Dolgeville Central School District - New York State ...

OFFICE OF THE NEW YORK STATE COMPTROLLER DIVISION OF LOCAL GOVERNMENT & SCHOOL ACCOUNTABILITY

Dolgeville Central School District

System Access Controls

Report of Examination

Period Covered: July 1, 2014 ? April 15, 2016

2016M-265

Thomas P. DiNapoli

Table of Contents

AUTHORITY LETTER

INTRODUCTION Background Objective Scope and Methodology Comments of District Officials and Corrective Action

SYSTEM ACCESS CONTROLS User Accounts Activity and Permissions Recommendations

APPENDIX A APPENDIX B APPENDIX C APPENDIX D

Response From District Officials Audit Methodology and Standards How to Obtain Additional Copies of the Report Local Regional Office Listing

Page

1

2 2 3 3 3

4 4 5 8

9 11 12 13

State of New York Office of the State Comptroller

Division of Local Government and School Accountability

January 2017

Dear School District Officials:

A top priority of the Office of the State Comptroller is to help school district officials manage their districts efficiently and effectively and, by so doing, provide accountability for tax dollars spent to support district operations. The Comptroller oversees the fiscal affairs of districts statewide, as well as districts' compliance with relevant statutes and observance of good business practices. This fiscal oversight is accomplished, in part, through our audits, which identify opportunities for improving district operations and Board of Education governance. Audits also can identify strategies to reduce district costs and to strengthen controls intended to safeguard district assets.

Following is a report of our audit of the Dolgeville Central School District, entitled System Access Controls. This audit was conducted pursuant to Article V, Section 1 of the State Constitution and the State Comptroller's authority as set forth in Article 3 of the New York State General Municipal Law.

This audit's results and recommendations are resources for district officials to use in effectively managing operations and in meeting the expectations of their constituents. If you have questions about this report, please feel free to contact the local regional office for your county, as listed at the end of this report.

Respectfully submitted,

Office of the State Comptroller Division of Local Government and School Accountability

DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY

11

Introduction

Background

The Dolgeville Central School District (District) is located in the Towns of Fairfield, Manheim and Salisbury in Herkimer County and the Towns of Ephratah, Oppenheim and Stratford in Fulton County. The District is governed by the Board of Education (Board), which is composed of seven elected members. The Board is responsible for the general management and control of the District's financial and educational affairs.

The Superintendent of Schools (Superintendent) is the District's chief executive officer and is responsible, along with other administrative staff, for the District's day-to-day management under the Board's direction. The Business Administrator, with support from the technology coordinator, is responsible for the day-to-day operations of the financial system (FS). The high school guidance counselor, with support from the technology coordinator and the Mohawk Regional Information Center (MORIC), is responsible for the day-today operations of the student information system (SIS).

The District operates three schools with 918 students and 185 employees. The District's budgeted appropriations for the 2015-16 fiscal year were approximately $19 million, funded primarily with State aid and real property taxes.

The FS is an electronic system used to record employee and vendor information (entered by District personnel); generate, sign and print checks; and post journal entries to the general ledger. The FS contains personal, private and sensitive information (PPSI)1 about District employees, including their Social Security numbers and bank, retirement and health savings account information. Authorized FS users are the Business Administrator, Deputy Treasurer, Treasurer, Clerk and Business Office secretary. The District assigns access permissions to these users within five different software modules.

The SIS is an electronic system that serves as the official District record of middle and high school student performance and is used to track those students' grades (entered by District personnel), generate report cards and maintain permanent records (i.e., transcripts). The SIS also contains other PPSI about students, including their student identification numbers and medical, order of protection and custody

1 PPSI is any information which ? if subjected to unauthorized access, disclosure, modification, destruction or disruption of access or use ? could severely affect critical functions, employees, customers, third parties or citizens of New York State in general.

2

OFFICE OF THE NEW YORK STATE COMPTROLLER

information. Authorized SIS users are teachers, administrators, various other District employees and third parties, including MORIC employees and the SIS software vendor. The District assigns access permissions to these 186 users through 18 different user groups.2

Objective

The objective of our audit was to examine information technology (IT) access controls over PPSI in the District's FS and SIS. Our audit addressed the following related question:

? Did District officials implement IT access controls to adequately safeguard PPSI in the District's FS and SIS?

Scope and Methodology

We examined the District's IT access controls for the period July 1, 2014 through April 15, 2016. Because of the sensitivity of some of this information, we did not discuss certain audit results in this report but instead communicated them confidentially to District officials.

We conducted our audit in accordance with generally accepted government auditing standards (GAGAS). More information on such standards and the methodology used in performing this audit are included in Appendix B of this report. Unless otherwise indicated in this report, samples for testing were selected based on professional judgment, as it was not the intent to project the results onto the entire population. Where applicable, information is presented concerning the value and/or size of the relevant population and the sample selected for examination.

Comments of District Officials and Corrective Action

The results of our audit and recommendations have been discussed with District officials, and their comments, which appear in Appendix A, have been considered in preparing this report. District officials generally agreed with our recommendations and indicated they planned to take corrective action.

The Board has the responsibility to initiate corrective action. Pursuant to Section 35 of General Municipal Law, Section 2116-a (3)(c) of New York State Education Law and Section 170.12 of the Regulations of the Commissioner of Education, a written corrective action plan (CAP) that addresses the findings and recommendations in this report must be prepared and provided to our office within 90 days, with a copy forwarded to the Commissioner of Education. To the extent practicable, implementation of the CAP must begin by the end of the next fiscal year. For more information on preparing and filing your CAP, please refer to our brochure, Responding to an OSC Audit Report, which you received with the draft audit report. The Board should make the CAP available for public review in the District Clerk's office.

2 User groups are established in the SIS and permissions are assigned by group. Therefore, all individuals in a group have the same user permissions.

DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY

33

 ................
................

In order to avoid copyright disputes, this page is only a partial summary.

Google Online Preview   Download