85. >> I felt like I didn't want to go to school. Does he want to be a vegetable in his room? And He doesn't want to drive to be a little part of last week,
but I don't know. I just Unfortunately, we have I was on the best, you know. I just do your best and then the video. >> Yeah. Okay, good afternoon. How is everybody?
Welcome to our second meeting um of the internal audit uh committee. So we have two presenters here today. um one from RSM which is going to give you an update on your current internal audits and then also from Gray who's going to give you
an update on our um audit of the internal accounts at our schools. um they'll both present events or any questions and then I think we also had in the agenda that we were going to um look at proposed dates for the upcoming
year quarterly proposed things I believe mal policy says quarterly um and then from there any other questions or concerns or anything anybody wanted to add to the agenda or wanted to discuss at this time. So um thank you everybody
for being here. Do we need to go around and do introductions or >> and Miss Jones will lead lead all that once we call the meeting to order as well? >> Yes. Yes. Um would we like to do introductions or or >> That's number two on the agenda. >> Okay. All right. >> So, perfect. We'll get that we'll get
the meeting called to order. Miss Jones, you're in charge. >> Okay. It is Thursday, November 20th at 2:03 p.m. and I'm calling our internal audit committee meeting to order. [snorts] So, we'll get started with um agenda
item number two, welcome and introductions. We'll just go. >> I'm school board attorney John Steinus. We can move on to uh district 1. >> Uh Jeff Nettles, District 1. >> Shanttoya Jones, District 2. Teresa
Harrington, District 3. >> Kelly Runford, District 4. >> Paul Busy, District 5. Superintendent David, >> Chief of Staff, Kelly Watt. Um, Don Posey, business affairs. >> Uh, alternate judge of Brian, Kyle Seymour, business affairs.
>> All right. Did everyone get a chance to look over the minutes from our April 17th meeting? Can I get a motion to approve? >> Motion. >> Anyone want to second? >> Second. >> All in favor?
>> All opposed? So, approved. um unanimously. Item number four, presentation from Pervis Gray, our internal accounts audit. >> Uh >> we're getting it pulled up.
>> Well, we don't have we don't have slides. >> Okay. >> We we got a page turner. Are you good? >> No. Um, so we we do have you should all have a physical bound copy in front of you. Uh, 60 plus pages we'll be going through in minute detail. It should take
the rest of the 2 hours or 3 hours of the rest of your day. [laughter] Excited for that. We will be turning some pages though, but we'll be focusing on the highlight uh, primarily the results of the audit as well as some of the key findings that we found during the course of the audit. Happy to present the internal accounts audit for
Clay County District School Board for the year ending June 30th, 2025. Uh if you go ahead and turn to [clears throat] page one in the bound financial statement, that first page should be the independent auditor's report. On page one,
so in the indep uh internal auditors report, you'll see a lot of language. Primarily, it focuses on what the responsibility is of management. It's management's responsibility for the preparation and fair presentation of the financial statements. It's our responsibility as auditors to issue an opinion on those financial statements
that they are fairly presented in all material respects based off the audit procedures that we performed as part of our audit engagement. Um so if you see there on the uh second paragraph on that page in our opinion the financial statements in all material respects are
fairly presented. Um that is a clean opinion. It's a unmodified opinion. It's the highest level of assurance that we could provide as part of an attestation engagement for a financial audit. Um turning the page on that uh you pass that actually you want to move on to the that's the rest of the report goes
through page three. On page four you'll find the balance sheet for the internal accounts. Um not not a whole lot going on and showing there. The cash and cash equivalence balance. However, um inside that balance there's $3.1 million that's actually cash with financial institutions. Another roughly $1.7
million is considered cash equivalents. That's with your investment in Florida um Florida Prime. met your balance sheet. On the next page, you'll see the statement of revenues, expenditures, and changes in fund balance. Um, revenues at the top
there of $1 million. That is up roughly 6% over the previous year. A large portion of that is is related to additional fundraisers and contributions. Three of the high schools had over $100,000 increase in revenues in the current year. uh main factors related to uh increase in some of the
field trips and fundraising as well as likewise with the revenues increasing about 6% in the current year. Expenditures also increased a little bit over 6% in the current year. Again, those same three high schools that had increase in revenues also had substantial increases in expenditures related to cheer camp, uh cheer
uniforms, as well as grad bash and other field trips. um all those items, but a 6% swing year-over-year is not usually unheard of and is not outside the norm. Following this page um from pages six,
starting on page six is this notes to the financial statements. That first note, note one, um is the summary of significant accounting policies. This has a lot of information related to the reporting entity. um what some of the line items as presented and what they include in the financial statements. Um estimates that are used by management.
