Operational Audit FY17

District records did not always evidence that impact fee proceeds were used only for authorized purposes, resulting in questioned costs of $13.6 million.

The District takes exception to this finding. As substantiated below, the District has expended impact fees only for authorized purposes, and as allowed by law. The school impact fees in question were levied pursuant to Lee County Ordinance No. 01-21, as amended by Ordinances Nos. 13-06 and 15-04, and as may be further amended (the “Impact Fee Ordinance”). The Impact Fee Ordinance is now found in Chapter 2, Article II, Division 6, Section 2-409 of the Land Development Code of Lee County, Florida (the “Land Development Code”).

Common law on impact fees in Florida was first enunciated by the Florida Supreme Court in the City of Dunedin v. Builders Association of Pinellas County (1976) case, involving imposition of impact fees for extension of water and sewer lines. While approving the ability of the City to collect such fees previously authorized by ordinance in 1972, the Supreme Court invalidated the ordinance because it failed to sufficiently restrict the use of the impact fees to expansion of the system, as opposed to replacement of existing facilities (which should be paid for by all customers in their monthly rates and charges and not just new customers). The City then adopted a new ordinance curing the prior defect, and obtained approval from the Second District Court of Appeal to expend impact fee moneys collected after the date of correction of the ordinance but paid under protest, on expanding the water and sewer system or paying debt service on its bonds issued in 1974 for the expansion of the system. Dunedin is the source of the “dual rational nexus” test, that is, (i) the impact fee must be reasonably connected to, or have a rational nexus with, the expenditure of the funds and the benefits accruing to new residential (in the case of schools) construction, and (ii) the local government must sufficiently earmark the funds for use in constructing facilities to benefit new users. “Rational nexus” means the local government must demonstrate a reasonable connection between the need for facilities and the growth in population, and a reasonable connection between the expenditure of the funds and the benefits accruing to the population paying the fees. In Dunedin the Supreme Court and the Second District Court of Appeal approved the use of impact fees to pay debt service on outstanding bonds previously issued to expand capacity. The School Board has restricted the use of impact fees collected within a particular attendance zone to make lease payments on impact fee eligible schools, or, according to Duncan Associates on a pro-rata portion of the cost of new administrative facilities serving such zone in accordance with the requirements of Section 2-409 of Division 6 of the Land Development Code, and has met both prongs of the Dunedin test.

The Impact Fee Ordinance was initially adopted in November 2001, and is now embodied as Division 6 of the Land Development Code. With certain exceptions, such as “communities for older persons”, commercial buildings, mobile home parks, communities providing mitigation of school impacts and other properties described in Section 2-412 of the Land Development Code, Section 2-405 requires payment of fees and Section 2-409 requires segregation of impact fees collected and expenditure only for capital improvements for educational facilities. The District has been divided into three “School Choice Zones” since the 2005-2006 school year, with a trust account for each service area, into which impact fees are deposited. The impact fees are to be used for the acquisition of school sites or the provision of facilities which will substantially benefit the residents of the school choice area, in accordance with a capital improvements program that has been approved by the Board of County Commissioners. So long as the School Board maintains a school choice system where noncharter school students must attend a school within the zone, then all funds must be spent within the zones where they are collected. Fees collected within one zone may be expended for capital improvements within another zone only if it can be demonstrated that the improvement will benefit the fee payers in the original school choice zone. Examples include magnet schools and administrative facilities. The current Impact Fee Study was prepared by Duncan Associates in January 2018. The study is updated every three years, to ensure that impact fees do not exceed reasonably anticipated costs associated with needed capital improvements. Duncan has been involved with the County since initiation of the education impact fee in 2001.

