You are on page 1of 123

OFFICE OF AUDITOR GENERAL

Budget and Revenue Audit
November 14, 2008

Budget and Revenue Audit Index

Report Section

Pages

Executive Summary Conclusion Summary of Recommendations

1 2 3

Observations, Recommendations and Action Plans Policies and Procedures Calculation and Allocation Review Position Management Maintenance Training Budget Presentation Board Communications Budget Changes 4 5 6 7 8 9 10

Budget and Revenue Audit Executive Summary

OBJECTIVE To evaluate the Budget and Revenue operations including the internal control environment, policies, procedures and compliance to determine whether controls are appropriately designed and operating effectively. BACKGROUND The District’s Budget and Revenue Department provides direction and support for the planning, development and implementation of the District’s annual budget. The Department also provides consultation and assistance to District management in preparing, monitoring and amending cost center budgets, preparing monthly financial reports for the Board of Education, and producing budget amendments. The Budget and Revenue Department is also responsible for coordinating, overseeing, protecting and maximizing the District revenues. Starting with the 2009-2010 budget development, the District will be moving toward a site-based budgeting model. As directed by the Superintendent, the District will be moving toward a more transparent budget and place accountability in the schools. The consulting firm of Education Resource Strategies has been hired to support the District in this transition. SCOPE To evaluate the policies, procedures and controls surrounding processes utilized in the development and monitoring of budget changes. We observed operating processes to assess the control environment and evaluated efficiencies. We evaluated the District’s compliance with regulatory requirements; the policies which address significant business control and risk management practices; and the documentation of key activities of the budget cycle, revenue coordination, oversight, protection and maximization. We evaluated the communication process for the annual budget to internal and external parties and the procedures used to monitor the results of operations. Interviews were held with various individuals throughout the District to obtain an understanding of their responsibilities in developing and monitoring the budget process outside of the budget department.

-1-

Budget and Revenue Audit Executive Summary

CONCLUSION The Budget and Revenue Audit revealed the need for improvement in two basic areas. The first and most important area is the development of policies and procedures. Although there are procedures currently in place, they are not written or consistent. Much is assumed regarding the policies and procedures for budget development, monitoring and oversight. Moving from the current budget model to a site-based budget model will be complicated by the fact that policies, procedures, goals, objectives and responsibilities are not concise nor communicated to all involved. These should be developed in order to form a strong alliance among all staff, District and school, as well as strengthen the operating and the control environment. These elements must be identified, agreed upon, documented and executed for the benefit of the District as a whole in order to move forward. Calculations in all areas of budgeting should be revisited to establish correct procedures, allocation methodology and to reduce and eliminate unnecessary steps in the process. Simplification should be considered in order to maintain procedures and allow for a change to site-based budgeting. The second basic area is that of communication. Once policies, procedures, goals, objectives and responsibilities are substantiated in written format, the communication of this information will need to be accomplished. A key component of this communication will be the training of all staff. Training should be developed and given during this transition period as we move to site-based budgeting. Schools do not have a clear understanding of basic budgeting concepts that will apply regardless of the model used. Another key element of communication is providing information to the Board, Superintendent and other end-users through the final annual budget presentation. This has already become a key component as the District begins its’ work with Education Resource Strategies. The immediate charge for the 2009-2010 budget presentation is transparency. Work has begun on creating a clearer view of the budget and a more understandable version of the elements included in the final presentation.

-2-

Budget and Revenue Audit Summary of Recommendations

Rec Audit Recommendations #
Policy and Procedures

1. 2. 3.

Establish a comprehensive operating procedures manual for all aspects of budget operations. Communication of this information as well as the elements to be included should be considered. Re-evaluate the TAPU rate structure to determine a more appropriate allocation and approach for discretionary spending of the schools. Evaluate the process currently in practice to eliminate additional databases other than PeopleSoft. Develop and clarify procedures for the maintenance of position management which would also include input from principals.

Communications 4.
Develop standard training with supporting documentation to be given to all individuals with monitoring and oversight responsibilities. This training should be considered mandatory for all new principals, assistant principals, secretaries, department heads and others new to the budget process. Develop the budget book to follow best practices with the inclusion of budgetary policies, financial planning, operational structure, education initiatives and goals, and related statistical and supplemental data to support in the transition to a more transparent budget process. Develop the mandatory format presented in Section 170.2 of the Commissioner’s Regulations for presentation of revenue received by the Board. Develop procedures and documentation to be distributed and available on SharePoint to all budget monitors. Include in the procedures a communication process to ensure understanding of transfers made by the Budget Department as well as requests made by budget monitors.

5.

6.

7.

-3-

Budget and Revenue Audit Observations, Recommendations and Action Plans
OBSERVATION #1 Policy and Procedures A comprehensive policy and procedures manual does not exist for the operations of the budget department. Written documentation to support procedures, objectives, budgetary policy and job descriptions and responsibilities were not available. It is apparent that individuals within the department are knowledgeable of their responsibilities, but the overall understanding of the department District-wide is not known. Although there are memos and information communicated to the various grant monitors, department heads, chiefs, principals and other individuals during the development of the budget, there is not available documentation to enable all to understand the budget process. Information concerning the entire budget process should be documented and available to all necessary individuals. The manual should include procedures used in developing the budget, responsibilities for budget monitoring and oversight, the budget calendar, explanation of the budget process, budget policies, contingency plans, reporting requirements such as transfer of funds, how to report a change in budget, procedures for monitoring, and other elements. Written and communicated policies and procedures would enhance the accuracy and consistency of the process, facilitate clarity of the process and aid in holding employees responsible and accountable for the monitoring and oversight of the budget process, both within the budget department and with budget monitors throughout the District. A budget procedure and reference manual should be written to include procedures and policies used by the District in creating and maintaining the budget. Consideration should be given to providing this information on Sharepoint and/or on the District website. RECOMMENDATION and MANAGEMENT RESPONSE Establish a comprehensive operating procedures manual for all aspects of budget operations. Communication of this information as well as the elements to be included should be considered. Management Responses: The District is currently undergoing a multi-year financial redesign project with the assistance of Education Resource Strategies. A comprehensive operating procedures manual will be the culmination of elements of this project. The completed manual will include not only procedures, but calendars, forms to be used, accountability information and communication protocol. The completed manual will be available to pertinent staff and will be available electronically through SharePoint or a designated website. Responsibility: John Scanlan, Deputy Superintendent, Administration; Vernon Connors, Budget Director Due Date: September 1, 2009

-4-

Budget and Revenue Audit Observations, Recommendations and Action Plans
OBSERVATION #2 Calculation and Allocation Review Discussions with budget staff and principals indicated a need to re-evaluate the calculation and allocation of the present TAPU money. The calculation goes back to the early 1990s, but since that time, generally a 3 – 5% increase has been added each year. The 08-09 year was increased by 10% by directive of the Superintendent. In testing for reasonableness, it appears that the rate is not reflective of the actual spend rate. Communication from various principals during the audit indicates that understanding the accounts within TAPU and how the dollars should be spent may not be understood by new principals and their secretaries, due to inconsistent training. In reviewing actual spent to the estimated TAPU budget for the past two years it was discovered that most schools under spend this allocation. This further supports the missing element of proper training to principals concerning their fiduciary responsibilities of funding. The TAPU rate was established to allow the principals to have discretionary funding for their schools. As we move toward site-based budgeting this would be an ideal time to re-evaluate the TAPU calculation and allocation. This review and possible change in TAPU spending may release funds and allow for allocation to other services that will have more of an impact on students.

RECOMMENDATION and MANAGEMENT RESPONSE Re-evaluate the TAPU rate structure to determine a more appropriate allocation and approach for discretionary spending of the schools. Management Responses: The structure for discretionary spending at the school level is being re-evaluated through the financial redesign project of the District. Management is currently working with principals to devolve more control of resources to the schools. All rate structures, TAPU and others, are being evaluated, updated and will be documented for the 2009-10 school year and going forward. Responsibility: John Scanlan, Deputy Superintendent, Administration; Vernon Connors, Budget Director Due Date: September 1, 2009

-5-

Budget and Revenue Audit Observations, Recommendations and Action Plans
OBSERVATION #3 Position Management Maintenance The main component of the budget comes from position management. The maintenance of this process is complicated and time-consuming. According to HCI, Budget and an application support specialist, information is maintained in three different sources: Sharepoint, PeopleSoft, and an Excel spreadsheet created from PeopleSoft. Positions are added/ deleted, coding changes, analysis of vacancies and/or extended absences and also salary changes are necessary outside of PeopleSoft in order to create the budget. Reconciliation is a constant process during the creation of the budget. Sharepoint is used as a reference to ensure that information maintained by HCI and Budget is the actual according to the school principals. Changes controlled by budget must be reported to HCI in order for PeopleSoft to reflect the changes necessary. This process continues not only during the development of the budget but also during the budget year. Budget appears to be the control point in maintaining position management accuracy for the District. Understanding that there will be the need for analysis of system data which will be completed outside of the system, there is still the need to reduce the steps taken in maintaining and verifying positions within the District. Consideration should be given to establishing one database maintained by HCI. Queries can be used within PeopleSoft to develop reports for use by principals to verify staffing in their locations. The process should be evaluated to eliminate unnecessary steps and delays in maintaining the PeopleSoft data. RECOMMENDATION and MANAGEMENT RESPONSE Evaluate the process currently in practice to eliminate additional databases other than PeopleSoft. Develop and clarify procedures for the maintenance of position management which would also include input from principals. Management Responses: Efforts are being made to clarify the rules and regulations necessary for the maintenance of position management. This part of the redesign is being conducted by a cross team of individuals which includes input from principals as well as chiefs, Human Capital Initiatives, Finance and Budget. Elimination of duplicate databases will be one of the outcomes of this work. The responsibility of maintenance and accountability of accuracy will be assigned with the establishment of a database. Information from this evaluation and the new formulas will be communicated to necessary staff for the 09-10 budget development. Additional technology investments will be required to allow full integration of the PeopleSoft system. These requirements will be scoped and presented in the next year’s budget but are not planned to be implemented before September of 2009. Management is fully aware of the defects caused by multiple data repositories and is implementing a system of record strategy to identify, manage and maintain key data systems. Responsibility: John Scanlan, Deputy Superintendent, Administration; Vernon Connors, Budget Director Due Date: June 1, 2009

-6-

Budget and Revenue Audit Observations, Recommendations and Action Plans
OBSERVATION #4 Communications Training Through discussions with various budget monitors, principals, department heads and grant monitors, it appears that consistent training has not been made available concerning the entire budget process. Staff in charge of monitoring budgets is at various positions with various levels of understanding. The only formal training that is provided is regarding data entry of budgets into EPM. Other training is given upon request of the principals and department heads by their budget analyst. There is no consistency in the training that is provided and the training only occurs on an as needed basis. Training is provided when necessary for grant funding, but only as needed. Individuals that are expected to monitor and have oversight for the budget should be trained in the protocol that is expected by the District. This should include understanding of funding sources, including grants, items supplied by the District, items to be supplied from TAPU, procedures to be used in the monitoring of funds, etc. This protocol should include the level of school administration that will perform these duties. Training will support a better understanding of the budget procedure and awareness of responsibilities of budget monitors.

RECOMMENDATION and MANAGEMENT RESPONSE Develop standard training with supporting documentation to be given to all individuals with monitoring and oversight responsibilities. This training should be considered mandatory for all new principals, assistant principals, secretaries, department heads and others new to the budget process. Management Responses: Standard training materials will be developed as a part of the financial redesign. The materials will include all aspects of the budgeting process and will clearly define the monitoring and oversight responsibilities. With the new changes in the procedure, training will be mandatory for all principals, department heads and other designated individuals. Responsibility: John Scanlan, Deputy Superintendent, Administration; Vernon Connors, Budget Director Due Date: June 1, 2009

-7-

Budget and Revenue Audit Observations, Recommendations and Action Plans
OBSERVATION #5 Budget Presentation Material The current presentation of the annual budget does not allow for a clear understanding of the District’s financial and educational goals and objectives. The final presentation of the annual budget, when compared to best practices, is lacking in many of the elements found in other school district budgets. The budget book should be inclusive of documents that would enable the reader, whether internally or externally, to understand the financial and educational goals of the District. Best practices include sections that would explain in clear language the budgetary policies of the District, financial planning, operational structure, educational initiatives and goals, as well as statistical and supplemental data to describe the District, with pertinent background information related to the services provided. Following best practices would allow users of the material to better understand our goals and objectives. It would give clarification and alignment of our budget to the stated educational goals, programs and services delivered and accountability to objectives. RECOMMENDATION and MANAGEMENT RESPONSE Develop the budget book to follow best practices, with the inclusion of budgetary policies, financial planning, operational structure, education initiatives and goals, and related statistical and supplemental data to support in the transition to a more transparent budget process. Management Responses: As part of the redesign project, the District has reviewed the documentation of other Districts. For the first year of the multiple year project we are building practices around transparency and incorporating the learning from other Districts and Education Resource Strategies. We have also researched the recommended elements and recommendations set forth by the Government Finance Officers Association (GFOA). It is our plan to submit the District’s budget book for evaluation to the GFOA Distinguished Budget Presentation Awards which promotes improvement in making budget documents clear, understandable, and complete. All aspects of the book are being considered in order to transition to site-based budgeting and also to create transparency in the information presented. Responsibility: John Scanlan, Deputy Superintendent, Administration; Vernon Connors, Budget Director Due Date: June 1, 2009

-8-

Budget and Revenue Audit Observations, Recommendations and Action Plans
OBSERVATION #6 Board Communications Communication to the Board concerning revenue is not in alignment with Education Law. Written policy was not available to support the communication of a change in revenue source to the Superintendent and/or Board. The budget department presents a summary to the Finance Committee throughout the year to show revenue and grant funding. This brief analysis appears to be presented when there is a change (generally an increase) in budgeted revenue. The report shows budgeted revenue and does not provide actual revenue received. According to Section 170.2 of the Commissioner’s Regulations, the Treasurer is to present the Board with the Budget Status Report for each fund at least quarterly; monthly, if transfers are made. It is stated that the regulation and sound fiscal management practices outline the format of the Budget Status Report. It also states that the format is not optional, but mandated. Revenue accounts are to include estimated revenues, amounts received to date of the report and revenues estimated to be received during the balance of the fiscal year. It is also suggested (but not mandatory) that the revenue section should show adjustments to the original estimate, percent of revenue collected for the current year and prior school year’s actual revenues. Improved communications to the Board and Superintendent would create a better understanding of funding sources and cash flow. This information would increase the Board’s understanding of its fiduciary responsibilities. RECOMMENDATION and MANAGEMENT RESPONSE Develop the mandatory format presented in Section 170.2 of the Commissioner’s Regulations for presentation of revenue received by the Board. Management Responses: Management understands the importance of following all regulations and strives to do so. Changes will be made at a later date to facilitate the communication of financial information and to follow regulatory procedure. It is believed that current reporting and the new budget transparency being generated by the redesign project reduces operational risk of this finding and will provide the Board added budget detail in the interim. When the budget redesign has stabilized the additional reporting will be commenced. Responsibility: John Scanlan, Deputy Superintendent, Administration; Vernon Connors, Budget Director Due Date: August 1, 2009

-9-

Budget and Revenue Audit Observations, Recommendations and Action Plans
OBSERVATION #7 Budget Changes It is unclear whether changes made to various budgets are clearly communicated to the appropriate budget monitors. Through discussions with various budget monitors, principals, department heads and grant monitors, it appears that if the budget monitor is reviewing his/her budgets on a monthly basis, that they will notice transfers made to their accounts. Some of these individuals, upon seeing changes, will request information regarding why the change was made. There are others that are not as diligent in reviewing their reports and therefore do not know when changes have been made. There is no consistency in the communication of budget changes or at least a clear understanding of how budget monitors are notified of changes. Any change made to an individual’s budget should be clearly communicated in a form separate from the actual monthly report. This would also include feedback from transfers requested by the budget monitor. As stated previously, budget monitors should be trained and information given in written documentation regarding expectations of their responsibilities and the procedures to follow. Better communications will allow budget monitors to increase their understanding of their responsibilities and to control the spending of their budgets. RECOMMENDATION and MANAGEMENT RESPONSE Develop procedures and documentation to be distributed and available on SharePoint to all budget monitors. Include in the procedures a communication process to ensure understanding of transfers made by the Budget Department as well as requests made by budget monitors. Management Responses: The District is currently evaluating the entire budget process with the support of our consultant, Education Resource Strategies. As we work through the changes that will occur for the 09-10 budget cycle, the documentation of all procedures will be included in the Operating Procedures Manual. Responsibility: John Scanlan, Deputy Superintendent, Administration; Vernon Connors, Budget Director Due Date: June 1, 2009

- 10 -

OFFICE OF AUDITOR GENERAL

Contract for Excellence Audit Report
November 14, 2008

Contract for Excellence Index

Report Section

Pages

Executive Summary

1

Summary of Recommendations

3

Observations, Recommendations and Action Plans Financial Accounting Monitoring Program Costs and Accountability for Outcomes Inconsistent Documentation for Class Size Reduction Improper Coding of Teacher Salary Training of Program Managers Inconsistent Monitoring of Reporting Requirements Overall Monitoring and Oversight of Program Compliance with the Public Process Chancery Data Efficient and Effective Spending of Contract For Excellence Funds 4 5 6 7 8 9 10 12 13 14

CONFIDENTIAL – NOT FOR DISTRIBUTION

Contract for Excellence Executive Summary
OBJECTIVE To evaluate the operating control environment, policies, and compliance procedures in place for utilizing and monitoring Contract for Excellence (C4E) funding. BACKGROUND New York State legislation has established that a school district with at least one school identified as requiring academic progress, in need of improvement, in corrective action, or in restructuring status and receives an increase in Foundation Aid which is at least $15 million or 10% of the previous year’s aid will be required to enter into a Contract for Excellence with the State that will govern how new Foundation Aid funds are to be used. Legislation has established six categories for which the aid must be used. These categories are: class size reduction, pre-kindergarten and full-day kindergarten, middle school and high school restructuring, student time on task, teacher and principal quality initiative, and experimental programs. Funds are to be used to supplement and not supplant previous expenditures. Funds are to be used for either continuation of existing programs, new or expanded programs. The 2007-08 year is to be used as the base year for future reporting. SCOPE We reviewed recording systems used in producing information including manually produced schedules, proprietary software and other desktop tools. We will collaborate with the various key personnel to understand the current control environment. We will then test the operating control environment and the pertinent financial information. We will document any issues noted and identify opportunities for improvement found during our work and issue recommendations to improve the control environment. Management was asked to respond in writing to our recommendations. CONCLUSION The Contract for Excellence (C4E) Audit identified the need for improved oversight, communication, recordkeeping for outcomes and monitoring. Improvements are needed to provide consistent supporting documentation for program outcomes. Considerable work remains necessary to adequately support required financial and program benchmarking requirements for the 2007-08 base year. Unless sound structures are created and put in place, it will be difficult to ascertain the level progress achieved in future years starting in 2008-09 using C4E funds. Documentation standards must exist for Program managers including agreed upon methods for tracking financial information and benchmarking performance by program. Accountability and monitoring for program goals must also occur to reach the desired outcomes. 1 CONFIDENTIAL – NOT FOR DISTRIBUTION

Contract for Excellence Executive Summary
CONCLUSION (Continued) We noted that the District has sufficient technology in place to maintain information required for financial monitoring and program tracking. However, additional efforts toward procedural aspects and standardization of recordkeeping are required to realize these benefits. PeopleSoft, the District’s financial system is capable of financial tracking at a school level. Some C4E programs use PeopleSoft for financial monitoring at the school level, while others are using centralized tracking at a departmental level with manual allocations outside of PeopleSoft. These financial recordkeeping processes should be revisited to ensure the quality and consistency of reporting. Chancery, the District’s student management system is utilized for benchmarking some program goals. We noted that the information contained in the system does not yield consistent valid information for reporting purposes. This was further evidenced by the alternate methods utilized to substantiate student related information that should be readily maintained in Chancery. Efforts should be made to ensure that all individuals involved with Chancery data entry be given specific detailed standards for data entry. Also, Chancery data should be thoroughly reviewed and data inconsistencies corrected. The communication process for C4E is also in need of improvement. Internal communications were not detailed enough to facilitate compliance with various C4E mandates. The public process lacks formalized procedures for open communication and public input, complaints, District response procedures, and clear information regarding programs and the related results. Generally, information is not clear and readily available for public review. C4E for 2007-08 has lacked the proper monitoring and oversight for tracking financial and program goals. Logistically, the implementation strategy for C4E funds is fragmented in such small increments, it is difficult to track spending and achievement of program goals for C4E funds separately from other funding sources for programs. The District plan for program based budgeting can facilitate C4E monitoring, however, to ensure success, program managers, principals, and service providers should be trained to fulfill their responsibilities for compliance with program goals.

