Webster CDS 2024-2025 Risk Assessment Report - FINAL (1).pdf

WEBSTER CENTRAL SCHOOL DISTRICT Internal Audit 2024-2025 Annual Update to Risk Assessment

WEBSTER CENTRAL SCHOOL DISTRICT Table of Contents January 31, 2025 Page Report

1

Risk Assessment and Internal Control Structure

2

Risk Score Summary (All Areas)

4

Historical Audit Areas

5

Internal Audit Work Plan

6

Detailed Risk Assessment by Area and Recommendations

7

Definitions of Risk Assessment Areas

16

January 31, 2025 Audit Committee Members Webster Central School District 119 South Avenue Webster New York 14580 Dear Audit Committee Members: The following report summarizes our annual risk assessment for the Webster Central School District (the District). Bonadio & Co., LLP was engaged by the District's Board of Education to fulfill the requirements of the 2005 School Financial Oversight and Accountability Act by performing an annual risk assessment. The purpose of the annual risk assessment is to provide the audit committee with a review of internal controls that the District has in place to prevent and detect fraud, ensure the financial reporting is accurate and that the District's assets are safeguarded. The content of this report is intended to provide the District's Audit Committee with the baseline information necessary to develop, approve, and implement an Internal Audit Work Plan in the 2024-2025 fiscal year. In performing our engagement, we relied on the accuracy and reliability of information provided by District personnel. We have not audited, examined or reviewed the information, and express no assurance on it. Had we performed additional procedures, other matters might have come to our attention that would have been reported to you. This consulting engagement report is intended solely for the information and use of the Administration, the Audit Committee, the Board of Education, and other applicable employees within the District and is not intended to be and should not be used by anyone other than those specified parties. We appreciate the opportunity to prepare this annual risk assessment for the District and are available to assist you in carrying out other portions of the Internal Audit Plan. We are also available anytime to answer your questions. 171 Sully’s Trail Pittsford, NY 14534 p (585) 381-1000 f (585) 381-3131

Very truly yours, BONADIO & CO., LLP

www.bonadio.com

Timothy J. Doyle, CPA Partner 1 ALBANY • BUFFALO • DALLAS • EAST AURORA • NEW YORK CITY • ROCHESTER • RUTLAND • SYRACUSE • UTICA • VIRGINIA BEACH • WILMINGTON

RISK ASSESSMENT AND INTERNAL CONTROL STRUCTURE Background Information In 2005, the New York State Legislature issued School accountability laws, pursuant to Chapter 263 of the Laws of 2005 (the Act), regarding increased oversight over public schools, charter schools, and boards of cooperative educational services. As part of these laws, the District is required to implement and maintain an Internal Audit function. The Internal Audit function requires the formation of an Audit Committee and the appointment of an internal auditor. For the 2024-2025 fiscal year, the District appointed Bonadio & Co., LLP as the District’s internal audit consultants to perform an annual risk assessment, develop a proposed audit work plan based on the high risk areas identified, and then to assist in the development of the scope and timing of the internal audit process based on the approval of the District’s Audit Committee. This report focuses on our annual risk assessment of internal controls of the District’s operations, financial reporting policies, procedures and functional activities. Our interviews with District Administration and staff were directed toward gaining an understanding of any changes and related risks in each internal control area during the last 12 months, from the perspective of management responsible for controlling such risks. Using this information, we assessed the risk (low, moderate, or high) present in each area. A summary of this annual risk assessment is included. The annual risk assessment process also drives the planned scope of the internal audit procedures, which is summarized in the internal audit work plan. Objective The objective of the annual risk assessment is to meet the requirements of the 2005 Schools Accountability legislation and assist Audit Committee members with the development of an effective internal audit work plan. Risk Assessment Process We previously performed an initial risk assessment of key areas and transactions in order to assess the risk for each of the significant transaction cycles and functional responsibilities. Annually, we update that initial risk assessment by performing interviews, observations, reperformance, recalculations, inquiries, and/or walkthroughs with various department personnel. Using this information and input, we evaluate the level of risk and assess a risk score which is then used to develop an overall risk rating for the area based on the perceived effectiveness of the internal control environment. As part of these procedures, we will obtain copies of your most recent audited financial statements and related reporting and identify any risks that may be applicable to our risk assessment process. In addition, we will obtain and review current policies and procedures in evaluating the design of the control environment and related activities.

