Vertus Charter School - Thomas P. DiNapoli · The Vertus Charter School (School) is an educational...

19
D IVISION OF LOCAL GOVERNMENT & SCHOOL ACCOUNTABILITY O FFICE OF THE N EW Y ORK S TATE C OMPTROLLER Report of Examination Period Covered: July 1, 2014 – September 1, 2016 2016M-344 Vertus Charter School Conflict of Interest and Information Technology Thomas P. DiNapoli

Transcript of Vertus Charter School - Thomas P. DiNapoli · The Vertus Charter School (School) is an educational...

Division of LocaL Government & schooL accountabiLity

o f f i c e o f t h e n e w y o r k s t a t e c o m p t r o L L e r

report of ExaminationPeriod Covered:

July 1, 2014 – September 1, 2016

2016M-344

Vertus Charter SchoolConflict of Interest and Information Technology

thomas p. Dinapoli

Page

AUTHORITY LETTER 1

EXECUTIVE SUMMARY 2

INTRODUCTION 4 Background 4 Objectives 4 Scope and Methodology 5 CommentsofSchoolOfficialsandCorrectiveAction 5

CONFLICT OF INTEREST 6 Recommendation 8

INFORMATION TECHNOLOGY 9 UserAccess 9 AcceptableUse 10 BreachNotification 10 Data Backup 11 Disaster Recovery Plan 11 Recommendations 11 APPENDIX A ResponseFromSchoolOfficials 13APPENDIX B AuditMethodologyandStandards 15APPENDIX C HowtoObtainAdditionalCopiesoftheReport 16APPENDIX D LocalRegionalOfficeListing 17

Table of Contents

11Division of LocaL Government anD schooL accountabiLity

State of New YorkOffice of the State Comptroller

Division of Local Governmentand School Accountability December2016

DearSchoolOfficials:

AtoppriorityoftheOfficeoftheStateComptrolleristohelpcharterschoolofficialsmanageschoolfinancialoperations efficiently andeffectivelyand,by sodoing,provideaccountability formoneyspenttosupportschooloperations.TheComptrollerauditsthefinancialoperationsofcharterschoolsoutside of New York City to promote compliance with relevant statutes and observance of good businesspractices.ThisoversightidentifiesopportunitiesforimprovingschoolfinancialoperationsandBoardgovernance.Auditsalsocanidentifystrategiestoreducecostsandtostrengthencontrolsintended to safeguard school assets.

Followingisareportofourauditof thefinancialoperationsof theVertusCharterSchool,entitledConflict of Interest and InformationTechnology.This auditwas conducted pursuant toArticleV,Section 1 of the State Constitution and the State Comptroller’s authority as set forth in Section 2854 of theNewYorkStateEducationLaw,asamendedbyChapter56oftheLawsof2014.

This audit’s results and recommendations are resources for school officials to use in effectivelymanagingfinancialoperationsand inmeeting theexpectationsof the taxpayers, studentsand theirparents.Ifyouhavequestionsaboutthisreport,pleasefeelfreetocontactthelocalregionalofficeforyourcounty,aslistedattheendofthisreport.

Respectfullysubmitted,

Office of the State ComptrollerDivision of Local Governmentand School Accountability

State of New YorkOffice of the State Comptroller

2 Office Of the New YOrk State cOmptrOller2

Office of the State ComptrollerState of New York

EXECUTIVE SUMMARY

Acharterschool isapublicschoolfinancedby local,Stateandfederal resources that isnotunderthecontrolof the local schoolboardand isgovernedunderArticle56ofEducationLaw.Charterschoolsgenerallyhavefewerlegaloperationalrequirementsthantraditionalpublicschools.MostoftheregulationsforacharterschoolarecontainedinArticle56anditsbylaws,charteragreementandfiscalmanagementplans,aswellastheFinancial Oversight Handbook.1

TheVertusCharterSchool(School)isaneducationalcorporationthatoperatesasacharterschoolintheCityofRochesterinMonroeCounty.TheSchoolwasgrantedafive-yearcharterbytheBoardofRegentsoftheUniversityoftheStateofNewYorkinDecember2013.TheoversightforSchooloperationsisprovidedbytheBoardofTrustees(Board),whichiscomposedofsevenmembers.TheBoardisresponsibleforthegeneralmanagementandcontroloftheSchool’sfinancialandeducationalaffairs. The School’s chief executive officer (CEO), chief operating officer (COO) and BusinessManagerareresponsiblefortheDistrict’sday-to-daymanagementundertheBoard’sdirection.

