Fla. Auditor General Issues Operational Audit on Union County District School Board
Here are excerpts:
* * *
SUMMARY
This operational audit of the
Finding 1: Although required by State law, Board policies did not require searches of prospective school volunteer names against the National Sexual Offender Public Web site.
Finding 2: The District did not comply with State law by timely and prominently posting on its Web site the required proposed, tentative, and final budget information for the 2022-23 fiscal year. A similar finding was noted in our report No. 2021-040.
Finding 3: The District did not annually test the Board-approved information technology (IT) disaster recovery plan and alternate site agreement by accessing and running critical applications and processes from an alternate site.
Finding 4: The District needs to establish a comprehensive IT risk assessment to provide a documented basis for managing IT risks.
BACKGROUND
* * *
FINDINGS AND RECOMMENDATIONS
Finding 1:
State law/1 requires, before making any decision to appoint a person to work as a volunteer where children regularly congregate, a search of that person's name or other identifying information be conducted against the registration information regarding sexual predators and sexual offenders through the Dru Sjodin National Sexual Offender Public Web site (NSOPW) maintained by the
* * *
1 Section 943.04351, Florida Statutes.
* * *
also provides that the search does not apply to positions or appointments for which a level 2 background screening is conducted.
Pursuant to Board policies,/2 school volunteers are required to complete a volunteer application and submit to a Statewide criminal and FDLE sexual offender registry search, and volunteers whose work will entail being left alone with a student are required to undergo a level 2 background screening./3 However, Board policies did not require searches of volunteer names or other identifying information be conducted against NSOPW information.
Although FDLE registry searches provide some assurances, the data in the FDLE registry is not as extensive as the national data provided by the NSOPW. In response to our inquiry, District personnel indicated that they were unaware of the requirement to complete a search against the NSOPW information for volunteer applicants. NSOPW searches would provide greater assurance as to the suitability of the backgrounds of individuals and are essential given the risks associated with allowing individuals access to places where children regularly congregate.
While the 112 volunteers who provided supervised student services during the 2022-23 school year were subjected to the FDLE registry search, a search of the individual's name or other identifying information was not conducted against the NSOPW information. As part of our audit, we performed a search of the names for 30 of the 112 volunteers against the NSOPW database and none of the 30 volunteers were listed as a sexual predator or sexual offender. However, our procedures cannot substitute for management's responsibility to establish appropriate controls over student safety. Absent such controls, there is an increased risk that volunteers with unsuitable backgrounds may have direct contact with students.
Recommendation: For those school volunteers not subjected to level 2 background screenings, the District should take immediate action to properly search pursuant to State law the individual's name and make appropriate decisions based on the search results. In addition, Board policies should be revised to require that, before making a decision to appoint a person who has not obtained a level 2 background screening to work as a volunteer where children regularly congregate, a search of that person's name or other identifying information be conducted against the NSOPW information and records be maintained to evidence the results of the search.
Finding 2: Fiscal Transparency
To promote responsible spending, more citizen involvement, and improved accountability, it is important for the District to provide easy access to its budget and related information. Pursuant to State law,/4 the District must post on its Web site graphical representations, for each public school within the District and for the District, of summary financial efficiency data and fiscal trend information for the previous 3 years, and the Web site must also include a link to the Web-based fiscal transparency tool developed by the FDOE pursuant to State law./5 The District is also required to post on its Web site a plain language version
* * *
2/ Board Policy 3.13,
3/ A level 2 background screening includes fingerprinting for Statewide criminal history records checks through the FDLE and national criminal history records checks through the
4/ Section 1011.035(2), Florida Statutes.
5/ Section 1010.20, Florida Statutes.
* * *
of each proposed, tentative, and official budget that describes each budget item in terms that are easily understandable to the public.
At the time of our review in
Subsequent to our inquiries, the official 2022-23 fiscal year budget was posted in
Recommendation: The District should continue efforts to comply with statutory transparency requirements by timely posting all required information on the District Web site.
Finding 3: Information Technology Disaster Recovery Plan
An important element of an effective internal control system over information technology (IT) operations is a disaster recovery plan to help minimize data and asset loss in the event of a major hardware or software failure. A disaster recovery plan should identify key recovery personnel and critical applications, provide for backups of critical data sets, and provide a step-by-step plan for recovery. In addition, plan elements should be tested periodically to disclose any areas not addressed and to facilitate proper conduct in an actual disruption of IT operations.
The District obtains certain IT services, such as financial, payroll, and other critical applications from the
In response to our inquiry, District personnel indicated that testing had not occurred due to personnel changes. The lack of annual testing of the IT disaster recovery plan at an alternate site may hinder District efforts to minimize the impact of, and timely recover from, a disaster or disruption of operations.
Recommendation: The District should test the IT disaster recovery plan at an alternate site annually and document the evaluation of the test results.
* * *
6/ NEFEC is a regional, non-profit, educational service agency established to provide cooperative services to 15 small and rural member districts.
