an ge
jec t
to
Ch
Webster Central School District
ub
Independent Internal Control Risk Assessment Report
Dr aft
-S
For the year ended June 30, 2026
Bonadio & Co., LLP
0
Audit Committee Members Webster Central School District 119 South Avenue Webster, NY 14580 Dear Audit Committee Members:
nge
April 23, 2026
Ch a
The following is a report of our risk assessment for the Webster Central School District (The District). Bonadio & Co., LLP was engaged by the District's Board of Education to fulfill the requirements of the 2005 School Financial Oversight and Accountability Act by performing an annual risk assessment.
The purpose of the annual risk assessment is to provide the Audit Committee with a review of internal controls that the District has in place to prevent and detect fraud, ensure financial reporting is accurate and that District assets are safeguarded.
-S ub jec t to
The content of this report is intended to provide the Audit Committee with the baseline information necessary to understand the risks and if deemed necessary develop, approve and implement an Internal Audit Work Plan for the fiscal year 2026.
In performing our engagement, we relied on the accuracy and reliability of information provided by District personnel. We have not audited, examined or reviewed the information, and express no assurance on it. Had we performed additional procedures, other matters might have come to our attention that would have been reported to you. This consulting engagement report is intended solely for the information and use of the Administration, the Audit Committee, the Board of Education, and other applicable employees within the District and is not intended to be and should not be used by anyone other than those specified parties. We appreciate the opportunity to prepare this annual Risk Assessment for the District and are available to assist you in carrying out other portions of the Internal Audit Plan. We are also available to answer your questions anytime. Very truly yours,
Dr aft
BONADIO & CO., LLP
Timothy Doyle, CPA Partner
nge
Dr aft
-S ub jec t to
Executive Summary
Ch a
01
Bonadio & Co., LLP
2
Executive Summary
nge
In 2005 the NYS Legislature issued school districts accountability laws, pursuant to Chapter 263 of the Laws of 2005 (the Act), regarding increased oversight over public schools, charter schools and BOCES. As part of the new laws, school districts were required to implement an Internal Audit function and form an Audit Committee with oversight responsibilities which included appointment of an internal auditor and review of the internal audit results with the appointed auditor.
Ch a
The District appointed Bonadio & Co, LLP as their internal audit consultants to perform an initial annual risk assessment, subsequent updates to that risk assessment and develop a proposed audit work plan based on the high risk areas identified and then to assist in the development of the scope and timing of the internal audit areas based on the approval of the District's Audit Committee. This report focuses on the risk assessment of internal controls of the District operations, financial reporting policies, procedures and functional activities.
-S ub jec t to
A summary of this risk assessment by control cycle is included below and a detailed assessment for each area can be found on the pages that follow.
Current Year Overall Risk
Prior Year Overall Risk
Extraclassroom Activity & Funds (ECA)
Moderate
Moderate
School Lunch Activities
Moderate
Moderate
Purchasing and Cash Disbursements
Moderate
Moderate
Information Technology (IT)
Moderate
Moderate
Payroll and Human Resources
Moderate
Low
Capital Projects and Capital Assets
Low
Low
Transportation
Low
Low
Facilities and Maintenance
Low
Low
Centralized Cash Receipts and Banking
Low
Low
Federal and State Aid
Low
Low
Federal and State
Low
Low
Revenue, Billings and Receivables
Low
Low
General Ledger and Financial Reporting
Low
Low
Debt Activities
Low
N/A
Dr aft
Business Cycle Area
Key findings include:
• We did not observe any findings that require a corrective action plan.
• Improvement of the timeliness of ECA deposits to the bank. • Reorganization of certain Business Office and administrative tasks. Bonadio & Co., LLP
3
nge Ch a
02
Dr aft
-S ub jec t to
Risk Assessment and Internal Audit Strategy
Bonadio & Co., LLP
4
Objective
nge
Risk Assessment and Internal Audit Strategy
Risk Assessment Performed
Ch a
The objective of this risk assessment is to meet the requirements of the 2005 Schools Accountability legislation by conducting an annual Risk Assessment. We relied on interviews with personnel, onsite observations, external audit reports, review of board minutes, status of prior audit findings and recommendations and District policies and amendments.
We conducted our risk assessment of key areas and transactions in order to assess risk for each of the significant transaction cycles and functional responsibilities. This information will be shared and discussed with the Audit Committee and Administration to identify high-risk areas that may need further review.
-S ub jec t to
Throughout our interviews and testing, we discussed controls as they stand today and what changes have occurred during the testing period. Our testing of those controls included a sample of transactions that spanned the testing period. This engagement did not constitute an engagement performed in accordance with generally accepted auditing standards. While we conducted inquiries to understand how selected controls are intended to operate, we did not perform testing of control design or operating effectiveness to support reliance. Any control procedures performed were limited to corroborating inquiry and were not used to reduce control risk or influence the nature, timing, or extent of other procedures.
