State of New Jersey Office of the State Comptroller PROSPECT PARK SCHOOL DISTRICT A PERFORMANCE AUDIT OF SELECTED FISCAL AND OPERATING PRACTICES PHILIP JAMES DEGNAN State Comptroller AJunJuen 9,201520 May 30, 2019 Prospect Park TABLE OF CONTENTS BACKGROUND............................................................. 1 AUDIT OBJECTIVE, SCOPE, AND METHODOLOGY ... 2 SUMMARY OF AUDIT RESULTS ................................. 3 AUDIT FINDINGS AND RECOMMENDATIONS .......... 4 Information Technology ...................................... 4 Longevity Payments .............................................. 7 Substitute Teachers .............................................. 8 REPORTING REQUIREMENTS ................................. 10 AUDITEE RESPONSE .................................... Appendix A BACKGROUND The Borough of Prospect Park School District (Prospect Park or the District), located in Passaic County, operates a K-8 school with approximately 900 students. In Fiscal Year (FY) 2017, Prospect Park employed 111 full-time equivalent employees, reported total revenue of $13.4 million, expended about $13.1 million including approximately $7.5 million for payroll, and received $9.3 million, or 69 percent, of its total revenue in State Aid. The District is governed by the Prospect Park Board of Education (the Board), which consists of seven elected officials. The Board appoints the superintendent, who is responsible for the overall administration of the District. The management of Prospect Park is responsible for establishing and maintaining an internal control structure designed to ensure that the assets of the District are protected from theft, loss, or misuse. 1 AUDIT OBJECTIVE, SCOPE AND METHODOLOGY The objective of our performance audit was to review the District’s controls over selected fiscal and operating practices. Our audit covered the period July 1, 2015 through June 30, 2017. To accomplish our objectives, we reviewed relevant laws, regulations, policies and procedures, collective bargaining agreements (CBAs), as well as individual employment and vendor contracts. We examined Board meeting minutes and resolutions, audit reports, and financial records, including budget reports and supporting documentation for selected financial transactions. We also interviewed certain Prospect Park personnel to obtain an understanding of their job responsibilities, overall operations, and the internal controls. As part of our review, we selected a judgmental sample of employee payroll and benefit payments and expenditures. We also reviewed the District’s contract for Information Technology (IT) services. Our samples were designed to provide conclusions about the validity of the sampled transactions and the adequacy of internal controls and compliance with applicable laws, regulations, policies, and procedures with regard to the same. We used a non-statistical sampling approach, therefore, the results of our testing cannot be projected over the entire population of like transactions. This audit was performed pursuant to the State Comptroller’s authority set forth in N.J.S.A. 52:15C-1 et seq. We conducted our audit in accordance with Generally Accepted Government Auditing Standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based upon our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. 2 SUMMARY OF AUDIT RESULTS Our audit identified weaknesses with certain District fiscal and operating practices and identified opportunities for potential cost savings. Generally, Prospect Park lacks key internal controls for the management and administration of certain IT functions, failed to comply with certain policies and state requirements, and lacked appropriate and necessary details in a substitute teacher staffing contract. Specifically, our audit found that Prospect Park: • Failed to develop a formal IT Disaster Recovery Plan pursuant to state requirements. • Did not maintain accurate inventory records of its IT assets or conduct periodic verifications of such assets as required by District policy. • Issued annual longevity payments to employees, the calculation of which included years of service from districts outside Prospect Park. • Executed an agreement for substitute teacher staffing services without a detailed scope of work or standard terms and conditions. • Did not maintain evidence of a completed background check for all substitute teachers. Through development of stronger policies and procedures, Prospect Park would be better positioned to improve its monitoring and oversight, provide greater efficiencies in operational practices, and achieve compliance with state statutes and regulations, and internal policies and procedures. OSC makes six recommendations to enhance Prospect Park’s monitoring and oversight of fiscal and business operations. 3 AUDIT FINDINGS AND RECOMMENDATIONS Information Technology The District has not implemented a Disaster Recovery Plan. Internal controls over inventory records need to be improved. ____________________________________________________________ Disaster Recovery Program School districts are responsible for establishing and maintaining student and financial data and for taking appropriate measures to ensure the preservation of such data and records in the event of an emergency or disaster. Districts also are required to establish a plan (i.e., Disaster Recovery Plan) for the recovery of such vital information in the event of an emergency or disaster to ensure continuity of school operations. See N.J.A.C. 15:32.5. During the course of our audit, we examined Prospect Park’s performance with regard to protecting its vital computer data and information as referenced above. We found that Prospect Park failed to establish a Disaster Recovery Plan as required. Even more troubling, we found that District officials were unaware that such a plan had not been put in place notwithstanding that the District had been subject to a cybersecurity attack in the past. We note that the District has outsourced the majority of its IT functions to a private vendor and that the scope of work for the contract includes certain