* * *
Finding 4: Information Technology Risk Assessment
Management of IT risks is a key part of enterprise IT governance. Incorporating an enterprise perspective into day-to-day governance actions helps entity personnel identify and understand the greatest security risk exposures and determine whether planned controls are appropriate and adequate to secure IT resources from unauthorized disclosure, modification, or destruction. A comprehensive IT risk assessment should consider specific threats and vulnerabilities, and the severity of such threats and vulnerabilities, at the Districtwide, system, and application levels and document the range of risks that District systems and data may be subject to, including those posed by internal and external users. IT risk assessments help support management's decisions in establishing cost-effective measures to mitigate risk and, where appropriate, formally accept residual risk.
In response to our inquiries, District personnel indicated that they had considered external and internal risks; however, due to the small size of the District and employee turnover, documentation was not maintained to evidence conduct of a comprehensive IT risk assessment. The absence of a comprehensive IT risk assessment may lessen the District's assurance that all likely threats and vulnerabilities have been identified, the most significant risks have been addressed, and appropriate decisions have been made regarding which risks to accept and which risks to mitigate through appropriate controls.
Recommendation: The District should conduct a comprehensive IT risk assessment to provide a documented basis for managing IT-related risks.
* * *
PRIOR AUDIT FOLLOW-UP
The District has taken corrective actions for findings included in our report No. 2021-040, except that Finding 2 was also noted in that report as Finding 1.
* * *
OBJECTIVES,
The Auditor General conducts operational audits of governmental entities to provide the Legislature,
We conducted this operational audit from
This operational audit focused on selected District processes and administrative activities. For those areas, our audit objectives were to:
* Evaluate management's performance in establishing and maintaining internal controls, including controls designed to prevent and detect fraud, waste, and abuse, and in administering assigned responsibilities in accordance with applicable laws, rules, regulations, contracts, grant agreements, and other guidelines.
* Examine internal controls designed and placed in operation to promote and encourage the achievement of management's control objectives in the categories of compliance, economic and efficient operations, reliability of records and reports, and safeguarding of assets, and identify weaknesses in those controls.
* Determine whether management had taken corrective actions for findings included in our report No. 2021-040.
* Identify statutory and fiscal changes that may be recommended to the Legislature pursuant to Section 11.45(7)(h), Florida Statutes.
This audit was designed to identify, for those areas included within the scope of the audit, weaknesses in management's internal controls significant to our audit objectives; instances of noncompliance with applicable laws, rules, regulations, contracts, grant agreements, and other guidelines; and instances of inefficient or ineffective operational policies, procedures, or practices. The focus of this audit was to identify problems so that they may be corrected in such a way as to improve government accountability and efficiency and the stewardship of management. Professional judgment has been used in determining significance and audit risk and in selecting the particular transactions, legal compliance matters, records, and controls considered.
As described in more detail below, for those programs, activities, and functions included within the scope of our audit, our audit work included, but was not limited to, communicating to management and those charged with governance the scope, objectives, timing, overall methodology, and reporting of our audit; obtaining an understanding of the program, activity, or function; identifying and evaluating internal controls significant to our audit objectives; exercising professional judgment in considering significance and audit risk in the design and execution of the research, interviews, tests, analyses, and other procedures included in the audit methodology; obtaining reasonable assurance of the overall sufficiency and appropriateness of the evidence gathered in support of our audit findings and conclusions; and reporting on the results of the audit as required by governing laws and auditing standards.
Our audit included the selection and examination of transactions and records, as well as events and conditions, occurring during the 2022-23 fiscal year audit period, and selected District actions taken prior and subsequent thereto. Unless otherwise indicated in this report, these records and transactions were not selected with the intent of statistically projecting the results, although we have presented for perspective, where practicable, information concerning relevant population value or size and quantifications relative to the items selected for examination.
An audit by its nature does not include a review of all records and actions of management, staff, and vendors, and as a consequence, cannot be relied upon to identify all instances of noncompliance, fraud, waste, abuse, or inefficiency.
In conducting our audit, we:
* Reviewed applicable laws, rules, Board policies, District procedures, and other guidelines, and interviewed District personnel to obtain an understanding of applicable processes and administrative activities and the related requirements.
* Reviewed Board information technology (IT) policies and District procedures to determine whether the policies and procedures addressed certain important IT control functions, such as security, logging and monitoring, and disaster recovery.
*
* 11 of the 29 user accounts with update access privileges to selected critical ERP system finance application functions.
* 6 of the 19 users accounts with update access privileges to selected critical ERP system HR application functions.
* The 2 accounts with systemwide access to the District application systems, datasets, and programs for the finance and HR applications.
* The 2 accounts with security access to the District application systems, datasets, and programs for the student application.
*
* Determined whether the District had a comprehensive IT disaster recovery plan in place that was designed properly, operating effectively, and had been recently tested.
* Examined selected application security settings to determine whether authentication controls were configured and enforced in accordance with IT best practices.
* Determined whether the District had established a comprehensive IT risk assessment to document the District's risk management and assessment processes and security controls intended to protect the confidentiality, integrity, and availability of data and IT resources.
* Inquired whether the District obtained and reviewed service organization controls (SOC) 1 Type 2 reports as described in Statement on Standards for Attestation Engagements No. 18, Attestation Standards: Clarification and Recodification.
