A REPORT TO THE ARIZONA LEGISLATURE Division of School Audits Performance Audit Tolleson Elementary School District August • 2015 Report No. 15-209 Debra K. Davenport Auditor General The Auditor General is appointed by the Joint Legislative Audit Committee, a bipartisan committee composed of five senators and five representatives. Her mission is to provide independent and impartial information and specific recommendations to improve the operations of state and local government entities. To this end, she provides financial audits and accounting services to the State and political subdivisions, investigates possible misuse of public monies, and conducts performance audits of school districts, state agencies, and the programs they administer. The Joint Legislative Audit Committee Senator Judy Burges, Chair Representative John Allen, Vice Chair Senator Nancy Barto Senator Lupe Contreras Senator David Farnsworth Senator Lynne Pancrazi Senator Andy Biggs (ex officio) Representative Regina Cobb Representative Debbie McCune Davis Representative Rebecca Rios Representative Kelly Townsend Representative David Gowan (ex officio) Audit Staff Ross Ehrick, Director Ann Orrico, Manager and Contact Person Tammy Seilheimer, Team Leader Marsden Burton Nate Robb Timothy Williams The Auditor General’s reports are available at: www.azauditor.gov Printed copies of our reports may be requested by contacting us at: Office of the Auditor General 2910 N. 44th Street, Suite 410 • Phoenix, AZ 85018 • (602) 553-0333 August 11, 2015 Members of the Arizona Legislature The Honorable Doug Ducey, Governor Governing Board Tolleson Elementary School District Dr. Lupita Hightower, Superintendent Tolleson Elementary School District Transmitted herewith is a report of the Auditor General, A Performance Audit of the Tolleson Elementary School District, conducted pursuant to A.R.S. §41-1279.03. I am also transmitting within this report a copy of the Report Highlights for this audit to provide a quick summary for your convenience. As outlined in its response, the District agrees with all of the findings and recommendations. My staff and I will be pleased to discuss or clarify items in the report. Sincerely, Debbie Davenport Auditor General 2910 NORTH 44th STREET • SUITE 410 • PHOENIX, ARIZONA 85018 • (602) 553-0333 • FAX (602) 553-0051 Tolleson ESD Table 1: Tolleson Elementary School District REPORT HIGHLIGHTS PERFORMANCE AUDIT Our Conclusion In fiscal year 2012, Tolleson ESD’s student achievement was similar to peer districts’, and its operational efficiencies were mixed, with some costs higher and some costs lower than peer districts’, on average. The District’s plant operations and food service program operated efficiently, but its administration and transportation program operated less efficiently with higher costs than peer districts’ averages. Administrative costs were higher primarily because the District paid some higher administrative salaries than peer districts, on average. Additionally, the District lacked adequate controls over user access to its computer network and systems. The District’s transportation costs were higher than the peer districts’, on average, partly because it operated a smaller program and transported more special needs and homeless riders. However, the District should look to improve the efficiency of its regular education routes and establish and monitor performance measures to help lower its transportation costs. Similar student achievement and mixed operational efficiencies Student achievement similar to peer districts’—In fiscal year 2012, Tolleson ESD’s student AIMS scores were similar to the peer districts’ averages in the four tested areas. Additionally, under the Arizona Department of Education’s A-F Letter Grade Accountability System, the District received an overall letter grade of C. Three of the five peer districts also received Cs, and two peer districts received Bs. Percentage of students who met or exceeded state standards (AIMS) Fiscal year 2012 100% 90% 80% 70% 60% 50% 40% 30% 20% 10% 0% Math Reading Writing Science Operational efficiencies were Tolleson ESD Peer group State-wide mixed—In fiscal year 2012, Tolleson ESD’s operational efficiencies were mixed, with some costs higher and some Comparison of per pupil expenditures costs lower than peer districts’ averages. by operational area The District’s plant operations and food Fiscal year 2012 Peer service program operated efficiently with Tolleson group lower costs per square foot and per meal, ESD average respectively, than the peer districts averaged. $939 $796 Administration However, the District’s administration was Plant operations 749 811 less than efficient with higher costs than peer Food service 539 523 Transportation 127 271 districts’, on average, primarily because of higher administrative salaries. In addition, the District’s high transportation costs per mile and per rider could potentially be lowered by improving bus route efficiency. Much higher administrative costs In fiscal year 2012, Tolleson ESD’s per pupil administrative costs were 18 percent higher than peer districts’, on average, primarily because it paid some of its positions higher average salaries than the average salaries for the peer districts. For example, the