District says it will improve oversight

GLOVERSVILLE – The Gloversville Enlarged School District Board of Education is trying to improve its oversight of financial operations in response to a state audit that said the board failed to exercise adequate oversight for almost two years.

The audit, officially released by the state comptroller’s office Thursday, covered July 1, 2011, to March 31, 2013.

The audit said the district had no audit committee. Although the school board had been established as an audit committee in 2005, the audit said, the members did not perform the required duties.

The audit also stated the district has had no internal audit report since 2010-11 and the district appointed no internal auditor for the 2012-13 school year.

“As a result, the taxpayers do not have adequate assurance that risk is being effectively monitored and that internal-control weaknesses are identified and addressed,” the audit results read.

School board President Richard Carlson said the board has started to address the recommendations from the comptroller’s office.

In the audit, Carlson stated he has been on the board for seven years and was unaware of an audit committee charter.

Carlson said the board appointed an audit committee this summer and it will look into external audits more frequently to ensure their recommendations are followed.

“One of the things we are doing this year that is different from past years is forming these committees,” Carlson said. “We are addressing issues that have been mentioned or recommended in things like the comptroller’s audit or concerns by board members in the past. I think what you are going to be seeing this year is as a board, we are going to be more directly involved and actively involved in all of these processes.”

He said the district will appoint an internal auditor and claims auditor this fall.

The comptroller said in the audit that board members do not audit individual claims and haven’t appointed a claims auditor.

“This was a finding in our prior audit report issued in March 2008, to which district officials responded they would budget for a part-time auditor in 2008-09,” the comptroller wrote. “To date, the board has not appointed a claims auditor.”

As a result, the audit said, none of the 50 claims tested by the comptroller’s office – totaling $967,570 – had been audited.

In addition, the audit said, one claim totaling $48,998 was for a truck that had no documentation to show the purchase was subject to competition.

According to the audit, the board has appointed the assistant superintendent to serve as the district’s purchasing agent, and he said the purchase was made locally for a higher-value truck than what was available on state contract from a vendor outside the area, although district officials provided no documentation to substantiate this assertion.

Five claims totaling $3,317 were for credit card charges in which the credit card company electronically debited payments directly from the district’s bank account, the audit showed.

“Without an active audit committee and a written record of its activity, the board is not providing adequate oversight, and taxpayers do not have adequate assurance that risk is effectively monitored or that the external auditor’s recommendations are, in fact, implemented,” the comptroller’s audit states.

The audit states the board did not adequately design and implement policies over the security of information technology. The audit said because of this, the district does not have a written disaster recovery plan.

“There is an increased risk of loss of computer equipment and data and that unauthorized or inappropriate transactions could occur,” the audit stated.

Carlson said the board is working with IT and business personnel to address the disaster recovery plan.

The comptroller made recommendations to the district, including:

The board should appoint an audit committee annually and enumerate its responsibilities in a charter. The audit committee should ensure there is a written record of its activities, including a review of any risk assessments or corrective action plans, and monitor the implementation of recommendations of external auditors.

The board should ensure the internal audit function is performed and documented.

The board should audit all claims against the district before payment or appoint a claims auditor to do so and ensure all claims are properly supported by itemized invoices and, where applicable, ensure competition has been solicited for purchases.

If the board wants to allow claims to be paid before an audit that are allowable under education law, it should pass a resolution authorizing this action.

The district should not allow third parties, such as a credit card company, to electronically debit its bank accounts to obtain payment, and any electronic payments made should be authorized in each instance by the treasurer or other district official after the board has audited the claim.

The board should adopt a formal written disaster recovery plan.

District officials should assign the treasurer only those user permissions that are essential to the job duties.

District officials should periodically produce and review activity logs for all users in the financial-management system to detect unauthorized or inappropriate transactions and the user who is responsible.

According to the comments from district officials in the audit, the district agreed with the comptroller’s recommendations.

“A majority of these recommendations have already been addressed and a detailed explanation will be provided in the corrective action plan that will be prepared by the Board of Education’s Audit Committee,” the district stated in the audit.

“We were doing most of these things in house, just not in the way they recommended,” Carlson said. “The focus of the whole audit here was to point out that even though we are managing our finances, we’ve got to build things into our process that reduce vulnerabilities. We want to make sure we are doing everything we can to safeguard the public’s investment into the school district.”

The board now has the responsibility to initiate corrective action. A written corrective action plan that addresses the findings and recommendations in the report must be sent to the comptroller’s office within 90 days, which Carlson said will be around December.

“We have an audit committee in place and they have been meeting,” district Superintendent Michael Vanyo said. “We are going to respond to any of the findings in there so that we are making corrections. Those were things we had already started discussing and are working on, and we are just in the process of doing that.”

Vanyo said the school board will be more involved in the finances of the district.