an ge
Dr aft
-S
ub
jec t
to
Ch
WEBSTER CENTRAL SCHOOL DISTRICT INTERNAL AUDIT WORK PLAN FOR THE YEAR ENDING JUNE 30, 2026
WEBSTER CENTRAL SCHOOL DISTRICT RISK ASSESSMENT SUMMARY
nge
We performed our annual risk assessment update of the Webster Central School District's financial operations and have issued our report. We have also met with the audit committee and discussed our risk assessment, as well as the additional concerns the committee had.
The following work plan is suggested to address the results of the risk assessment and committee concerns. The District is required to perform one detailed audit and may select one or multiple areas that are suggested below.
Ch a
FEE
$20,000. Approximately $10,000 incurred for risk assessment. The remaining fee of $10,000 is allocated for the following options and for additional audit committee meetings.
WORK PLAN
-S ub jec t to
RECOMMENDED TESTING
In further analyzing each of these areas, we considered the size/impact to the District of material fraud or error occurring, the complexity of the transaction system, employee training, frequency of findings, and other factors. Based upon this analysis, we suggest the following testing be performed as part of our internal audit services: FINANCE DEPARTMENT OVERVIEW
Given the turnover in Administrative functions and concerns regarding communication between various Administrative teams, the District should consider a Finance Department review to determine if there are any efficiencies, changes in approach, or controls needed to improve daily operations. We would perform a general review surrounding financial operations and associated roles, through systems, data, and channels of communication. The work would be conducted through on-site/off-site efforts, main site walk-through, and inquiry-based reviews of controls, documents, and processes. Estimated costs to complete - $10,000
Dr aft
INFORMATION TECHNOLOGY CONTROLS
Given the ever-changing risks relating to the IT environment, the district should consider using our IT related services to perform a General Controls Assessment review surrounding financial and general information systems, data, administrative controls, and physical security. This review consists of an inquiry and observational assessment of the information technology/infrastructure surrounding electronic information security, processes, and controls in place at the District. The work would be conducted through on-site/off-site efforts, main site walk-through, and inquiry-based reviews of controls, documents, and reports. Estimated costs to complete - $8,000
2
MEDICAID COMPLIANCE AND UTILIZATION The District should consider, as part of the internal audit function, using our experienced Medicaid billing expert to review the district’s Medicaid billing process to determine if there are additional services that the district can bill for that would maximize the district’s Medicaid revenue as part of its internal audit areas to be tested.
nge
$7,000 PAYROLL
Trace five new employee additions and five terminations from the pay master file in WINCAP to evidence of authorizations such as board minutes or other documented authorization. Trace five new employee additions and five terminations from board minutes or other authorization to pay master in WINCAP. Of the ten terminations selected, we will review the payroll register to determine that pay ceased at termination effective date. For timesheet employees, we will select ten employees pay transaction and agree back to the authorized timesheet comparing for accuracy. We will also select one deduction from the pay and request the employee authorization for the deduction to confirm authorization and accuracy. From the paymaster file in WINCAP, we will select ten employees and agree their information to a W4 and I9 and that their payrate is in agreement with their respective collective bargaining agreement. We will select five payrolls and confirm that evidence of payroll certification has occurred.
-S ub jec t to
Ch a
We will review the District’s payroll activities for the current year. We will review the policies and procedures in place in administering the District’s payroll. Procedures may include;
$7,500
ACCESS CONTROLS
Dr aft
Electronic approvals and movement away from paper processes increases access control risks. In addition, there has been an uptick in NYSOSC audits in Information Technology access controls. We will perform a detail review of the access controls of all Business Office employees activity in WINCAP and make recommendations for any controls that are not compatible with the job functions of that employee. The analysis will include a detailed segregation of duties analysis comparing actual and allowed functions.