average salary for Tolleson ESD business services staff was 22 percent higher than the peer districts’ average salary for business services staff. Recommendation 2015 August • Report No. 15-209 The District should review its administrative positions and pay and determine how it can reduce its administrative costs. District needs to strengthen its accounting and computer controls Inadequate payroll and purchasing controls—The District had an increased risk of errors and fraud because it did not sufficiently separate its payroll and personnel functions. One employee was responsible for performing all payroll-processing duties and also had the ability to change employee pay rates and add or delete employees within the District’s payroll system, which are typically personnel functions. In addition, we reviewed 30 fiscal year 2012 accounts payable transactions and found that 3 transactions were for purchases made without prior approval. Inadequate computer controls—The District lacked adequate controls over user access to its computer network and systems. More specifically, the District allowed network and student information system passwords to be short and did not require passwords to contain numbers or symbols. Additionally, five of the District’s ten business office accounting system users had more access to the accounting system than they needed to perform their job duties. Further, the District’s network and student information system had user accounts that were linked to employees who no longer worked for the District as well as some unnecessary generic accounts not assigned to specific users, making it difficult or impossible to hold anyone accountable if inappropriate activity occurred while using these accounts. Finally, the District had a disaster recovery plan, but it was missing some key components. Having a complete and up-to-date disaster recovery plan would help ensure continuous accessibility to sensitive and critical data in the event of a system or equipment failure or interruption. Recommendations The District should: Implement proper payroll and purchasing controls. Implement proper controls over its computer network and systems. Ensure that its disaster recovery plan is complete. • • • District’s transportation costs could potentially be lowered by improving bus route efficiency Compared to peer districts’, Tolleson ESD’s fiscal year 2012 transportation costs were 12 percent higher per mile and 40 percent higher per rider. Factors, such as operating a smaller program than peer districts’, meant the District’s more fixed-type transportation costs, such as its transportation director’s salary, increased the District’s transportation costs per mile and per rider because they were spread over fewer miles and riders when calculating these measures. However, our review of bus route records showed that some regular education bus routes were inefficient, filling buses to only an average of 58 percent of capacity. Improving the efficiency of its routes and monitoring performance measures, such as bus capacity usage, may help the District lower its transportation program costs. Recommendations The District should: Review its bus routes and adjust them as necessary to improve their efficiency. Monitor performance measures to help improve program efficiency. • • Tolleson Elementary School District A copy of the full report is available at: www.azauditor.gov REPORT HIGHLIGHTS Contact person: August 2015 • Report No. 15-209 Ann Orrico (602) 553-0333 PERFORMANCE AUDIT TABLE OF CONTENTS District Overview 1 Student achievement similar to peer districts’ 1 District’s operational costs mixed with some improvements needed 1 Finding 1: District had higher administrative costs and lacked adequate controls to protect it from errors and fraud 3 District paid some higher administrative salaries 3 Inadequate accounting controls 3 Inadequate computer controls 4 Incomplete disaster recovery plan could result in interrupted operations or data loss 5 Poor controls over district keys and building access increased the District’s risk of theft and misuse 5 Recommendations 6 Finding 2: District may be able to lower transportation costs by improving bus route efficiency 7 District’s transportation costs were higher than peer districts’, on average 7 Improving regular education bus route efficiency and monitoring performance measures may help lower costs 8 District overstated number of riders transported 8 Recommendations 9 Appendix a-1 Objectives, Scope, and Methodology Arizona Office of the Auditor General Tolleson Elementary School District • Report No. 15-209 Page i TABLE OF CONTENTS District Response Tables 1 2 3 Comparison of per pupil expenditures by operational area Fiscal year 2012 (Unaudited) 2 Comparison of per pupil administrative costs by category Fiscal year 2012 (Unaudited) 3 Comparison of transportation costs per mile and per rider Fiscal year 2012 (Unaudited) 7 Figure 1 Percentage of students who met or exceeded state standards (AIMS) Fiscal year 2012 (Unaudited) 1 Arizona Office of the Auditor General Tolleson Elementary School District • Report No. 15-209 Page ii DISTRICT OVERVIEW Tolleson Elementary School District is a medium-large sized, suburban district located approximately 12 miles