Good evening. This is April Chandler calling to order the legislative Audit and Policy Committee meeting for October 21st, 2025. Um, we usually begin with public comment, but seeing as there are no, um, commenters present at the meeting tonight, we will move on to our first item, um, item 3.01, approval of the September 16th, 2025 draft minutes. May I please have a motion to approve the September meeting minutes? Motion to approve. September 16th, 2025 LAMP meeting minutes. Thank
You, Ms. S Shernoff. And, um, I will offer that as a second. Um, the motion was properly made by Ms. Shernoff and seconded by Ms. Chandler. All those in favor, please say aye. Aye. Aye. Um, seeing none opposed. Um, with Ms. Donahue, absent for the vote, the motion passes. Um, tonight at the request of staff, I am going to make the, um, decision to change the agenda and treat the first item 4.01. Um, as a discussion item. Um, Dr. Bergen, would you like to speak to why
that change was requested? Yes, Madam Chair. Uh, it occurred to me it was an oversight that we did not follow our own good practice and post the policy for feedback from our community after the last meeting. And I don't wanna miss that important step. So I, I don't believe there's, uh, timeliness to this, that it, it couldn't wait for another cycle. So if we take it up as an information item tonight with the other policies that we're considering, we'll send them all out as a batch for advisor to our advisory committees. Uh, thank you, Dr. Bergen.
I'm, I am definitely in support of that approach. Um, and, uh, in, in bringing this forward, we'll discuss it, discuss it again as an information item. Um, I chose to bring this policy forward as the first course of action following our discussion way back in August on aligning the policies related to staff who report to the school board. To that end, after reviewing the procedures in other divisions that have an auditor general or similar, similarly, um, positioned auditor, I have suggested new language that would bring the authority to employ the auditor General
directly under the authority of the school board to align the office of the auditor general more appropriately with the typical industry standard. In considering the best course of action, I weighed placing the auditor under the direction of the school board chair, but opted for this, leaving the supervision of the Auditor General in this committee, which works most directly with the auditor General. This alignment works well for direct oversight of the actual work and sets us up in the event in the future that we should choose a new standing committee to transfer oversight of the auditor General from the Legislative Audit and Policy Committee to a new standing audit committee.
I'm looking forward to hearing the perspectives of the committee members on this proposal. And to that end, I would also ask that staff incorporate the, uh, changes that are in the Chandler Amendment, um, so that they can be included in the document, um, when it goes out for review. All right. With that, uh, are there any questions or comments from the committee? Great. All right. Well, um, seeing no further discussion, we will move on to our other information items, um, including item 4.02, policy 2130, the oath of office.
Um, this policy was last reviewed in September, 2021 with pro proposed changes align with the current practice and provide additional clarity. Um, Dr. Bergen, our chief of staff, will be presenting Dr. Bergen, the floor is yours. Thank you, Madam Chair. Uh, we are not proposing any changes to the one sentence in this policy, uh, as there are no changes in the, in the code to my knowledge. So this is up for review simply because it's good practice to touch each policy on a, on a cycle. And this has not been touched by the board since, uh, is that correct?
This 2016? Am I reading that correctly? So, yeah, it's just, uh, for the board to consider if there are any changes necessary to your oath of office. And I would defer to legal if there's any other reason why we would need to consider any changes to this policy. Looks like a longstanding policy. Um, thank you for that. Looks like silly, but I guess you do need it. Thank, yeah. No, actually, thank you for bringing it forward. It's certainly important that we touch every policy in a timely manner. Um, is there any discussion or comment? Nope. Okay. Uh, thank you for bringing that forward, Dr. Bergen.