TheSchooloperatesonebuildingwith130studentsingradesnineand10andhas41employees.TheSchoolendedthe2015-16fiscalyearwith$2.9millioninexpenses.TheSchool’s2016-17fiscalyearbudgetedexpensestotal$4.8million.Theseexpenseswillbefundedprimarilywithrevenuesderivedfrombillingtheareaschooldistrictsforresidentpupils(86percent)andfromcertainStateandfederalaidattributabletothesepupils(9percent).

Scope and Objectives

TheobjectivesofourauditweretoreviewtheSchool’sfinancialactivitiesforconflictsofinterestandtoassessthecontrolsoverinformationtechnology(IT)fortheperiodJuly1,2014throughSeptember1,2016.Ourauditaddressedthefollowingrelatedquestions:

• DidtheBoardensurethatSchoolofficialsandemployeesdidnothaveaprohibitedinterestinSchool contracts?

• DidSchoolofficialsproperlysafeguardSchoolITassets?

1 TheCharterSchoolsInstituteoftheStateUniversityofNewYork(SUNY)publishestheFinancial Oversight Handbook toprovideSUNY-authorizedcharterschoolsassistancewithnavigatingfinancialaccountability.TheCharterSchoolsInstitutewascreatedbytheSUNYTrusteestoassistthemincarryingouttheirresponsibilitiesofgrantingpublicschoolchartersundertheNewYorkStateCharterSchoolsActof1998.

33Division of LocaL Government anD schooL accountabiLity

Audit Results

TheBoarddidnotensurethatSchoolofficialsandemployeesdidnothaveaprohibitedinterestintheSchool’s contracts. We found that certain provisions of the School’s bylaws and code of ethics appear tobe inconsistentwith theSchool’s charter and theprovisionsofGeneralMunicipalLaw (GML)Article18madeapplicable tocharterschools.Wefound thatoneTrusteecouldpotentiallyhaveaprohibited interest pursuant to GML. The Trustee and the School entered into an agreement in the formofapromissorynoteinwhichtheTrusteelenttheSchool$40,000toassistwiththeSchool’sbudgetshortfalls.ThenoteistoberepaidonorbeforeMarch1,2017,andtheTrusteeistoreceiveintereston theunpaidportionof theprincipal sumat the rateof2percentperyear.However, theTrustee has not collected any of the interest owed on the promissory note. The Trustee has declined toaccepttheaccruedinterestfromthedateofinception,March1,2014,toJune30,2015duetotheSchool’sfinancialcondition.IftheTrusteedecidestocontinuetodeclinetheinterestontheunpaidportionoftheprincipalsumfortheremainderofthepromissorynoteterm,theTrusteewouldnothavea prohibited interest in the contract.

TheBoard and School officials have not implemented appropriate IT policies and procedures foruseraccounts,acceptableuse,breachnotificationanddatabackups.TheBoardalsohasnotadoptedadisasterrecoveryplan.Asaresult,ITassetsareatriskforunauthorized,inappropriateandwastefuluse,whichcouldcausetheSchooltohaveinterruptionsinITservices.

Comments of School Officials

TheresultsofourauditandrecommendationshavebeendiscussedwithSchoolofficials,andtheircomments,whichappearinAppendixA,havebeenconsideredinpreparingthisreport.Schoolofficialsgenerally agreed with our recommendations and indicated they plan to initiate corrective action.

