The Bonadiop Group - Proposal for Monroe BOCES 2 Internal Audit (1).pdf

Proposal for Internal Auditing Services May 25, 2023

May 25, 2023 Monroe 2-Orleans BOCES Melanie M. Dickson Administrative Assistant to Steve Roland, Assistant Superintendent for Finance and Operations 3599 Big Ridge Road Spencerport, New York 14559 Dear Ms. Dickson: It is The Bonadio Group’s (Bonadio) pleasure to submit this proposal to provide internal audit services to the Monroe 2-Orleans BOCES acting as the coordinator for the participating school districts (the Districts) for the contract commencing July 1, 2024, and ending June 30, 2028. Bonadio has read and understands the specifications and is committed to performing the work as presented in of the Districts’ Request For Proposal. The attached proposal sets forth the qualifications of our firm and the scope and approach to provide the services you desire. We hope that as you read our proposal, you sense our strong commitment to serve the Districts with the best in auditing and other professional services. Internal Audit—More Important Than Ever Public entities, including school districts, face mounting pressure to insure they are protected against fraud, cyberattack and other security risks in an age when these threats can be perpetrated with increasing technological sophistication. Unfortunately, many school districts are not implementing strategies and tactics to match the levels of these threats. In 2005 NYSED enacted the 2005 Accountability Legislation in response to pervasive fraud occurring in a New York State School District. One of the new requirements from this legislation was the requirement of an internal audit function. It has been nearly 20 years since that requirement was enacted, and in many cases, schools have merely selected the lowest cost provider without considering the long-term implications. Often, the internal audit function has been relegated to repeating testing and not developing meaningful insights and policies. This not only can put the district at risk, but it is also a wasteful expenditure for the district and ultimately the taxpayers. Bonadio has a better way. At Bonadio, we believe that the internal audit function is a critical business component that deserves focused attention in today’s hyper-connected world. Our internal audit team is not only one of the most experienced in New York State, they are innovators and proven problem-solvers who have a wealth of experience with school districts and internal audits. They understand that an internal audit is a strategic tool to help school districts operate more securely, efficiently and in compliance with new NYSED regulations. We currently have over 70 school districts and BOCES under contract for internal and external auditing services as well as consulting engagements. We are school district experts.

While the attached proposal provides detail, we would like to highlight its key elements: Prompt Service: Our firm is committed to prompt service. We commit to meet or exceed your expectations and the timelines. We have extensive experience with nVision and WINCAP. Ask us how this will make your audit more effective while reducing the time your staff spends on the audit. School District Knowledge: Through our committee service and our regular attendance at ASBO, NYSSBA, GFOA, and other industry group meetings, we stay current on all issues that affect our school district clients. We will keep you abreast of changes throughout the year as they come up. Statewide capability: As one of the largest independent audit firms in New York, our size allows us to easily commit to the required resources you desire, and we believe that you will find our fees very competitive and reflective of our desire to serve as your auditors. Value: Our extensive experience with school districts allows us to provide the District with an efficient and knowledgeable audit approach resulting in very competitive fees. We want to work for you! We look forward to the opportunity to work with the Districts and are committed to assisting you in achieving your goals and making all of the resources of our firm available to you. If you have any questions regarding the information contained in this proposal or on any other matter, please contact me at (212) 600-2854 or tdoyle@bonadio.com. I am available, at your convenience, to meet with you to discuss any questions you may have and to demonstrate our interest in serving you. Firm and Irrevocable Offer Bonadio & Co., LLP agrees to all the requirements, conditions, and contract terms, and to provide all the services as outlined in your Request for Proposals. I am authorized to contractually bind the Firm for the purpose of fulfilling the contract, if awarded. This proposal is firm and irrevocable for 90 days from May 25, 2023. After this time, Bonadio may elect to modify the quote fees to meet the factors in place at that time. We are not obligated to honor the fees listed in the proposal after that the irrevocable offer period. BONADIO & CO., LLP

Timothy J. Doyle, CPA Partner

Contents Qualifications of the Firm and Assigned Staff

1

References

11

External Quality Control Review

12

Work Plan

15

Appendices A—Fee Schedule B—Hourly Rates C—Proposed Warranties D—Affirmation E—Bonadio Commitment to Diversity, Equity & Inclusion

Qualifications of the Firm & Assigned Staff Firm Background & Experience Bonadio was founded in 1978 and has grown to be the largest independent provider of accounting, business advisory and financial services in New York. Bonadio now currently employs approximately 900 personnel, including a dedicated governmental client service group consisting of 12 partners, 4 principals, 7 managers, and numerous staff accountants. Over the years we’ve merged in several firms which have helped us to grow our client base, but more importantly has expanded our expertise both technically and geographically. We serve school districts and municipalities that desire quality professional accounting advice at a reasonable cost, and who need personalized and timely services. Bonadio provides an environment where creative, people-oriented professionals practice accounting without some of the constraints inherent in very large firms. We believe that our size is a reflection of the outstanding service level we provide to all our clients. It is this combination that has made us successful and is responsible for our growth. We provide highly technical and quality service commensurate with that of the largest certified public accounting firms. However, we are able to respond quickly and personally to the needs of our clients because we are structured to service our clients in this way. You will interact regularly with our most experienced personnel, i.e., partners, principals, and managers. This is in sharp contrast to most accounting firms where quality involvement of their most experienced personnel is limited. We are a hands on firm and do our work on-site with qualified staff where answers to questions can be quickly obtained through discussions with District staff. Many other firms will inundate you with staff, have you copy significant amounts of data, then take that information back to their office to complete the audit. These audits tend to drag out endlessly and are a burden to you and your staff. Our preference is to send the right amount of competent staff to perform the audit in the field where you and your data resides. Our paperless audit approach allows us to electronically capture or obtain the supporting documentation we need without you wasting staff time or resources copying what we need. What’s important with our approach is that we build several review steps into our preparation for issuance. These include internal and external processes to ensure your issued reports meet your expectations and all technical requirements. We will meet with management prior to final issuance to review all draft documents. This ensures that all materials are accurate and clear for their indented users. There is no national office hierarchy to contend with, so any matters requiring consultation can be dealt with in any of our offices. The engagement partner for each job has full autonomy in making decisions. This enables prompt turnaround and the ability to deliver timely and outstanding service to our clients.