Um, let's see. Now we will move on to review of policy 2140 orientation and professional development for board members. This policy was, is also due for its five year review, last reviewed in November, 2021. Um, again, the proposed changes align with current practice and provide additional clarity. Um, Dr. Bergen will be presenting again, Dr. Bergen, the floor is yours. Yes, ma'am. Uh, as you stated, it was just up for five year review, but when we put fresh eyes on this, we realized that there were some, uh,
suggested revisions for your consideration. First of all, with the title, this is, uh, specific to new board members. 'cause we are talking about their orientation and professional development, um, in the opening paragraph, uh, simply a stylistic choice of changing the word problems to protocols, uh, in paragraph B, just to be consistent with revisions to other policies, striking the word division and leaving the word superintendent by itself or designee. And then, uh, most of the changes occurring in the following paragraphs,
in paragraphs C in lieu of titling the paragraph special workshops, we would call it plainly New School Board Member orientation. And it would elaborate what is our current practice, which namely is for the superintendent or designee to schedule in-depth programming for new school board members for the primary purposes of orienting those new members to their responsibilities. As, I won't read the rest of the paragraph, but as the language is already in place. But then, um, clarifying that this is at the direction of the chair of the board. So the superintendent or designee would work with the chair
of the board and setting that scheduling and that the chair and other board members would be invited to participate in orienting the new members to the board. Um, and then lastly, in paragraph C, uh, spelling out that newly elected or appointed school board members are expected to attend the new school board member orientation within a 30 day period following their election or appointment. Uh, the other major changes to this policy, again, with fresh eyes was current paragraph F applies to all board members, not just new. And so relocating that current paragraph f in its entirety
to a different policy that would pertain to all board members, which we'll get to next on our agenda, as well as number two. How this got stuck in there, I'm not quite sure, but it talks about the professional development of the superintendent. Again, taking that paragraph in whole and moving it into a different policy that pertains only to the superintendent and his responsibilities. And that those are all of the red line changes. Thank you, Dr. Bergen. Um, I do find, um, personally that the proposed changes align with my lived experience. So I do appreciate that we're, um, really making an effort to capture the intention of, um, the process
and to also make sure that our other policies are in more appropriate alignment. Um, are there any comments, sir? Sure. Ms. Shernoff. Thank you. Um, chair Chandler. Uh, my question is for Mr. Allen. Actually, one of the questions. I also am very on board with all this, and I, the orientation was so important. I mean, all nine of us changed over at once, so that was unique. Um, and that will not happen again, but I still think there's a lot of value here. Uh, one question I got asked after the fact was about Quorum and how quorum rules work in the interim
between being elected and then sworn in. And so I just for clarity's sake, is that something we might wanna consider adding in here to say that it's not, or is that just understood? I wasn't sure if that should be a point of clarification or if it's good the way it is, and we don't need to address it. But there are different rules in that interim period that apply once you're elected, and then a difference once you're sworn in. Thank you, Ms. Shernoff. So if I understand correctly, just to clarification that until, even though you're elected, until you take oath,
that you don't apply towards the, a quorum, uh, to run a foul of foia, you know, um, or open meeting requirements, um, that the committee could certainly put that forward just to have clarity if they would. So, like to do, It's not a hill for me to die on. I just sort of wanted to get it on the record, honestly. Yeah. I mean, it's just for the public. I think it's a little bit confusing that we can have those meetings and all talk and then, or whoever's new could get together and all talk and violate what could be perceived as quorum, but it's not. Um, so just something to think about. But, um, again, not a hill for me to die on,
but I wanna make sure I put that on the record just so that people know that there is a distinct difference before you are sworn in. And it is something that will have to be taken into account with all of the school board members who are not changing in any way that impacted. Right. True. It's something to think about before we come back to the next meeting. Yeah. Yeah. Thank you. I can circle back with you if you wanna put in a sentence or something. It's interesting. Yeah. It would be our intent not to have more than two board members, current board members attend any orientation session so that we didn't run a foul of quorum. Nope. All right. With that, um, thank you Dr. Bergen.
And we will now move on to, um, our next item 4.05 policy, 31 20 powers and duties of the division superintendent. Oh, no, I, I'm sorry. I apologize. I skipped an item. Our, uh, next item is item 4.04, policy, 10 35 school board norms, protocols, and violations. Uh, this policy is also due for its fifth year review, uh, being last reviewed in April of 2021. Um, and the proposed changes, again, align with current practice and provide additional clarity.