4 Office Of the New YOrk State cOmptrOller4

Background

Introduction

Objectives

Acharterschoolisapublicschoolfinancedbylocal,Stateandfederalresources that is not under the control of the local school board. Charterschoolsgenerallyhavefewerlegaloperationalrequirementsthan traditional public schools. Most of the regulations for a charter school are included in Education LawArticle 56 and its bylaws,charteragreementandfiscal/financialmanagementplans,aswellasthe Financial Oversight Handbook.2Charterschoolsarerequiredtosetbothfinancialandacademicgoals,andaschool’srenewalofitscharter is dependent on meeting these goals. TheVertus Charter School (School) is an educational corporationthat operates as a charter school in the City of Rochester in Monroe County. The School was granted a five-year charter by the Boardof Regents of the University of the State of New York in December 2013.TheoversightforSchooloperationsisprovidedbytheBoardofTrustees(Board),whichiscomposedofsevenmembers.TheBoardis responsible for the general management and control of the School’s financialandeducationalaffairs.TheSchool’schiefexecutiveofficer(CEO), chief operating officer (COO) and Business Manager areresponsible for the District’s day-to-day management under theBoard’s direction.

TheSchooloperatesonebuildingwith130studentsingradesnineand10andhas41employees.TheSchoolendedthe2015-16fiscalyearwith$2.9millioninexpenses.TheSchool’s2016-17fiscalyearbudgetedexpensestotal$4.8million.3Theseexpenseswillbefundedprimarily with revenues derived from billing the area school districts forresidentpupils(86percent)andfromcertainStateandfederalaidattributabletothesepupils(9percent).

The objectives of our audit were to review the School’s financialactivities for conflicts of interest and to assess the controls overinformation technology (IT). Our audit addressed the followingrelatedquestions:

2 The Charter Schools Institute of the State University of NewYork (SUNY)publishes the Financial Oversight Handbook to provide SUNY-authorizedcharterschoolsassistancewithnavigatingfinancialaccountability.TheCharterSchoolsInstitutewascreatedbytheSUNYTrusteestoassistthemincarryingouttheir responsibilities of granting public school charters under the New York State CharterSchoolsAct(Act)of1998.

3 Expensesincreasedsignificantlyfrom2015-16to2016-17becausetheSchoolisin the process of adding one new grade each year.

55Division of LocaL Government anD schooL accountabiLity

Scope andMethodology

Comments ofSchool Officials andCorrective Action

• DidtheBoardensurethatSchoolofficialsandemployeesdidnot have a prohibited interest in School contracts?

• DidSchoolofficialsproperlysafeguardSchoolITassets?

WereviewedthecodeofethicsandbylawsastheyrelatetoconflictsofinterestandexaminedtheSchool’scontrolsoverITassetsfortheperiodJuly1,2014throughSeptember1,2016.

We conducted our audit in accordance with generally accepted governmentauditingstandards(GAGAS).Moreinformationonsuchstandards and the methodology used in performing this audit are includedinAppendixBofthisreport.Unlessotherwiseindicatedinthisreport,samplesfortestingwereselectedbasedonprofessionaljudgment,asitwasnottheintenttoprojecttheresultsontotheentirepopulation.Where applicable, information is presented concerningthe value and/or size of the relevant population and the sampleselectedforexamination.

The results of our audit and recommendations have been discussed withSchoolofficials,andtheircomments,whichappearinAppendixA, have been considered in preparing this report. School officialsgenerally agreed with our recommendations and indicated they plan to initiate corrective action.

The Board has the responsibility to initiate corrective action. We encourage the Board to prepare a plan of action that addresses the recommendations in this report and forward the plan to our officewithin90days.Formore informationonpreparingandfilingyourcorrectiveactionplan,pleaserefertoourbrochure,Responding to an OSC Audit Report, which you received with the draft audit report. We encourage the Board to make this plan available for public review in theSchoolBoardSecretary’soffice.

6 Office Of the New YOrk State cOmptrOller6

Conflict of Interest

EducationLaw,asofMay28,2010,providesthatcharterschoolsaresubjecttotheprovisionsofGeneralMunicipalLaw(GML)Article18, Sections 800 – 806 to the same extent such sections apply toschool districts.

