MAY 30, 2023
PROPOSAL FOR INTERNAL AUDIT SERVICES For Monroe 2-Orleans BOCES, Brighton Central School District, East Rochester Union Free School District, Brockport Central School District, Fairport Central School District, Churchville-Chili Central School District, Gates Chili Central School District, East Irondequoit Central School District, Greece Central School District, Hilton Central School District, Penfield Central School District, Honeoye Falls-Lima Central School District, Rush-Henrietta Central School District, Monroe One BOCES, Spencerport Central School District, West Irondequoit Central School District & Webster Central School District.
May 30, 2023 Melanie Dickson Administrative Assistant to the Assistant Superintendent for Finance and Operations Monroe 2-Orleans BOCES 3599 Big Ridge Road Spencerport, NY 14559 Dear Melanie: Thank you for the opportunity to submit our proposal to serve as internal auditors for the Monroe 2-Orleans BOCES and its participating school districts (“collectively the “Districts”). Freed Maxick, CPAs PC (“Freed Maxick”) greatly appreciates the opportunity to be considered for appointment. We know that the selection of an internal audit firm is an important decision and realize that the differences between firms are often difficult to discern. However, we can assure you that our experience and capabilities highly relevant to the needs of the Districts. We have extensive experience with BOCES and school district operations in New York and have the resources of a dedicated Governmental Services and Internal Audit Practice, which is committed to serving school districts and providing professional internal audit and consulting services. This is evidenced by our present clients, some of whom are listed as references, and our involvement in the NY State Society of CPAs Committee on Public School Accounting and the NY State Association of School Business Officials. We conduct all school district internal audits according to standards from both the “Yellow Book” and the “Red Book” (Institute of Internal Auditors Professional Practices and standards). Our internal audit consultants hold various professional certifications such as Certified Public Accountant (CPA), Certified Internal Auditor (CIA), Certified Information Systems Auditor (CISA), Certified Six Sigma Black Belt (CSSBB), and Certified Information Systems Security Professionals (CISSP). We have the expertise you desire, coupled with the people and capabilities that will serve your needs with an eye on national best practices and a personalized service approach. This offer is firm and irrevocable for a period of 90 days. We look forward to your review of our proposal, and the opportunity to continue/establish a long-term relationship. We encourage you to contact us during your selection process if you need additional information or have any questions. Very truly yours, Freed Maxick, CPAs, P.C.
Kathryn M. Barrett, CPA Director
David Hansen, CISSP, CISA, PCI QSA, CPA, Director
Table of Contents FIRM QUALIFICATIONS & EXPERIENCE ...........................................................................................................1 QUALIFICATIONS ...............................................................................................................................................2 Risk Advisory Services Expertise..............................................................................................................2 Our Leading Governmental Practice ........................................................................................................3 National, State & Local Organizations.......................................................................................................3 New York State Society of CPAs Committee on Public School Accounting............................................3 Professional Standards in Governmental Accounting ..............................................................................4 Regular attendees and presenters at Governmental Conferences & Seminars .......................................4 License to Practice in NY State ................................................................................................................4 Federal and State Field Reviews ..............................................................................................................4 Peer Review Letter ...................................................................................................................................4 Independence ...........................................................................................................................................4 REFERENCES AND SIMILAR ENGAGEMENTS .................................................................................................5 Prior Engagements with the Districts.......................................................................................................7 ENGAGEMENT TEAM QUALIFICATIONS AND EXPERIENCE ..........................................................................8 Partner, Manager, Supervisory Staff Qualifications & Experience ...........................................................8 Staff Continuity .........................................................................................................................................8 PROJECT APPROACH AND SCOPE OF WORK DELIVERABLES ......................................................................9 A METHODOLOGY BASED ON INTERNAL AUDIT LEADERSHIP ..................................................................10 Risk Management Tools and Technology ..............................................................................................12 AUDIT TIMELINE ...............................................................................................................................................13 PROFESSIONAL FEES .......................................................................................................................................14 EXHIBITS A. Professional Biographies B. Peer Review Letter C. Required Forms
Firm Qualifications & Experience Top 100 Firm -- Freed Maxick is one of the largest providers of professional services in Upstate New York with over 320 professional and administrative staff. We are listed in the Public Accounting Report’s annually updated list of the 100 largest accounting firms in the United States. We have developed a highly diversified client base that is well balanced and not overly dependent on one industry for continued growth. We believe that our clients and our people are our greatest assets. OUR PHILOSOPHY IS GROUNDED IN OUR CORE VALUES:
Recognized for Outstanding Service -- Client service is a significant piece of our brand promise of taking it personally. Understanding how our clients feel about the value we provide is important to us. We have surveyed our client’s numerous times to validate our approach to client service. Each time, the results have confirmed our approach is working. In fact, our last client survey resulting in a net promoter score (NPS) of 88.3. This NPS score earned our firm recognition from Clearlyrated.com as “Best of Accounting” when compared to our Top 100 firm peers across the United States. Access to the Resources of the RSM US Alliance -- Freed Maxick is a member of the RSM US Alliance. The RSM US Alliance provides its members with access to resources of RSM US LLP, the leading provider of attest, tax, and consulting services focused on the middle market, with more than 12,000 people in 84 offices nationwide. RSM US LLP is a licensed CPA firm and the U.S. member of RSM International, a global network of independent attest, tax, and consulting firms with more than 43,000 people in over 120 countries. RSM US Alliance member firms are separate and independent businesses and legal entities that are responsible for their own acts and omissions, and each are independent and separate from RSM US LLP. Commitment When you engage Freed Maxick, be assured that: • We will perform our services timely and efficiently • We will provide services that are designed to help you achieve your goals • All aspects of our client relationships will be handled with honesty, integrity and confidentiality • Your questions will never go unanswered - we make a point responding to client questions and needs as soon as possible • Our policy is to service our client needs in a professional manner and with competitive fees