The Bonadio Group

1

A Top 50 National CPA Firm

• Over 900 employees • More than $125 million/year in firm revenues • 161 partners/ principals • 112 managers

• Albany • Buffalo • Dallas, TX • East Aurora • New York City • Rochester • Syracuse • Utica • Rutland, VT

• Accounting and Auditing • Business Advisory • Healthcare Consulting • IT Consulting • Internal Audit Services • Outsourced Quality Control Function • Outsourced Training • Peer Reviews • Risk Management

• Arts and Cultural • Colleges and Universities • Financial Institutions • Foundations • Governments • Healthcare • Human Service Providers • Individuals Labor • Private School K-12 • Privately Held • Public Companies • Small Businesses • Tax-Exempt Entities

• Tax Planning and Preparation The Bonadio Group

2

Relevant Experience When it comes to the business of government, Bonadio is all business. Whether it’s performing an annual financial statement audit, analyzing cost containment and saving s opportunities, assisting with GASB implementation, attacking Medicaid fraud and abuse, or helping clients navigate the new American Rescue Plan, Bonadio is prepared to deliver outstanding results for remarkably reasonable fees. The quality of our services and the expertise of our staff have made us one of the most successful CPA firms in New York State.

Types of Bonadio’s Government Clients School Districts and BOCES Villages Towns Counties Cities State of New York Public Authorities State of New York Departments Industrial Development Agencies Boards of Election

On an annual basis, Bonadio conducts hundreds of different types of audits for a variety of governmental entities. We audit financial statements, perform compliance and operational audits, help our clients assess and remediate risk, & More. Our auditors are charged with understanding and applying the most recent GASB, Yellow Book, and other auditing standards, and are known for their responsiveness, dedication to detail, insightful management reports, and ability to communicate findings in an understandable manner. Beyond audits, Bonadio works with governmental entities to find ways to cut operational costs, streamline operations, eliminate waste, and uncover fraud. Our CPAs, MBAs, and Certified Forensic Examiners bring real world, hands-on experience backed by academic and professional credentials in internal auditing, information systems auditing, forensic accounting, integrated resource management, and purchasing management, among other services. Bonadio meets all federal government qualification requirements for auditors who perform Single Audits, including the licensing, independence, quality assurance, and continuing professional educational requirements of the GAO's Government Auditing Standards. Additionally, our firm is a member of the American Institute of Certified Public Accountants' Division of CPA Firms and the New York State Society of Certified Public Accountants. We currently provide various audit services to over 70 school districts throughout New York State.

Bonadio is a diversified professional services firm offering multi-dimensional accounting and auditing, business advisory and financial services to clients around the world. • A Top 100 CPA Firm in the U.S. by Public Accounting Report and Inside Public Accounting. − Ranked 43rd in 2023 on Accounting Today’s list of Top 100 Firms • Identified by Practical Accountant as a CPA Innovative Firm. • Identified by Accounting & Financial Women’s Alliance (AFWA) and the American Women’s Society of Certified Public Accountants (AWSCPA) as a Best Accounting Firm for Women • Named as one of the 2022 Best Companies to Work For in New York by FORTUNE and Great Place to Work® • Ranked in Forbes as one of America’s Best Tax and Accounting Firms in 2022

The Bonadio Group

3

School District/BOCES Client List We believe the value to our clients is based on two things: 1) relevant expertise and 2) sound, practical advice. You will not find a comparable dedication of resources and practice size in any other firm in New York. This allows your client service team to have the depth of knowledge and experience to meet your critical needs. Below is a sample list of our education clients: While we serve over 300 Government clients, we have included a selection of our engagements currently performed by our public education specialists that we feel demonstrates our performance relative to Schools/BOCES and specific downstate engagements. We would be happy to provide additional references as needed. Altmar-Parish-Williamstown Central School District Arlington Central School District Auburn Enlarged School District Baldwinsville Central School District Barker Central School District Bedford Central School District Berlin Central School District Berne-Knox-Westerlo Central School District Burnt Hills-Ballston Lake Central School District Camden Center School District Cheektowaga-Sloan Union Free School District Cooperstown Central School District East Greenbush Central School District Eastern Suffolk BOCES Ellenville Central School District Granville Central School District Greece Central School District Haldane Central School District Haverstraw-Stony Point Central School District Jefferson-Lewis BOCES Hinsdale Central School District Hoosick Falls Central School District Indian River Central School District Liverpool Central School District Lyndonville Central School District Manhasset Union Free School District

The Bonadio Group

Middleburgh Central School District New York Mills Union Free School District Nanuet Union Free School District Nassau BOCES Onondaga-Cortland-Madison BOCES Orleans-Niagara BOCES Oswego City Central School District Phoenix Central School District Putnam Northern Westchester BOCES Sauquoit Central School District Schenectady City School District South Glens Falls Central School District Spackenkill Union Free School District Stillwater Central School District Syracuse City School District Tarrytown Union Free School District Trumansburg Central School District Tuckahoe Union Free School District Voorheesville Central School District Wappingers Central School District Wayland-Cohocton Central School District Western Suffolk BOCES Whitesboro Central School District Wayne-Finger Lakes BOCES York Central School District

4

Why Bonadio is the best qualified. Bonadio is best qualified to serve as the Districts/’ Internal Auditor. We are the largest CPA firm in the region and have significant government, School District and BOCES experience statewide. We have a solid group of experts available to serve you today, and the years to come.