* Inquired whether the District had expenditures or entered into any contracts under the authority granted by a state of emergency declared or renewed during the audit.
* Examined the District Web site to determine whether the 2022-23 fiscal year proposed, tentative, and official budgets were prominently posted pursuant to Section 1011.035(2), Florida Statutes. In addition, we determined whether the District Web site contained, for each public school within the District and for the District, the required graphical representations of summary financial efficiency data and fiscal trend information for the previous 3 years, and a link to the Web-based fiscal transparency tool developed by the
* From the expenditures totaling
*
*
* Examined copies of the most recent annual fire safety, casualty safety, and sanitation inspection reports to determine whether the District provided for periodic inspections of educational and ancillary facilities and timely action was taken to correct previously cited deficiencies.
* From the population of
*
* From the population of
* From the population of 148 diplomas issued during the audit period, examined documentation for 13 selected diploma recipients to determine whether the recipients met the applicable graduation requirements.
*
* Evaluated Board policies and District procedures addressing the ethical conduct of school personnel, including reporting responsibilities related to employee misconduct which affects the health, safety, or welfare of a student, and the investigation responsibilities for all reports of alleged misconduct to determine whether those policies and procedures were effective and sufficient to ensure compliance with Section 1001.42(6) and (7)(b)3., Florida Statutes, and SBE Rule 6A-10.084, Florida Administrative Code.
* Examined Board policies, District procedures, and related records supporting school volunteers for the audit period to determine whether the District searched prospective volunteers' names against the Dru Sjodin National Sexual Offender Public Web site maintained by the
* Evaluated Board policies and District procedures for periodic reconciliations of health insurance provider billings to District payroll records to determine whether Board contributions for health insurance premiums are for eligible participants and contributions and employee-paid premiums are consistent with the Board-approved amounts.
* From the population of payments for contracted services totaling
* The District complied with applicable competitive selection requirements (e.g., SBE Rule 6A-1.012, Florida Administrative Code).
* The contracts clearly specified deliverables, time frames, documentation requirements, and compensation.
* District records evidenced that services were satisfactorily received and conformed to contract terms before payment.
* The payments complied with contract provisions.
* From the compensation payments totaling
* Determined whether non-compensation expenditures were reasonable, correctly recorded, adequately documented, for a valid District purpose, properly authorized and approved, and in compliance with applicable State laws, SBE rules, contract terms and Board policies; and applicable vendors were properly selected. Specifically, from the population of non-compensation expenditures totaling
* For the one significant construction project with a contract totaling
* Reviewed Board policies and District procedures related to identifying potential conflicts of interest. For the 5 District officials, the Superintendent, and the Director of Finance we reviewed
* Communicated on an interim basis with applicable officials to ensure the timely resolution of issues involving controls and noncompliance.
* Performed various other auditing procedures, including analytical procedures, as necessary, to accomplish the objectives of the audit.
* Prepared and submitted for management response the findings and recommendations that are included in this report and which describe the matters requiring corrective actions. Management's response is included in this report under the heading MANAGEMENT'S RESPONSE.
* * *
7/ The District had not incurred any project-related expenditures as of
* * *
AUTHORITY
Section 11.45, Florida Statutes, requires that the Auditor General conduct an operational audit of each school district on a periodic basis. Pursuant to the provisions of Section 11.45, Florida Statutes, I have directed that this report be prepared to present the results of our operational audit.
Auditor General
* * *
The report is posted at https://flauditor.gov/pages/pdf_files/2024-095.pdf.
Oregon Health & Science University: Medicaid Coverage of Physical, Behavioral Health Together Does Not Improve Access, Care
UNIQA Green Bond Report 2023
Advisor News
- House panel votes to raise certain taxes, transfer money to offset Medicaid shortfall
- Iowa House backs temporary tax hike to fill Medicaid gap
- Iowa Medicaid temporary tax plan draws sharp public opposition
- Charitable giving planning can strengthen advisor/client relationships
- New $6K deduction could provide tax planning window for retirees
More Advisor NewsAnnuity News
- We can help find a loved one’s life insurance policy
- 2025: A record-breaking year for annuity sales via banks and BDs
- Lincoln Financial launches two new FIAs
- Great-West Life & Annuity Insurance Company trademark request filed
- The forces shaping life and annuities in 2026
More Annuity NewsHealth/Employee Benefits News
- CT leaders debate how to fix health care: Blunt federal cuts, up reimbursement or kill private health care?
- When health insurance costs $2,500 per month, families make tough choices
- In U.S. Health Insurance Market, Consolidation Of Insurers Is Increasing Premiums
- Health insurance jargon can be frustrating and confusing – here's how to navigate it
- Minnesota Blue Cross CEO steps down from Sutter Health board over conflict of interest
More Health/Employee Benefits NewsLife Insurance News
- Murray Giles Hulse
- New individual life premium hits record-setting $17.5B in 2025
- Maryland orders Cigna to halt underpaying doctors or give cause
- Insurers optimistic about their investments in 2026
- AM Best Affirms Credit Ratings of PVI Insurance Corporation
More Life Insurance News