FREED MAXICK PROPOSAL FOR INTERNAL AUDIT SERVICES
|
1
Qualifications Internal Audit Expertise and Depth of High-Quality Resources We have a large local Internal Audit Risk Management practice with highly qualified Internal Audit personnel. We have significant expertise in Risk Management with a focus on Internal Audit Outsourcing. Because we recognize that internal controls today rely heavily on information technology, we have a dedicated staff of IT Auditors. Working with our qualified professionals enables the Districts to leverage its in-house resources more effectively. Over the past ten years we have performed internal audits and tests of controls in the following areas: • • • • • • • • • •
Purchasing and cash disbursements Payroll processing Employee benefits Budgeting and long-term financial planning General ledger maintenance Wire transfers Fuel depot operations Information technology Community education enrollment and cash receipts Attendance
• • • • • • • • •
School lunch cash receipts Grant compliance Medicaid processing STAC processing Termination benefits Security over student assessment data Purchase card transactions Fixed assets Decentralized cash receipts – athletic events, instrument rentals and library fines
Risk Advisory Services Expertise We offer a full range of enterprise risk management services. Because we’re committed to helping you succeed, we take a value-added approach to risk management — looking for opportunities to improve productivity and performance and suggesting improvements where appropriate. Below is a list of enterprise risk management services offered by Freed Maxick: Risk Management Consulting • • • • • • • • •
Internal audit consulting Business risk assessments Enterprise risk assessments Process analysis and control evaluation Policy and procedure development and reviews Compliance auditing Code of ethics/corporate governance reviews Fraud examination — prevention and detection Internal control reviews and assessments
Information Technology Consulting • • • • • •
System selection and installation support Long-range IT strategic planning Interim IS support IT internal control assessments Security and network intrusion testing services NIST Cybersecurity Framework (NIST CSF)
Privacy Consulting • • •
Ed Law 2D SHIELD IT Strategy, Remediation, & Project Management
FREED MAXICK PROPOSAL FOR INTERNAL AUDIT SERVICES
|
2
Our Leading Governmental Practice Our Firm is dedicated to serving the Districts via our Risk Advisory Services Practice and our Governmental Services Practice. It is comprised of 11 professionals who understand the unique environment that school districts operate in and the compliance issues they face. Our Firm has been involved in serving school districts and other governmental entities for many years, serving as external auditors, internal auditors and consultants to a large number of governmental entities in Western and Upstate New York. The audit will be performed with staff from our Buffalo, Batavia, and Rochester offices. We have decades of combined experience providing auditing and consulting services to 100 government entities of varying type and size, and with varying needs, including BOCES and school districts. We currently serve 11 school districts in Western New York as internal auditors. We understand the economics, operations and trends in the industry, and we devote significant time to training and research activities related specifically to BOCES and school districts. Our reputation is that we are very responsive and proactive in the delivery of services of value to our clients and that we become an integral part of an entity’s team of valued professionals.
National, State & Local Organizations Members of Governmental Professional Organizations: Members of our Governmental Services Practice are actively involved in the NY State Society of CPAs Committee on Public School Accounting, the NY State Association of School Business Officials, and the Government Finance Officers Association, In addition, we are a member of the AICPA’s Governmental Audit Quality center. As a requirement of membership all members of our Governmental Service Practice are required to attain continuing professional education requirements of Government Audit Standard. This education is in addition to the required 24 hours required for Uniform Guidance and Yellow Book audits. We are also an associate member of the New York State Association of School Board Officials (NYSASBO), Rochester ASBO and Buffalo ASBO.
New York State Society of CPAs Committee on Public School Accounting Kathryn Barrett currently serves on the New York State Society of CPAs Committee on Public School Accounting and is the past Chairperson and has been a member of the Committee for more than 20 years. The Committee is a statewide committee of certified public accountants that are at the forefront of emerging accounting issues in the public-school environment. Our presence on the Committee positions us in a manner to be involved as issues related to our school district clients emerge. Many times, we are involved in planning for matters before other accounting firms are even aware of them. Another benefit of serving on the Committee is the relationships that we have developed. These include other accounting firms across the State, as well as individuals at the State Education Department and the New York State Comptroller’s office. These relationships are invaluable and allow us to “pick-up the phone and call” should the need arise. Kathryn worked with the ASBO NY in the development of a Uniform Guidance Procedures Manual Template that was made available to all school districts and BOCES to help ensure their compliance with the Uniform Guidance. We are also currently evaluating how GASB Statement No. 87 – Leases and GASB Statement No. 96 – Subscription-Based Information Technology Arrangements should be accounted for equipment lease and software contracts between BOCES and school districts.
FREED MAXICK PROPOSAL FOR INTERNAL AUDIT SERVICES
|
3
Professional Standards in Governmental Accounting Successfully serving the Districts requires that we possess significant knowledge of and experience with governmental entities. Members of our Governmental Services Practice focus the majority of their continuing professional education requirements in these areas. As a result, we are abreast of the most current industry issues and can provide timely updates through regular correspondence with our clients to keep them informed of pertinent accounting and auditing developments. The members of our Governmental Services Practice are also experienced in auditing in accordance with Government Auditing Standards, the provisions of the Single Audit Act and Title 2 U. S. Code of Federal Regulation (CFR) Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (the Uniform Guidance).
Regular attendees and presenters at Governmental Conferences & Seminars We are an associate member of the New York State Association of School Board Officials (NYSASBO), Rochester and Buffalo local chapters of ASBO and our staff attends and presents at the workshops sponsored by those organizations. Individuals in our Governmental Services Practice also attend and present at conferences sponsored by the Government Finance Officers Association, including their annual conference held in Albany, the annual Public School Accounting Conference sponsored by the New York State Society of Certified Public Accountants, and Monroe County School Boards Association. We feel that this level of quality, expertise and resources puts us in a unique position.
License to Practice in NY State Freed Maxick CPAs, P.C. and all key professional staff are properly licensed to practice in New York State.