Deep Understanding The School District Financial Accountability regulations issued by the State Education Department (the Five Point Plan) require the internal audit function to include at minimum: 

Development of a risk assessment of the Districts’ operations, including, but not limited to, a review of financial policies, procedures and practices,



An annual review and update of such risk assessment,



Annual testing and evaluation of one or more areas of your internal controls, taking into account risk, control weaknesses, size and complexity of operations.

Bonadio agrees to provide professional internal auditing services to the Districts as follows: 1. Development of risk assessment - After a thorough review your financial policies, procedures and practices, which would include extensive on-site interviews of staff members, we will develop a risk assessment of your operations. We will take this a step further and categorize the areas assessed on a scale from critical to non-essential. Our primary focus will be on auditing those areas that are critical to your financial and programmatic mission. 2. Tests of internal controls - Testing of your internal controls will be performed each year. Testing will be focused in those areas that were identified as critical during the risk assessment process, as well as those areas that encompass such large amounts of transactions that testing on an annual basis is desirable (i.e. payroll and purchasing). 3. Reporting/Recommendations - We will provide written reports to the Board of Education that will include the findings of the risk assessment, recommendations for improvement and comments regarding internal control structure. We will also assist you in the implementation of procedures to ensure the effectiveness of internal controls. The aforementioned internal auditing services will be performed in two parts. The annual risk assessment will be performed earlier in the year, presented to the audit committee and areas of risk will be discussed for additional testing. The testing of selected area(s) will be performed at an agreed upon time with the Districts to ensure that presentation of results will be presented to the audit committee prior to year-end. We will work with the Districts to schedule the components to ensure that deadlines are met. The duration of time needed for testing are dictated by the areas selected, therefore it is difficult to estimate the time needed.

Fraud and Forensic Accounting Expertise Bonadio has the resources, technology, and depth of experience to not only uncover fraud but to put controls in place to reduce your risk. Through our professional affiliations and commitment to training, the Bonadio forensic team is on the cutting edge of emerging trends of fraud prevention and regulatory issues. Many smaller firms simply do not have the time or staff to devote to these quickly changing and critical areas of concern. At Bonadio, we have more than twenty-eight Certified Fraud Examiners (CFEs) on staff that are available to assist with any situation. In instances where we have assisted our clients in fraud investigations, one of the things we recommend is the engagement be separated from the audit. Additionally, we should be engaged directly by the District’s legal counsel which provides the engagement with attorney-client privilege, and therefore, additional protection while the investigation The Bonadio Group

5

Value-Added Services The breadth of services we are able to provide ensures that your needs are met timely and effectively by your client service team. Examples of the type of consulting services we are able to provide beyond traditional audit services are as follows: • • • • • • • • • • • •

Medicaid Compliance and Training Business office staffing and productivity reviews Business plan development Computer system control reviews Computer system installations Grant compliance reviews Internal audit services Software evaluation and selection assistance Strategic planning consultation Transportation studies IRS audit assistance Bookkeeping and accounting services

It is our hope that we have made a strong and compelling case that the scope, depth, and breadth of our services are second to none, but more importantly, that our objectives are to integrate these services to assure the highest degree of confidence in your audit results and deliverables.

The Bonadio Group

6

Qualifications of Assigned Staff Government Expertise We believe that our people make the difference. The primary personnel assigned to serve you –Tim Doyle, Adam Kozielec, Steven Morse, Michael Connelly, Kristen Clark and Carl Cadregari —have a unique blend of consulting, audit, governmental, and business consulting experience. A complete firm-wide organizational chart can be provided to you upon request. Please be aware that we maintain continuing professional education as required by professional standards and meet the independence requirements of Government Auditing Standards, published by the U.S. General Accounting Office. Each of the individuals listed will be available for continuing advice and counsel throughout the term of the engagement.

Timothy Doyle, CPA—Engagement Partner (tdoyle@bonadio.com) Timothy (Tim) Doyle is a partner with our Public Sector Division. He is a licensed CPA in New York State and has met all federal and New York State continuing professional education requirements for supervision of audits performed under governmental auditing standards. With 30 years of experience in private and public accounting, Tim specializes in providing accounting, consulting and auditing services for a variety of clients, with a primary focus on governmental entities—including school districts, BOCES, community colleges, municipalities, and New York State agencies. Prior to joining Bonadio, he held positions with firms in Buffalo and Hudson, NY, for 13 years that included positions of Staff Accountant, Supervisor, Audit Manager and Office Partner. Tim is a graduate of the State University of New York at New Paltz. Tim is a frequent author, lecturer and panel member on topics including GASB 84 & 87 and Uniform Guidance audit requirements and other technical topics. He has presented at meetings of the New York State Government Finance Officers Association, the New York State Association of School Business Officers and the New York State Association of Counties, among others. Tim is an active member of the New York State Society of Certified Public Accountants, for which he currently serves as President of the Northeast Chapter. Tim is also a member of the NYS Society of CPAs Public School Accounting Committee and the BOCES Sub-committee, and co-chairs the Public Schools Accounting and Auditing Conference. He is also a member of the American Institute of Certified Public Accountants. School Districts and other internal audits that Tim serves as Engagement Executive are as follows: • Manhasset UFSD • Nassau BOCES • Western Suffolk BOCES • Eastern Suffolk BOCES • Bedford CSD • Putnam (Northern Westchester) BOCES • Haverstraw Stony-Point School District • Orange Ulster BOCES • Jacob Javits Center Internal audit • City of Yonkers Internal audit

