WEBSTER CENTRAL SCHOOL DISTRICT INTERNAL AUDIT Risk Assessment Annual Update and Internal Audit Report and Examination of Human Resource Processes 2021 ‐ 2022
March 30, 2022 Brian Freeman, Assistant Superintendent for Business Webster Central School District 119 South Avenue Webster, New York 14580 Dear Audit Committee Members: Bonadio & Co., LLP was engaged by the Webster Central School District (the District) to fulfill the requirements of the Internal Audit Function in accordance with the provisions of the 2005 Public School District Accountability Act. We have been contracted by the District to perform an updated risk assessment, and to conduct internal audit testing, which this year includes an evaluation of the policies and procedures in place regarding the District’s Human Resources department (specifically surrounding healthcare costs and resignations). The results of our testing, which are included in this report, have been communicated to the District Administration. This report is intended solely for the information and use of the District Administration, the Audit Committee, the District, and other applicable employees within the District and is not intended to be and should not be used by anyone other than those specified parties. We would like to acknowledge the cooperation extended to us during our examination by the employees of the Webster Central School District. If you have any questions concerning this report, please feel free to contact us at any time. Very truly yours, BONADIO & CO., LLP
171 Sully ’s Trail Pittsford, New York 14534 p (585) 381-1000 f (585) 381-3131
Randy Shepard, CPA Partner
www.bonadio.com
1 ALBANY • BUFFALO • DALLAS • EAST AURORA • NY METRO AREA • ROCHESTER • RUTLAND, VT • SYRACUSE • UTICA
EXECUTIVE SUMMARY Purpose and Scope Risk Assessment Annual Update To conduct an update to the annual risk assessment. We will review previous years’ risk assessment and evaluate the current year level of risk based upon current year circumstances. Internal Controls Testing The procedures performed examined the effectiveness of the internal control environment surrounding the Human Resources department processes. We were not engaged to perform an audit of this area; and therefore, we express no opinions on the procedures or operations of the controls. Internal Audit Testing Testing regarding the current employees’ health insurance withholding and resignations were completed for the District. Confidentiality This report is confidential and should be distributed only to those with a need to know and who are authorized to access the information; the District Board of Education, the Superintendent or the District Assistant Superintendent for Administration and Bonadio & Co., LLP, the Internal Auditors, must approve the release of this report to anyone outside the District.
2
RISK ASSESSMENT ANNUAL UPDATE 1. Procedures We interviewed District management for purposes of updating the annual risk assessment and determining whether any changes were needed. 2. Results Based on the results of our discussions we did not note any factors or elements that would result in a change in the risk assessment previously performed. However, due to significant turnover in the Human Resources department in the current year, the District opted for testing this area in the current year. 3. Internal Audit Work Plan Our Internal Audit Work Plan was prepared related to fiscal year ending June 30, 2022 and included within this report. The results of the current year Internal Audit are disclosed in Section III.
3
INTERNAL AUDIT TESTING 1. General B&Co. interviewed David Swinson, Assistant Superintendent for Administration and Human Resources, regarding the various policies and procedures in place at the human resources department. 2. Understanding of the Design of the Internal Control Environment We reviewed existing documented policies and procedures for various functions of the District. We reviewed various documents, which were obtained to gain an understanding of the District’s processes. 3. Assessing the Operating Effectiveness of the Internal Control Environment We assessed the adequacy of the design of existing policies and procedures through performance of initial reviews of current reports, management letters, recent audit results and determined susceptibility to various risks and vulnerabilities. 4. Procedures and Testing We determined if proper procedures were followed for 10 employees who resigned during the school year. We obtained resignation information and compared the information to the accounting software. We ensured that the employee who resigned had their accounts (including email and badge access) deactivated timely. We ensured that the last paycheck for employees who had resigned were for hours worked prior to their resignation date. We scanned the list of current employees to ensure that the employees who had resigned were no longer included on the current employee listing.
We selected a sample of 15 employees from WinCap to determine whether or not their health insurance withholdings per the insurance bill agreed to what was withheld on their paycheck per WinCap. We compared total benefits withheld to the insurance bill and then obtained the employee’s personnel file to ensure that the insurance withholding agreed to what was selected for coverage and they were allowed that level of coverage based on their employment contract. We then agreed the withholding to the current insurance rates. Lastly, we agreed the breakout of what was paid by the District to what was withheld from the employee, to ensure the proper amount was remitted.
We selected a sample of 15 employees from the insurance bills to determine that their health insurance withholding per their WinCap agreed to what was indicated on the insurance bill. We then obtained the employee personnel file to ensure that the insurance withholding agreed to what was selected for coverage and that they were allowed that level of coverage based on their employment contract. We then agreed the withholding to the current insurance rates. Lastly, we agreed the breakout of what was paid by the District to what was withheld from the employee, to ensure the proper amount was remitted.
4
5. Results A. Employee System Deactivation Observation We noted the following regarding the number of days it took the District to deactivate a resigned employee’s District facilities and account access based on our testing of 10 individuals. Resignation dates were obtained from the notification letter to the District. Number of Selections 5 1 1 1 1 1 10
Business Days After Resignation 1 2 4 6 8 33
Recommendation It is recommended that the District ensure that employees who have resigned have their accounts and District facilities access deactivated timely (within 1 business day). We noted that 5 individuals were deactivated within that time and 5 individuals were not, with the most significant delay being 33 business days. We noted that the individual that was not deactivated until 33 business days after resignation was working per diem for a few of those days. The District deactivated this individual 25 days after their last per diem shift. B. Employee Medical Enrollment Form Observation We noted there was 1 instance out of 30 individuals selected wherein an employee’s personnel file did not contain the enrollment form completed to support what medical plan the employee had selected during the onboarding process. Recommendation It is recommended that the District ensure all employees have an enrollment form included in their personnel files to support the insurance election made by the employee.
5