STATE OF NEW YORK OFFICE OF THE STATE COMPTROLLER 110 STATE STREET ALBANY, NEW YORK February 25, 2011

Transcription

1 THOMAS P. DiNAPOLI COMPTROLLER STATE OF NEW YORK OFFICE OF THE STATE COMPTROLLER 110 STATE STREET ALBANY, NEW YORK STEVEN J. HANCOX DEPUTY COMPTROLLER DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY Tel: (518) Fax: (518) February 25, 2011 Dr. Debra Jackson, Superintendent Highland Falls-Fort Montgomery Central School District 21 Morgan Road Highland Falls, NY Report Number: S Dear Dr. Jackson and Members of the Board of Education: A top priority of the Office of the State Comptroller is to help school district officials manage their resources efficiently and effectively and, by so doing, provide accountability for tax dollars spent to support district operations. The Comptroller oversees the fiscal affairs of districts statewide, as well as compliance with relevant statutes and observance of good business practices. This fiscal oversight is accomplished, in part, through our audits, which identify opportunities for improving district operations and Board of Education governance. Audits also can identify strategies to reduce costs and to strengthen controls intended to safeguard district assets. In accordance with these goals, we conducted an audit of six school districts throughout New York State. The objective of our audit was to determine if school districts have adequate internal controls over their online banking processes to safeguard district monies. We included the Highland Falls-Fort Montgomery Central School District Central School District (District) in this audit. Within the scope of this audit, we examined the District s policies and procedures and reviewed all transactions associated with online banking for the period July 1, 2009 through October 31, Following is a report of our audit of the Highland Falls-Fort Montgomery Central School District. This audit was conducted pursuant to Article V, Section 1 of the State Constitution, and the State Comptroller s authority as set forth in Article 3 of the General Municipal Law. This report of examination letter contains our findings specific to the District. We discussed the findings and recommendations with District officials and considered their comments, which appear in Appendix A, in preparing this report. District officials generally agreed with our findings and recommendations and plan to initiate corrective action. At the completion of our audit of the six school districts, we prepared a global report that summarizes the significant issues we identified at all of the school districts audited.

2 Summary of Findings The District has opportunities to improve its controls over online banking. Online banking duties are appropriately segregated between three employees and the proper authorization step is in place. Bank accounts also are properly monitored to ensure online banking transactions are authorized. We examined transactions for a three month period - 40 online transfers, 1 totaling $3.8 million - and found all were accurately recorded. The District can strengthen internal controls by adopting policy guidance over online banking. Further, the District should include a section in the online banking policy that prohibits users from accessing the District bank accounts from non-district computers. The District has an adequate computer use policy that prohibits unprofessional conduct on District computers. This policy requires users to sign a document stating they agree to follow the policy; however, the user agreement for the Treasurer could not be located by the District. Upon review of the two users computers used for online banking, we found no issues with software and Internet content. Further, proper virus control and filtering software was in place and working properly, thus reducing the risk of theft from District bank accounts from online hackers. Background and Methodology The District is located in Orange County and serves the Towns of Highland and Phillipstown. The District is governed by a seven-member Board of Education (Board). The Superintendent of Schools (Superintendent) is the chief executive officer of the District and is responsible, along with other administrative staff, for the day-to-day management of the District under the direction of the Board. The District currently has three schools in operation and employs approximately 200 full time staff. District enrollment for the school year was approximately 1,100 students. The District s general fund expenditures for the school year were approximately $22.8 million with a cash balance of approximately $3 million as of June 30, Recently, there has been a significant increase in fraud involving the exploitation of valid online banking credentials. Online banking fraud typically originates through fake messages or malicious software (malware). The targeted user may receive an that either contains an infected attachment or directs the recipient to an infected website. Once the recipient opens the attachment or visits the website, malware containing a key logger (which captures the user s keystrokes) is installed on the computer. The key logger harvests log-in information allowing the perpetrator to masquerade as the legitimate user or create another user account. Thereafter, fraudulent electronic cash transfers are initiated and directed to bank accounts in the United States or foreign countries. Good controls over computer usage, specifically Internet usage, reduce the risk of fraud involving the exploitation of school district bank accounts. 1 Online transfers include the transfer of money from a District account to a non-district account (wire transfers). The District does not transfer money from one District account to another (intra-bank transfers) via online; these are done by a check brought to the bank in person. Phone and fax wires are not included in this total as they are not part of the online banking process. 2