Uh, Dr. Bergen will be presenting again, Dr. Bergen, the floor is yours. Yes, Madam Chair says I referenced earlier striking paragraph F from 2140. It would then land here in 10 35, uh, as new paragraph B. And again, this policy pertains to all board members, elected board members. And so this would speak to the, uh, expectation of ongoing professional development for all board members while we had fresh eyes on this policy. Also, then we looked at paragraph, uh, re, re, uh, number D protocols.
If you flip the page to the back, page four in paragraph six A, uh, the current language, uh, regarding visitation to schools says, unless invited by the building or, yeah, unless invited by the building principal, the board member, uh, uh, it currently states that board members would communicate in advance with building principals about a visit to their building, which is certainly much appreciated. So there are no surprises for our principals, and they're prepared to receive a board member. And that has been our practice. Our board members have been very good about communicating
with the administrators. There's been a common practice of the board members notifying the superintendent's office or designee chief of staff just for coordination, um, to attend on those visits, uh, or not. Uh, so, but there's nothing in, in policy to codify that good practice. So this would capture that by inserting the words. Uh, I'll read from number six. School board members are encouraged to attend school activities when possible and to visit schools periodically to maintain contact with building principals and increase understanding of actual educational practices.
And then bullet a notify the chief of staff as well as the building principal in advance of school visits. And then I would share that notification with school leadership, just so they would be aware. Uh, so there should be follow up questions. They would, they would already be aware of the visit. Um, and of course, the office of the chief of staff is help happy to help facilitate those visits for our board members at their request. Those are all of the changes that, uh, are before the board at this time. Be happy to answer any questions and defer to legal if there are any other sections
that need discussion. Thank you, Dr. Bergen. Um, any questions or comments from the committee? Um, Ms. Shernoff, Thank you so much. Um, I just, I don't have any questions or comments. I approve of the changes that are in the red line version. I just, this has been something I've been thinking about for a while and I'm wondering if this might be the right place for it. I struggle and we are gonna have a change in leadership in January. We know that, um, as far as the chair. And so in many of our policies, it mentions in the policy we just talked about, the chair will work with the superintendent, the chair will do this.
The chair will assign people to committees. The chair will do this. And I feel like they're kind of scattered all throughout our policies and they're not all in one place. And I'm wondering if that would be a nice section to add here for school board norms, protocols, and violations in terms of new people coming on and having a consolidated list of accountability expectations that the chair and the vice chair would participate in. I know they attend various different events, um, that some board members are not invited to outside of that, because they hold that position, they hold speaking engagements at some of our big events.
I just think it would be nice to have it consolidated in a place. I don't know if that would be in a regulation. So that should things change that would make more sense. We could more quickly and easily make those changes. Or if that could be put into this policy as a section of just sort of a generic list of the different things that the chair takes on just for clarity. Um, and I'm just curious what your thoughts are on that. 'cause it is another role of the board separate from just being a board member that has additional responsibilities. And while they are listed throughout many other policies, it would be nice
for my organizational brain if they were in one place. I, I do find that an interesting idea. I I would wanna sit with it. Sure. Um, and, and sort of consider, uh, really where I land on that suggestion. But, uh, I am open to the idea and absolutely happy to have a conversation. Um, is there anyone on staff who has any immediate reaction to that proposal? Or that it is embedded in lots of policy, but we don't have any specific policy that speaks to that directly? Correct.
