Brad Freeman (Audit Supervisor)
Page 11 – Internal Audit – We can’t stress enough to get an internal audit function to look over all processes, not just financial or school activity accounts. All processes … financial, compliance and operations. They should be focusing on all of those areas. You see APS. They got hit with a big operation with the test scores. You should have an internal audit process in place to look into operations, compliance, state, federal, local, board policies and your financial aspects. That would include your expenditures being approved based on board policy, is access in place. They should make sure the controls in place are operating effectively. That’d be your internal audit function. We can’t stress enough to get an internal audit function in place.
Dr. Cheryl Atkinson
You’re saying get an internal audit function in place as if the district didn’t have that. The district has had an internal auditor in place since I’ve been on board. At the time there were still issues that had not been addressed.
What I will say is, we will still have an internal audit function, but when we debriefed, it was my understanding that there were some issues with regards to where different audit functions were sitting. And, they shouldn’t have been auditing that which they were also responsible for. We have now dis-aggregated that and separated that so the person purchasing is not the person auditing. That was the issue I had. We will have internal audit functions specifically based on your recommendations.
Jay Cunningham [00:04:02]
I think SACS took this same recommendation that was brought through this audit committee and charged us to hire somebody, or have somebody in that particular position. Then we ran into the problem of who they report to. I feel like we half way met that. What I’m reading here and what that person is doing is the difference between night and day.
What I’m hearing from you is that people aren’t auditing themselves. The board needs to see that this is being done within our budget guidelines. It talks about the school house and then you’re talking about grades. The next thing I’ll look for is how you’re going to set this up and how it’s going to function within the school system. I’m sure when SACS comes back, they’re going to be asking us the same thing. Now that this person is gone, we need to be able to answer how this is functioning.
Atkinson
When I came into the district, I was floored by what I thought was an excellent process around … he made mention of APS and the testing issue. I think DeKalb has a very good, stringent check and balance around its test data and procedures. The state also has good ways of verifying and giving you any red flags. I think we have a tight process.
We are working on their recommendations around some of the other areas. When we get those people, or that system setup, I’ll certainly share with the board what that looks like.
Cunningham
As we hire those people, do we have something in place … checks and balances.
Atkinson
Yes. We have more than one person dealing with the internal audit function.
Freeman
Your internal audit function should be outside of your normal control procedures. They should be in addition to all of that. If you can think of it … put each division into a bucket, like finance, HR, payroll. If you had an internal audit function, a process in place and it takes time to get in place. It’s not something that happens overnight. Each one of those divisions, or buckets, would do a risk assessment. They would list out all their risks, just like the finance people provide us … all the risk related to their area. Not just finance, but operations and compliance. They would have the risk identified and identify the controls that they have in place. Hopefully they would use some sort of COSO model that has 5 components of internal controls and they’d address each one. They would list each control that mitigates that risk.
As an internal audit function, they would come … they would get those risk assessments and evaluate those risk assessments. How strong they are and test them. That’s the internal audit function we would like to see. There are aspects of that in place. There are weaknesses in place. Like Dr. Atkinson said, they were part of the control process sometimes.
This takes time. It will strengthen your controls. When you have stuff like this that’s not in place, that’s where you have deficiencies. As a board, if you look for those risk assessments and then charge that internal auditor to verify those procedures are in place. Your controls at the school board will be strengthened. You won’t have any surprises. As a school board you’ll already know.
Nancy Jester
Dr. Atkinson, my memory of the internal auditor when you came in place, I believe the internal auditor was hired in 2010. They were in place 2011 going forward. Mr. Cunningham was right. It was done out of a response to the SACS list of requirements. They wanted us to have an internal auditor. There were like 7 things on that list. That was one of them.
Subsequent to that, it was very curious, we were then told you’ve got to have a strong delineation to the board. They must be reportable back to the board and not necessarily through the Superintendent. Subsequent to that SACS changed that view and back tracked and said the reporting could go through the Superintendent. I think that was a response to the new administration. I think they were trying to be supportive of your restructuring. But, I recall very specifically different advice from them about that. Mr. Cunningham is shaking his head, so I’m guessing you did as well.