west of Phoenix. In fiscal year 2012, the District served 2,558 students in kindergarten through 8th grade at its four schools. In fiscal year 2012, Tolleson ESD’s student achievement was similar to peer districts’, and its operational efficiencies were mixed, with some costs higher and some costs lower than peer districts’, on average.1 Specifically, the District’s plant operations and food service program operated efficiently, but its administration and transportation program operated less efficiently with higher costs than peer districts’ averages. Student achievement similar to peer districts’ In fiscal year 2012, 51 percent of the District’s students met or exceeded state standards in math, 69 percent in reading, 36 percent in writing, and 48 percent in science. As shown in Figure 1, each of these scores were within 5 percentage points of the peer districts’ respective averages. Further, under the Arizona Department of Education’s A-F Letter Grade Accountability System, Tolleson ESD received an overall letter grade of C for fiscal year 2012. Three of the five peer districts also received Cs, and two peer districts received Bs. Figure 1: Percentage of students who met or exceeded state standards (AIMS) Fiscal year 2012 (Unaudited) 100% 90% 80% 70% 60% 50% 40% 30% 20% 10% 0% Tolleson ESD Peer group State-wide Math Source: Reading Writing Science Auditor General staff analysis of fiscal year 2012 test results on Arizona’s Instrument to Measure Standards (AIMS). District’s operational costs mixed with some improvements needed As shown in Table 1 on page 2 and based on auditors’ review of various performance measures, in fiscal year 2012, some of Tolleson ESD’s operations were relatively efficient while other areas needed improvement. More specifically, the District’s administrative costs were higher than peer districts’ because of some higher administrative salaries, and its transportation costs were higher per mile and per rider, in part, because of some inefficient bus routes. The District’s per pupil spending of $6,549 was lower than the peer districts’ spending primarily because it received less federal grant money because its poverty level was slightly lower than the peer districts’ average, and it received less Maintenance and Operation Fund monies because it transported students fewer miles. 1 Auditors developed three peer groups for comparative purposes. See page a-1 of this report’s Appendix for further explanation of the peer groups. Arizona Office of the Auditor General Tolleson Elementary School District • Report No. 15-209 Page 1 Tolleson ESD Much higher administrative costs and some improvements needed—At $939 per pupil, Tolleson ESD’s administrative costs were 18 percent higher than the peer districts’ $796 average. Tolleson ESD spent more on administration because it paid some higher administrative salaries than the peer districts, on average. Auditors also identified some accounting, computer, and building access controls that need strengthening (see Finding 1, page 3). Efficient plant operations—Compared to peer Table 1: Comparison of per pupil Table expenditures 1: by operational area Fiscal year 2012 (Unaudited) Spending Total per pupil Classroom dollars Nonclassroom dollars Administration Plant operations Food service Transportation Student support Instruction support Peer group average $6,968 State average $7,475 3,289 3,582 4,053 939 749 539 127 421 796 811 523 271 522 736 928 382 362 578 Tolleson ESD $6,549 districts’ averages, Tolleson ESD’s fiscal year 2012 plant operations costs were 19 percent lower per square foot and 8 percent lower per 485 463 436 student. The District was able to spend less on Source: Auditor General staff analysis of fiscal year 2012 Arizona plant operations primarily because it employed Department of Education student membership data and district-reported accounting data. fewer plant operations staff per square foot than the peer districts’ average. Tolleson ESD contracted out the custodial services part of its plant operations, as did five of its peer districts. Compared to those five peer districts, each Tolleson ESD plant operations full-time equivalent position maintained 33 percent more square footage. Efficient food service program—Tolleson ESD’s food service program operated efficiently with a $2.11 cost per meal that was 13 percent lower than the peer districts’ $2.44 average. Because of this low cost per meal, the District was able to keep its food service cost per pupil similar to the peer districts’ average despite serving 19 percent more meals per pupil. Higher transportation costs—In fiscal year 2012, Tolleson ESD’s $5.42 cost per mile was 12 percent higher than the peer districts’ average, and its $1,183 cost per rider was 40 percent higher. The District’s costs per mile and per rider were higher partly because although the District traveled a similar number of miles per rider as its peer districts, its transportation program was smaller overall, employing fewer drivers, traveling fewer miles, and transporting fewer riders. As a result, the District’s more fixed-type transportation costs, such as its transportation director’s salary, increased the District’s transportation costs per mile and per rider because they were spread