system and change the bank account for your direct deposit. You won’t even notice anything is wrong — until payday, when your paycheck doesn’t show up. What kind of damage does a typical payroll fraud incident cause at a higher education institution? Payroll fraud within a higher education institution can lead to financial, operational and reputational damages . Your employees may also experience significant frustration if their personal finances are affected as a result of a fraud incident. Financial damage: Exact dollar amounts are typically not reported. However, the Association of Certified Fraud Examiners (ACFE) has estimated that median losses per fraud incident (across all types, not just payroll) are approximately $50,000. Other ACFE data suggests some fraud incidents can reach financial losses as high as $1 million . Operational damage: Your systems may experience significant downtime as you work to recover from a successful payroll fraud incident, especially if it involves a cyberattack. Reputational damage: Your reputation can be affected by a successful fraud incident, with donors potentially less likely to feel comfortable giving to your institution. Damaged morale: Employees who miss paychecks as a result of an attack will understandably be frustrated and may even experience significant personal consequences should they have to delay paying bills. How should higher education leaders improve cybersecurity to prevent payroll fraud? CFOs and CIOs at universities and other higher education institutions should actively strengthen their cybersecurity posture to prevent payroll fraud and other phishing-related attacks. Key steps include doing a cybersecurity audit, implementing phishing training, deploying multifactor identification (MFA) and putting additional security controls in place. 1. Do a cybersecurity audit Bring in a third-party cybersecurity advisor to assess your current controls and cybersecurity defenses. This will help you identify any gaps in your systems that need to be filled in to better protect your institution from a fraud incident or attack. 2. Implement MFA If your institution doesn’t already have MFA in place, you need to do that immediately. Rather than receiving an MFA code via text or email, the most effective form involves using an authenticator app or a passkey, which will make it dramatically harder for a phishing attack to compromise your systems. 3. Provide regular phishing training Your whole team needs to receive regular phishing training. This can’t just happen once a year, either. It should be frequent enough to keep phishing scams top of mind for all your team members, so that if they do receive a phishing email, they will be less likely to click through and more likely to report it. 4. Consider additional controls Consider whether you need to implement additional controls to prevent payroll fraud. For example, this could include something as simple as ensuring that when an employee’s user account makes a payroll-related change, an HR team member gets an email about the change. Or it could also mean requiring any changes to an employee’s direct deposit account to be done in person or be requested over a video call. 5. Conduct ongoing network monitoring Monitor your network for potential threats continuously. This includes tracking unusual sign-in locations and looking for other anomalies that may indicate a hacker is trying to gain access to your systems. Read more Cybersecurity is a major financial risk for your organization Boosting cybersecurity in schools after PowerSchool data breach Cybersecurity strategies for mid-market leaders
ARTICLE
What is a single audit and when do you trigger one?
Organizations that receive significant federal grant funding should be aware that they are required to complete an annual assurance review known as a single audit. This process is typically conducted by a third-party CPA and is meant to provide oversight on how federal money is being spent. If you’re new to receiving federal grants or your funding levels have recently increased, you may be surprised to discover that you’ve triggered the single audit requirement. (This was a frequent source of confusion during the COVID-19 pandemic, when organizations claiming CARES Act or ARP funding were often shocked to find out about audit rules after the fact.) Keep reading to learn more about single audits, who is subject to one and how the audit process works. What is a single audit? Each year, the federal government distributes billions of dollars in grant funding or other federal assistance to non-federal entities like nonprofits. But how is that money actually being spent? Enter the single audit. A single audit is an annual assurance process meant to ensure that non-federal entities are following the rules about when and how they use the federal funding they receive. This process is known as a single audit because it allows you to audit all of your federal grant spending at once, even if you received funding from multiple grants or agencies. Single audit rules were initially established by the Single Audit Act of 1984 but have been amended or adjusted since then. What is the purpose of a single audit? If you receive federal grant funding, the federal government may require that you complete a single audit to prove you are spending that funding appropriately. During this process, a third-party auditor will carefully audit your financial statements and organizational activities to assess how federal funds have been used and whether your organization has maintained compliance with rules and regulations regarding federal grant funding. What is the trigger for a single audit? In both 2025 and 2026, non-federal entities that accept $1 million or more in federal assistance must complete an annual single audit. Before 2025, the single audit threshold was $750,000. Single audit rules apply regardless of whether your organization receives federal funds directly or indirectly. When calculating whether you’ve reached $1 million in federal assistance, you must include both cash and non-cash assistance that you’ve received. How often is a single audit required? The federal government requires annual single audits for organizations that reach or exceed the $1 million audit threshold. However, the government does not conduct single audits directly. Instead, organizations typically hire a third-party attest firm to do the audit before reporting the results to the federal government. Uniform Guidance audit requirements Per Uniform Guidance regulations, here are some additional single audit requirements : Additional internal control processes will be needed to ensure compliance for major programs, and any findings will be disclosed in your financial statements Identification of the funds received and the major programs under which the funds were received via a schedule of expenditures of federal awards (SEFA) Identifying programs as either Type A or Type B Knowledge of federal statutes, regulations and terms and conditions of the federal awards Disclosure in your financial statements of any findings and follow up on any prior-year findings Preparation and submission of a data collection form directly to the Federal Audit Clearinghouse at the completion of the audit What is the difference between a single audit and a regular audit? An audit is a rigorous oversight process that assesses the accuracy of an organization’s books. During an audit, an auditor (who is typically a CPA) will review your financial statements using GAAP or another accounting standard, assess your internal controls and test transactions to ensure that your financial position is what you say it is. A regular audit focuses on your organization’s finances and is meant to assure shareholders, clients, partners, potential investors, government organizations and the public that you are accurately reporting your financial condition. Large and mid-sized organizations routinely undergo regular audits, including for-profit businesses or other entities that do not receive any federal grants or other federal assistance. Single audits also assess your compliance with grant funding rules A single audit is a specific type of audit that is broader in scope than a regular audit. In addition to evaluating the accuracy of your financial statements, an auditor conducting a single audit will also assess your compliance with rules and regulations that govern how organizations can use federal assistance or grant funding. In other words, if a regular audit is about whether your books are correct, a single audit also takes a deeper look at what you actually did with the money. This includes areas like allowable costs and activities, matching requirements and cash management procedures. How should you prepare for a single audit? Don’t try to prepare for a single audit without outside guidance. Any organization receiving federal assistance that risks triggering single audit requirements should seek out an attest and advisory firm that specializes in single audit and compliance work. This advisor can help you understand compliance requirements, assess your existing controls and recommend improvements. Crucially, your advisor should also be able to perform a single audit when necessary. How much does a single audit cost? A single audit will typically cost at least $10,000. However, that sum can go significantly higher depending on factors like the size of your organization, whether you are receiving federal funds from more than one grant or whether those funds come with any additional complexities or restrictions. Read more 5 common GAAP violations you should know Fixed asset accounting: Asset capitalizing rules, do's & don'ts Effective strategies for preventing and detecting expense fraud in your organization
LET'S CONNECT
Let Wipfli help you improve student support, protect your assets and transform your infrastructure.