Dr aft
The District’s risk assessment was conducted through structured interviews and targeted testing of key control transactions. We identified key risk areas or circumstances that could significantly prevent the District from effectively achieving its goals. Each risk was evaluated as to whether its potential effect would be low, moderate, or high. We obtained an understanding of Administration’s attitude, awareness and actions concerning internal control. We assessed the “tone at the top” regarding internal control and developed our risk assessment accordingly.
Bonadio & Co., LLP
5
Risk Assessment and Internal Audit Strategy
nge
Transaction Cycles and Functions Subject to Risk Assessment
Ch a
We determined the control objectives, risk, and control activities associated with each of the following transaction cycles or functions identified to determine the nature, timing and extent of internal auditing procedures necessary for conducting the internal audit work. The following transaction cycles and functional responsibilities were reviewed: • Extraclassroom Activity & Funds (ECA) • School Lunch Activities • Purchasing and Cash Disbursements
• Facilities and Maintenance
• Centralized Cash Receipts and Banking • Federal and State Aid
• Grants – Federal and State
• Payroll and Human Resources
• Revenue, Billings and Receivables
• Capital Projects and Capital Assets
• General Ledger and Financial Reporting
• Transportation
• Debt Activities
-S ub jec t to
• Information Technology (IT)
In addition, we assessed the adequacy of accounting policies and governance through audit inquiries, observations and discussions with Administration and other District personnel.
Dr aft
The concept of materiality is intrinsic to the risk assessment of the District. The areas of the District that deal with more significant dollars or a higher volume of transactions may score as higher risk. The scope is primarily risk-based and is organized around the District’s major internal control cycles. Inherent risk relates to the environment both in and around the District and therefore, the District has less influence on these risks. Control risk relates to the District’s internal controls and demonstrate the level at which the controls are designed and operating to lower the District’s overall risk, whereby a low control risk demonstrates that the District’s controls are well designed and operating effectively to lower risk.
Bonadio & Co., LLP
6
nge Ch a
03
Dr aft
-S ub jec t to
Risk Assessment Summary
The pages that follow summarize our evaluation of each of the transaction cycles and functional responsibilities we considered.
The attached appendix provides background and definitions to the risk categories used.
Bonadio & Co., LLP
7
Audit Area
Risk Assessment Inherent
Control
Moderate
Moderate
Materiality
CY Overall
PY Overall
Ch a
Extraclassroom Activity & Funds (ECA)
nge
Risk Assessment Summary
Low
Moderate
Moderate
-S ub jec t to
Contributing factors in our Risk Assessment Factors contributing to our assessment of Inherent Risk Factors that lower Inherent Risk
• The materiality of ECA funds is low in comparison to the entire District's financial operations. • The Student Accounts Central Treasurer has been with the District for 23 years. Factors that increase Inherent Risk
• Susceptibility to fraud or error due to the nature of the funds including a high volume of cash receipts and activities administered, accounted for and reported by multiple clubs with students in a learning environment. • The District personnel transitions, including the upcoming retirement of the ECA treasurer and onboarding of new staff across buildings.
Dr aft
Factors contributing to our assessment of Control Risk Factors that lower Control Risk
• The Audit Committee and Board of Education review periodic extraclassroom reports.
• The Board members are required to participate in mandated financial trainings.
Factors that increase Control Risk • Based on our walkthrough procedures, the timeliness of deposits should be improved. #R-001
Bonadio & Co., LLP
8
Audit Area
Risk Assessment Inherent
Control
Moderate
Moderate
Materiality
CY Overall
PY Overall
Ch a
School Lunch Activities
nge
Risk Assessment Summary
Low
Moderate
Moderate
-S ub jec t to
Contributing factors in our Risk Assessment Factors contributing to our assessment of Inherent Risk Factors that lower Inherent Risk
• Food Service Director has been employed by the District since 2015. Factors that increase Inherent Risk
• The expansion of the State's free lunch provision has caused an increase in meal counts from last year. There has been a double to triple amount increase in meal distribution counts, and breakfast meals have increased significantly. • The District faces chronic understaffing and turnover, compounded by increased operational demands from CEP, which may strain oversight and increase the likelihood of errors or control breakdowns.
Factors contributing to our assessment of Control Risk
Dr aft
Factors that lower Control Risk
• The District utilizes a third-party armored courier service and secured safes for cash handling.
• The District utilizes badge swipes and locks for all food storage. • The District utilizes inventory tracking software.