over fewer miles and riders when calculating these measures. In addition, the District drove more miles to transport special needs and homeless students, which further increased its transportation costs. However, the District should look to improve the efficiency of its regular education bus routes and establish and monitor performance measures to help lower transportation program costs. Further, the District should ensure that it accurately reports its number of students transported for state funding purposes (see Finding 2, page 7). Arizona Office of the Auditor General Tolleson Elementary School District • Report No. 15-209 Page 2 FINDING 1 District had higher administrative costs and lacked adequate controls to protect it from errors and fraud In fiscal year 2012, Tolleson ESD’s administrative cost per pupil was 18 percent higher than the peer districts’ average primarily because it paid some higher administrative salaries. Additionally, the District lacked adequate accounting, computer, and facility access controls. Adequate controls in these areas are important to help protect the District from errors and fraud. District paid some higher administrative salaries As shown in Table 2, in fiscal year 2012 Tolleson ESD spent $939 per pupil on administration, 18 percent more than the peer districts’ $796 average. As a result, the District spent more of its available operating dollars on administration, leaving it less money available to spend in the classroom.1 Had Tolleson ESD spent the same per pupil amount on administration in fiscal year 2012 as its peer districts averaged, it would have saved more than $365,000, monies that otherwise potentially could have been spent in the classroom. Table 2: Comparison of per pupil adminstrative costs by category Fiscal year 2012 (Unaudited) Cost Category Salaries and benefits Purchased services Supplies and other Total Source: Tolleson ESD $799 106 34 $939 Peer group average $683 92 21 $796 Auditor General staff analysis of fiscal year 2012 Arizona Department of Education student membership data and district-reported accounting data. The District’s administrative costs were higher primarily because it paid some of its positions higher average salaries than the average salaries for the peer districts. For example, the average salary for Tolleson ESD assistant principals was 9 percent higher than the peer districts’ average salary for assistant principals, and the average salary for Tolleson ESD business services staff was 22 percent higher than the peer districts’ average salary for business services staff. Inadequate accounting controls In fiscal year 2012, Tolleson ESD lacked adequate controls over payroll processing and purchasing, which exposed the District to increased risk of errors and fraud. Payroll lacked proper separation of responsibilities—The District had an increased risk of errors and fraud because the District did not sufficiently separate its payroll and personnel functions. One district employee was responsible for performing all payroll-processing duties 1 Available operating dollars are those used for the District’s day-to-day operations. For further explanation, see Appendix page a-1. Arizona Office of the Auditor General Tolleson Elementary School District • Report No. 15-209 Page 3 and changing employee pay rates, which is a personnel function. In addition, although not a typical duty, this employee had the ability to add and delete employees within the District’s payroll system, which is also a personnel function. Although no improper transactions were detected in the 30 fiscal year 2012 payroll transactions auditors reviewed, allowing an individual the ability to initiate and complete the payroll process, including performing some personnel functions, could allow the processing of false payments. Some purchases lacked proper approval—The District did not always require proper approval prior to purchases being made. For 3 of 30 fiscal year 2012 purchases and 1 of 11 fiscal year 2012 credit card purchases examined, auditors found that items or services were purchased without prior approval. Although no inappropriate purchases were detected in the items auditors reviewed, the District should ensure that an authorized employee approves all purchases prior to ordering goods or services, as required by the Uniform System of Financial Records for Arizona School Districts. This helps ensure that purchases are appropriate and that the District has adequate budget capacity prior to ordering goods and services. Inadequate computer controls Tolleson ESD lacked adequate controls over its accounting and student information systems and network. These poor controls exposed the District to an increased risk of unauthorized access to critical systems. Additionally, the lack of a thorough and tested disaster recovery plan could result in interrupted operations or loss of data. Weak password requirements—The District did not have strong password requirements for its network and student information system. Although users developed their own passwords, the passwords lacked a complexity requirement—that is, passwords could be short and did not need to contain numbers and symbols. Common practice requires passwords to be at least eight characters and