2 CONFIDENTIAL – NOT FOR DISTRIBUTION

Contract for Excellence Summary of Recommendations

Recommendations 1 2 3 4 5 6 7 8 9 10 Establish and develop procedures that require ALL Contract for Excellence funds to be tracked by program and by school within the PeopleSoft accounting system. Identify clear responsibility for accuracy of costs and program outcomes and develop procedures to periodically review expenditures for proper alignment with program expectations and compliance with approved costs. Develop a benchmarking system to track the necessary information for 2006-07, 2007-08, 2008-09 forward to support progress against goals for the reduction of class size throughout the District. Develop and establish a procedure to verify the salaries coded to the funding sources. Establish training, with continual support and aid, to ensure that program managers understand the tracking needs and documentation for the programs as part of Contract for Excellence. Establish a District wide calendar to display the due dates for all reporting required by the District. Establish a single point person to oversee all facets of the Contract for Excellence, including monitoring, oversight, training, communication, including the public process, and reporting. Develop and document procedures to comply with the SED requirements for the C4E public process. Perform an extensive analysis to verify the accuracy and validity of data reporting within Chancery. Evaluate funding sources of the District to concentrate C4E spending in programs to facilitate tracking of C4E spending.

3 CONFIDENTIAL – NOT FOR DISTRIBUTION

Contract for Excellence Observations, Recommendations and Management Action Plans
OBSERVATION #1 Financial Accounting The funds designated as Contract for Excellence are not consistently tracked by program and building in the PeopleSoft financial system. In reviewing the Budget or Commitment Control reports it was noted that funds designated as Contract for Excellence are tracked by program, but tracking at the building level is not always captured. Program administrators have a choice of selecting by school (building) or a centralized budgeting process. Centralized budgeting captures the program and codes all expenses to a central department within that program. The responsibility for breaking the transactions into specific schools lies with the program administrator. We are not using the system effectively to ensure proper recording. ALL programs within Contract for Excellence are required to be captured by program and by building. PeopleSoft is sophisticated
enough to track expenses by program and building but it is not utilized to its fullest extent. If the program requires a cost allocation, it would be advantageous to allocate costs through the accounting system. Using the financial system will allow for consistent tracking of costs and help further move the District toward School-based budget accountability. Utilization of PeopleSoft will also eliminate spreadsheets outside of the system and additional work required by the program directors when using the centralized budget option. Costs coded properly will allow for immediate tracking of costs by program and school instead of recreating at the end of the year.

RECOMMENDATIONS and MANAGEMENT RESPONSE
Establish and develop procedures that require ALL Contract for Excellence funds to be tracked by program and by school within the PeopleSoft accounting system.

Management Responses: (Risk Level Assessment: D-II) Although portions of the District’s tracking of C4E programs are completed by the use of spreadsheets this is necessary due to the calculations that are necessary in the use of District-wide allocations. C4E costs are tracked by program and school with the exception of shared costs such as District-wide contractual services, transportation and employee benefits. Contractual services and transportation costs are allocated to the various programs and schools based upon the number of students participating in the programs, while employee benefits are allocated to schools and programs based upon employee staffing and earnings. The NYS Education Department has approved this methodology. The independent audit firm Freed, Maxick & Battaglia certified that our accounting structure meets C4E reporting guidelines in their 2007-08 independent audit of the District. It should be noted that management is evaluating the use of the project costing package for the tracking of all programs.
Responsibility: John Scanlan, Deputy Superintendent, Administration Due Date: No further action necessary

4 CONFIDENTIAL – NOT FOR DISTRIBUTION

Contract for Excellence Observations, Recommendations and Management Action Plans
OBSERVATION #2 Monitoring Program Costs and Accountability for Outcomes Accountability for Contract for Excellence includes both a financial component and programmatic accountability. Documentation is necessary to support the funds spent and the related outcomes. Accountability should be clearly established to ensure that program outcomes and spending are aligned. Guidelines to identify the types of expenses included in the program and monitoring for compliance are necessary. Program directors should participate in establishing the monitoring method(s) used for their respective programs. They also should monitor expenditures based on their knowledge of where and how expenditures are used in the schools in conjunction with principals and teachers. Training and monitoring of program directors is necessary to successfully complete this task. During the audit we noted some costs allocated to C4E that did not appear to be in alignment with program objectives. We were unable to determine the cause for this inconsistency, however regular monitoring should have identified and corrected any misalignment. The role of approving expenditures for programs should also include verification that the costs are in alignment with program goals. Procedures should be developed to periodically review expenditures to ensure that funds are spent in alignment with program expectations. Procedures should also identify responsibility for corrections/adjustments. Program directors, principals, and teachers should be informed of expected expenditures and held accountable for proper spending. A lack of appropriate monitoring could lead to disallowed costs in future periods. RECOMMENDATIONS and MANAGEMENT RESPONSE Identify clear responsibility for accuracy of costs and program outcomes and develop procedures to periodically review expenditures for proper alignment with program expectations and compliance with approved costs. Management Responses: Measurement criteria and outcomes have been established for the various Contract for Excellence programs. This information has been communicated to the appropriate program managers to facilitate monitoring spending and related program outcomes. We will perform training and monitor as necessary throughout the year to ensure consistency and accountability in Contract for Excellence initiatives. Responsibility: Jeanette Silvers, Chief Accountability Officer Due Date: May 1, 2009

5 CONFIDENTIAL – NOT FOR DISTRIBUTION

Contract for Excellence Observations, Recommendations and Management Action Plans
OBSERVATION #3 Inconsistent Documentation for Class Size Reduction Documentation to support the benchmarking of programs was not readily available during the course of the audit for several of the tested programs. This was an existing program at the District that was folded into the Contract for Excellence and accounts for 25% of the funds. Several attempts were made to obtain information to analyze the progress made with these funds. Information required to track progress for this program would include the grade level, the number of classes, the average class size and the number of classroom teachers, support for 2006-07 and 2007-08 for comparative and documentation of reduction. Information should have been readily available from the Chancery system. Working first with IT and then later with Research, Evaluation and Testing, neither department could produce accurate information from Chancery. Research, Evaluation and Testing was able to obtain manually compiled information from the various schools. In addition, historical information is not available due to a system change and a problem with 2006-07 data. The base year for Contract for Excellence is the 2007-08 year. There is an immediate need to establish and document the progress for 2007-08. A method of monitoring and benchmarking information for the past year should be established and be consistent with the information provided in the future years. The information must be monitored to ensure that the number of students in these classrooms does not exceed the K through 12 teacher-student ratio targets prescribed by the Commissioner. RECOMMENDATIONS and MANAGEMENT RESPONSES Develop a benchmarking system to track the necessary information for 2006-07, 2007-08, 2008-09 forward to support progress against goals for the reduction of class size throughout the District. Management Response: We have established a process for tracking progress on the class size reduction initiative. We will maintain analysis to evaluate the annual progress for Contract for Excellence program goals and objectives. Analysis and documentation of the baseline information from the 2007-08 school year has been completed. Now that baseline is completed, the tracking will be ongoing. Responsibility: Jeanette Silvers, Chief Accountability Officer Due Date: May 1, 2009

6 CONFIDENTIAL – NOT FOR DISTRIBUTION

Contract for Excellence Observations, Recommendations and Management Action Plans
OBSERVATION #4 Improper Coding of Teacher Salary In two of the five programs audited it was noted that teachers charged to programs that they did not support. Since this had continued all year it is apparent that there has been no monitoring of actual costs charged to a program throughout the budget year. In one of the programs it was noted that 8 teachers were coded to various schools which neither the program manager nor the lead teacher knew to be a part of the program. This same program was missing 12 teachers that were a part of the program but were not charged to the program. In another program fourth and sixth grade teachers were coded to a program that was for grades K, 1 and 2. Salary coding should be monitored by the program directors on a regular basis. It would be a good practice to monitor employees during defined intervals in the school year. Starting in the 2008-09 school year C4E programs will require the payroll to be certified. This certification will verify that payroll costs have been properly charged to the C4E program and the employee(s) worked on the program during the year. The Certification must be completed by an administrator responsible for supervising the employee performing the service. RECOMMENDATIONS and MANAGEMENT RESPONSES Develop and establish a procedure to verify the salaries coded to the funding sources. The procedure should identify responsibility for proper coding, how often salaries should be reviewed, review procedures, and correction procedures. Management Responses:(Risk Level Assessment: D-II) The District instituted a monthly process to validate staffing charged to C4E programs in 2008-09 as part of the Personnel Activity Reports (PARS) project. Procedures, methodology and responsibilities have been documented, with final adjustments to the process based upon experience to be documented. Responsibility: John Scanlan, Deputy Superintendent, Administration Due Date: Completed

7 CONFIDENTIAL – NOT FOR DISTRIBUTION

Contract for Excellence Observations, Recommendations and Management Action Plans
OBSERVATION #5 Training of Program Managers Discussions were held with various individuals that were responsible for the startup of the 2007-08 Contract for Excellence. The Chief of Staff, Director of Budgeting, and the various chiefs over the programs worked as a team to establish the programs and various components to be included as part of the Contract. Although time was spent to determine how funds would be allocated for the State presentation. We identified little evidence to suggest appropriate leadership and communication throughout the year. Due to the number of individuals responsible for tracking these costs, it is important that everyone be given a clear understanding of funds, established goals, and methods of benchmarking for success, monitoring and oversight of each program. With the changing economic environment at the State, and the accountability required for reporting of Contract for Excellence, this risk may increase. Each person directly and indirectly affected by the Contract for Excellence must understand their role and the importance of accurate and consistent tracking from year to year. Additional and continual training is necessary for this to be accomplished. The training should be a joint effort between financial, technology and program individuals to address that holistic perspective of monitoring and oversight. RECOMMENDATIONS and MANAGEMENT RESPONSES Establish training, with continual support and aid, to ensure that program managers understand the tracking needs and documentation for the programs as part of Contract for Excellence. Management Responses: We will meet with the appropriate Program Managers and other key stakeholders as a group to ensure the documentation requirements are understood and formalized. We will meet with Program Managers on a quarterly basis to ensure that appropriate documentation is maintained to evaluate the programs. Responsibility: Jeanette Silvers, Chief Accountability Officer Due Date: May 1, 2009

8 CONFIDENTIAL – NOT FOR DISTRIBUTION

Contract for Excellence Observations, Recommendations and Management Action Plans
OBSERVATION #6 Inconsistent Monitoring of Reporting Requirements Communication from the State Education Department concerning Contract for Excellence was delayed regarding C4E requirements. Expectations and compliance requirements gave Districts little time to meet deadlines. Several telephone calls were made to administrators on the State level by District management to obtain clarification. It is unclear if future requirements will be communicated in a more clear and timely manner. At the end of our planned fieldwork, we noted on the SED website that a report of our actual expenditures was due September 1, 2008. This information was brought to the attention of the Director of Budget. He was unaware of the reporting requirement. Various communications throughout the year had been provided to Districts and was readily available on the website. Although there was not a significant amount of time to comply with SED expectations, procedures should exist to monitor reporting requirements. Monitoring reporting requirements is important to meet compliance reporting deadlines. This should not be left to one individual. A procedure should be developed to include periodic monitoring of State & Grant requirements, especially of newly created programs. The monitoring procedure should include the development of a centralized calendar that would display all due dates of reports. The calendar should include individuals responsible for completion and oversight. An internal notification system should be developed as a part of this calendar to alert individuals as to the closeness of these dates. RECOMMENDATIONS and MANAGEMENT RESPONSES Establish a District wide calendar to display the due dates of all reporting necessary by the District. This calendar should include responsibility, early notification, a tracking system for completion, and filing. Management Responses: (Risk Level Assessment: D-II) The Office of Administration has developed a calendar that is maintained on a Sharepoint site. The calendar includes the event, due date, and department/person responsible. The calendar will be updated with the most recent Contract for Excellence calendar. Internal due dates have been established to ensure compliance with State requirements. Oversight is conducted by the Comptroller and the Deputy Superintendent of Administration. Responsibility: John Scanlan, Deputy Superintendent, Administration Due Date: June 30, 2009

9 CONFIDENTIAL – NOT FOR DISTRIBUTION

Contract for Excellence Observations, Recommendations and Management Action Plans
OBSERVATION #7 Overall Monitoring and Oversight of Program Our testing identified many inconsistencies in monitoring programs. We noted in some cases, expectations were placed on Budget staff for compliance reporting. Many program managers assumed that the budget director and his staff were maintaining all facets of C4E compliance. The actual expenditure report due at the end of the fiscal year contained many detailed reports and expectations that were not addressed until the end of the year. With the lack of consistent monitoring these reports became overwhelming which increases the risk for reporting errors. It is not clear if the final financial reports are monitored or reviewed for accuracy by anyone other than the Budget Director. The District accountability for C4E funding, which highly stresses accountability, has not been consistent. The testing suggested that all program managers were not closely monitoring and benchmarking the programs. Tracking for programs was scattered among areas, directors, and managers and there is no one central source or contact person that is providing direction for the program compliance of C4E funds. Documentation should be completed to support the financial and program results for 2007-08. This information should be used as a baseline for comparison with 2008-09 tracking and monitoring of C4E funds. This information should be communicated to all participants of the program, including budget, chiefs, program managers, instructors, and principals. Allocation methods, benchmarks, budget reports, evaluation methods, and individuals responsible for each program should be clearly defined and communicated. Procedures should be developed to internally report progress of not only C4E funds, but other funding sources of the District.

10 CONFIDENTIAL – NOT FOR DISTRIBUTION

Contract for Excellence Observations, Recommendations and Management Action Plans
RECOMMENDATIONS and MANAGEMENT RESPONSES Establish a single point person to oversee all facets of the Contract for Excellence, including monitoring, oversight, training, communication, including the public process, and reporting. Management Responses: (Risk Level Assessment: D-IV) Oversight of all facets of the Contract for Excellence is under the direction of the Deputy Superintendent of Administration and the Comptroller. A team has been developed to address the completion of financial and programmatic requirements. This team has been charged with the training of additional program and financial individuals to ensure consistency in the reporting of information to the State. The team consists of key individuals from the Accountability Department that will work with the program portion of the Contract and Budget Department to ensure proper financial reporting. A review process is in place that will allow for review of financial reports submitted by the Budget Director before entry into the State software. A District-wide effort has been started to better monitor and benchmark all programs within the District which will include C4E programs. Documentation and communication of requirements will be documented and communicated to program and financial individuals. Responsibility: John Scanlan, Deputy Superintendent, Administration Due Date: August 31, 2009

11 CONFIDENTIAL – NOT FOR DISTRIBUTION

Contract for Excellence Observations, Recommendations and Management Action Plans
OBSERVATION #8 Compliance with the Public Process The pubic process performed at the District did not align with the recommended dates and requirements from SED. Basic information was recently placed on the RCSD website for the 2008-09 budget. The information lacks sufficient detail to help the reader understand the dynamics of this program. The District has also not established a complaint process, or a procedure for documenting and answering public comments. The District public process should be clearly documented and communicated to the public. The process needs to include information concerning the financial and program benchmarking, description of the programs, input process from the public, compliant process, District response procedures, dates of meetings, and contact individuals. Information should be available our website and procedures followed as stated by SED.

RECOMMENDATIONS and MANAGEMENT RESPONSES Develop and document procedures to comply with the SED requirements for the C4E public process. Management Responses: (Risk Level Assessment: D-II) The NYS Education Department establishes the Contract for Excellence guidelines and calendar for the public input process. Upon completion of the 2009-10 filing with the State the required reports generated from the State software will be loaded to the District website. The District website will also be updated to include the public process for the 2009-10 process which was recently issued by NYSED. Responsibility: John Scanlan, Deputy Superintendent, Administration

Due Date: July 1, 2009

12 CONFIDENTIAL – NOT FOR DISTRIBUTION

Contract for Excellence Observations, Recommendations and Management Action Plans
OBSERVATION #9 Chancery Data Throughout the audit, individuals spoke of the inconsistencies of data maintained in Chancery. This is the system that should be used to support program benchmarks. While trying to verify numbers for Class Size Reduction, reports were requested from Chancery. The reports contained information that did not appear to be valid. An accurate and reliable data system must be available to support student information for programs. Chancery data should be accurate and confidence placed in the reporting from this system to support benchmarking of the District. Individuals should be trained in data entry and receive an understanding of how the information entered is used in reporting. There should be a monitoring procedure in place to verify the reasonableness of the data provided by the system.

RECOMMENDATIONS and MANAGEMENT RESPONSES Perform an extensive analysis to verify the accuracy and validity of data reporting within Chancery. This should include but not limited to the training of individuals for data entry, accuracy, usable reports, consistency of reporting and a monitoring procedure to verify reasonableness. Management Responses: The Office of Accountability has started performing analysis to resolve the data accuracy issues. The implementation of Datacation has allowed the Office of Accountability staff to effectively analyze, identify, and coordinate corrections to Chancery data in the schools. Training and related documentation is being created as needed to facilitate consistent data entry in all District systems. Responsibility: Jeanette Silvers, Chief Accountability Officer Due Date: Ongoing

13 CONFIDENTIAL – NOT FOR DISTRIBUTION

Contract for Excellence Observations, Recommendations and Management Action Plans
OBSERVATION #10 Efficient and Effective Spending of C4E Funds Contract for Excellence requires reporting that identifies funding and related outcomes achieved through the programs funded. It is not clear as to whether a global strategy has been clearly established for C4E. The State requirements directly connect the programs funded with the outcomes achieved. Breaking funding into many small programs and through a variety of schools may not be the most efficient or effective spending of C4E for financial or program benchmarking. Presently, the C4E portion of State Aid is broken into 20 programs and across 57 schools. The funding is to support the neediest students. Spreading the funding across all of our schools and so many different programs may not allow us to show much of a true impact on our student improvement. Tracking in so many different programs and schools is also not cost efficient and allows for many errors and inaccuracies. Management should consider spending the C4E funds across fewer programs and fewer schools. Larger amounts of funding in fewer areas will not only improve tracking and monitoring, but may allow for an increased impact on student improvement in the schools selected for the programs. RECOMMENDATIONS and MANAGEMENT RESPONSES Evaluate funding sources of the District to concentrate C4E spending in programs to facilitate tracking of C4E spending. Management Responses: The Teaching and Learning organization is establishing the global strategies to align programs, including Contract for excellence with classroom instruction. We will evaluate the program outcomes and determine the most productive way to effectively utilize Contract for excellence funding to achieve these desired outcomes. The program analysis is underway and program changes would not likely occur until the next school year. Responsibility: Marilynn Patterson-Grant, Deputy Superintendent, Teaching and Learning Due Date: October 1, 2009

14 CONFIDENTIAL – NOT FOR DISTRIBUTION

OFFICE OF AUDITOR GENERAL

Employee Benefits Audit Report
July 22, 2008

Employee Benefits Index

Report Section

Pages

Executive Summary Objective/Conclusion 2

Summary of Recommendations Observations, Recommendations, and Action Plans Communications Policies and Procedures Oversight Joint Committee Oversight Clarification of the Role of the Superintendent Accuracy and Completeness of Employee Files Inaccurate Entry into PeopleSoft Clarification of Processing Forms Organization of Employee Files Consistency of Information

4

5 6

8 9

10 11 12 13

Employee Benefits Executive Summary
OBJECTIVE To evaluate Employee Benefits including the internal control environment procedures, policies and compliance.