All that information can be found in note one of the financial statements. A lot of this is required disclosure for any gap compliant financial statements include in note one of your financial statements. The next note um note two and note three. Note two um a few pages down
after you get through note one on page eight. Note one cash deposits for financial institutions. Custodial credit risk. Um this is required disclosure. Essentially anytime you have large balances of cash in a single bank account, um FDIC only insures up to a
set $250,000 in a single institution per depositor. Um so that's kind of what that disclosure um discusses. And then next note three is your investment disclosures and these are um Gazsby 40 primarily disclosures related to investments. Discusses the ratings and the RAMs and all that is pertaining to
the portion of the internal accounts that's in Florida prior. following that um additional risk after that. Following that on page 11 I believe sorry you'll see the supplementary information um on
page 11 schedule of changes in fund balance this is a supplementary information so it's not required under the accounting standards to be presented along with the financial statements but essentially this shows the school's balances um uh in a cash basis from the beginning of the year to the end of the year. So,
if you total all that total up there on that page of the uh 4.9, that totals back to your balance sheet for your cash portions of all those individual schools. Since this isn't required supplementary information, we don't necessarily audit this information. However, we do issue an in relation to
opinion in which we actually do perform some basic procedures to ensure that these balances are in agreement with the financial statements that are audited. Following that on page 12, independent auditors report on internal control over financial reporting and
compliance. As part of a um a governmental audit, we are required to look at the internal controls over financial reporting and compliance. Uh we we do that in review of your internal controls, not necessarily to test and we're not required to test the effectiveness of the internal controls,
but we do review the internal controls as it relates to the financial audit. um when we're performing those procedures. So if we have any specific items to bring to your attention that are internal control deficiencies that we noted during the audit, they are included in this report. This report does discuss what a
deficiency and internal control is uh is and it kind of breaks it down. There's two different types of internal control deficiencies. There's a material weakness and this is an internal control if not in place. it would likely um result in a material misstatement not being detected if those controls are not
in place. That's a material weakness. A significant deficiency is a a breakdown internal controls that is less severe than a material weakness. They may just be breakdowns internal control, but if they're not in place and they break down, don't necessarily likely result in a material misstatement from
occurring. We do have a significant deficiency comment that will be found on the second page. of that report segregation of duties. And this is actually a comment that we've had in the past. And a large portion of this really pertains to the operation setup of internal accounts at
the school district, but essentially anytime you have a segregation duty where a single individual um is solely responsible and oversees any direct accounting functions, that's included. That's considered a segregation of duties. Um during our testing we did note situations in which the bookkeepers
were the sole individuals that were overseeing certain accounting functions. I will say that is not what your internal policies actually designate. It's not what's in the red book. There are specific policies in place to not have that. However, there were breakdowns in some instances that we noticed during our testing which the
bookkeeper basically was the initial recipient of cash directly um or there was not any document documentation of any approval for uh dispersements by a secondary individual during their review which if that was in place as the policy substantiate them that would have been a finding and wouldn't result in a
segregation of duties. So um you see on that page I believe I got a draft copy should be management's responses related to that finding um and they are currently trying to address this by updating the internal accounts manual as well as strengthening their training and controls and and direction and uh
conversations that they're having with the bookkeeper to help support them to ensure that these processes that are in place are actually being followed which should alleviate this deficiency. Um, following that, you'll have a management letter on page 15.
