Fonda-Fultonville Central School District

Transcription

1 O FFICE OF THE NEW YORK STATE COMPTROLLER DIVISION OF LOCAL GOVERNMENT & SCHOOL ACCOUNTABILITY Fonda-Fultonville Central School District Online Banking Report of Examination Period Covered: July 1, 2009 August 31, M-62 Thomas P. DiNapoli

2 Table of Contents AUTHORITY LETTER 2 Page INTRODUCTION 3 Background 3 Objective 3 Scope and Methodology 3 Comments of District Officials and Corrective Action 4 ONLINE BANKING 5 Recommendations 8 APPENDIX A Response From District Officials 10 APPENDIX B Audit Methodology and Standards 13 APPENDIX C How to Obtain Additional Copies of the Report 14 APPENDIX D Local Regional Office Listing 15 DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 11

3 State of New York Division of Local Government and School Accountability July 2011 Dear School District Officials: A top priority of the is to help local government officials manage government resources efficiently and effectively and, by so doing, provide accountability for tax dollars spent to support government operations. The Comptroller oversees the fiscal affairs of local governments statewide, as well as compliance with relevant statutes and observance of good business practices. This fiscal oversight is accomplished, in part, through our audits, which identify opportunities for improving operations and Board of Education governance. Audits also can identify strategies to reduce costs and to strengthen controls intended to safeguard local government assets. Following is a report of our audit of the Fonda-Fultonville Central School District, entitled Online Banking. This audit was conducted pursuant to Article V, Section 1 of the State Constitution and the State Comptroller s authority as set forth in Article 3 of the General Municipal Law. This audit s results and recommendations are resources for district officials to use in effectively managing operations and in meeting the expectations of their constituents. If you have questions about this report, please feel free to contact the local regional office for your county, as listed at the end of this report. Respectfully submitted, Offi ce of the State Comptroller Division of Local Government and School Accountability 2 OFFICE OF THE NEW YORK STATE COMPTROLLER

4 Introduction Background The Fonda-Fultonville Central School District (District) is located in seven towns 1 in Montgomery County, the towns of Carlisle and Esperance in Schoharie County and the City and Town of Johnstown in Fulton County. The District is governed by the Board of Education (Board) which comprises seven elected members. The Board is responsible for overseeing the financial and educational activities of the District. The Board may accomplish this by adopting District policies which establish good internal controls over financial operations and which ensure the proper monitoring of activities. The Board is assisted in these responsibilities by the Superintendent of Schools (Superintendent). The Board also annually appoints a District Treasurer and a Deputy District Treasurer to assist with the handling and oversight of the District s financial activities. The District had a total student population of approximately 1,400 and 200 employees at the end of the school year. The District s reported operating expenditures for were more than $24.6 million which were primarily funded through State aid and real property taxes. Objective The objective of our audit was to determine if the District had established effective internal controls over online banking. Our audit addressed the following related question: Did the District establish adequate internal controls to safeguard online banking transactions? Scope and Methodology We examined the District s internal controls over online banking for the period July 1, 2009 to August 31, Our audit disclosed an area in need of improvement concerning information technology controls. Because of the sensitivity of this information, certain vulnerabilities relating to online banking are not discussed in this report but have been communicated to District officials so they could take corrective action. We conducted our audit in accordance with generally accepted government auditing standards (GAGAS). More information on such standards and the methodology used in performing this audit are included in Appendix B of this report. 1 Towns of Amsterdam, Charleston, Florida, Glen, Mohawk, Palatine and Root DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 33

5 Comments of District Officials and Corrective Action The results of our audit and recommendations have been discussed with District officials and their comments, which appear in Appendix A, have been considered in preparing this report. District officials generally agreed with our recommendations and indicated they planned to initiate corrective action. The Board has the responsibility to initiate corrective action. Pursuant to Section 35 of the General Mucnicipal Law, Section 2116-a(3)(c) of the Education Law, and Section of the regulations of the Commissioner of Education, a written corrective action plan (CAP) that addresses the findings and recommendations in this report should be prepared and provided to our office within 90 days, with a copy forwarded to the Commissioner of Education. For more information on preparing and filing your CAP, please refer to our brochure, Responding to an OSC Audit Report, which you received with the draft audit report. The Board of Education should make the CAP available for public review in the District Clerk s office. 4 OFFICE OF THE NEW YORK STATE COMPTROLLER