Factors that increase Control Risk • No significant factors
Bonadio & Co., LLP
9
Audit Area
Risk Assessment Inherent
Control
Moderate
Moderate
Materiality
CY Overall
PY Overall
Ch a
Purchasing and Cash Disbursements
nge
Risk Assessment Summary
High
Moderate
Moderate
-S ub jec t to
Contributing factors in our Risk Assessment Factors contributing to our assessment of Inherent Risk Factors that lower Inherent Risk
• Main accounts payable staff and the Claims Auditor have been in this role and performing their duties for several years. Factors that increase Inherent Risk
• The District has a moderate volume of purchasing and cash disbursement transactions. • There is a higher susceptibility to error or fraud for unauthorized payments with disbursements.
Factors contributing to our assessment of Control Risk Factors that lower Control Risk
Dr aft
• Based on walkthroughs performed during our risk assessment, we found no exceptions related to the cash disbursement process. • Staff performing duties receive ongoing training, but it should be noted that some staff reported wanting more training.
Factors that increase Control Risk • No significant factors
Bonadio & Co., LLP
10
Audit Area
Risk Assessment Inherent
Control
Moderate
High
Materiality
CY Overall
PY Overall
Ch a
Information Technology (IT)
nge
Risk Assessment Summary
Moderate
Moderate
Moderate
-S ub jec t to
Contributing factors in our Risk Assessment Factors contributing to our assessment of Inherent Risk Factors that lower Inherent Risk
• Director of IT has been with the District for several years. Factors that increase Inherent Risk
• Data breaches and phishing attacks are always a risk in compromising employees’ and students’ information.
Factors contributing to our assessment of Control Risk Factors that lower Control Risk
• The District has a disaster recovery plan in place, and backups are regularly performed.
Dr aft
• The District continuously monitors and reviews controls and safeguards over their information technology system.
Factors that increase Control Risk • No significant factors
We welcome the opportunity for our Foxpointe team to engage directly with the District’s IT team regarding these matters. To protect the integrity of your IT controls and minimize potential security risks, we have intentionally omitted specific technical details from this report.
Bonadio & Co., LLP
11
Audit Area
Risk Assessment Inherent
Control
Moderate
High
Materiality
CY Overall
PY Overall
Ch a
Payroll and Human Resources
nge
Risk Assessment Summary
High
Moderate
Low
-S ub jec t to
Contributing factors in our Risk Assessment Factors contributing to our assessment of Inherent Risk Factors that lower Inherent Risk
• Personnel involved in these activities have been performing their duties and have been employed by the District for several years. Factors that increase Inherent Risk
• The Assistant Superintendent for Administration and Human Resources is retiring in the coming year. • The District has similar openings to the prior year, but has concerns over covering future retirements.
Factors contributing to our assessment of Control Risk Factors that lower Control Risk
Dr aft
• Based on walkthroughs performed during our risk assessment, we found no exceptions related to the payroll and human resources process.
Factors that increase Control Risk • District personnel raised concerns over the proper alignment of tasks and which teams perform them. #R-002
• The District uses paper timesheets, but personnel stated this process works well and does not need to be optimized.
Bonadio & Co., LLP
12
Audit Area
Risk Assessment Inherent
Control
Moderate
Low
Materiality
CY Overall
PY Overall
Ch a
Capital Projects and Capital Assets
nge
Risk Assessment Summary
High
Low
Low
-S ub jec t to
Contributing factors in our Risk Assessment Factors contributing to our assessment of Inherent Risk Factors that lower Inherent Risk
• Many Capital Assets and Capital Projects relate to large dollar items concentrated in a few items, such as Buildings and Improvements, which are not "walkable." • Personnel involved in these activities have been performing their duties and with the District for several years. Factors that increase Inherent Risk
• Capital assets, particularly those with high usage or rapid technological change, are susceptible to damage and obsolescence. • Capital projects involve complexity and high costs.
Dr aft
• The District has capital projects in progress that feature multiple phases and work being performed in multiple buildings. There is an $85 million project currently in process, notably for building upgrades, and an addition to a middle school.
Factors contributing to our assessment of Control Risk Factors that lower Control Risk • There is proper oversight and approval from the District's Business Office to the Board.
• The District has an effective tagging system to track and maintain its capital assets listing.
Factors that increase Control Risk • No significant factors
Bonadio & Co., LLP
13
Audit Area
nge
Risk Assessment Summary
Risk Assessment Control
Moderate
Low
Transportation
Materiality
CY Overall
PY Overall
Ch a
Inherent
Moderate
Low
Low
-S ub jec t to
Contributing factors in our Risk Assessment Factors contributing to our assessment of Inherent Risk Factors that lower Inherent Risk
• Director of Transportation has been with the District since 1998. Factors that increase Inherent Risk
• There is a zero-emissions mandate scheduled for 2035, which causes concern regarding compliance, power sources, staffing, and other concerns. • The District could benefit from more staff. The nationwide bus driver shortage continues to affect the Transportation Department.
