>> Hey, everyone. Good afternoon. We have quorum. going to go ahead and call. >> Today's 3/17/2025, regular meeting. The Fairfax County School Board audit Committee
to order. This lady has submitted a She there. She she's not there. Okay. So we'll dispense with that for
now. Janet. This flag she? So? will be moving to item 1.0, 0, 2, the approval of Minutes, 2
will now vote to approve the minutes of the 1/13/2025, meeting of the audit committee which sent around for everyone. do we have a motion?
is Saint John Counting is moving. That committee will prove the minutes from the January 13th 2025 meeting. With sleeve for the clerk to make grammatical and formatting at its do have a second or thank you. Okay.
Great as Henderson. Seconded. All those in favor. Okay. Unanimous. If those at the table opposed none. Now moving
on 1.0, 0, 3, AG Engagement status update. So I call on Daniel more for item. 1.0 3. Thank >> So good evening, everyone. And we will be going over AG
internal audits that is right now. I want to start with we have 2 items that we will present tonight. That will be a can't process audit as well as asked, didn't display
disciplinary audit. Those items are complete. And as I mentioned, we will present those tonight. We do have 2 audits that are currently in process. They are our execution phase. Those
construction and renovation. Crime contracting process audit as well as our critical process review art. It for hiring. And so we are
scheduled. I mentioned, they are in our execution phase and we are scheduled present on those and our June audit committee meeting. We also have our ongoing continuous
monitoring. We're currently in quarter 2 of the continuous monitoring. As of right now, we are looking at some career and technical education sites
that we conducting audits on as well as we have 15 schools that we want. We'll review. not appropriate inappropriate transactions and we will be
continuing our unannounced gate receipts and a couple of our schools. Some of them other duties would include our
fy 20 risk assessment process. We have concluded doing our benchmarking national K 12 organizations. We have interviewed and collecting
feedback from Nexstar owns internal stakeholders and we are analyzing our financial indicators and we are hoping to prevent our final proposal
in April and audit committee meeting. After that, the results will be presented to our school to the school board. We also have our front
waste and abuse inquiries and we I want to refer that we be presenting on some of those internal inquiry updates tonight. We also have our recommendations follow up IDA
recommendations and the dirty January. 31 and has been completed and we will also be present in those. And tonight in this meeting. And I want to also mention that we have our
out was education. We just completed and that's what training along with payroll. And it was called bridging payroll and on it and audit to action that was present all my
7th. We had a wonderful turnout as it relates to that NASCAR trainee and also wanted to mention upcoming in April. April May we have our Internal Audit Awareness Month coming out. So we are so excited for
that. So that will conclude our internal audit, the status updates and now giving back some Thank you, Mr. >> Does anyone have any
questions on this updates seeing And with things to Dre, Mr. Smith for letting in the light. We will move into item.
Number one points here AG inquiry. Updates. So I turned it over to General Co. >> Thank you. Good afternoon, everyone. So the item for the
Office of Auditor, General Internal inquiry updates. So what you see in front of you that you the numbers of concerns and or situations
that we received through different means. And 2 from the July one, which is our to start off our 5 fiscal years to March 6 of this year, Azoff
March 6. We got a total cases of 44 and on the list. You can see that that by themes and the areas that this claims are related to. So as today, all
of the cases that we received, we have closed time, meaning that we have conducted a preliminary review, coating to our policy. 1, 107, regulation
14, 10 to review them. And then for some of them, we may need to refer Dow like Messi if they are human resources related or residency related,
then we're referring to the appropriate departments with Fairfax County Public Schools. And when situations like there are, you know, credible information that I would need to share more with the audit
committee members, those situation would be to be discussing the public meeting discussing closed meeting it is appropriate. So with that would like to turn it back to Ryan.
>> Thank you. anyone have any questions on our? Yes, Mister >> commission the appropriate for me to ask any questions about the nature of some of
these inquiries and public setting when I saw 3 high, a number for human resources, unusual that sense. I just want hear if you could share
with us in public what they chatted with those inquiries might have been sure. Thank you, Mr. Mullin for the question.
