Documents › Board of Education, 2026-04-21

report 12 pages

Also attached to this agenda item: Internal Audit Report on Revenue and Cash Management... FY26 CH UFSD revenue and cash management cycle report...

Croton-Harmon Union Free School District Risk Assessment Update Report For the Period January 1, 2025 to December 31, 2025 R.S. Abrams & Co., LLP – Accountants & Consultants for Over 75 Years TABLE OF CONTENTS Page: Report on Risk Assessment Update 1 – 2 Executive Summary 3 – 4 Assessment of Risk and Testing Plan 5 Procedures Performed, Observations, and Recommendations 6 – 8 Status of Prior Year Observations 8 – 10 Board of Education Croton-Harmon Union Free School District 10 Gerstein Street Croton-On-Hudson, NY 10520 We have completed our risk assessment update of the Croton-Harmon Union Free School District (the “District”) for the period January 1, 2025 through December 31, 2025. The objectives of the engagement were to assist the Board of Education (the “Board”) in ensuring that the District’s risks are identified and that appropriate internal controls are in place to mitigate those risks. In developing our risk assessment, we have performed the following procedures:  Gained an understanding of the internal controls for the following key business processes through inquiry and observation: o Governance and Planning o Accounting and Reporting o Revenue and Cash Management o Purchasing and Related Expenditures o Payroll, Human Resources, and Benefits o Facilities, Capital Projects, and Capital Assets o Student Services o Student Related Data and Services o Information Technology  Identified risks that could inhibit the District in achieving its goals;  Reviewed Board policies to determine if all legally required polices have been adopted and reflect current fiscal operations of the District;  Evaluated the design and effectiveness of controls and performed tests of controls to verify controls are working as intended; and  Identified key areas or opportunities that can strengthen the existing internal control structure. It is ultimately the District’s responsibility to review and assess the internal control structure to address the adequacy of the risk management system. In performing our engagement, we relied on the accuracy and reliability of information provided by District personnel. We have not audited, examined, or reviewed the information, and express no assurance on it. R.S. Abrams & Co., LLP – Accountants & Consultants for Over 75 Years 2 We would like to acknowledge the courtesy and assistance extended to us by personnel of the District. We are available to discuss this report with the Board or others within the District at your convenience. This report is intended solely for the information and use of the Board, the Audit Committee, and management of District, and is not intended to be and should not be used by anyone other than those specified parties. Very truly yours, R.S. Abrams & Co., LLP April 9, 2026 CROTON-HARMON UNION FREE SCHOOL DISTRICT Risk Assessment Update Report For the Period January 1, 2025 to December 31, 2025 R.S. Abrams & Co., LLP – Accountants & Consultants for Over 75 Years 3 Executive Summary This report serves to address the first requirement of Chapter 263 of the laws of New York, 2005, to establish an internal audit function. The internal audit function requirement includes the engagement of a qualified audit firm or individual to assess risk surrounding the design and effectiveness of the District’s internal control system, provide annual updates to the initial risk assessment, and test the design and operating effectiveness of these controls on a periodic basis. This risk assessment is intended to provide management with information to enhance and strengthen the District’s internal control system relating to their financial processing, reporting, and operations of the District. We performed the current year’s risk assessment update through various methods, including, but not limited to: inquiry of appropriate District personnel, observations and walkthroughs of controls in place, and testing key controls, where deemed necessary, to determine if the internal controls are operating as intended as detailed further in this report. Additionally, we have reviewed the status of prior year reports issued by our firm to determine if relevant controls have been implemented as recommended. We considered the following risks in our risk assessment and the potential effects on the District’s internal control system:  Inherent Risk - the risk associated with the nature and type of transactions processed due to complexity, materiality, and quantity of the transactions outside of the District’s internal control structure.  