The Bonadio Group

7

Adam Kozielec, CPA—Engagement Principal (akozielec@bonadio.com) Adam is a principal in our Public Sector Division. He is a licensed CPA with over 20 years of experience in public accounting, internal audit, and consulting. His experience includes six years of public accounting experience in the Big 4 and ten years of experience in the corporate internal audit group of a Fortune 100 healthcare company. Adam has extensive experience managing and executing reviews of the internal control environment for organizations of various types and sizes. This includes Sarbanes Oxley related implementations, audits, monitoring and gap assessments. Adam also specializes in operational and internal control investigations and gap assessments related to regulatory compliance, anti-bribery and corruption compliance, sunshine act compliance, HIPPA, financial statement fraud, and third-party due diligence. Adam is an active member of the American Institute of Certified Accountants. Adam has been a presenter and panel member for various internal and external congresses on third-party due diligence, internal control best practices and anti-bribery and corruption. Adam is a graduate of the Rutgers Business SchoolRutgers University, New Brunswick, NJ.

Adam currently serves as the Engagement Principal for the following relevant clients: • • • •

Bedford Central School District Jacob Javits Center Nassau BOCES Nassau County

• • • •

Orange Ulster BOCES Putnam Northern Westchester BOCES Town of North Castle Town of Ramapo

Steven Morse, CPA, CGMA—Audit Director (smorse@bonadio.com) Steven Morse is a leader on the Bonadio Consulting and Advisory Team, which provides an array of consultative and internal audit services that are specifically designed to improve compliance, internal controls and efficiency for organizations. He has provided internal audit services to colleges and universities, public school districts, and other not-for-profit organizations. Steve is also qualified to perform, and has performed, Quality Assurance Reviews for internal audit departments in any industry. Prior to joining the firm in 2017, Steve was the Rochester Institute of Technology chief audit executive for more than a decade. His past career work experience includes positions such as assistant vice president for Finance and Budget at the National Technical Institute for the Deaf, a college of RIT, as well as holding senior management leadership positions at Genesee Corporation and Deloitte and performing adjunct teaching assignments at the SUNY College at Brockport. Steve holds a Bachelor of Science degree in accounting from the Saunders College of Business at RIT and is a New York State licensed Certified Public Accountant. He also holds the certification of Chartered Global Management Accountant. He is a member of the New York State Society of Certified Public Accountants (current member of the Board of Directors), the American Institute of Certified Public Accountants (current member of the AICPA Council), and the Institute of Internal Auditors.

The Bonadio Group

8

Michael Connelly—Audit Manager (mconnelly@bonadio.com) Michael is a manager in our NYC office with seven years of professional experience providing audit and accounting services in our Government, Compliance, and Labor Division. He specializes in providing accounting, consulting and auditing services for a variety of government clients including counties, cities, towns, school districts, BOCES, community colleges, and New York State agencies. Michael graduated in 2015 with his B.S. in Accounting from the University at Albany. He went on to receive a M.S., in Forensic Accounting from the University at Albany. A sample of relevant clients served by Mike includes: • • • • •

City of Long Beach Eastern Suffolk BOCES Nassau County BOCES Rockland Community College Suffolk Community College

• • • •

Orange Community College Sullivan Community College Town of Ramapo Town of Ramapo LDC

Kristen M. Clark, CPA, HFMA—Quality Assurance Partner (kclark@bonadio.com) Kristen is an audit partner and director of the firm’s Quality Assurance and Education Division with over 25 years of experience with the firm. In this capacity, she is responsible for all of The Bonadio Group’s quality control processes and procedures (including peer review and inspection) and directs and coordinates all training for the firm. Her responsibilities include performing all second partner quality reviews for the firm (all offices); coordinating annual inspection and tri-annual peer review activities and ensuring the firm’s compliance with the related requirements to maintain successful results from these activities; and researching all new technical accounting and auditing pronouncements and providing personnel with the appropriate communication and training. Relative to this engagement, Kristen will be responsible for review and approval of all audit reports and related financial statements and will act as an advisor to the engagement's client service team on technical matters. Kristen received her B.S. degree in Accounting from St. John Fisher College and joined Bonadio in 1986. She is a fellow of the Healthcare Financial Management Association (HFMA), a member of the American Institute of Certified Public Accountants and the New York State Society of Certified Public Accountants, where she is a member of a statewide committee on peer reviews. She is also active in the local civic community as a member and past president of the Rochester Regional Chapter of the HFMA, the United Way of Greater Rochester’s Women’s Leadership Council Steering Committee, and a member of St. John Fisher College Accounting Advisory Board, as well as a past member of the Geva Theatre Center Board, and the National Association of Women Business Owners Board. Kristen was a recipient of the Rochester Business Journal’s 40 Under Forty Award. She was a finalist in the 2018 Athena Award.

The Bonadio Group

9

Carl Cadregari, CISA—Executive Vice President IT/Information Risk Management (ccadregari@foxpointesolutions.com) Carl is an executive vice president with the FoxPointe Solutions Information Risk Management Division of The Bonadio Group. Carl has more than 28 years of experience in providing reasonable and actionable information technology, cybersecurity and architecture, controls deployment, business continuity plans and disaster recovery auditing and planning, cybersecurity by design, and overall controls governance. His expertise in Cybersecurity Controls, Physical, Administrative, and Technical Security, Enterprise Risk Management, Business Impact Analysis, Vendor Management and Disaster Recovery Planning has been applied across many companies across almost all vertical markets from banking to government to healthcare to education. Carl’s experience includes over 18 years in auditing and standards compliance assessment experience, developing and executing programs predicated upon ensuring that client computer controls are functioning according to all applicable regulations. Carl currently holds the following certifications: • Certified Information Systems Auditor from ISACA (CISA) • Certified Assessor for the HITRUST Common Security Framework (CCSFP) • Certified Third Party Risk Professional (CTPRP) • Certified HITRUST Quality Professional Carl’s professional memberships have included the Information Systems Audit and Control Association (ISACA), Health Information and Management Systems Society (HIMSS), HFMA, DRI International (DRI) Systems Administration Networking and Security Institute (SANS), and the Association of Certified Fraud Examiners (ACFE). He is an experienced HIPAA Privacy and Security Assessor and Certified Information Systems Auditor (CISA).