Federal and State Field Reviews During the past three years, there have been no state of federal desk reviews of our internal audits nor any disciplinary actions taken against the firm. There have been no reports issued by the Office of the State Comptroller that indicate any negative findings on previous or current audits, including special projects. The United States Department of Education has performed a quality review of three of our school district single audits in the past, resulting in no findings or letter of comment.
Peer Review Letter We are subject to a rigorous peer review every three years to ensure the quality of our work is in accordance with our professional standards. Our most recent peer review, which can be found in the exhibits, was an unqualified opinion with no letter of comments.
Independence We recognize that independence in fact and appearance is fundamental to our ability to serve as auditors. Our independence policies are comprehensive and represent the highest standards in the profession. We have invested significant dollars to put monitoring processes, systems, and training in place to ensure that engagement staff is in compliance with the independence rules. Our system for reporting and monitoring financial and other relationships, the profession’s benchmark, is checked against a database. Freed Maxick has clearly articulated policies in place that govern acceptable – as well as restricted – behavior relationships. We would immediately inform you of any conflicts that might arise. We have concluded our independence inquiries with respect to the Districts and no conflict of interest exists between the firm, the districts and its boards. (See Prior Engagements on following page for additional detail.)
FREED MAXICK PROPOSAL FOR INTERNAL AUDIT SERVICES
|
4
References and Similar Engagements In addition to the annual risk assessments, we have performed the following internal audit and information technology services for the following clients. Williamsville CSD Tom Maturski | 105 Casey Rd, Amherst, NY | (716) 626-8012 Contract – 2006 - Current Information Technology Services • Cybersecurity Scanning services including: Vulnerability • Google Suite for Education Review (in process) Assessments, Penetration Testing, and Social • Ed Law 2-d and SHIELD Review (in process) Engineering – Phishing Internal Audit Services • • • • • •
Budgeting, Governance and Reporting State Aid Purchasing and Cash Disbursements Student Assessment Security Employee Benefits Budgeting
• • • • • • •
Purchase Cards Payroll Cash Receipts General Ledger Maintenance Wire Transfers Fixed Assets Fuel Depot
ERIE #1 BOCES Jim Fregelette | (716) 821-7100 Contract – 2007 – Current Information Technology Services • "Acceptable Use” Practices • Access Controls • Access Management • IT Risk Assessment • Asset Management • Backup & Restore Processes • Business Continuity and Disaster Recovery • Disaster Recovery • Endpoint Management • External Penetration Assessment • Hardware & Software Licensing Internal Audit Services • Payroll • Purchasing and Cash Disbursements
• Incident Response • Internal and External Vulnerability Assessment • Network and Wireless Access Configuration and Controls • Organizational Structure, Policy and Procedure Review • Patching & System Maintenance • Physical Protection of Infrastructure • Security Awareness Training • Social Engineering • Third–Party IT Management • Web Application Security Assessment
• Fixed Assets • Community Education Cash Receipts • Budgeting and General Ledger Maintenance
FREED MAXICK PROPOSAL FOR INTERNAL AUDIT SERVICES
|
5
Lancaster CSD Jamie Phillips | 177 Central Ave., Lancaster, NY | (716) (716) 686-3212 Contract – 2009 - Current Information Technology Services • Cybersecurity Scanning Services, Including: Vulnerability Assessments, Penetration Testing, and Social Engineering – Phishing Internal Audit Services • Community education cash receipts • STAC Processing • Payroll • General Ledger Maintenance • Purchasing
• IT Process Review - Business Continuity Planning and Disaster Recovery
• • • • •
School Lunch Cash Receipts State Aid – Attendance State Aid – Building And Transportation Aid Fuel Depot Operations Medicaid Processing
Cheektowaga-Maryvale CSD Steve Lunden | 1050 Maryvale Dr., Cheektowaga, NY | (716) (716) 631-7485 Contract – 2028 - Current Information Technology Services • Cybersecurity Scanning Services, Including: Vulnerability Assessments, Penetration Testing, and Social Engineering – Phishing
• IT Process Reviews – Access Controls (in process) • Network and Wireless Access Configuration Controls (in process)
Internal Audit Services • • • •
Community Education Cash Receipts Fixed Assets Grant Compliance Medicaid Processing
• • • •
Payroll Purchasing and Cash Disbursements STAC Processing State Aid – Attendance and Special Education
Newark CSD Ed Gnau | 100 Miller St., Newark, NY | (351) 332-3203 Contract – 2007 - Current Information Technology Services • Change Management • Computer Operations Internal Audit Services • Attendance • Budgeting, Governance and Reporting • Community Education Cash Receipts • State Aid – Attendance, Transportation and Special Education
• Information Security • IT Governance and Oversight • IT Process Review • Employee Benefits • General Ledger Maintenance • Payroll
FREED MAXICK PROPOSAL FOR INTERNAL AUDIT SERVICES
|
6
Pittsford CSD Leeanne Reister |75 Barker Rd., Pittsford NY | (585) 267-1036 Contract – 2022 - Current Internal Audit Services • Purchasing and Cash Disbursements
Additional Internal Audit Client Listing
• •
• •
East Rochester UFSD
Dansvillle CSD
Lewiston-Porter CSD Gates-Chili CSD
• •
Palmyra-Macedon CSD Cassadaga Valley CSD
Prior Engagements with the Districts We have prior engagements with the following Districts: New Internal Audit Clients - Past 5 Years District
Engagement Partner/Office
District Contact
Pittsford CSD
Kathryn Barrett, CPA Batavia, NY
Leeanne Reister 585-267-1036
Gates Chili CSD
Kathryn Barrett, CPA Batavia, NY
Sally Sanford 585-247-5050
Cassadaga Valley CSD
Kathryn Barrett, CPA Batavia, NY
Jamie Rodgers 716-962-5155
Past 5 Years
District
Engagement Partner/Office
District Contact
Relationship and Timeframe
Lancaster CSD
Kathryn Barrett, CPA Batavia, NY
Jamie Phillips 716-686-3213
Internal audit client (2009-2021). Normal RFP process - District desired Firm rotation.