So, they hired him. I was very disappointed. We didn’t get reports. Nothing was generated on a regular basis to us. They setup a hotline to report things and then he proceeded to investigate cash handling situations in high schools. While I respect the need to make sure that goes well for parents and schools, we’re missing the big things. I asked him publicly at several meetings when he was going to get to that. Then we stopped seeing him at public meetings.
At some point when we have our monthly meetings, I’m going to start asking that question … where are our audit reports. I respect that these things take time to put in place, but I’m going to start asking those questions. Just like we need to setup a policy about hearing the state audit’s exit conference findings, we need to start getting in the habit of it. That’s the history as I see it.
The internal auditor, I don’t know if he was ever tasked with looking at the scope of things you identified … looking at all the controls … and of course it can’t just be one person. And of course you can’t audit your own department. All these things come together and your staff is looking into that. You’re building credibility with me on that. I look forward to asking those questions.
Sarah Copelin Woods [00:14:48]
I’ll ask our CFO, Mr. Perrone, how many staff members do you have in your department?
Michael Peronne (Chief Financial Officer)
We have approximately 27 right now.
Woods
Do you feel that you can train them to accomplish what is notated here?
Peronne
What we are talking about now, the internal auditing, is no longer in the finance department. That was one of the reasons and one of the takeaways from this, they are now in another department. The internal audit and purchasing were in the same area reporting to the same person. They wanted to break that out.
Training for the internal audit side would be a question for …
Woods
I’m talking about everything, and not just one section.
Peronne
This will be a team effort … finance, IT. We need to take these findings and develop an audit committee team and monitor and then on a monthly basis report back. We did that at my previous district. At the end, you may not get to all of them. The next year’s audit might come up with some more and you put them all together again and continue.
Dr. Gene Walker
This item is very specific. It says, “Internal audits not independent of purchase card processing.” I’m aware of the situation you had, the state had, with Georgia Tech on the purchase cards and how they got out of line because they didn’t have somebody monitoring them to make sure the use was for educational purposes.
The people, when they finally started checking them, saw that people had been purchasing everything with those credit cards. And we have people with credit cards. An effective internal auditor needs to be independent of internal controls, so he or she can say that ‘no’ you can’t use a card for that. They can say that without fear from the board or superintendent.
We are going to assume that can be done now. If you use a credit card, it must be used for educational purposes. It must be documented by the finance department or whoever the auditor is. The school board will make sure that takes place. We are not going to wait a long time for that. We want to see that on a monthly basis. We’re pushing that forward.
Freeman
The long time would be the internal audit process. The P-card can happen right away.
The process with the P-card is that somebody within the internal audit department was physically looking at every monthly reconciliation, every transaction for the p-cards. That’s a great control. I couldn’t recommend anything more than that. They will catch most if not all improprieties.
I’m not saying the p-card process wasn’t functioning well. What our problem was that the internal audit department was responsible for carrying out that control.
Walker
You’re saying the problem is that it was all in one house?
Freeman
The internal auditor should be going around saying something isn’t happening as it’s designed, or it is. They are assessing if the controls are operating. I wouldn’t want the internal auditor to be looking at his own house and telling me, yeah everything is fine. I want him, independent of that, to make those assessments. That gives you an additional level assurance.
Walker
Even though we don’t have a person with the title “Internal Auditor”, she has restructured it to separate the internal auditor from the finance department. Is that correct?
Atkinson
Yes.
Walker
This person can do the kind of things we expect can insure that these p-cards are being used in the proper way. That’s our expectation.
Woods
Do we know who has these p-cards? Why do they need them?
Atkinson
I don’t know who all has them. It’s based on whatever our policy is.
Peronne
I can get a list of everybody that has one. It’s usually a department head who is in charge of a budget. I was against having them until I came on board here because of their efficiency. There is an issue that they could cause problems with fraud. That’s why you have these controls.
Woods
Is there a monthly report on the usage?
Peronne
There can be a report.
Walker
Do we need to pass a policy to that affect?
Freeman
I wouldn’t … [00:23:18] 45+ minutes left
“Extremism in defense of liberty is no vice. Moderation in pursuit of justice is no virtue.”