The Bonadio Group

10

References Orleans/Niagara BOCES Scope of Work: Internal Audit Years Engaged: 5+ years Contact: Melanie Conley (716) 731-6800

We encourage you to contact our references as part of your evaluation process.

The Bonadio Group

11

External Quality Control Review Quality Control Bonadio maintains a partner-level position of Director of Professional Excellence, Kristen Clark, responsible for all of the firm’s quality control processes and procedures, including peer review and inspection, and for directing and coordinating all training for the firm. wo other partners and four principals are also fully committed to the Professional Excellence Department and are supported by a support staff of three. Specific responsibilities include: • • • •

Bonadio has a strong and continual commitment to quality and education and dedicates significant professional resources that are necessary to ensure that our clients receive the highest possible quality of attest services and deliverables.

Performing all second partner quality reviews for all the firm’s offices. Coordinating annual inspection and tri-annual peer review activities and ensuring the firm’s compliance with the related requirements. Researching all new technical accounting and auditing pronouncements and providing personnel with the appropriate communication via technical memoranda and training sessions. Developing and delivering, where appropriate, a comprehensive training curriculum for all firm personnel. Bonadio is a member of the AICPA Governmental Audit Quality Center, membership in which requires Bonadio to undergo considerable additional continuing professional education and increased scrutiny by the AICPA.

Governmental Audit Quality Center

The centerpiece of Bonadio’s quality assurance/control system is a policy that requires every audit report produced by the firm to be reviewed and approved by the Director of Professional Excellence and her staff or another partner within the firm.

Our quality assurance program has been complemented by independent periodic peer reviews. We received our most recent report that was successfully executed in October 2020. It is important to note that our most recent quality control review did include a review of specific government engagements. A copy of the peer review report is on the following page.

Federal or State Desk Reviews Because of the significant number of governmental agencies whose regulations and standards we and our clients are subject to, periodic routine inspections of various aspects of our professional practice are made. If requested, we will discuss the nature and results of these inspections with you. No state or federal regulatory agencies or professional organizations have taken any disciplinary action, nor is there any pending, against Bonadio or its Partners during the past three years.

The Bonadio Group

12

Peer Review Report

The Bonadio Group

13

Industry Memberships The firm and/or individuals are members of the following organizations (not all inclusive): New York State Society of CPAs Public Schools Committee Governmental Finance Officers Association (National and Local) New York State Association of Counties Association of School Business Officials American Institute of Certified Public Accountants (AICPA) (includes AICPA Quality Center) Association of Certified Fraud Examiners We are active members of the NYS Society of CPAs Public School Accounting Committee (PSAC). This committee consists of CPAs, School Business Officials, and representatives from both the NYS Office of the State Comptroller and NYS Education Department, and provides timely, relevant continuing professional education that pertains specifically to NYS school districts. Additionally, the PSAC annually offers input on upcoming issues that impact public schools and updates to the reference manual, which provides school districts with a template for their annual financial statements. Through our membership, we are able to stay on the cutting edge of the issues that affect NYS school districts and provide our districts with timely and well-informed insight. In addition to our active role in the Public-School Accounting Committee, we also are members and attend the conferences of ASBO and NYSSBA. Our involvement in these organizations helps us to see our school district clients through the perspective of a Business Official or Board of Education member. We believe understanding the differing perspective of our clients enables us to serve them more effectively.

The Bonadio Group

14

Work Plan Our Internal Audit Approach – Methodology and Tools We employ a well-established six-step process with integrated internal audit methodology and tools throughout. The diagram presented on the following page represents the framework of our approach. It contains a high-level overview of our methodology and tools, and illustrates activities performed in each of the six steps. This methodology and toolset are used and understood globally by all of the internal audit practitioners of Bonadio. Bonadio continually invests in the development of leading-edge tools and technologies that increase the efficiency and cost-effectiveness of our services and provide access to extensive sources of industrypreferred practices and benchmarks. We also understand that leveraging the collective knowledge of our practitioners by sharing knowledge and industry-preferred practices is critical to a cost-efficient, valueadded internal audit function.

Bonadio’s Internal Audit Methodology

Strategic Analysis Issue Follow-Up and Tracking

Risk Assessment

Reporting

Internal Audit Plan Internal Audit execution

The Bonadio Group

15

Bonadio’s Internal Audit Methodology STRATEGIC ANALYSIS • Prepare, discuss, and confirm: • Objectives • Approach/engagement leadership team • Stakeholder’s expectations • Scope • Consulting Days • Review the latest internal audit reports and status of outstanding action items, if available • District • Output Objectives requirements • Control • Regulatory environment Environment • Management • Economic/social/ Control environmental issues

• • • • •

• • •

INTERNAL AUDIT PLAN Conduct audit project planning and scoping Conduct interviews with management For each agreed project, identify business objectives, risks, controls, and exposures Incorporate insights of specialists Prepare detailed internal audit work plan for each project INTERNAL AUDIT EXECUTION Perform process/transaction walkthrough and documentation of results Document specific controls (including operational, financial, information technology, regulatory compliance) Perform and document testing and analysis