Spencerport CSD
Kathryn Barrett, CPA Batavia, NY
Rick Wood 585-349-5119
Internal audit client (2006-2019). Normal RFP process- District desired Firm rotation.
FREED MAXICK PROPOSAL FOR INTERNAL AUDIT SERVICES
|
7
Engagement Team Qualifications and Experience Our engagement plan is to serve the Districts with individuals from our Governmental Services and Risk Management Practices from our Buffalo, Rochester and Batavia offices. Kathryn Barrett will serve as the engagement’s overall relationship Director and technical advisor. David Hansen will serve as our Internal Audit and Risk Management subject matter expert. Katelyn Crowley will serve as the Risk Assessment Specialist. Supervisors and staff auditors for the risk assessment and internal audits will be assigned in such a way that leverages their unique experiences and talents. If there is a significant change in the composition of your engagement team, we will inform you immediately and discuss the replacement with you.
Partner, Manager, Supervisory Staff Qualifications & Experience We have designated personnel to be assigned to the client service team who have outstanding technical skills and who are familiar with the operation and financial environment present within school districts and BOCES. Use of these experienced professionals will ensure minimum disruption of your daily routines. Each individual above the senior level is licensed to practice as a certified public accountant in the State of New York. Individuals in our governmental practice are required to obtain, at a minimum, 24 hours of continuing education in this field every two years. This education includes programs sponsored by the AICPA, the NYSSCPA, the School District Internal Auditing Alliance, the NYS Association of School Business Officials, and the New York State Comptroller’s Office, as well as in house sessions on GASB and governmental GAAP updates on a routine basis. Our Governmental Services Practice has presented at the annual ASBO conference on “The Internal Audit Function”, the ASBO Financial, Management, Accounting and Auditing Workshops on “Preparing for Your Audit”, “The Uniform Guidance”, “Long-term Financial Planning in the Tax Cap Era” and “Accounting and Financial Reporting for Post Benefits other than Pensions,” and “GASB Updates”. The NYSSCPA Public School Accounting and Auditing Conference on “Long Range Planning for School Districts,” “Top 10 Internal Control Deficiencies Cited in OSC Reports and Responding to OSC Reports,” “GASB Statement No. 54 Questions and Answers,” “Accounting and Auditing of the Federal Stimulus Funds” and the Four County School Boards Association on “Preventing Fraud, Waste and Abuse in School Districts”. Continuing Professional Education Examples of continuing education courses attended by the members of our Governmental Services Practice every year include • • •
Governmental Audit Staff Training Association of School Board Officials Financial Management, Auditing and Accounting Workshop School District Audit Staff Training
• • •
Annual Government GAAP Update New York State Annual School District Conference New York State Annual Governmental Accounting Conference
Staff Continuity Staffing is a critical issue in the accounting industry today. Our firm takes great pride in its ability to attract and retain qualified professionals. Our staff turnover rate of 15% is well below the national average of 25% and significantly enhances our ability to maintain continuity on engagement staffing. As a result, your risk assessment engagement team will allow for multiple points of contact and provide for maximum staffing continuity should there be any changes in staffing for the engagement. We understand this and see the important role that continuity plays in developing long-term, value-added relationships. We commit our engagement teams for the long-term. The knowledge and experience gained by our team is used to deliver effective and efficient service that addresses your needs. The risk assessment engagement team gains a thorough understanding of the Districts during the risk assessment. We understand that it is extremely beneficial for both the Districts and Freed Maxick to maintain staff consistency from year to year for the risk assessment phase of the engagements. The added value of staff consistency for the Districts is that you have a consistent group of professional available to consult with as questions arise that are intimately familiar with your operations. Employee turnover is common in the public accounting industry but based on our employee track record together with our desire to maintain consistency on the engagement, we are confident that a substantial amount of your risk assessment engagement team will return on an annual basis. FREED MAXICK PROPOSAL FOR INTERNAL AUDIT SERVICES
|
8
Project Approach and Scope of Work Deliverables Our internal audit plan will be designed to provide the Audit Committee and the Board of Education information on the Districts operations and activities. The internal audit provides confidence that the internal controls are effective, operating as intended and that the assets of the Districts are adequately safeguarded. We understand that our internal audit function will not replace the activities being performed by the Districts’ Claims Auditor. The foundation of our internal audit plan will be a thorough understanding of the existing internal control policies and procedures of the Districts. If during this process we find weaknesses or inefficiencies in the internal control policies and procedures, we will address the situation and make recommendations for improvement. We believe that our internal audit plan has been designed to evaluate existing internal controls, identify potential weaknesses in internal controls and provide recommendations and best practices to improve each District’s existing control structure. The plan would have the following stages or cycles: • • • • •
•
Documenting our understanding of internal control system and internal claims audit function. Provide recommendations or comments with respect to improvements, as appropriate. Risk assessment of the Districts’ financial operations. Meeting with the audit committee to review the results of our risk assessment and recommend an internal audit plan. Testing of controls and performing internal audit procedures with respect to specific areas or activities identified as high risk. This will generally include detailed testing and not analytical procedures. The internal audit is designed to address all areas of concern of the Districts, including, but not limited to compliance with laws and regulations. The audit plan is approved by management and the audit committee prior to the audit being performed. Generally, internal audit testing is performed based on a sample of transactions selected at random and with a sample size deemed to be sufficient to draw conclusions from the testing performed. Meeting with the audit committee and management to discuss the results of the internal audit tests and recommendations.
