Office of the New York State Comptroller

 

Local Government and School Accountability

Liberty Central School District

Information Technology and Claims Auditor
Executive Summary

Complete Audit in PDF

The Liberty Central School District (District) is governed by the Board of Education (Board) which comprises nine elected members. The Board is responsible for the general management and control of the District's financial and educational affairs. The Superintendent of Schools (Superintendent) is the chief executive officer of the District and is responsible, along with other administrative staff, for the day-to-day management of the District under the direction of the Board.

The centralized Information Technology (IT)1 Department consists of three employees: the IT Director, Network Administrator, and Technician. The Network Administrator and Technician report to the IT Director, who reports to the Superintendent. The IT Director also gives an annual presentation to the Board to keep them updated on current practices and future needs. The department is responsible for maintaining the school's financial and student information databases, which are stored on the District's three servers.

The Board appointed a claims auditor to review and approve all District claims. The claims auditor receives a claims package2 that the accounts payable clerk compiles for her. The claims auditor indicates her approval by initialing and dating each claim. She also reviews and signs off on the warrants.3

1 Information Technology can be defined as the development, installation, and implementation of computer systems and applications.
2 The claims package includes purchase requisitions, purchase orders, invoices and supporting documentation.
3 A warrant is a detailed listing of bills ready for payment.

Scope and Objective

The objective of our audit was to determine if District officials adequately safeguarded District assets for the period July 1, 2006 to July 18, 2007. Our audit addressed the following related questions:

  • Did the Board establish plans to protect information technology (IT) equipment and data from potential disasters?
  • Did the claims auditor properly audit and approve claims?

Audit Results

The Board did not establish plans to protect IT equipment and data from potential disasters. During our audit period, the claims auditor had user access rights to the financial software system; specifically, she had the ability to add/update vendors, cash disbursement schedules, and warrants; record checks that were manually prepared; and print checks. We also found that physical access to the server room is not tracked or monitored, and the room is left unlocked even when it is unoccupied.

The Board has not adopted a formal disaster recovery plan to protect the District's data and systems in the event of a disaster. However, the IT Director and Network Administrator told us they are in the process of replacing their current servers. They plan to have a formal, documented disaster recovery plan in place once the new servers are installed to protect against potential disasters.

We found that the claims auditor properly audited and approved District claims. The claims auditor keeps a file of all problems she encounters and reports them directly to the Board. She also keeps the Superintendent and Business Official updated with any problems she finds. We determined that the claims auditor maintains independence because she reports directly to the Board. We tested 129 claims totaling approximately $985,000 for proper authorization, reasonableness, sufficient support, and indication of claims auditor review and found no significant deficiencies.

Comments of District Officials

The results of our audit and recommendations have been discussed with District officials and their comments, which appear in Appendix A, have been considered in preparing this report. District officials generally agreed with our recommendations and indicated they planned to or had already initiated corrective action.