• • • • • •

• • •

• • • • • •

The Bonadio Group

RISK ASSESSMENT Review the current requirements in more depth Facilitate risk assessment analysis Prioritize the internal audit plan based on the risk model Recommend strategies for addressing the relevant issues identified in the risk profile and the resources required Propose recommended projects to be included in the Strategic Internal Audit Plan Develop a Three-Year-Strategic Internal Audit Plan based on the risk analysis and submit to client approval

REPORTING Evaluate results and collaborate with management Review issues and agree management action with area management (exit conference) Issue final report

ISSUE FOLLOW-UP AND TRACKING Update and refine risk assessment and reevaluate plan Summarize and evaluate current period audit activities Follow-up and track agreed management action to help ensure effective implementation Meet with senior management and Audit Committee Evaluate performance against District’s expectations Complete audit survey/feedback

16

Work Product The School District Financial Accountability regulations issued by the State Education Department (the Five Point Plan) require the internal audit function to include at minimum:  Develop a risk assessment.  Review policies and procedures.  Test compliance with laws, regulations, and policies.  Test validity, accuracy and reliability of accounting records and financial reports.  Perform audit procedures designed to identify unusual and/or questionable transactions.  Monitor internal controls of the Districts.  Test controls to assure that they are appropriate and are effective when applied.  Test the design and operating effectiveness of internal controls to detect deficiencies.  Review recommendations regarding the internal controls with Business Office personnel and the Audit Committee.  Assist the Districts in the design and implementation of recommended procedures to ensure the operating effectiveness of the internal control environment.  Report to the Audit Committee on a semi-annual basis, at a minimum. Bonadio agrees to provide professional internal auditing services to the Districts as follows: 4. Development of risk assessment - After a thorough review of the Districts’ financial policies, procedures, and practices, which would include extensive on-site interviews of staff members, we will develop a risk assessment of the Districts’ operations. We will take this a step further and categorize the areas assessed on a scale from critical to non-essential. Our primary focus will be on auditing those areas that are critical to the Districts’ financial and programmatic mission. 5. Tests of internal controls - Testing of the Districts’ internal controls will be performed each year. Testing will be focused in those areas that were identified as critical during the risk assessment process, as well as those areas that encompass such large amounts of transactions that testing on an annual basis is desirable and may include: • • • • • •

Payroll audits IT programs and controls Certification of payroll Review of bank reconciliations and Treasurers report Review of payroll process and related controls Review of fixed asset inventory

6. Information Technology testing - Internal controls in the IS area will be evaluated with a risk management, information assurance, and regulatory compliance (FERPA, COPPA, CIPA, HIPAA, Dept. of Education, etc.) approach. Sample sizes will be chosen based on the published CoBIT inherent risk ranking for IT/IS areas and based on Fayetteville-Manlius Central School District’s communicated risk ranking as identified within their key controls risk assessment. 7. Unusual/Questionable transactions - Bonadio utilizes data extraction software used to the Districts’ needs in identifying unusual or questionable transactions. Should unusual or questionable transactions be identified, we will then obtain supporting documentation to test validity. 8. Reporting/Recommendations - We will provide written reports to the Board of Education that will include the findings of the risk assessment, recommendations for improvement and comments regarding internal control structure. We will also assist the Districts in the implementation of procedures to ensure the effectiveness of internal controls.

The Bonadio Group

17

Use of Technology in Our Audits Our staff is empowered with tools allowing us to perform efficient, yet effective audits. For each audit, we utilize software that enables us to provide a focused approach that utilizes your staff’s time efficiently while providing sound, sufficient audit evidence. Some examples include: •

•

•

Data mining, sample selections, etc. – We utilize IDEA data extraction software allowing us to analyze large amounts of data in a very efficient manner. Use of this software allows us to note patterns of data, search for specific items such as related party transactions, stratify data and many other functions. Additionally, we utilize random number generators to ensure that no bias exists in our sampling.

Bonadio Client Portal The Bonadio Client Portal is a secure cloud based portal providing several tools which streamline the audit process and ensure that everyone is on the same page with no surprises.

The Bonadio Group

18

Microsoft Teams Bonadio uses a full suite of Microsoft office products including Microsoft Teams for secure video conferencing solutions that allow us to interface face to face with our clients. Video conferencing is not a replacement for face-to-face meetings; however, we do see this as a significant enhancement to our current client communications. The ability to host web based meetings will allow our client’s audit committees to hold a virtual meeting should they have travel issues or committee members that are out of town.

Additionally, we believe a face-to-face video call with our clients, including the ability to collaborate and comment on documents shared on-screen, is a significant enhancement to the traditional phone call. This technology also allows us to host webinars for our clients throughout the state on emerging topics as they arise. Our commitment to technology ensures that our clients obtain unmatched timeliness, cost efficiency and limited interruption to their staff. While we believe strongly that these capabilities have and continue to provide the most efficient audit to our clients, we remain flexible to what works best for our clients.

Privacy and Data Security Information security is one of our firm’s highest priorities. Bonadio utilizes a third party to complete a security assessment annually. The assessment includes policies and procedures, physical and virtual servers, virtual hosts, network infrastructure, network perimeter, end user computing, mobile devices, software, and more. Physical access to information technology areas are restricted to information technology personnel. All information technology areas require swipe card access and have video surveillance. Surveillance recordings are stored for six months. At the perimeter of our network, there are two firewalls in an active/passive setup. IDPS is hosted on these devices. Inbound and outbound internet access is filtered and firewalled. Our firewall rules are reviewed as part of our annual security audit, which encompasses review of policies and procedures, documentation, tests of controls, penetration testing, and a variety of other aspects. All servers have antivirus and firewalls enabled, both of which are actively monitored for changes. Our email server also has two additional layers of antivirus protection. Our web content filter has its own antivirus engine and is used to filter and protect internet access. All Bonadio employees are issued a consistent brand and model of computer and computer image. Hard drives on all laptop and desktop computers are fully encrypted. Encryption is actively monitored and information technology staff are automatically notified if there are any errors. Passwords are changed every 90 days and must be 12 characters long, including uppercase, lowercase, number, and special characters. Security settings are managed via group policy and cannot be altered by the end user. When computers are replaced, they are wiped with a Department of Defense-level hard drive scrubbing application 10 times.