FREED MAXICK PROPOSAL FOR INTERNAL AUDIT SERVICES
|
9
A Methodology Based on Internal Audit Leadership Our integrated School District Internal Audit methodology utilizes the broad definition of internal control as described in the COSO Internal Control Framework, the standard of internal control and the Yellow Book Standards. This is an integral component of our integrated risk management audit approach and it is built into our methodology. These control frameworks allow us to focus our risk management approach on the relatively higher risk activities and the related control structure. It also results in valueadded insights to your organization including operational improvements that reduce cost and improve efficiency. Because we recognize that changes in business operations have IT implications, we include technology risk consultants in the process. Unlike many firms, we deploy our own IT professionals, who work from local offices, as needed during your engagement. The plan would have the following stages or cycles: 1. Understanding Internal Controls 2. Evaluation of Internal Controls, Processes and Procedures 3. Risk Assessment and Internal Audit Plan
4. Internal Audit 5. Maintenance 6. Continuous Communication
1. Understanding of Internal Controls The planning phase of our engagement will include a walk-through and thorough documentation of the District’s internal controls. The basis of this understanding will be interviews with Districts staff responsible for each control area, our understanding of control system of the District’s accounting and financial management systems and performance of transaction walkthroughs and testing. Based on our understanding of internal controls over these areas, we will prepare a memorandum detailing our understanding of the internal controls. This will be provided to management for their review to ensure the accuracy and completeness of our understanding. During the planning phase we will also gain an understanding of the existing internal claims audit function. This will be done to ensure that our procedures do not duplicate but enhance those being performed by the Claims Auditor. During this process if we become aware of areas in which the function of the Claims Auditor can be expanded to become more efficient or effective, we will communicate them to the Districts and make appropriate recommendations. Our understanding of internal controls will also include gaining an understanding of specific risk areas that, based on our knowledge, experience and involvement with school districts, are inherent to school districts. 2. Evaluating Internal Controls, Processes and Procedures Based on our understanding of the District’s internal controls processes and procedures, we will evaluate the existing controls for weakness in the control system and opportunities for improvement. We will also evaluate the District’s readiness and planned implementation of specific new regulatory, industry or accounting requirements such as implementation of Education Law 2D, documentation of grant administration policies and procedures and implementation of Government Accounting Standards Board (GASB) Statement No. 87 – leases. This process will also include providing recommendations or comments with respect to improvements, as appropriate, that are specific to the Districts.
FREED MAXICK PROPOSAL FOR INTERNAL AUDIT SERVICES
|
10
3. Risk Assessment and Internal Audit Plan Based on our understanding of the financial operations of the Districts, the Public-School Accounting Industry, and other internal and external operating factors, we will assess risk based on a matrix scoring system that will weigh various risk elements to arrive at a ranking of the Districts’ financial operations or activities. This process includes assessing the risk of an entire control cycle, the specific risks within a control cycle, or an entire of area of operations. Upon completion of our risk assessment, we will prepare a report that includes the results of our risk assessment, identified risks, suggestions for improvement of internal controls to mitigate any risks that have been identified and a recommended internal audit plan. The plan will not be an internal claims audit and it will not audit all areas of the District’s financial operations. The internal audit plan will focus on the highest areas of risk within the District’s financial operations and will provide for a maintenance plan to ensure that areas of lower risk are monitored in a preventative manner. Our intent is to design an internal audit plan that is multi-year in nature. A multi-year plan prioritizes tasks while allowing the Districts to manage the cost of carrying-out the internal audit. We will present our internal audit plan and the results of our risk assessment to the Audit Committee for comments, consideration and approval. This meeting will also serve as a forum to address the risk assessment and internal audit process. Discussions may include determining if revisions should be made to the process, or if the process should be expanded to address other areas of concern to the Districts. Upon approval of the audit plan, we would schedule and begin the actual internal audit. 4. Internal Audit The internal audit includes the testing of controls and performing testing procedures with respect to specific areas or activities identified as higher risk. The internal audit plan, sample sizes, analytical procedures and internal audit timeline will vary based on the results of our risk assessment and areas to be tested. Each internal audit is carefully planned and executed. The internal audit is designed to address all areas of concern of the District, including, but not limited to compliance with laws and regulations. The planning phase of the internal audit includes developing and audit plan that is specifically designed for the Districts, including sample sizes and segmentation and/or stratification of the transactions to be tested. Sample transactions are selected at random and with a sample size deemed to be sufficient to draw conclusions from the testing performed. The audit plan is reviewed with management to ensure it meets their needs, risks and concerns. The audit plan is approved by management and the audit committee prior to the audit being performed. The execution phase includes detailed testing and possibly trend analysis and analytical procedures as outlined in the audit plan. We will test the District’s compliance with General Municipal Law, Education Law and the District’s policies as they relate to the area to be tested. At the conclusion of the internal audit, we will prepare a report that outlines our testing procedures, the results of our testing and recommendations improvement of internal controls or mitigation of findings. The final phase of the internal audit is our meeting with the audit committee and management to discuss the results of the internal audit tests and recommendations. 5. Maintenance Maintenance ensures that the internal controls continue to operate as designed. The role of the Claims Auditor is very much a maintenance function. We will assist the Audit Committee and the Board of Education by reviewing and providing appropriate comments and recommendations on the procedures performed. We will also periodically review the work of the Claims Auditor to ensure that the procedures are performed and done so in a timely manner. Maintenance also includes an annual evaluation and updating of the risk assessment. As recommendations are made and changes are implemented, areas that were originally identified as high risk will likely be downgraded to low or moderate risk. Other areas will be brought to the top of the list as areas to address as high risk in subsequent periods. These areas are more likely to be smaller in scope and the internal audit will focus more on very specific risks associated with specific types of transactions. Throughout the process, we will continue to evaluate the results of the State Comptroller’s Office audits of school districts. We will also continue to review any proposed regulations and interpretations set forth by their office and the State Education Department and adjust the internal audit plan if appropriate.
FREED MAXICK PROPOSAL FOR INTERNAL AUDIT SERVICES
|
11
6. Continuous Communication The process of continuous communication includes the exchange of ideas and advice as changes are considered or implemented within the Districts, the accounting profession, or by regulatory authorities. This process begins after our audit is complete and continues throughout the year. We encourage our clients to discuss special concerns with us as they arise so that timely and constructive advice may be rendered. We make a concerted effort to always be informed about our clients’ “business health”.
