Hunter-Tannersville Central School District

Internal Controls Over Claims Processing and Information Technology -
EXECUTIVE SUMMARY

The Hunter-Tannersville Central School District (District) is governed by the Board of Education (Board) which comprises five elected members. The Board is responsible for the general management and control of the District’s financial and educational affairs. The Superintendent of Schools (Superintendent) is the chief executive officer of the District and is responsible, along with other administrative staff, for the day-to-day management of the District under the direction of the Board.

The Board is responsible for auditing all District claims or appointing a claims auditor in compliance with the State Education Department’s (SED) regulations. The Board appointed an independent contractor as claims auditor in January 2007.

Scope and Objective

The objective of our audit was to determine if internal controls over claims processing and information technology were appropriately designed and operating effectively for the period July 1, 2005 to May 23, 2007. Our audit addressed the following related questions:

• Are internal controls over claims processing appropriately designed and operating effectively to adequately safeguard District assets?
  
  
• Are internal controls over information technology (IT) appropriately designed to adequately safeguard District assets?

Audit Results

Internal controls over claims processing were not appropriately designed and operating effectively. We found that the claims auditor does not report directly to the Board, as required. Instead, the claims auditor reports to the Business Manager. In addition, we found deficiencies in the claims audit process. Of the 26 claims we tested, eight claims, totaling $10,329, were not properly supported or the expenses claimed were not for a proper District purpose. For example, we found that an employee was reimbursed $3,895 for tuition despite the fact that there was no provision in the employee’s contract for this benefit. We also found that a claim paid for meal reimbursement included charges for alcohol totaling $22, which the Business Manager approved for payment even though the claims auditor questioned the propriety of this expense. We also found that a claim for $4,200 that was submitted by the claims auditor’s consulting firm was not sufficiently itemized. Unless billed services list sufficient detail to determine what services were performed, and the rate paid for those services, the District cannot be sure exactly what services it is paying for.

We also found that IT controls were not appropriately designed. The District does not have physical safeguards over its computer equipment, does not store backup computer data at a secure off-site location, and does not have a disaster recovery plan. As a result, the District’s IT systems and electronic data are subject to increased risk of loss or misuse.

Comments of District Officials

The results of our audit and recommendations have been discussed with District officials and their comments, which appear in Appendix A, have been considered in preparing this report. District officials generally agreed with our recommendations and indicated that they are taking corrective action.