In general, the provisions of GMLArticle 18 limit the ability ofmunicipal officers and employees, including school officers andemployees, to enter into contracts in which both their personalfinancialinterestsandtheirpublicpowersanddutiesconflict.Morespecifically,unlessastatutoryexceptionapplies,Article18prohibitsmunicipal officers and employees from having an “interest” in acontract with the municipality for which they serve when they also havethepowerorduty,eitherindividuallyorasaboardmember,tonegotiate,prepare,authorizeorapprovethecontract;toauthorizeorapprovepaymentunder thecontract; toauditbillsorclaimsunderthecontract;ortoappointanofficeroremployeewithanyofthosepowersorduties. For thispurpose, acontract includesanyclaim,account,demandagainstoragreementwithamunicipality,expressor implied.

Municipalofficersandemployeeshaveaninterestinacontractwhenthey receive a direct or indirect pecuniary (monetary) or materialbenefit as a result of a contract.Municipalofficers andemployeesarealsodeemedtohaveaninterestinthecontractsoftheirspouse,minor childrenanddependents (except employmentcontractswiththemunicipality); a firm, partnership or association ofwhich theyareamemberoremployee;andacorporationofwhichtheyareanofficer,directororemployee,ordirectlyorindirectlyownorcontrolanystock.Asarule,interestsinactualorproposedcontractsonthepartofamunicipalofficeroremployee,orhisorherspouse,mustbepubliclydisclosedinwritingtothemunicipalofficeroremployee’simmediate supervisor and to the governing board of the municipality. However,disclosure,abstentionorrecusaldonotcureaninterestinacontractotherwiseprohibitedbyGMLArticle18.4

We found that certain provisions of the School’s bylaws and code of ethics(Code)appeartobeinconsistentwiththeSchool’scharterandtheprovisionsofGMLArticle18madeapplicabletocharterschools.For example, the bylaws state, in part, that an “interested person”may enter into certain “transactions” when “amore advantageoustransaction or arrangement is not reasonably attainable under circumstancesthatwouldnotgiverisetoaconflictofinterest”andthe

4 See,e.g.,OpinionsoftheStateComptrollerNos.83-168and2000-7.

77Division of LocaL Government anD schooL accountabiLity

Board“determinesbyamajorityvoteofthedisinterestedTrustees”that the “transaction or arrangement is in the Corporation’s bestinterestandisfairandreasonabletotheCorporation.”However,theprovisionsofGMLArticle18applicabletotheSchool(Sections800–806)maystillresultinsuchatransactionconstitutingaprohibitedinterest under GML.5 The School’s charter provides that the bylaws shallnotconflictwithanytermofthecharterorwithapplicablelaw,including provisions of GML.6

There also appear to be certain inconsistencies between the School’s CodeandtheSchool’scharterandtheprovisionsofGMLArticle18madeapplicabletocharterschools.Forexample,thecharterstates,in part, that the School and its Trustees, officers and employeesshallabidebytheSchool’sCode,whichmustbeconsistentwiththeprovisionsofGMLSections800through806asmadeapplicablebytheAct.7WealsofoundthattheCodeacknowledgesthattheconflictof interest provisions of GML are applicable to charter schools to the sameextent thoseprovisions are applicable to school districts.AllTrustees,officersandemployeesshallcomplywithsuchlaws.8 However,theCodeappearstosuggestthatBoardmembers,providedtheydisclose(writtenororally)totheBoard,mayhaveaninterestincertain transactions. This could be read to suggest that the transactions discussed in this section may be authorized, even if prohibitedpursuanttoGMLSections800through806.

Finally,wenotethatitisuncleariftheCodeaddressescertainrequiredprovisionsofGMLSection806relatingtodisclosureofinterestinlegislationbeforethelocalgoverningbody,holdingofinvestmentsinconflictwithofficialduties,privateemployment inconflictwithofficialdutiesandfutureemployment.