Thank you, Mrs. Chandler. Um, while not a legal issue, um, just institutional knowledge wise, yes. It's, um, as Ms. Shernoff alluded to, there's various policies that do set forth certain roles or responsibilities of the board chair. The other document that's not in your bylaws or policy is the annual organizational resolution, which also sets forth some of the rules and responsibilities of the chair. So perhaps instead of doing it in policy, you could, the board could consider incorporating that more straightforward
and the, uh, organizational resolution on an annual basis. Uh, and then to shernoff, in terms of a regulation, I, I would probably, uh, discourage that just because regulations are kind of reserved for administration versus policy, which you all have the purview over. That makes sense. Um, I do find it interesting and, and one of the, we have as, um, a school board decided some very specific norms that haven't necessarily been conveyed, um, out to the community. And I'm curious, I that may be something that we should engage in conversation as we, um,
move forward with this policy next month, is whether that's something that should also be included perhaps in the resolution since it would change according to when the school board changed as opposed to when the policy changes that could, the policy could last longer than more than one iteration of the school board. Something to think about. Yeah. Um, mission enough. It's kind of, it's just the two of us. So, um, would that also fall under LAMP if we change the, can you tell me again? The organizational meeting, what's that called? The resolution Annual Organizational Resolution, would
that come through us as well? I'm just, I'm trying to, it wouldn't. Okay. Typically it has not historically. Okay. So I'm just trying to position ourselves timing wise. It just feels timely to kind of think about these things, um, and where they would fit. Um, and again, it's, it's not anything outside of just knowing what all of those things are that could be done. And I think, you know, we interact with our chair all the time, so I think we kind of have a good grasp of the different pieces. And we're a pretty forward facing school board in terms of events and things. So we see that work. But I'm just thinking in terms of,
you know, the bigger picture. So maybe we could have a conversation with staff and, and see where that might be appropriate. Uh, so I don't really know where that puts us with the policy for sending it out for feedback, because I think if this committee decides to add that section, I would rather have all of that go out to the public at one time. And I don't know that that decision can be made tonight. So if you wanna, I mean, it's up to you, I guess. So I will defer to you, but I would like to think about finding a landing place for that conversation. I would be open to holding this policy so
that it comes back as information next month. Um, are any other comments? No. No. Alright. Then we will move on to our last information item. Uh, five. Well, it's, we did have to renumber, um, 4.05, uh, policy 31 20 powers and duties of the division superintendent. Um, this policy is of course being revised as a result of revisions to policy 2140, which has already been discussed tonight. So, uh, Dr. Bergen, again, the floor is yours Well stated. That's it. Uh,
mo moving it from 2140 intact into policy 31 20. Since it speaks specifically to the responsibilities of the superintendent for regular ongoing professional development, it seemed appropriate that it would fall underneath powers and duties of the division superintendent. Alright. Um, thank you Dr. Bergen. Uh, any questions or comments? Sure. Go ahead, Ms. She, Thank you for that. Um, I just had a question about language, and this would be for you, Mr. Allen as well, really putting you on the spot tonight. Um, when it says the division superintendent shall participate annually in high quality professional
development activities at the local state, when it uses the word or their national levels, it doesn't imply that it would have to be local, state, and national levels. Correct. We're not ma making all three of those mandatory the, OR would keep us from that. Thank you, Mr. Turnoff. Yes. That, that language is come, comes straight from the Virginia Code section 22.1 2, 53 point 13 five, section D, and it does have the word or so. It does provide the flexibility there as opposed to the required of or mandate of all three.
Okay. And then this is, would this be separate from the engagements that may or may not require approval for travel and cost by the chair? Just to my, just to beat my point from before one more time. Um, just wondering how that all fits in here. 'cause that's really in his contract, not necessarily in policy. So would that be something that we would need to cross reference here in terms of protocols for making those decisions? Or is it just a vague like he'll go and participate? Do we not need to be that specific? He or she should it ever change? Yeah, I, I think that within the board's purview to provide
that level of clarity if it thinks it's needed. Um, but you, the, the superintendent's contract does provide for that. And I don't see them as mutually exclusive necessarily. So, but it, it certainly if within your, uh, discretion, I'm okay with that as long as it's covered there. I just didn't know. Do you think that it would be appropriate to cross reference a contract here or not so much to give clarity on those issues? I think you could under cross reference. It's not a legal reference necessarily, but, um, you could consider it, it'd be, um, unary
for any other policy doesn't reference. Okay. But That's what I was looking for. Um, I actually have a question. Is there a hierarchy in terms of the value of the documents between policy and, and the superintendent's contract? So one is based on, on contract, right? So contract law applies versus policy, which is, um, ever evolving. And, um, you know, there's, there's legal ramifications for if a board doesn't follow policy. Um, and then there's also legal ramifications, uh, for,
you know, violating or breaching a contract. So different considerations, Different considerations And different consequences. Very interesting. And then of, of course, the, something to think about. Okay. Well thank you for that clarification. Um, any further discussion? Me too. Okay. Um, then we will move on to the last item on our agenda today, which is a discussion item. Um, this is 5.01 office of the auditor, general overview of current audit reports. Our auditor general Mr. Ahmad Woods, will present Mr. Woods, the floor is yours. Thank you, Madam Chair. Um, today the office auditor general will present two audits
that we recently issued. Uh, they include the IT third party, uh, risk management and the staff support advocacy audits. Next slide on, uh, today's agenda. We'll go over the background and objective and scope of the audits. Uh, we'll discuss quickly the opinion and criteria of the audits, uh, findings and recommendations and management response. Uh, we'll also briefly go over o a's assessment. Next slide. And just to give you an overview of, uh, how we classify findings. Uh, we have them as high, moderate, and low.