2

When assessing risk in a control environment, we consider four categories of risk which are defined below. Inherent Risk The nature of some activities or areas makes them a greater risk than others. Some characteristics that generally increase inherent risk are opportunity, complexity, changes in the operating environment, changes in personnel, and rapid growth. Inherent risk is a tool in determining the susceptibility of an entity, unit, or account to fraud, waste or abuse assuming there were no related internal controls. Control Risk This is the risk that material errors or fraud are not prevented or detected by the internal control system. Materiality This is an expression of relative significance or importance of a particular transaction class which can be based on factors such as dollar value or volume of transactions. Overall Risk This is the remaining and assigned risk level calculated after evaluating control risk, inherent risk and materiality. We will calculate an overall risk score at the entity level, using the considerations as defined later in this report, in the following key accounting areas: Revenue, Billings, Receivables, and Cash Receipts Federal and State Aid Expenditures, Expenses, Payables and Disbursements Human Resources Payroll

Transportation and Facilities Extraclassroom Activity Funds (ECA) Information Technology School Lunch Fund

Not all risks are created equal. Some are more likely than others to occur, and some will have a greater impact than others if they ultimately do occur. Additionally, the perception of risk is truly subjective and may not be viewed the same by all individuals. Once risks are identified, their probability and significance must be assessed. Upon identifying and assessing risk, your organization must decide how to address and reduce the risk to an acceptable level. Based on a cost/benefit analysis, in some cases, the Board's decision may be to implement additional controls or in some cases the Board may decide to accept the risk identified. Personnel Interviewed We interviewed several individuals in connection with our risk assessment update procedures. Our interviews were directed towards gaining a thorough understanding of the objectives and related risks in each of the internal control areas from the perspective of the individuals responsible for controlling such risks.

3

RISK SCORE SUMMARY Below is a risk score summary ranked by accounting area beginning with the area with highest risk score. Business Cycle Area Extraclassroom Activity Funds (ECA) School Lunch Expenditures, Expenses, Payables and Disbursements Information Technology Payroll and Human Resources Transportation Federal and State Aid Revenue, Billings, Receivables and Cash Receipts Building and Grounds Scoring Methodology Risk Level Low Moderate High

CY Risk Score PY Risk Score 14 15 14 13 14 10 13 11 11 14 11 11 11 11 10 12 9 9

Individual Area 1 2 3

Overall Score 1-11 12-20 21-27

We are pleased to report that the District does not have any categories identified as High Risk based on the current year risk assessment. In reviewing the ranking above, four of the current year areas fall into the moderate category and the remaining current year areas into the low category. Those in the moderate are generally in the low end of the range. On the following pages we have provided a historical table showing the areas audited, as well as our recommendations for the current and next year for your consideration. We also provide some suggested approaches to addressing the recommended areas for the current year.

4

HISTORICAL AUDIT AREAS The table below illustrates the historical audit areas for which testing has been performed. These priorities are reviewed annually with the Board or Audit Committee and readjusted accordingly. On the following page, we outline the proposed work plan for the current fiscal year, and provide some suggested procedures to accomplish the objectives. Business Cycle Area

2019-20 (Completed)

2020-21 (Completed)

2021-22 (Completed)

X

X

2022-23 (Completed)

2023-24 (Completed)

Revenues, Billings, Receivables and Cash Receipts Expenditures, Expenses, Payables and Disbursements Human Resources/Payroll Building and Grounds School Lunch Fund Information Technology

X

Extraclassroom

X

Transportation State and Federal Aid Special Education & Student Services

X

5

INTERNAL AUDIT WORK PLAN Below is a recommended Internal Audit Workplan. Fiscal Year 2024-2025 Business Office - Policies and Procedures Review During our review of the districts control environment, we noted through discussions with management that succession planning was a significant concern. In order to ensure that the business office is prepared for eventual turnover of staff and that all processes that are being performed are properly documented, we will examine all significant policies and procedures that are formalized in writing. We will give recommendations on current policies and procedures as well as recommendations on procedures that are either incomplete or not in writing. Estimated costs to complete - $10,000

6

Revenues, Billings, Receivables, and Cash Receipts Area of Consideration External Audit and Past Audit Considerations

CY Risk Score PY Risk Score 1

1

Financial Reporting (Internal Reporting, External Reporting, Budgeting)

1

2

Governance and Management

1

1

Design and Effectiveness of Control Environment and Control Activities

1

1

1

1

2

2

1 1 1

1 1 2

10

12

IT, Sensitivity of Information, and Access Vulnerability Materiality, Complexity and Transaction Volume Fraud Risk Environmental Risks Observation and Inquiry Risks SCORE

Risk Level None Low Moderate High

Comments/ Other Info

Scoring Methodology Individual Area 0 1 2 3

7

The bank reconciliation process, as noted during our walkthrough, includes proper review procedures that were updated from our prior year risk assessment.

This is a material area with significant transaction volume.

Prior year recommendation addressed

Overall Score 0 1-11 12-20 21-27

Expenditures, Expenses, Payables and Disbursements Area of Consideration

CY Risk Score PY Risk Score

Comments/ Other Info The District had a deficiency in internal controls related to purchase contracts of other municipalities and no formal procedure to verify that contracts meet all District prerequisites.