In addition, we will select a sample of WINCAP User Access Update forms and compare them to the changes made in the system as detailed in the User Security Profile Report to ensure that updates have been authorized and made in accordance with the requesting department’s directions. Estimated cost to complete – $6,500
3
REVIEW OF VENDOR VS EMPLOYEE CLASSIFICATION AND 1099 FILING In recent years governmental entities, including school districts, have seen an increase in Internal Revenue Service audits. Many of these audits have focused on proper 1099 filings and employee vs subcontractor classifications. We recommend that the District perform the following procedures to mitigate the risk of and identify possible exposures in any future audits.
Ch a
nge
Vendor vs Employee Classification To gain an understanding of the current District procedures related to determining vendor vs employee classifications, we will interview various officials within the procurement and payroll functions. In addition, the District will provide us with an outline of the procedures currently in place to add new vendors. We will perform a walkthrough of these procedures with members of the District’s accounts payable department, assessing the procedures for appropriateness and potential weaknesses in the control structure as they relate to determining whether the proper vendor/employee classification was made. In addition, we will select 25 vendors from the WINCAP OTHER1099 listing. This list identifies vendors that were processed through accounts payable that have been denoted as not requiring a 1099. We will perform the following procedures on these 25 vendors;
-S ub jec t to
To determine whether a 1099 should have been issued; Discuss type of service performed with accounts payable. Review an invoice to corroborate type of service and entity type (Inc., Corp, etc.) Review W-9 to corroborate whether 1099 should have been issued.
To determine whether the vendor is improperly classified; Consider information obtained above for 1099 determination. Review contracts for the selected vendors to determine if any requirements within the agreement are in conflict with the IRS rules for determining a subcontractor. Search retirement reporting to determine that vendor is not reported under retirement plans. 1099 Filing To gain an understanding of the current District procedures related to the preparation and filing of annual 1099 information returns, we will interview various District officials within the accounts payable function. In addition, the District will provide us with an outline of the procedures currently in place to prepare and file the 1099s. We will perform a walkthrough of these procedures with members of the District’s accounts payable department, assessing the procedures for appropriateness and potential weaknesses in the control structure as they relate to timely accurate filing of the 1099s.
Dr aft
In addition, we will select 25 vendors from the WINCAP DETL1099 listing. This list identifies vendors that were processed through accounts payable that have been denoted as requiring a 1099. We will perform the following procedures on these 25 vendors;
Review the completed 1099 for completeness. Including Addresses, tax ID, etc. Compare all information obtained on the W-9 to completed 1099. Compare all information from the DETL1099 report to the completed 1099
$7,750
4
PURCHASING
Ch a
nge
NYSOSC audits have recently identified the procurement cycle as an area of concern. We will select a sample of 25 vendor payments. As part of this testing, we will determine if the District adhered to their purchasing policy, including their bidding requirements by testing for the following: For purchases less than $20,000, did the District follow their purchasing policy and include supporting documentation of the purchase in accordance with their purchasing policy; For purchases over $20,000, did purchase meet the requirements for bidding; i.e. the purchase of supplies, materials and equipment in excess of $20,000 and public work contracts in excess of $35,000; o Was the bid advertised in accordance with the purchasing policy; o Were bids received documented as to date and time received and not opened until the designated date and time; o Were bid results documented; o Was the contract awarded to lowest responsible bidder or, if not, was the reason for awarding the contract to other than the lowest responsible bidder documented; and o Was the award approved and documented by the board. Trace expenditure for the vendor to the general ledger to ensure it was coded to proper account.
-S ub jec t to
$7,250 EXTRACLASSROOM ACTIVITY FUNDS
Due to the nature of the student population and the decentralized nature of the extraclassroom activities, it is important that adequate controls are in place. We will meet with selected faculty advisors and the extraclassroom treasurer to discuss the processes in place over the processing of transactions. Reasonableness tests will be performed on larger fundraisers as well as tests of cash receipts and cash disbursement transactions. We will also provide training to all faculty advisors and others involved in extraclassroom clubs. A report would be issued regarding suggested improvements. Estimated cost to complete – $5,750
EMPLOYEE WITHHOLDING AUTHORIZATIONS
We will select a sample of 40 employees and compare their W4 withholding authorizations with actual withholding rates in WINCAP and that a completed W4 is on file.