And if you kind of just scan uh skim down to the end towards the end of that page, uh, the second to last paragraph, during the audit, we became aware of certain matters that represent opportunities for strengthening internal controls in improving operational effect efficiency. Sorry. Our comments related
to these matters are on page 16 through 64. It's a little bit different format than what's been issued in the past. In the past, we uh we we we did we performed the audit. We had various uh findings that we'd have. We would relay those with the school the individual schools and the principles and they would respond to their findings
individually. What made it into our audit reports in the past was more of summarized type repeated findings overall for the internal accounts. This year though, it's actually broken out by school. So you'll actually see the individual comments at each school and
that's what's on pages 16- 64. And that I'm not going to go through each of one of those findings, but I will like to give you some highlights on some of the items that are be occurring and give you some statistics on those. There's really three primary findings that are prevalent uh during the course
of this engagement that we noted. Um the first one's fundraising issues and this pertains to um fundraisers either occurring prior to any approval by the principles. So the date start date of the fundraiser occurred before any type of approval was given. Also there was
not uh there may not be uh the recap that's submitted at the end of the fundraiser that's required and reviewed within a timely manner uh at the end of the fundraiser. Those are the primary issues related to fundraising. And out of all the schools that we visited, uh this accounts for 20 of the findings that we had during the
current year. So almost half of the schools that we visited had a related finding related to fundraising issues. Of those 20 finding schools that had this finding, five of them are repeat findings from the previous year, meaning that they had some sort of finding in the prior year related to fundraising and they occurred again in the current
year. The next prevalent finding that you'll find is cash handling and uh timely deposit of cash. Um, the DOE red book requires that any cash that is received at the school be remitted to the office within 24 hours and then that deposit be
made within five working working days to the bank. Also, it requires receipts or any type of support to substantiate the deposit um uh as well related to that. So, any findings related to that would kind of relate to this cash handling and timely deposit. [clears throat]
out of the schools that we visited, nine of the schools had a finding related to this and three of those are repeat issues that that have had these issues in the past as well. So if you do look at those individual ones, when you see the individual findings, you'll see what the finding was in the first column,
what the finding is in the first column. The second column will just state if it's a repeat or not, yes or no. And if it's a yes, um there'll be more context on what that finding was in the previous year. And then the third column is more support of why it's a clining. So it's either going to primarily reference general accounting standards, but it
usually is going to reference uh the internal accounts handbook and where that's noted and it's a violation or DOE's chapter 8 of the red book. So it'll reference where that why that's exactly a finding and then the principles are in the design responses related to those findings. So that's
kind of how those look. The last finding that's prevalent that we've seen a lot of um involves missing support and documentation. A lot of times this will be uh purchase orders. Again, the signature of the of the principal may be missing or the PO itself may not be missing. So anytime
we're unable to substantiate any support and secondary review, that's kind of a missing documentation related to those findings. Um as well as any type of like PCAR transactions, maybe not support related to the PCR transactions as well. So that kind of rounds out the
primary findings that we had. Just kind of high high overview of all those type of findings. But if anybody does have any questions on any particular findings or concerns or anything that we can help answer related to the audit, I'd be happy to address those. Did you have any uh did you have a
number count for how many were missing support documentation for me? >> Um so you I was just since you had >> so I Yeah. So I have I have some more detail but I don't have so sheets missing three POS miss POS which would
be related to that is three uh budgeted budgets and transfers there was three of those each as well but budgets and transfers usually when they're going to have a support some sort of support documentation that's missing. Anytime the bookkeeper is doing a transfer or journal entry the principal should be reviewing those entries that are made
and documenting their support and their review of it. In a lot of these cases, the principal is the secondary reviewer to ensure that this is not breakdown instead of sort of single person being involved. Um, so a lot of journal some of the well there's only three of the journal issues and transfers we reviewed they were missing the principal
signature altogether. We didn't have there's there's been a slight decrease over the years. We used to have so we we when we go out to the V and we visit every single school enforce person in performing various testing. We look at a lot of receipts, dispersements, PE cards, uh making general inquiries and internal control.
We have a questionnaire that we provide to them that they respond to. It might result looking at any ticket sales that they may have and that's the one that's kind of decreased over the years. used to have a lot of ticket sales um related type issues, but a lot of entities lot some places are going away from cash based and actual physical tickets and
going to electronic means which does kind of help alleviate some of that potential risk. U but ticket sales a lot of times they would be recalculating. So they would have to say what the ticket roll began and ended on. So what's that difference times the dollar value and if that doesn't agree to the amount that's being deposited that was an issue that's kind of decreased over the years with
some entities kind of switching away from the cashbased use of those Madam chair, if I could, I would just say uh I appreciate the format naming the school format >> because then you can uh retraining
more apparent than when you compile the results like you you know where you need to go and who >> I agree. >> Yeah. In this formatting that we do have it's it's it's just now in the report. So it does make it a lot easier for everybody to be aware of what we're finding. In the past while we're out on