WeidentifiedatransactioninwhichoneTrusteecouldpotentiallyhavea prohibited interest pursuant to GML. Entering into this transaction may have occurred as a result of the School not having clear guidance astotheapplicabilityofGMLSections800through806.

The School entered into an agreement in the form of a promissory notewithaTrusteetolendtheSchool$40,000,apparentlytoassist

5 We note that the bylaws state that this policy is intended to supplement but notreplaceanyapplicableStatelawsgoverningconflictsofinterestapplicableto nonprofit and charitable corporations. In our view, it is not clear from thislanguage that the drafters intended this sentence to include the provisions of GMLArticle18madeapplicabletocharterschools.Inanyevent,thelanguagesetforthinthebylawsappearsinconsistentwithprovisionsofGMLArticle18made applicable to charter schools.

6 Seechartersection2.13(c).7 See charter section 2.11.8 Seecodeofethicssection4(a).

8 Office Of the New YOrk State cOmptrOller8

with the School’s budget shortfalls. The note is to be repaid on or beforeMarch1,2017.Inexchange,theTrusteeistoreceiveintereston the unpaid portion of the principal sum at the rate of 2 percent per year.

The promissory note between the School and Trustee is an agreement and, therefore, isa“contract”forpurposesofGMLArticle18.Onthefaceofthedocument, theTrusteeappearstohavean“interest”in the contract because he is entitled to receive a direct pecuniary (monetary)benefitasaresultofthecontractintheformofinterestontheunpaidbalanceofthenote.AsamemberoftheBoard,thisindividual possesses one or more powers or duties that could give rise toaprohibitedinterest.Asnoneofthestatutoryexceptionsappeartoapply,theTrustee’sinterestinthecontractwouldbeprohibitedundertheprovisionsofGMLArticle18applicabletocharterschools.

However,theTrusteehasyettocollectanyoftheinterestowedonthepromissorynote.Instead,hehasdeclinedtoaccepttheaccruedinterestfromthedateofinception,March1,2014,toJune30,2015.In a discussionwith theTrustee, he stated that initiallyhedidnotintendtoforgivetheinterestonthenote.However,heunderstandstheSchool’sfinancialconditionandwill likelycontinue to forgivetheinterest.IftheTrusteedecidestocontinuetodeclinetheintereston the unpaid portion of the principal sum for the remainder of the promissorynoteterm,werecognizethattheTrusteewouldnoteveractuallyreceiveadirectorindirectpecuniary(monetary)benefitasa result of the contract.Therefore, theTrusteewould not have aninterestinthecontractprohibitedbyGMLArticle18.However,theSchool and Trustee should not have entered into a contract with the potentialforaconflictofinterest.

1. TheBoardandSchoolofficialsshouldconsultwiththeSchool’slegal counsel to address the apparent inconsistencies between the School’s bylaws and Code and its charter and the application of GMLSections800through806.

Recommendation

99Division of LocaL Government anD schooL accountabiLity

Information Technology

The School relies on its IT system for performing a variety oftasks, including accessing the Internet, storing data, using emailcommunicationand recordingfinancial transactions.Therefore, theSchool’sITsystemandthedataitholdsarevaluableresourcesthatneedtobeprotectedfromunauthorized,inappropriateandwastefuluse.EvensmalldisruptionsinITsystemscanrequireextensivetimeandefforttoevaluateandrepair.TheBoardandSchoolofficialsareresponsible for designing and implementing policies and procedures tomitigate these risks.Protecting ITassets is especially importantas the number of instances of people with malicious intent trying to harmcomputernetworksorgainunauthorizedaccesstoinformationthrough the use of viruses, malware and other types of attackscontinues to rise.

TheBoard and School officials have not implemented appropriateITpoliciesandproceduresrelatedtouseraccounts,acceptableuse,breachnotificationordatabackups.Additionally,theBoardhasnotadoptedadisasterrecoveryplan.Consequently,ITassetsareatriskfor unauthorized, inappropriate and wasteful use, and the Schoolcould encounter an interruption in services.