6 Online Banking The Board is responsible for establishing internal controls over online banking to safeguard District assets. To meet this responsibility, the Board must adopt policies and procedures for online banking which include provisions to establish those controls. It is important for the District s policy to outline the online banking activities the District will engage in, the employees who will be granted access to the District s online accounts, and include provisions to segregate the duties of initiating, approving, transmitting, recording, and reconciling transactions. The policy must also include provisions for training all employees who have access to online banking, and for monitoring online banking activity, which requires the review of a monthly report of all online banking transactions. It is important that someone independent of the online banking process review this report and reconcile it with the monthly bank statement to verify that all transactions were properly approved and appropriate. The Board did not adopt an online banking policy and did not develop procedures for online banking activities. In addition, online banking duties were not properly segregated and account accessibility was not properly controlled. Furthermore, the Treasurer and Deputy Treasurer did not use proper procedures when accessing and exiting online banking sessions. Finally, the Treasurer and Deputy Treasurer did not receive appropriate online banking training and access to the District s bank accounts has not been monitored. As a result, District funds are at risk. Policy and Procedures Effective internal controls over online banking include policies and procedures to properly monitor and control online banking transactions. A comprehensive online banking policy clearly describes the online banking activities the district will engage in, specifies which district employees have the authority to process transactions, and establishes a detailed approval process to verify the accuracy and legitimacy of transfer requests. The District does not have an online banking policy and has not established written procedures for online banking. As a result, we found several weaknesses in the informal procedures implemented by District officials to perform online banking activities. Segregation of Duties To adequately safeguard District assets, District officials must properly segregate duties for employees granted access to the District s online banking application. Effective policies DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 55

7 and procedures which segregate job duties also ensure that employees are unable to perform financial transactions unilaterally. The District has not adequately segregated employee duties related to online banking transactions. The Treasurer, the Deputy Treasurer and an account clerk, who previously worked in the Business Office, were granted access to the District s online bank accounts. Both the Treasurer and Deputy Treasurer have full access to all of the District s online bank accounts which enables them to initiate and authorize direct deposits and transfers to and from District bank accounts without the review or authorization of any other District employee or official. By allowing District employees to have unilateral access to perform online banking transactions there is an increased risk that inappropriate or unauthorized transactions may occur and go undetected. Account Access Granting employees access to online bank accounts exposes the District to vulnerabilities. Additionally, online banking applications often provide users with a variety of functions they may use to process various transactions online. If employees are granted access beyond that which is necessary to complete their job duties these vulnerabilities are increased, potentially allowing transactions or modifications to be performed which may be unauthorized or malicious. To reduce the risk of such transactions or modifications occurring, the District should limit account access to those employees and functions which are essential to an employee s job duties. The District s bank offers numerous services through their online banking application. 2 The District allows their online banking users access to transfer funds between the 11 accounts held at that bank, to upload and pay direct deposit files and to purchase savings bonds. To obtain access to any of the other functions offered by the bank, the District must call the bank call center and request access to the specific functions. Using sensitive information, the bank verifies the person to whom they are speaking on the phone and if the individual is an account signatory, the bank will grant the requested access. We found both the Treasurer and Deputy Treasurer have supervisory access to the District s online bank accounts. As a result, they have access to all online banking functions with all 11 accounts and have rights to transfer funds between accounts, upload direct deposit files and pay the associated direct deposits. Additionally, both employees can purchase savings bonds with District monies, change the names 6 OFFICE OF THE NEW YORK STATE COMPTROLLER 2 Online banking users can transfer funds between their different bank accounts, pay bills, process automatic clearing house (ACH) payments and collections, send money via wire, send money internationally via wire, send electronic tax payments, process payroll, upload payment files, order currency and purchase savings bonds.