contain a combination of alphabetic and numeric characters. Strengthening password complexity requirements would decrease the risk of unauthorized persons gaining access to the network and system. Broad access to accounting system—Auditors reviewed the District’s user access report for five of the ten business office users with access to the accounting system and identified four district employees who had more access to the accounting system than they needed to perform their job responsibilities. Two of these employees had full access to the system, giving them the ability to perform all accounting system functions. These two employees also had system-administrator-level access, meaning they had access to all settings within the accounting system, including the ability to add new user accounts and to modify the level of access users have in the system. Allowing too many users to have this level of access also increased the District’s risk of security breaches because administrator accounts are typically targeted by hackers because of their high-level privileges. Although no improper transactions were detected in the 30 payroll and 30 accounts payable transactions auditors reviewed, such broad access, especially full system access, exposed the District to a greater risk of errors and fraud, such as processing false invoices or adding and paying nonexistent vendors or employees. Arizona Office of the Auditor General Tolleson Elementary School District • Report No. 15-209 Page 4 Inadequate procedures for removing access to the network and critical systems— The District did not have sufficient procedures in place to ensure that only current employees had access to its network and critical systems. Auditors found 11 network user accounts and 2 student information system user accounts that were linked to employees who no longer worked for the District. At least one of these individuals had not worked for the District for more than 2 years. To reduce the risk of unauthorized access, the District should implement procedures to ensure the prompt removal of access when a user is no longer employed by the District. Generic system accounts—Auditors reviewed the District’s user access reports for its network and systems and found that four network accounts and two student information system accounts were unnecessary generic accounts not assigned to specific individuals. Establishing unnecessary generic accounts creates additional risk because generic accounts make it difficult or impossible for the District to hold anyone accountable if inappropriate activity were conducted using these accounts. Incomplete disaster recovery plan could result in interrupted operations or data loss The District had a disaster recovery plan, but it was missing some key components. For example, the plan did not contain important information regarding staff roles and responsibilities during system or equipment failure or interruption. A comprehensive disaster recovery plan would help ensure continued operations in the case of a system or equipment failure or interruption. Additionally, disaster recovery plans should be tested periodically and modifications made to correct any problems and to ensure their effectiveness. Poor controls over district keys and building access increased the District’s risk of theft and misuse The District needs to strengthen its process for distributing and tracking keys for district buildings. Specifically, the District did not maintain a complete and up-to-date log showing keys made and distributed to employees, and the District did not have a formal process in place to determine the access level given to employees. In addition, employees receiving keys were not required to sign a user agreement outlining the rules and policies they must follow regarding the use of district keys. Further, the District’s process for distributing building keys did not include oversight or process controls to ensure that only authorized employees were given keys to buildings or areas within the District. For example, the District issued keys to a service provider who leased space at a district school and worked with district students, but district officials were unaware of the level of access given to district buildings. Additionally, the District did not have a contract with the service provider to outline both parties’ responsibilities, including the service provider’s responsibilities regarding the District’s facilities. Because of the lack of controls, the District did not know at any point in time how many district keys existed and who had them. Arizona Office of the Auditor General Tolleson Elementary School District • Report No. 15-209 Page 5 Recommendations 1. The District should review its administrative positions and related duties and salaries to determine how it can reduce administrative costs. 2. The District should implement proper controls over its payroll process to ensure proper separation of responsibilities. 3. The District should ensure that it requires independent review and approval for all of its purchases prior to the purchases being made. 4. The District should implement and enforce stronger password requirements. 