Factors contributing to our assessment of Control Risk Factors that lower Control Risk
Dr aft
• Based on discussions with management, the director and staff receive adequate ongoing training. • The bus garage is secured with badge-only access and monitored by cameras around the building. • The District utilizes software to track fuel and inventory.
Factors that increase Control Risk • No significant factors.
Bonadio & Co., LLP
14
Audit Area
nge
Risk Assessment Summary
Risk Assessment Control
Moderate
Low
Facilities and Maintenance
Materiality
CY Overall
PY Overall
Ch a
Inherent
Moderate
Low
Low
-S ub jec t to
Contributing factors in our Risk Assessment Factors contributing to our assessment of Inherent Risk Factors that lower Inherent Risk
• The Director of Facilities has been with the District for 30 years. Factors that increase Inherent Risk
• Infrastructure management requires compliance with complex regulations and attention to physical safety risks associated with operations. • The Director of Facilities will look to retire in the coming year.
Factors contributing to our assessment of Control Risk Factors that lower Control Risk
Dr aft
• Based on discussions with management, it appears the District has proper controls around procuring, receiving, maintaining, recording, and reporting on its facilities and maintenance activities.
Factors that increase Control Risk • The District has ongoing capital projects span multiple phases and locations, increasing complexity and the need for strong project oversight and cost controls.
Bonadio & Co., LLP
15
Audit Area
Risk Assessment Inherent
Control
Moderate
Low
Materiality
CY Overall
PY Overall
Ch a
Centralized Cash Receipts and Banking
nge
Risk Assessment Summary
High
Low
Low
-S ub jec t to
Contributing factors in our Risk Assessment Factors contributing to our assessment of Inherent Risk Factors that lower Inherent Risk
• Personnel involved in these activities have been performing their duties and have been employed by the District for several years. Factors that increase Inherent Risk
• Cash is susceptible to misstatement due to the potential for human error and fraud.
Factors contributing to our assessment of Control Risk Factors that lower Control Risk
• Based on walkthroughs performed during our risk assessment, we found no exceptions related to the centralized cash receipts or bank reconciliation processes.
Dr aft
• Bank transfers require dual authority.
• Controls over cash receipts and banking are properly segregated.
Factors that increase Control Risk • No significant factors
Bonadio & Co., LLP
16
Audit Area
Risk Assessment Inherent
Control
Moderate
Low
Materiality
CY Overall
PY Overall
Ch a
Federal and State Aid
nge
Risk Assessment Summary
High
Low
Low
-S ub jec t to
Contributing factors in our Risk Assessment Factors contributing to our assessment of Inherent Risk Factors that lower Inherent Risk
• Personnel involved in these activities have been performing their duties and have been employed by the District for 24 years. • The District continues to monitor changes to Foundation Aid and approaches budget assumptions cautiously. Factors that increase Inherent Risk • No significant factors.
Factors contributing to our assessment of Control Risk Factors that lower Control Risk
Dr aft
• The District's external auditors completed their Single Audit regarding major federal programs and noted the District complied, in all material respects, with the compliance requirements for federal programs.
Factors that increase Control Risk • No significant factors
Bonadio & Co., LLP
17
Audit Area
nge
Risk Assessment Summary
Risk Assessment Control
Moderate
Low
Federal and State
Materiality
CY Overall
PY Overall
Ch a
Inherent
Moderate
Low
Low
-S ub jec t to
Contributing factors in our Risk Assessment Factors contributing to our assessment of Inherent Risk Factors that lower Inherent Risk
• Personnel involved in these activities have been performing their duties and have been employed by the District for over ten years. Factors that increase Inherent Risk
• Grants are complex and have compliance and other regulations.
Factors contributing to our assessment of Control Risk Factors that lower Control Risk
• Per discussion with management, staff have adequate procedures to refer to when needed, and there is a grant application process required for approval.
Dr aft
Factors that increase Control Risk
• The District only draws down grants through use of the FS-25 annually. This presents additional risk should the state claw back grant funds and results in temporary subsidies from the general fund pending receipt of the state funds. The Districts should utilize the FS-25 to draw down funds throughout the year as expenditures are incurred.
Bonadio & Co., LLP
18
Audit Area
Risk Assessment Inherent
Control
Moderate
Low
Materiality
CY Overall
PY Overall
Ch a
Revenues, Billings and Receivables
nge
Risk Assessment Summary
High
Low
Low
-S ub jec t to
Contributing factors in our Risk Assessment Factors contributing to our assessment of Inherent Risk Factors that lower Inherent Risk
• Personnel involved in these activities have been performing their duties with the District for several years. Factors that increase Inherent Risk
• Susceptibility to fraud or error due to the high volume of transactions.
