Webster CSD Internal Audit 2023 RA Final.pdf

WEBSTER CENTRAL SCHOOL DISTRICT

Internal Audit 2022-2023 Annual Update to Risk Assessment

WEBSTER CENTRAL SCHOOL DISTRICT Table of Contents February 13, 2023

Page Report

1

Risk Assessment and Internal Control Structure

2

Risk Score Summary (All Areas)

4

Historical and Projected Audit Areas

5

Internal Audit Work Plan

6

Detailed Risk Assessment by Area and Recommendations

7

Definitions of Risk Assessment Areas

18

February 13, 2023 Audit Committee Members Webster Central School District 119 South Avenue Webster New York 14580 Dear Audit Committee Members: The following report summarizes our annual risk assessment for the Webster Central School District (the District). Bonadio & Co., LLP was engaged by the District's Board of Education to fulfill the requirements of the 2005 School Financial Oversight and Accountability Act by performing an annual risk assessment. The purpose of the annual risk assessment is to provide the audit committee with a review of internal controls that the District has in place to prevent and detect fraud, ensure the financial reporting is accurate and that the District's assets are safeguarded. The content of this report is intended to provide the District's Audit Committee with the baseline information necessary to develop, approve, and implement an Internal Audit Work Plan in the 2022-2023 fiscal year. In performing our engagement, we relied on the accuracy and reliability of information provided by District personnel. We have not audited, examined or reviewed the information, and express no assurance on it. Had we performed additional procedures, other matters might have come to our attention that would have been reported to you. This consulting engagement report is intended solely for the information and use of the Administration, the Audit Committee, the Board of Education, and other applicable employees within the District and is not intended to be and should not be used by anyone other than those specified parties. We appreciate the opportunity to prepare this annual risk assessment for the District and are available to assist you in carrying out other portions of the Internal Audit Plan. We are also available anytime to answer your questions.

171 Sully ’s Trail Pittsford, New York 14534 p (585) 381-1000 f (585) 381-3131

www.bonadio.com

Very truly yours, BONADIO & CO., LLP

Randy Shepard, CPA Partner

1 ALBANY • BUFFALO • DALLAS • EAST AURORA • NEW YORK CITY • ROCHESTER • RUTLAND, VT • SYRACUSE • UTICA

RISK ASSESSMENT AND INTERNAL CONTROL STRUCTURE Background Information In 2005, the New York State Legislature issued School accountability laws, pursuant to Chapter 263 of the Laws of 2005 (the Act), regarding increased oversight over public schools, charter schools, and boards of cooperative educational services. As part of these laws, the District is required to implement and maintain an Internal Audit function. The Internal Audit function requires the formation of an Audit Committee and the appointment of an internal auditor. For the 2022-2023 fiscal year, the District appointed Bonadio & Co., LLP as the District’s internal audit consultants to perform an annual risk assessment, develop a proposed audit work plan based on the high risk areas identified, and then to assist in the development of the scope and timing of the internal audit process based on the approval of the District’s Audit Committee. This report focuses on our annual risk assessment of internal controls of the District’s operations, financial reporting policies, procedures and functional activities. Our interviews with District Administration and staff were directed toward gaining an understanding of any changes and related risks in each internal control area during the last 12 months, from the perspective of management responsible for controlling such risks. Using this information, we assessed the risk (low, moderate, or high) present in each area. A summary of this annual risk assessment is included. The annual risk assessment process also drives the planned scope of the internal audit procedures, which is summarized in the internal audit work plan. Objective The objective of the annual risk assessment is to meet the requirements of the 2005 Schools Accountability legislation and assist Audit Committee members with the development of an effective internal audit work plan. Risk Assessment Process In 2022, we performed an initial risk assessment of key areas and transactions in order to assess the risk for each of the significant transaction cycles and functional responsibilities. Annually, we update that initial risk assessment by performing interviews, observations, reperformance, recalculations, inquiries, and/or walkthroughs with various department personnel. Using this information and input, we evaluate the level of risk and assess a risk score which is then used to develop an overall risk rating for the area based on the perceived effectiveness of the internal control environment. As part of these procedures, we will obtain copies of your most recent audited financial statements and related reporting and identify any risks that may be appliable to our risk assessment process. In addition, we will obtain and review current policies and procedures in evaluating the design of the control environment and related activities.