the site and we kind of complete most of our testing, we'll have a brief exit with the bookkeepers and the principles on site just so they're aware of what we saw and sometimes they may have some specific information they want to provide related to that. Um so once those visits are done, they have a little soft exit in the field. Then it's then all the work papers are obtained
and reviewed internally by a second individual and then we actually issue and send an email related to these findings to the principles bookkeepers. And we've already done that. It's basically the format that you now see, but they would return that to us in management would would would have it as well, but it never made it into our report the way it was presented. We
always just summarize in the past. But this format is actually there's a lot of other school districts that use this format. It's not necessarily required. Um, but it does make it a little easier so everybody's on board to see what the individual findings are. And hopefully the bookkeepers and the principles also now that they know that those are the
specific items, they kind of help address those items in the future. I I think sometimes it's hard. they'll look at these findings and and just try to justify well you know this occurred and this occurred and I completely understand those things happen but if that kind of becomes the norm when you're looking at what these controls are and you're just kind of like yeah
it's this reason and stuff that's when you end up rising to issues and things end up in the public and things going on. So it's best if you can just try to have strengthening the controls and make sure everybody's on the same page to support those controls that are in place. So, as Matt said, a lot of other school districts already do this and put
them into the report and that's how it was at St. John's. So, when we came here, Matt and I had a conversation about this. So, because I could never, you know, the Excel document like Matt said was being done, but it wasn't, you know, just >> didn't get out there into the report, didn't the public relate to their area
and what they were doing. this kind of helps them the school see it and hold them accountable for it and help them realize what what's going on at their school. So yeah, >> is there a procedure for followup on these things like school work? >> Yeah. >> I think the the challenge is right like
let's say the finding about uh not having the prop for documentation for starting a fundraiser. a picture of people at a PFA meeting. They say, "Okay, we're going to do this fundraiser and everybody at the meeting agrees, but nobody fills out the form and then the dates don't match when they do their
testing." It was a binding thing. So, it's a matter of good people knowing that the paperwork, the documentation are paramount to the process, you know. >> Sure. Just if I could chime in, uh spoke with Miss Posie a lot about uh plans going
into the future and that management response that's in there. Uh we do feel that you know there is some fresh look that's being taken at the processes and the training aspect and all of that as well as bringing uh some more centralized aspects to it and I think that will help a lot. um you know sort
of a crystal ball prediction but the plans that it sound like are being put in place by the superintendent in business affairs I think will just through those efforts will reduce the findings going into the future. I think actions are being taken. I don't think it's just being you know sort of pushed
aside into the future. So appreciate the plans that sound like they're being put in place. >> Can you I think you already did this once but I was reading and listening all at the same time. Can you recap the most common mistakes one more time? >> Sure. Uh the largest one is fun is is
fundraising related issues. So again that's the fundraiser occurring uh starting before the approval date. So there's a form that they has to be completed that a fundraiser is going to be undertaken. The principal and bookkeeper sign off on that. Um the other part of anything that's a fundraising issue is that has a recap basically where you calculate what the
what the revenue and expenses related were to the fundraiser and it has supposed to be filed within and filed and approved within 30 days at the end of the fundraiser. So those type of things were missing and uh I think it was 20 of those schools basically had a finding related to that and five of
those were repeat findings. So they had that finding a related finding to fundraisers in the p in the prior year and again in the current year. Um and then cash handling and deposit timeliness. Um the DOE red book that kind of oversees what you can and can't do necessarily with internal accounts. Your internal handbook kind of has
additional controls and additional information that kind of may you know kind of be less than that. But the red book requires the deposit to be deposited to the off get into the office within 24 hours and deposited to a bank within five business days. And there were nine nine findings related to that.
Three of them being repeats. And the other thing is usually just missing documentation. title. I think it was about six of those total. Um, but that kind of goes from PECAR documentation missing. Like we weren't able to complete the testing to say that the dates weren't necessarily completed because when we requested documentation was completely missing. So those were
also finding. So that was kind of the third one that we had a lot of. >> Yeah. May I ask a question? >> Yes. >> Um, and maybe this is just maybe it's just me because I haven't been on this board until this time. So I'm it's new for me. of the revenues that are listed
here, what percentage of those will be in this bucket that we're talking about fundraising? I mean, that is that a big percentage? >> Is it most of it or is that a small percentage? >> Um, I it's probably not significant amount. I would I guess I don't really have that that data with me to be honest
with you. A lot of it is um collection of like field trips, fundraisers. It's club club accounts essentially. So, if the club's doing anything, any type of collection, selling something, has an event that they're going on, they collect the revenues related to that. >> Yeah. done not for profofit but I I haven't done any school related so I didn't know what percentage of this
revenue would be represented by fundraising versus other what other kind of revenue streams do they have besides the fundraising the big ones >> your your largest is probably your football gate >> can you believe that >> typically you know we don't have the statistics particularly on yours but
generally speaking you know your athletics uh your gate fees being the largest uh but flowing through there you know all the trips um and depending upon what schools are doing, what trips can be a very significant component. I would say that's probably category two.