3 The Business Office staff comprises four employees, which include the Business Official, the Payroll Clerk, the Accounts Payable/Cash Receipt Clerk and the Accountant. The District s online banking transactions consist of wire transfers (from a District account to a non-district account, such as from the general fund checking to the State of New York for tax payments). Intra-bank transfers (from one school account to another, such as from the general fund checking to the general fund money market) are not completed via online banking. To complete our objective, we interviewed District officials and reviewed policies to determine the District s procedures relating to online banking. We reviewed supporting documentation, 2 bank statements, and financial reports to determine the validation and the recording of each online banking transaction for the audit scope period. We also reviewed computers used for online banking for adequate software protections and updates and for Internet usage patterns. We conducted this performance audit in accordance with generally accepted government auditing standards (GAGAS). Those standards require that we plan and perform our audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objective. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Audit Results Online Banking Transactions Effective internal controls over online banking include policies and procedures to properly monitor and control online banking transactions. A comprehensive online banking policy clearly describes the online banking activities the District will engage in, specifies which District employees have the authority to process transactions, establishes a detailed approval process to verify the accuracy and legitimacy of transfer requests, and requires a monthly report of all online banking transactions. It is important for someone independent of the online banking process to review this report and reconcile it with the monthly bank statement to verify that all transactions were properly approved and appropriate. 3 Further, authorized online banking users should access bank accounts only from their District computers, rather than personal computers, to avoid security risks. The District has opportunities to improve its controls over online banking. The District has segregated duties to not allow one employee to perform all aspects of the transaction. However, the District could further strengthen controls by formalizing the current processes into a formal District policy. The District uses online banking with 13 bank accounts maintained at three banks. The Business Official and Payroll Clerk have unrestricted access to the online banking websites to perform their authorized duties. Further, the Business Official and Payroll Clerk have been assigned user rights via contracts with the three banks with whom the District has online access. To initiate a transfer, the Business Official or the Payroll Clerk enters data from source documents into the online banking website. If the Payroll Clerk enters the data; then the Business 2 This includes vendor invoices and other vendor documentation. 3 The OSC Cash Management Technology Guide, available at provides guidance for online banking and includes an overview and list of best practices. 3

4 Official must authorize the transfer, or if the Business Official enters the data, then the Payroll Clerk must authorize the transfer. The Accountant enters the transfer data into the accounting system. Bank reconciliations are performed by the Payroll Clerk and reviewed by the Business Official. The bank reconciliations are included in the Treasurer s report submitted to and reviewed monthly by the Board. The District could strengthen its controls by having a third party independent from the online banking process perform the bank reconciliations. We reviewed 40 transfers made between November 1, 2009 to January 31, 2010 to determine that transfers were properly recorded, appropriate and proper. All of the 40 transactions, totaling $3.85 million, were wire transfers made from District to non-district accounts. We found that all transactions were appropriate and proper. The two Business Office personnel have user names, passwords, and token identifications 4 that are user specific. However, the individuals are able to access the online banking websites from non-district computers. Although personnel generally access the websites from the District computer, the District s lack of policy does not prohibit them from using other computers to do so. The District can further reduce the risk of unauthorized access by including prohibited access to bank accounts from non-district computers when constructing the online banking policy. Information Technology Controls District officials are responsible for maintaining adequate controls over employee computer usage, especially on the Internet. These controls include an Internet usage policy that establishes the District s expectations for employees who use a District computer. Additionally, the use of website filtering software can restrict access to Districtapproved websites only, and careful monitoring of Internet access helps to ensure appropriate use. Without a strict user policy and monitoring systems in place, inappropriate Internet usage could put District computers at risk, including those used to access on-line banking websites specific to the District s bank accounts. The District has a computer usage policy that provides guidance and procedures for proper usage, and specifically states that District staff shall adhere to laws, policies and rules governing computers. Further, the policy states that staff must complete a written agreement stating that they will conform to the requirements of the policy. The user agreements could not be located by District personnel when we inquired about the documents. Additionally, the District has website filtering software that prohibits access to various websites that are deemed not work-related. To determine if the information technology controls are operating effectively, we reviewed the hardware, software, Internet history, and related information on the Treasurer s computer that is involved in online banking activity. This review included analyzing the Internet history (cookies 5 ) on each machine to determine whether the Internet activity was appropriate and if the activity is putting District monies at risk. The computers used for online banking had adequate software and were being used in accordance with District computer usage policy. 4 Token identifications contain a number series assigned to a specific user. They can be used on any computer, but the user has to go through additive securities to gain access to the online banking website. 5 A cookie (also tracking cookie, browser cookie, and HTTP cookie) is a small piece of text stored on a user's computer by a web browser. 4

5 Recommendations 1. The Board should reassign the duties of the bank reconciliation to someone independent of the online banking transactions or implement compensating controls. 2. The Board should create and implement written online banking policy guidance. 3. The Board, through policy guidance, should prohibit staff from accessing District bank accounts from non-district computers. 4. The District should ensure that all staff has completed and signed the computer user agreement required by District policy. The Board has the responsibility to initiate corrective action. Pursuant to Section 35 of the General Municipal Law, Section 2116-a (3)(c) of the Education Law, and Section of the Regulations of the Commissioner of Education, a written corrective action plan (CAP) that addresses the findings and recommendations in this report must be prepared and provided to our office within 90 days, with a copy forwarded to the Commissioner of Education. To the extent practicable, implementation of the CAP must begin by the end of the next fiscal year. For more information on preparing and filing your CAP, please refer to our brochure, Responding to an OSC Audit Report, which you received with the draft audit report. The Board should make the CAP available for public review in the District Clerk s office. Our office is available to assist you upon request. If you have any further questions, please contact Ann Singer, Chief of Regional and Statewide Projects, at (607) Sincerely, Steven J. Hancox, Deputy Comptroller Office of the State Comptroller Division of Local Government and School Accountability 5

6 APPENDIX A RESPONSE OF DISTRICT OFFICIALS The District officials response to this audit can be found on the following pages. 6

7 7

8 8

9 9