External Audit and Past Audit Considerations

2

1

Financial Reporting (Internal Reporting, External Reporting, Budgeting)

1

1

Governance and Management

2

1

District's purchasing agent is set to retire in current school year.

1

Based on walkthrough of internal controls over cash disbursements, controls appear to be operating effectively.

Design and Effectiveness of Control Environment and Control Activities

IT, Sensitivity of Information, and Access Vulnerability Materiality, Complexity and Transaction Volume Fraud Risk Environmental Risks Observation and Inquiry Risks SCORE

Risk Level None Low Moderate High

1

2

1

2

2

1 1 2

1 1 1

14

10

Scoring Methodology Individual Area 0 1 2 3

Given heavy reliance on paper and manual processes, information is vulnerable and not backed up with the same level of sophistication. This is a material area with significant transaction volume.

See recommendations below

Overall Score 0 1-11 12-20 21-27

Human Resources & Payroll Area of Consideration

CY Risk Score PY Risk Score

External Audit and Past Audit Considerations

1

2

Financial Reporting (Internal Reporting, External Reporting, Budgeting)

1

2

Governance and Management

1

2

Design and Effectiveness of Control Environment and Control Activities

1

1

IT, Sensitivity of Information, and Access Vulnerability

2

2

1

1

1 1 2

1 1 2

11

14

Materiality, Complexity and Transaction Volume Fraud Risk Environmental Risks Observation and Inquiry Risks SCORE

Risk Level None Low Moderate High

Scoring Methodology Individual Area 0 1 2 3

Comments/ Other Info The District adequately addressed the 20222023 deficiency in internal controls related to the submission of IRS Filings in a timely manner. Prior year deficiency addressed, as noted above. Consistency in HR and Payroll staffing has improved. Based on walkthrough of internal controls over payroll, controls appear to be operating effectively. Given heavy reliance on paper and manual processes, information is vulnerable and not backed up with the same level of sophistication.

See recommendations below

Overall Score 0 1-11 12-20 21-27

9

School Lunch Fund Area of Consideration

CY Risk Score PY Risk Score

Comments/ Other Info The District has addressed the deficiencies in internal controls regarding the school lunch fund balance and the average threemonth expenditure requirement.

External Audit and Past Audit Considerations

1

2

Financial Reporting (Internal Reporting, External Reporting, Budgeting)

1

1

Governance and Management

2

1

District has two co-directors overseeing food services, who are new to their roles. The District personally handles and transports cash from the various schools to a central location for counting.

Design and Effectiveness of Control Environment and Control Activities

2

2

IT, Sensitivity of Information, and Access Vulnerability

1

1

Materiality, Complexity and Transaction Volume

2

2

Fraud Risk

1

1

Environmental Risks

2

1

Observation and Inquiry Risks

2

2

SCORE

14

13

Risk Level None Low Moderate High

Scoring Methodology Individual Area 0 1 2 3

The District received various State and Federal funding and has multiple locations, which adds complexity and a risk to overall controls over inventory. The District is challenged with staffing shortages and they are currently understaffed. The District's greenhouse requires a lot of upkeep, and staffing challenges makes this difficult.

Overall Score 0 1-11 12-20 21-27

Building and Grounds Area of Consideration External Audit and Past Audit Considerations Financial Reporting (Internal Reporting, External Reporting, Budgeting) Governance and Management Design and Effectiveness of Control Environment and Control Activities IT, Sensitivity of Information, and Access Vulnerability Materiality, Complexity and Transaction Volume Fraud Risk Environmental Risks Observation and Inquiry Risks SCORE

Risk Level None Low Moderate High

CY Risk Score PY Risk Score 1

1

1

1

1

1

1

1

1

1

1

1

1 1 1

1 1 1

9

9

Scoring Methodology Individual Area 0 1 2 3

11

Comments/ Other Info

Overall Score 0 1-11 12-20 21-27

Information Technology Area of Consideration External Audit and Past Audit Considerations Financial Reporting (Internal Reporting, External Reporting, Budgeting)

CY Risk Score PY Risk Score 1

1

1

1

Governance and Management

2

1

Design and Effectiveness of Control Environment and Control Activities

1

1

2

2

1

1

1

1

Environmental Risks

2

2

Observation and Inquiry Risks

2

1

SCORE

13

11

IT, Sensitivity of Information, and Access Vulnerability Materiality, Complexity and Transaction Volume Fraud Risk

Risk Level None Low Moderate High

Scoring Methodology Individual Area 0 1 2 3

Comments/ Other Info

District communication between HR, business officials and IT can be improved for new hires and terminated employees.

Inherent risk related to IT services.