Factors contributing to our assessment of Control Risk Factors that lower Control Risk
• Board members are required to participate in mandated financial trainings. • Aged receivables are monitored on a monthly basis.
Dr aft
• Departments monitor their budgets on a monthly basis.
• Based on walkthroughs performed during our risk assessment, we found no exceptions related to the cash receivables process.
Factors that increase Control Risk • No significant factors
Bonadio & Co., LLP
19
Audit Area
Risk Assessment Inherent
Control
Moderate
Low
Materiality
CY Overall
PY Overall
Ch a
General Ledger and Financial Reporting
nge
Risk Assessment Summary
High
Low
Low
-S ub jec t to
Contributing factors in our Risk Assessment Factors contributing to our assessment of Inherent Risk Factors that lower Inherent Risk
• Personnel involved in these activities have been performing their duties and with the District for over ten years. Factors that increase Inherent Risk
• Financial reporting for OPEB, pension obligations, and compensated absences is governed by complex accounting standards that require careful compliance. • There are complex reconciliations of the School District payable/receivables at year end related to fund balance. • There are significant estimates involved in year-end reporting, as well as cut-off considerations.
Dr aft
Factors contributing to our assessment of Control Risk Factors that lower Control Risk
• Proper financial reporting is an important responsibility of the District. Financial data is reviewed by multiple employees in the district and by the Board of Education. The financial statements are audited annually. • Reserves are monitored and adjusted annually by the Board.
Factors that increase Control Risk • No significant factors noted.
Bonadio & Co., LLP
20
Audit Area
nge
Risk Assessment Summary
Risk Assessment Control
Low
Low
Debt Activities
Materiality
CY Overall
PY Overall
Ch a
Inherent
Moderate
Low
N/A
-S ub jec t to
Contributing factors in our Risk Assessment Factors contributing to our assessment of Inherent Risk Factors that lower Inherent Risk
• Main personnel involved in this area have been performing their duties for several years. • Debt proceeds are maintained in separate bank accounts, reducing misuse risk. Factors that increase Inherent Risk
• New debt issuance introduces complexity and potential compliance issues with statutory requirements and reporting.
Factors contributing to our assessment of Control Risk Factors that lower Control Risk
• Debt transactions are approved by the board.
Dr aft
• Debt payments are made timely and monitored by multiple internal and external stakeholders.
Factors that increase Control Risk • No significant factors
Bonadio & Co., LLP
21
nge
Dr aft
-S ub jec t to
Internal Audit Work Plan
Ch a
04
Bonadio & Co., LLP
22
Internal Audit Work Plan
Ch a
nge
The internal audit work plan summarized below, illustrates possible audits for the 2026-2028 fiscal years for approval by the Audit Committee. The District is required to performed a reassessment of risk on an annual basis. The results of the annual reassessment will be the basis for identifying audit priorities and determining the internal audit plan in future years. These priorities will be reviewed with the District’s Audit Committee Members and readjusted accordingly, if necessary. Included in the summary are the annual risk assessment, identified high-risk areas, and other areas.
Previous Audit 2023
2024
2025
2026
-S ub jec t to
Business Cycle Area
Suggested Future Audits 2027
2028
Payroll, Onboarding, and Deductions
Detailed IT Review
Extraclassroom Activities & Funds (ECA)
X
Policies and Procedure Review
X
WinCap Administration & Access Rights
Special Education & Student Services
Financial Operations Review
X
X
X
X
Dr aft
ACH Payments and Wire Transfers
Recommendation
We recommend the Audit Committee, select an area or areas from the attached detailed workplan for testing in the fiscal year ending 2026. Additional areas may include department or program specific areas to test in the categories above.
Bonadio & Co., LLP
23
nge
Dr aft
-S ub jec t to
Findings
Ch a
05
During the current risk assessment update, we identified the following findings. Findings are the result of an auditor's evaluation of collected evidence against established audit criteria, indicating conformity or non-conformity in a system or process. These Findings represent our observations in connection with the risk assessment services performed.
Any findings noted in this section of this report require a corrective action plan (CAP).
Bonadio & Co., LLP
24
Findings Summary
nge
Findings
Dr aft
-S ub jec t to
Ch a
We did not observe any findings that constitute a Corrective Action Plan (CAP) as required by the Commissioner's Regulations.