Dr aft
$5,750
5
GRANT TESTING We will review the District’s grant activities for the most recently completed year. We will review the policies and procedures in place in administering grant activity with the District’s current staff. Additional procedure may include; Select reporting (such as FS-10, FS-10A, FS-10F or similar) for testing to determine if initial and subsequent budgets were established and any required reporting as prescribed by the funding source was adhered to and timely filed.
Reconcile the grants from the final reporting to the audited financial statements for the most recently completed fiscal year ended.
Determine if adherence to the budget was met. If underspent, determine if underspent amount was requested to roll forward. If overspent, obtain explanation of how the budget was overridden.
Select a sample of 10 employees from the final reporting (FS-10F, etc.)
Ch a
nge
Test to determine that the selected employee is not counted as more than 1 FTE across the grants for that period.
o
Agree the employee pay rate to that shown on the final report.
-S ub jec t to
o
o
View the employees I9.
Select a sample of 10 expenditures from the final reporting (FS-10F, etc.). o
Agree to amount in general ledger.
o
Obtain invoice packet and agree vendor, type of expenditure, amount to final reporting.
o
View evidence of proper procurement policies on selection, including approval by purchasing agent, bidding or quotes as applicable.
Where outside vendors were contracted to carryout required activities of the program, determine through inquiry and obtaining supporting documentation that the students received the benefit of the contracted services. As an example, if the vendor was contracted to provide training on a certain matter, is their evidence that the training occurred, and the subject matter addressed the grant’s required activities?
Dr aft
$6,500
6
SCHOOL LUNCH FUND School Lunch cash receipts can present additional risk due to its reliance on cash transactions and decentralized management. To ensure financial integrity and compliance with district policies, we will assess the adequacy of oversight and identify potential areas for improvement.
nge
We will meet with the food service director and relevant staff to discuss current processes for managing the school lunch fund, including budgeting, expense tracking, and revenue collection.
Ch a
A sample of cash receipts will be tested for accuracy, timely deposit and we will reconcile these with recorded fund revenue. Additionally, a sample of expenditures from the school lunch fund will be analyzed to ensure compliance with district policies and appropriate documentation. We will verify that all expenses are supported by receipts and align with budgetary constraints. Upon completion of our review, we will issue a report detailing our findings, including any weaknesses identified in the control environment and recommendations for improvement. Estimated cost to complete – $6,500 INFORMATION TECHNOLOGY
-S ub jec t to
Information Technology is always an area to be mindful of, and NYSOSC audits have recently identified this area as a concern. Specifically, as it relates to NY Shield Act, which was signed into law in 2019. The NYS Shield Act requires any person or business that maintains private information to adopt administrative, technical and physical safeguards. We will deploy IT specialists from FoxPointe who will determine the District’s current response plan to the NYS Shield Act, test compliance, and develop recommendations as deemed necessary.
Dr aft
$7,500
7
PENETRATION TESTING
nge
This testing is a method of evaluating the security of a client’s externally facing presence on the internet. This type of testing encompasses the offensive security concept, which simulates the Tactics, Techniques, and Procedures (TTP) utilized by an attacker (i.e., hacker). The method involves an active analysis of the attack surface for any vulnerabilities and misconfigurations, as well as the active exploitation of them. During a test, we utilize TTPs applicable to the type of test we are engaged to perform.
1.
Information Gathering
2.
Network Mapping
3.
Vulnerability Identification
4.
Penetration Attempts
Ch a
In the assessment, a layered approach is followed that includes actions in:
And if successful with the penetration attempts:
Gaining Access and possible Privilege Escalation
6.
Enumerating Further
7.
Compromise Remote Users/Sites
8.
Maintaining Access
9.
Covering Tracks
-S ub jec t to
5.
Reporting and Deliverables Bonadio’s deliverable reports include specific sets of hardcopy and electronic documentation, including:
An Executive Summary, containing limited technical jargon, that is management-focused on data protection, integrity, confidentiality, and operational security.