Uh, a high, uh, a finding classified as high is a high priority issue. And immediate management attention is required. Moderate will be a medium priority issue. Timely management attention is warranted, uh, in a regular day-to-day operations of management. And a low priority would be a routine management attention. Alright, we will go over the first audit, which is the IT third party, uh, risk management. Uh, LCPS operates under a centralized purchasing and contracting system designed to promote full and open competition. This is in alignment with Loudoun County School Board
policy 64 30. Uh, this approach aims to maximize educational value and cost efficiency. Formal guidelines are in place for contract approvals, particularly, particularly for procurements. Exceeding $300,000 are those deemed of special interest, which require approval from the Loudoun County School Board. The purchasing agent manages all compliant and budgeted awards. These procedures also extend to third party contracts, including information technology contracts. Next slide please. The
objective of the audit was to, uh, evaluate Loudoun County Public School, how Loudoun County Public School identifies monitors and mitigates risks associated with third party IT vendors. Uh, the audit covered, uh, activities during fiscal years 2024 and 2025, uh, focusing on risk assessment, vendor selection, contract management, monitoring and termination. The audit opinion is controls should be enhanced. Uh, this is based on the audit conclusion that identifies high risk findings requiring immediate attention.
Uh, below you'll see the criteria. I will not read them all, but they include identified LCPS or Loudoun County School Board policies, as well as the, uh, Virginia Code for Public Procurement Act regarding it. Third party risk management. Uh, we identified two findings, uh, the first one being Loudoun County School Board. Uh, lack of formal third party risk policy. Uh, currently we do not have a third party risk management policy. Uh, the absence of this policy, uh, may hinder consistent risk identification
and medic mitigation, potentially increasing exposures to operational compliance and cybersecurity threats. The second finding was insufficient documentation and validation controls, uh, inconsistent due diligence and incomplete documentation across vendor contracts, which may lead to oversight gaps, unclear expectations and accountability issues. I'll pause real quick to see if there's any questions. Alright. Okay, next slide. Um, previously we went over the findings.
Uh, recommendations include that, uh, loud County School Board should develop a third party risk management policy to include procedures for evaluating, monitoring and managing, uh, vendors, and especially IT vendors also integrate an IT risk categorization framework. Uh, this would help identify what vendors we contract with who are high risk or moderate or low risk. The second recommendation is to strengthen documentation and validation controls.
Uh, use standard contract language and technical checklists and incorporate them into a comprehensive third party risk management framework. Um, as part of that framework, it would establish clear protocols across all phases of the offender lifecycle. Um, to the right we have, uh, management response. I'll just quickly go over them. Um, they do acknowledge deficiencies and are committed to maturing the onboard technology review process, enhanced communication and documentation processes or practices, and collaborate across, across departments
to improve oversight. Next, uh, they did express concerns about implementing vendor risk classification for the following reasons. Uh, FOIA implications. Um, there might be some concerns that, uh, some of the information collected on how our vendors perform may be subject to foia. And as such, that vendors may be apprehensive to enter into contracts if they are, um, fearful that the information we collect on them is subject to public disclosure. Uh, second are resource constraints.