>> So human resources on Maney person. Now we laid it. So for example, someone may come
playing a bow. The supervisor all complain about their work environment and I'm not really directly related to fraud, waste or abuse. And again, we
have very clear definition of each terms policy. 1, 107. So then what looked at those staff, a nation and then to see when the claims come in map to those and many times I
need to be, you know, just candid with you. All many cases have fallen in the middle off it right. So then we would need to work with our human resources counterpart to
gather first many some of the situations. But depending on the majority of that case, if that is personnel related, then we put under the human resources category. It makes
sense. And if I may also advise you all about the theme of the use of assets, we have very strong in that really
educating our employees outcome of team members that the bulk of budget is for payment for our payroll, right? So we have to ensure that that kind of like our
employees, you know, are working the contract that hours, for example, for hourly off or salary to work or so when situations come up, maybe
at may be concerns about Ester Cody, not, you know, work my contract to ours, depending on the claims. Come mean, I may put it under use of SS because talents and time
is a very important asset or we may put it under documentation. there is no, you know, in my time I did not like Putin correctly. So it depends on the case by case a
lawful. >> Okay. Thank you, And we're going take a quick pause. A lady has entered the chat this lady has submitted a written request to attend this
afternoon's meeting virtually due to a personal conflict as she has another meeting directly after this meeting and is attending tonight's meeting from Herndon, Virginia. All those in favor
of approving latest request. The same cutting to approve. Okay. That's unanimous for this. Those at the table. Thank you. Right now back to.
Item of hand. Any other questions on our internal inquiry that date? I have one question, which is you know, we saw a huge spike last year
and it doesn't like look like we're going to reach that level again this year. Can you kind of just give your own sense of why we saw that spike and why it has even doubt.
>> Yeah. Thank you for the question, Ryan. So yeah, I think in fiscal year, 24, we have started very aggressive. You know, education and community outreach. And thank you. Also for all audit
committee members and also our staff members, you know, to advocate that for us, we continue to do the same thing in fiscal year. 25 and my
sense is stat that we actually were very closely with the stakeholders. And I feel like that many times of managers already, you know, know, kind of what we're expecting. And I think that that the
self-awareness and then they try to, you know, we saw off the E shoes even before they become an issue. So I really think it's a great story to tell.
>> And then out of the out that the numbers that you see it here, I also want to raise it. The fact that >> the number one not related to fraud, waste and abuse that fcps number has dropped
significantly. Also. So what does it tell me is that that people are really using Israeli using the hot this hotline for the purpose that it is the sign for. So while
annualized, a number doesn't really as much as last year. But I think this all of the numbers of small, solid. >> Great. Thank you for that. So seeing no further questions, I think we can move
to item 1.0 5. So I call on Luke Robertson time Tishman for item. 1.0 5. Thank >> So this is the procurement
process audit AG performed in accordance with the EFI. 25 approved plan audit plan by the school board. So background and context is that
Fcps has delegated purchasing authority from the Fairfax County government executed by the Office of Procurement Services for Fcps. The Office of Cybersecurity and Technology Architecture and
Assessment Section within the Department of Information. Technology have established processes for evaluating b***** risk in the form of the security architecture and vendor acceptance question
errands vendors complete these questions before signing a contract or adopting a service or platform with Fcps and question is collect information from vendors on various aspects, including
cybersecurity privacy, acceility, cetera, to the audit scope was for Fy. 24 and the objectives were to assess whether adequate controls are in place and have been
achieving desired outcomes for the following process areas, bidding process and vendor selection which includes relevant. It processes such as the cybersecurity checklist
and assess compliance with policies and regulations. So in order to achieve the objective, Zoe G reviewed clickable fcps policies and regulations reviewed the Virginia Public Procurement
Act. Fairfax County Purchasing Resolution and applicable Fairfax County government policies and regulations. We reviewed chairman manual for prescribe best practices and
standard operating procedures. We conducted walkthroughs in interviews with stakeholders including O P S O C S and T a and we assessed are. We also
reviewed a sample of 63 contracts for compliance with procurement requirements. So as a result, you noted, 3 moderate risk findings, one low risk finding and one
observation within the report. We have. What you can see is the one page summary which describes a high-level highlights of the report. We also have the 2 page executive summary which contains a