>> Um heading in, you know, down from there, you get into uh your yearbook fees can be significant um at your high school levels, particularly moving further down, you get into smaller realms, um of just the general fundraisers, uh the smaller activities
that are going on, club fees. >> So, would you believe that these findings primarily relate to those smaller um fundraising accounts are maybe, you know, a few hundred dollars or a few thousand dollar for >> Oh, I would say thousands. I mean, across the district, you're talking
thousands at the school level, right? That would that would vary. I mean, at an elementary school, um it it it could be a significant component of an elementary school. Uh from a high school, you know, it's outsized by ticket sales, gate ticket sales, so it's
a smaller component. Um but still thousands in a year, you know. um couldn't articulate the particulars. It's not broken down in that detail. >> And that's an internal control that's basically an efficiency over fundraising. It's not that the dollars are missing or not in there. So, it's not it's not an audit adjustment that
necessarily that the revenue is not properly recorded. It's the controls behind that that are being reviewed to help substantiate that number. Those items were not followed. >> Well, you know, you don't know your population. >> Yeah. No, period audit term. You don't you don't have a real population supposedly.
That's why makes it more difficult to know what that number is, >> right? No. Exactly. And in some of these findings, all the fundraisers may not have it necessarily, but a lot of the findings, if there was a specific amount that that there was a violation, those will be listed in there. And they may seem like small, and I get that they do seem small in the grand scheme maybe of things, but these are breakdown of
controls. And then when they repeat is when this kind of stuff ends up breaking down, and that's when stuff ends up in the news. >> So, you're going to wait it'll be another year before they get reviewed again, right? Um but for the financial audit, for the financial audit, it's just annual as of
6:30 each year. Um y'all do have an internal internal accounts coordinator that does some training and stuff and some follow up when questions arise, >> right? That's one of the concepts that you need to keep in mind is we are auditing the districtwide, not the
individual school. Um and so we're looking for those systemic problems. That is the district not have control over what's out there. And so from that sampling basis um so yeah we're following you know we will revisit the school next year um and apply those districtwide
u audit procedures uh but the district between now and then is the one who will be needing to follow up on a shorter basis and I do think that the training and plans that are being put in place to centralize more of the accounting function uh will help in catching some
of that. So to kind of add clarification uh to this concern if you have a coordinator of internal accounts which is a person that does um routine although not officially auditing that looks behind to make sure and there's
constant communication because this is a daily event with many transactions every day >> across the district and so somebody does check on the daily work and this is more the big broad picture of the entire district and controls And if I may, I would I would add to
that that you know um effective July one internal accounts came into business plus which is the district's ERP system. And so part of that process is a workflow that you know you now do POS in the system when your prior approval
would be a purchase requisition and all that is now documented within the system. So we're able to and they're able the auditors are able to look at that and get into the workflow and see that and we also so that's that would be new for them to be into our system and we also through the system approve here
at the district level in our internal counselor we also approve all journal entries so the POS were included in the significant finding number two that you were talking about not having support well that's going to be really difficult now for them not to have that they're in
the system they have to have all that it's the only way it'll go through the workflow. And the other thing with the journal entries, all their journal entries that they do at each school are reviewed here at the district and checked beforehand. So if there's like a, you know, if you have the wrong object code or if you have the wrong revenue or you got revenue going to an
expense object code or the other way, we'll catch that here and they get to fix it and then it goes forward. So we have these um controls in place that are proactive to help them from getting into situations. Does that make sense? Yeah,
I just thought I'd throw that out there. >> Well, I happy to answer any questions, but if any questions do ever come up, we can always feel free to reach out to us throughout the year. We'll be always happy to to respond and um answer any questions that anybody may have.
>> Thank you. Okay, we've got agenda item number five, update from RSM on cyber security and contract review. Good afternoon. Thanks for having us again today. What we've got on the screen is our first official monthly
project dashboards. You all should have received this in your email uh on the 14th, which I think was last Friday. Um did did anybody not receive it? Did not receive it. Okay, we can connect afterwards. Make sure we have your email. Make sure that you're on the list there to get it going forward. But what
this is is a it's a monthly update that we provide to the committee here as well as to the board that basically provides exactly what it sounds like, an update on the ongoing projects that we have right now. So, our intention will be to provide this the second Friday of every month starting last week and and going
forward until we complete both of these projects and then present them uh to the committee here and to the board. And then once once they they drop, you know, they'll drop off and then in the next year's audit plan, we'll create a new dashboard uh to update on those audits as they're ongoing. And so, you will
start to see these every month. Obviously, if you have any questions, uh it'll either probably come from me or Weiss or one of our uh supervisors, Jack Hughes. Um just reach out if you have any questions about anything that's ever on the dashboard. So, we'll go through this just verbally with you today uh since we're here uh and we'll talk about