Control Risk – the risk that the internal control system is not adequately designed to prevent or detect errors or irregularities on a timely basis. We reviewed selected processes noted in our Risk Assessment Letter and have assigned the business processes the following ratings:  High Risk (H) – We identified areas where we believe the internal control system is not effective in preventing or detecting risks associated with the District’s operations and require immediate attention from the Board and management.  Moderate Risk (M) – We identified areas where we believe an internal control system exists, but may not be fully effective in preventing or detecting risks. The District should review our recommendations and consider the need to implement these recommendations.  Low-Risk (L) – We believe the internal control system is adequately designed and operating as intended. We have also included our recommendations in the procedures performed, observations, and recommendations section of this report where we believe CROTON-HARMON UNION FREE SCHOOL DISTRICT Risk Assessment Update Report For the Period January 1, 2025 to December 31, 2025 R.S. Abrams & Co., LLP – Accountants & Consultants for Over 75 Years 4 opportunities exist to further strengthen the internal control system. The assigned control risk ratings listed are based on our risk procedures performed and are subject to change based on future risk assessment or extensive system reviews performed. Process Evaluation Summary and Proposed Business Processes: The following represents the business processes where we have provided internal audit services and the extensive review process we are proposing for the upcoming fiscal year: Extensive System Reviews Completed: 2014 – 2015: Extraclassroom Activities 2015 – 2016: Information Technology 2016 – 2017: Human Resources 2017 – 2018: Capital Assets 2018 – 2019: State Aid and Grants 2019 – 2020: System to Track and Account for Children (“STAC”) 2020 – 2021: Payroll Processing and Related Expenditures 2021 – 2022: Fund Balance Management and Reserves and Fiscal Health; Human Resources 2022 – 2023: Purchasing and Related Expenditures 2023 – 2024: Extraclassroom Activities 2024 – 2025: Information Technology 2025 – 2026: Revenue and Cash Management Extensive System Review Proposed: 2026 – 2027: Capital Assets CROTON-HARMON UNION FREE SCHOOL DISTRICT Risk Assessment Update Report For the Period January 1, 2025 to December 31, 2025 R.S. Abrams & Co., LLP – Accountants & Consultants for Over 75 Years 5 BUSINESS PROCESSES AND SUBPROCESSES GOVERNANCE AND PLANNING 2024-2025 2025-2026 2024-2025 2025-2026 2026-2027 Governance and Control Environment L L  Strategic Planning L L  Budget Development and Budget Administration L L  ACCOUNTING AND REPORTING 2024-2025 2025-2026 2024-2025 2025-2026 2026-2027 Assessing Financial Condition L L  Financial Accounting and Reporting L L  Auditing L L  State Aid and Grants L L  REVENUE AND CASH MANAGEMENT 2024-2025 2025-2026 2024-2025 2025-2026 2026-2027 Revenue, Billings, and Receipts L L  Cash and Investment Management L L  PURCHASING AND RELATED EXPENDITURES 2024-2025 2025-2026 2024-2025 2025-2026 2026-2027 Purchasing L L  Accounts Payable and Cash Disbursements L L  Travel and Conferences L L  PAYROLL, HUMAN RESOURCES, AND BENEFITS 2024-2025 2025-2026 2024-2025 2025-2026 2026-2027 Payroll Processing and Related Expenditures M L  Human Resources L L  Benefits L L  FACILITIES, CAPITAL PROJECTS, AND CAPITAL ASSETS 2024-2025 2025-2026 2024-2025 2025-2026 2026-2027 Facilities Maintenance L L  Capital Projects L L  Capital Assets L L   STUDENT SERVICES 2024-2025 2025-2026 2024-2025 2025-2026 2026-2027 Student Transportation L L  Food Service L L  Extraclassroom Activities L L STUDENT RELATED DATA AND SERVICES 2024-2025 2025-2026 2024-2025 2025-2026 2026-2027 Student Attendance L L  Reliability of Student Performance Data L L  Student Security and Safety L L  INFORMATION TECHNOLOGY 2024-2025 2025-2026 2024-2025 2025-2026 2026-2027 Policies and Governance L L  Data Backup and Recovery Processes L L  Data Security and Cybersecurity Risks L L  Legend  = Extensive system process review completed  = Risk process evaluated  = Extensive system process proposed H = High M = Moderate L = Low Control Risk Audit Plan CROTON-HARMON UNION FREE SCHOOL DISTRICT Risk Assessment Update Report For the Period January 1, 2025 to December 31, 2025 R.S. Abrams & Co., LLP – Accountants & Consultants for Over 75 Years 6 PROCEDURES PERFORMED, OBSERVATIONS, AND RECOMMENDATIONS GOVERNANCE AND PLANNING Procedures Performed:  Interviewed key personnel involved in the governance and planning processes.  