Bonadio & Co., LLP
25
nge Ch a
06
-S ub jec t to
Recommendations
Dr aft
During the current risk assessment update, we identified the following recommendations. Our recommendations are suggested improvements in your control environment that offer opportunities for improvement. These observations can improve the effectiveness and efficiency of your control environment but do not indicate an internal control weakness. These recommendations represent our observations in connection with the risk assessment services performed.
Pursuant to Commissioner’s Regulations 170.12_(e)(4)(i), we do not consider these recommendations and / or suggestion to be findings or require a corrective action plan.
Bonadio has the resources and would be happy to assist you with any of these recommendations.
Bonadio & Co., LLP
26
ECA Deposits Recommendations #R-001:
nge
Recommendations
Ch a
Based on walkthrough procedures and limited testing of Extraclassroom Activity cash receipts, it was noted that there was approximately a one-month lag between when funds were received by a student club and when the funds were deposited into the District’s Extraclassroom Activity bank account.
While the funds reviewed were ultimately deposited intact and properly recorded, guidance from the New York State Education Department and the Office of the State Comptroller emphasizes the prompt safeguarding and deposit of student activity funds to reduce exposure to loss or misuse.
Dr aft
-S ub jec t to
It is recommended that the District continue to reinforce expectations that Extraclassroom Activity funds be remitted and deposited in a timely manner after receipt, which would further strengthen internal controls and align practices with State guidance.
Bonadio & Co., LLP
27
Recommendations
Recommendations #R-002:
nge
Business Office and Administrative Tasks
Ch a
Based on discussions with District personnel, it was noted that certain responsibilities within the Business Office, Payroll, and Human Resources functions are not always clearly aligned with the staff best positioned to perform them, and communication between Payroll and Human Resources could be strengthened.
-S ub jec t to
In particular, matters related to unemployment claims, job performance, and other personnel-related topics would generally be better supported by Human Resources, while tasks that are predominantly payroll-driven, such as the preparation and filing of quarterly employer payroll tax reports (Form 941), are more appropriately handled within Payroll, consistent with guidance from the Office of the State Comptroller and New York State Education Department emphasizing clear assignment of duties and effective internal controls.
Dr aft
It is recommended that the District consider clarifying and, where appropriate, realigning responsibilities between Payroll, Human Resources, and the Treasurer’s function, and establish more formal and recurring communication between Payroll and Human Resources to improve the flow of information, reduce duplication of effort, and ensure matters falling into “gray areas” are addressed by the appropriate personnel.
Bonadio & Co., LLP
28
nge
Dr aft
-S ub jec t to
Appendix
Ch a
07
• Definition of Internal Control
• Risk Assessment • Internal Audit Process
Bonadio & Co., LLP
29
Definition of Internal Control
nge
Appendix
• Effectiveness and efficiency of operations. • Reliability of financial reporting. • Compliance with applicable laws and regulations. This definition reflects certain fundamental concepts: • Internal control is an ongoing process.
Ch a
Internal control is a management process designed to provide reasonable assurance regarding the achievement of objectives in the following categories:
-S ub jec t to
• Internal control is performed and maintained by the actions of the District personnel. It is not merely policy manuals and forms, but people functioning at every level of the District. • Internal control is geared to achieve objectives in several overlapping categories- Operations, Finance, and Compliance. • Internal control can be expected to provide only reasonable assurance to the District administration and Board regarding achievement of operational, financial reporting, and compliance objectives.
Dr aft
Effective administration of a strong internal control environment involves proper planning, execution, and ongoing monitoring of activities. Internal control is a tool used to protect the District assets from intentional or unintentional loss.
Bonadio & Co., LLP
30
Risk Assessment
nge
Appendix
Ch a
Risk assessment is defined as the identification and analysis of relevant risks in the achievement of the objectives, forming the basis for determining how the risks should be managed. Risk assessment is one of the five elements of internal control, which are described in the appendix of this report. The other components include control environment, control activities, information and communication, and monitoring. Objective setting is necessary for assessment.
-S ub jec t to
Control activities are closely related to the risks in the Districts. Examples of control activities are policies, authorization, financial information reconciliations, asset verifications, and appropriate segregation and delegation of duties within the business operations of the. Control activities are either preventive or detective in nature and need to be evaluated as to benefits to the District and/or associated costs to the District. Risk arises out of uncertainty, from either internal or external sources. As a result of pursuing or not pursuing a particular course of action, there is the possibility of economic/financial loss or gain, physical damage, injury or delay. Risk is defined as the chance of something happening that will have an adverse impact upon the achievement of objectives. There will always be some risk involved in anything an individual chooses. The choice is between the actions we dare to take, given the level of risk we will accept and the level of remediation we will attempt to treat.
Dr aft
the likelihood of something happening and the consequences if it happens. The level of risk is the relationship between the likelihood of something happening and the consequences if it does. Action taken to address the level of risk must address the likelihood of the event occurring, or the consequences if it does occur, or both.
