Background

The Webster Central School District (District) is located in the Towns of Webster and Penfield in Monroe County and the Towns of Ontario and Walworth in Wayne County. The District is governed by the Board of Education (Board) which comprises seven elected members. The Board is responsible for the general management and control of the District’s financial and educational affairs. The Superintendent of Schools (Superintendent) is the chief executive officer of the District and is responsible, along with other administrative staff, for the day-to-day management of the District under the direction of the Board.

There are eleven schools and a transportation facility in operation within the District, with approximately 9,000 students and 1,700 employees. The District’s budgeted expenditures for the 2005-06 fiscal year were approximately $116 million, funded primarily with State aid, real property taxes and grants.

The Director of Data Management and Information Processing (IT Director) supervises the District’s Information Technology (IT) Department. Two Co-Coordinators of Technology and several technicians assist the IT Director. The District has approximately 2,800 individual computers and each school has its own local area network (LAN).

Objective

The objective of our audit was to evaluate internal controls over information technology. Our audit addressed the following questions:

• Are physical access controls over the District’s information technology system appropriately designed to protect electronic data?
  
  
• Has the District properly implemented controls over user passwords used to access the computer network?
  
• Has the District properly designed and implemented procedures for recovery of information system data in the event of a loss?

Scope and Methodology

Our initial assessment included evaluations of the following areas: cash receipts and disbursements, purchasing, payroll and personal services, capital assets and consumable inventories, and information technology systems. Based on that evaluation, we determined that controls appeared to be adequate in the financial areas we reviewed. We did determine that risk existed in the area of information technology. Therefore, we examined the internal controls over access to and recovery of information technology for the period July 1, 2005 to August 21, 2006.

We conducted our audit in accordance with generally accepted government auditing standards (GAGAS). More information on such standards and the methodology used in performing this audit are included in Appendix B of this report.

Comments of Districts Officials and Corrective Action

The results of our audit and recommendations have been discussed with District officials and their comments, which appear in Appendix A, have been considered in preparing this report. District officials generally agreed with our recommendations and indicated they planned to initiate corrective action.

The Board has the responsibility to initiate corrective action. Pursuant to Section 35 of the General Municipal Law, Section 2116-a (3)(c) of the Education Law and Section 170.12 of the Regulations of the Commissioner of Education, the Board must approve a corrective action plan that addresses the findings in this report, forward the plan to our office within 90 days, forward a copy of the plan to the Commissioner of Education and make the plan available for public review in the District Clerk’s office. For guidance in preparing the plan of action, the Board should refer to applicable sections in the publication issued by the Office of the State Comptroller entitled Local Government Management Guide.