Risk Management Tools and Technology We utilize our Caseware software in the delivery of risk management services. This is a fully integrated tool designed to streamline and automate the entire risk management process. Caseware offers the following features: Audit planning and management • • • •
Define your audit universe and track historical data Perform risk assessment and analysis Use the outcome of the risk assessment to prepare your audit plan Control adequacy and effectiveness
Perform planning and risk analysis • • • • • •
Use standard and customized work programs Attach supporting workpapers in file formats such as Excel, Word, Visio or ACL Document your exceptions and findings Track and report on key milestone dates Issue management Automatically track findings noted in the audit and monitor action plans status Summarize findings by auditor, responsible manager, status, and risk category
Frequently used information • •
Store audit programs in a library to be easily accessed and imported into engagements Ability to store policies and procedures in a quickly accessed library
FREED MAXICK PROPOSAL FOR INTERNAL AUDIT SERVICES
|
12
Audit Timeline We understand the time demands and obligations of administrators and staff, thus we will work with management to develop a work plan timeline that is convenient for you. Previous internal control narratives will be used as a baseline and will be updated to document current internal controls policies and procedures. A typical engagement timeline is as follows:
Engagement Phase
Description of Services
•
Review the Districts documentation of internal controls and internal claims audit process. If comprehensive documentation cannot be provided, we can provide a process and procedures template to be completed by District personnel.
•
Meetings to review the District’s internal controls over various financial transaction cycles and update documentation of the internal controls over these cycles.
•
Develop our risk assessment and audit plan.
•
Meeting with the Audit Committee to present our risk assessment results and proposed internal audit plan
Early 2024
•
Commence the internal audit procedures. We anticipate that our procedures would be scheduled in advance. Depending on the nature of the area being audited our visit may be for one day or multiple days.
March/April 2024
Risk Assessment & Development of Internal Audit Plan
Execution of Internal Audit Plan
Communication
Maintenance
Date
•
Present the Audit Committee with the internal audit report
•
Update risk assessment and internal audit plan to begin the next year's engagement
Upon Appointment
May/June 2024
Fall/Winter 2024
FREED MAXICK PROPOSAL FOR INTERNAL AUDIT SERVICES
|
13
Professional Fees We are committed to providing you with a fee that is fair for the high quality of service and value that you will receive. Our engagements are valued based upon anticipated time and effort, the skill level of personnel needed, and rates set by our firm, appropriate to the local market. To be clear – our practice is to bid our work fairly and competitively. We do not exaggerate the hours to give the perception of a low rate per hour nor do we practice “low-balling”, with the intention of submitting unanticipated, extra, or a la carte billings. We will honor our fee commitments. We realize clients need to call for information or ideas that require quick, concise responses. In the interest of strengthening the trust and working relationship between our organizations, we believe your personnel should feel comfortable calling for necessary information without fear of incurring additional charges. In fact, we encourage such a relationship and billing for the time involved would only serve to stifle it. As such, we do not bill for routine phone conversations or consultations. While the fixed fee entitles the Districts to unlimited consultation with us, if your questions or issues require additional research and analysis beyond the "routine", then that work will be subject to an additional fee, to be negotiated before the requested service is performed. In the interest of developing/continuing a long-term relationship with the Districts we agree to waive all start-up costs associated with an initial risk assessment provided we are appointed for a term of three years or longer. This translates into approximately 40 hours of professional service during the first year of our engagement. These pro-bono hours are provided primarily by the Engagement Partner, Risk Assessment Specialist and Senior Specialists to ensure these professionals, primarily responsible for your internal audit services, have a complete and comprehensive understanding of the operations of your organization to ensure the services you are provided are of the highest quality. Risk Assessment Hours Risk assessments are performed by experienced manager and senior level resources. These individuals have the industry knowledge and background that are critical in performing a high-quality risk assessment. Interviews and Update of Internal Controls
Risk Assessment and Reporting
Less Pro- Bono Hours
Total Hours
Partner
0
13
(8)
5
Risk Assessment Specialist
65
12
(32)
45
65
25
(40)
50 hours
Professional Level
Total
The hours noted above also include meetings with management and the Audit Committee to review the risk assessment, our findings and the internal audit plan. Risk Assessment Fees District
YE 6/30/24
YE 6/30/25
YE 6/30/26
YE6/30/27
YE 6/30/28
School Districts
$8,800
$9,250
$9,700
$10,200
$10,700
BOCES
$10,200
$10,725
$11,250
$11,825
$12,400
FREED MAXICK PROPOSAL FOR INTERNAL AUDIT SERVICES
|
14
Internal Audit Hours Each engagement is carefully planned, and a time budget is established for each phase of our work. The time of each individual involved is accounted for, and all staff members are well indoctrinated on the need to control and spend time to the best advantage. Because each internal audit is unique the hours necessary to plan and perform the internal audit will naturally vary. As we develop our internal audit plan for the high-risk areas to be tested, we will review the plan with management and the estimated hours for performance of the internal audit. This will provide the Districts with the opportunity to evaluate the plan, discuss the scope of the engagement and manage the hours and related internal audit fee. Our internal audit staffing model is very different from our risk assessments. Staff can easily conduct a majority of audit testing of internal controls and compliance. This allows us to reduce the blended hourly rate charged for our internal audits. Due to the nature of internal audits, the number of hours necessary to conduct an internal audit and the technical expertise of the professionals assigned to the internal audit will vary depending on the scope of the testing performed. As requested in the Request for Proposal and for the purpose of this proposal the fees outlined below are based on an estimate of 70 hours for an internal audit of an identified high-risk area. Professional Level
Internal Audit Testing
Partner Supervisor Staff Total
7 24 30 61
Reporting and Presentations 3 6 9
Total Hours 10 30 30 70
In advance of each internal audit, we will provide the Districts with an engagement letter outlining the procedures to be performed and the range of hours anticipated for the completion of the internal audit. Understanding that the Districts have limited resources in their budgets, we can work with the Districts to manage the number of hours necessary for completion of the internal audit. Internal Audit Fees YE 6/30/24
YE 6/30/25
YE 6/30/26
YE6/30/27
YE 6/30/28
School Districts
$13,000
$13,650
$14,350
$15,050
$15,800
BOCES
$13,000
$13,650
$14,350
$15,050
$15,800
We are very interested in establishing/continuing a long-term relationship with you. We believe our qualifications, expertise and history of providing high quality internal and external audit and consulting services to school districts and BOCES in the region for over 30 years makes us uniquely qualified to meet your needs.
