Internal controls are a vital component of any financially healthy organization, and public school districts are no exception. In New York, the Office of the State Comptroller (OSC) has increased testing of school districts’ controls after it uncovered an $11.2 million fraud at the Roslyn School District on Long Island in 2004. The education sector represented 6% of all fraud cases reported in the 2016 Association of Certified Fraud Examiners (ACFE) Report to the Nations on Occupational Fraud and Abuse (http://bit.ly/2n6YKMp). School districts are often small organizations with large expenditures but few controls in place, making them highly susceptible to fraud.
The OSC audited each of the 733 school districts in New York State over the five years following the Roslyn fraud and in 2010 reported many successful improvements in control and tax dollar savings. Since then, the office has audited approximately 100 school districts, Boards of Cooperative Educational Services (BOCES), and charter schools per year. This article analyzes 287 OSC audits of New York school districts’ internal controls completed between 2013 and 2015. These are not traditional financial statement audits, but directed investigations of selected areas of internal controls. The authors found that 14% of districts in the sample received no recommendations for improvements in controls, compared with more than 5% of all districts audited by the OSC in the five years following Roslyn (“Making the Grade: Five Years of School District Accountability,” 2009, http://bit.ly/2lZyCBe). Although this is a sign of improvement, many instances of costly control deficiencies are still cited in recent audits.
The results of the OSC control audits are of interest to CPAs in New York and beyond who conduct financial statement audits of school districts and other local government entities. Awareness of common control deficiencies may help school district auditors with risk assessment and planning. School audits may have been considered lower risk before the Roslyn fraud, but regional firms conducting district financial audits still need to pay close attention to internal control issues in order to protect their reputations and help school districts avoid potentially expensive control weaknesses. For example, the audit firm responsible for auditing 40% of all Long Island school districts, including Roslyn, went out of business shortly after the comptroller revealed that substandard audit work contributed to the successful embezzlement of $11 million (Faiza Akhtar, “After the Roslyn Mess, Who Audits Schools?” New York Times, June 19, 2005, http://nyti.ms/2lZmxw4).
Examples of Costly Control Deficiencies
While not every missing or malfunctioning control results in a financial loss or misstatement, many of the audits revealed mistakes that proved costly for the school districts examined. Between 2011 and 2016, the OSC uncovered the following losses resulting from weak controls that opened the door to fraud, errors, or waste (reports available at http://www.osc.state.ny.us/audits/):
- The Ripley Central School District underbilled a neighboring district and an additional nonresident student for a total of $55,563 due to a failure to adjust for enrollment changes (2016).
- Auditors found that Mount Pleasant–Blythesdale Union Free School District issued an unnecessary revenue anticipation note and could have saved $43,270 in interest payments (2016).
- In Hamilton Central School District, auditors discovered the school lunch fund had been losing $95,000 per year due to selling meals below cost, causing the fund to show a deficit of $193,766 (2015).
- In Forestville Central School District, auditors concluded that omitted analyses of bus routes could potentially have saved approximately $460,500 over the next two years and $36,500 annually thereafter (2014).
- In Norwich City School District, unpaid school lunch balances totaled $36,000 over a 16-month period, adjustments were made to accounts without approval, and voids made by food service employees were not reviewed or approved (2013).
- In Watervliet City School District, an examination of payroll revealed that a former superintendent was overpaid by $11,083 at retirement for vacation days to which he was not entitled, and a former employee was entitled to an additional $13,773 at retirement for unused sick days (2011).
- In Cortland Enlarged City School District, district officials failed to ensure that business office staff were billing for various reimbursements due to the district, resulting in at least $52,000 in lost reimbursement revenues (2011).
In addition to these costly examples, basic controls were lacking in many cases, including the absence of an audit committee, the absence of a disaster recovery plan for information systems, a lack of purchasing procedures to ensure competitive bids, and a lack of segregation of duties in various areas. Many districts were also cited for inappropriately high reserve balances, underestimation of expenses, and other poor budgeting outcomes that resulted in either an excess collection of real property taxes from residents or dangerously low levels of reserve funds. For example, the Medina Central School District underestimated revenues and overestimated expenditures by approximately $14.7 million over a period of five years. Finally, auditors noted that several districts failed to implement recommendations from prior audits.
Risk of Fraud in Public Education
The Roslyn School District fraud, mentioned above, involved the misuse and misappropriation of funds in excess of $11 million by 29 individuals in the district for over eight years. The Roslyn case represents a perfect example of how deficiencies in internal controls can have terrible consequences. The illusion of controls allowed fraud to run rampant through the district and ultimately led to extensive, statewide school auditing by the OSC. There is a growing call for improved internal controls in schools outside New York State as well; the American School Board Journal and others have published guidelines and suggestions to help school districts improve controls.
The Roslyn case shows that the public sector, particularly school systems, represents a high risk for major fraud. According to the 2015 ACFE Report, over half of all fraud occurs in organizations with fewer than 1,000 employees, and more than 15% of cases occurred in the government or education sectors. School systems, especially small ones, do not have the same level of internal controls or governance structure as large companies. Vulnerability to fraud in this sector makes a study of internal control failures useful to school districts hoping to improve controls and prevent fraud and waste.
The New York State School System and Comptroller Audit Process
School districts make up a significant portion of the New York economy, with 2016 budgeted expenditures of $95 billion. In the years studied, there were 732 school districts and 295 charter schools across the 62 counties of New York. Within these schools, staff and faculty served a student base of 2,652,283 (New York State Education Department, http://data.nysed.gov). These numbers include New York City school districts under the audit jurisdiction of the Office of the New York City Comptroller, which were not included in the results below but are subject to similar requirements.