little bit more information and everything else discuss today is found within the report. So for today's presentation were just discussing the key highlights for each of the findings detailed within the report. So
for the first finding to moderate risk finding titled Conflicting directives and guidance regarding approval authority. So procurement services, cybersecurity and
technology, architecture and assessment each of functions to establish document and the vendor approval process through their policies, regulations and internal and external guidance. The office
is shared B***** approval process should simply aligned and agree between documents with clear language as F I-24 there is conflicting and inconsistent language within
their policies, regulations and internal and external guidance regarding the shared vendor approval process functions of O P S O C S and T a as an example regulation. 64
10 states Cs is responsible for assessing security risk and approving heart software hardware, vendors and services, which is supported by the related guidance that they provide to vendors requiring them to complete the
security architecture and the vendor acceptance question areas and meanwhile, regulation 50 12, which is regulation owned by Chairman Services, does not include any
requirements for vendors to complete questionnaires and participate in procurement activities. And additionally O P S soap. He's only questionnaires to be completed by vendors if applicable
inconsistent guidance may the ability for fcps to solicit vendors in a timely manner and then without process standardization, there's an observed administrative
inefficiency due to internal confusion and delays in decision-making. So what we recommended C S and T a document, a standardized risk assessment process that Taylor is vendor risk management
practices on a case-by-case basis based off the type of products or services being acquired and to that O P S O C S and collaborate to revise
the regulations to align with their agreed upon assessment processes and 3, that those 3 offices also ensure that vendor requirements within regulations and internal and external guidance fondors
are clear and consistent and messaging. Finding 2 is a moderate risk. Finding titled Operational Inefficiencies,
Impacting B***** solicitation. So at the time of the AG found that C S and T a vendor view controls where and efficiently designed as vendors are required to complete a
standard comprehensive questionnaire. Regardless of the nature of the contract or degree to which technology is involved in the terms of service. question is, are
through an intricate in order to address 3rd party risk as most K 12 data breaches are initiated by third-party vendors. However, question is were not designed to be flexible based on resources
are tailored based on the specific use case of services or products being acquired during Fy. 24, there are 2 members of the OCS security architecture team responsible
for conducting their security architecture question interviews and 7 members of the team responsible for conducting their vendor acceptance question interviews. And as of the time
of the audit, these offices had 4, 7 members respectively. In addition. Sorry, lost my
place. And although although the security architecture question airlines with other industry leading question and K 12 and higher education, these are specific to organizations acquiring
cloud-based services. question can take several months for vendors to complete which may cause fcps to lose business and not acquire critical goods and services in a timely
manner. Vendors choose not to participate to the length and scope of question relative to what their offering in terms of service. So for OCS inefficiencies, stem from
vendors, either not completing questionnaires when they sent out or not completing them in a timely manner, which was a valid ID sums for some vendors and support that they provided. was difficult for us to validate for the sample of
contracts tested just due to the limited milestone tracking an established indicators we will describe in the next finding. So we recommended
that O C S and T a scope. Their question based on the service or product inquired and consider implementing a 3rd party risk management and trust software as well as consider accepting
industry-leading certifications and out of stations in Louisville. Question heiress. The next moderate fng finding 3, which is the limited
performance monitoring for procurement activities O P S O C S and have not established kpi key performance indicators to track the effectiveness of
chairman vendor View activities. There were noted consistencies and recording milestones in the contract requesting management system or cram system which isn't
managed by O P s with limited available milestones available for security architecture and the vendor acceptance question activities per the Government Accountability. Office management may need to design
performance measures that indicate a level or degree of performance such as milestones and establishes activities to monitor performance measures and indicators. The lack of
established indicators does not allow for management to obtain a clear indication of the effectiveness of these controls. So we recommended that O P S O C S and consider
building key performance indicators into a cure the into their current procurement and vendor review activities. So they have a baseline formed against which to measure the
effectiveness of their processes. finding 4, which is low risk titled Contract File Review. Aging noted that 9 of