The Bonadio Group

19

Access to all systems and applications are managed and authored by Bonadio information technology personnel. Only Bonadio employees are given access to systems and applications after going through background checks and approval from Bonadio’s human resources department. All systems and applications require authentication either through single-sign-on via the Security Assertion Markup Language standard, or an application’s native authentication. Access and changes to all systems and applications are logged at the user level. Client data is stored in ProSystems Engagement on network shares. Engagement is the firm’s paperless audit product. Access to it requires a domain account and a native account within Engagement. The donation and Engagement use the same username format but different passwords. Data stored in Engagement is encrypted on the server and workstation. Client data in Engagement is logically separated into Binders, which are configured to only allow access to the Bonadio engagement team actually working on your project. Network shares are only accessible to Bonadio employees who have an active account on the domain, and are controlled by Access Control Lists. Adjusting the Access Control Lists requires approval from department leaders. To transfer data securely, Bonadio utilizes Microsoft Outlook e-mail encryption, as well as myPortal. All Bonadio employees are trained on how to identify sensitive information and the best way to store and transfer it at least annually. All devices connected to Bonadio’s network are patched on a regular basis.

Business Continuity & Disaster Recovery • • • • •

Documented procedures across datacenters to minimize the impact of a disaster and respond to specific emergencies Secondary datacenter provides the technology foot- print for data recovery and business continuity Recovery Time Objectives (RTO) for critical applications/services Use of automated industry leading recovery tools to ensure the continuity of business services Annual plan review and simulated failover testing

The Bonadio Group

20

&

APPENDICES

The Bonadio Group

Appendices

APPENDIX A Fee Schedule Maximum Base Price as Proposed YE 6/30/26 YE 6/30/27

YE 6/30/24

YE 6/30/25

Brighton CSD

$19,000

$20,000

$21,000

$22,000

$23,000

Brockport CSD

$19,000

$20,000

$21,000

$22,000

$23,000

Churchville-Chili CSD

$19,000

$20,000

$21,000

$22,000

$23,000

East Irondequoit CSD

$19,000

$20,000

$21,000

$22,000

$23,000

East Rochester CSD

$19,000

$20,000

$21,000

$22,000

$23,000

Fairport CSD

$19,000

$20,000

$21,000

$22,000

$23,000

Gates Chili CSD

$19,000

$20,000

$21,000

$22,000

$23,000

Greece CSD

$19,000

$20,000

$21,000

$22,000

$23,000

Hilton CSD

$19,000

$20,000

$21,000

$22,000

$23,000

Honeoye Falls-Lima CSD

$19,000

$20,000

$21,000

$22,000

$23,000

Monroe One BOCES

$19,000

$20,000

$21,000

$22,000

$23,000

Monroe 2 - Orleans BOCES

$19,000

$20,000

$21,000

$22,000

$23,000

Penfield CSD

$19,000

$20,000

$21,000

$22,000

$23,000

Rush-Henrietta CSD

$19,000

$20,000

$21,000

$22,000

$23,000

Spencerport CSD

$19,000

$20,000

$21,000

$22,000

$23,000

Webster CSD

$19,000

$20,000

$21,000

$22,000

$23,000

West Irondequoit CSD

$19,000

$20,000

$21,000

$22,000

$23,000

District

The Bonadio Group

YE 6/30/28

Appendices

APPENDIX B SCHEDULE OF FEES FOR ADDITIONAL SERVICES AND AUDITS IF REQUESTED BY PARTICIPATING SCHOOL DISTRICT

Partners Managers Supervisory Staff Staff Other

The Bonadio Group

Hourly Rate $400 $295 $255 $175 $145

Appendices

APPENDIX C PROPOSER WARRANTIES I.

Proposer warrants that it is willing and able to obtain an errors and omissions insurance policy providing a prudent amount of coverage for the willful or negligent acts, or omissions of any officers, employees or agents thereof.

II.

Proposer warrants that it will not delegate or subcontract its responsibilities under an agreement without the prior written permission of each affected School District.

III.

Proposer warrants that all information provided by it in connection with this proposal is true and accurate.

The Bonadio Group

Appendices

Conflict of Interest Bonadio & Co., LLP affirms that our relationship with other School Districts and BOCES that are current Bonadio clients will not affect our ability to serve the Districts with the type of dedication, commitment, and professionalism you expect. In fact, we view these relationships as a positive situation as we can share best practices across our clients. We will provide a secure, discreet, and confidential environment and would like the Participants to note the following: • • •

Team members will maintain the strictest confidentiality related to information obtained during the audit process. We currently work with other School Districts and BOCES and have maintained our commitment to discretion and confidentiality. We have a wealth of experience in providing confidential and discreet services to multiple clients.

Bonadio is independent with respect to the Districts in accordance with Rule 101 of the AICPA’s “Code of Professional Conduct,” and its interpretations and rulings. Bonadio is independent of the Participants as defined by auditing standards generally accepted in the United States of America, the U.S. General Accounting Office’s Government Auditing Standards and no conflicts of interest exist. Bonadio is also independent of the NYS Department of Education.

