Rockville Centre Union Free School District

Controls Over Credit Card Purchases and Computer Data
Executive Summary

The Rockville Centre Union Free School District (District) is governed by the Board of Education (Board) which comprises five elected members. The Board is responsible for the general management and control of the District’s financial and educational affairs. The Superintendent of Schools (Superintendent) is the chief executive officer of the District and is responsible, along with other administrative staff, for the day-to-day management of the District under the direction of the Board. The District’s audited financial statements for the fiscal year ending June 30, 2006 reported total expenditures of $75.4 million.

The Treasurer was also the purchasing agent, responsible for overseeing credit card purchases. The District had 22 credit cards (16 gasoline cards, five bank cards, and one hardware store card) which were used for purchases totaling $121,279 during our audit period. The District used an accounting software package to process financial transactions and maintain accounting records.

Scope and Objective

The objective of our audit was to assess the adequacy of the District’s system of internal controls over credit cards and computer data for the period July 1, 2005 through December 31, 2006. Our audit addressed the following related questions:

• Did District employees adhere to adopted policies regarding credit card use?
• Did the District implement policies and procedures that address internal controls over computer data?

Audit Results

District employees did not adhere to District policies regarding credit card use. Maintenance workers and night security employees often did not submit gas card receipts to indicate that charges were valid District obligations and District officials did not monitor gasoline usage. Of 407 gas charges that we reviewed, 58 percent lacked receipts. In addition, the District did not have procedures to monitor credit card use by the Building and Grounds Director, and did not require employees to sign credit card receipts to indicate goods were received at various District locations. We examined six claims containing 14 charges totaling $3,425. Although receipts were attached, there were no signatures to indicate that a District official or employee had received the goods. As a result, there is an increased risk that payments could be made for credit card charges that are not proper District obligations and an increased risk of the loss of District assets.

District officials have not implemented written policies and procedures regarding the District’s computer data systems. The District has insufficient controls over user access and passwords, District officials do not monitor audit trail reports and there is no formal disaster recovery plan. As a result, there is an increased risk of unauthorized access to sensitive information, manipulation of District records and the loss or destruction of data.

Comments of District Officials

The results of our audit and recommendations have been discussed with District officials and their comments, which appear in Appendix A, have been considered in preparing this report. District officials generally agreed with our recommendations and indicated they planned to initiate corrective action.