the 63 contract files were reviewed were in compliance with procurement requirements. But we're missing some documentation that should have been maintained in their
contract file per fcps regulations so peas and best practices found within chairman manual. Additionally regulation 50 12 does not describe cooperative. Chairman
process detailed in the care manual which made up 44% of contract activity in 2024. And fy 2024. So we recommended that O P s consider
documenting currents chairman methods and regulation 50 12 to include cooperative procurement types. And PS consistently apply. Steps outlined in guidance and ensure that the documentation
for contract files is maintained. It is required. And lastly, the one observation titled Supplier, Diversity Initiatives Facilitated by Fcps. So
alignment with the Fairfax County Purchasing Resolution and the one Fairfax policy and the Virginia Public Procurement Act. The Fairfax County governments, Department of procurement and Material Management, which is their
version of our Office of Procurement Services have established supplier diversity program with a mission to provide the necessary support to small women and minority owned and service, disabled,
veteran-owned businesses, which I'll be referring to a swim businesses this community, they've established this program for this
community designed to do business with in and with Fairfax County O P S is not establish their own separate supplier diversity program apart from the county. It's
unclear whether Fcps is required to establish its own supplier diversity program as dpm them does include both Fairfax County government and Fairfax County, Public Schools, data in their
reporting of the participation of swam suppliers in contracts awarded. So we recommended that they can O P s console with the Vision Council and or the county government to
review and evaluate whether Fcps is obligated to establish a separate program that mirrors the supply to diversity supplier, diversity
initiatives the county has established PS consider publicly advertising resources available to prospective swam vendors and consider updating regulation 50 12 to align with
what is found within Virginia Public Procurement Act and the county's purchasing resolution. With I would like
to Pso for working with U.S. collaborating with us answering our emails and providing support. We need to complete this audit. And with that, I'd like to yield back
to the chair direction. Okay. Thank you, Mr. Abbott sentence tease Tim. They are named in the script was written this time said anyway, we know
you're So anyway, this is there's a lot here. I know we have leadership from the various departments here. So thank you all for being here. >> So with that open the floor
for questions from committee members, Mr. Hunt. >> This is just from the lack or what this is based upon you can learn. Some reading
report. And the first page report highlights. Could you explain to me what those fine into Cannon's off? dollar
figure on and then positions is that? Positions within that office. Respect about this. for example, you he is a 77
positions with. 29 million dollars. Persists. Ups is a 20 positions from 30 million dollars.
>> So the is a section of USA. So which is enterprise information system? And assessment. I apologize if I have got that incorrect. But
they maintain the section. Who does Thunder except Inc processes? >> Like I was just looking at
poor petition differences amongst does so that current OK, thank you. So when say a pro, charmin process. We sure
get Whether certain contracts. We're sort of the season needed. Laurent says that's not a process that some substance questions we want
get when you do process on it. We just look at the process. So May I clarify the question this him and he said the
question, yeas sue this audit. Do we also do a needs assessment? >> To see whether that's service food is needed for
fcps, including that. Yes. So I I think I would need to defer to my team to answer, but likely we have reviewed the justification for why that
service on goods are required and then review the signoff from the necessary. approval. But look, you want to go ahead. So for all the contract files that we reviewed, we
were dollars. Part of it was looking at compliance. >> With the policies and regulations, meaning that we're also looking to see if the need for this. The
contract was justified properly was within there the requirements to initiate that contract. >> As the part procurement
process Okay. If I go one step farther to get to the view the >> Buehler number or is better
the vendors. See. And then how he got to choose a or B or C is that part of Comparing like >> services between vendors
wasn't within the objectives scope of what we looked at. We're looking just to see whether or not contracts where procured, according to how they should be and that all
the contract files maintain that documentation and approvals. >> Okay. If the board wants to. That one step farther, does your office simple
capacity to be able to tender that? >> So I'd like to just to clarify that, right? So the
question east that. If we need to us doing The agreed with management at the time when they make that decision, like let's say they have 3
defenders, spend a 1, 2, 3, and do we will we reach an independent decision? The same asked management could we look
into that does mention whether whether you whether you office. >> Has a capacity to death part this process, procurement process. To it.