FREED MAXICK PROPOSAL FOR INTERNAL AUDIT SERVICES
|
15
EXHIBITS A. Professional Biographies B. Peer Review Letter C. Required Forms
Kathryn M. Barrett, CPA DIRECTOR KATHRYN.BARRETT@FREEDMAXICK.COM 585.815.4527 Kathryn M. Barrett, CPA, is a Director in Freed Maxick's Governmental Services and Not-for-Profit Practice. Kathryn joined Freed Maxick in August 1994. Kathryn is responsible for audits, risk assessments, internal audits, and provides consulting services for public school districts, charter schools, private schools, BOCES and local governments . She has considerable experience with audits in compliance with Government Auditing Standards issued by the Comptroller General of the United States and the Single Audit Act of 1996. Kathryn's responsibilities include leading the Governmental Practice of Freed Maxick, CPAs, training and mentoring staff and conducting formal internal and external training in auditing an accounting. She has represented the Firm at various professional seminars and has been a guest speaker at the Association of School Business Officials, New York School Boards Association, Monroe County School Boards Association, The New York State Society of CPAs, local school districts, and BOCES on various topics impacting school districts.
EDUCATION Bachelor of Science, Accounting/Finance, State University of New York at Buffalo PROFESSIONAL AFFILIATIONS Member & Past Chairperson, New York State Society of Certified Public Accountants Public School Accounting Committee, 2001 - Current Member & Past Chairperson, Genesee and Wyoming County Business Education Alliances(BEA), 2014 - Current Member, Junior Achievement of Western New York, 2018 - Current American Institute of Certified Public Accountants New York State Society of Certified Public Accountants
David Hansen, CISSP, CISA, PCI QSA, CPA DIRECTOR DAVID.HANSEN@FREEDMAXICK.COM 585.360.1481 David is a Director in Freed Maxick's Risk Advisory Services practice. David has a broad background, specializing in both financial and technical assessments, compliance and risk engagements, and other audit and consulting projects. His primary focus includes third-party risk advisory and assurance, compliance with laws and regulations regarding internal controls over financial reporting, Payment Card Industry (PCI) consulting and compliance, and cybersecurity. He has been with the Firm since 2007, helping to grow our risk and compliance consulting services. David's clients include many large, public companies facing complex technical, security, and compliance issues both domestically and abroad. David is the responsible Director for the Firm's System and Organization Control (SOC) Reporting practice, which includes oversight of all SOC clients operating throughout the United States. He develops and implements the methodology used for providing these services, is responsible for reviewing all reports prior to their issuance, and provides technical guidance to clients and internal resources on third-party assurance matters. David has performed numerous SOC examinations himself, including SOC 1, 2 and 3 reports, and consultation for first-time clients, and direction to service providers looking to expand their assurance to cover other services, security and compliance risks and frameworks. David is also the leader of our SOX compliance services practice, which includes helping companies establish compliance functions and complete annual assessments of their internal controls. During his tenure with the firm, David has worked with public companies in numerous industries and several different external auditor firms, including the Big 4. As a PCAOB registrant, David works closely with our SEC audit practice providing guidance and oversight during the completion of integrated audits. David has also been involved in several PCAOB inspections, providing experience and perspective that he uses when delivering these services to our clients. David also leads Freed Maxick's Payment Card Industry Compliance (PCI) practice as the Firm's lead Qualified Security Assessor, directing all RAS practice resources to execute Reports on Compliance and other assessments in accordance with the PCI Data Security Standards. In this capacity, David has helped companies evaluate their payment streams to determine their compliance obligations, reduce their compliance requirements through the implementation of alternative methods for storing, processing, and transmitting cardholder data, and acted as a subject matter expert with his clients' customers and regulators.
EDUCATION Bachelor of Business Administration, Finance, State University of New York at Buffalo Master of Business Administration, Accountancy, State University of New York at Buffalo
PROFESSIONAL AFFILIATIONS Board of Governors, Rochester Chapter of the Institute of Internal Auditors
Prior to his career with the Firm, David was a member of a global IT audit team with a large, international manufacturing company where he participated in several multinational internal audit engagements, including Sarbanes-Oxley reviews, and commonly served as a facilitator with members of the business community and the organization's external auditors.
Katelyn M. Crowley, CPA, CCBA, CBAP, CPA MANAGER KATELYN.CROWLEY@FREEDMAXICK.COM 716.362.6281 Katelyn M. Crowley, CPA is a Manager in Freed Maxick's Risk Advisory Services practice. She joined the firm in July 2018. Katelyn graduated Canisius College in May 2018 with a Bachelor of Science degree in Accounting and Accounting Information Systems. She went on to graduate in December 2018 with a Master of Business Administration degree in Accounting from Canisius College. Katelyn received her Certified Public Accountant license in September 2020. Katelyn is a Certified BSA/ AML Professional as of August 2021 and is a Certified Community Bank Credit Analyst as of April 2022. Katelyn has been involved with providing risk assessments to numerous school districts, starting in December 2019. She has performed interviews, reviewed narrative procedures, updated/ created risk ratings of business areas, and completed risk assessment reports. Katelyn has worked extensively on Sarbanes-Oxley engagements, testing controls in the Inventory, Order To Cash, Payroll, Treasury, Procure to Pay, Financial Statement, Revenue, and Property, Plant, and Equipment cycles. Katelyn has experience with internal audit engagements, in which she has tested controls involving Information Technology General Controls, Billing Cycle, and Internal Segregation of Duties controls. Katelyn has been involved in executing Service Organization Control engagements. She has worked on SOC 1 and SOC 2 engagements, including financial institutions. Katelyn has performed engagements that have provided exposure to several different fields of business, including financial services, technology, and manufacturing. She has also worked on financial institution audits including compliance, asset lending management, and bank secrecy, specifically fund transfer auditing. Katelyn also has experience performing risk assessments for numerous school districts including conducting interviews, updating/ creating risk ratings of business areas, and completing risk assessment reports.