5. The District should limit employees’ access to its computerized accounting system to only those accounting system functions needed to perform their work. 6. The District should develop and implement a formal process to ensure that terminated employees have their network and system access promptly removed. 7. The District should eliminate or disable unnecessary generic user accounts in its network and systems. 8. The District should review its formal disaster recovery plan to ensure it is complete and test it periodically to identify and remedy deficiencies. 9. The District should implement controls over its process for producing, distributing, and tracking building keys, including maintaining a complete and up-to-date distribution log, establishing a process for determining the access level given to employees, and implementing a user agreement outlining the rules and policies an employee must follow regarding the use of district keys. 10. The District should establish a written agreement with the service provider who is leasing space at a district school that outlines each party’s responsibilities. Arizona Office of the Auditor General Tolleson Elementary School District • Report No. 15-209 Page 6 FINDING 2 District may be able to lower transportation costs by improving bus route efficiency Compared to peer districts’, Tolleson ESD’s fiscal year 2012 transportation costs were 12 percent higher per mile and 40 percent higher per rider. Although factors, such as operating a smaller program than peer districts’ and driving more miles to transport special needs and homeless students, increased the District’s costs, improving the efficiency of its regular education routes and monitoring performance measures may help the District lower its transportation program costs. Some of the cost savings could potentially be spent in the classroom. Further, the District misreported the number of students it transported for state funding purposes. District’s transportation costs were higher than peer districts’, on average As shown in Table 3, in fiscal year 2012, Tolleson Table 3: Comparison of transportation ESD’s $5.42 cost per mile was 12 percent higher costs per mile and per rider Fiscal year 2012 than the peer districts’ average, and its $1,183 cost (Unaudited) per rider was 40 percent higher. The District’s costs Tolleson Peer group were higher partly because, although it traveled a Cost measure ESD average similar number of miles per rider as its peer districts, $5.42 $4.84 Cost per mile its transportation program was much smaller $1,183 $844 Cost per rider overall, traveling 87 percent fewer total miles and Source: Auditor General staff analysis of fiscal year 2012 Arizona transporting 89 percent fewer riders. As a result, the Department of Education district mileage and ridership reports and district-reported accounting data. District’s more fixed-type transportation costs, such as its transportation director’s salary, increased the District’s transportation costs per mile and per rider because they were spread over fewer miles and riders when calculating these measures. The District’s higher costs were also a result of the District traveling more miles on bus routes for transporting special needs and homeless students than the peer districts, on average. For example, 63 percent of Tolleson ESD’s total route miles were used to transport special needs and homeless students compared to 52 percent, on average, for the peer districts. The costs of transporting these students are inherently higher because transporting special needs and homeless students often requires special routes with fewer students assigned. In addition, routes for transporting homeless students can be lengthy because, under federal law, school districts must provide homeless students with transportation to and from their schools of origin regardless of whether the student still resides within that school’s boundaries. Despite these challenges, the District could improve the efficiency of some of its bus routes and potentially lower its transportation costs. Arizona Office of the Auditor General Tolleson Elementary School District • Report No. 15-209 Page 7 Improving regular education bus route efficiency and monitoring performance measures may help lower costs Although the District had less control over some of the factors increasing its transportation costs, improving the efficiency of its regular education bus routes and monitoring performance measures are well within the District’s control and can help lower costs. Regular education bus route efficiency could be improved—Some of the District’s bus routes appeared to be inefficient and potentially contributed to the District’s higher transportation costs. Auditors reviewed records for morning and afternoon regular education routes run by three district buses during 3 separate weeks of fiscal year 2012 and found that the routes resulted in buses being filled to only 58 percent of seat capacity, on average. Auditors’ observations of bus routes at all four of the District’s schools further confirmed that some regular education routes had low capacity usage. More specifically, auditors observed six buses as they dropped off riders at the District’s four schools and found that these buses were filled to an average of only 34 percent of seat capacity, indicating