Our full observations and recommendations report.
A detailed technical remediation report, per assessed device, asset (physical or technical), or fileshare.
Detail of key tests performed.
Dr aft
Any critical issues identified during the penetration testing will be communicated to the District. A critical issue is defined as “any issue posing an immediate security threat to the confidentiality, integrity, or availability of the District’s network or data”. The severity of, as well as countermeasures to safeguard against, any critical issues identified will then be discussed with the District. Estimated costs to complete – $5,000 - $12,500
8
TRANSPORTATION Our Transportation Advisory Services (TAS) a division of Bonadio provides a number of types of projects. We have listed them below; however, we would need to meet to better understand the scope of your needs in these areas to provide a price range. These possible projects include:
Ch a
nge
1. Labor Agreement(s) Numerous areas will be explored including the labor agreement language, practices that affect the operation of the program, job descriptions and staffing levels, and the wage and benefit structures as compared to industry norms. TAS will provide the District with recommendations relative to potential areas of operating procedures and/or financial elements that should be considered in future labor agreements, especially if program restructuring such as significant attendance zone changes are being contemplated. We will also provide insights relative to labor costs as a factor in Transportation Aid, and alternatives that the district may want to consider in the future.
-S ub jec t to
2. Policy and Procedures Review TAS will review the District’s transportation related policies and procedures, recommending any changes, additions or deletions that would enhance the operation of the program. Also included in this study will be a discussion with the District focused on the operation of the program from the perspective of compliance with policies and procedures. In other words, we will compare what you really do versus what your formal guidelines require. In areas where procedures vary, or in areas where no procedures are in place, TAS will recommend specific directions for the District to consider. In all cases where recommendations are provided, we will endeavor to detail the ramifications of making the proposed changes. Once we evaluate your current policy compliance, we will evaluate the pro’s and con’s of modifying specific policies that may result in greater cost or operating efficiencies. Our recommendations will incorporate our detailed knowledge of the State regulatory requirements. Changes in policy and service levels (such as changes in bell times or tier structures) can have ramifications throughout the District. We will consider cost, service levels, staffing mandates, capital investments, community reactions, and more.
3. Program Operations TAS will evaluate the operating performance of the District with an eye toward making recommendations that will improve the operations and efficiencies of the program. Included in this analysis will be a thorough review of the organizational structure; internal management and information systems; the use and effectiveness of maintenance and management software systems; capital investment requirements; and other aspects as defined by the District as being key components of our review.
Dr aft
4. Maintenance TAS will evaluate the District’s maintenance program, including but not limited to: staff scheduling and staffing levels; mechanic qualifications and training; use and effectiveness of maintenance software systems; inventory controls; maintenance costs; work order processing and repair schedules; shared services; equipment availability; and the use of outside services. Maintenance can be impacted by tier level changes or bell time consolidations due to staffing needs or fleet changes.
9
nge
5. Financial Analysis A critically important consideration of each area that we study will be the financial impact that any proposed changes could have upon the District. Included in our review will be an analysis of your current costs of the operation compared to industry norms, the status of internal controls and procedures (i.e. labor, purchasing, and inventory controls), and recommendations aimed at enhancing the efficiency of the operation while maintaining the level of service desired by the District. TAS offers the District extensive experience at controlling transportation costs while continuing to meet the operating needs of the District. It is important to state that this is not a financial audit, but a review from an experienced transportation consultant. We will incorporate into our recommendations a review of the District’s Transportation Aid (90% for last year), and we will recommend any changes that we believe would be appropriate to maximize this resource.
Ch a
6. Fleet We will review the fleet’s utilization, configuration, and costs. As a part of this section, we will make recommendations for future fleet replacements. Included in any fleet recommendations will be the potential impact of any routing or bell time changes.