EDUCATION Bachelor of Science, Accounting and Accounting Information Systems, Canisius College Master of Business Administration, Accounting, Canisius College
PROFESSIONAL AFFILIATIONS Member, ICBA, January 2021 to present Member, AICPA, January 2021 to present Member, IIA, March 2019 to present
One East Fourth Street, Suite 1200, Cincinnati, Ohio 45202 P. 513.241.3111 | F. 513.241.1212 | cshco.com
Report on the Firm’s System of Quality Control December 24, 2020 To the Shareholders of Freed Maxick CPAs, P.C. and the National Peer Review Committee We have reviewed the system of quality control for the accounting and auditing practice of Freed Maxick CPAs, P.C. (the firm) applicable to engagements not subject to PCAOB permanent inspection in effect for the year ended June 30, 2020. Our peer review was conducted in accordance with the Standards for Performing and Reporting on Peer Reviews established by the Peer Review Board of the American Institute of Certified Public Accountants (Standards). A summary of the nature, objectives, scope, limitations of, and the procedures performed in a System Review as described in the Standards may be found at www.aicpa.org/prsummary. The summary also includes an explanation of how engagements identified as not performed or reported in conformity with applicable professional standards, if any, are evaluated by a peer reviewer to determine a peer review rating. Firm’s Responsibility The firm is responsible for designing a system of quality control and complying with it to provide the firm with reasonable assurance of performing and reporting in conformity with applicable professional standards in all material respects. The firm is also responsible for evaluating actions to promptly remediate engagements deemed as not performed or reported in conformity with professional standards, when appropriate, and for remediating weaknesses in its system of quality control, if any. Peer Reviewer’s Responsibility Our responsibility is to express an opinion on the design of the system of quality control and the firm’s compliance therewith based on our review. Required Selections and Considerations Engagements selected for review included engagements performed under Government Auditing Standards, including compliance audits under the Single Audit Act; audits of employee benefit plans, and examinations of service organizations (SOC 1 and SOC 2 engagements). As a part of our peer review, we considered reviews by regulatory entities as communicated by the firm, if applicable, in determining the nature and extent of our procedures. Opinion In our opinion, the system of quality control for the accounting and auditing practice of Freed Maxick CPAs, P.C. applicable to engagements not subject to PCAOB permanent inspection in effect for the year ended June 30, 2020, has been suitably designed and complied with to provide the firm with reasonable assurance of performing and reporting in conformity with applicable professional standards in all material respects. Firms can receive a rating of pass, pass with deficiency(ies), or fail. Freed Maxick CPAs, P.C. has received a peer review rating of pass.
Clark, Schaefer, Hackett & Co. Certified Public Accountants
APPENDIX A Fee Schedule Maximum Base Price as Proposed District Brighton CSD Brockport CSD Churchville-Chili CSD East Irondequoit CSD East Rochester CSD Fairport CSD Gates Chili CSD Greece CSD Hilton CSD Honeoye Falls-Lima CSD Monroe One BOCES Monroe 2 - Orleans BOCES Penfield CSD Rush-Henrietta CSD Spencerport CSD Webster CSD West Irondequoit CSD ,,
YE 6/30/24
YE 6/30/25
YE 6/30/26
YE6/30/27
YE 6/30/28
$21,800
$22,900
$24,050
$25,250
$26,500
$21,800
$22,900
$24,050
$25,250
$26,500
$21,800
$22,900
$24,050
$25,250
$26,500
$21,800
$22,900
$24,050
$25,250
$26,500
$21,800
$22,900
$24,050
$25,250
$26,500
$21,800
$22,900
$24,050
$25,250
$26,500
$21,800
$22,900
$24,050
$25,250
$26,500
$21,800
$22,900
$24,050
$25,250
$26,500
$21,800
$22,900
$24,050
$25,250
$26,500
$21,800
$22,900
$24,050
$25,250
$26,500
$23,200
$24,375
$25,600
$26,875
$28,200
$23,200
$24,375
$25,600
$26,875
$28,200
$21,800
$22,900
$24,050
$25,250
$26,500
$21,800
$22,900
$24,050
$25,250
$26,500
$21,800
$22,900
$24,050
$25,250
$26,500
$21,800
$22,900
$24,050
$25,250
$26,500
$21,800
$22,900
$24,050
$25,250
$26,500
APPENDIX B SCHEDULE OF FEES FOR ADDITIONAL SERVICES AND AUDITS IF REQUESTED BY PARTICIPATING SCHOOL DISTRICT
Hourly Rate Partners Managers Supervisory Staff Staff Other (Specify)
$350 $230 $205 $160
APPENDIX C PROPOSER WARRANTIES I.
Proposer warrants that it is willing and able to obtain an errors and omissions insurance policy providing a prudent amount of coverage for the willful or negligent acts, or omissions of any officers, employees or agents thereof.
IL
Proposer warrants that it will not delegate or subcontract its responsibilities under an agreement without the prior written permission of each affected School District.
III.
Proposer warrants that all information provided by it in connection with this proposal is true and accurate.
Name (typed):
Kathryn M. Barrett
Title:
Director
Firm:
Freed Maxick CPA’s P.C.
Date:
May 30, 2023