2

When assessing risk in a control environment, we consider four categories of risk which are defined below. Inherent Risk The nature of some activities or areas makes them a greater risk than others. Some characteristics that generally increase inherent risk are opportunity, complexity, changes in the operating environment, changes in personnel, and rapid growth. Inherent risk is a tool in determining the susceptibility of an entity, unit, or account to fraud, waste or abuse assuming there were no related internal controls. Control Risk This is the risk that material errors or fraud are not prevented or detected by the internal control system. Materiality This is an expression of relative significance or importance of a particular transaction class which can be based on factors such as dollar value or volume of transactions. Overall Risk The is the remaining and assigned risk level calculated after evaluating control risk, inherent risk and materiality. We will calculate an overall risk score at the entity level, using the considerations as defined later in this report, in the following key accounting areas: Revenue, Billings, Receivables, and Cash Receipts Expenditures, Expenses, Payables and Disbursements Human Resources Payroll

Building and Grounds Information Technology School Lunch Fund Student Services

Not all risks are created equal. Some are more likely than others to occur, and some will have a greater impact that others if they ultimately do occur. Additionally, the perception of risk is truly subjective and may not be viewed the same by all individuals. Once risks are identified, their probability and significance must be assessed. Upon identifying and assessing risk, your organization must decide how to address and reduce the risk to an acceptable level. Based on a cost/benefit analysis, in some cases, the Board's decision may be to implement additional controls or in some cases the Board may decide to accept the risk identified. Personnel Interviewed We interviewed several individuals in connection with our risk assessment update procedures. Our interviews were directed towards gaining a thorough understanding of the objectives and related risks in each of the internal control areas from the perspective of the individuals responsible for controlling such risks.

3

RISK SCORE SUMMARY Below is a risk score summary ranked by accounting area beginning with the area with highest risk score. Business Cycle Area Extraclassroom Activity Funds (ECA) Special Education and Student Services Payroll and Human Resources School Lunch Transportation Building and Grounds Information Technology Federal and State Aid Expenditures, Expenses, Payables and Disbursements Revenue, Billings, Receivables and Cash Receipts

CY Risk Score 13 13 12 12 12 11 11 11 11 10

Scoring Methodology Individual Area 1 2 3

Risk Level Low Moderate High

Overall Score 1-11 12-20 21-27

We are pleased to report that the District does not have any categories identified as High Risk based on the current year risk assessment. In reviewing the ranking above, five of the current year areas fall into the moderate category and the remaining current year areas into the low category. But those in the moderate are generally in the low end of the range. On the following pages we have provided a historical table showing the areas audited, as well as our recommendations for the current and next year for your consideration. We also provide some suggested approaches to addressing the recommended areas for the current year.

4

HISTORICAL AND PROJECTED AUDIT AREAS The table below illustrates the historical and projected audit areas for which testing has been, or may be performed. These priorities are reviewed annually with the Board or Audit Committee and readjusted accordingly. On the following page we outline the proposed work plan and provide some suggested procedures to accomplish the objectives. Business Cycle Area

2019-20 (Completed)

2020-21 (Completed)

2021-22 (Completed)

X

X2

2022-23 (Suggested)

2023-24 (Suggested)

Revenues, Billings, Receivables and Cash Receipts Expenditures, Expenses, Payables and Disbursements Human Resources/Payroll Building and Grounds School Lunch Fund Information Technology

X1

Extraclassroom

X

Transportation State and Federal Aid Special Education & Student Services

X3

X1 - Information Technology General Control (ITGC) areas for WINCAP and Frontline. X2 - Health insurance withholdings and employee resignations. X3 - Processes related to Individualized Educational Plans (IEPs). 5

INTERNAL AUDIT WORK PLAN Below is a recommended Internal Audit Workplan. Fiscal Year 2022-2023 Area 1: Special Education & Student Services Reason: The process for creating Individualized Education Programs (IEPs) for the 840+ eligible students at the District has become a time consuming and extensive process which has been exacerbated by the recent turnover within the department. As a result, certain controls ensuring the accuracy of the final reports have not been able to be implemented effectively. Possible Audit Strategy(ies): We will review and document the District's current process associated with the creation of an IEP and will make any recommendations, if necessary. We will select a sample of students who are receiving special education services and ensure that the District has an IEP on file for those students and that the following steps were followed related to the IEP: 1. There was a referral for special education evaluation. 2. The student's eligibility for special education services was determined. 3. An IEP meeting was scheduled. 4. The initial IEP was developed. 5. The District provided special education and related services to that student. 6. The District is monitoring the student's progress. 7. The District is reviewing the student's IEP and performing re-evaluation as needed. Fiscal Year 2023-2024 Area 2: Extraclassroom Reason: Extraclassroom activity funds, funds being operated by and for the students, are by nature, an increased risk for the District. We noted that each school within the District has a slightly different process, varying levels of training for those individuals involved, and there is a heavy reliance on paper and manual processes. Additionally, we noted that the District does not have any up-to-date documentation of the policies and procedures related to the handling of extraclassroom funds. Possible Audit Strategy(ies): We will assist the District in reviewing current processes and procedures and develop a uniform approach. We will conduct an extraclassroom activities training for the club advisors and club treasurers to go over their roles and responsibilities, the District's process, forms, etc.