Effective access controls require the user accounts be linked tospecificindividualstohelppreventanddetectunauthorizedactivity.Users should not be allowed to share accounts.

We found that two employees, the Business Manager and theOperations Assistant, share a user account for an online vendor.Furthermore,theCOO’sSchool-issueddebitcardinformationissavedinthisvendor’saccountprofile.AlthoughtheBusinessManagerdoesnot make purchases for the School and only uses the account access to review purchases, the account does not have restricted use andcould be used to make unapproved purchases. Because the account issharedby two individuals,Schoolofficialswouldnotbeable tohold one person accountable for any inappropriate purchases. The Business Manager is also responsible for entering these transactions into the School’s accounting records.Therefore, any inappropriatetransactionscouldgoundetected.Furthermore,bystoringtheCOO’sdebitcardinformationonthewebsite,theSchool’sbankaccountisalso vulnerable to outside hackers who could obtain the School’s debit card information. This practice is also in violation of the School’s credit/debitcardpolicy.

User Access

10 Office Of the New YOrk State cOmptrOller10

Because of this practice, we reviewed 21 purchases made to thisvendor.Whilewefoundthatall21purchasestotaling$6,265wereappropriateandhadsupportingdocumentation,eightofthepurchasestotaling $450 did not have proper approval prior to purchase.Additionally,twoofthepurchasestotaling$1,160wereforgiftcardsthatareusedtorewardstudentsforvariousachievements.AlthoughSchoolofficialswereabletoprovideuswithapprovalandsupportingdocumentationforthegiftcardpurchases,wewereunabletotracethegiftcardreceipttotheintendedstudentsduetoinsufficientrecords.Given the loose controls over user access to this online vendor and thelackofaccountabilityovergiftcards,theSchoolisatanincreasedrisk of fraud and abuse.

Anacceptableusepolicydescribeswhatconstitutesappropriateandinappropriate use of resources, expectations concerning personaluseoftheSchool’scomputers,expectationsconcerningprivacyandconsequences forpolicyviolations.Thepolicy shouldaddress,butnotnecessarilybelimitedto,theacceptableuseoftheInternetandemail,passwordsecurity,accesstoanduseofconfidentialinformationand the installation and maintenance of software on School owned equipment.

While School officials have implemented and disseminated anadequate acceptable use policy for students, a similar policy thataddressesthetermsandconditionsofnetwork,Internetandemailusefor staff has not been established. By failing to adopt a policy that sets thestandardsandexpectationsfortheresponsibleuseoftheSchool’scomputerresourcestothestaff,theBoardisincreasingtheriskthatresources could be misused or that data could be lost or corrupted.

New York State Technology Law requires local governments toestablish an information breach notification policy. While schooldistrictsarenotsubjecttothislaw,itisstillintheSchool’sbestinterestto adopt and implement such a policy. The policy should detail how officialswouldnotifyresidentswhoseprivateinformationwas,orisreasonablybelievedtohavebeen,acquiredbyapersonwithoutvalidauthorization.Thedisclosureshouldbemadeinthemostexpedienttime possible and without unreasonable delay, consistent with thelegitimate needs of law enforcement and any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.

TheBoardhasnotadoptedabreachnotificationpolicy.Asaresult,intheeventthatprivateinformationiscompromised,Schoolofficialsand employees may not be prepared to properly notify affected individuals.

Acceptable Use

Breach Notification

1111Division of LocaL Government anD schooL accountabiLity

Abackupisacopyofelectronicinformationthatismaintainedforuse if there is loss or damage to the original. Policies and procedures outliningthedataback-upprocessshouldincludehowoftenbackupsaretobeperformed,theprocessforverifyingdatahasbeenproperlybacked up, information on storing the back-up media in a securelocationandverifyingtheabilitytorestoretheback-updata.

TheSchooldoesnothavewrittenback-upprocedures.IftheSchool’sIT system was compromised, the School could lose essentialinformation,includingstudentrecords,whichmaynotberecoverable.TheSchoolalsocould incurexpensesforsystemrestorationorforequipmentrepairorreplacement.