Section 2-409 of the Land Development Code specifically addresses bonding (or issuance of COP’s), as was involved in Dunedin. It provides: “Funds may be used or pledged in the course of bonding or other lawful financing techniques, so long as the proceeds raised thereby are used for the purpose of capital improvements for educational facilities. If these funds or pledge of funds are combined with other revenue sources in a dual or multipurpose bond issue or other revenue raising device, the proceeds raised thereby must be divided and segregated such that the amount of the proceeds reserved for educational facility purposes bears the same ratio to the total funds collected that the school impact fee funds used or pledged bear to the total funds used or pledged.”

Questions have been raised whether the School Board may use educational impact fees in future years to make basic lease payments under its Master Lease Program which are then used to pay principal and interest on Certificates of Participation (“COP’s) issued in previous years. By law, COP’s may have a term as long as 30 years, so theoretically the School Board could finance the construction of an impact fee eligible growth school over 30 years. Lease payments are appropriated annually by the School Board, so it never obligates itself to make payments for more than a year at a time. The 1991 Master Lease provides that lease payments can be made from “current or other funds authorized by law and appropriated for such purpose by the School Board”. Although capital outlay millage is the primary source, any other funds that are legally available may be used. Impact fees are one of those sources. Other projects that are ineligible for impact fees can be and have been included in the same COP financing but have been and will continue to be paid from other legally available sources such as capital outlay millage. Facilities financed from the Series 2002A and 2004A COP’s were new elementary, middle, high and K-8 schools providing expanded capacity for future residents and are impact fee eligible. Other facilities in the same COP issues were administrative in nature and must be paid from capital outlay millage.

Contrary to State law, the District expended ad valorem tax levy proceeds for cleaning and groundskeeping services that did not appear to be allowable uses for the proceeds, resulting in questioned costs totaling $3.9 million.

The District takes exception to this finding. The District has provided evidence that demonstrates funds expended meet requirements of the law and are allowable expenses. The short version of the Audit Finding makes it appear, incorrectly, that the District spent $4.2 million to clean and maintain grounds. The District has provided documentation that the items considered by the State as cleaning and maintaining grounds met the Safety to Life criteria and are therefore allowable expenses. In addition, the State is questioning services related to mold remediation and indoor air quality as not allowable expenditures. Within Florida Statute 468.84, “Mold-related services licensing program; legislative purpose” we find legislation stating the nature of mold related services are required in the interest of public safety and welfare:

The Legislature finds it necessary in the interest of the public safety and welfare, to prevent damage to real and personal property, to avert economic injury to the residents of this state, and to regulate persons and companies that hold themselves out to the public as qualified to perform mold-related services.

Florida Statute 1011.71 (2)(g) allows “Payment of costs directly related to complying with state and federal environmental statutes, rules, and regulations governing school facilities”. Mold remediation is a service required by statute to be supported to maintain public safety, and therefore is allowable and an authorized purpose.

It should also be noted that during the initial audit and original exit conference on October 2, 2017, this finding was not identified through sampling of expenses.

A standard audit practice is to consider a 10% sampling of data as reasonable. According to the Public Company Accounting Oversight Board Under AS 2315: Audit Sampling number .34 (please see below) for a low level control risk a tolerable rate of 5 percent would be reasonable but if a high risk level is desired then 10 percent would be reasonable.

“.34 The auditor should determine the maximum rate of deviations from the prescribed control that he would be willing to accept without altering his planned assessed level of control risk. This is the tolerable rate. In determining the tolerable rate, the auditor should consider (a) the planned assessed level of control risk, and (b) the degree of assurance desired by the evidential matter in the sample. For example, if the auditor plans to assess control risk at a low level, and he desires a high degree of assurance from the evidential matter provided by the sample for tests of controls (i.e., not perform other tests of controls for the assertion), he might decide that a tolerable rate of 5 percent or possibly less would be reasonable. If the auditor either plans to assess control risk at a higher level, or he desires assurance from other tests of controls along with that provided by the sample (such as inquiries of appropriate entity personnel or observation of the application of the policy or procedure), the auditor might decide that a tolerable rate of 10 percent or more is reasonable.”