Bonadio & Co., LLP
31
Appendix
nge
Internal Audit Process
Although every audit and each organization is unique, the internal audit development process is similar for most engagements and normally consists of five stages:
2. Survey 3. Fieldwork 4. Reporting 5. Ongoing monitoring, follow-up and corrective action
Ch a
1. Planning
-S ub jec t to
These stages are described in more detail further in Section III. The active involvement of the District personnel is critical at each stage of the process and involves a collaborative effort from departmental personnel. We realize a certain amount of time is diverted from regular routines as a result of Internal Audit activities. Therefore, one of our key objectives is to minimize the disruption of operations by performing the internal audit in a timely and efficient manner.
Strategic Analysis
Dr aft
Issue Follow-Up and Tracking
Risk Assessment
Internal Audit Plan
Reporting
Bonadio & Co., LLP
Internal Audit Execution
32
Appendix
nge
Internal Audit Process (Continued)
Ch a
Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve the District’s operations, policies, procedures and internal controls. Internal auditing is a critical element of assisting in accomplishing the District’s objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control and governance processes. An internal audit is generated within the District, including all departments, at the direction of the Audit Committee for the purpose of appraising, examining, or evaluating: 1. Financial transactions for accuracy and compliance with Board of Education policies 2. Financial and operational procedures for adequate internal controls
-S ub jec t to
3. Timeliness, reliability and appropriateness of the District’s records and reports 4. The level of compliance with required internal policies and procedures, state and federal laws and government regulations Management or program reviews designed to improve departmental operations and procedures A) Five Elements of Internal Control
This report focuses on the internal audit function and risk assessment of the District. For purposes of reporting on internal controls, we must understand the following elements: Control environment
•
Risk assessment
•
Control activities
•
Information and communication
•
Monitoring
Dr aft
•
Bonadio & Co., LLP
33
Internal Audit Process (Continued) B) Control Environment
nge
Appendix
C) Risk Assessment
Ch a
The control environment sets the cultural tone of compliance for the District, influencing the control consciousness of its personnel. It is the foundation for all other components of internal control, providing discipline and structure. Control environment factors include the integrity, ethical values and competence of the District’s personnel; management's philosophy and operating style; the way management assigns authority and responsibility and organizes and develops its personnel; and the attention and direction provided by the Board of Education.
-S ub jec t to
Every organization faces a variety of risks from external and internal sources that must be assessed. A precondition to risk assessment is establishment of objectives, linked at different levels and internally consistent. Risk assessment is the identification and analysis of relevant risks to achievement of the objectives, forming a basis for determining how the risks should be managed. Because economic, industry, regulatory and operating conditions will continue to change, mechanisms are needed to identify and deal with the special risks associated with change. D) Control Activities
Control activities are the policies and procedures that help ensure that the administrative directives are carried out. They help ensure that necessary actions are taken to address risks to achievement of the District’s objectives for compliant activities. Control activities occur throughout the District, at all levels and in all functions. They include a range of activities as diverse as approvals, authorizations, verifications, reconciliations, reviews of operating performance, security of assets and segregation of duties. E) Information and Communication
Dr aft
Pertinent information must be identified, captured and communicated in a form and timeframe that enable the personnel to carry out their responsibilities. Information systems produce reports, containing operational, financial and compliance-related information, that make it possible to run and control the programs of the District. They deal not only with internally generated data, but also information about external events, activities and conditions necessary for informed program decision-making and external reporting. Effective communication also must occur in a broader sense, flowing down, across and up to the District’s levels. All personnel must receive a clear message from top management that control responsibilities must be taken seriously. They must understand their own role in the internal control system, as well as how individual activities relate to the work of others. They must have a means of communicating significant information to the oversight body. There also needs to be effective communication with external parties, such as the general public, vendors and suppliers, regulators and others.
Bonadio & Co., LLP
34
Internal Audit Process (Continued) F) Monitoring
nge
Appendix
Ch a
Internal control systems need to be monitored, a process that assesses the quality of the system's performance over time. This is accomplished through ongoing monitoring activities, separate evaluations or a combination of the two. Ongoing monitoring occurs in the course of operations. It includes regular management and supervisory activities, and other actions personnel take in performing their duties. The scope and frequency of separate evaluations will depend primarily on an assessment of risks and the effectiveness of ongoing monitoring procedures. Known internal control deficiencies should be reported, with serious matters reported to the Administration and the Board of Education.