AsystemofstrongITcontrolsincludesadisasterrecoveryplanthatdescribeshowanorganizationwill dealwithpotential disasters.Adisaster could be any sudden, unplanned catastrophic event, suchasafire,flood,computervirus,vandalismorinadvertentemployeeactionthatcompromisestheintegrityofthedataandtheITsystems.Contingency planning to prevent loss of computer equipment anddata and the procedures for recovery in the event of an actual loss are crucialtoanorganization.Theplanneedstoaddresstherolesofkeyindividualsandincludeprecautionstobetakentominimizetheeffectsofadisastersoofficialswillbeabletomaintainorquicklyresumeday-to-dayoperations.Inaddition,disasterrecoveryplanninginvolvesananalysis of continuity needs and threats to business processes and mayincludeasignificantfocusondisasterprevention.Itisimportantfor School officials to distribute the plan to all responsible partiesand to periodically test and update the plan to address changes in the School’sITsecurityrequirements.

School officials have not developed a disaster recovery plan.Consequently, in the event of a disaster, School employees donothaveadequateguidancetofollowtorestoredataorresumecriticaloperations in a timely manner. The lack of an adequate disasterrecoveryplancouldleadtolossofimportantfinancialandconfidentialdata,inadditiontoseriousinterruptionoftheSchool’soperations.

TheBoardandSchoolofficialsshould:

2. Adopt comprehensive policies governing the School’s IToperationsincluding,butnotlimitedto,useraccess,acceptableuseandbreachnotification.

3. Ensure that vendor account access is appropriately limitedand that proper internal controls are in place to prevent or detect inappropriate use.

Data Backup

Disaster Recovery Plan

Recommendations

12 Office Of the New YOrk State cOmptrOller12

4. Developdataback-upprocedures requiringSchoolofficialstoperiodicallytesttheback-upfilestoensurethatthedatacanbe fully restored.

5. Develop a formal disaster recovery plan that addresses the rangeofthreatstotheSchool’sITsystem,distributetheplantoall responsible parties and ensure that the plan is periodically tested and updated as needed.

1313Division of LocaL Government anD schooL accountabiLity

APPENDIX A

RESPONSE FROM SCHOOL OFFICIALS

TheSchoolofficials’responsetothisauditcanbefoundonthefollowingpage.

14 Office Of the New YOrk State cOmptrOller14

1515Division of LocaL Government anD schooL accountabiLity

APPENDIX B

AUDIT METHODOLOGY AND STANDARDS

Toachieveourauditobjectivesandobtainvalidevidence,weperformedthefollowingprocedures:

• WeinterviewedSchoolofficials,BoardmembersandITvendorstogainanunderstandingoftheSchool’sbusinessandIToperations.

• WereviewedtheSchool’spolicies,Code,bylaws,charter,Boardminutes,financialreportsandannual independent audit report.

• Weselectedajudgmentalsampleof10vendorclaimstoreviewbasedonapreliminaryreviewof the School’s bank statements. We reviewed the claims to determine if the purchases were properly approved, had supporting documentation and were appropriate purchases for theSchool.Wedeterminedthatitwasalsonecessarytotestadditionalpurchasesfromonespecificvendor.Therefore,werandomlyselectedthemonthsofSeptember2015andMay2016.Wereviewed the supporting documentation for every other purchase from this vendor in each month(startingwiththesecond)basedonthebankstatementsforthesemonths.

• WereviewedconflictofinterestdisclosuresforallBoardmembersandkeySchoolofficials.

• We reviewed the loan agreement and supplementary agreements between the Trustee and the Schoolfora$40,000loanissuedbytheTrustee.

WeconductedthisperformanceauditinaccordancewithGAGAS.Thosestandardsrequirethatweplanandperformtheaudittoobtainsufficient,appropriateevidencetoprovideareasonablebasisforourfindingsandconclusionsbasedonourauditobjectives.Webelieve that theevidenceobtainedprovidesareasonablebasisforourfindingsandconclusionsbasedonourauditobjectives.