BACKGROUND The Employee Benefits Department is responsible for all benefits offered to employees and retirees of the District. Programs include medical insurance, life insurance, Employee Assistance Program (EAP), Workers’ Compensation plan and short-term disability. They also manage the District’s self-administered Sick Leave options, Catastrophic Leave, and Dental Insurance. Many of these programs are governed by the Internal Revenue Code and related regulations. SCOPE We evaluated the effectiveness of the internal controls, records, and administrative procedures in place for the Benefits Department. The file maintenance, internal reporting and external reporting were evaluated for maintaining accurate information by the District and our thirdparty administrators. Attention was given to the timely reporting of employee life event changes for insurance purposes and the review of all recording systems used in producing information for the various programs which included a query from the PeopleSoft HR module. This audit focused on Medical and Dental Administration, Half-Pay and Catastrophic Leave. CONCLUSION The Employee Benefits Audit revealed the need to improve the communication among Human Capital Initiatives, Employee Benefits, and Payroll to ensure the accuracy of recorded benefits. Improvements are needed in providing consistent supporting documentation for decision making in the approval/denial process for Half-Pay and Catastrophic Leave. Although there are not an excessive number of HalfPay and Catastrophic Leave claims, a legal risk can exist when decisions are not consistent. The legal basis for Half-Pay and Catastrophic Benefits are updated with each renewal of the union contracts, but written procedures and operations are not up to date. Operational procedures used should be reviewed, updated, documented and enforced for all areas of the District. Collaboration is suggested and should include individuals from Human Capital Initiatives, Employee Benefits, Payroll, and Supervisors from the various areas of the District (schools and Central Office).

2

Employee Benefits Executive Summary

CONCLUSION (Continued) The Superintendent’s approval for Catastrophic Leave was delegated to the Chief of Human Capital Initiatives. It is unclear when the delegation occurred and if the current Superintendent wants to continue this practice. Written delegation of authority should be obtained from the current Superintendent. Changes have occurred during this audit to improve the documentation of decisions. Payroll and Employee Benefits have worked together to clarify pertinent information on the Leave Processing Form. Employee medical files have been “cleansed” and organized to allow a better trail for understanding in each case. There is an opportunity to streamline and reduce the quantity of paper maintained in files for documentation. Efficiencies could be created by improving the flow of information and processing time. Improvements are also necessary in the review and payment processes. Information contained in the manual files was not always reflected in the PeopleSoft system. Responsibility for the reconciliation of information is not clear. Our recommendations will improve the completeness and accuracy of information, strengthen existing controls, and create efficiencies in workflow. Health and dental benefits rely on information communicated to and received from third-party administrators. Automated validation procedures have been established to effectively monitor changes in benefit status. Overall, these procedures are adequately controlled and working efficiently. Management is currently working to enhance the verification process for dental administration. At the time of our review this initiative was still in process.

3

Employee Benefits Summary of Recommendations

Recommendations 1 Develop a cohesive workflow to improve employee benefits tracking by establishing a work group of individuals from Employee Benefits, Payroll, Human Capital Initiatives and representatives from school supervision. Design a plan to maximize efficiencies, improve communications and tracking by clearly defining roles, responsibilities and accountability. Develop and implement written policies and procedures documenting all functions and guidelines for half-pay and catastrophic leave. Develop and document the criteria to be used in the Joint Committee decision making. Obtain written documentation for delegation of authority from the Superintendent to the Chief of Human Capital Initiatives for duties stated in contracts. Establish review and reconciliation processes for Half-Pay and Catastrophic Illness Leave benefits. Redesign the Leave Processing Form to clarify responsibility of each department, calculation support, and clarification of information required on the form. Establish documentation and tracking system to be used in the paper files. Revise employee approval letter to clearly communicate the total days of half-pay benefit, approval of days for current event and remaining days of benefit.

2 3 4 5 6 7 8

4

Employee Benefits Observations, Recommendations and Management Action Plans
OBSERVATION #1 Communications Employee Benefits, Human Capital Initiatives, Payroll and Supervisors do not have clearly defined roles. As a result, effective tracking of employee information is lacking. The responsibilities of the areas are not clearly defined or understood by each department which has caused some duplication of efforts, as well as leaving areas exposed for error. While there is communication among the departments, it is not consistent or efficiently designed. This may cause improper paid benefit amounts to be given to employees. It may also lead to additional work in order to recoup funds from employees and/or additional time to investigate discrepancies and correct problems. RECOMMENDATIONS and MANAGEMENT RESPONSE Develop a cohesive workflow to improve employee benefits tracking by establishing a work group of individuals from Employee Benefits, Payroll, Human Capital Initiatives and representatives from school supervision. Design a plan to maximize efficiencies, improve communications and tracking by clearly defining roles, responsibilities and accountability. Management Responses: Representatives from the four work areas will meet to define roles and responsibilities, improve communications, and work toward efficiencies as a comprehensive group. We have already started improvements in our tracking methodology (Reports, BENR017 and BENR131) by the addition of the payroll Supervisor to the distribution list. We plan to establish a joint committee comprised of representatives from Human Capital Initiatives, Employee Benefits, Payroll and lead school secretaries in October to improve communications throughout the benefits flow. Responsibility: Michele Hancock, Chief of Human Capital Initiatives; Nancy Palozzi, Employee Benefits Director Due Date: November 1, 2008

5

Employee Benefits Observations, Recommendations and Management Action Plans
OBSERVATION #2 Policies and Procedures The policies and procedures provided to OAG for the audit included union agreements and SEG Rules and Regulations concerning the granting of Half-Pay and Catastrophic Illness Leave. Procedures for handling these requests were provided by the Employee Benefits Department. Although the union agreements are regularly renewed, the written procedures have not been updated since 1996. The forms used in this process indicated revisions in 2005. The information obtained from these documents is not supportive of the practice that is currently being applied. In both Half-Pay and Catastrophic Illness Leave, it is stated that the Certificate of Personal Illness (CPI) is to be submitted each month to the Payroll Department in order for salary checks to be released. This is not performed. For Catastrophic Illness Leave, once the initial CPI is received, another CPI is not requested until an extension or a second Catastrophic Illness Leave is requested. Half-Pay CPIs are not consistently given to Employee Benefits, although procedures require that they be sent to Employee Benefits each month. During the audit, Elizabeth Cammilleri, Director of Payroll, began documenting the procedures of Half-Pay and Catastrophic Illness Leave from a Payroll perspective. Additional work and collaboration with Employee Benefits is recommended to complete this work. RECOMMENDATIONS and MANAGEMENT RESPONSE Develop and implement written policies and procedures documenting all functions and guidelines. The manual should, at a minimum, include the following: Definition of acceptable Half-Pay and Catastrophic Illness Leave request. Specific requirements for application of requests. Detailed instructions regarding supporting documentation from attending physician, including when and where Certificates of Personal Illness are to be sent. Detailed job responsibilities and duties for all areas involved with Half-Pay and Catastrophic Illness Leave: Employee Benefits, Human Capital Initiatives, Payroll, Supervisors of requesting employee, Joint Committee and the Superintendent. Specific forms to be used in the process. Grievance process.

6

Employee Benefits Observations, Recommendations and Management Action Plans
Management Responses: We have updated the “Absence Request Guidelines” HCI Manual which defines most of our procedures. We have incorporated the responsibilities of Employee Benefits, Joint Committee, Payroll, and HCI for the various processes. As a result of discussion during the audit, we have completed updates for this manual and have incorporated these changes to the Benefits Procedure Manual. We have updated the guidelines and procedures for half pay as well as catastrophic illness leave. We have defined the requirements for ½ Pay and Catastrophic Illness leaves in this “Absence Request Guideline” manual. This manual has been presented to all principals and school secretaries. We have also revised the requirement for the “Attending Physician’s Statement” (CPI) and the approval letters to clarify when a CPI is required. We will continue to update the “Absence Request Guidelines” manual and the “Benefits Procedure Manual”. Responsibility: Michele Hancock, Chief of Human Capital Initiatives; Nancy Palozzi, Employee Benefits Director Due Date: Completed

7

Employee Benefits Observations, Recommendations and Management Action Plans
OBSERVATION #3 Joint Committee Oversight Catastrophic Illness Leave requests are approved based on the prognosis and diagnosis of the attending physician. If the required documentation from the physician states the mental and/or physical capacity of the individual is rated a Class 5 (severe) then the application is approved by the Employee Benefits Director and forwarded to the Chief of Human Capital Initiatives for approval and signature. Requests with conflicting information are generally forwarded to the Joint Committee for decision. The Joint Committee consists of a union representative, Supervisor of employee, Chief of Human Capital Initiatives, and the Employee Benefits Director. Criteria are used to evaluate the information and a decision is made for approval or denial. Each case is evaluated separately and on the merits of the information provided. It was noted that in cases where the request for Catastrophic Illness Leave Pay goes to the Joint Committee, there are no consistent documented guidelines for decision making of this committee. Also, the meetings themselves are not consistently documented to include the attendees, decisions made and the reason for decision. Historical information had to be obtained from conversations with the Employee Benefits Director. Going forward, she will be making notes of these meetings on the email meeting notice. Lack of this documentation could cause the District to be at risk if decisions of the committee were to be challenged. RECOMMENDATIONS and MANAGEMENT RESPONSES Develop and document the criteria to be used in the Joint Committee decision making. This should include the written documentation from each meeting and a confirmation of individuals in attendance, decisions made and outcomes. Management Responses: We began the development and documentation of the Joint Committee decision making process during the course of the audit. Prior to the audit process, the Employee Benefits Director maintained notes and decisions of the Joint Committee meeting, on the email meeting notice. Since that time we have developed a new document entitled “Catastrophic Meeting Approval/Denial” form. This will be used with each case and will be filed with the employee’s request. Responsibility: Michele Hancock, Chief of Human Capital Initiatives; Nancy Palozzi, Employee Benefits Director Due Date: Completed

8

Employee Benefits Observations, Recommendations and Management Action Plans
OBSERVATION #4 Clarification of the Role of the Superintendent During the interview process with the Director of Employee Benefits and the former Chief of Human Resources, it was communicated that the Superintendent approval for Catastrophic Illness Leave cases was delegated to the Chief of Human Resources. Union agreements and the SEG rules and regulations still state that the Superintendent shall convene a joint committee chaired by the Chief of Human Resources to review Catastrophic Illness Leave request and that the committee recommends and the Superintendent approves the illness days. It is unclear when the delegation was established, since there have been three Superintendents in the last two years. It is not clear whether this delegation of authority has been made by the current Superintendent. Documentation of the delegation of authority from the Superintendent to the Chief of Human Capital Initiatives for Catastrophic Illness Leave cases should be documented upon the change of Superintendents and not assumed. Without proper communication and documentation, misunderstandings could occur and authority usurped. RECOMMENDATIONS and RESPONSES: Obtain written documentation for delegation of authority from the Superintendent to the Chief Human Capital Initiatives for duties stated in employee contracts. If it is the intent that the Chief Human Capital Initiatives Officer should maintain these duties, then the language of the contracts should be changed to substantiate the District intent and practice. Management Responses: Michele Hancock is obtaining the Superintendent’s approval of his delegation of authority. Collective Bargaining Agreements currently contain a provision for the Superintendent to convene a joint committee chaired by the (Chief of HCI) to approve the request for catastrophic illness leave. Responsibility: Jean-Claude Brizard, Superintendent; Michele Hancock, Chief of Human Capital Initiatives; Nancy Palozzi, Employee Benefits Director Due Date: November 1, 2008

9

Employee Benefits Observations, Recommendations and Management Action Plans
OBSERVATION #5 Inaccurate Entry into PeopleSoft PeopleSoft documentation for Half-Pay Leave is not consistent with the supporting documentation. It was discovered during testing that the Half-Pay benefit calculated and approved is not consistent with information found in the Payroll System. There were cases found where Employee Benefits had stated that it should be half-pay and the Payroll System stated unpaid illness or a status other than half-pay. This is caused when supervisors do update Time and Labor (PeopleSoft) files when half-pay status is approved. Supervisors often enter the time for employees before it is known that half-pay has been awarded. No one, including Managers, Payroll, or Employee Benefits goes back to review information placed into the system. There should be a review and reconciliation process to ensure that information recorded in the Payroll System for Half-Pay and Catastrophic Illness Leave agrees with benefits approved and paid. Clear and consistent documentation should be kept for all leave benefits. Improper documentation could result in the incorrect payment of benefits to employees. Benefits could be awarded to employees that are no longer eligible for the benefit. RECOMMENDATIONS and MANAGEMENT RESPONSES Establish review and reconciliation procedures for Half-Pay and Catastrophic Illness Leave. Discussion should be held with Payroll, Human Capital Initiatives, Employee Benefits and School Liaison to establish the most efficient way of ensuring correct documentation. Management Responses: Our review and reconciliation process for half-pay and catastrophic recording includes: Automated PeopleSoft reports BENR017 (Catastrophic log) and BENR131 (1/2 Pay log) which run bi-weekly and are distributed to Payroll, Employee Benefits and Human Capital Initiatives. During the audit process, we have added the Payroll Supervisor to the distribution list for these two automated reports. The new Joint Committee (referred to in Observation #1) will define roles and responsibilities of school liaisons ( the time keepers in the schools) Responsibility: Michele Hancock, Chief of Human Capital Initiatives; Nancy Palozzi, Employee Benefits Director Due Date: November 30, 2008

10

Employee Benefits Observations, Recommendations and Management Action Plans
OBSERVATION #6 Clarification of Processing Forms “Request for Payroll Information” forms are initiated by Employee Benefits and completed by Payroll for use in the Half-Pay and Catastrophic Illness Leave processing. These forms establish the last day that Leave Balances are available, the first day to be used for Half-Pay or Catastrophic Illness Leave, and other employee information. The form is confusing and does not clearly establish the responsibility for Employee Benefit and Payroll information. In addition, there are multiple requests received from each employee and there is no indication on the form to identify which request is being referenced. The information is also not reviewed for accuracy. During the course of the audit, Payroll and Employee Benefits have worked together to clarify this form. Information provided by both departments has been segregated for clarity. Clarification is still needed for populating the maximum entitlement line. Information provided on this line needs to be consistent and clearly understood by all participants. Documentation provided on this form should be reviewed for accuracy along with supporting documentation for calculations. Miscalculations of leave entitlement could cause an overpayment or underpayment to an employee. Additional time is required to recover employee overpayments. Additional upfront clarification and review could result in fewer incorrect payments. RECOMMENDATIONS and MANAGEMENT RESPONSES Redesign the Leave Processing Form to clarify responsibility of each department, calculation support, and information required on the form. Management Responses: The form “Request for Payroll Information” has been revised to clarify responsibilities between Payroll and Employee Benefits. The form is broken into two segments: employee information and payroll information. The employee information is completed by the benefits department. Information concerning payroll is completed by the payroll department. Both sections are signed by the individual providing the information. The request is returned to Employee Benefits. Responsibility: Michele Hancock, Chief of Human Capital Initiatives; Nancy Palozzi, Employee Benefits Director; Elizabeth Cammilleri, Director of Payroll Due Date: Completed

11

Employee Benefits Observations, Recommendations and Management Action Plans
OBSERVATION #7 Organization of Employee Files An employee may have several Half-Pay Leave requests during a specified period. When this occurs, documentation including requests for payroll information, approval or denial, and CPI’s must be provided for each incident. Accessing this information in the paper files becomes cumbersome and confusing due to lack of organization and excessive paper kept in files. Multiple copies of the same form and/or handwritten copies sent to word processing are all kept in the file. Some of this paperwork is not necessary for supporting documentation. Paperwork for each incident should be kept together for clarity and documentation of the process per incident. A tracking system should be devised to support multiple requests and the status of each request. Lack of clear documentation and tracking could result in the incorrect approval of additional requests. RECOMMENDATIONS and MANAGEMENT RESPONSES Establish documentation and tracking system to be used in the paper files. Files should maintain only the final, necessary documentation. Additional papers used for typing, etc should be cleansed from the file. Consider the use of a checklist to identify missing documents and a summary sheet to be kept in each Employee File to show the history of requests. Management Responses: We have created a tracking form “Half-Pay Eligibility Worksheet” to be attached to each file. This worksheet establishes the eligibility of the employee by union, years of service, any breaks in service, number of requests, and dates of prior approvals of half pay. The balance(if any) of unused days, from either a previous request or as an extension of an existing disability, will determine the maximum days of eligibility and total days to be approved for this occurrence. The file cleansing began during the audit. Extra copies and unnecessary worksheets were removed from most of the files. Going forward only as updated documentation is received, older copies will be removed from the files. We are creating a checklist to be placed with each file in order to maintain proper documentation and history for each employee file. Responsibility: Michele Hancock, Chief of Human Capital Initiatives; Nancy Palozzi, Employee Benefits Director Due Date: October 1, 2008

12

Employee Benefits Observations, Recommendations and Management Action Plans
OBSERVATION #8 Consistency of Information When employees request Half-Pay Leave, a letter of approval or denial is sent to the employee. This letter generally states the dates of approval as well as the number of days approved. During the audit testing it was noted that the information given to employees concerning their leave was not consistent with recorded information or in reporting information to employees. Some letters indicated only the number of days allowed for the event where in some cases the letter informed them of total days available. In cases where employees have requested extensions, the information given them did not specify remaining days of eligibility. Improving this area would help lessen incorrect approval of Half-Pay Leave benefit to employees as well as improve communications to employees. It would also lessen the chances of employees being overpaid for a benefit and requiring the District extra efforts to recoup funds. Letters to employees should clearly communicate the total number of days available to the employee, the number of days approved as well as the remaining days. This would improve communication to the employee as well as be a review and check point for employee benefits to confirm remaining days of benefit. RECOMMENDATIONS and MANAGEMENT RESPONSES Revise employee approval letter to clearly communicate the total days of Half-Pay Leave benefit, approval of days for current event and remaining days of benefit. Management Responses: The Half-Pay Leave approval letter has been revised to communicate to the employee the number of days granted out of the maximum number of days allowed by the employee’s eligibility. It also includes the date that illness, vacation and personal business days were exhausted and the start and end date of the half-pay sick leave.

Responsibility: Michele Hancock, Chief of Human Capital Initiatives; Nancy Palozzi, Employee Benefits Director Due Date: Completed

13

OFFICE OF AUDITOR GENERAL

Procurement Audit
March 25, 2009

Procurement Audit Index

Report Section

Pages

Executive Summary

2

Summary of Recommendations

4

Observations, Recommendations and Action Plans Policies and Procedures PO Monitoring Documentation Written Quotation Tabulation of Bids Gaps in PO Sequence PeopleSoft Users Commodities Confirming Order 5 7 9 10 11 12 13 14 15

Procurement Audit Executive Summary

OBJECTIVE: To evaluate procurement operations including the internal control environment, procedures, policies and compliance.

BACKGROUND: During calendar year 2008, over 12,000 purchase orders were created totaling in excess of $200 million. The volume of purchasing activity demands that comprehensive policies and procedures be in place and operating effectively to ensure that the District receives the best possible value. Laws exist that govern purchasing in the public sector and all purchase orders made by the District must comply with proper bidding and quotation procedures.

SCOPE: We evaluated Purchasing processes to assess the control environment, as well as to evaluate efficiencies. Purchase orders were selected for testing to determine if the requisition, purchase order and receipt were properly executed, as well as the timeliness of the preparation of the purchase order. The confirming order process was evaluated for reasonableness. Change orders were tested to ensure proper documentation to support the change exists. The approval process was tested to evaluate the effectiveness of workflow. Testing was performed on the competitive bid process and the written quotation process to ensure compliance with General Municipal Law and District policies.

