Audit: Computers lacking protection

Criticisms by state auditors that Schoharie Central School District computer systems and financial d
PHOTOGRAPHER:

Criticisms by state auditors that Schoharie Central School District computer systems and financial data were inadequately protected over the two-year period ending June 25, 2007, have reaffirmed changes already under way, district Superintendent Brian Sherman said Wednesday.

A routine audit released this week by the state Comptroller’s Office faulted the district and its Board of Education for not establishing sufficient safeguards for computerized data and access to computers.

The report also noted that failure to appoint a claims auditor until Dec. 1, 2006, resulted in about $13.2 million from about 77 percent of all claims were not audited by the district and verified as accurate before payment. The report also faulted the school board and the district business administrator for not ensuring that staff accurately account for payroll-related transactions.

Because of the control weaknesses, state auditors reviewed 35 claims totaling $307,843 paid before Dec. 1, 2006, and 15 claims totaling $18,051 paid after that date.

“While our testing did not reveal any material discrepancies, the failure of the [school] board to ensure that claims are properly audited and approved prior to payment increases the risk … that errors and irregularities could occur,” the report stated.

Procedures have since changed, and a claims auditor was appointed Dec. 1, 2006. The auditor will report to the board on a regular basis, according to Sherman.

School board President F. Christian Spies said Wednesday that the board believes oversight has been sufficiently strengthened.

“The board is on top of it,” Spies said. “The board understands it and the board has properly addressed it.”

“We’re pleased to see that despite those weakness, [the auditors] found no wrongdoing on anyone’s part,” Spies said.

Sherman noted that he and Business Manager Robert Bonaker didn’t begin working for the district until July 2006. Over the period of the audit, there were also several changes in the seven-member school board, including its leadership.

“When we arrived, the [systems] infrastructure was in extremely poor shape,” Sherman said. “We started making changes before auditors even arrived.”

Computer systems were based on 1995 operating software, which didn’t allow sufficient protection or access limits for computers used by accounting staff or students.

Auditors found that unauthorized software had been added to at least one computer and that a system that records users’ key strokes to potentially track use had been added to another district desktop computer.

Administrators believe the key logger had been added by a student. While the administrator did not believe any sensitive data had been compromised, auditors noted they were unable to verify that because of a lack of records.

Nearly all computer systems have since been updated and better protections added, Sherman said.

Upgraded software cost about $70,000 a year over two years, Sherman said. The district was also operating on a restricted contingency budget in 2006-07, he noted, but the improvements received state aid.

Accounting software is expected to be fully updated by July 1, he said, and more secure password procedures are expected to be completed by September.

Bonaker referred questions about the audit to Sherman.

“It wasn’t so much the accounting as the information technology,” Sherman said.

Auditors also noted that the district buildings are in a potential flood zone. That potential puts data at risk of loss in a disaster.

Those have also been corrected, Sherman said, with backup data available to be taken off site. A new air-conditioned, locked room will also protect the main computer servers, he said.

Despite the criticisms, “we’re very pleased with the audit,” Sherman said.

“The report reinforced everything we [already] wanted to do … and it helped accelerate the process,” he said.

“We are well on our way in developing a rigorous action plan to respond to [auditors’] recommendations,” Sherman said in a response letter included in the Comptroller’s report.

Categories: Schenectady County

Leave a Reply