Independence Bonadio is independent with respect to the Districts in accordance with the AICPA’s “Code of Professional Conduct,” and its interpretations and rulings, and in accordance with the DOL regulations. Bonadio certifies that our key personnel do not have any financial interests in the Districts that would affect our ability to render an objective, unbiased opinion about the requested conditions of the Districts.

The Bonadio Group

Appendices

•

Examination/Education: We are listening, learning, and reflecting on the tangible things we can and must do as individuals and as a firm to do our part in being catalysts for change. We understand that we have a tremendous amount of work to do, and we know it will not happen overnight.

•

•

Act with a Sense of Urgency: It is always the right time to do the right thing. We recognize that implementing substantive change will require a grass roots effort and alliances. We have established an internal Council for Diversity, Equity, and Inclusion, and we will be working with these ambassadors to implement tangible next steps.

• DE&I Consultant: The Bonadio Group engaged a consultant, KET Solutions, LLC, to perform a DEI Organizational Gap Assessment. Kimberly Ellison-Taylor, CPA, CGMA, CISA, our consultant, has significant public accounting and industry experience and then transitioned to DE&I consulting. Our process for the assessment included:

•

−

Cross-section of interviews

−

Review of various documentation

−

Newsletters, HR documents, BU materials, website, etc.

Dedicated Manager of Diversity, Equity & Inclusion: We have hired a full time manager of Diversity, Equity & Inclusion. In this role, the manager will work with the DE&I council, senior leadership, and others to develop and deliver a meaningful long-term DE&I strategy, including programs, initiatives, and communications, which are designed to attract, retain, develop, and advance diverse talent.

We acknowledge there is much work to be done and a long way to go, but we are dedicated to fostering an environment of diversity, equity, and inclusion at Bonadio. We believe that an inclusive work environment allows all of our people to achieve their greatest potential and the greatest results for our clients and communities.

The Bonadio Group

Appendices

Council for Diversity, Equity, and Inclusion (DE&I)

Our Council for Diversity, Equity & Inclusion strives to lead initiatives that foster a diverse and welcoming atmosphere, enabling everyone to feel empowered, valued, respected and safe. The firm’s leadership is committed to implementing initiatives that fundamentally address the issues of diversity, equity and inclusion. Our DE&I Council is composed of 40 members of our Bonadio team, representing people from all our geographies, industry specialties, and levels of experience throughout our firm. The Council is led by Kristen Clark, Syracuse Office Managing Partner and member of our Firm’s Management Committee and Kevin West, a Tax Principal in our Rochester office. Kevin and Kristen are guided by the full Council. The Council consists of 4 pillars focused on the following areas: •

Communication

•

Alliances

•

Recruiting and Retention

•

Education

Our strategic activities are structured around these pillars, which helps guide our activities to provide the most benefit to our people, our communities and our firm. Our Communication subcommittee publishes a quarterly newsletter, The Inclusionary, which focuses on education around topics related to DE&I. From an education perspective, the DE&I Council works with Bonadio University, our learning and development division, to develop educational tracks for all individuals in the firm to enhance our knowledge on such areas of importance as unconscious bias, diversity of thought and gender equity. In addition, we regularly conduct surveys among our people on topics such as gender equity, gender neutral restrooms, remote work, and other topics and use the results of these surveys to drive our firm’s direction. The results of one such survey, related to hybrid work environment were shared with Le Moyne Professor Christie Novak, who is helping us analyze the results and who we also connected with our national accounting firm affiliate group, Moore Global, for further research and analysis opportunities. This way, we are mutually benefitting a valued professor’s research opportunities as well as furthering the study of diverse work environments in our profession. We recently presented an internal webinar entitled Moving the Needle: How Gender Equity Benefits Everyone and were thrilled to have over 250 of our teammates participate in the session. We are very proud of our historic and continuing focus on gender equity in our profession and our firm. We know that this will help us formulate a focused, relevant and effective strategy to address DE&I matters in our firm in the short and long-term.

The Bonadio Group

Appendices

CEO Action for Diversity and Inclusion Our CEO and Managing Partner, Bruce Zicari, CPA has joined this coalition, which consists of more than 1,200 CEOs across 85 industries, truly making it the largest CEOdriven business commitment to advance diversity and inclusion within the workplace. It centers around four main pledge commitments: •

Cultivate trusting workplaces that can have complex, and sometimes difficult, conversations.

•

Implement and/or expand unconscious bias education.

•

Share best—and unsuccessful—practices.

•

Create and share strategic inclusion and diversity plans with the board of directors (or equivalent governing bodies).

Equal Employment Opportunity Bonadio’s core employees, not including subsidiaries or affiliates, total 700. Women comprise 53.4% (374). Minorities comprise 12.3% (45). Bonadio would also like to note that 23% of our Partner Group are women; 35% of our Principal Group are women; and 66% of our Directors are women. All presentations and materials produced by Bonadio & Co., LLP are free from racial, religious, or sexual bias. Bonadio is committed to the principle of equal treatment and opportunity for all people. All firm personnel are dedicated to delivering the highest level of service, responsiveness, productivity, and value to the firm’s clients, and to respect the dignity of others. The firm is committed to fostering and managing diversity in the workplace as an integral part of its practice and service to clients. The firm values the rich variety of perspectives and experiences offered by those of different backgrounds. This diversity strengthens our institution and enables it to better respond to our clients’ needs in an increasingly global profession. This commitment to diversity in the work force is to be implemented by the Executive Committee and Division Leaders under the direction of our Managing Partner, and in conjunction with our Human Resources department.

The Bonadio Group

Appendices

The Bonadio Group

Appendices

Albany | Buffalo | Dallas | East Aurora | NY Metro Area | Rochester | Rutland | Syracuse | Utica