-2-

Procurement Audit Executive Summary

CONCLUSION: The Purchasing Department processes a large volume of purchase orders annually, as well as conduct the competitive bid and request for proposal processes, and administers the P-Card function. With all the areas the Purchasing Department is responsible for, the procurement process has been effectively managed, but there are some areas with needed improvements. The Purchasing Department has standardized processes, but the processes need to be formalized and documented. Although the Purchasing Department has a detailed policy manual; it has not been updated since the implementation of PeopleSoft 8.9, and there is a lack of detailed procedures for the various purchasing functions. Purchase orders are not monitored to ensure completeness of the order as well as to determine which POs have not been received or have residual amounts outstanding. Consistency of documentation within PeopleSoft should be enforced. Details surrounding confirming orders are not reported to the Purchasing Department whose controls are being circumvented. Commodities should be monitored to recognize cost saving opportunities for the District. The policy for obtaining the three written quotes for purchases greater than the established threshold needs to be enforced and evidence needs to be documented. The written quotation thresholds have not been reevaluated to ensure it aligns with the District’s goals and current needs. The tabulation of bids which is used in the competitive bidding process should be verified by an independent person for completeness and accuracy.

-3-

Procurement Audit Summary of Recommendations

Rec #

Audit Recommendations Update the Business Services Procedures and Reference Manual for the Purchasing Department. Complete a department manual which provides detailed procedures of the various Purchasing functions. Implement procedures to identify and close fully spent POs until PeopleSoft is automated to perform this function. Monitor open purchase orders regularly to determine if the remaining PO balances should be released for spending. Develop and implement documentation standards for procurement information maintained in PeopleSoft. Specify information required to support change orders, contract information, bidding and quotes. Enforce the policy of obtaining the three written quotations for purchase orders over the established threshold and document evidence that the written quotations were obtained. If the current procedures are not realistic with the current volume of purchases, consider modifying procedures to better align with business limitations. Establish independent verification procedures to ensure completeness and accuracy of the tabulation of bids prior to the analysis of the lowest bidder. Ensure that Procurement operating procedures do not allow employees to skip PO numbers. Also, develop periodic monitoring procedures to detect skipped PO numbers. If gaps are identified, they should be detected, explained, documented and approved by management certifying that the gap is reasonable. Establish documentation standards and approval to substantiate instances where IM&T personnel have been requested to perform operating functions to resolve a problem. Develop a process to monitor commodities to recognize cost saving opportunities for the District. Consider implementing more specific coding to fully utilize system reporting capabilities. Develop a procedure to inform the Purchasing Department about confirming orders to ensure appropriate vendor relationships are procured.

1. 2. 3. 4. 5. 6. 7. 8. 9.

-4-

Procurement Audit Observations, Recommendations and Action Plans

OBSERVATION #1 Policies and Procedures The Business Services Procedures and Reference Manual for the Purchasing Department has not been updated since November 2006. This manual does not include policy changes since the implementation of PeopleSoft 8.9. The PeopleSoft 8.9 upgrade automated requisitioning, approvals, purchase order preparation and receiving. The desk procedures manual for the various functions in the Purchasing Department also requires completion and updating. A policies and procedures manual for procurement should be complete and up to date to ensure consistent application of procurement procedures. Written and communicated policies and procedures would enhance the accuracy and consistency of recorded data, consistency in the handling and recording of transactions, and aid in holding employees responsible and accountable for the work performed. RECOMMENDATION and MANAGEMENT RESPONSE Update the Business Services Procedures and Reference Manual for the Purchasing Department. The manual should, at a minimum, include: Approval level criteria, Bidding policies and procedures, Quotation policies and procedures, RFP policies and procedures, and Guidelines for purchases below the bidding and quotation thresholds. Management Responses: (Risk Level Assessment: D-III) The risk of poor purchasing management presents low operational and financial risks to the District. Policies and Procedures (Regulations) are being rewritten and expanded as part of a Business Services directive rewrite. This was in process before this audit and will continue until completed. Not only are the procedures and reference manual being revised but desk procedures for each function are being revised. Pertinent procedures will be included in the manual and the desk procedures. Responsibility: Joyce Martelli, Comptroller; Gary Smith, Director of Procurement and Supply Due Date: August 31, 2009

-5-

Procurement Audit Observations, Recommendations and Action Plans

RECOMMENDATION and MANAGEMENT RESPONSE Complete a department manual which provides detailed procedures for the various Purchasing functions including, but not limited to Purchase order preparation, the bidding process, change order processes, instructions for the handling commodities (i.e. direct connect, textbooks) and monitoring procedures. Management Responses: (Risk Level Assessment: D-III) As stated in the response to Observation 1, this presents low operational and financial risks to the District. Purchasing is currently working on revising and expanding the departmental manual to include pertinent procedures. This manual will include the monitoring procedures.

Responsibility: Joyce Martelli, Comptroller; Gary Smith, Director of Procurement and Supply

Due Date: August 31, 2009

-6-

Procurement Audit Observations, Recommendations and Action Plans

OBSERVATION #2 PO Monitoring Monitoring procedures are not in place to determine which purchase orders are outstanding. Open purchase orders can include orders that have not been received and completed orders with dollars remaining on the purchase order. It was noted during our testing that only approximately 600 out of 8,000 POs created this fiscal year have been closed. Management has communicated that a “purchase to pay” project team is working on eliminating this backlog and establishing an automated process to remediate this issue. Also, once a purchase order has been created, they are not monitored to ensure that they have been dispatched or used. During our testing, we observed that there were POs with open and approved statuses that were inadvertently not dispatched. There were POs in a “pending cancel” status which were selected for cancellation, but never finalized or “dispatched” to complete the action. As a result, these orders remained in a “pending cancel” status and funds remained encumbered and were not released for spending. Because purchase orders are not monitored, Purchasing was not aware that these POs were outstanding. Monitoring purchase orders should be performed on a regular basis to ensure completeness of the order, as well as to determine which POs have not been received and/or have residual amounts outstanding. If the PO has a remaining balance, then the unused encumbered funds should be released back into the budget. Monitoring POs will also ensure that the POs are dispatched in a timely manner. Closing POs will assist in expediting the year end closing process.

-7-

Procurement Audit Observations, Recommendations and Action Plans

RECOMMENDATION and MANAGEMENT RESPONSE Implement procedures to identify and close fully spent POs until PeopleSoft is automated to perform this function. Management Responses: (Risk Level Assessment: C-IV) Procedures have been defined and parameters put in place to automatically close purchase orders meeting a certain criteria. The criteria were set as the three-way match of purchase order, receipting and invoice all match completely and a specific timeframe of non-activity. As part of the process for year-end close action the purchasing and accounting departments will review and initiate the close of remaining POs. Included in this process will be the use of a daily report received from MIS showing all POs approved but not dispatched. Moving forward, the review of open purchase orders will be reviewed by the purchasing department on a monthly basis. The procedures for this process will be finalized and documented. Responsibility: Joyce Martelli, Comptroller; Gary Smith, Director of Procurement and Supply Due Date: August 31, 2009 RECOMMENDATION and MANAGEMENT RESPONSE Monitor open purchase orders regularly to determine if the remaining PO balances should be released for spending. Management Responses: (Risk Level Assessment: D-III) Purchasing recently (February 2009) implemented a procedure to “finalize” any purchase order that is created for less than the requisition, which releases the “dangling dollars” back to the requisitioning department’s budget. Additionally, Accounts Payable implemented a procedure to “finalize” and invoices that are less than the line item dollar amount, which releases the “dangling dollars” back to the requisitioning department’s budget. This should resolve this issue moving forward. A monthly close process, which is a goal for 2009-10, will include the monitoring of open purchase orders.

Responsibility: Joyce Martelli, Comptroller; Gary Smith, Director of Procurement and Supply

Due Date: August 31, 2009

-8-

Procurement Audit Observations, Recommendations and Action Plans

OBSERVATION #3 Documentation During the audit, it was noted that information is not consistently documented in PeopleSoft for purchase orders that require quotations, competitive bids, contracts or change orders. Contract numbers were not consistently referenced in the PO, change orders did not always have documentation regarding why the change was being made, and POs that required three written quotes did not consistently have the three quotes attached. Documentation should exist to support the District’s efforts for obtaining the best possible pricing and value. Quotations which are required to be obtained should be attached to the PO in PeopleSoft. If quotes were not obtained or bidding was not performed, then an existing contract should have been used and the contract should be referenced in PeopleSoft. RECOMMENDATION and MANAGEMENT RESPONSE Develop and implement documentation standards for procurement information maintained in PeopleSoft. Specify information required to support change orders, contract information, bidding and quotes. Management Responses: (Risk Level Assessment: D-II) The risk of poor documentation presents low legal and financial risks to the District. For the omissions cited in this audit the staff was able to provide justification in the “header” field of most of the cited documents. Documentation standards for procurement are in place. Procedures are being updated to better maintain the documentation within the PeopleSoft system. As part of our updating of the procedures manual we will be including the documentation standards and their implementation. It is the intent of the District to provide documentation within the system to facilitate the tracking of purchases and to eliminate excessive paper files. Responsibility: Joyce Martelli, Comptroller; Gary Smith, Director of Procurement and Supply Due Date: August 31, 2009

-9-

Procurement Audit Observations, Recommendations and Action Plans

OBSERVATION #4 Written Quotations Per District Policy, three written quotes are to be obtained for any purchase greater than $2,000. It was noted during our testing, although infrequent, evidence of three written quotes were not always obtained. Three written quotations should be obtained for all purchase orders greater than the District’s established threshold. If the purchase is under contract with the District, NYS or Monroe County, the quotes are not required. Written quotations should be obtained for purchases greater than the established threshold to ensure the District is obtaining the best pricing for its purchases. If the current procedures are not realistic with the current volume of purchases, establish policies that would better align within business limitations. RECOMMENDATION and MANAGEMENT RESPONSE Enforce the policy of obtaining the three written quotations for purchase orders over the established threshold and document evidence that the written quotations were obtained. If the current procedures are not realistic with the current volume of purchases, consider modifying procedures to better align with business limitations. Management Responses: (Risk Level Assessment: D-III) It is District policy to obtain three competitive quotes for commodities that are not on contract with costs between $2000 and $9999. Although the audit noted infrequent findings where this was not completed, these were exceptions and not stemming from a repeated concern of following procedures. Management has performed additional training to its staff. Current procedures are realistic and align with business limitations and risk levels. Policies and procedures are evaluated regularly for any necessary changes. Responsibility: Joyce Martelli, Comptroller; Gary Smith, Director of Procurement and Supply Due Date: Completed

- 10 -

Procurement Audit Observations, Recommendations and Action Plans

OBSERVATION #5 Tabulation of Bids The tabulation of bids is prepared by the Purchasing Assistant who then reviews her own tabulation. The Buyer determines the lowest bidder utilizing the tabulation of bids, as well as the actual bids. Although the Buyer does verify numbers, there is not a formalized review of the tabulation of bids by an independent person prior to the determination of the lowest bidder. During the bid testing, it was noted in two instances of the ten contracts tested that there was an omission of a bid on the tabulation of the bids. These omissions would not have created a change in the awarded bid, but should have been included on the tabulation of bids. Per General Municipal Law, the award of a competitive bid should go to the lowest responsible bidder. Omitting bids on the tabulation of bids could cause a vendor who was not really the lowest bidder to get awarded the bid. The tabulation of bids should be reviewed by an independent person to ensure accuracy and completeness. RECOMMENDATION and MANAGEMENT RESPONSE Establish independent verification procedures to ensure completeness and accuracy of the tabulation of bids prior to the analysis of the lowest bidder. Management Responses: (Risk Level Assessment: D-III) Currently bids are publically opened and evaluated by the buyer. Bid tabulations are completed by the Purchasing Assistant. Both the purchasing assistant and the buyer review the tabulations independently of one another. This procedure will be evaluated and any changes will be included in the policy and procedure manual. Responsibility: Joyce Martelli, Comptroller; Gary Smith, Director of Procurement and Supply Due Date: August 31, 2009

- 11 -

Procurement Audit Observations, Recommendations and Action Plans

OBSERVATION #6 Gaps in Purchase Order Sequence Purchase orders are automatically assigned a sequential purchase order number by the PeopleSoft system. While examining purchase orders for the calendar year 2008, it was noted that there were gaps in the purchase order numeric sequence. Although IM&T provided explanations regarding how numbers could be skipped, specific reasons for the gaps in purchase order numbers could not be explained. These gaps were identified by OAG during our audit and neither management nor IM&T were aware that they existed. Operating procedures should be established in Procurement to ensure that staff does not create these gaps while performing daily responsibilities. In addition, periodic monitoring should occur to ensure that gaps in the sequential purchase orders do not exist. In the rare event that gaps are detected, management should evaluate and substantiate specifically as to why the gap exists. All purchase order numbers, which are assigned sequentially, should be accounted for. An audit trail should exist for all purchase order activity. Undetected missing PO numbers allow data integrity concerns that could be the result of inappropriate transactions. RECOMMENDATION and MANAGEMENT RESPONSE Ensure that Procurement operating procedures do not allow employees to skip PO numbers. Also, develop periodic monitoring procedures to detect skipped PO numbers. If gaps are identified, they should be detected, explained, documented and approved by management certifying that the gap is reasonable. Management Responses: (Risk Level Assessment: D-IV) Beginning July 1, 2009 for fiscal year 2009-10, all purchase orders will begin with the four digits 2010xxxxxx (the first PO number will be 2010000001). Fiscal year 2010-11 will begin with 2011xxxxxxx (the first PO number will be 2011000001) and so on in future years. This will allow Purchasing to run queries on not only the status but identify any missing PO numbers. A review will be established of this query including supporting documentation, oversight, and approval process for any missing PO numbers. This information will be included in the procedures manual. Responsibility: Joyce Martelli, Comptroller; Gary Smith, Director of Procurement and Supply; IM&T Due Date: August 31, 2009

- 12 -

Procurement Audit Observations, Recommendations and Action Plans

OBSERVATION #7 PeopleSoft Users During our PO testing, POs were identified that were created by individuals outside of Procurement and Contracts (ICS). We noted while analyzing purchase orders that there were POs that were created by IM&T users. Several POs totaling in excess of $1M were created by IM&T staff. Of significant concern is the fact that a PO was created using the VP1 user ID. The VP1 user ID is the highest level of authority in the system which can allow the user to perform all system functions and if desired actions could be performed without detection. Since VP1 is a generic utility ID, there is no visibility regarding who actually performed the transactions. The VP1 user has complete access of the entire PeopleSoft system and creates a segregation of duties issue. IM&T should not be performing operating processes in PeopleSoft. This ID should not be used to perform any operating functions. If there is a need for IM&T to perform production emergencies, operating management should maintain sufficient documentation including authorization for these types if issues. OAG evaluated all transactions originated by IM&T personal and verified the cancelled checks to ensure that all transactions appeared to be for legitimate existing vendors. RECOMMENDATION and MANAGEMENT RESPONSE Establish documentation standards and approval to substantiate instances where IM&T personnel have been requested to perform operating functions to resolve a problem. Management Responses: (Risk Level Assessment: D-II) The creation of POs by the VP1 user ID existed only in the rollover of information from 2007-08 to the 2008-09 fiscal year. This was completed in order to implement PeopleSoft 8.4 upgrade. Several of the POs needed correction or re-entering due to improper procedures being implemented during the transition period. It is not the normal function of the IM&T staff to perform operating processes. Procedures will be developed to authorize, monitor and document any transaction created by IM&T for emergencies and/or upgrades made to the system which require intervention by the IM&T staff. Responsibility: Joyce Martelli, Comptroller; Gary Smith, Director of Procurement and Supply; IM&T Due Date: August 31, 2009

- 13 -

Procurement Audit Observations, Recommendations and Action Plans

OBSERVATION #8 Commodities Commodities are assigned to buyers in the Purchasing Department. Each buyer is responsible for recognizing potential bidding opportunities for their commodities. Reporting has not been established to facilitate monitoring commodities to help ensure that the District is acquiring contracts to obtain the best pricing for the District. The commodity codes that the District assigns in PeopleSoft are not specific enough to effectively utilize reporting to recognize savings opportunities. The District should be maximizing their cost savings by monitoring commodities to identify potential competitive bidding and contract opportunities.

RECOMMENDATION and MANAGEMENT RESPONSE Develop a process to monitor commodities to recognize cost saving opportunities for the District. Consider implementing more specific coding to fully utilize system reporting capabilities. Management Responses: (Risk Level Assessment: D-III) Since category codes are assigned to particular buyers and requisitions are processed by the buyers that have the greatest knowledge of commodities within the category codes, monitoring of best value and NY Public Law is being affected. To include commodity codes on all purchasing lines (greater than 12,000 purchases orders with an average of 6 lines per order totaling more than 72,000 lines) at this point will not have the return on investment.

Responsibility: Joyce Martelli, Comptroller; Gary Smith, Director of Procurement and Supply Due Date: No further action.

- 14 -

Procurement Audit Observations, Recommendations and Action Plans

OBSERVATION #9 Confirming Orders Confirming orders are a result of invoices received that do not have a corresponding purchase order, but by definition should have. Confirming orders must receive Chief, Comptroller and Legal approval before payment can be made on the invoice. Purchasing is not involved in the confirming order process, nor is Purchasing made aware of the details surrounding a confirming order. Confirming orders circumvent the entire purchase order process which includes quotation and competitive bidding processes. The Purchasing Department should be made aware of confirming orders and they should be reviewed to ensure the District policies regarding quotations and competitive bidding are being adhered to. Per General Municipal Law, purchases greater than $10k must go out for competitive bid. If there are confirming orders that have commodities greater than $10k, then they should have gone out for competitive bid. Awareness of purchases that are not in compliance with District policy and General Municipal Law will allow Purchasing to enforce compliance. RECOMMENDATION and MANAGEMENT RESPONSE Develop a procedure to inform the Purchasing Department about confirming orders to allow Purchasing to enforce compliance with Procurement policies. Management Responses: (Risk Level Assessment: D-III) Confirming orders are reviewed by the Comptroller and Legal for approval. Before presentation to the Comptroller the Accounts Payable staff discusses the lack of compliance with the requisitioner and their supervisor. The requisitioner is educated as to the proper procedure to follow. It should be noted that confirming orders are on the decline from prior years. Additional procedures will be evaluated to ensure that purchasing is included in the process where necessary. Responsibility: Joyce Martelli, Comptroller; Gary Smith, Director of Procurement and Supply Due Date: July 31, 2009

- 15 -

OFFICE OF AUDITOR GENERAL

Procurement Card (P-Card) Audit
June 19, 2008

Procurement Card Index

Report Section

Pages

Executive Summary

1

Summary of Recommendations

2

Observations, Recommendations and Action Plans General Purpose Card User Access in SDOL® Audit Trail for Cardholder Maintenance Terminated Employees Alignment of Data Compliance Security of Account Information Duplicate Payment Manual Process Reconciliations Storage and Record Retention Contracted Vendors Merchant Category Codes

4 5 6 7 8 9 15 16 17 18 20 21 22

Procurement Card Executive Summary
OBJECTIVE To assess the District’s operating control environment for Procurement Card (P-Card) activities and transactions. BACKGROUND The P-Card program allows District cardholders to purchase low dollar value goods and services utilizing a credit card in place of the requisition and purchase order process. Although the employee’s name appears on the P-Card, liability for payment resides with the District. Payment is made through a wire transfer for the full amount of all District P-Cards on a monthly basis. The District implemented the P-Card program in July 2006. In fiscal 2008, over 14,700 transactions were made through the P-Card program and over $1.8 million was spent using P-Cards. These are transactions which would have otherwise gone through the requisition, purchase order, and invoicing process. Using the P-Card saves time and money for the District and its’ employees because it reduces the number of purchase orders and checks issued. The NYS Comptroller recently noted the operating benefits gained through the use of the P-Card. Management is considering increasing utilization of this program for added efficiencies. SCOPE We evaluated controls, policies and procedures surrounding the District’s P-Card program. Cardholders were selected for testing to verify employee status, existence of required forms and agreements, accurate supervisor designation, attendance at P-Card training, agreement between spending limits and authorized documentation. Selected transactions were tested for compliance with District policies. The online system that is utilized for the P-Card program is JPMorgan Chase Smart Data Online (SDOL®). We evaluated user access and authority in SDOL® for reasonableness. Overall reconciliation and monitoring procedures were evaluated for effectiveness. CONCLUSION We identified operating deficiencies in administrative practices including monitoring, reporting, security, and compliance. Control weaknesses exist regarding prohibited transactions, split transactions, and duplicate payments. Additional opportunities exist in defining controls related to segregation of duties, access, audit trails and records retention. The P-Card control environment will be further stressed given the decrease in staffing. Even though the P-Card program has been functioning for several years, increased reliance on this program should only be considered pending remediation of the significant control design and operating deficiencies.