16 Office Of the New YOrk State cOmptrOller16

APPENDIX C

HOW TO OBTAIN ADDITIONAL COPIES OF THE REPORT

OfficeoftheStateComptrollerPublicInformationOffice110StateStreet,15thFloorAlbany,NewYork12236(518)474-4015http://www.osc.state.ny.us/localgov/

Toobtaincopiesofthisreport,writeorvisitourwebpage:

1717Division of LocaL Government anD schooL accountabiLity

APPENDIX DOFFICE OF THE STATE COMPTROLLER

DIVISION OF LOCAL GOVERNMENTAND SCHOOL ACCOUNTABILITYAndrewA.SanFilippo,ExecutiveDeputyComptroller

GabrielF.Deyo,DeputyComptrollerTraceyHitchenBoyd,AssistantComptroller

LOCAL REGIONAL OFFICE LISTING

BINGHAMTON REGIONAL OFFICEH.ToddEames,ChiefExaminerOfficeoftheStateComptrollerStateOfficeBuilding,Suite170244 Hawley StreetBinghamton,NewYork13901-4417(607)721-8306Fax(607)721-8313Email:[email protected]

Serving:Broome,Chenango,Cortland,Delaware,Otsego,Schoharie,Sullivan,Tioga,TompkinsCounties

BUFFALO REGIONAL OFFICEJeffreyD.Mazula,ChiefExaminerOfficeoftheStateComptroller295MainStreet,Suite1032Buffalo,NewYork14203-2510(716)847-3647Fax(716)847-3643Email:[email protected]

Serving:Allegany,Cattaraugus,Chautauqua,Erie,Genesee,Niagara,Orleans,WyomingCounties

GLENS FALLS REGIONAL OFFICEJeffreyP.Leonard,ChiefExaminerOfficeoftheStateComptrollerOneBroadStreetPlazaGlensFalls,NewYork12801-4396(518)793-0057Fax(518)793-5797Email:[email protected]

Serving:Albany,Clinton,Essex,Franklin,Fulton,Hamilton,Montgomery,Rensselaer,Saratoga,Schenectady,Warren,WashingtonCounties

HAUPPAUGE REGIONAL OFFICEIraMcCracken,ChiefExaminerOfficeoftheStateComptrollerNYSOfficeBuilding,Room3A10250VeteransMemorialHighwayHauppauge,NewYork11788-5533(631)952-6534Fax(631)952-6530Email:[email protected]

Serving:NassauandSuffolkCounties

NEWBURGH REGIONAL OFFICETennehBlamah,ChiefExaminerOfficeoftheStateComptroller33AirportCenterDrive,Suite103NewWindsor,NewYork12553-4725(845)567-0858Fax(845)567-0080Email:[email protected]

Serving:Columbia,Dutchess,Greene,Orange,Putnam,Rockland,Ulster,WestchesterCounties

ROCHESTER REGIONAL OFFICEEdwardV.Grant,Jr.,ChiefExaminerOfficeoftheStateComptrollerThe Powers Building16WestMainStreet,Suite522Rochester,NewYork14614-1608(585)454-2460Fax(585)454-3545Email:[email protected]

Serving:Cayuga,Chemung,Livingston,Monroe,Ontario,Schuyler,Seneca,Steuben,Wayne,YatesCounties

SYRACUSE REGIONAL OFFICERebeccaWilcox,ChiefExaminerOfficeoftheStateComptrollerStateOfficeBuilding,Room409333E.WashingtonStreetSyracuse,NewYork13202-1428(315)428-4192Fax(315)426-2119Email:[email protected]

Serving:Herkimer,Jefferson,Lewis,Madison,Oneida,Onondaga,Oswego,St.LawrenceCounties

STATEWIDE AUDITSAnnC.Singer,ChiefExaminerStateOfficeBuilding,Suite170244 Hawley Street Binghamton,NewYork13901-4417(607)721-8306Fax(607)721-8313