it. Uh so, the two, if you guys will recall, at the last audit committee meeting, this committee approved and recommended to the board um to bring the two audits that are here, contract compliance and internal and external penetration testing, cyber security testing. So the board at their next
meeting approved that and then we uh executed the statements of work with the scope and have been and have begun testing starting basically and we had our I think our first kickoff meeting in like the August September time frame. But we were really waiting until school got started and the the chaos of the new
school year settled down before we really started to to come in and bother too much. But where we are right now is um contract compliance was one of the ones that we selected. If you'll recall, uh, when we when we talk about contract compliance at the district, like at a district, any school district, many
contracts are are are all throughout the district, lots of different departments. Generally, even though the purchasing function is going to be a centralized uh process, the actual administration [clears throat] of contracts is going to be out at perhaps different schools or different departments. And so, it's a decentralized function. And so, what we
do for that is we sample some high-risk contracts. Weiss will talk a little bit more about how we do that and kind of where we are on that right now. But we sample high-risisk contracts and we look at the controls of how is the district, the different departments, the different individuals that are responsible for monitoring these uh agreements, how are
they doing? Are they are they reviewing the invoices? Do the invoices have an appropriate level of detail based on the services that are outlined in the agreement? Um if there are any change events, how are those being dealt with? Again, are they are they in compliance with the agreement? making sure that the controls are are good and in place at
various departments and kind of across the district. So that's the approach we take to doing that. So we did sample five contracts uh of different types services uh goods across several different departments and we're just now getting into field work on that one. uh
you know we we had a couple discussions about sampling and I won't go too much into that because Weiss is going to talk about that but we're just now getting into fieldwork on that one on the cyber security internal and external penetration testing that's um not done by me thankfully uh but we have cyber
security folks that work at RSM what they do is it's really a two-part test so the first one is external penetration testing so are our penetration testers white hat hackers are they able to compromise ize the district's environment in any type of way from the
from the outside. So, they might do some searching on the internet, see if there's anything that's been posted on, you know, the dark web. They might try multiple different ways of getting into the system to see if they're able to get in. And if they are, they'll provide those the I'll go over the process in a
minute, but they basically if they do find vulnerabilities, that's communicated and then uh discussed and then, you know, there are remediation recommendations for the district to consider if there are any vulnerabilities there. The other piece of that is internal penetration testing. So that kind of assumes that once an
actor, if a bad actor has gotten into the system or even if it's just somebody like even like a student or an employee that is that already has access into the system through legitimate means or even possibly illegitimate means, how can they jump from one area to the next?
Because obviously that's an important thing. Generally with cyber, you want things compartmentalized so that if you get into the email system, you can't then jump over to the student information system and get a bunch of confidential data out of there. And so what they do is they kind of start out with the running like a lead and then
they see, okay, if once we did get in, are we able to then move throughout other parts of of the of the district's environment? And then if they are again if there are any vulnerabilities identified that's discussed with management and remediation plans uh and recommendations are provided to
management. Um obviously for the sake of security I'll talk just briefly about reporting there. That's a confidential report. I mean that's never anything that we would want in the public. Um so what we typically do is we'll work with the board attorney to make sure that everything's buttoned up officially. But
what we typically do is we issue a letter that basically says, you know, pursuant to the statutes that relate to the sunshine law, this is confidential and it's uh not something that's going to be shared publicly, but we did this work. We discussed it with management.
Period. And that's really the only thing that becomes the public facing document. There is a full report that gets discussed with management. Uh we'll work with the board to determine how much it's really up to the board's discretion. Uh how much of that report is presented to the committee here um
and when and how that happens. We have to work with the board to our our leaison there Miss Hansen to kind of really determine how to proceed with how we what we present to the committee. But if we do what that typically looks like either the committee or the board or both it's a it's a shade session. So we
would go into close session. Um, generally to keep in line with statutes, minutes have to be taken, but they're never public. Um, and then, you know, that's where we would hand out hard copies of the report, they'd be numbered and we collect the hard copies back so that nobody can leave with them, that sort of thing, just to make sure that
security is is as tight as possible on that. But, uh, that that's kind of what the reporting process would look like. For that one, we're very we're basically we've done our work and we are in reporting. Uh, and so right now, um, it's going through our QA, our internal