>> decision made by the management. The because I guess, you know, picking one than the He was the best of this isn't whether whether you
have the capacity to do that at all. >> Yeah, I great question. I think it depends on the service. Is good set up a cooler right? It is something more general right that we
have the expertise to capabilities to reveal. Yes, absolutely. Yes, but it is something very specialized like if it is related, I'm just making, you know, polite
with special education population. They may need a very unique type of services. And STA terminology. I think that my existing team one will
not be able to pro 5 for judgment. All right. So it depends on what we have procured okay. It's a part of This
>> procurement process, you know, only this time. Have you to the any sources contracts? >> Yes, yes. So if I may, I'm so sorry to sue the Thunder
from Luke. But yes, the answer So if you look at Page 5, it actually types of Polk. You amend that. That was procure led by Suu Cooperative
contract, IFB RFP. And so source. And then we also saw like samples right from each of these category. And I believe I believe under Page 7
in Page 8, is a table so sorry that that is at the bottom. A list at ow the IFB. And the
RFP. So request for How many will in the population doing the years audits and then how many that we will liked it.
And then if you looked at Page 8 the top that you can see that the only population falso source, if this is area off, you know, focus, we only have
9 toto during that time frame and we have looked at. 4 of them. Am I correct? So when you when you look at the one looked at those 4 sources contracts and Chairman, is it
OK for middle? >> When you look at those 4 sources contract. To you or certain, look at what he's
your some lead car. It was really sore source with the doings. Any vendor, a veteran, a park for moms to work. >> Right, right. So I would defer. I know. Look, you have
flight the information with you. >> Yes, so as part of this all source, we looked at specifically whether they had the findings and determination, documentation saying that attesting to the
fact that this is the only source source for this specific type of purchase. I can say that for to have the sole source contracts we looked at, they were related
to fundraising services. So essentially they or the cured as a sole source so that they could be available 2 schools to contract with with this
provider to do fundraising services at their school, the others. So source contracts that we looked at we're related to cut the area here
and application tracking software as well as K 6 language arts, Basil resources.
>> whether you Make an independent to soar. making up the word. >> Source source in Those contracts. What you want you
up just a taking the suffocation by the man on that. Who's out the source source? >> I think we have to, you know, be making a professional
judgment as well right someone. So we have to rely on the management. So defecation. But at the same time, I think Luke, you share with me right?
Life the fundraising. One, can speak about what the actually on better maybe I can defer to management who responds to kind of Doe's fundraising. Fender, but the other 2 from
based upon my understanding, they indeed the only pro fighters in the industry. Am I correct? Yeah, that's correct.
So one of them obviously being dependent on. >> What recommendations the dog is made in terms of who can provide what sort of resources. >> So within that, we did see
that there was due diligence doo determine that that, in fact, was the only available provider of that contract as well as the other.
sole source contract that. >> Okay. Thank you. That's that's going on, including a 44 mile and I would love to entertain offline conversation
with patients some time. Superintendent read. >> Thank you, Mr. McLean, Mr. Moon on the bottom of Page
think. Attorney-General cut General Co talked about the chart. I think at the bottom of the page is a different bottom of the page. But really, I think shows the work
staff has gone to to minimize still source. >> Contracts and we've worked very hard. I know in my 3 years, and the Times I worry,
it's actually created a challenge for us because we're working so hard to only RFP in some areas, but it just wanted to draw your attention to down
on >> I appreciate you. actually pointing to that particular chart. I like what I see them
on lies. It's not that I am trying to second guess management's judgment or suffocation of a source of And
then I don't I'm not arguing that social I'm not on the socials. Maybe of a video need if a much needed for. So
that's that should wind from a student's Fendi 7 for school system. >> as I mean, that should get to be asked community members
of what do we do? >> With the school board that's eat.
