Mr. John R. Swain, Superintendent
Salem County Special Services School District and
Salem County Vocational Technical School District
880 Route 45
Woodstown, NJ 08098

Re:  Follow-Up Report – A Performance Audit of Salem County Special Services and Salem County Vocational Technical School Districts

Dear Superintendent Swain:

On September 17, 2020, we issued an audit report, A Performance Audit of Salem County Special Services and Salem County Vocational Technical School Districts (2020 Audit),^[1] in which we made recommendations to address identified weaknesses. Pursuant to N.J.S.A. 52:15C-1 et seq., we have conducted a follow-up review of the corrective action plan of Salem County Special Services and Salem County Vocational Technical School Districts to assess the implementation of the recommendations contained in the 2020 Audit. Our findings and conclusions are set forth below.

Background, Scope, and Objective

Our audit of the Salem County Special Services (Special Services) and Salem County Vocational Technical (VoTech) School Districts (Salem or Districts) identified internal control weaknesses that resulted in unauthorized transactions and potentially lost revenue. The audit also found that VoTech lacked adequate internal controls for the billing and collection of payment for child care services.

The objective of our follow-up review was to determine if the Districts have implemented the eight recommendations contained in our 2020 Audit report.

Summary Conclusion

We found that Salem has made progress in implementing the recommendations set forth in our 2020 Audit report. Of the eight audit recommendations, seven were implemented and one was partially implemented. We urge Salem to continue its efforts to comply with the recommendation not yet fully implemented.

Status of Initial Audit Recommendations

Recommendation 1

Develop policies and procedures and appropriate controls for the accounting system user access, including segregation of duties, to address the requirements of N.J.A.C. 6A:23A-6.7(c). The Districts should consider recognized authoritative guidance, such as FISCAM, in drafting its policies and procedures.

Status: Partially Implemented

Our 2020 Audit found that three employees had unrestricted access to the accounting system’s security module and access to systems that were not necessary to fulfill their job duties. The Districts advised in their corrective action plan that a Guide for Standard Operating Procedures and Internal Controls (Guide) had been created and utilized.

Our review confirmed creation of the Guide and determined that, although the Districts did not develop formal policies and procedures related to user access, currently only the Special Services School Business Administrator (SBA) has access to the security module that controls access to the system. The Districts advised that formal policies may be drafted upon the transition to their new accounting system.

We find recommendation 1 to be partially implemented due to the lack of formal policies and procedures related to granting system access. We encourage the Districts to ensure that formal policies are developed related to accounting system user access, including proper segregation of duties.

Recommendation 2

Develop policies and procedures for the assignment and modification of system user access and privileges. The Districts’ procedures should grant the employees user and system access based on job duties and responsibilities and include monitoring of user access and periodic review of privileges. The Districts also should use a formal user access request form to document management review and approval.

Status: Implemented

Our 2020 Audit found that the Districts granted certain staff user privileges to access the accounts payable system when such access was beyond their job title, duties, and responsibilities. In addition, the Districts’ accounts payable clerks had unrestricted access to all aspects of the Districts’ payment process. The clerks were able to initiate, change, approve, and issue a payment without any oversight or approval, in violation of segregation of duties controls. The Districts advised in their corrective action plan that a form was created to identify responsibilities by title. In addition, the system itself was reviewed and audited for permissions based upon employee responsibilities and a quarterly review of user access is now in place.

During our review, we confirmed that the Districts now utilize user access forms that appropriately govern the process. In addition, we noted that employees with similar job titles were provided appropriate access levels to enable them to perform their duties and while properly segregating duties. We were informed that the quarterly reviews are not documented.

We consider this recommendation to be implemented despite a lack of documentation of the quarterly reviews, as we did not identify any issues and there had not been a need to adjust user access as existing staff had not left and no new staff had started. We nevertheless encourage the Districts to adopt formal policies and procedures related to user privileges.

Recommendation 3

Establish a password management process for the accounting system using recognized authoritative guidance, such as FISCAM. At a minimum, the password process should require all users to create complex passwords and to change those passwords on a regular basis.

Status: Implemented

Our 2020 Audit found that the Districts IT Acceptable Usage Policy did not include instructions or requirements for password management, including appropriate complexity restrictions and periodic change. The Districts advised in their corrective action plan that passwords are now required to be changed on a regular basis and that passwords expire after 60 days.

During our review, we confirmed that the Districts required password changes every 60 days. While the current accounting system does not have complexity rules, the Districts are transitioning to a new system that includes this component. Although the current accounting system does not require passwords to be complex, passwords cannot be exported or shared which improves the control environment of the Districts.

Recommendation 4

Develop procedures to ensure that the submission of required Treasurer’s and Secretary’s Reports for all accounts occur in the right order and on time in accordance with the provisions of N.J.S.A. 18A:17-9 and 18A:17-36.

Status: Implemented

Our 2020 Audit found that the Treasurer did not complete the annual Treasurer’s Reports for both Districts for fiscal year (FY) 2016. Our audit also found that the Board secretary submitted the Secretary’s Reports to the Board several months before the Treasurer’s Reports, contrary to N.J.S.A. 18A:17-9.  The Districts advised in their corrective action plan that the submission of the Treasurer’s and Board Secretary’s reports have been brought back into alignment and are now meeting the provisions of N.J.S.A. 18A:17-9 and 18A:17-36.