QAQC process. And shortly we'll be meeting with the district management and the superintendent to discuss the results. Um, vet everything, make sure that we didn't, you know, misrepresent anything or make sure that it's accurate. But I will, that's just a high level update. Like I said, you'll be receiving these dashboards monthly. If
you have any questions, please reach out. We're certainly happy to discuss anything that you might want to talk about. But I'll let Weiss kind of get into the details of of both of them. >> Perfect. Yeah. add a little bit more context. Um, starting with contract compliance. So, this is a very subjective approach that we take. It's a judgmental s sample and that's very
intentional and that's the approach we take for all of our internal audits, right? The goal is to sample inherently high-risisk areas. In this case, contracts. So, the first step we take and you'll see that noted here is we do data analytics on contract spend by vendor. That helps us get an idea of where from a materiality perspective the
spend is going. From there, that helps us facilitate conversations with management. So that allows us to get perspective from management. In this case, we we met with your superintendent as well as some other leaders to understand are there any inherently high-risisk contracts that you're aware of. Maybe you faced exper or you've experienced issues with the vendor from
whatever perspective. Um so that we can consider that as we go into our sampling approach. Um as Matt alluded to, we did select five contracts. So what we'll be doing when we when we sample those contracts is actually look at every provision of those contracts to make sure service level agreements are being
met. um any responsibilities on the vendor side are being uh fully executed to the expectations of the district and then of course any responsibilities on the district end we're making sure that those invoices are being paid timely things like that as well. Um we're in the process of uh we've disseminated those those requests and now we're just
waiting for the actual support and then we'll be able to start our testing and and hopefully expedite that review pretty quickly. Um the internal and external penetration testing as Matt alluded to that's a simulated attack. So that's our ethical hackers is what we described. They've gone in, they've done their due diligence, working with
management to execute that last month. So, we are in the process of getting that report pulled together and hoping to have we've already distributed the preliminary results so that we can begin those conversations on what opportunities may or may not exist and uh we'll be executing hopefully an exit
meeting here soon with Dwayne to uh talk through any concerns or questions you might have around that. So, both of them are moving pretty quickly and as Matt said, here to answer any questions you might have. >> Yeah. And we would expect just for your benefit, I know you're not setting your you're setting your meetings I think next year today. Uh depending on when
that is I would imagine penetration testing will definitely be done by then whenever the next meeting is because we're pretty much done now. I would imagine that contract compliance will probably be done unless your meeting is in early January. So depends on when you guys have the meeting but in theory you know we should be at the next audit
committee meeting uh should be able to bring both of those reports uh and to complete the audit plan for the year. All right. Any questions? >> So you're saying that by Februaryish
cuz you know one of the challenges if I if I could manage your establishing the dates you want to make sure you have something of meat to do when you get to the meeting, right? So >> when would you think that would be possible to set a meeting because we didn't have the meeting? >> Yeah. Yeah. So, I know we've been
working with procurement to get the contracts. I believe I know I saw emails this week. So, I believe we have everything we need there. So, we should be able to set up uh walkthroughs with the different departments that own those contracts. I would imagine we should be able to have those completed before the holidays, before Christmas, and then
could complete our testing uh in January and probably be into reporting in February. And by the time we're done, so the way that our reporting process works is obviously we go through our our process, we're in communication with management the entire time to make sure that we're not missing anything or misinterpreting something and we have
everything that we think we supposed to have. And we try to do that vetting process in real time. And then once we feel comfortable that we've done that, we will go to writing the report and it goes, it's a draft report and then we have an exit meeting with the department level to say, "Hey, here's where we are with the report. here's recommendations
we have and we take their feedback if they think no no no you didn't ask about this and here's this one thing that actually impacts that or no we agree with that whatever and then we kind of talk through that with them then we schedule a meeting with the superintendent and other any other uh if he wants to invite cabinet whoever else
to to discuss the report with him uh once everybody's happy that management response uh you know that everything's accurate management's responses have um addressed the issues uh effectively and set a set a date for remediation, then it becomes a final report and then
that's when we bring it to the audit committee. So, it does take some time. Um I don't know and that's that's intentional, right? Because before it becomes public, we want to make sure everything is complete and accurate and that everyone's on the same page. Management action plans are another component of our report. So, sometimes we'll go through the exercise you just
described where we we hold our exit meetings and then it takes time for management to get their responses. So, what actions are you going to take to address these risks? Sometimes that can take time. So to maybe to answer your question, I think certainly penetration testing will be completed, but whether or not we're communicating that will
[clears throat] be I think to be determined. So we may find a later date is better just to make sure we have a fuller agenda to to to discuss everything. >> Yeah, we would definitely be done I would think with that by March. If you have an early meeting in early March, we would I have no problem doing that. I
