South Kortright Central School District

Internal Controls Over Selected Financial Activities -
EXECUTIVE SUMMARY

The South Kortright Central School District (District) is governed by the Board of Education (Board) which comprises five elected members. The Board is responsible for the general management and control of the District’s financial and educational affairs. The Superintendent of Schools (Superintendent) is the chief executive officer of the District and is responsible, along with other administrative staff, for the day-to-day management of the District under the direction of the Board.

The Board has the responsibility to appoint a claims auditor in compliance with the Regulations of the Commissioner of Education. The Board and Treasurer have the responsibility to assess the control risks associated with the payroll process and institute appropriate internal controls, including the segregation of job duties to ensure that the work performed by one individual is verified in the normal course of another employee’s regular duties. The District uses one networked computer system to process and store financial and non-financial data,¹ supported by three servers. Financial data is stored on a separate and dedicated server. The Information Technology (IT) administrator oversees the network and is an employee of the Broome-Tioga Board of Cooperative Educational Services.

Scope and Objective

The objective of our audit was to determine if District officials were properly managing District operations to safeguard District assets for the period July 1, 2005 through April 27, 2007. Our audit addressed the following related questions:

• Did the Board appoint a claims auditor in accordance with the Regulations of the Commissioner of Education?
• Did District officials adequately address control risks inherent in the District Treasurer’s duties to ensure that he was accurately accounting for payroll related transactions?
• Did the Board establish comprehensive policies and procedures addressing the safeguarding of computerized data and assets?
  

Audit Results

We question if the Board appointed the claims auditor in compliance with the Regulations of the Commissioner of Education. The principal’s secretary was appointed as the claims auditor for the 2005-06 and 2006-07 fiscal years, which may be prohibited because the principal’s secretary occasionally reported directly to the Superintendent.

We also found the payroll process is not properly segregated. The Treasurer has complete control over the process and full user access rights to the payroll functions in the financial software. The only mitigating control is the certification of payroll by the Superintendent. However, we believe the certification process does not significantly reduce the risk associated with the inadequate segregation of duties.

The Board also has not established comprehensive policies and procedures to sufficiently address the safeguarding of computerized data and assets. Formal policies and procedures for acceptable computer use; addition, modification and deletion of access rights; and a strong password system have not been adopted. District officials have not developed a disaster recovery plan.

Comments of District Officials

The results of our audit and recommendations have been discussed with District officials and their comments, which appear in Appendix A, have been considered in preparing this report. District officials generally agreed with our recommendations and indicated they planned to initiate corrective action.

______________________________________
¹ A networked computer system is two or more computers connected using a telecommunication system for the purpose of communicating and sharing resources. Non-financial data includes such items as student attendance records, grades, and data generated by students and staff.