the routes could possibly pick up additional students or be combined with other routes. Districts with efficient bus routes will typically operate routes that fill buses to 75 percent or more of seat capacity. Establishing and monitoring performance measures could help improve efficiency—The District’s high transportation program costs emphasize the need to monitor the transportation program. However, the District had not established and monitored performance measures to help it evaluate the program’s efficiency. Measures such as cost per mile, cost per rider, bus capacity usage, miles per gallon, and ride times can help the District identify areas for improvement. With such measures, the District can better evaluate the efficiency of its program and proactively identify operational issues. District overstated number of riders transported Districts receive transportation funding based on a formula that uses primarily the number of route miles traveled and secondarily the number of eligible students transported. In fiscal year 2012, the District over-reported to the Arizona Department of Education its number of riders by about 185, or 40 percent. Auditors determined that the error was caused by the District double-counting most riders. Transportation funding is primarily based on miles driven, but the number of riders is also a factor in determining the per mile rate that districts receive. Although the District’s inaccurate reporting of riders in fiscal year 2012 did not affect its transportation funding, the District should ensure it is meeting state reporting requirements by reporting the actual number of students transported. Having accurate rider counts will enable the District to calculate and use rider-based performance measures, such as cost per rider and bus capacity utilization, to evaluate its routes and program efficiency and make informed program decisions. Arizona Office of the Auditor General Tolleson Elementary School District • Report No. 15-209 Page 8 Recommendations 1. The District should closely review its regular education bus routes to determine how it can improve route efficiency and adjust its bus routes accordingly. 2. The District should develop and monitor performance measures such as cost per mile, cost per rider, and bus capacity usage to help evaluate and improve the efficiency of its transportation program. 3. The District should accurately calculate and report to the Arizona Department of Education the riders transported for state funding purposes. Arizona Office of the Auditor General Tolleson Elementary School District • Report No. 15-209 Page 9 APPENDIX Objectives, Scope, and Methodology The Office of the Auditor General has conducted a performance audit of the Tolleson Elementary School District pursuant to Arizona Revised Statutes §41-1279.03(A)(9). Based in part on their effect on classroom dollars, as previously reported in the Office of the Auditor General’s annual report, Arizona School District Spending (Classroom Dollars report), this audit focused on the District’s efficiency and effectiveness in four operational areas: administration, plant operations and maintenance, food service, and student transportation. To evaluate costs in each of these areas, only operational spending, primarily for fiscal year 2012, was considered.1 Further, because of the underlying law initiating these performance audits, auditors also reviewed the District’s use of Proposition 301 sales tax monies and how it accounted for dollars spent in the classroom. In conducting this audit, auditors used a variety of methods, including examining various records, such as available fiscal year 2012 summary accounting data for all districts and Tolleson ESD’s fiscal year 2012 detailed accounting data, contracts, and other district documents; reviewing district policies, procedures, and related internal controls; reviewing applicable statutes; and interviewing district administrators and staff. To compare districts’ academic indicators, auditors developed a student achievement peer group using poverty as the primary factor because poverty has been shown to be associated with student achievement. Auditors also used secondary factors such as district type and location to further refine these groups. Tolleson ESD’s student achievement peer group includes Tolleson ESD and the five other elementary school districts that also served student populations with poverty rates between 28 and 37 percent in cities and suburbs. Auditors compared Tolleson ESD’s student AIMS scores to those of its peer group averages. The same grade levels were included to make the AIMS score comparisons between Tolleson ESD and its peer group. AIMS scores were calculated using test results of the grade levels primarily tested, including grade levels 3 through 8. Generally, auditors considered Tolleson ESD’s student AIMS scores to be similar if they were within 5 percentage points of peer averages, slightly higher/lower if they were within 6 to 10 percentage points of peer averages, higher/lower if they were within 11 to 15 percentage points of peer averages, and much higher/ lower if they were more than 15 percentage points higher/lower than peer averages. In determining the District’s overall student achievement