District Staff pulled a sampling of over 11% of the items directly related to the items in question from this finding. Our percentage of sampling is even higher than the highest amount recommended by the best practice sampling method. In the District’s sampling, we identified one item totaling $10,956 that could possibly be questionable due to its description: repairing uneven turf on the football field at Fort Myers High School. However the work was performed to ensure the safety of students and to prevent injuries, all within Safety to Life criteria, and thus allowable. All other items clearly fall within Florida Statute 1011.71 (2)(g) “Payment of costs directly related to complying with state and federal environmental statutes, rules, and regulations governing school facilities”.

The chart below represents the sampling and the columns are as follows:

• “Purpose” = Information provided by auditors
• “Facility Name” = District Facility where work was completed
• “Supplemental Work Description” = Description of work completed and reason

After the initial and second exit conference on July 23, 2018, this finding has been adjusted again to add additional items regarding previous year’s findings in Fiscal Years 2013-14 and 2010-11, implying that these are the same findings as in past years. The only similarity is that it is in regards to Ad Valorem taxes which is approximately 90% of the capital budget and where the majority of the capital expenditures occur. In the previous years the finding was related to transfers to the general fund to cover capital expenses, and in 2010-11 a portion of the amount identified in the finding was found to be allowable by the State. Then in 2013-14 the State identified the same finding and refused to accept the response that the State had previously accepted.

View the Chart of Sampled Items

District controls over indoor air quality (IAQ) services and related payments did not ensure that District records documented:

• Evaluations of the need for the various IAQ services before the District contacted service providers and contracted for the services with related payments totaling $5.9 million.
• Cost-benefit considerations to demonstrate the cost-effectiveness of contracting with an IAQ provider for both emergency services and services that did not require immediate attention.
• Verifications that the personnel who performed the services possessed the contract-required license and certificate qualifications or that the services were performed by the most qualified service provider.
• The reasonableness and propriety of negotiated contract rates.
• Prior to payment for the contracted services, the satisfactory receipt of the services performed consistent with the Board-approved contracts.

Additionally, District IAQ contracts did not contain maximum contract amounts to help the District monitor and limit the services provided and related costs. Also, the District made payments for cleaning services that appeared to be charged at rates for mold remediation rather than room cleaning services, resulting in questioned costs of $291,126.

The District takes exception to this finding. Lee County is located in Southwest Florida where humidity and moisture are at very high levels year round. The District and the public are keenly aware of the District’s responsibility to provide students and staff with educational spaces that are safe and healthy, including free of air pollutants and mold. With over 13,200,000 square feet of facilities, and 43 of our campuses with buildings between 42 – 103 years old, the demand for IAQ services has existed continuously for years. In the most recent decade, decreased funding for capital projects including emergency and preventative maintenance for roofs and HVAC systems has been a contributing factor for the ongoing need for IAQ services. In 2013 as the 2010 contract for IAQ services neared expiration, the District was proactive, evaluating the need for continued service, and competitively awarding an on-demand contract with prenegotiated rates in advance of the need for service - a best practice that locked in fixed rates for the 5-year contract duration. The contract scope required contractors to respond to emergencies within one hour; and to respond to non-emergency situations in four hours; reflecting the urgent nature of all IAQ services. The School Board publicly approved the contract and base year expenditure in 2013 and the Board publicly approved each subsequent years’ expenditures for IAQ services for each remaining contract period, with a not-to-exceed annual cost each time. This information, coupled with the detailed information regarding the competitive solicitation process described by the State in its’ audit, reveal the District’s documented need for IAQ services; the proper execution of a public, competitive solicitation process to acquire services; and public approval of a not to exceed contract amount for each contract year. Additionally, it would have been an ineffective use of taxpayer dollars to publish, negotiate, award and administer separate contracts for emergency and non-emergency services, due to response time requirements that varied minimally.