-S ub jec t to
7. Facility TAS will review the functionality of the transportation facility, including its impact on the on-going operation of the program. TAS has been engaged over the years to assist districts in the review of facilities, including providing assistance to architects in the design of new structures. We can offer knowledgeable perspectives on facility locations and features which can enhance the success of any project while saving money from those “wish-list” items that always seem to appear. 8. Management and Staffing TAS will review the organizational structure of the transportation program, including personnel assignments, training, sufficiency, and areas of responsibility. We will evaluate the program management systems and procedures, including labor time tracking, payroll processing, and attendance reporting. We will focus on the functional aspects of operating an involved transportation system, coupled with an evaluation of the resources provided to the Department. Given the changes that have occurred to the program management in the past few years, this aspect of the review is very important.
Dr aft
9. Routing Efficiency Analysis TAS will work with District staff members to evaluate the routing protocols and procedures in place, along with the effectiveness of the District’s routing software. Incorporated in this area of the study will be a formal “Ridership Audit” to determine the actual versus scheduled ridership in the District. This information will be very important as we evaluate the current routes in place, the opportunity for combining and/or eliminating routes to be more efficient. The results of the ridership audit is critical to identify specific buses and/or routes that have capacity on a regular basis. The ridership audit will also provide an excellent picture of the overall efficiency of the route design. As a part of this review, we will evaluate the District’s use of their routing software, and we will offer insights should the program operation not be to the level as expected. TAS would analyze the current routes with a focus on the overall design and effectiveness of the routes, the efficiency of the routes, as well as an analysis of potential for combining or eliminating routes altogether. Several factors come into play in this analysis such as the availability of drivers, the desired length (number of minutes) of routes, the geography of the school district as well as bus capacities etc. Items 1 – 9 Together = TAS Efficiency Study - $17,500 Items 1 – 9 Individually - $5,000 each
10
nge
10. Bell Time and/or Tier Changes Analysis TAS will focus on the effects of potential changes in bell times or adjustments to the tier structure of the District’s bus program. This analysis is critical to contemplated changes to bell times or tier structures as it identifies the effects on the number of buses and drivers required on a daily basis (tier changes) as well as the potential effects of bell time changes to on-time performance by the buses. TAS has extensive experience with reviewing bell time changes and tier structure adjustments and providing recommendations to Districts on the feasibility of each. Estimated costs to complete – $7,500
-S ub jec t to
Ch a
11. Zero Emission Bus Mandate TAS will analyze and address risks associated with the successful compliance with the zeroemission school bus mandate. TAS will analyze the composition of the District’s current bus routes, bell times, and tier structure to determine the most appropriate types/size of buses, the battery capacities, and the required charging infrastructure that will be needed to be successful with the transition. TAS will assess the requirements of the bus charging infrastructure as well as the infrastructure needed to receive the power from the utility provider. The analysis will also include an assessment of the District’s current facility to accommodate a full fleet of electric vehicles, charging needs and changes to the maintenance program for zero emission buses. A GAP analysis will be provided to chart where the district is and where the district needs to be in compliance with the mandate. Estimated costs to complete – $10,000 - $15,000
Dr aft
12. Transportation Contract Compliance The contract compliance component of a study would include the analysis of the requirements of the current contract in place with the District’s transportation provider. TAS would analyze the contract’s key terms and conditions, and test the operations to confirm compliance by the contractor. Some key areas within a transportation contract would include the following: Personnel mandates: is the contractor providing the mandated number of management personnel (Terminal Manager, Safety Coordinator, Lead Mechanic etc.), dispatchers, mechanics, monitors/aides, drivers, etc. Billing Accuracy: Is the District being billed the correct amounts each month, for the active buses in operation, for the correct length of day, for the appropriate size of buses, field and sports trips, etc. Training mandates: Are the drivers and monitors/aides in compliance with state mandated training, as well as specialized training that is required by the contract. Stand-by drivers and spare buses: Is the contractor providing the appropriate number of spare drivers and spare buses required by the contract. Are the buses properly equipped with the technology that is required by the contract. Cameras, GPS systems, two way radios, air conditioning, seat belts, etc. Fuel Allowance: is the fuel allowance reconciliation being prepared timely and accurately each school year. Estimated costs to complete – $5,000 – $7,500
11