6

Revenues, Billings, Receivables and Cash Receipts Area of Consideration External Audit and Past Audit Considerations Financial Reporting (Internal Reporting, External Reporting, Budgeting) Governance and Management Design and Effectiveness of Control Environment and Control Activities IT, Sensitivity of Information, and Access Vulnerability Materiality, Complexity and Transaction Volume Fraud Risk Environmental Risks Observation and Inquiry Risks SCORE

CY Risk Score

Comments/ Other Info

1 1 1 1 1 This is a material area with significant transaction volume.

2 1 1 1 10

Risk Level None Low Moderate High

Scoring Methodology Individual Area 0 1 2 3

7

Overall Score 0 1-11 12-20 21-27

Expenditures, Expenses, Payables and Disbursements Area of Consideration External Audit and Past Audit Considerations Financial Reporting (Internal Reporting, External Reporting, Budgeting) Governance and Management Design and Effectiveness of Control Environment and Control Activities IT, Sensitivity of Information, and Access Vulnerability

CY Risk Score 1 1 1

The District is driven heavily by paper and manual processes.

2 1

Materiality, Complexity and Transaction Volume

2

Fraud Risk Environmental Risks Observation and Inquiry Risks

1 1 1

SCORE

11

Risk Level None Low Moderate High

Comments/ Other Info

This is a material area with significant transaction volume. Additionally, in the current year there was increased spending as a result of additional funding from the American Rescue Plan Act.

Scoring Methodology Individual Area 0 1 2 3

Overall Score 0 1-11 12-20 21-27

8

Human Resources & Payroll Area of Consideration

CY Risk Score

External Audit and Past Audit Considerations

2

Financial Reporting (Internal Reporting, External Reporting, Budgeting)

1

Governance and Management

2

Design and Effectiveness of Control Environment and Control Activities

1

IT, Sensitivity of Information, and Access Vulnerability Materiality, Complexity and Transaction Volume Fraud Risk Environmental Risks Observation and Inquiry Risks SCORE

Comments/ Other Info There was a 2021-2022 deficiency in internal controls related to documentation and approval of separation payments.

There has been significant turnover within the HR department.

Personally identifiable information (PII) stored by the District.

2 1 1 1 1 12

Risk Level None Low Moderate High

Scoring Methodology Individual Area 0 1 2 3

Overall Score 0 1-11 12-20 21-27

9

School Lunch Fund Area of Consideration External Audit and Past Audit Considerations Financial Reporting (Internal Reporting, External Reporting, Budgeting) Governance and Management

CY Risk Score 2

1 1

Design and Effectiveness of Control Environment and Control Activities

2

IT, Sensitivity of Information, and Access Vulnerability

1

Materiality, Complexity and Transaction Volume

2

Fraud Risk Environmental Risks Observation and Inquiry Risks

1 1 1

SCORE

12

Risk Level None Low Moderate High

Comments/ Other Info There was a 2021-2022 deficiency in internal control related to excess fund balance in the School lunch fund.

The District personally handles and transports cash from the various schools to a central location for counting.

The District received various State and Federal funding and has multiple locations, which adds complexity and a risk to overall controls over inventory.

Scoring Methodology Individual Area 0 1 2 3

Overall Score 0 1-11 12-20 21-27

10

Building and Grounds Area of Consideration External Audit and Past Audit Considerations Financial Reporting (Internal Reporting, External Reporting, Budgeting)

CY Risk Score 1 1

Governance and Management

2

Design and Effectiveness of Control Environment and Control Activities

2

IT, Sensitivity of Information, and Access Vulnerability Materiality, Complexity and Transaction Volume Fraud Risk Environmental Risks Observation and Inquiry Risks SCORE

Comments/ Other Info

Job vacancies due to a shortage of employees. This is a statewide and even nationwide issue. This will continue to be an issue for the foreseeable future. Newly implemented fuel system with key card access. Additionally, the District is in the process of implementing a new inventory tracking system and work order system.