>> Ask someone to verify the independent judgment. the judgment made by the management of He in a social justice. I think this is the
right time. This is that this the venue to ask those questions. Thank you, Saint Johns County.
>> So for >> your first finding in terms of they're not being alignment
between O P s O C S and D it. Can you identify what you think the various were and how difficult it's going to be to get that an alignment. And with the risk of not having it
in alignment is. >> So I think this might also to sort of be the I guess, the risk of them not being in
alignment is that there is the increased risk of they're being confusion, delays in decision-making impacts the ability for the office is to understand their role in the
procurement process who has ultimate approval authority and then it it just again creates the delay and procuring services that may be needed all right. Well, as the
rest of it. >> So with the barriers that would be which I think you answered because you're saying what the barriers are that has kept them from being in
alignment. >> I think priorities between the different offices. Obviouslocurement services wants to be able to pick your stuff in a timely manner. And then with the sick
cybersecurity and technology architecture, they want to make sure that what is being procured, our vendors that Fcps is working with are safe and properly vetted to the
maximum a stent extent possible. And I think the priorities can foot the little bit. And that's sort of what causes that can be inconsistent application of
the questionnaires and the vendor of years. >> So in terms of the questionnaires, because you did mention that the questioners, someone not answered at all or some took
too long to answer. Is that standard practice? How long are they? Is it necessary? As did mention an alternative which I would like for you to explain a little bit more elaborate on.
>> The alternatives being that. Except certification. So ISO, 27,001 would be one of the certifications that
would accept that. So I think I can not that be 27,001 is a certification that basically looks at the potential vendors
information system management systems. information, security management systems and they,
in place and ISO. 27,001 is ls more of a performance prescriptive based certification done by an independent. You getting body.
That will take a look at the organization and see if they have the prop or up to day control such as multi-factor authentication. Single sign
things like that. Various controls that they're looking for and prescriptive policies and procedures that, you know.
So I so is is a worldwide organization. So it's more recognized controls that they're looking for. So it's a pretty. Pretty good, certification to. Carry with
you. You have an initial audit and then you would have surveillance audits done every year. So, you know, there's no way to entirely controlled risk. But you want to mitigate
risk. And it's a good way to mitigate risk for potential vendors. >> So that's that certification like the Good housekeeping stamp of approval
is something that. Would not take that questionnaire because the assumption is that have they have that certification that would have answered some of the
questions. Does that make sense? you know, the questionnaire is to reduce cyber security risk or >> information security risk
your mitigating it either through the cap questionnaire or assertive independent certification. So one can be in Louisville. Another. It's what the recommendation. >> Would you happen to know
with the standard practices in other school systems of how they procure? Companies to do this. If they use the
questionnaire or the stamp of approval, I mean, for lack of a better word. Well, I would. >> I was part of vote.