8 and addresses listed on the District bank accounts and change access rights of users who do not have supervisory access rights. Finally, all of the functions that the Treasurer and Deputy Treasurer can perform can be done without any authorization, approval or notification of another employee. In addition, as of the end of , the account clerk, who is still a District employee but no longer works in the Business Office, had read-only access to all of the District s online accounts. This additional and unnecessary user access exposes the District to increased risk that the access privileges could be misused by employees or others. Furthermore, the Treasurer and Deputy Treasurer both have the ability to increase an employee s access rights without authorization. Access and Exit Procedures Good internal controls over online banking include written procedures for accessing and exiting the bank website which safeguard the District s user information and online banking session from unwanted or malicious attacks. Such controls include requiring users to type the bank s website uniform resource locator (URL) address into the Internet s address bar every time they log-on to the application. In addition, users must always ensure the website is authentic by checking the web address and general appearance of the website and ensuring the connection is secure (secure website addresses begin with https). Additional procedures should be established to ensure that computers used for online banking do not store or save user log-in names or passwords and that user names and passwords meet complexity requirements. Additionally, when exiting the bank s website, users should actually log-out of online banking sessions; simply closing the browser window could leave District accounts open to threats. Users should also delete any browsing history, cookies, temporary internet files, and similar information from the computer after an online banking session is completed. If the computer is compromised such information could be used to access District bank accounts. The District has not established adequate internal controls over online banking which include user access and exit procedures to online banking applications. We observed the access and exit procedures of the Treasurer and Deputy Treasurer. When accessing the online banking website, the Treasurer used an internet search engine to find the bank webpage and selected the link. The Deputy Treasurer selected the bank website from the internet browser s drop-down menu. When exiting the online banking website, the Treasurer and Deputy Treasurer both logged out of the website and closed the browser but neither of them deleted their internet history, cache, cookies or temporary internet files. DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 77

9 Training Performing transactions over the internet can expose District bank accounts to threats from malicious software. Computer users who are unaware of potential threats are more likely to unknowingly download unwanted or malicious software, which can threaten online bank accounts. An adequate online banking policy requires employees with access to online bank accounts to receive internet security awareness training. Such training includes a review of District policies and procedures, a review of potential internet scams, and a review of information technology security best practices. Both, the Treasurer and Deputy Treasurer perform online banking transactions and neither has received internet security awareness training. This lack of training could result in users unintentionally exposing the District s online bank accounts to threats from malicious software which could endanger District assets. Monitoring The District s online bank accounts must be monitored on a regular basis for unauthorized or suspicious activity. The timely identification and reporting of suspicious activity can protect the District from loss and improve opportunities for recovery of lost assets. The District has not implemented policies and procedures which include provisions to regularly monitor access to online bank accounts. While the Treasurer and Deputy Treasurer regularly access the online accounts and reconcile them to the financial records, formal procedures need to be in place to require someone independent of the online banking process to monitor those transactions. As a result of the lack of formal monitoring procedures unauthorized or suspicious online banking activities could go undetected, or be identified too late to fully recover losses. As a result of the deficiencies, we reviewed all bank reconciliations for the fiscal year and found that all online transactions were properly supported. Although our audit found no evidence of inappropriate transactions, the lack of comprehensive policies and procedures which adequately segregate incompatible duties, limit access to the District s bank account, require users of the District s online banking system to be trained on proper online banking procedures and require monitoring of online banking transactions put the District s assets at risk. As a result, errors, irregularities, or fraud could occur and not be detected and corrected in a timely manner. Recommendations 1. The District should establish formal written policies and procedures which establish effective internal controls over online banking by including provisions to adequately segregate duties and limit access rights, require users to receive training and require online banking transactions to be monitored. 8 OFFICE OF THE NEW YORK STATE COMPTROLLER

10 2. District officials should limit user access to online bank account functions to the level necessary to complete job duties. 3. District officials should establish access procedures which require users to type in the URL address every time when logging into the online banking application. 4. District officials should establish exit procedures which require users to log out of the online banking application, not just close the web browser. The procedures should also require the deletion of the web browser cache, temporary internet files, cookies, and history after every online banking session. 5. District officials should ensure that employees involved in the online banking process receive adequate training. 6. District officials should ensure that someone independent of the online banking process regularly monitor the online transactions. DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 99

11 APPENDIX A RESPONSE FROM DISTRICT OFFICIALS The District officials response to this audit can be found on the following pages. 10 OFFICE OF THE NEW YORK STATE COMPTROLLER