disaster-related responsibilities such as maintaining critical data at an offsite location. While those responsibilities may be component parts of a Disaster Recovery Plan, they do not relieve the District of its obligation to establish and maintain the robust recovery plan required by state regulation. Technology Inventory District policy requires that all computer and technology assets be tagged and inventoried. The policy further requires that periodic verification be performed to ensure 4 and/or verify (1) the asset is still in use, (2) the current location of the asset, and (3) that the inventory listing is accurate and includes all assets. The District’s IT vendor is contractually responsible for verifying the technology inventory. Contrary to its own policy and internal controls, Prospect Park did not maintain a complete or accurate inventory of its IT assets. During the course of our audit, the IT vendor’s specialist provided us with an inventory list that included 1,297 items, consisting of computers, monitors, printers, and televisions. The inventory list, however, did not include all necessary information to appropriately track each asset. For example, the list did not include a unique identifier for each asset (i.e., serial number or tag number), nor did it document the current location of each asset or the name of the employee assigned to use the same. Our audit included verifying the asset’s existence and location for a judgmentally selected sample of 374 items, consisting primarily of high dollar value assets. Our audit concluded that Prospect Park did not maintain an adequate inventory system for its IT assets and had not maintained an accurate or complete inventory record. These conclusions indicate that the District was unaware of its total IT assets, the location of the assets, and the employees assigned to use the assets. These deficiencies create a significant risk of loss or theft of District IT property. We discuss our specific findings more fully below. The actual number of assets located did not reconcile to the District’s inventory records. Of the 374 sampled items, 162 computers and monitors could not be verified because the District was unaware of their current locations. The District records noted 53 iPads compared to our count of 78, this difference of 25 iPads represents a 47 percent discrepancy. The District’s failure to implement adequate inventory controls over its IT assets or to comply with its policies and procedures is troubling considering these are easily transportable items of high value and more susceptible to theft. 5 The results of our inventory count are summarized in the chart below: Asset Type District Asset Count OSC Actual Count Difference iPads, Tablets, and Laptops 59 84 25 Desktop computers 100 96 (4) Printers 29 29 0 TVs and Miscellaneous 24 18 (6) 212 227 Grand Total Recommendations 1. Establish and maintain a Disaster Recovery Plan pursuant to state requirements. The scope of the plan should be aligned with risks relative to the loss of records stored on the systems and include a requirement for off-site data storage retention. 2. Develop a process to comply with its policy for maintaining complete and accurate IT asset inventory records and conducting periodic verifications of those records to capture any changes. After developing that process, the District should conduct an initial inventory of its IT assets. That inventory should include relevant details for each IT asset such as the type of asset, serial number, any District identifying tag, location, and the name of the employee assigned to use the asset. 6 Longevity Payments Longevity payments are issued to some employees based in part on their prior service in other school districts or even private schools. Employees of the Prospect Park School District may earn longevity bonuses pursuant to terms and conditions set forth in the District’s Collective Bargaining Agreement (CBA). For employees hired before July 1, 2005, the annual longevity payments range from a minimum of $600 for 5 years of service to as much as $5,000 for 30 years of service. Employees hired after July 1, 2005 receive longevity payments beginning with the completion of 10 years of service. The CBA defines service time based on total work in any “public or private schools,” as long as the employee worked his or her last three years in Prospect Park. This practice of factoring in prior service time for non-District employment does not comport with the intent of a longevity program which is to recognize an employee’s continued service with the same employer. Furthermore, by comparison, the District’s practice of providing longevity payments is more generous when compared to state employee benefits that do not include recognition of service time through longevity payments. During FYs 2016 and 2017, Prospect Park paid 59 employees approximately $239,000 in total for longevity payments. Our review noted that approximately $36,000, or about 15 percent, of the total payments was based in part on non-District service. Recommendation 3. In future Collective Bargaining Agreement negotiations, eliminate the longevity payments. At a minimum, longevity payments should be limited to service within the Prospect Park School District. 