Reviewed whether the District has adopted all legally required Board of Education (the “Board”) policies per the New York State School Boards Association (NYSSBA).  Reviewed Board member training certifications to assess whether Board members have fulfilled applicable training requirements.  Reviewed the District’s budget development and administration process to ensure it follows required policies and regulations. This included confirming the presence of formal budgeting policies, written objectives, and procedures for budget preparation, transfers, and amendments. Assessed whether the proposed budget clearly communicates financial plans and priorities to the public and whether budget transfers comply with legal requirements.  Reviewed the Treasurer’s Report provided to the Board for September and November 2025 to assess whether all required financial reports were included.  Reviewed the minutes of the annual reorganization meeting held July 10, 2025 to assess whether required appointments and designations were properly documented.  Inquired with District administration as to whether a multi-year financial plan has been developed and updated.  Obtained and inspected signed oaths of office for newly elected and appointed Board members and reviewed the reorganization meeting minutes to assess whether oaths were administered prior to participation in Board votes, as required by Public Officers Law §10 and Education Law §2106.  Sampled five (5) budget transfers to assess whether transfers were properly approved, supported, and performed in accordance with District policy. Observation: The District’s multi-year financial plan was last updated in May 2021. Recommendation: We recommend that District officials develop and adopt via Board resolution an updated multi-year financial plan that projects revenues, expenditures, fund balance, and reserve levels for at least three to five years. We acknowledge that the District is currently in the process of updating its multi-year financial plan. Updated Control Risk Ratings: Governance and Control Environment (L) Strategic Planning (L) Budget Development and Budget Administration (L) *** CROTON-HARMON UNION FREE SCHOOL DISTRICT Risk Assessment Update Report For the Period January 1, 2025 to December 31, 2025 R.S. Abrams & Co., LLP – Accountants & Consultants for Over 75 Years 7 ACCOUNTING AND REPORTING Procedures Performed:  Interviewed key personnel involved in the accounting and reporting process.  Reviewed whether the District has adequate policies and procedures in place to monitor and track state aid and grants.  Reviewed whether the District has adopted a federal procedural manual which includes all required policies in accordance with Uniform Guidance.  Reviewed federal grant allocation reports to assess whether grant funding is being utilized in accordance with program requirements, budgets, and timelines.  Reviewed whether required external audit reports and corrective action plans are published on the District’s website.  Reviewed fund balance amounts for the general fund, including reserves, to assess whether reserves are allowable and fund balance levels appear reasonable.  Reviewed the Treasurer’s Reports for September and November 2025 to assess whether all bank accounts and fund balances are properly reported.  Reviewed interfund balances (due to/due from) as of December 31, 2025 to assess whether interfund transactions are properly recorded and balances net to zero across all funds.  Reviewed the variances between actual expenditure results and budgeted appropriations over the past three fiscal years to assess whether trends are reasonable and appropriately addressed in the budgeting process.  Sampled five (5) journal entries to assess whether entries are supported by adequate documentation and appropriate approvals. Observation: At the time of testing, the District's corrective action plan from the most recent external audit was not posted to the District's website as required by the Office of the State Comptroller (OSC). Recommendation: We recommend the District ensure corrective action plans for external audits are posted to its website in accordance with OSC requirements. We acknowledge that the District has since posted the corrective action plan for the external audit to its website. Updated Control Risk Ratings: Assessing Financial Condition (L) Financial Accounting and Reporting (L) Auditing (L) State Aid and Grants (L) *** CROTON-HARMON UNION FREE SCHOOL DISTRICT Risk Assessment Update Report For the Period January 1, 2025 to December 31, 2025 R.S. Abrams & Co., LLP – Accountants & Consultants for Over 75 Years 8 PURCHASING AND RELATED EXPENDITURES Procedures Performed:  Interviewed key personnel to understand and evaluate internal controls, operational procedures, and adherence to District policies for purchasing and procurement.  