think if we're in February, that'd probably be when we would normally be having our vetting discussions with management, making sure that the report is is tidy. Um, so yeah, if that helps you all in your decision- making for that, uh, but if not, you know, and you
have another one in Q2, um, that would we could still do it then, too. Um, because that would still be before the end of the fiscal year. And normally we would try to stagger these reports so that there's at least one at each meeting so that we have an opportunity to meet. That's that's ideal. This might be the unique scenario where it might
benefit you to wait till both are complete. >> Both the technology and the contract reports. Is that what you're talking about? >> Mhm. >> Yeah. Yeah. No matter when, if it's February, the technology one would definitely be done. I mean we're we'll
be 95% done with that for Christmas. >> But then you also got to take it to the liaison of the board, right? >> We will discuss with her how she wants I don't know how she or how the board decides they want to move forward with what we present to the committee again because of the sensitivity of it. Um but
that's ultimately up to the board to decide. [clears throat] >> Okay. Madam chair, it's up to it's up to you. >> Okay. Thank you. Does anyone else have any questions? I have an off like slightly off topic question. Sorry. The ethical hackers, I
know you luckily it's not either of the two of you. Are they [laughter] um like are they and I'm asking for personal reason. My brother's an ethical hacker and he will not go out on his own. So, I'm just wondering if the ethical hackers are um like direct employees of you all or do you generally
contract with like an ethical hacking firm or something? >> They're employees. Yeah. So, we have um we're a large firm in all over the world. Yes. >> Uh and and we have a whole I mean probably hundreds of people. I don't know their exact size, but a large team
of people whose entire job is to >> I mean they even have their own sub team. So they have people that only do hacking and they work overnight and then we have people that do incident response. So if there is a big breach they go and they collect things and help you know remediate that issue in real time and they get called out in the
middle of the night all the time now. But they're they're actual employees of of our firm >> and it takes it almost one step further. These are the cyber security team works at the one that is specifically working on this engagement works with school districts exclusively with with governments because they're most familiar with the types of risk. So when
it comes to recommendations and those conversations, they're not providing unrealistic, you know, this isn't a Fortune 500 company, right, that's going to have the same type of challenges or resources, right? So that's another big benefit I would say. >> Cool. Thank you. >> Yeah. >> All right. I think that we should move
on to agenda item number six, our future proposed meeting dates. So it looks like we have February, May, September, and December. Based on what we just heard, should we move Februaries to March? >> It's up to the group. That seems like
the recommendation. >> Yeah, I I was um Miss Posie was sharing with me that these months worked with the calendar. I believe you said it right. The current calendar. So, >> if you want to be three months out. >> Oh, okay. Going every 3 months. Yeah, I
see. I mean maybe in February they might have one ready in February and then one ready in May. Is that kind of >> Sure. Yeah, we could do that. Absolutely. >> So >> you would have because you also might have in February and I'm just you also probably will have in February the audit
from Pervis Gray on the district's financial statements too. So that one will be that's kind of why I picked February to begin with because I had Pervis Gray too. So they will have their audit. They did the audit of the internal accounts today which is part of
the big financial one but the whole financial audit our audit the single audit act the federal awards that will that will be ready in February. So that was just another thing to consider. So you could have two you could have a
audit from Pervis Gray and an audit from RSM in February and then possibly in May the other audit right back. Yeah. >> Mhm. >> I think that sounds good. >> I think so too.
>> Do we need to choose like specific dates? is are we proposing dates for all of these now >> calendar I think we should at least pick February at least >> and I think we had Thursdays I think this is our
>> I don't have the school calendar I don't think we have anything >> calendar so we have like day of the week like today is Thursday. So, is are Thursdays best? >> Okay. I think we I think last time we decided Thursdays were best. I think the
first one was on Thursday, too. >> So, I Mr. Broski would be out um on the 19th, but we could do it the afternoon of the 20th, but the morning
has an event. 26. >> Yes, sir. >> Yeah, we should be >> should be done by the afternoon. Afternoon should be clear. So, 2:00 on February 26 would be the recommendation
from the superintendent side. >> I don't have any objections to that. >> Okay. You're not out of town or anything? >> No, I'm not out of town. I went everybody. But this room
>> and this one was scheduled for uh I think an hour when it was sent. Is that about about the amount of time each time? >> I think it was scheduled for two hours. >> It looks like this one is is about an
hour. So, >> okay. between that amount of time seem rational to me. >> So two to three approximately it could go a little later just depending on the conversations. Okay. Agenda item number seven. We have other
business report with committee members. That's just a general. >> Then I guess we'll move on to adjournment. >> Excuse motion to adjurnn. >> Oh, sorry. Motion to adjurnn. >> Second. >> Oh, you need to motion to second.
>> All right. All those in. >> All those in favor? >> I >> All those opposed. >> All right. >> This meeting is journed. This meeting is adjourned. All right. >> And just remember if one of the Curtis
Gray or another entity sends the committee a an email, you need to reply back to Gray and not the entire assumption. Okay. >> Okay.
Nice to meet you. Good job. Thank you. That's what you do. Do you want to silly what I think about gay? You know, everybody I am in agreement. So I know that we need to be like right
him. If one