In addition to the State’s summary of the IAQ Services contract, which provides ample evidence of the District’s compliance with competitive purchasing rules and regulations, the District provides the following information that further demonstrates the District’s execution of best practices in public purchasing and project execution.The District conducted planning and created documentation that evidenced the need for IAQ Services and a plan to procure the services, in advance of the release of a competitive solicitation for services, which replaced an expiring contract for similar services.

In February 2013, as a result of discussions between the District IAQ team and Procurement staff regarding the need for continued IAQ services and the most economical method to procure them, it was determined to pursue an Invitation to Negotiate as the preferred solicitation method. This decision was documented in the document titled “7103SM Justification of ITN in lieu of Bid.”

An evaluation committee meeting was held on May 9, 2013, at 9:00 am with the District Indoor Air Quality Supervisor and staff, and Procurement staff. Past services utilized, and the need, type, and quantity of continued services was further discussed and documented, in advance of the solicitation publication. The meeting minutes were previously provided to the State. In the District’s opinion, District IAQ subject matter experts who oversee IAQ projects are the best resources to determine the need for continued IAQ services in District facilities. They did so, and the analysis was documented.

A review by the evaluation committee of the historical and continued need for IAQ services revealed future service costs would exceed $25,000. School Board policy required competitive solicitations for services in excess of $25,000 annually, so staff proceeded with developing the requirements for IAQ services. The requirements were formally documented in Invitation to Negotiate #137103SM and released to the public. As stated in the RFP:

Some examples of requirements include providing IAQ related investigation, defining work scope, testifying in legal proceedings, environmental test samples, asbestos abatement, lead abatement, HVAC services, water damage repair, mold remediation, drywall repair, floor and ceiling repairs, painting and general cleaning at approximately 106 facilities including schools and administrative sites

As demonstrated with the 18 certifications received from the two contracted firms and their staff, personnel who performed the services possessed the industry standard certifications to perform the services.

Contract Category A work required 13 total certifications:

* One contractor submitted 13 of the 13 requested certifications for Category A
* Another contractor did not submit a proposal to perform work in Category A

Contract Category B required 6 total certifications:

* One contractor submitted 6 of 6 certifications for Category B
* One contractor submitted 5 of 6 certifications for Category B and has since submitted to the District the 6th certification

Based on their qualifications, the two awarded contractors were both deemed qualified to perform the services requested. During the contract price negotiation process, the District intentionally negotiated identical rates with both contractors, so that either qualified contractor could perform requested services, based on District demand and contractor resource availability – without having to evaluate cost each time. The awarded contractors had also provided fixed rate services under the prior District contract. The District deemed it fair and reasonable to increase rates one time over an 8 year period, to equate to less than the annual average increase of 4-5% annually used by other government entities. Failure to accommodate rate increases for eight years would result in decreased competition and the possibility that no Contractors would be willing to perform the required services. In addition, during negotiations the District targeted lower rate increases for services used most frequently.

Based on the annual spend from 2010 through 2017, the negotiation strategies to control cost increases were successful. Although the number of district buildings increased with the addition of new schools, and buildings aged and realized increased opportunities to require air quality service, the annual expenditures for the contract in the 8 year period grew only moderately including the support of the Hurricane Irma aftermath – which is a 7% increase from the prior contract to the current contract.

In addition, during the new contract planning process, the District made the focused decision to convert the price structure for services from linear foot to labor hours in an attempt to control costs. The spreadsheet previously provided to the State was created by the evaluation team based on estimated labor hours to perform the linear foot work. Converting from linear foot to hourly labor rates was anticipated to control the overall contract costs.

After the contract was awarded to two businesses, the evaluation for services occurred as each situation presented itself – on a case-by-case basis, and in consideration of the need for services in Category A or B. When a problem or suspected problem was reported by school officials, the District process, as documented in the IAQ Process Document, was executed. District Maintenance Staff contacted contractors for service, and monitored each project as the contractors performed their service.