1 1 1 1 1 11

Risk Level None Low Moderate High

Scoring Methodology Individual Area 0 1 2 3

11

Overall Score 0 1-11 12-20 21-27

Information Technology Area of Consideration External Audit and Past Audit Considerations Financial Reporting (Internal Reporting, External Reporting, Budgeting) Governance and Management Design and Effectiveness of Control Environment and Control Activities IT, Sensitivity of Information, and Access Vulnerability Materiality, Complexity and Transaction Volume Fraud Risk

CY Risk Score 1 1 1 1 2

Inherent risk related to IT services.

1 1

Environmental Risks

2

Observation and Inquiry Risks

1

SCORE

11

Risk Level None Low Moderate High

Comments/ Other Info

Ransomware is always a risk and has been occurring more often in the government space.

Scoring Methodology Individual Area 0 1 2 3

12

Overall Score 0 1-11 12-20 21-27

Special Education and Student Services Area of Consideration External Audit and Past Audit Considerations Financial Reporting (Internal Reporting, External Reporting, Budgeting)

CY Risk Score

Governance and Management

2

Design and Effectiveness of Control Environment and Control Activities

3

IT, Sensitivity of Information, and Access Vulnerability Materiality, Complexity and Transaction Volume Fraud Risk Environmental Risks

1 1 Significant turnover within the department. Discussions with the District identified the IEP process as being time consuming and inefficient in addition to key members of personnel recently changing. Additionally, there is a heavy reliance on "paper and manual processes".

1 1 1 1

Observation and Inquiry Risks

2

SCORE

13

Risk Level None Low Moderate High

Comments/ Other Info

Discussions with District Officials identified the IEP process as being time consuming and inefficient with significant turnover in this area.

Scoring Methodology Individual Area 0 1 2 3

13

Overall Score 0 1-11 12-20 21-27

Extraclassroom Activity Funds (ECA) Area of Consideration

CY Risk Score

External Audit and Past Audit Considerations

3

Financial Reporting (Internal Reporting, External Reporting, Budgeting)

2

Governance and Management Design and Effectiveness of Control Environment and Control Activities IT, Sensitivity of Information, and Access Vulnerability Materiality, Complexity and Transaction Volume Fraud Risk Environmental Risks Observation and Inquiry Risks

1

SCORE

13

Risk Level None Low Moderate High

Comments/ Other Info There were multiple deficiencies in internal control related to Extraclassroom Activities in 2021-2022 school year. Bank reconciliations did not tie to the general ledger for both the Schroeder High School and Spry Middle School Extraclassroom Activities funds. In addition, at Schroeder High School the Profit and Loss statements for the Theater Club did not trace to the general ledger. Additionally, it was noted that there was a deficit in the sales tax balance at year end. The District does not have standard documentation - each of the schools in the District has separate processes and procedures documentation for extraclassroom funds. We noted that there is some documentation of processes and procedures, however, these were noted to be outdated. There is a heavy reliance on paper and manual processes.

2 1 1 1 1 1

Scoring Methodology Individual Area 0 1 2 3

Overall Score 0 1-11 12-20 21-27

14

Federal and State Aid Area of Consideration External Audit and Past Audit Considerations Financial Reporting (Internal Reporting, External Reporting, Budgeting) Governance and Management

CY Risk Score 1 1 1

Design and Effectiveness of Control Environment and Control Activities

1

IT, Sensitivity of Information, and Access Vulnerability

1

Materiality, Complexity and Transaction Volume

3

Fraud Risk Environmental Risks Observation and Inquiry Risks

1 1 1

SCORE

11

Risk Level None Low Moderate High

Comments/ Other Info

Inherent risk related to the District receiving additional federal funding from new grants.

Scoring Methodology Individual Area 0 1 2 3

15

Overall Score 0 1-11 12-20 21-27

Transportation Area of Consideration External Audit and Past Audit Considerations Financial Reporting (Internal Reporting, External Reporting, Budgeting)

CY Risk Score 1 1

Governance and Management

2

Design and Effectiveness of Control Environment and Control Activities

2

IT, Sensitivity of Information, and Access Vulnerability Materiality, Complexity and Transaction Volume Fraud Risk

Job vacancies due to a shortage of employees, especially bus drivers. This is a statewide and even countrywide issue, as many districts are unable to find people willing to drive buses. This will continue to be an issue for the foreseeable future. With the completion of the construction project, the District's process/procedures related to fueling buses has changed.