-1-

Procurement Card Summary of Recommendations

Rec # 1. 2. 3. 4.

Audit Recommendations Cancel the P-Card Administrator’s general purchase P-Card immediately. Evaluate and modify the user authority for all user groups able to modify transaction limits. Restrict access to cardholder maintenance for all user groups to the P-Card Administrator and designated back up personnel. Develop a procedure to monitor, approve and retain all the changes to cardholder maintenance in SDOL®. Perform regular monitoring of all cardholders to ensure only active District employees have access to P-Cards. Obtain regular notification of all employee terminations to facilitate the review. Review all cardholder spending limits and supervisor assignments to ensure documentation exists to support what is actually granted in SDOL®. Obtain updated agreements and forms for those with discrepancies. Evaluate the spending limits on a regular basis to ensure reasonableness. Periodically verify that the cost center for cardholders and their related supervisors are accurate. Review and approve all authorizing documentation for the P-Card to ensure accuracy and completeness. Delay the issuance of the P-Card until proper documentation and authorization exists. Monitor the cardholder reconciliations and the Supervisor approval to authorize P-Card purchases. Notify violators who have not performed their review and escalate to the violators’ manager, principal or department head. Trend violations to determine repeat offenders and consider suspension or cancellation of card privileges. Develop and document monitoring procedures for supporting documentation. Determine the ramifications for violators of P-Card policies and consider suspension or cancellation of card privileges. Enforce P-Card Administration receipt requirements to substantiate purchases. Trend violations to determine repeat offenders. Trend and report violations of district policy regarding P-Card purchases to Senior Management. Define tolerance levels for the violation of P-Card procedures. Follow up on violations of P-Card purchases to ensure monies are recouped.

5.

6.

7.

8.

9.

-2-

Procurement Card Summary of Recommendations

Rec #

Audit Recommendations Enforce the policy that split transactions are not allowed and develop written policies for any exceptions that may exist. Trend violations of the split transaction policy. Define disciplinary ramifications for those in violation of the policy. Secure all P-Card account information to help prevent unauthorized use of the P-Cards. Prohibit the payment of invoices utilizing the P-Card and document this limitation in the procedures manual. Monitor for invoice related items paid by the P-Card and ensure that duplicate payments do not exist. Develop a more thorough systematic process for reviewing inappropriate P-Card Transactions. Evaluate automation to facilitate the review process for detecting questionable purchases. Develop a monthly reconciliation process in which the total dollar amount billed for the month equals the total dollar amount in account statements and receipts received. Develop a monthly process where the ACH pay cycle is reconciled to the JPMorgan Chase account statement. Develop a record retention policy defining requirements for P-Card related documentation. Ensure the means of which the District stores its documentation is operational and reliable. Develop and enforce a policy that cardholders should purchase from vendors that are on contract with the District to take full advantage of the contracted savings. Provide P-Card owners with a table of specific contracted vendors that should be used. Obtain a copy of the Merchant Category Code exclusions the District has implemented. Monitor Merchant Category Codes on a regular basis and assess the exclusions for reasonableness and appropriateness for District needs. Retain the analysis for review.

10. 11. 12. 13.

14.

15.

16.

17.

-3-

Procurement Card Observations, Recommendations and Action Plans

OBSERVATION #1 General Purpose Card The P-Card Administrator has a general purpose P-Card for the District. Although this card is not currently activated nor has it ever been used, the P-Card Administrator should not possess a P-Card since the Administrator has the ability to activate the card and utilize it without independent monitoring. This represents a lack of segregation of controls. The P-Card Administrator has the ability to activate and deactivate cards, change spending limits and mark purchases as reviewed, which could circumvent any potential oversight to prevent unauthorized purchases. RECOMMENDATION and MANAGEMENT RESPONSE Cancel the P-Card Administrator’s general purchase P-Card immediately. Management Responses: Completed. It was recommended by legal that we have this card due to upgrade of PeopleSoft 8.4 to 8.9. The system was unusable for more than two weeks in July 2007. This was never used. The card was deactivated and destroyed in June 2008. Responsibility: Brian O’Connor, P-Card Administrator, Gary Smith, Director of Procurement & Supply

Due Date: Completed, June 2008

-4-

Procurement Card Observations, Recommendations and Action Plans
OBSERVATION #2 User Access in Smart Data OnLine (SDOL®) During the audit, we noted inappropriate user access available to user groups assigned in SDOL®. The P-Card Administrator and designated backup personnel should have exclusive authority to request new cards, change spending limits and other cardholder maintenance functions such as the activation or deactivation of cards and modifications to the SDOL® system. All P-Card Supervisors and the P-Card Administrator have the ability to perform cardholder maintenance which includes changing spending limits. These changes can be made, and were made as part of our testing, without the P-Card Administrator’s knowledge. We were able to change one cardholder’s spending limit to $100,000 without any repercussions. JPMorgan Chase does not provide any notification to the P-Card Administrator when spending limits are increased. The potential exists for a P-Card Supervisor to provide a cardholder with spending limits that are in excess of the desired card monitoring controls. It also allows a Supervisor to avoid the scrutiny of the normal purchasing process for spending that exceeds planned low dollar value purchases. Prior to completion of the P-Card Audit, the company administrator (info only) user authority was changed to “print only” after the PCard Administrator was informed of the excessive access, but the P-Card Supervisor role still maintains unnecessary access which is inappropriate based on their responsibilities. RECOMMENDATION and MANAGEMENT RESPONSE Evaluate the user authority for all user groups able to modify transaction limits and modify access as deemed necessary. Restrict access to cardholder maintenance for all user groups to the P-Card Administrator and designated back up personnel. Management Responses: Agree with this finding. This was possible due to incorrect set-up within JP Morgan SmartData by P-Card Administrator. The ability to change the cardholders spending limit by the cardholder was corrected as soon as this became known. The ability to correct the ability of the Supervisor to change spending limits will be completed by November 30. Responsibility: Brian O’Connor, P-Card Administrator, Gary Smith, Director of Procurement & Supply Due Date: November 30, 2008

-5-

Procurement Card Observations, Recommendations and Action Plans
OBSERVATION #3 Audit Trail for Cardholder Maintenance The Smart Data OnLine (SDOL) ® cardholder maintenance function includes changes to all cardholder information including cardholder’s personal information, spending limits, location of cardholder, P-Card deactivation and new card requests. These changes to cardholder maintenance are not monitored or approved, nor are they retained for future reference. The audit trail in SDOL® for cardholder maintenance is available for only the last 90 days online. An audit trail should be available for all changes to cardholder information that can be reviewed as needed. Visibility to changes made to cardholder maintenance enables oversight and minimizes the likelihood of unauthorized changes. RECOMMENDATION and MANAGEMENT RESPONSE Develop a procedure to monitor and approve the changes to cardholder maintenance in SDOL®, at least quarterly to compensate for the limited 90 day audit trail period. Retain all changes and approvals of changes to cardholder maintenance in SDOL®. Management Responses: There is an Audit Summary in JP Morgan Chase that provides a summary of account maintenance requests for up to a 30-day period. The last 90 days are available but we can only view 30 days at a time. The Director of Purchasing has investigated this report and is requesting it be run monthly to review all maintenance including changes to cardholders. This will be reviewed and filed. Responsibility: Gary Smith, Director of Procurement & Supply Due Date: January 31, 2009

-6-

Procurement Card Observations, Recommendations and Action Plans
OBSERVATION #4 Terminated Employees There is a lack of assurance that terminated employees’ P-Cards are deactivated. A policy exists where an employee must cut their card in half and return it to their P-Card Supervisor upon termination of employment or in the event of a job transfer. The P-Card Supervisor is responsible for submitting this cut card to the P-Card Administrator with a memo requesting deactivation. The P-Card Administrator is responsible for deactivating the cardholder’s account in SDOL®. There are no procedures in place to ensure that all terminated employees have turned in their card or that all cardholders are active employees at the proper job location. A procedure should be in place to ensure there are no terminated employees with access to PCards. This should include notification to the P-Card Administrator of cardholders who have ceased employment with the District. Without having assurance that all terminated employees have turned in their P-Card, the District runs the risk of terminated employees making unauthorized purchases which could go undetected. RECOMMENDATION and MANAGEMENT RESPONSE Perform regular monitoring of all cardholders to ensure only active District employees have access to P-Cards. Obtain regular notification of all employee terminations to facilitate the review. Management Responses: Purchasing receives reports from Payroll that do not quite meet the needs required. Research has already been done by the new P-Card Administrator on reports that are available or can be developed from Payroll and Budget listing termination of employees. Additionally the P-Card Administrator will work with Human Capital Initiative to encourage a system where a record may be kept on file so that immediate notification of termination can be sent to the P-Card Administrator. The P-Card Administrator will then inactivate the terminated employee’s P-Card as soon as information is available. Responsibility: Brian O’Connor, P-Card Administrator, Gary Smith, Director of Procurement & Supply Due Date: January 31, 2009

-7-

Procurement Card Observations, Recommendations and Action Plans
OBSERVATION #5 Alignment of Data Information in cardholder files did not align with the information in Smart Data OnLine®. The information in SDOL® should be supported by the information in the cardholder’s files to ensure proper authorization and accuracy of approved assignments and limits. There were many occurrences in which the P-Card Supervisor assigned when the P-Card was initiated did not align with the P-Card Supervisor that was assigned in SDOL®. There were also instances where the spending limit recorded in the cardholder file did not agree with the actual spending limit the cardholder maintained in SDOL®. The availability of a report to assist in the monitoring of spending limits of all cardholders is not readily available in SDOL®. The spending limits and supervisor assignments agreed upon at inception of the card should coincide with the actual available limit and supervisor assignment. If there is a change in either the spending limit or the assignment of a P-Card supervisor, that change should be documented and maintained in the cardholder file for future reference. Spending and transaction limits should be regularly monitored to ensure reasonableness. Without proper review and documentation of spending limits and supervisor assignments, the risk of overspending by the cardholder exists. RECOMMENDATION and MANAGEMENT RESPONSE Review all cardholder spending limits and supervisor assignments to ensure documentation exists to support what is actually granted in SDOL®. Obtain updated agreements and forms for those with discrepancies. Evaluate the spending limits on a regular basis to ensure reasonableness and consider obtaining an annual acknowledgement for all supervisors’ responsibility for cardholders. In addition, periodically verify that the cost center for cardholders and their related supervisors are accurate. Management Responses: Purchasing has kept files on all P-Card holders and supervisors since the inception of the program. The paperwork is nearly all in order. The P-Card Administrator will make this a project to review all files of current cardholders and supervisors to make sure the paperwork is in order. Any universal changes made to system records will be kept in a master file documenting the date and nature of the change. Individual changes made to any profile will be documented in the cardholders existing file. Responsibility: Brian O’Connor, P-Card Administrator, Gary Smith, Director of Procurement & Supply Due Date: January 31, 2009

-8-

Procurement Card Observations, Recommendations and Action Plans
OBSERVATION #6 Compliance Forms and Agreements During testing of cardholder files it was noted that required forms and agreements were not always properly executed. Some of the documentation required for obtaining a P-Card where incomplete or improperly completed. The following is a list of issues noted in our sample selected for testing: Missing required forms and signatures (from department head/principal) Incorrect signature on the P-Card Supervisor agreement (in some instances the cardholder signed this form) Instance where one individual recommended self for card Updated forms for changes in P-Card Supervisor were not completed P-Card Designation of Key Personnel form was not always completed by the P-Card Administrator (card approval section) causing a lack of documentation of P-Card Administrator review and approval of P-Card Incomplete forms Missing or incomplete authorization documentation creates the risk for possible inappropriate issuance or misuse of P-Cards. All forms should be included in the cardholders’ files, with all pertinent information completed including the existence of all required signatures. These forms should be updated for any changes. The P-Card Administrator should complete the P-Card Designation of Key Personnel form to provide documentation of the review and approval of the P-Card. RECOMMENDATION and MANAGEMENT RESPONSE Review and approve all authorizing documentation for the P-Card to ensure accuracy and completeness. Delay the issuance of the P-Card until proper documentation and authorization exists. Management Responses: Purchasing has kept files on all P-Card holders and supervisors since the inception of the program. The paperwork is nearly all in order. The P-Card Administrator will make this a project to review all files of current cardholders and supervisors to make sure the paperwork is in order. P-Cards will not be issued unless proper paperwork is completed. Moving forward all files will have proper paperwork and file information should match authority granted in the system. Responsibility: Brian O’Connor, P-Card Administrator, Gary Smith, Director of Procurement & Supply Due Date: March 31, 2009

-9-

Procurement Card Observations, Recommendations and Action Plans
OBSERVATION #7 Cardholder Reconciliation and P-Card Supervisor Approval A lack of enforcement for the cardholder reconciliation and P-Card Supervisor review and approval exists. During audit testing, it was noted that many cardholders were not current on their reconciliation between the bank statement and SDOL®. It was also noted that P-Card Supervisors were behind on their approval of their assigned cardholder’s purchases. There does not appear to be any procedures in place to monitor or enforce the P-Card Supervisor review. All cardholder reconciliations and Supervisor approval of purchases are, required to be completed by the 12th of every month. The PCard Receipt Reviewer is responsible for ensuring the P-Card reconciliation is completed prior to posting all charges to the general ledger and must notify the cardholder regarding the violation of reconciliation procedures. Delinquency of cardholder reconciliation and P-Card Supervisor review and approval may cause inappropriate purchases to go undetected, potential account misclassifications and possible lapse in time for disputed purchases. JPMorgan Chase only allows 60 days for the notification of disputes. After that point, the District must assume responsibility for handling disputed items. RECOMMENDATION and MANAGEMENT RESPONSE Monitor the cardholder reconciliations and the Supervisor approval for authorizing P-Card purchases. Notify violators who have not performed their review and escalate to the violators’ manager, principal or department head. Trend violations to determine repeat offenders and consider suspension or cancellation of card privileges. Management Responses: This procedure will be reviewed. There are automatic emails in place to remind cardholders and supervisors of their responsibilities. The P-Card Administrator will review this process and set up metrics and monthly summaries that are consistent with procedure. Regarding non-compliance, this is from the P-Card manual (revised 11/08) as follows:: XV. VIOLATIONS OF PROCEDURES AND CONSEQUENCES A. Violations Violations of procedures shall be defined as: Proof of Purchase Documentation Failure of the Cardholder to provide the Proof of Purchase Documentation as required in Section XII A.

- 10 -

Procurement Card Observations, Recommendations and Action Plans
Reconciliation Procedures Failure of either the Cardholder or the P-Card Supervisor to complete reconciliation in Smart Data OnLine® (SDOL®) by the 12th of each month. Unauthorized / Unofficial Use Unauthorized or Unofficial use of the P-Card by the Cardholder or use of the P-Card by persons other than the Cardholder B. Consequences Consequences for violating P-Card procedures, depending on the severity, intent and/or repetition of violations, are: Personal liability for full amount to the District. Immediate suspension or cancellation of card privileges as deemed appropriate by the P-Card Administrator. Disciplinary action under applicable District administrative procedures. Suspension of card privileges until Cardholder attends a remedial training session. In Order to reactivate a suspended card or to reissue a new card that has been cancelled one must: First Offense – To the P-Card Administrator submits all outstanding receipts and obtains written permission from one’s supervisor. Second Offense - To the P-Card Administrator submits all outstanding receipts and obtains written permission from one’s supervisor and his/her chief. Third Offense - To the P-Card Administrator submits all outstanding receipts and obtains written permission from one’s Supervisor, his/her Chief and the Superintendent of Schools. NOTE: At anytime when Fraud is determined to exist, the District will prosecute to the fullest extent of the law. Responsibility: Brian O’Connor, P-Card Administrator, Gary Smith, Director of Procurement & Supply Due Date: March 31, 2009

- 11 -

Procurement Card Observations, Recommendations and Action Plans
OBSERVATION #8 Supporting Documentation According to the P-Card procedures manual, the original itemized sales receipt must be submitted to the P-Card Administration for all P-Card transactions. P-Card Administration is responsible for ensuring all sales receipts are provided and attached to the account statement for each cardholder and is to notify the cardholder of violation of proof of purchase documentation. P-Card Administration’s follow up requests were not retained; therefore it was difficult to verify that monitoring exists. Delinquent receipt of account statements and supporting documentation are not being trended to determine frequent violators. It was noted during audit testing that some of the supporting documentation received for P-Card purchases was missing or unsuitable. In the sample of transactions tested for our audit, we noted a packing slip, a non-itemized receipt, a partial receipt, and a photocopied receipt was provided and accepted as supporting documentation. In some cases, no receipt was provided. The original itemized sales receipt should be provided for all P-Card purchases. P-Card Administration should be contacting the cardholder to obtain the acceptable form of documentation. Follow up requests for supporting documentation should be retained. Violations of policy should be trended to determine repeat offenders. Failure to obtain original itemized receipts for P-Card purchases could result in the purchase of items which are prohibited by the District and could potentially go undetected. RECOMMENDATION and MANAGEMENT RESPONSE Develop and document monitoring procedures for supporting documentation. Determine the ramifications for violators of P-Card policies and consider suspension or cancellation of card privileges. Enforce P-Card Administration receipt requirements to substantiate purchases. Trend violations to determine repeat offenders. Management Responses: This procedure will be reviewed. There are automatic emails in place to remind cardholders and supervisors of their responsibilities. P-Card Administrator will review to set up process that is consistent with procedure. See Observation #7. Responsibility: Brian O’Connor, P-Card Administrator, Gary Smith, Director of Procurement & Supply Due Date: March 31, 2009

- 12 -

Procurement Card Observations, Recommendations and Action Plans
OBSERVATION #9 Prohibited Transactions Purchases are being made with P-Cards which do not follow District policy. Included in the P-Card procedures manual is a prohibited list of vendors and uses of the P-Card. During our audit testing, we noted there were purchases made to prohibited vendors including wholesale clubs, Staples retail store and other office supply stores which are all on the prohibited vendor and uses list. Under no circumstances should a cardholder make a purchase using the P-Card for any of the prohibited vendors or uses as defined in the PCard procedures manual. These purchases should be made through the purchasing process. It was also noted that not all P-Card purchases made were tax exempt. Sales tax should not be charged to the District. Any sales tax charged should be promptly refunded back to the cardholder’s account. There were some instances in which the sales tax was questioned by the P-Card Transaction Reviewer and the cardholder was instructed to obtain a credit for the tax, but the credit for the tax was never received. There is no trending regarding the prohibited uses of the P-Card to identify frequent abusers nor is there any follow through for remediation. Also, there are no defined tolerance levels regarding violations of District policy. This information could aid in determining the appropriate consequences for violating the District’s P-Card procedures. There should be a clearly defined policy regarding tolerance levels for violations of P-Card policy. Not following District policy regarding P-Card purchases could result in violations of awarded bids and the District not getting preferred pricing. RECOMMENDATION and MANAGEMENT RESPONSE Trend and report violations of district policy regarding P-Card purchases to Senior Management. Define tolerance levels for the violation of P-Card procedures. Follow up on violations of P-Card purchases to ensure monies are recouped, as appropriate. Management Responses: There is weekly monitoring of P-Card transactions by Purchasing (Sr. Buyer) and email notifications are sent to P-Card holders for explanation and action to correct a transaction that may not adhere to policy. Metrics and reports will be reviewed to monitor trending. P-Card Administrator will notify Supervisors of frequent offenders and implement appropriate consequences. Responsibility: John Burke, Sr. Buyer, Gary Smith, Director of Procurement & Supply Due Date: January 31, 2009