7 Substitute Teachers The contract for substitute teacher staffing services lacks sufficient details of the obligations and responsibilities of the vendor. In addition, Prospect Park did not provide evidence that required background checks had been completed for all substitute teachers. Substitute Teacher Staffing Contract Prospect Park outsources its substitute teacher staffing services through a contract with an outside vendor. Prospect Park advised OSC auditors that its staffing services vendor is responsible for interviewing, hiring, and conducting criminal background checks for all substitute teachers. OSC reviewed the details of the staffing services contract and found that it lacked sufficient details concerning the scope of work, the services to be provided, and other important provisions pertaining to the responsibilities of the parties. The agreement does not include any provisions concerning criminal background checks, discipline, performance evaluations, or other customary terms and conditions such as a termination clause. Background Checks Pursuant to N.J.S.A. 18A:6-7.1, background checks must be conducted for any employee, including substitute teachers, working in a school district. District officials advised OSC auditors that they rely on their staffing services vendor to ensure that required background checks are completed. We note that the District itself does not maintain appropriate documentation demonstrating that background checks have been completed for all substitute teachers. Instead, the District relies upon its vendor to maintain such information. Our audit included verification with the Department of Education (DOE) to ensure that background checks had been properly conducted for the substitute teachers selected for our testing. Our sample included all 132 substitute teachers paid in FYs 2016 and 2017 and an additional 15 substitute teachers that we randomly selected from the substitute teacher list maintained by the District. DOE advised OSC that all 147 substitute teachers had 8 completed background checks. DOE noted, however, that for 55 of the 147 substitute teachers, (or 37 percent), evidence of a completed background check had not been transferred to Prospect Park as required. Recommendations 4. The contract for substitute teacher staffing services should include sufficient details regarding the scope of work and services to be provided, the responsibilities of the parties to the agreement as noted in this report, and all other relevant and appropriate terms and conditions. 5. Develop a process to ensure that evidence of a completed background check for all substitute teachers is maintained. 6. Implement a process to ensure that background checks for substitute teachers are current and transferred to the District pursuant to the Department of Education regulations and policies. 9 REPORTING REQUIREMENTS We provided a draft copy of this report to Prospect Park School District officials for their review and comment. In general, Prospect Park School District officials agreed with the audit findings and conclusions and their response indicated they intend to initiate corrective actions. Their comments were considered in preparing our final report and are attached as Appendix A. The Office of the State Comptroller is required by statute to monitor the implementation of our recommendations. To meet this requirement and in accordance with N.J.A.C. 17:44-2.8(a), following the distribution of the final audit Report, Prospect Park School District shall report to the Office of the State Comptroller within 90 days stating the corrective action taken or underway to implement the recommendations contained in the report and, if not implemented, the reason therefore. This Office will review the implementation of the corrective action plan. On behalf of OSC, I thank the management and staff of the Prospect Park School District for the courtesies and cooperation extended to our auditors during this engagement. 10 Appendix A - Auditee Response SUPERINTENDENT PROSPECT PARK BOARD OF EDUCATION 290 NORTH 8TH STREET PROSPECT PARK, NJ 07508 PHONE: (973) 720-1981 FAX: (973) 720-1992 District Website: May 14, 2019 Ms. Yvonne Tierney, CPA Director, Audit Division Office of the State Comptroller P.O. Box 024 Trenton, NJ 08625-0024 Re: Prospect Park Performance Audit Dear Ms. Tierney, We are in receipt of the audit findings dated April 17, 2019. As such, please be advised of the following: Information Technology Prospect Park does sub-contract with Northern Region Educational Services Commission (NRESC) for its technology staff and services. The entire district?s financial and personnel data is compiled and stored with Computer Solutions Inc. and all student information with Realtime Information Technology, Inc. The district does need to improve upon and create a more thorough disaster plan. The district will research and contract with a disaster recovery company. As for the technology inventory, the district agrees that a more concise inventory system must be put in place and include better checks and balances. This was not maintained appropriately by the current contracted technology services. Therefore, the district will complete the inventory procedure within the scheduled timeframe identified to ensure accuracy. Moving forward, this procedure will be undertaken on a regular basis with documentation maintained. Substitute Teachers Prospect Park does contract with Northern Regional Educational Services Commission for Substitute Teachers. The district does pay an annual fee to NRESC to create a pool of substitute teachers that are made available to us on a daily basis. As part of that fee, NRESC performs all criminal background checks and required training on our behalf before declaring an individual eligible to substitute teach in Prospect Park or any school district that they serve. This service saves the school district a great deal of time and money not having to perform the necessary hiring practices. During the audit, a sampling did initially uncover some background checks were not available within the NJDOE. Fortunately, each substitute in question was eventually determined to be eligible and background checks had been completed. Moving forward, the district will con?rm a substitute is an approved applicant through the Office of Student Protection and keep a copy of the approval with all documents required for district employees. Longevity Payments Longevity payments are part of the negotiated contract with the Teachers Association of Prospect Park and have been a part of the agreement for many years. As noted in the audit, tenured employees do receive credit for service from other districts prior to being employed by Prospect Park. As the current teachers? contract is expiring, it will be suggested to the Board of Education to temper longevity in future contracts as recommended in this audit. Please feel free to contact me with any further questions.