Um, right now the staff, uh, are busy doing their current day due duties and implementing such a classification may require additional steps that they may not be currently staffed to handle. Um, and again, the potential impact on vendor participation is a result of those FOIA implement implications. I, uh, recently discussed. Next slide. Um, so the assessment of management response, um, by the Dollar General, uh, commitment
to strengthening the oversight management did emphasize the improvement of vendor oversight and documentation practices. They do aim to formalize and use tools like data integration checklists. And it just give you some background. That data integration checklist, it was developed by DDI, it is a, a great tool, um, that they have, uh, developed that does address quite a few items on the it, it third party framework. Um, and now it's about using it consistently and identifying that checklist within a third party policy. Again, the infrastructure, uh, challenges, uh,
of risk classification and performance reviews hindered by current, uh, infrastructure limitations, uh, specifically staffing and again, FOIA disclosures. Um, we can put in place parameters where sensitive vendor, uh, information is, is, is uh, protected. And when we enter these, uh, contracts, uh, we should protect their information that is proprietary. And I think that is the concern that we have entering the contracts. And lastly, we encourage coordination between procurement, uh, and DDI to enhance consistency.
Uh, that is the end of going over it. Third party risk management. Are there any questions regarding this particular audit? Ms. Shernoff, thank you so much Mr. Woods. I appreciate, um, all the information and for the additional information that you were able to help me with, I was wondering if you could just speak to, um, some of the changes that you and I spoke about that were aligned with the state of Virginia and their internal control standards and what happened with that. Yes. Uh, recently, um, the Virginia Department of Accounts revise their agency risk
management and internal control standards. Uh, in those standards. They're asking, uh, agencies within Virginia to develop a, um, comprehensive third party risk management, uh, framework. Uh, and one of the minimum requirements is to document that. And one of the ways we can, uh, do that is by developing a third party risk management policy. Additionally, the framework that they're asking is asking that they, we incorporate a statement of organizational controls from our vendors, which is known as SOC one. Um, DDIs checklist does identify the collection
of a statement of organization's controls, uh, in their checklist. And incorporating that into a third party risk management process would, I would encapture that and we'd be able to use that, uh, to consistently, uh, follow Department of accounts, um, guidance. I appreciate that. And I found that particularly interesting in our conversation because LCPS was already leaning in that direction with this audit and then the state came up and sort of put, you know, backing behind that as well. So I am grateful for that, that context.
And I am very supportive of moving forward with these recommendations. I think it is a good move for us to have a third party risk management policy. And I'm just wondering, I know that this is specific to it, um, and I'm just wondering if a policy could also be more broad because we have third party vendors all over the place in LCPS. It's not just in it. So I'm wondering if we did a policy, do you think that we could section it off? Um, or just those best practices could apply, apply across different vendors? Um, yes. And to clarify,
third party risk management is applicable to all our vendors. Uh, this particular audit covered, uh, specifically IT or information technology, uh, vendors, because for those vendors, they require an added step for, uh, information safety. So we wanna protect our student data, we wanna protect employee data. And so third party risk management would apply to all vendors, but you also wanna incorporate steps in there specifically for IT vendors. Okay. But the other general language should cover all third party risk or all third party vendors.
Okay. I appreciate that. I have a couple more. You want me to keep going? Okay. Um, on page nine, I know it referenced the procurement exceeding 300,000. And again, we're talking about the annual re organizational resolution. I know there's a clause in there about certain thresholds of contracts and what the school board actually signs off on. And everything else is just sort of operational overseen by the superintendent. And I know that that's a matter of practicality. It's always kind of, my control side has, it's always kind of bothered me a little bit. I understand its purpose, but I'm wondering if we could leverage a policy to identify different risk categories
and then maybe if something is deemed high risk or even further, I think there are four different categories maybe that there could be or three, um, that maybe that could be something that the school board could also have oversight over just to give an extra layer of protection so that if there is high risk, we could also look at it regardless of the contract size. Uh, yes. So it's $300,000 or more or high? Um, I don't think they use the term high risk. I think it's, um, a different term. We use, I'll say high visibility for now
until I can remember exactly the language. But during the, um, contracting phase, the due process, if during, before we enter a contract, it is identified that a contract or vendor, uh, does have a high risk. In other words, they have high level of access to our, our data or security, or they may have weak controls, then I, I think you could capture in a third party risk, uh, policy, um, where items that do, where under that $300,000
threshold are brought to the, uh, board or committee's attention. Um, and so they are aware of the risks that we may face entering into a contract with a particular vendor who has been identified as being high risk. Gotcha. There's something to think about, I guess as we navigate this, should we decide to? And then the last thing is just a thank you, your appendix with all these charts with the policies where it's outlined the gaps and what's missing. Um, you can go on board docs and see it if you want. It's just really very clear and so helpful, especially as we think about possibly navigating writing a new policy.