1 1 1

Environmental Risks

2

Observation and Inquiry Risks

1

SCORE

12

Risk Level None Low Moderate High

Comments/ Other Info

Statewide shortage of bus drivers, causing a significant impact on districts all over the United States.

Scoring Methodology Individual Area 0 1 2 3

Overall Score 0 1-11 12-20 21-27

16

TRANSPORTATION ANALYTICS Analytic #1 Procedure: Determine the total cost of repairs/maintenance incurred in relation to the total miles on the school bus fleet. NOTE: repairs/maintenance includes, parts, lubricants etc. but excludes fuel.

Repairs Total Mileage

581,745

$

$

507,653

$

1,186,203

1,338,194

Repairs/Mile

6/30/2020

6/30/2021

0.43

$

401,237 955,157

0.43

$

0.42

0. 05 0. 06 0. 07 0. 08 0. 09 0. 10 0. 11 0. 12 0. 13 0. 14 0. 15 0. 16 0. 17 0. 18 0. 19 0. 20 0. 21 0. 22 0. 23 0. 24 0. 25 0. 26 0. 27 0. 28 0. 29 0. 30 0. 31 0. 32 0. 33 0. 35 0. 36 0. 37 0. 38 0. 39 0. 40 0. 41 0. 42 0. 43 0. 44

FYE 2021 FYE 2022 FYE 2020

Analytic #2 Procedure: Determine reasonableness of FTE mechanics in relation to the number of buses in the fleet. Expectations: Industry norms are 16-18 buses per 1FTE mechanic 6/30/2022 8

6/30/2021 8

6/30/2020 8

Fleet Size

172

172

172

Buses / Mechanic

22

22

22

FTE Mechanics

TRANSPORTATION ADVISORY SERVICES

26

25

24

23

22

21

20

19

18

17

16

15

14

13

12

11

9

10

8

FYE 2020 FYE 2021 FYE 2022

Brian Lafountain, CPA, CFE TRANSPORTATION ADVISORY SERVICES 171 Sully’s Trail Pittsford, NY 14534 (585) 203-9477 / (800) 233-3251 / (585) 381-3131(fax) www.TransportationConsultants.com Email: BLafountain@TransportationConsultants.com

17

DefinitionsofRiskAssessmentConsiderations AreaofConsideration

Definition Consideration is given to results of the external and internal audits performed in the current and prior years, ExternalAuditandPastAuditConsiderations aswellastheauditee'sresponsetothoseresults. How does management approach the financial reporting process both internally and externally and how FinancialReporting(InternalReporting, accurate and available is the information. In addition, are regulatory reporting requirements submitted ExternalReporting,Budgeting) timelyandaccurately. Construct, makeͲup and involvement of the Board and management from an oversight perspective. Experience of members of the Board and management are considerations in this area. Existence of policies GovernanceandManagement andproceduresaswellasdemonstrationoftoneatthetop. The overall design, operation and effectiveness of the internal control structure, regardless of the personnel DesignandEffectivenessofControl in place. What level of reliance on computerized controls versus manual controls is in place including EnvironmentandControlActivities whetheranysignificantchangesincontrolshavetakenplace. The complexity of the IT environment, including the software and hardware used in various financial IT,SensitivityofInformation,andAccess reporting applications are considered. Additionally, the nature of data used and processed, as well as Vulnerability physicalanddigitalaccessrisksthatmayexist. The materiality, complexity and volume of transactions play a significant role in the assessment of risk related Materiality,ComplexityandTransaction to the audit area. Areas of large volume, large dollar amounts and increased complexity will have a greater Volume riskwhichareindependentofanycontrolsinplace. Consideration of whether fraud has occurred in the past, or based on interviews and procedures if personnel feel there is a risk of fraud that exists. The design of controls to mitigate the risk of fraud are also key FraudRisk considerations.Toneatthetopandthegeneralenvironmentoftheentityareimportantfactorshereaswell. These are risk factors that are in some ways outside of the control of the entity, such as political landscape, EnvironmentalRisks NYSOfficeofStateComptrollerauditsandfocusareas,mediareports,andsimilaritems. Based on the results of all procedures including inquiry and observation, are there any additional areas of ObservationandInquiryRisks concernidentifiedthatwouldnecessitateanadditionalriskrating.

18