Electronic Roundtable former see so from the Boston, the Boston. Precinct. was talking
about. In lieu of, you know, the standard policy betting they would look for both the ISO 27,001 and a sock to type
2 audit report. So. It is a practice that had that I participated round tables and and heard of. >> Maybe if I can just jump
mean so benchmarking is not part of the scope of this audit because we would like to focus on procurement, which is the big thing. And of course, that cybersecurity risk ease
is imminent. we would really want to do what we can to to mediate. It's but at the same time, I think what is the right balance? And I think I would like to see if management, if you have any
thought to add at this point here because I think this is a great question and I don't we don't have the answer. >> I just like to add, like you said, it's all part of a
defense in debt. Security architecture. As you were comparing the question there, too. Attestation report, sir
certifications, you want to defense and depth with multiple multiple layers mats, kind of speaking to Lucas coming from, where, you know,
cybersecurity has. Duty and fiduciary duty to protect Fcps from cyber cybersecurity events. But defer back to
esters comment. I believe you deferred to management or >> thank you, Mr. McLean. So which specific question asked, are you wanting me to respond
to know? I just think that mercy has a great question. And like about what are the other alternative, right? Like the checklists easily very long and some maybe not or night frame from that
questions correctly? Well, I From what I heard was that. It seems to me that there's a standard practice takes up the certifications for says the questionnaires and what from what was said about the
questionnaires is that sometimes it will cost us business because it takes too long to answer system and just won't do it. They may be a great mentor. They're just not going to be question air. They're not doing it. They're
not finishing that. So he's trying to find out what standard practice is because I cuts I could see the benefit in terms of learning what standard practices are across
the board for other organizations because we're losing business because the question are, does that make sense? Is that even efficient? Are these certifications valid enough that we could say, you
know, we can trust them and then move forward and not wait too long. So I think
>> You know you we have to be thoughtful about what? Our cyber security team says. if they and this is Western, I had quite a little conversation when
>> We. >> I am not a cyber expert. And it when the cyber team says these are the minutes say 10 things that have to be done. If you want a quicker, I
want you to sign a form saying you're going to take full responsibility for the outcome. I'm not going to sign that, right? Because I don't have that expertise. Nor do I
want other. Personnel and the school division to be signing that because we don't have that expertise. So if it's put in front of us that these are the 10 things you need to do. Then we're going to say to
protect the school division, we're going to do those 10 things, right? I'm not going to take responsibility to do 6 of the 10. And if there's a breach, then, I said, Esther,
then the next thing will be auditing the breach and saying why did we not do the other 4 of the 10? All right. And we're going to be right back here. So whatever the standard
we choose to accept or it's referred to as our risk tolerance. It's going to be based on wwe are told is the safest risk tolerance for the school division. And at
this point, I have to rely on our cyber team to say this the safest, whatever, you know, protocol and it is taking a long time guarantee. And we have lost people because of
it. And we've had people say we're not applying because of it. And yet I don't feel like I have the expertise to say, well, we're only gonna do half
of those things are on are only a part of those. That's it's not realistic. Right? If there's another firm or another standard or another certification level that we
think is sufficient. Of course, we're going to implemented. But again, we have to trust our cyber team to say that. Yes, I don't know the acronym that you shared,
but if that is the acronym that we believe today, moving forward as best and it's quicker and we know it'll safely protect the school division. I think we would all agree. It's a good thing to
do. I haven't had that presentation right? So absent that presentation, we're going to continue to do what we think is going to protect the school division at this point.
So that is a come a long answer to the question. But that's as we look at this. I don't know that we can pick off pieces of the a cyber review that are more or less
important at this point, we're told they're important. procurement is following that That's how we're managing it at the moment. Yeah, I think
my question was more. Certification that you said like if this comes and they have the certification. >> With that covered those 10
items like do we trust like, I don't know what that certification from the independent party that says this company is certified as a good company to do
cybersecurity because they usually cover boom, boom, boom, boom. And I guess that's where begin. I am not. think we can look into that and get back to OK, right now we're
following the process that's been recommended or the risk tolerance recommended by our cyber team. Okay. I think someone from well, that's okay. I think that's the answer. Okay. Yeah. I think somebody wanted to speak of
and no, that's okay. I think it's tough. >> Even though I appreciate
the response given by talk to I feel her. Still come par at the fact that. Superintendents. It's in a
position. To just relying on, you know, staff. Cybersecurity is to make those decisions.
And this call. You know, it's getting units and he was on par. If you don't talk to Did your tax bill? Did your tax
bill? And to question him ask by hour inside was can you can for offender to satisfy? Is it a wee for us to be able to
compare our question there with some other school districts? >> So I think there must be a way someone to answer your question. I'm sure there is a
way. >> Ease. I don't know if we have the best person to get that list because we and just very candidly speaking, I don't have to those contacts
in the other school districts. So I'm wondering. Maybe management, could we have that exercise right to see how the other not only K 12, right? Because I don't thing any
organization can D*** cybersecurity Maybe. Take a look at how the other like checklist of being done. I just an idea. Dr Thanks, Mr.