12 DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 1111

13 12 OFFICE OF THE NEW YORK STATE COMPTROLLER

14 APPENDIX B AUDIT METHODOLOGY AND STANDARDS Our overall goal was to assess the adequacy of internal controls put in place by District officials to safeguard District assets and monitor financial activities. To accomplish this we performed an initial assessment of District controls so that we could design our audit to focus on those areas at greatest risk. Our initial assessment included evaluations of the following areas: financial oversight, cash receipts and disbursements, purchasing, payroll and personal services, capital projects and information technology. During our initial assessment we interviewed District officials, performed limited tests of transactions, and reviewed pertinent documents such as District policies, Board minutes, and financial records and reports for the period July 1, 2009 through August 31, After reviewing the information in our initial assessment, we determined where weaknesses existed, and evaluated those weaknesses for potential fraud, abuse, or professional misconduct. We then decided upon the reported objective and scope by selecting those areas most at risk. We selected online banking for further audit testing. To accomplish our audit objectives and obtain relevant audit evidence, our procedures included the following: We interviewed District officials to determine which employees have been designated to initiate, authorize, record, reconcile, and monitor online banking transactions. We reviewed District policies to determine if the Board has adopted an adequate policy for online banking. We interviewed District officials to determine whether practices and procedures have been adopted to establish effective internal controls over online banking activities. We observed District employees access, exit, and navigate the online banking application. We reviewed online banking agreements between the District and the District s bank. We interviewed representatives from the District s bank regarding online banking security features available to the District. We conducted this performance audit in accordance with generally accepted government auditing standards (GAGAS). Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objective. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective. DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 13

15 APPENDIX C HOW TO OBTAIN ADDITIONAL COPIES OF THE REPORT To obtain copies of this report, write or visit our web page: Public Information Office 110 State Street, 15th Floor Albany, New York (518) OFFICE OF THE NEW YORK STATE COMPTROLLER

16 APPENDIX D OFFICE OF THE STATE COMPTROLLER DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY Steven J. Hancox, Deputy Comptroller Nathaalie N. Carey, Assistant Comptroller LOCAL REGIONAL OFFICE LISTING BINGHAMTON REGIONAL OFFICE H. Todd Eames, Chief Examiner State Office Building - Suite Hawley Street Binghamton, New York (607) Fax (607) Muni-Binghamton@osc.state.ny.us Serving: Broome, Chenango, Cortland, Delaware, Otsego, Schoharie, Sullivan, Tioga, Tompkins Counties BUFFALO REGIONAL OFFICE Robert Meller, Chief Examiner 295 Main Street, Suite 1032 Buffalo, New York (716) Fax (716) Muni-Buffalo@osc.state.ny.us Serving: Allegany, Cattaraugus, Chautauqua, Erie, Genesee, Niagara, Orleans, Wyoming Counties NEWBURGH REGIONAL OFFICE Christopher Ellis, Chief Examiner 33 Airport Center Drive, Suite 103 New Windsor, New York (845) Fax (845) Muni-Newburgh@osc.state.ny.us Serving: Columbia, Dutchess, Greene, Orange, Putnam, Rockland, Ulster, Westchester Counties ROCHESTER REGIONAL OFFICE Edward V. Grant, Jr., Chief Examiner The Powers Building 16 West Main Street Suite 522 Rochester, New York (585) Fax (585) Muni-Rochester@osc.state.ny.us Serving: Cayuga, Chemung, Livingston, Monroe, Ontario, Schuyler, Seneca, Steuben, Wayne, Yates Counties GLENS FALLS REGIONAL OFFICE Jeffrey P. Leonard, Chief Examiner One Broad Street Plaza Glens Falls, New York (518) Fax (518) Muni-GlensFalls@osc.state.ny.us Serving: Albany, Clinton, Essex, Franklin, Fulton, Hamilton, Montgomery, Rensselaer, Saratoga, Schenectady, Warren, Washington Counties SYRACUSE REGIONAL OFFICE Rebecca Wilcox, Chief Examiner State Office Building, Room E. Washington Street Syracuse, New York (315) Fax (315) Muni-Syracuse@osc.state.ny.us Serving: Herkimer, Jefferson, Lewis, Madison, Oneida, Onondaga, Oswego, St. Lawrence Counties HAUPPAUGE REGIONAL OFFICE Ira McCracken, Chief Examiner NYS Office Building, Room 3A10 Veterans Memorial Highway Hauppauge, New York (631) Fax (631) Muni-Hauppauge@osc.state.ny.us STATEWIDE AND REGIONAL PROJECTS Ann C. Singer, Chief Examiner State Office Building - Suite Hawley Street Binghamton, New York (607) Fax (607) Serving: Nassau and Suffolk Counties DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 15