- 13 -

Procurement Card Observations, Recommendations and Action Plans
OBSERVATION #10 Split Transactions Split transactions were made using the P-Card to circumvent spending limit controls. Under no circumstances should a purchase be split into multiple transactions to avoid spending limit controls. Specific purchases that are in excess of the established spending limits should be acquired through the traditional purchasing process. As part of the P-Card Transaction Reviewer’s job responsibilities, split transactions should be identified weekly and the cardholder should be questioned. Based on the testing performed, it was determined that not all split transactions were questioned. It was noted during the audit that split transactions have been allowed for Staples and Grainger because secretaries are making purchases for multiple teachers at these vendors and because they are contracted Direct Connect vendors. This policy is not in writing. Allowing exceptions to policies without documenting those exceptions circumvents compliance with documented procedures. RECOMMENDATION and MANAGEMENT RESPONSE Enforce the policy that split transactions are not allowed and develop written policies for any exceptions that may exist. Trend violations of the split transaction policy. Define disciplinary ramifications for those in violation of the policy. Management Responses: There is weekly monitoring of P-Card transactions by Purchasing and email notification is sent to P-Card holders for explanation and action to correct a transaction that may not adhere to policy. Several P-Card holders have had their card deactivated due to splitting of transactions. The Purchasing manual will be updated to clarify the acceptable usage for Staples and Grainger. Responsibility: Brian O’Connor, P-Card Administrator, Gary Smith, Director of Procurement & Supply Due Date: January 31, 2009

- 14 -

Procurement Card Observations, Recommendations and Action Plans
OBSERVATION #11 Security of Account Information It was observed during our audit testing that P-Card statements are kept unlocked at the P-Card Receipt Reviewer’s desk in a box or on the desk. This purchasing area is not secured and account information and expiration dates could be obtained by unauthorized parties. All P-Card account data should be locked in a secure location with access only given to appropriate personnel. Without securing account data, including account numbers and expiration dates, purchases could be made to the P-Card by unauthorized users. This includes online purchases or purchases over the phone where the physical card isn’t needed. RECOMMENDATION and MANAGEMENT RESPONSE Secure all P-Card account information to help prevent unauthorized use of the P-Cards. Management Responses: This is not a high risk as not all numbers are exposed (i.e. expiration date, security code). With the renovation on the 1st floor - better security will be afforded Purchasing and the P-Card Administration area. Statements will be locked on a nightly basis. Responsibility: Brian O’Connor, P-Card Administrator, Gary Smith, Director of Procurement & Supply Due Date: November 30, 2008

- 15 -

Procurement Card Observations, Recommendations and Action Plans
OBSERVATION #12 Duplicate Payment Inappropriate use of a P-Card to pay an invoice caused a duplicate payment to be made. An invoice was paid with a P-Card, but this invoice had actually already been paid by a check through the accounts payable process prior to the P-Card payment. There is no written policy in the P-Card procedures manual that prohibits the payment of invoices with the P-Card. Purchases made by P-Card should be for only those items included on the allowable items list in the P-Card procedures manual. All payments of invoices should only be made through the accounts payable process. Payment of invoices with the P-Card could cause duplicate payments to be made by both P-Card and AP. RECOMMENDATION and MANAGEMENT RESPONSE Prohibit the payment of invoices utilizing the P-Card and document this limitation in the procedures manual. Monitor for invoice related items paid by the P-Card and ensure that duplicate payments do not exist. Obtain a credit for the duplicate payment identified above. Management Responses: To the knowledge of Purchasing this has happened only once with more than 20,000 transactions. It is common legal practice that a vendor not invoice when receiving payment via credit card. This is as much an A/P and cardholder issue to not pay on claims voucher if a P-Card has been used for a particular transaction. The P-Card manual has been updated to indicate improper use to pay an invoice and is a part of the training. The one transaction ($13.85) that was double paid by the P-Card and check is under investigation. Responsibility: Cerri Cupples, Supervisor of Accounting, Gary Smith, Director of Procurement & Supply Due Date: March 31, 2009

- 16 -

Procurement Card Observations, Recommendations and Action Plans
OBSERVATION #13 Manual Process The transaction review process is manual and exception reporting is not available, nor does the capability for the downloading of information exist. The P-Card Transaction Reviewer is responsible for reviewing all P-Card transactions and inquires about the nature of any purchase that appears questionable. This is a manual process with no ability to download information to perform analytical review. There is no exception reporting available to help ensure all potential violations are identified. Although many of the purchases that were tested during our audit were questioned by the P-Card Transaction Reviewer, there were some prohibited or questionable transactions that were not addressed. The P-Card Transaction Reviewer is responsible for reviewing all P-Card transactions and should inquire about the nature of any purchases that appear unusual. Inadequate reporting exists to manage the P-Card program. Exception reporting and download capabilities would assist in the analysis of P-Card transactions. The current manual transaction review process increases the chances of missing potential prohibited transactions. RECOMMENDATION and MANAGEMENT RESPONSE Develop a more thorough systematic process for reviewing inappropriate P-Card Transactions. Evaluate automation to facilitate the review process for detecting questionable purchases. Management Responses: The Sr. Buyer (P-Card Transaction Reviewer) does review all transactions on a weekly basis and send emails if it appears there may be a transaction the goes against policy. This will continue. Purchasing is taking action to benchmark what other municipalities do to monitor transactions and will evaluate the need to change the process. Responsibility: Brian O’Connor, P-Card Administrator, Gary Smith, Director of Procurement & Supply Due Date: January 31, 2009

- 17 -

Procurement Card Observations, Recommendations and Action Plans
OBSERVATION #14 Reconciliations Reconciliation procedures and practices to ensure completeness and accuracy are lacking throughout the P-Card process which results in ineffective monitoring. Reconciliation is performed between the account statement and the JPMorgan Chase file feed by the Accounts Payable Supervisor. This reconciliation includes verifying the dollar balance on the JPMorgan file feed to the balance on the JPMorgan account statement. The Accounts Payable Supervisor also verifies the J.P. Morgan file feed to the billing cycle total the P-Card Transaction Reviewer provides. No documentation exists for either of these reconciliations. The District’s ACH pay cycle is not reconciled to the JPMorgan file feed to ensure completeness. The monthly cardholder report the P-Card Receipt Reviewer utilizes to ensure all cardholders have turned in their account statement and receipts is not reconciled to the billing total that is submitted to Accounts Payable. Therefore, there is a lack of assurance that the account statements received equal the billing cycle total. It came to our attention that the report the P-Card Receipt Reviewer was utilizing to track the statements received was not all inclusive because it did not include all cardholders with activity in that month. A monthly reconciliation between this report and the total the P-Card Transaction Reviewer obtains would have ensured completeness of the report the P-Card Receipt Reviewer was utilizing. In this situation, because comprehensive reconciliation controls were not in place, management was not able to discern that all account statements were being received, ultimately creating a false sense of assurance. RECOMMENDATION and MANAGEMENT RESPONSE Develop a monthly reconciliation process in which the total dollar amount billed for the month equals the total dollar amount in account statements and receipts received. Develop a monthly process where the ACH pay cycle is reconciled to the JPMorgan Chase account statement. Management Responses: Accounts Payable maintains the back-end portion of P-Card processing, as the dollar amount/transactions uploaded into PeopleSoft from the JPMorgan Chase file feed are compared to the amount of the JPMorgan Chase account statement. P-Card transactions are not posted to the general ledger until the transactions uploaded are reviewed by the Accounts Payable Supervisor who ensures the vouchers have cleared the budget check and document tolerance system process. This review is completed using the PeopleSoft queries RCSD_BUDGET_LINE_ERROR_PCARD and RCSD_RECYCLED_VOUCHERS.

- 18 -

Procurement Card Observations, Recommendations and Action Plans

The Accounts Payable Supervisor then reconciles the P-Card transactions to the JPMorgan Chase account statement before the ACH pay cycle is created by comparing the ACH payment selection/pay cycle details to the JPMorgan Chase account statement. A P-Card reconciliation coversheet is prepared showing the total of the ACH pay cycle which equals the amount on the JPMorgan Chase account statement. A payment register report for the ACH pay cycle is also created for supportive documentation for the P-Card reconciliation. The Director of Purchasing and P-Card Administrator has communicated with JPMorgan Chase to write a report that will be used to track any variances in terms of dollars spent and number of cardholder users each month. This will be reviewed and filed. There will be a monthly reconciliation to the JP Morgan chase reports matching cardholders and dollars. Variances will be tracked. Responsibility: Brian O’Connor, P-Card Administrator, Cerri Cupples, Supervisor of Accounting Due Date: March 31, 2009

- 19 -

Procurement Card Observations, Recommendations and Action Plans
OBSERVATION #15 Storage and Record Retention The District lacks a record retention policy for P-Card documentation. This information has been kept indefinitely on microfiche, which is not a current or efficient form of data storage. The scanner to the microfiche machine is broken and the supporting documentation for the monthly billing cycle has been stored in boxes in the accounting department. These boxes of account statements and supporting documentation go back for over one year without being scanned to the microfiche. To ensure the availability of records when needed, a clear written record retention policy should exist for all aspects of P-Cards and the means of storage should be operational and reliable. RECOMMENDATION and MANAGEMENT RESPONSE Develop a record retention policy defining requirements for P-Card related documentation. Ensure the means of which the District stores its documentation is operational and reliable. Management Responses: We recognize the need to update our storage system and have requested funding to purchase a new computer scanner for the storage of our records. The scanning of the 2007-2008 P-Card statements and documentation which has been stored in boxes will be scanned and accessible online, pending approval and funding of the new scanner system (cost is approximately $8,000). The 2008-2009 and future years’ P-Card documentation will also be accessible online. Responsibility: Cerri Cupples, Supervisor of Accounting Due Date: January 31, 2009

- 20 -

Procurement Card Observations, Recommendations and Action Plans
OBSERVATION #16 Contracted Vendors The capability exists to purchase with a P-Card from a non-contracted vendor when a contracted vendor exists for the purchase. There is no assurance that cardholders are purchasing from contracted vendors and taking advantage of preferred pricing. Purchases to noncontracted vendors are not prevented. During the training that is required prior to issuance of the P-Card, a listing of vendors the District has contracts with is provided to all cardholders and P-Card Supervisors. Based on testing performed, it was noted that there were items purchased from vendors that could have potentially been purchased from contract vendors, but were not. In the P-Card procedures manual, it states that the District “strongly encourages” purchasing from vendors that are on contract with the District to take full advantage of the contracted savings. This policy is not definitive enough and does not require cardholders to purchase from contracted vendors. Cardholders should purchase from vendors that are on contract with the District to take full advantage of the contracted savings. RECOMMENDATION and MANAGEMENT RESPONSE Develop and enforce a policy that cardholders should purchase from vendors that are on contract with the District to take full advantage of the contracted savings. Provide P-Card owners with a table of specific contracted vendors that should be used. Management Responses: As a part of training, individuals are given the most current list of RCSD contracts and are informed that all contractors do take the P-Card. The manual will change the language to be more definitive. Responsibility: Brian O’Connor, P-Card Administrator, Gary Smith, Director of Procurement & Supply Due Date: January 31, 2009

- 21 -

Procurement Card Observations, Recommendations and Action Plans
OBSERVATION #17 Merchant Category Codes The District does not possess, nor does it periodically monitor the listing of acceptable Merchant Category Codes (MCC). During our review, the most recent list available was from September 2006, but per the P-Card Administrator, this list had been modified. MCCs are merchant industry codes that identify the type of business that the merchant is classified under. Exclusion of these codes can restrict cardholders from certain types of merchants that are deemed disallowed per the card administrator. For instance, travel expenses are prohibited on the P-Card; therefore all travel MCCs should be disallowed. There appears to be MCCs which should be excluded from the groups based on the prohibited list in the P-Card procedures manual, but are not. For example, wholesale clubs are prohibited to be purchased from, but the code is not part of the exclusion. There have been purchases made at these wholesale clubs which could have been prevented if they were part of the exclusion. MCCs should be monitored regularly and exclusions should be assessed for reasonableness and appropriateness for the District. RECOMMENDATION and MANAGEMENT RESPONSE Obtain a copy of the Merchant Category Code exclusions the District has implemented. Monitor Merchant Category Codes on a regular basis and assess the exclusions for reasonableness and appropriateness for District needs. Retain the analysis for review. Management Responses: The MCC Code exclusions were updated as recently as June 2008. This will be reviewed on an annual basis. Responsibility: Brian O’Connor, P-Card Administrator, Gary Smith, Director of Procurement & Supply Due Date: June 30, 2009

- 22 -

OFFICE OF AUDITOR GENERAL

PeopleSoft Financial System Controls Audit Report
May 28, 2009

PS Financial System Controls Index

Report Section

Pages

Executive Summary

1

Summary of Recommendations

3

Observations, Recommendations and Action Plans Monitoring Essential Processes PeopleSoft Updates Operating Procedures Query Table Access Passwords 4 5 6 8 9

PS Financial System Controls Executive Summary

OBJECTIVE To evaluate the Financial System Controls in PeopleSoft 8.9 for propriety and sufficiency to generate accurate financial reporting and enable fiscal accountability. BACKGROUND The PeopleSoft system is an enterprise-wide system that was implemented to automate and streamline operations. The District implementation date for the upgrade from PeopleSoft 8.4 to 8.9 was July 18, 2007. The conversion included Accounts Payable, General Ledger, Budgets, Purchasing, Projects, Asset Management, Grants and Contracts. An additional module, eProcurement, and the functionality of Workflow were added to the implementation. Increased functionality of the new environment was provided to improve system use District-wide, the internal control environment and return on investment. Financial transactions of the District are gathered by departments via spreadsheets and PeopleSoft modules. This data is then summarized in the PeopleSoft General Ledger for financial reports to management and other interested parties. SCOPE Our audit will evaluate the effectiveness of internal controls, records management, and procedures over Financial Reporting in PeopleSoft. We will: 1) Assess existing PeopleSoft application controls and design for effectiveness and efficiency. 2) Review User roles, permissions, profiles workflow and manual authorization controls for reasonableness. 3) Assess reliability of reports and queries used to compile and communicate financial results to internal and external parties. 4) Evaluate procedures to monitor application changes for sufficiency and ensure system integrity. We rely upon key personnel and their designees to develop our understanding of the current control environment. We will then test the identified controls and assess their effectiveness. Results of our audit procedures will be summarized to determine internal control concerns and provide recommendations to improve the control environment. Management will be requested to respond to our recommendations, in writing, for inclusion in our final report to management and the Board of Education.

1

PS Financial System Controls Executive Summary

CONCLUSION IM&T operating practices regarding the sharing of information and decisions with business owners could be enhanced. Opportunities exist regarding notification of key automated process failures and communication of potential problems and fixes from PeopleSoft. While some PeopleSoft processes are complex and IM&T has some documentation, the operating procedures and design documentation are not adequate to ensure IM&T operational continuity in the event of staff turnover. This level of documentation also restricts other District departments in their understanding of key automated processes. Additionally, the password controls are weak and District guidelines have not been formalized to direct a desired level of control. Weak password controls could allow improper access to sensitive data (personal or otherwise) housed in PeopleSoft but accessible through public queries.

2

PS Financial System Controls Summary of Recommendations

Rec# 1 2 3

Recommendations Review, document, and monitor automated processes with business owners to determine essential business functions that should be monitored if process failures exist. Communicate essential process failures when they occur. Review current patch component fixes with functional managers during existing monthly meetings. Document IT operating procedures. Document PS application technical design configurations and purposes for options currently being utilized. Develop and implement a change control operating procedure to ensure changes are accepted in writing and achieve the desired business objective. Work with process owners to identify data tables with sensitive data and determine appropriate user access. Use PeopleSoft query security controls to align RCSD PeopleSoft users to have access to information necessary for their job performance. Implement and communicate stronger password controls. Require the policy to be reviewed periodically for appropriateness.

4

5

3

PS Financial System Controls Observations, Recommendations and Action Plans
OBSERVATION #1 Monitoring Essential Processes Formalized monitoring procedures for essential processes have not been established with process owners. IM&T developers receive automated e-mails when processes fail. Currently, developers determine when it is appropriate to communicate the failures to process owners. Operating management relies on consistent performance of automated activities to provide a first level of control in the financial systems. Operating management cannot rely on timely communication from IM&T if an understanding of essential processes and related monitoring has not been established and agreed upon. As a result, delays in corrective action can occur should an automated activity not complete properly. RECOMMENDATIONS and MANAGEMENT RESPONSES Review, document, and monitor automated processes with business owners to determine essential business functions that should be monitored if process failures exist. Communicate essential process failures when they occur. Management Responses: All currently monitored processes will be reviewed with Business Owners. If the Business Owners wish to be included on the Distribution Lists to receive an automated email if a process fails, they will be added to the Distribution. When reviewing these processes with the Business Owners, if there are any additional processes identified for which monitoring would also add value, monitoring will be established for these processes, as well.

Responsibility: Jerome Underwood, Technology Information Officer; Annmarie Lehner, Manager of Technology Services

Due Date: December 31, 2009

4

PS Financial System Controls Observations, Recommendations and Action Plans
OBSERVATION #2 PeopleSoft Updates IM&T communicated that PeopleSoft patches are posted on Oracle’s web site and those patches are available to all customers including RCSD users. Given that availability, IM&T states they do not proactively communicate reported issues, or known repairs to RCSD business owners because they do not have the resources to do so. The District practice is to hold all PeopleSoft notices for an annual, mass installation. This practice is utilized to better align with available resources. Repairs for improperly working functions that the user may not be aware of, or has not communicated to IM&T, can go uncorrected until year end. As a result, system or user operating inefficiencies can occur and end users miss the opportunity for consideration of earlier correction. RECOMMENDATIONS and MANAGEMENT RESPONSES Review current patch component fixes with functional managers during existing monthly meetings to improve awareness and resolution to repairs. Management Responses: The maintenance of the PS Financials application is performed annually January thru April to coincide with the schedule of our Business Owners who must test the system. As there were 1,011 patches created in the maintenance applied last year alone (a 10month period of time), it is not feasible to review all patches with our Business owners – even on a monthly basis. Business owners do test all Production processes and reports after any and all maintenance is applied to make sure there are no negative impacts resulting from all changes made, even though not patch specific. A comprehensive test plan has been created for this purpose and this is updated annually with input from the Business Owners. They are required to sign-off on testing performed which is retained for review. IM&T management has accepted this process as adequate and the Business Owners have also accepted this standard of applying maintenance on an annual basis. We will formalize this maintenance agreement by defining and documenting our process, its user approval, and clarify business owner responsibilities, including awareness and acceptance for all software changes as noted on the web site and associated testing risks when installed. Responsibility: Jerome Underwood, Technology Information Officer; Annmarie Lehner, Manager of Technology Services Due Date: December 31, 2009

5

PS Financial System Controls Observations, Recommendations and Action Plans
OBSERVATION #3 Operating Procedures PeopleSoft applications are highly complex and configured to accommodate specialized needs of the District. Procedures and functionality, as designed, should be documented to ensure operational continuity independent of IT personnel. Examples OAG believes should be included are: Specific application functions that are enabled and associated customizations including, but not limited to, combination edits, workflow, security, matching, external and internal interfaces. Technical monitoring processes and tools used to ensure system integrity. Change Control procedures and proof of user acceptance. User access and security procedures to maintain the system. IM&T was unable to provide documented PeopleSoft application configurations and operating procedures. They also do not have complete or formally documented design configurations or IM&T operating procedures for PeopleSoft financial applications used by the District. Discussions with IT staff indicated that IT operating practices do exist. Some IM&T staff members provided developer notes for OAG to derive an understanding of documented PeopleSoft processes and controls; however these documents were not comprehensive. IM&T’s ability to maintain PeopleSoft applications may be hindered through staff transition. In addition, cross training should occur to ensure RCSD’s operating processes are not hindered during transitions. Improper or unauthorized changes could be made to PeopleSoft applications due to lack of documented configurations, policies and procedures.