-S ub jec t to
There is both synergy and linkage among these five components, forming an integrated system that reacts dynamically to changing conditions. The internal control system is intertwined with the District’s operating activities and exists for fundamental educational reasons. Internal control is most effective when controls are built into the infrastructure and are a part of the essence of the District. "Built in" controls support quality and empowerment initiatives, avoid unnecessary costs and enable quick response to changing conditions. There is a direct relationship between the objectives, which are what an District strives to achieve, and components, which represent what is needed to achieve the objectives of its educational programs. All components are relevant to each objectives category. When looking at any one category, the effectiveness and efficiency of operations, for instance, all five components must be present and functioning effectively to conclude that internal control over operations is effective.
Dr aft
The internal control definition, with its underlying fundamental concepts of a process, affected by people, providing reasonable assurance, together with the categorization of objectives and the components and criteria for effectiveness, and the associated discussions, constitute this internal control framework.
Bonadio & Co., LLP
35
Appendix
nge
Internal Audit Process (Continued) Management Responsibility
• Specific areas of responsibility include: • Maintaining a high ethical tone throughout the District.
Ch a
All levels of management are responsible for accomplishing and adhering to the District’s Mission Statement by achieving the District’s goals and objectives through effective and efficient use of resources and compliance with applicable laws, regulations and policies.
• Assessing and managing the District’s business operation risks.
-S ub jec t to
• Developing cost effective internal controls over all operations.
The internal audit process and function can assist management in discharging these responsibilities by providing an independent and objective evaluation of existing internal controls over the business operations. The internal audit can also help management develop improved controls and processes over operations. However, management always retains control over their own operations and ultimate responsibility for their performance. Employee Responsibility
Internal controls are the responsibility of all District’s employees. Individual employees of the District have the responsibility for maintaining work performance in a productive and conscientious manner. In the normal course of work, employees should be aware and alert for activities or situations, which pose actual or potential risks of loss, harm or misuse of assets, or obstruction to the attainment of the District’s goals.
Dr aft
Individuals and department heads should commit to the principles of internal controls and support programs and activities, which strengthen systems and practices and implement any corrective action determined necessary. Individuals and department heads are responsible for development, maintenance, documentation, and supervision of internal controls.
Bonadio & Co., LLP
36
Internal Audit Process (Continued) Role of the Internal Auditor
nge
Appendix
Ch a
The key role of internal audit is to provide the Board of Education, Audit Committee, and Administration with an independent and objective evaluation of internal controls over key business activities. This means we put a priority on reviewing the validity of financial and other management information, compliance with applicable laws, regulations and policies, and how District operations can be more effective and efficient.
The internal audit function can provide a variety of management assistance services to both District Administration and the Board of Education. It is important to understand the services and roles of the internal auditor. Assistance services include:
-S ub jec t to
• Financial Reviews (normally done in conjunction with external auditors) — These are "traditional" audits of financial records, such as accounts receivable or payable. The objective is to determine the accuracy of financial records and adherence to appropriate internal control procedures. Results will be communicated to District Administration and the Board and usually incorporated in the external auditor's report on the financial statements. • Operational or Compliance Reviews — These are projects directed by the Board, District Administration and the internal auditors, based on perceived business and operational risks. The focus is on assessing specific processes and identifying cost effective ways to improve internal controls, efficiency, and effectiveness. Examples would be reviewing a capital project for compliance with contract terms bidding process or evaluating the internal controls over a purchasing process. Written audit reports are prepared, discussed with the District’s Administration and staff, presented to the Audit Committee, and then submitted to the Board of Education for approval.
Dr aft
• Management Assistance — For projects with District-wide impact or of high importance to the District, consulting assistance may be provided to help design plans and achieve effective implementation. Assistance might take the form of facilitating problem solving techniques, flow charting processes, or performing program-based costing analyses and financial budgetary and actual comparisons. Status reports, in various formats, depending on the project, would be provided to the management and the Board of Education. “Best practices” may be discussed and implemented.
Bonadio & Co., LLP
37
Internal Audit Process (Continued) Role of the Internal Auditor (Continued)
nge
Appendix
Ch a
• Technical Research — Internal auditors can assist with questions dealing with the Board of Education policies, New York State laws, regulations and policies, accounting and internal controls, and general school district practices.
• Investigations — At the direction of the Board of Education or the request of management, the internal auditor may investigate suspected cases of unethical behavior, including fraud, theft, and abuse of position. Depending on the facts uncovered, such cases may be referred to management, an Audit Committee, the Board, or legal authorities for further action.
Dr aft
-S ub jec t to
Our focus is on the processes and how to make them best work to achieve the Board’s and the District’s strategic goals and objectives. If there are issues, we identify the business risks and their roots causes and work with the District Administration, Audit Committee and Board to develop and implement cost effective solutions.
Bonadio & Co., LLP
38
The Bonadio Group
39
Dr aft -S ub jec t to Ch a
nge