The District agrees that some invoices for IAQ services were submitted for a total project cost, and did not include a breakdown of the project cost by hourly rate. The District has formally notified both firms, in writing, that all future invoices are required to contain a breakdown of services provided. The District respectfully disagrees that timesheets for contractors are required to be submitted to the District to justify work performed. Projects are supervised by District staff, who also review invoices to validate level of effort.

The District requested the State to provide evidence that it is a best practice for contractors to submit their timesheets to the government when providing services, or that any other district follows this practice. We have not received these items.

District procedures did not provide, before payments for construction management entity (CME) services, for comparisons of CME pay requests to the subcontractor bids and contracts for the Dunbar High School Remodel (DHSR) and the Bonita Springs High School (BSHS) Projects totaling $64.4 million.

The District takes exception to this finding. The District consistently reviews monthly payment applications from CME line item values as stipulated in the GMP, submitted for approval by the District following the competitive bidding process. The GMP line item values are the basis of the monthly payment application submission. The District reviews subcontract competitive bids with the CME prior to GMP creation, and prior to CME contracting with subcontractor entities. District Facility Engineers field verify actual monthly work progress in conjunction with Project Architects and Engineers, to verify accuracy of CME payment applications against the District approved GMP. The District utilized the AIA billing system (Document G702: Application and Certificate for Payment) which requires the construction manager to provide information according to the status of the total dollar amount of work completed during the construction project, the sum of any previous payments, descriptions of any change orders, the amount of any retainage, and the sum of the requested payment. The information contained in the document is certified by the project architect and then reviewed by District Staff using the “Checklist for Payment Application” prior to a multi-signature approval.

The statement that the District’s ability to recover overpayment amounts is limited because the CPA firm services are provided after projects are completed and payments are made to the CME’s is misleading. Pursuant to Section 255.078, Florida Statutes, the District retains a minimum of 5% of the construction contract amount until after the project is completed and audited by an external CPA firm and Board Approved for the final retainage to be paid to the construction manager. Should the audit find any overpayments, the District reserves the right to recover via the retained funds.

The District has updated the “Checklist for Payment Application” for all construction projects to document a thorough review of CME pay applications to ensure all billing is performed in accordance to the schedule of values in contracts and the contractors/subcontractors are submitting all required paperwork, including bids, prior to making payment. The District has also engaged with an external legal consultant to develop a CME contract template that provides for open and transparent general conditions reporting.

Additional note: The District previously received communication from the auditor on October 9, 2017, stating this particular finding would be removed as a result of reviewing the project audit reports performed by an external CPA for the projects in question.

District construction administration procedures for the DHSR and BSHS Projects did not include comparisons of subcontractor bid awards to the CME subcontractor contracts to verify that the CME used a competitive selection process to select subcontractors and that the bid award and contract amounts agreed.

The District agrees in part with the finding. While the District acknowledges copies of CME subcontracts were not maintained in file, it does not negate the fact that the subcontract work scope was in fact publicly advertised and competitively bid. The CME opens all bids with the District staff in presence during the bid openings. The CME compiles and qualifies all bids, and provides a GMP submission to the District for approval (lowest qualified bids are used). The District does not review subcontracts engaged between the CME and Subcontractors, as the only legal binding document is the GMP engaged between the District and CME. Contractual language in the District CME contract stipulates that line items within the GMP are not guaranteed, and allows for CME to adjust GMP lines as needed. However the GMP is fixed and cannot be increased without District approved change order process. Following are documented examples of this requirement, extracted from the Bonita Springs High School and Dunbar contracts:

Bonita Springs High School Contract Section 5.3 – Construction Phase

“For each line item in the GMP Amendment, Construction Manager shall develop and maintain a written report which identifies and explains all variances and deviations from the bid amount originally submitted for that line item, to the final line item price incorporated into the GMP. Notwithstanding the foregoing the Construction Manager and Owner agree that the amounts of any particular line items in the schedule of values is not guaranteed.”