I think that this is really, it's, it's just outstanding work and it just provided so much clarity for me to see where those gaps are and the different policies that already exist and why that would justify a need for another one. So I appreciate the hard work that you did and for all of your analysis, and I look forward to, to the changes ahead. Alright, thank you. Uh, I'm sorry, I was just gonna ask Mr. Woods, if you could speak a little bit more to the, um, FOIA implications and, and what types of protocols might be put in place, um, to safeguard some of that, um, sensitive information. Uh, one is you can aggregate data
or you can, uh, collect it in a way that is, uh, ambiguous. So one can easily identify it as this contractor's information. Um, other protocols, uh, you just have to look at the contract. Maybe you can put in the contract language. Uh, but that'd be something that I think legal would have to, to respond to. And I wouldn't be too sure what contract language we could put in to, uh, make sure certain information isn't disclosed per foia. Um, Mr. Allen, would you like to comment? Yes. So, and, and as a clarification, it's not only the Virginia Freedom
of Information Act, it's really the Virginia Public Procurement Act as well. So, and in tandem, and that that's more governing or controlling over procurement. So we would want to make sure that, and our, our legal team would look at it any considerations to make sure they're aligned with the Virginia Public Procurement Act. And there are, there are, just for edification, there are vendors who submit, um, various, um, proposals, um, or respond to, uh, solicitations. They, they are afforded the opportunity
to mark things proprietary. And if they do, then we're bound to, um, respect that confidentiality and that that's pursuant to the Virginia code. So we would make sure that it's in accordance with the law. I guess we're ready to move on to the next report. May I ask, ask question? Yeah. Um, just circling back, the data integration checklist, uh, is currently in use here. Uh, yes. But what we saw when we tested all our contracts, we tested five contracts out of a, a university of about 148.
Um, not every audit had had performed a checklist even though it came in, uh, during the period in which the checklist was developed, but it is currently in practice and we're asking that we develop a policy that enhances its consistency. Sure. And so I just wanted to accentuate the point. I think Ms. S Shernoff, you made the point we already have that in our practice, despite the fact it wasn't required by the changes in law as Mr. Woods was referencing. And the recommendation is to develop a third party risk management policy. Um, Mr. Woods, is there A-V-S-B-A policy
for third party risk management? Uh, not to my knowledge. So again, I think it's great we'll be leading the way because nearly every school division in the Commonwealth uses VSBA policy. So no one has a third party risk management policy is my point. We will develop one at the recommendation of the auditor general to strengthen our current practices of using a data integration checklist. Thank you. Um, we can continue. Alright, thank you. Uh, the second audit is the audit of staff support and advocacy resources. The reason we performed this audit was a, uh,
was a result of the special grand jury recommendation number seven, uh, focused on improving support and advocacy for staff facing dangerous or disruptive situations, uh, prompting a dedicated audit. Uh, next slide please. Uh, the objective was to evaluate the availability, accessibility, and communication of staff support and advocacy resources, ensuring they're effectively deployed and aligned with employees' needs. And the Loudoun County School Board policies. Uh, the scope covered activities from fiscal year 2023 through 2025, including formal
and informal support systems, policies, procedures, and communication channels. Um, the audit opinion is control should be enhanced, and this is based on the scope and observations contained in this in, in the reports. Um, there are no high risk findings included in the report and that should be noted. Um, again, here is the criteria. I will not read off all the policies, but they also included standard seven school board policies, code of Virginia, uh,
key findings, uh, or first one, there is no formal or standalone ethics or whistleblower policy. Uh, this gap may hinder the efforts to promote ethical behavior, protect whistleblowers and manage misconduct effectively. We do currently have a professional conduct policy. We currently have a, a handbook as well employee handbook. Um, but they don't meet all of the things that would fall into a standalone ethics policy. And they certainly don't meet the what would be in a whistleblower policy. And just to go back to the agency risk management
and, uh, internal control standards issued by Department of of accounts, they also mention, or they do speak to ethics policies and to whistleblower and the same standards that are discussed regarding third party, uh, risk management. Um, if you wanna look for 'em, they're on pages four of the, uh, agency risk management and internal control standards. And page 28. Uh, the next finding is, uh, two policies are overdue for review. Um, they are policy 70 18 and 70 24.
