South Colonie Central School District

Internal Controls Over Selected Financial Activities -
EXECUTIVE SUMMARY

The South Colonie Central School District (District) is governed by the Board of Education (Board) which comprises nine elected members. The Board is responsible for the general management and control of the District’s financial and educational affairs. The Superintendent of Schools (Superintendent) is the chief executive officer of the District and is responsible, along with other administrative staff, for the day-to-day management of the District under the direction of the Board.

The District has appointed a claims auditor to perform the claims processing function. The District also entered into an inter-municipal agreement with the Capital Region Board of Cooperative Educational Services (BOCES) to perform the internal audit function. In addition, the District processes all financial activity on computerized software for payroll, cash disbursements, human resources and general accounting.

Scope and Objective

The objective of our audit was to review internal controls over selected financial activities for the period July 1, 2005 through December 29, 2006. Our audit addressed the following related questions:

• Are internal controls over claims processing adequate and operating effectively to protect District assets against fraud, abuse and professional misconduct?
• Has the District appropriately established the internal audit function?
• Are internal controls over computerized data appropriately designed to adequately safeguard District assets?

Audit Results

We found weaknesses in internal controls over claims processing. The District prepares and signs computer-generated and hand-drawn checks to pay District claims prior to the claims being audited by the claims auditor. The computer-generated checks are not issued until after such audit; however, the sample of hand-drawn checks we reviewed were issued prior to audit. When checks are issued, hand-drawn or otherwise, prior to the performance of a claims audit, there is a significant risk that payments could be made in erroneous amounts, be based on insufficient documentation or be made for other than proper District purposes.

In addition, we found that the BOCES employee serving as the internal auditor is not independent in performing the internal audit function. The District’s current arrangement may put this BOCES employee in the position of evaluating significant District services or programs that are provided by BOCES, the individual’s employer.

We also found weaknesses in internal controls for information technology related to disaster recovery, back-up file storage, user-rights access and audit logs. As a result, there is an increased risk of the loss of computer data as well as the inability to recover computer data in the event of a disaster, and the potential for misuse or alteration of data that could result in the compromise of sensitive information and/or potential financial loss to the District.

Comments of District Officials

The results of our audit and recommendations have been discussed with District officials and their comments, which appear in Appendix A, have been considered in preparing this report. District officials generally agreed with our recommendations and indicated they have already initiated corrective action.