Dunbar High School Contract Section 5.3 – Construction Phase

“Notwithstanding the foregoing the Construction Manager and Owner agree that the amounts of any particular line items in the schedule of values is not guaranteed. The final cost of any particular line item may be more or less than the amount set forth in such line item in the schedule of values. Thus, the amounts set forth for particular line items are not guaranteed, but Construction Manager guarantees that in no event shall the Construction Management Fee and the total Cost of the Work exceed the GMP, as the GMP may be adjusted pursuant to the terms herein for Change Orders and Construction Change Directives.”

The current District practice, adopted in 2018, requires staff to maintain an attendance sheet for all subcontractor bid openings that clearly states the time, date, and location of the opening as well as the printed names, signatures, contact information, and represented entity for all attendees including District staff. District staff will also be required to sign all bid tabulation sheets during subcontractor bid openings on future projects. Current practice also requires staff to obtain and record, after the bid opening, all associated bid documents and subcontractor contracts in order to verify, in the form of a report, that the construction manager used a competitive selection process to select subcontractors and ensure services are obtained at the lowest cost consistent with acceptable quality and that maximum cost savings under the GMP contracts are realized.

Additional note: The District previously received communication from the auditor on October 9, 2017, stating this particular finding would be removed as a result of reviewing the project audit reports performed by an external CPA for the projects in question.<

The District did not verify subcontractor licenses before the subcontractors commenced work on the DHSR and BSHS Projects.

The District agrees in part with this finding. The District has consistently held the construction manager responsible for maintaining documentation verifying subcontractor licenses before commencing work. To strengthen oversight, the current District practice contractually requires construction managers provide staff with a list of valid and current subcontractor licenses as an attachment to the GMP prior to the execution of the contract.

The District needs to enhance controls over negotiating, monitoring, and documenting the reasonableness of CME general conditions costs.

The District agrees with this finding. Current District CME contracts, developed in consultation with an external legal professional, no longer include general conditions within an all-inclusive construction management fee as negotiated in previous projects. General conditions are now listed as line items within the contract to enable external CPA review for accuracy and costing. Current policy for negotiating contract general conditions is based on best practice and consultation with peer Districts. The District acknowledges that such an action may result in higher projects costs due to the additional auditing services not necessary in the previous practice of construction management fees inclusive of general conditions.

Additional note: The District previously received communication from the auditor on October 9, 2017, stating this particular finding would be removed as a result of reviewing the project audit reports performed by an external CPA for the projects in question.

District records did not always demonstrate that the District performed searches of prospective school volunteer names and information against the applicable registration information regarding sexual predators and sexual offenders.

The District agrees with this finding. The District understands the severity and importance of supervising volunteers in our schools. Each school is responsible to submit volunteers for an FDLE Sexual Predator background screening. This background screening is required and must be completed and documented annually for each volunteer (including returning volunteers) and approved by the Principal before volunteers participate on school campuses. The school Principal has the final decision to accept or deny volunteers. Volunteer applications and screenings are kept on file at individual schools. Volunteers are required to login/logout for identification purposes and to wear their volunteer name badge while on campus. The District commits to educating Principals annually, at the start of the school year, of the requirements to be followed regarding background checks for all volunteers; and to conduct periodic audits to ensure background checks are conducted as required.

On Monday, August 20, 2018, Principals attended a webinar on this subject, which was recorded to be accessible to Principals and District Staff throughout the year.

The District needs to establish a mechanism for noninstructional employees to report time worked and procedures requiring supervisors to document the review and approval of such time.