During our review, we confirmed that procedures were implemented to ensure that submission of both reports occurred timely and in sequence. We reviewed the submission dates for the Treasurer’s and Secretary’s Reports from July 2021 through December 2021 and confirmed that all of the Treasurer’s Reports were completed prior to the Board Secretary’s Reports. Further, the year-end annual Treasurer’s Reports for both Districts were completed timely for FY 2021.

Recommendation 5

Review and evaluate the accounts payable process to establish appropriate policies and procedures and internal controls requiring adequate segregation of duties, proper authorization of accounts payable transactions, secure blank check supply, and appropriate management review and Board oversight before checks are issued.

Status: Implemented

Our 2020 Audit found that the Districts did not implement adequate management review and oversight of the accounts payable process. In addition, the process lacked segregation of duties. The Districts advised in their corrective action plan that the accounts payable process has been reviewed and brought into line with VoTech, responsibilities have been segregated, and duplication of duties have been eliminated.

During our review, we found that the Districts established appropriate management oversight of the accounts payable process. We reviewed check registers, compared the totals of all checks identified in the August 24, 2021 Board meeting minutes, and determined that all checks were approved. Further, we took a judgmental sample of 20 transactions from both Districts to verify supporting documentation. All 20 transactions had proper requisitions, signed purchase orders, and copies of the checks.

We also reviewed purchase orders from July 1, 2021 through February 28, 2022 and identified 17 purchase orders with paid amounts higher than the original approved amounts. Upon reviewing supporting documentation, we determined that all 17 purchase order increases had been reviewed, had an explanation, and had any required SBA approvals.

Recommendation 6

Develop and implement policies and procedures to account for the shared services in compliance with N.J.A.C. 6A:23A-16.11.

Status: Implemented

Our 2020 Audit found that the Districts shared administrative staff, but did not properly account for the shared services. The Districts advised in their corrective action plan that a spreadsheet had been developed to account for all shared services and that the district that owes the other district would make two yearly payments.

During our review, we found that the spreadsheet clearly identified all shared employees and demonstrated the breakdown of salary and benefit costs for each district. The spreadsheet identified bi-annual payments of $212,442 due from Special Services to VoTech for the 2021-2022 school year. We confirmed the first payment was made on March 28, 2022.

Although this recommendation has been implemented, we encourage the Districts to adopt formal policies and procedures that are consistently followed related to accurate tracking of costs.

Recommendation 7

VoTech should develop adequate controls to prevent it from borrowing from student activity accounts in compliance with N.J.A.C. 6A:23A-16.12.

Status: Implemented

Our 2020 Audit found that in FY 2015, VoTech, at the direction of the SBA, paid a District expense of approximately $4,000 from the student activity account due to a cash flow shortfall. The Districts advised in their corrective action plan that controls have been instituted following the retirement of the individual who violated N.J.A.C. 6A:23A-16.12. Salem further stated that at no time are funds from student activities comingled or used to fund the VoTech budget.

Our review confirmed that the Districts’ policy related to the disbursement of funds from the student activity accounts states that “[b]orrowing from [the] student activity account is prohibited.” We reviewed all payments made from the student activities accounts during the period of July 1, 2021 through December 31, 2021 for the Districts and determined that all transactions were related to student activities.

Recommendation 8

VoTech should develop and implement policies and procedures for record keeping, billing, and collection of payment for its child care services.

Status: Implemented

Our 2020 Audit found that VoTech did not establish internal controls or formal policies and procedures for billing or collecting payment for its child care services. In addition, VoTech’s accounting of its child care services lacked adequate monitoring and oversight. The Districts advised in their corrective action plan that the EduMet System is used to track all billing and payments for the child care center.

During our review, we determined that procedures for billing and collecting payments for child care services were implemented. We reviewed attendance records, billing invoices, and payments. Attendance records and billing invoices for the month of December 2021 indicated that all ten accounts were billed properly.  We noted that services were paid in full for eight accounts, that one had an insignificant balance, and that one account was not delinquent, although VoTech actively pursued payment.

We encourage the Districts to adopt formal policies and procedures related to billing and collecting payment for its childcare services.

Reporting Requirements

We provided a draft copy of this report to the Districts for their review and comment. Their response was considered in preparing our final report and is attached as Appendix A.

By statute, we are required to monitor the implementation of our recommendations. To enable us to meet this requirement, within 90 days, the Districts’ shall report to our office regarding the actions that have been or will be taken to address the unresolved issue in this report. We will continue to monitor those steps.

We thank the management and staff of the Districts for the courtesies and cooperation extended to our auditors during this review.

Sincerely,

KEVIN D. WALSH
ACTING STATE COMPTROLLER

By: Christopher Jensen, CPA
Director, Audit Division

Attachment

c: Dr. Angelica Allen-McMillan, Acting Commissioner, Department of Education
Dr. Jamar E. Purnsley, Director, Department of Education, Office of Fiscal Accountability and Compliance
Peggy Nicolosi, Interim Executive County Superintendent of Schools, Salem County Office of Education
Doris Isaacs, Executive County Business Official, Salem County Office of Education
Linwood Donelson, III, President, Board of Education, Salem County Special Services School District & Salem County Vocational Technical School District
Dr. Jennifer K. Bates, Assistant Superintendent/Business Administrator, Salem County Vocational Technical School District
Frank H. Maurer, III, Assistant Superintendent/Business Administrator, Salem County Special Services School District