6

PS Financial System Controls Observations, Recommendations and Action Plans
RECOMMENDATIONS and MANAGEMENT RESPONSES Document IT operating procedures. Document PS application technical design configurations and purposes for options currently being utilized. Develop and implement a change control operating procedure to ensure changes are accepted in writing and achieve the desired business objective. Management Responses: IM&T will review internal functions to assess where there may be inadequate documentation and based on criticality of need, IM&T will document any areas identified. We agree that change control procedures and some security operating procedures qualify. IM&T will review and revitalize the previously-utilized change control procedures and will communicate this process to Business Owners. Responsibility: Jerome Underwood, Technology Information Officer; Annmarie Lehner, Manager of Technology Services

Due Date: March 31, 2010

7

PS Financial System Controls Observations, Recommendations and Action Plans
OBSERVATION #4 Query Table Access All District data in PeopleSoft are housed in data tables viewable by all PeopleSoft users via Query Report Writer. IM&T does not utilize PeopleSoft delivered security controls to restrict user access to query tables containing sensitive data. Some examples of tables containing sensitive data that have unrestricted access and are visible to users are the “1099 Vendor Table” in PeopleSoft Financials that contains visible vendor tax ID numbers and social security numbers. There are 24 public queries providing this information and over 200 employees with access to it. Additionally, in the PeopleSoft Human Resource system, the “DEPT_SALARIES_NVISION”, the Department Salaries table, contains visible employee salaries. Access to sensitive data housed in PeopleSoft should be restricted to users based upon their job functions. Information protected under regulatory privacy laws should be maintained in compliance with those standards. Sensitive information such as tax payer ID's and social security numbers can be accessed and used for unauthorized purposes. RECOMMENDATIONS and MANAGEMENT RESPONSES Work with process owners to identify data tables with sensitive data and determine appropriate user access. Use PeopleSoft query security controls to align RCSD PeopleSoft users to have access to information necessary for their job performance. Management Responses: Only Business Owners “super users” have access to Query Manager – allowing them to create queries of their own. This access level has been approved by their managers and this access is reviewed with management on an annual basis. Other users of the Financial System have access to Query Viewer, which allows them to run Public Queries only. IM&T will review, with the Business Owners, the public queries that are available and will restrict those queries that contain sensitive information. Since we currently have 2,362 public queries, this process will take a significant amount of time to complete. Responsibility: Jerome Underwood, Technology Information Officer; Annmarie Lehner, Manager of Technology Services Due Date: June 30, 2010

8

PS Financial System Controls Observations, Recommendations and Action Plans
OBSERVATION #5 Passwords PeopleSoft password controls are weak and district guidelines have not been formalized to direct a desired level of control. Existing password controls are not effective at current settings to reasonably protect a user’s password and the associated activities that person is responsible for when using the system. A password control policy has been drafted and IT is in the process obtaining approval from various process owners. There is no expected date for its completion; however a draft has existed for several years. The risk of weak password controls could allow improper access to data. Weak passwords could allow people to circumvent any business activity performed through the system such as approvals, changes to financial data, generation of transactions, or modification of reports. Password controls should be designed with enough complexity to serve as a reasonable deterrent for unauthorized users seeking to gain access to PeopleSoft. Password controls are the key to a person’s identity on the system and should be reasonably designed to protect that identify. RECOMMENDATIONS and MANAGEMENT RESPONSES Implement and communicate stronger password controls. Require the policy to be reviewed periodically for appropriateness. Management Responses: Once the District’s overall Password Control Policy has been approved by management, the new controls will be applied to the District’s PeopleSoft applications. Password Policy requirements have been discussed with the Deputy Superintendent of Administration. This level of management is required to roll out a new password policy throughout the District. Follow-up on this subject is on-going. Responsibility: Jerome Underwood, Technology Information Officer; Annmarie Lehner, Manager of Technology Services Due Date: January 31, 2010

9

OFFICE OF AUDITOR GENERAL

Student Counseling Audit Report
June 21, 2010

Student Counseling Table of Contents

Report Section

Pages

Executive Summary Summary of Recommendations Observations, Recommendations and Action Plans Governance Roles and Responsibilities Standardized Operating Procedures Counseling File Documentation Standards Student Interaction Services Collaboration Parent/Third-Party Collaboration Academic Reporting Counseling for Personal/Social Milestones Urban Professional Development Counselor Performance Criteria

2 4

6 7 8 9 10 11 12 13 14 15 16

Student Counseling Executive Summary
OBJECTIVE To evaluate the operating control environment, Administrative Counseling, and oversight for the Office of School Counseling.

BACKGROUND The Office of School Counseling supports the schools and students by providing certified School Counselors at secondary schools, serving students in grades 7-12. School Counselors address the developmental needs of all students through a school counseling program addressing the academic, career and social/emotional development of all students. Through the work of the Office of Counseling, the District has increased access to college readiness activities. Sophomores and juniors are participating in PSAT exams and the number of RCSD students taking the SAT exams has been rising steadily to approximately 860 in 2009. There has also been an increase in student participation through college fairs where in excess of 1,200 students attend annually. Most notably, the Counseling Department, in March 2010, coordinated a major event to assist RSCD parents in completing college financial aid applications, which is often an intimidation barrier to college.

SCOPE We will evaluate the effectiveness of the internal controls including operating protocols and school monitoring provided by the Office of School Counseling. We will determine if adequate controls have been implemented to ensure every student benefits from School Counseling programs. We will collaborate with the key personnel to understand the current control environment and test the operating control environment. We will identify opportunities for improvement and issue recommendations to improve the control environment. Management will be asked to respond in writing to our recommendations within 30 days.

-2-

Student Counseling Executive Summary
CONCLUSION The Office of Counseling is a small group of professionals with a significant role in supporting student performance from a personal/social, academic and career perspective. Uniform standards across the District would facilitate providing all students with comprehensive counseling activities at every grade level. We recognize that schools may have differences based on leadership expectations; however basic protocols should exist and be somewhat standard across the district. Counselors were aware of school counseling standards, but clarity surrounding standards that must be performed in areas of documentation, required student contact, and parent communication should be formalized to ensure consistent application by all individuals. Standard reporting should also exist at every school for each grade level to ensure that all students are formally monitored each year. Formal processes and forums should be established to allow sharing of best practices within the district. This practice would allow all schools to benefit from lessons learned from experienced counselors and the mature counseling programs. Counselors are not required and therefore do not exist at the Elementary level. While this requirement does not exist, there still appears to be a need for the district to develop social competencies for elementary students prior to their arrival in a secondary environment. Counselors communicated that a significant amount of time is spent teaching students social/ personal competencies when they arrive in a secondary school building, development in this area could allow counselors to spend additional time in the academic and career domains. We noted that counselors recognized the Director of Counseling as a good resource for technical guidance. We believe the Director of Counseling should also be used as a resource to Principals for ensuring that all school counseling programs effectively align with organizational goals for student achievement. Collaboration with Principals and annual assessments of counseling programs could provide a valuable resource in this specialty area for administrators. The Office of counseling has implemented several initiatives to increase the college readiness such as PSAT exams for sophomores and juniors, college fairs, increased students participating in the SAT exam and financial aid assistance. These opportunities show the counselor’s commitment to making RCSD students college ready.

-3-

Student Counseling Summary of Recommendations

Rec# 1

Recommendations Establish a clear governance structure for consistent standardized district-wide counseling activities. Provide more direct guidance for counseling activities at schools with structured documented feedback from the Director of Counseling for individuals responsible for the school counseling function. Define, communicate and monitor to ensure that all key Counselor roles and responsibilities are performed. Establish comprehensive operating procedures for the Office of School Counseling. Establish, communicate and train Counselors regarding documentation that should be maintained in student counseling files. Establish and communicate formal monitoring procedures that will identify how all students should be monitored which will include monitoring frequency and escalation procedures for intervention. Consider establishing a cross-functional team to discuss and identify, communicate and remediate common and emerging issues for students. Remediation should include a plan for implementation at schools including delegated responsibility. Establish and communicate guidelines to facilitate what types of events should initiate parent contact or additional human service resources. Designate responsibility for coordinating communicating to resources on a timely basis. Implement standard system reports which provide administrators with critical graduation readiness information for each grade level.

2 3 4 5 6 7 8

-4-

Student Counseling Summary of Recommendations
Rec # 9 Recommendations Implement district-wide personal/social developmental skills that will be taught to students at each specific grade level. Utilize Social Workers to facilitate identification of milestones and teaching developmental skills training due to their expertise in this area. Consider establishing a process that obtains counselor input for Professional Development. At a minimum, provide Urban Professional Development for counselors. Consider including the Director of Counseling present in assessing Counselor performance and providing evaluation feedback.

10 11

-5-

Student Counseling Observations, Recommendations and Action Plans
OBSERVATION #1 Governance There is a lack of clear governance and oversight for the District-wide counseling function. Principals, or their designee, have daily responsibility for all school related personnel, which includes the counseling function. In each school-based counseling department, according to ASCA guidelines, counselors should address student needs from three domains: social/ personal, academic, and career perspectives. It was not evident that all three domains were not performed by all counselors. Counselor roles varied. Some counselors focused on social/personal issues, some filled in for absent administrators, and some were expected to focus on monitoring student grade information. It is not clear that adequate guidance has been provided to identify what Principals can expect from counselors and clarify the level of support that should be provided by the Director of Counseling. RECOMMENDATIONS and MANAGEMENT RESPONSES Clarify the role of the Director of Counseling and obtain agreement regarding responsibility for governance of counseling activities. Communicate these clear guidelines throughout the organization. Management Responses: The Director of Counselor job description will be reviewed and revised to reflect clearer expectations. The Director will use her knowledge, experience, administrative authority to leverage and create an official infrastructure in each school. This infrastructure will facilitate and support the collection of informational reports such as academic and intervention data. A Lead Counselor position will be created to support the school- building Counselors and the Principals. The goal is to align efforts and outcomes with the District wide college going culture, connections to higher education, RTI, Parent engagement, student career awareness exploration and any additional support to ensure student success. Responsibility: Gladys Pedraza-Burgos, Chief Youth Development and Family Services Due Date: October 31, 2010

-6-

Student Counseling Observations, Recommendations and Action Plans
OBSERVATION #2 Roles and Responsibilities There is a lack of clarity surrounding the critical roles that the Counselor should perform. Principals had different responsibilities for Counselors at the schools. There are three domains that a counselor is expected to focus on. All three domains were not performed by all Counselors. Principals expected individual Counselors to focus on social/personal issues, fill in for absent administrators, and some were expected to focus on monitoring student grade information. We recognize that each Principal can select an effective method for their building; however, it was not clear that all counseling activities were being performed. Clear definition of Counselor responsibilities should be established to ensure all key functions are performed for all students. RECOMMENDATIONS and MANAGEMENT RESPONSES Define, communicate and monitor to ensure that all key Counselor roles and responsibilities are performed. Management Responses: The counselor job description and expectations have been revised according to the American School Counselor Association, ASCA and New York State School counselors Association, NYSSCA. The director of School Counseling will meet with every Principal to reinforce the counselor expectations. Written records will be maintained to capture contact with Principals. Although the school Principal is responsible for daily monitoring, on an annual basis the Director of Counseling will perform an assessment of the counseling programs at the schools from a technical perspective. Responsibility: Gladys Pedraza-Burgos, Chief Youth Development and Family Services; Dr. Bonnie Rubenstein, Director of Counseling Due Date: December 31, 2010

-7-

Student Counseling Observations, Recommendations and Action Plans
OBSERVATION #3 Standardized Operating Procedures There is a lack of comprehensive District-wide protocols and procedures for the Office of School Counseling. There are also no Desk Procedures to communicate how to perform daily responsibilities. These procedures are individually created at each respective school, if it exists. The Office of School Counseling has started to document protocols; however, efforts should be made to ensure protocols are comprehensive, communicated and implemented by all counselors. There should be counseling guidance provided to facilitate the counseling process. Inconsistencies across schools make it difficult to ensure counseling quality throughout the district. If basic counseling is provided, it can improve consistency in the quality of services provided. Schools should be able to personalize their procedures in order to meet their individual differences; however, a consistent baseline will improve counseling consistency. RECOMMENDATIONS and MANAGEMENT RESPONSES Establish comprehensive operating procedures for the Office of School Counseling. Management Responses: During the 2009-10 school year the counselor manual was revised. The revisions have been forwarded to management for review. We are currently implementing recommended changes to the manual. We anticipate the updated manual will be forwarded to counselors in Fall 2010. Responsibility: Gladys Pedraza-Burgos, Chief Youth Development and Family Services; Dr. Bonnie Rubenstein, Director of Counseling Due Date: October 31, 2010

-8-

Student Counseling Observations, Recommendations and Action Plans
OBSERVATION #4 Counseling File Documentation Standards Documentation standards do not exist for counseling files. Student file documentation varied across schools and counselors. Differences were also noted among counselors within individual school buildings. District protocols have not been established to identify what level of documentation should exist to substantiate counseling services. Some counselors communicated that they were advised to write very little in the files. We recognize that protecting student confidentiality must be considered, however counseling should be established to identify what documentation is prudent to support that adequate counseling was provided. RECOMMENDATIONS and MANAGEMENT RESPONSES Establish, communicate and train Counselors regarding documentation that should be maintained in student counseling files. Management Responses: We will formalize and document clear expectations that must be followed by all counselors to support the performance of required counseling activities. These documentation standards will align with the national and state standards. We will communicate these standards to all counselors in our counselors meetings and monitor these requirements during the annual counseling program review on a test basis. Responsibility: Gladys Pedraza-Burgos, Chief Youth Development and Family Services; Dr. Bonnie Rubenstein, Director of Counseling Due Date: October 31, 2010

-9-

Student Counseling Observations, Recommendations and Action Plans
OBSERVATION #5 Student Interaction Standardized procedures do not exist to ensure that all students receive counseling. We were unable to obtain assurance that all students were receiving counseling services. Some Counselors performed manual monitoring procedures to ensure that student interaction had occurred; others tracked student contact in a very informal manner. The procedures had varying degrees of completeness, consistency, and effectiveness. This was particularly evident for students below the 12th grade level, where there was a lack of detailed analysis and diligence. A designated level of attention should be established at each grade level, not just for seniors. There should be established monitoring procedures to ensure all students are reviewed at each grade level. RECOMMENDATIONS and MANAGEMENT RESPONSES Establish and communicate formal monitoring procedures that will identify how all students should be monitored which will include monitoring frequency and escalation procedures for intervention. Management Responses: A counseling calendar has been provided to all counselors and is included on the Counseling Sharepoint site. We will also establish specific expectations for counselors to ensure that annual student contact, monitoring and escalation procedures occur. Responsibility: Gladys Pedraza-Burgos, Chief Youth Development and Family Services; Dr. Bonnie Rubenstein, Director of Counseling Due Date: October 31, 2010

- 10 -

Student Counseling Observations, Recommendations and Action Plans
OBSERVATION #6 Services Collaboration Formalized collaboration among the various service oriented disciplines (i.e. counselors, psychologists, social workers, external agencies) does not exist. There are many school support personnel and organizations available to assist with student needs. Common problems likely exist across schools and among grade levels. While it was communicated that some collaboration can occur if a specific student need arises, there was no standard forum to collaborate in a more holistic manner across schools and disciplines. In order to be proactive in dealing with common and emerging student issues, there should be ongoing communication within and among various service individuals. RECOMMENDATIONS and MANAGEMENT RESPONSES Consider establishing a cross-functional team to discuss and identify, communicate and remediate common and emerging issues for students. Remediation should include a plan for implementation at schools including delegated responsibility. Management Responses: We are taking the initiative to engage and participate in the District’s RTI teams, Social Workers Advisory Council, the Student Support Center teams and the Counselor Advisory Council as well. The goal is to facilitate open communications, referrals and collaborative efforts to better serve students and their families. Specific communication guidelines will be included in the revised counseling and social workers manual.

Responsibility: Gladys Pedraza-Burgos, Chief of Youth Development and Family Services Due Date: November 30, 2010

- 11 -

Student Counseling Observations, Recommendations and Action Plans
OBSERVATION #7 Parent/Third-Party Collaboration The parent communication and collaboration process for counseling related services lacked structure and standards across the District. Parents receive communication through phone calls, letters, home visits, or meetings. The type and volume of the communication varies by school. We were unable to identify District Counseling standards that establish basic protocols for interaction with parents. There were no standardized events that would automatically lead to parent contact by the Counselor. Counseling guidance was also lacking to establish when other District resources should be engaged. Documented guidelines that clearly define responsibility and timing for communicating parent and/or other district resource involvement. RECOMMENDATIONS and MANAGEMENT RESPONSES Establish and communicate guidelines to facilitate what types of events should initiate parent contact or additional human service resources. Designate responsibility for coordinating communicating to resources on a timely basis. Management Responses: All counselors have received the College Boards “ College Counseling Sourcebook” which includes parental guidelines by grade level. Specific communication guidelines will be included in the revised counseling manual. We have also included on the RCSD website counseling protocols in the parent section to increase parent awareness. A series of workshops for parents through Parent University will be offered which includes college readiness and financial aid. Responsibility: Gladys Pedraza-Burgos, Chief Youth Development and Family Services; Dr. Bonnie Rubenstein, Director of Counseling; Dorothy Evans-Flaherty, Director of Parent Engagement Due Date: October 31, 2010 – Spring 2011

- 12 -

Student Counseling Observations, Recommendations and Action Plans
OBSERVATION #8 Academic Reporting Standard administrative reporting does not exist to facilitate academic monitoring for all students. Of the schools we visited, we noted that all schools had a method of communicating progress towards graduation for seniors, although the format and content varied. Datacation is a tool available to facilitate student progress tracking, however all schools did not rely on this resource. Schools used either Datacation or Chancery for progress monitoring; however, reporting is performed in an ad hoc basis. Formal active monitoring did not consistently occur for non-seniors. The documentation varied based on the Counselor’s preferences and abilities. Since information should be monitored to track all students at each grade level, standard common reporting would facilitate this task. This will ensure that all Counselors and Principals are able to view relevant information to actively monitor student progress. Improved reporting can assist administrators in making timely decisions regarding student academic intervention. RECOMMENDATIONS and MANAGEMENT RESPONSES Implement standard system reports which provide administrators with the key academic drivers for each grade level. Management Responses: We will identify, establish and communicate standard system reports that all counselors should use to monitor student progress in schools. These sample reports will be communicated to Principals to facilitate their monitoring of students. Responsibility: Gladys Pedraza-Burgos, Chief Youth Development and Family Services; Dr. Bonnie Rubenstein, Director of Counseling Due Date: June 30, 2011