The District takes exception to this finding. As stated in response to an inquiry during the audit, the District shared that non-instructional personnel are required to use the LeeClock electronic sign in/out application. In addition, the prior response stated that many locations also use a paper sign in/out book. The Fair Labor Standards Act does not require exempt employees to report time, as they are paid on a salary basis. The performance of exempt employees is measured by supervisor review of performance and employee output, on a regular basis. Board approved job descriptions are in place for exempt employee positions and define the expectations of the positions. Written evaluations for exempt employees are captured in the performance evaluation.

The District did not always base the eligibility of teachers for Florida Best and Brightest Teacher Scholarship awards on reliable and authentic records.

The District takes exception to this finding. The State of Florida's Best and Brightest Scholarship Program has been amended by the Legislature each year since its inception. Constant changes have placed a burden on staff responsible for administering the program both at the Florida Department of Education (FLDOE) and at the District. The statutory language is ambiguous and vague. The District has contacted FLDOE on numerous occasions for guidance from FLDOE, since the language is minimal and does not provide the District with clear direction on how to ensure compliance with the statutory language. The District has made a continuous effort to formalize and continuously improve procedures, now that the program has been extended to be a multi-year program. The District has identified steps that need to be taken to ensure the collection of reliable and authentic records. The District has engaged key-stakeholders and is working to address procedural challenges that have come about as the result of the ambiguous statutory language and the delay in feedback from the State. With respect to charter schools, the District does not have access to charter school employee records. Therefore we request the charter schools validate their lists based on their employee performance data in advance of sending the lists to the District (in about December) and before funds are disbursed (approximately in March).

The District controls for monitoring school resource officer service contracts and related payments could be enhanced.

The District takes exception to this finding. The District collaborates with the Lee County Sheriff's Office to include School Resource Officers as part of the District's security program. Interlocal agreements capture the contractual requirements for this service. District Administrators at each location review the performance of the assigned Sheriffs on a regular basis. In the event unsatisfactory performance is received, the District would communicate the issue to the Sheriff's Youth Services Supervisors. Performance is not measured by hours on site, rather by fulfillment of contractual obligations. If there is a responsibility for validating number of hours worked by individual Sheriff staff members, the responsibility would be incumbent on the Lee County Sheriff's Office, not the District.

District controls over the purchasing card program continue to need improvement.

The District agrees in part with this finding. The $999.99 P-Card limit is for one single item. The current P-Card Policy states that charges for purchases shall not be split to stay within the SINGLE ITEM purchase limit. The reason for the P-Card limit is to ensure Capital items valued at $1000 or more are ordered through the PeopleSoft system to ensure asset tagging. In addition, the current P-Card Policy allows travel related expenses to be purchased via P-Card in amounts not to exceed $4,999.99. Because travel is often scheduled for multiple staff members to attend a training session, it is more efficient to consolidate purchases for travel expenses into fewer transactions.

The District had not developed a comprehensive, written information technology (IT) risk assessment.

The District agrees with this finding and is already in the process of developing a comprehensive risk assessment and mitigation program to include a combination of binary risk analysis tools and an adaptation of the Factor Analysis of Information Risk (FAIR) model. The District engaged the services of United Data Technologies to perform a comprehensive security and risk assessment. We are in the process of reviewing their findings and recommendations and developing an action plan based upon the report. We engage Microsoft to perform an Active Directory review (ADRAP) biannually to review account security and policy management.

The existence of some unnecessary IT user access privileges and the lack of documented periodic reviews of access privileges increased the risk that unauthorized disclosure of student social security numbers may occur.

The District agrees with this finding, and is in the process of implementing a periodic review process to ensure that access to SSNs via the student information system (SIS) are reviewed and access no longer needed is terminated in a timely basis.

Certain District IT security controls related to user authentication, data loss prevention, and logging and monitoring of system activity need improvement.

The District agrees with the finding related to log analysis tools and has submitted a FY19 budget request for those solutions.

The District does not agree with the finding related to the number of unsuccessful login attempts, as the policy was designed with specific goals in mind, while allowing for mitigation of the risks for which the finding is targeted.