Next slide. Uh, I'm sorry. Previous skipped one, sorry. Oh yeah. Up one. Yeah. Thank you. Uh, the key recommendations are Loudoun County School Board, uh, implement a ethics standalone ethics policy and a whistle blowing policy. Um, also strengthen oversight of existing school board policy tracking system. Those were the two recommendations. Uh, management response is an I'll paraphrase without reading is currently we, uh, are going through, uh, negotiations for the collective bargaining agreement.
These policies, along with the ethics policies and the whistle blowing policy may infringe on those nego negotiations. And so human resource and talent talent development is with, uh, is deferring, uh, addressing the findings and the, uh, rec or the recommendations to not, uh, in interfere with those negotiations and to be seen as a bad actor in good faith and negotiations. Um, it's the auditor general stance that we agree with them to defer, uh, these, um, actions
until after negotiations with LEA or, um, I don't know the acronym off the top of my head. I'll just stick to LEA, but to wait for those negotiations to be done and then after those to revisit these recommendations, uh, and see if there's anything that would need to be addressed. Uh, next slide please. I think I, I, I addressed our, uh, the assessment that I have already in, in those comments. Um, I will stop here and ask if there are any questions regarding this audit. Yeah, I understand
with collective bargaining, it makes it tricky. I guess my question would be, is there going to be a window where those, when the first negotiations are done, that we could slide in there with some of these policies? Or are they forever gonna be in flux if they're not touched by collective bargaining? I guess that would be question for, I'll defer to, uh, bargaining general division counsel. Thank you, Ms. Shernoff. Um, so the topics that are always, uh, up for negotiation under the resolution that the board passed are benefit wages
and then working conditions, right? So to the extent there's working conditions that are defined as four topics, I believe in the first cycle that are mutually agreeable or up to, to four topics and are mutually agreeable. And so there will be a period in my estimation that those four agreed upon topics, which, when they are part of a collective bargaining agreement, if they don't overlap with working conditions for that term of the collective bargaining agreement, which is typically three to five years. But, um, that's to be foreseen. Um, I do think there's a potential argument
or position that could be taken Yeah, in that regard. Yeah, I, I think that that's important and will need to be flagged on when that is. 'cause I really think that this is so important for protecting our employees, especially, I mean, it's no secret we're in a very polarized culture. Loudoun is sometimes at the epicenter of that. And I, you know, it, it seems like an extra protection around ethics and whistle blowing for people goes beyond a grievance. A grievance can just be, this happened to me and I don't like it. And then we can maybe fix that. But actually saying like, I see behavior that I don't think is right is a different step
and to face retribution for that. And, and I have heard that from educators before, that they do feel that, you know, sometimes they don't know if they can speak freely about certain things. And so I do think this is a critical issue, but I wanna respect the bargaining process. Obviously, um, we're right in the middle of all of that, so I wanna make sure that that gets done. But I would appreciate if there is a timeline where there, that could be available to us as board members that that would be flagged for us as an opportunity. 'cause I imagine this would be tense. I don't know.
I mean, delicate, I think it's a delicate topic, um, and could, you know, really take some care. So, um, could take some time to really develop that. So I would just ask for, you know, urgency. I feel urgency around addressing this for our staff and making sure that those things are solidified. Thank you for that context. And um, thank you for clarification on, um, that, uh, potential issue. I will look forward to having the opportunity at some point, um, to move forward with that recommendation. Um, are there any further questions or comments? Alright. Um, thank you so much Mr. Woods.
Um, we have reached the end of our agenda. Is there any new business? No. Seeing none. We are adjourned. Thank you and have a pleasant evening. I.