- 13 -

Student Counseling Observations, Recommendations and Action Plans
OBSERVATION #9 Counseling for Personal/Social Milestones Counselors are responsible for addressing personal/social, career and academic attributes for students. The Director of Counseling has provided Counselors with reference information and activities to facilitate teaching these attributes; however, there is no requirement that these activities be performed. As a result, there is inconsistent training and social competencies provided to students. Counselors noted that students in 7th and 9th grade levels have a significant need for social and personal support when students transitioned, especially from the other district schools. This reactive approach takes a tremendous amount of time, when a more focused emphasis on academics should occur. This challenge is further complicated by a lack of formal social/personal milestones taught to students at the elementary level to facilitate the transition to secondary school. Specific grade relevant milestones and district-wide standards have not been established. If standard personal/social developmental milestones were formally taught and reinforced by grade level, students would be operating with similar competencies regardless of which school they attended. If personal/social milestones are not achieved, it creates a barrier for student success in the academic and career areas. RECOMMENDATIONS and MANAGEMENT RESPONSES Implement district-wide personal/social developmental skills that will be taught to students at each specific grade level. Utilize Social Workers to facilitate identification of milestones and teaching developmental skills training due to their expertise in this area. Management Responses: Since the District does not have elementary counselors, social workers will be provided with New York State School counselors Association, NYSSCA activity books which represent best practices in counseling. The Director of Counseling will work with the Director of Social Work in making these materials available. In addition, the Director of Social Work will work with District Social Work leaders to identify specific training that should be targeted on a District-wide basis. Responsibility: Gladys Pedraza-Burgos, Chief Youth Development and Family Services; Dr. Bonnie Rubenstein, Director of Counseling; Audrey Cummings, Director of Social Work Due Date: June 30, 2011

- 14 -

Student Counseling Observations, Recommendations and Action Plans
OBSERVATION #10 Urban Professional Development While some Urban Professional Development has been provided, Counselors expressed a need to obtain targeted Urban Professional Development which includes peers from other districts. Funding for targeted training has not been readily available for Counselors. Our discussions with Counselors identified concerns regarding a lack of professional development for urban children. Professional Development is an opportunity for sharing best practices and resources. Counselors in urban districts face unique challenges which require different approaches for success. Counselors communicated that training was offered within the past year, however many Counselors believed the training provided was not relevant for an urban population. Since funding for Professional Development opportunities are limited, Counselor feedback should be considered to ensure relevant concerns are addressed. Considering budgetary limitations, effective Counselors within the district should share best practices amongst their peers to capitalize on effective strategies. RECOMMENDATIONS and MANAGEMENT RESPONSES Consider establishing a process that obtains counselor input for Professional Development. At a minimum, provide Urban Professional Development for Counselors. Management Responses: The Director of Counseling will work with the College Board, the National Office of School Counseling Advocacy (NOSCA), RCSD Professional development and other peers to identify possible training to increase the cultural competency development of school counselors. Responsibility: Gladys Pedraza-Burgos, Chief Youth Development and Family Services; Dr. Bonnie Rubenstein, Director of Counseling Due Date: June 30, 2011

- 15 -

Student Counseling Observations, Recommendations and Action Plans
OBSERVATION #11 Counselor Performance Criteria Counselors are evaluated utilizing the same performance criteria as teachers. A standard evaluation form has been established for teachers, but it is also utilized for school counselors. Required counseling elements are neither identified nor assessed in the annual performance review. Performance evaluations are meant to provide relevant feedback for the individual reviewed; however, the relevant criteria are not included. At a minimum, providing emphasis on counseling criteria would reinforce counselor expectations to the reviewer and counselor. There would also be additional value if an individual with a counseling background performed the review. RECOMMENDATIONS and MANAGEMENT RESPONSES Establish and implement an evaluation form that identifies counseling criteria. Consider including the Director of Counseling present in assessing Counselor performance and providing evaluation feedback. Management Responses: New York State School counselors Association, NYSSCA and National American School Counselor Association, NASCA has provided an evaluation tool for counselors. We will meet with union representatives to obtain agreement. Responsibility: Gladys Pedraza-Burgos, Chief Youth Development and Family Services; Dr. Bonnie Rubenstein, Director of Counseling Due Date: June 30, 2011

- 16 -

OFFICE OF AUDITOR GENERAL

Vendor Management Audit
March 1, 2008

Vendor Management Audit Index

Report Section

Pages

Executive Summary Conclusion Summary of Recommendations

1 2 3

Observations, Recommendations and Action Plans Requirement of W-9 Form Form 1099 System Testing Vendor Set-up Employee Set-up in Vendor Files Verification of Vendor Information IT Staff Access Staff Access to Vendor Information Change Management 4 5 6 7 8 9 10 11

Vendor Management Audit Executive Summary

OBJECTIVE The Vendor Management Audit will evaluate the internal controls, procedures and functionality of the Vendor Management process. A review of the internal control environment will determine if controls are appropriately designed and operating in this area to properly record and approve acceptable vendors for the District. SCOPE The scope of the Vendor Management Audit was limited to the clean-up process of existing information for PeopleSoft 8.9 Upgrade through the implementation and its conversion effective July 15, 2007. We evaluated the related controls and processes utilized in the PeopleSoft financial system from the application process of the vendor through the approval of the vendor within the automated system. We included the retention of paper documents and the procedures for change management. We collaborated with the various Purchasing staff to understand the current control environment. Purchasing has been deemed responsible for the vendor management files. We tested the process and the pertinent data within the PeopleSoft 8.9 system under the direction of Purchasing. Employees are also set-up in vendor management in order to reimburse employees for expenses incurred for the District. This portion was included in our testing. At the time of the audit, the purchasing department was still updating vendor records and will continue through the addition of eProcurement. Information concerning the database administrator’s user id provided via vendor screens was not made available to us. Information has been requested to independently verify data provided in an effort to understand the controls and security in relation to vendor management. The information was never received for our review.

-1-

Vendor Management Audit Executive Summary

CONCLUSION

A tremendous effort has been made by the Purchasing Department to update the vendor files within the PeopleSoft 8.4 environment for conversion to the new 8.9 environment. Improvements are still necessary for operating activities as well as system improvements. Our suggested recommendations would improve the completeness and accuracy of information, timeliness of changes, strengthening existing controls, efficiency of workflow and the security of our control systems. Purchasing and Accounts Payable should work together to develop clear, concise written documentation concerning the request for vendor information, recording of information, change management within the electronic environment and communication to all District staff. The ideal situation would be to have a designated person responsible for the entire operation of the vendor file. Best practice is having vendor maintenance separate from purchasing and accounts payable. The designated person(s) is responsible for all areas of vendor set-up from obtaining applications, W-9, updating information, accuracy, and processing of compliance issues and reports. We recommend that improvements be acted upon immediately since vendor management is an integral component in the payment of the District’s vendors. To further facilitate these improvements, the Office of Auditor General is requesting that an upcoming IT audit be given full view of system security of this area.

-2-

Vendor Management Audit Summary of Recommendations

Rec Audit Recommendations # 1. 2. 3. 4. 5. 6. 7. 8. Implement the requirement that all vendors, including sports officials and one-time vendors complete the Form W-9. Establish and implement the procedures, both operational and system for the efficient flow of the Form 1099 process. Develop and implement clear procedures for the use of the one-time vendor set-up and single-payment vendor set-up within the PeopleSoft 8.9 system. Develop procedures to review and update existing vendor files set up for employees. Develop a procedure for verification of vendor information submitted on the application and Form W-9. Develop a monitoring process for operating management to review system modifications made by IT staff. Re-evaluate the access individuals have to all screens within the vendor management system and align with their assigned business responsibilities. Develop change management procedures for vendor management screens to include personnel changes, monitoring of changes, and approval.

-3-

Vendor Management Audit Observation, Recommendations and Action Plans
OBSERVATION #1 Tax Requirements Requirement of W-9 form The Federal Form W-9 is not being requested from all vendors for documentation prior to vendor payment. It was noted that sports officials and one-time vendors are not completing this required Federal form within the Central Office and the individual schools. Vendors regardless of the materials, supplies or services provided the district, should be required to complete the Form W-9. It is the responsibility of the District to provide the Federal government and the vendor with a Form 1099 reporting payments made to particular vendors. Accumulated payments over $600 for the calendar year are to be reported to the vendor and the Internal Revenue Service. If the District does not comply or incorrectly reports this information it may cause fines to be levied upon the District. RECOMMENDATION and MANAGEMENT RESPONSE Establish and Implement the requirement that all vendors, including sports officials and one-time vendors complete the Form W-9. Management Responses:For all approved vendors, W-9 Forms are required and kept on file in Purchasing. For sports officials, some coaches and security personnel, a copy of the W-9 Form is kept in the Athletic Department by Karen Cottrone-Young. The new procedure is as follows, effective February 3, 2008: Karen Cottrone-Young will keep the original W-9 Form on file in her office. She will make a copy of the W-9 Form for a new individual not in the vendor file or not “approved” in the vendor file, who will need to be paid and attach the W-9 Form copy to the claim voucher. Purchasing is in support of the District following best practice by having a separate department maintain the vendor file. Responsibility: Vince Carfagna, Chief Financial Officer; Gary Smith, Director of Purchasing. Due Date: Implemented as of February 3, 2008

-4-

Vendor Management Audit Observation, Recommendations and Action Plans
OBSERVATION #2 Form 1099 System Testing This is the first year that Accounts Payable will be responsible for the entire 1099 process. In years past, the process was completed by Accounts Payable and the IT staff. Accounts Payable will now be responsible for the verification of information, review of reports, approval of accumulated information, running the Form 1099 and summary report 1096, mailing to vendors, filing reports with vendors and the IRS, correction of information after processing, and responding to notices from the IRS. At the time of the audit, the procedure and testing of this process was not completed. During the audit the year-end process has been developed and tested. Problems have been noted concerning the accurate recording of vendor status to produce 1099s. Although sending 1099s to a vendor when it is not necessary is not a concern, the exclusion of a vendor that should have a 1099 could result in penalties on the vendor and the District. Employees involved with the vendor files should be educated to understand the proper recording of vendor status for 1099 processing. RECOMMENDATION and MANAGEMENT RESPONSE Establish and implement the procedures, both operational and system for the efficient flow of the Form 1099 process. Management Responses: The Accounts Payable Department issued 1099’s on January 31, 2008 for the first time utilizing PeopleSoft 8.9. There were many lessons learned. We are currently working with the IT Department to document the process and procedures. We anticipate having written documentation for review by May 2, 2008. Upon completion, we will forward the document to the OAG. Responsibility: Vince Carfagna, Chief Financial Officer; Cathy Peets, Interim Director of Accounting; Christina Jones, Accounts Payable Supervisor Due Date: May 2, 2008

-5-

Vendor Management Audit Observation, Recommendations and Action Plans
OBSERVATION #3 Recording of Vendor Information Vendor Set-up The set-up procedures for use of a one-time vendor and the use of single-payment vendors have not been clearly defined. The PeopleSoft 8.9 environment permits two ways of establishing a vendor for a one-time payment. The current handling of the payment for one time vendors is the same as the 8.4 environment. This environment required all information such as name, address, vendor identification, etc. to be completed in set-up. After the one-time payment, the status of the vendor electronically goes to “inactive”. The additional way, called single-payment, allows a vendor to be set-up as a vendor but does not require all the information needed for a regular set-up. A consistent procedure for processing one-time vendors should be established and communicated to all users. The procedure should be documented. Improper and/or inconsistent processing of one-time vendor payments will cause confusion for all related staff. Improper set-up could cause insufficient documentation to be received and the improper filing of federal forms at year end. It may also increase the risk of duplicate vendors being placed in the system. RECOMMENDATION and MANAGEMENT RESPONSE Develop and implement clear procedures for the use of the one-time vendor set-up and single-payment vendor set-up within the PeopleSoft 8.9 system. Management Responses: The “one-time” payment set-up is determined by Accounts Payable and is in the identifying information field labeled “Persistence”. The “Single Pay” set-up will not used. The procedures are the same for one-time vendor as with other vendor set-up. An application, W-9 and approval by Purchasing are required before payment can be made to the vendor. Responsibility: Vince Carfagna, Chief Financial Officer; Gary Smith, Director of Purchasing Due Date: Implemented

-6-

Vendor Management Audit Observation, Recommendations and Action Plans
OBSERVATION #4 Employee Set-up in Vendor Files It appears that the diligence used in cleansing the vendor files has not been applied to the grouping of vendors listed as employees. Through our testing we noted that terminated employees are not changed to inactive status, vendors have been marked as employees, and others have no activity since 2003. Since management has made the decision to use the accounts payable system to make payments, excluding employee salary, then the vendor records marked as employees should be reviewed and changes made to bring information up to the quality of accuracy in other vendor files. Continuing to pay employees through the accounts payable system will place a risk to the District of amounts made not being recorded properly as additional income and therefore not reported as a part of the employees year-end Form W-2. Management should consider making all payments to employees through the payroll system. Best practice for employee payments is to have all payments made through the payroll system. This includes reimbursements as well as additional types of earned income. RECOMMENDATION and MANAGEMENT RESPONSE Develop procedures to review and update existing vendor files set up for employees at least annually for year end reporting. Management Responses: Purchasing has communicated to Accounts Payable the need to deactivate any employees in the Vendor file that are no longer employed by the District. Accounts Payable is responsible for the maintenance of employee data recorded in the vendor files of People Soft. Accounts Payable has not agreed to this solution. Discussions will be held between Purchasing and Accounts Payable to resolve this issue. Procedures and responsibilities will be written by July 1, 2008. Purchasing is in support of maintaining all payments to employees through the payroll system. We have also requested and support the implementation of an individual separate from Purchasing and Accounts Payable to maintain the vendor files. This would strengthen the internal controls related to vendor files. Responsibility: Vince Carfagna, Chief Financial Officer; Gary Smith, Director of Purchasing; Cathy Peets, Interim Director of Accounting Due Date: July 1, 2008

-7-

Vendor Management Audit Observation, Recommendations and Action Plans
OBSERVATION #5 Verification of Vendor Information Information is received from vendors through the use of an application and the Form W-9. Pertinent information such as name, address, ownership of the company, Federal Identification Number/Social Security Number (FIN/SS), and other required information for proper payment of services and/or goods received are found on these two forms. The information received from the vendor is not verified for correctness. Although the application and the Form W-9 are signed by an appropriate person within the vendor establishment, it is not known whether the information is accurate. Verification of key information of the vendor should be performed by the District. Incorrect FIN/SS, addresses, and entity status of a vendor may result in unnecessary work at calendar year-end in submitting 1099s. Submission of incorrect information could result in fines to the District due to misfiling of tax information. Management has been informed of a Federal website that may be a possibility for vendor verification. RECOMMENDATION and MANAGEMENT RESPONSE Develop a procedure for the verification of vendor information submitted on the application and Form W-9. Management Responses: A Vendor File Procedures Manual was developed dated November 29, 2007. Along with the Form W-9, Purchasing has also implemented the use of the Form W-8BEN. This form is to be used for foreign vendors of the District. The procedures will be the same as those for the Form W-9. Both forms will support due diligence of confirming accurate vendor name and number. Incorrect information submitted on these forms constitutes perjury on the part of the vendor. Purchasing is investigating methods of verifying certain vendor information. It will be decided how the investigation will be completed, who is responsible and what information is to be verified. Purchasing is in support of the District following the best practice of having a separate department maintain the vendor file. As increase compliance measures are put into place at the District, it would strengthen internal controls and allow for better and timely verification of vendor information and corrections for the vendor files. Responsibility: Vince Carfagna, Chief Financial Officer; Gary Smith, Director of Purchasing Due Date: July 1, 2008

-8-

Vendor Management Audit Observation, Recommendations and Action Plans
OBSERVATION #6 System Security IT Staff Access It appears that individuals within the IT function have unrestricted access to vendor pages with the capability to update and add vendor identifying information and also approve the changes made within the system. It is not known if an audit trail of vendor modifications and approvals exists outside of the IT function. In addition there is a DBA ID that appears to be a shared ID amongst the DBA group. Along with this, Purchasing and Accounts Payable may have been given conflicting roles within the vendor management area. This shared ID makes it impossible to know who administered changes to the production data. Understanding that IT must have access to make necessary program changes, it should not include changes to data. Monitoring IT changes should be completed by an individual outside of the department to strengthen the control environment. A conflict of system access and functional roles could result in improper changes that may place the District in a potential fraudulent situation. Procedures should be developed to include the monitoring of changes made within the vendor management screens as well as access to those screens. RECOMMENDATION and MANAGEMENT RESPONSE Develop a monitoring process for operating management to review system modifications made by IT staff. Management Responses: Program level changes, other than update and/or maintenance patches, are direct request from the business owner and are considered customizations. All customizations must be signed off by the Business Services Managers (Accounting, Purchasing, Budget, IT). Stronger controls will be developed for data changes by activating the “audit” function on particular fields. When this is activated any changes made to particular fields with the “audit’ function initiated will have information stored that will specify the Userid and datetime stamp of any changes that were made to those fields. Purchasing will work with IT to identify fields that are candidates for this function and to establish a procedure for review of information. Responsibility: Vince Carfagna, Chief Financial Officer; Gary Smith, Director of Purchasing; Ford Greene, CIO Due Date: July 1, 2008

-9-

Vendor Management Audit Observation, Recommendations and Action Plans
OBSERVATION #7 Staff Access to Vendor Screens and Authority In our audit of vendor management access, it was noted some individuals had system access, but did not require the functionality for their positions. This is a concern since it is not clear whether system access monitoring occurs by role, screens, and operator preferences. A control is in place to enforce that all vendor additions and changes must be approved by an individual designated within the purchasing department. Access to vendor system screens and the roles of the individual apparently are not tightly structured. The audit team requested information to independently verify data provided in an effort to understand why and if this was due to maintenance timing or other legitimate business reasons. This information was requested by OAG but never received. Many organizations (best practice) have a separate department from purchasing and accounts payable maintain the vendor information, which includes access to the data, authorization, as well as obtaining documentation, maintaining accuracy and processing vendor information. RECOMMENDATION and MANAGEMENT RESPONSE Re-evaluate the access individuals have to all screens within the vendor management system and align with their assigned business responsibilities. Management Responses: Gary Smith and Deborah Tracey from Purchasing are the only individuals with security rights to approve a vendor. In Accounting, Christina Jones, Sue Harriff, Kathy Stewart, and Joya Ferguson have security to update the vendor file. Cathy Peets, Cerri Cupples, and Paul Laboski have security to approve only vendors with a status of EMPL. The implementation of a separate department to maintain the vendor file would support the limited access to vendor management screens and also allow for stronger internal controls of the area. Responsibility: Vince Carfagna, Chief Financial Officer; Gary Smith, Director of Purchasing Due Date: Implemented

- 10 -

Vendor Management Audit Observation, Recommendations and Action Plans
OBSERVATION #8 Change Management It was noted during the audit that changes may be made within the system that could possibly go unnoticed by purchasing and or accounts payable. Also, individuals that have left employment of the District or have changed positions within the District have not had their system access changed. Access to systems should be updated immediately for personnel changes. When questioned as to how these changes and others are monitored in the system it became apparent that change management had not been a priority. There appears to be no written procedures concerning personnel changes or other changes necessary within the PeopleSoft system. Procedures should be clearly documented and communicated to all employees to reduce the potential risk of incorrect access and conflict with job responsibilities and system access. RECOMMENDATION and MANAGEMENT RESPONSE Develop change management procedures for vendor management screens to include personnel changes, monitoring of changes, and approval. Management Responses: When an employee is terminated, their user account is automatically locked upon termination. This does not terminate their vendor account, just access to computer systems. There is an automatic distribution list of terminated employees that may be used to update the vendor maintenance file. This distribution list is used by purchasing to deactivate P-cards. Ann Marie Lehner will review list to ensure that Accounting and Accounts Payable are placed on the distribution in order to inactivate vendor accounts of terminated employees. IT has agreed to review the security of all employees on a semi-annual basis for transferred employees. To be proactive in this area, IT will review an existing form, used to activate employee status, to include request of access change due to transfers. The procedure will be developed to place responsibility on chiefs, department heads, and/or supervisors to inform IT of employee status changes. Forms and the procedure for transferred employees will be communicated to all District employees. Responsibility: Vince Carfagna, Chief Financial Officer; Gary Smith, Director of Purchasing; Ford Greene, CIO Due Date: July 1, 2008

- 11 -