Reviewed whether the District has Board adopted policies surrounding conference, travel, and meal expenditures, including mileage reimbursement rates.  Reviewed whether the District’s purchasing policy addresses competitive bidding requirements and procedures for purchases below bidding thresholds.  Obtained an understanding of the District’s cash disbursement procedures, including voucher package assembly and claims auditor review.  Reviewed whether the District’s independent claims auditor was Board appointed and reviews all voucher packages prior to payment.  Sampled ten (10) cash disbursements to assess whether requisitions were properly approved, bidding procedures were followed, supporting documentation was retained, and claims auditor approval was obtained.  Sampled five (5) travel and conference and employee reimbursement expenditures to assess whether travel requests were prepared and approved, where applicable, and that the District’s policies were adhered to. Recommendations: No observations or recommendations were noted. Updated Control Risk Ratings: Purchasing (L) Accounts Payable and Cash Disbursements (L) Travel and Conferences (L) *** STATUS OF PRIOR YEAR OBSERVATIONS: Area: Governance and Control Environment: Observation: We noted the District did not have a formal policy for #5550, Student Privacy, as required by the New York State School Boards Association. Status: Implemented. Updated Control Risk Rating: Low (L) CROTON-HARMON UNION FREE SCHOOL DISTRICT Risk Assessment Update Report For the Period January 1, 2025 to December 31, 2025 R.S. Abrams & Co., LLP – Accountants & Consultants for Over 75 Years 9 Area: Payroll Processing and Related Expenditures: Observation: Although the District had Board policies on payroll, the District did not have a formalized employee handbook outlining general payroll and benefit policies, employment policies, laws and regulations, employee conduct, and workplace information. Status: Implemented. Updated Control Risk Rating: Low (L) Area: Capital Assets: Observation: The District did not have a five-year facilities plan and a capital assets preservation plan as required by Policy #7100, Facilities Planning. Status: Not Implemented. While the district does not currently maintain the specific plans noted above, it appears that the District is in compliance with the substantive requirements of New York State Education Law §3602(6). We continue to recommend that the District create a single, consolidated document titled the "Five-Year Capital Assets Preservation Plan" in accordance with Policy #7100, Facilities Planning. Updated Control Risk Rating: Low (L) Area: Information Technology (IT) Policies and Governance: Observation: The District did not perform regular internal IT risk assessments to identify cybersecurity threats or system vulnerabilities as recommended by the National Institute of Standards and Technology (NIST) Cybersecurity Framework report. Status: Implemented. Observation: We noted that the District’s IT systems generated automated logs and alerts for unauthorized login attempts and security events. However, there was no documented process to regularly review, analyze, or act on these logs. Status: Implemented. Observation: The District’s IT inventory listing contained entries missing key information such as serial numbers, purchase/acquisition dates, tag number, and asset locations. Status: Implemented. Observation: The District’s IT inventory listing included six assets marked as retired, but still listed as “in use.” CROTON-HARMON UNION FREE SCHOOL DISTRICT Risk Assessment Update Report For the Period January 1, 2025 to December 31, 2025 R.S. Abrams & Co., LLP – Accountants & Consultants for Over 75 Years 10 Status: Implemented. Observation: The IT inventory included 161 assets such as laptops, printers, iPads, etc. that were acquired between 2000 and 2017 that were still marked as active. Status: Implemented. Updated Control Risk Rating: Low (L) Area: Data Backup and Recovery Processes: Observation: The District’s disaster recovery plan remained in draft form and had not been finalized or approved by the Board. Status: Implemented. Updated Control Risk Rating: Low (L) Area: Data Security and Cybersecurity Risks: Observation: The Incident Response Plan (IRP) contained placeholder text instead of district- specific information such that the plan would be unusable in an actual incident. Status: Implemented. Updated Control Risk Rating: Low (L)