McLean I think absolutely we could. I do think it is important to stay in the K 12 spear. >> Because we have such unique student information which requires a different level of
protection sometimes. So I would. But I'm happy to. Collect that information. And talk you know, talk to if you could have. >> The compelling to some of
the largest school districts. And or older Critics take caution a cautious approach as we do with that may be one thing. But if we just a
standout on order of this court that's people something think about. Yes, >> Great. Well. Thank you, everyone for fulsome conversation. Thanks contend
for your work on this. So we're now going to be moving to item one point 0, 6, school year. 25 student disciplinary audit. So I call on hot item. One pointers.
>> Thank you, Ryan. But that's a new one. Every one. So our office conducted a performance audit of student discipline due process in accordance with the Fy 25 approved plan. The
scope of this audit was school year 2024, we also incorporated data from previous school year 2023 for comparative analysis. The primary objective of this
audit where to assess compliance Reg applicable regulations, guidelines and policies evaluate effectiveness of students and student discipline in total
control and benchmark the process against other educational institutions and leading best leading processes due to the confidential nature of the audit report and
exception from the freedom of Information Act requirements. The detail of this reports will be will not be shared publicly as it would be shared
in the close Any comments on this comments and questions. >> Seeing none. We're going to move on to item 7 and it followed pneumonia Right?
Okay. >> Okay. So the following documents prevents on that. Fall out of that recommendation. Follow-up as
of January 2025. As you can see since a loss on that follow up. We were able to close the the audit and currently we have only 2
outstanding items which are highlighted in life. this is
for them. This Russian services We have to recommendations that are outstanding and are currently in process why we were able to verify that keep the I would have or develop more
established benchmarking data collection is ongoing. Tucker is ongoing process to create baseline for future comparison. We also the
updates for food and nutrition services regulation ongoing. All full and is expected to be completed by March 2025. this
month. Next, we have facilities, maintenance. AG, verified and close to recommendations related to
prevent of men's tennis. Firstly, we were able to verify, dot, sold trade for tomorrow. Graduates have obtain 4th time position during this school year. Also
H r address or its youth. The year experience to facilitate graduate high line. Secondly, a new standard operating procedure or an S O P was created or developed a
schedule twice flee twice weekly preventive maintenance. Also within so Peter Risk base priorities priority patients
model utilize in schedule and facility condition assessment data is being them all up optimized. To current resource locations. For the remaining 2
recommendations related to form in the decayed of preventive maintenance team and exploring information system functionality.
>> Management has asked to close them for all and the stand. Then due to budget constraints. Management's was unable to implement them. Shych point she proposed to close these 2 items and the
standing that management has violated implementation for Blasey within the existing budget. Next item we have
grants. The recommendation for native to grant applicants rating is now closed. Financial services fast team has created then on local school next refund or SAS
grants reporting Web form and phase 2 is now complete. I lost items are. Holland, middle and imagery mentioned
school of business process audit. The tour recommendations related to monitoring of the nation related projects and payment fcps person personnel are now
closed during a follow-up. We were able to review cash disbursements over month over the 4 month period. And noted no donation or personnel payments were made. We will
also continue our monitoring on FOX as part of AG. If like, TWENTY-FIVE continues monitoring efforts. eg cost of to include a review of the
nation and then all the A we continue to follow up on House didn't stand and items on a quarterly basis. The next follow-up would be in would be
as of April 30th of 2025. Any scheduled to be presented. The Joint Audit Committee meeting. >> Great. Thank you. And any questions or comments on these
follow-up items? Saint John County, is okay? Wonderful. thank you. Also at 5.22, this meeting of the audit committee
is adjourned. We'll be meeting again. And so, remember, it will April >> April, 28, yes, see that.
>> Now, not a committee will make a motion to go into closed meeting to discuss personal matters pursuant to section 2.2, 37 11, a one of the code of Virginia and to consult with legal counsel regarding specific matters
requiring the provision of legal advice by such council pursuant to Section 2.2, 37, 8, 8, the code of Virginia, specifically a personal matters and 2 studen