Ransomware is always a risk and has been occurring more often in the government space. See recommendations below

Overall Score 0 1-11 12-20 21-27

12

Extraclassroom Activity Funds (ECA) Area of Consideration

CY Risk Score PY Risk Score

External Audit and Past Audit Considerations

2

3

Financial Reporting (Internal Reporting, External Reporting, Budgeting)

2

2

Governance and Management

2

2

Design and Effectiveness of Control Environment and Control Activities

2

2

1

1

1

1

1 1 2

1 1 2

14

15

IT, Sensitivity of Information, and Access Vulnerability Materiality, Complexity and Transaction Volume Fraud Risk Environmental Risks Observation and Inquiry Risks SCORE

Risk Level None Low Moderate High

Scoring Methodology Individual Area 0 1 2 3

Comments/ Other Info Qualified Opinion for 2023-2024 audit. A number of clubs remain inactive. 20222023 recommendations were properly implemented. Consistency is an issue - The District does not have standard documentation, and handling of ECA funds may vary between schools. The District has two relatively new staff members handling ECA funds No formal training is provided to student treasurers or faculty advisors on the District's policies and procedures regarding ECA activity.

See recommendations below

Overall Score 0 1-11 12-20 21-27

13

Federal and State Aid Area of Consideration External Audit and Past Audit Considerations Financial Reporting (Internal Reporting, External Reporting, Budgeting) Governance and Management

CY Risk Score PY Risk Score 1

1

1

1

1

1

Design and Effectiveness of Control Environment and Control Activities

1

1

IT, Sensitivity of Information, and Access Vulnerability

1

1

Materiality, Complexity and Transaction Volume

3

3

Fraud Risk Environmental Risks Observation and Inquiry Risks

1 1 1

1 1 1

SCORE

11

11

Risk Level None Low Moderate High

Scoring Methodology Individual Area 0 1 2 3

14

Comments/ Other Info

Inherent risk related to the District receiving additional federal funding from new grants.

Overall Score 0 1-11 12-20 21-27

Transportation Area of Consideration External Audit and Past Audit Considerations Financial Reporting (Internal Reporting, External Reporting, Budgeting)

CY Risk Score PY Risk Score 1

1

1

1

Governance and Management

2

2

Design and Effectiveness of Control Environment and Control Activities

1

1

1

1

1

1

1

1

IT, Sensitivity of Information, and Access Vulnerability Materiality, Complexity and Transaction Volume Fraud Risk

Environmental Risks

2

2

Observation and Inquiry Risks

1

1

SCORE

11

11

Risk Level None Low Moderate High

Scoring Methodology Individual Area 0 1 2 3

15

Comments/ Other Info

Vacancies due to a shortage of employees. This will continue to be an issue for the forseeable future.

Statewide shortage of bus drivers, causing a significant impact on districts all over the United States. Working with Cornice regarding safety of electric bus mandates.

Overall Score 0 1-11 12-20 21-27

Definitions of Risk Assessment Considerations Area of Consideration External Audit and Past Audit Considerations Financial Reporting (Internal Reporting, External Reporting, Budgeting) Governance and Management Design and Effectiveness of Control Environment and Control Activities IT, Sensitivity of Information, and Access Vulnerability Materiality, Complexity and Transaction Volume Fraud Risk Environmental Risks Observation and Inquiry Risks

Definition Consideration is given to results of the external and internal audits performed in the current and prior years, as well as the auditee's response to those results. How does management approach the financial reporting process both internally and externally and how accurate and available is the information. In addition, are regulatory reporting requirements submitted timely and accurately. Construct, make-up and involvement of the Board and management from an oversight perspective. Experience of members of the Board and management are considerations in this area. Existence of policies and procedures as well as demonstration of tone at the top. The overall design, operation and effectiveness of the internal control structure, regardless of the personnel in place. What level of reliance on computerized controls versus manual controls is in place including whether any significant changes in controls have taken place. The complexity of the IT environment, including the software and hardware used in various financial reporting applications are considered. Additionally, the nature of data used and processed, as well as physical and digital access risks that may exist. The materiality, complexity and volume of transactions play a significant role in the assessment of risk related to the audit area. Areas of large volume, large dollar amounts and increased complexity will have a greater risk which are independent of any controls in place. Consideration of whether fraud has occurred in the past, or based on interviews and procedures if personnel feel there is a risk of fraud that exists. The design of controls to mitigate the risk of fraud are also key considerations. Tone at the top and the general environment of the entity are important factors here as These are risk factors that are in some ways outside of the control of the entity, such as political landscape, NYS Office of State Comptroller audits and focus areas, media reports, and similar items. Based on the results of all procedures including inquiry and observation, are there any additional areas of concern identified that would necessitate an additional risk rating.

16