Governance structure in school districts is unique. The superintendent acts as chief executive officer of the district and answers to the board of education, comprising five to nine elected volunteers responsible for the general management of financial and educational affairs. Unfortunately, school board members may lack financial expertise and independence, two attributes long viewed as essential in the private sector. (For a full discussion of school district governance, see Cynthia R. Phillips and Nina T. Dorata, “School District Boards, Audit Committees, and Budget Oversight,” The CPA Journal, March 2013, http://bit.ly/2m3pxID.)
School district governance also includes several different types of audits. Districts in New York State are required to employ an internal auditor who manages and tests risk assessment and controls, to have an annual external financial audit of financial statements conducted by a CPA and submitted to the state, and to have an audit committee of at least three members of the school board who are not employees or vendors of the district that is primarily responsible for overseeing these internal and external audit functions. A claims auditor who approves vouchers and invoices before payment is strongly recommended, but not required. Finally, recent policy has dictated that the OSC audit internal controls of school districts periodically. (For more information, see “School District Auditing: Roles, Responsibilities, and Resources,” available at http://bit.ly/2lZJKOq.)
The OSC audit process differs substantially from an external financial audit. The OSC’s school district audits commonly cover two years and take 40 days to complete, but they can vary in length. The audit begins with an initial assessment of internal controls to determine where to focus audit work. Review of the data determines the weaknesses present, as well as their severity and risk of potential fraud. The areas with the highest risk of control deficiencies are then subjected to further testing during the audit, referred to below as “areas of focus.”
For audit reports completed between 2013 and 2015, the OSC focused on a variety of topics for further testing. (The total count of each area selected for further analysis can be found in Exhibit 1.) Thirty-one school districts in the sample had more than one area selected for further testing. Budget-oriented audits tended to focus on financial management, financial condition, and reserve issues, while the most frequently targeted areas in non-budget control audits were payroll, purchasing issues, and employee compensation issues. It is important to note that these areas do not necessarily reflect the most critical issues in all districts across the state; instead, they may reflect a decision by the OSC to focus on a particular area.
Internal Control Areas Selected for Further Testing
After testing is complete, the district receives a draft report of recommendations and is able to respond to the audit results. This response is reviewed by the OSC and included as an appendix in the final report. After the report is publicly distributed, the organization has 90 days to report any corrective actions taken or justify why it has chosen to not implement a recommendation.
The analysis encompassed 287 OSC office internal control audits of school districts during 2013, 2014, and 2015. Thirty-five charter schools were also audited during the two-year period but were excluded from this analysis due to their different governance structure.
The length of time spent on each audit varied. It is also important to note that these districts are neither a random sample nor a representative sample; the OSC selected the schools to audit based on its own criteria. All budget review reports were excluded from this sample, as these reports do not search for internal control deficiencies, but rather focus on recommendations to improve budgets and school fiscal performance. Budgetary and financial condition control audits are included, as they do examine controls related to these areas.
The data collected included general information about each school district from the OSC report, including annual expenditures and student body size. Annual expenditures ranged from $946,175 to $806,600,000, with an average of $49,581,166. Student body size ranged from 15 (in a school district that only had an elementary school and sends higher level students to other districts) to 34,000 students, with an average of 2,330. The range of recommendations for the districts was from 0 (clean reports) to 24, with an average of 3.5.
Each audit recommendation for improvement of internal controls was coded in one of the eleven categories listed in Exhibit 2. All but 42 of the audit reports had at least one recommendation; these clean reports were included in analyses as observations with zero recommendations. The most frequent recommendations for school districts were reserve concerns and budgetary concerns, followed by the system of authorizations and a lack of adequate records.
Frequency of Recommendations in 2013–2015 Audit Reports
The OSC focused on financial condition in many audits and commonly made at least two recommendations relating to budgets and reserves. The most common budgetary recommendation was that “the Board and District officials should develop realistic budget estimates using financial results from prior years to project expenditures.” This reflected one of the auditors’ major concerns: budgetary estimates were not realistic, usually due to a consistent overestimation of expenses; the remaining unused funds would commonly be placed into reserve funds. Because of this, the usual recommendation paired with this budgetary recommendation was that “the Board should ensure unexpected surplus fund balance is within the allowed legal limits,” which are 4% at the beginning of the year. This limit was frequently surpassed by schools with budgetary issues.
“Adequate records” was the most frequent non-budgetary recommendation noted, with a variety of recommendations. Adequate records referred to deficiencies in many areas, such as “The school should implement and maintain accurate, up-to-date inventory records for computer hardware and software” and “If the Board chooses to continue leasing buildings, it should properly document its analysis and actions taken in the official board record to help provide assurance that the terms and conditions of the lease agreements are in the School’s best interest.” The next most frequent non-budgetary recommendation was improvements to the system of authorizations. Recommendations in this category suggested that proper authorization be granted and documented for hiring and compensation, major purchases, and other claims. The large number of recommendations related to authorizations and adequate records suggests that these are major areas of concern.
The above analysis of internal control recommendations for school districts in New York has some interesting implications for auditors, schools, and other small government entities. Examining the areas studied most often by state auditors, as well as their most common recommendations for improvement, can inform other school districts. Districts may find it useful to focus on improving controls in the areas most frequently cited by the OSC, that is, maintaining budgetary reserves within the legal limits, proper authorizations for purchases, and maintaining adequate records. CPAs might also increase testing of financial transactions and controls in these areas.