level, auditors considered the differences in AIMS scores between Tolleson ESD and its peers, as well as the Arizona Department of Education-assigned letter grade.2 To analyze Tolleson ESD’s operational efficiency in administration, plant operations, and food service, auditors selected a group of peer districts based on their similarities in district size, type, and location. This operational peer group includes Tolleson ESD and 15 other elementary school districts 1 Operational spending includes costs incurred for the District’s day-to-day operations. It excludes costs associated with repaying debt, capital outlay (such as purchasing land, buildings, and equipment), and programs such as adult education and community service that are outside the scope of preschool through grade 12 education. 2 The Arizona Department of Education’s A-F Letter Grade Accountability System assigns letter grades based primarily on academic growth and the number of students passing AIMS. Arizona Office of the Auditor General Tolleson Elementary School District • Report No. 15-209 Page a-1 that also served between 1,600 and 7,999 students and were located in cities and suburbs. To analyze Tolleson ESD’s operational efficiency in transportation, auditors selected a group of peer districts based on their similarities in miles per rider and location. This transportation peer group includes Tolleson ESD and 13 other districts that also traveled between 141 and 230 miles per rider and were located in cities and suburbs. Auditors compared Tolleson ESD’s costs to its peer group averages. Generally, auditors considered Tolleson ESD’s costs to be similar if they were within 5 percent of peer averages, slightly higher/lower if they were within 6 to 10 percent of peer averages, higher/lower if they were within 11 to 15 percent of peer averages, and much higher/lower if they were more than 15 percent higher/lower than peer averages. However, in determining the overall efficiency of Tolleson ESD’s nonclassroom operational areas, auditors also considered other factors that affect costs and operational efficiency such as square footage per student, meal participation rates, and bus capacity utilization, as well as auditor observations and any unique or unusual challenges the District had. Additionally: • To assess whether the District’s administration effectively and efficiently managed district operations, auditors evaluated administrative procedures and controls at the district and school level, including reviewing personnel files and other pertinent documents and interviewing district and school administrators about their duties. Auditors also reviewed and evaluated fiscal year 2012 administration costs and compared these to peer districts’ and surveyed the peer districts to further evaluate staffing and salary levels. • To assess the District’s financial accounting data, auditors evaluated the District’s internal controls related to expenditure processing and scanned all fiscal year 2012 payroll and accounts payable transactions for proper account classification and reasonableness. Additionally, auditors reviewed detailed payroll and personnel records for 30 of the 370 individuals who received payments in fiscal year 2012 through the District’s payroll system and reviewed supporting documentation for 30 of the 5,618 fiscal year 2012 accounts payable transactions. No improper transactions were identified. Auditors also evaluated other internal controls that they considered significant to the audit objectives and reviewed fiscal year 2012 spending and prior years’ spending trends across operational areas. • To assess the District’s computer information systems and network, auditors evaluated certain controls over its logical and physical security, including user access to sensitive data and critical systems, and the security of servers that house the data and systems. Auditors also evaluated certain district policies over the system such as data sensitivity, backup, and recovery. • To assess whether the District managed its plant operations and maintenance function appropriately and whether it functioned efficiently, auditors reviewed and evaluated fiscal year 2012 plant operations and maintenance costs and district building space, and compared these costs and capacities to peer districts’. Auditor’s also reviewed the District’s controls over district keys and building access. • To assess whether the District managed its transportation program appropriately and whether it functioned efficiently, auditors reviewed and evaluated required transportation reports, bus driver files, bus maintenance and safety records, bus routing, and bus capacity usage. Auditors also reviewed fiscal year 2012 transportation costs and compared them to peer districts’ average costs. Arizona Office of the Auditor General Tolleson Elementary School District • Report No. 15-209 Page a-2 • To assess whether the District managed its food service program appropriately and whether it functioned efficiently, auditors reviewed fiscal year 2012 food service revenues and expenditures, including labor and food costs; compared costs to peer districts’; reviewed the Arizona Department of Education’s food-service-monitoring reports; reviewed point-of-sale system reports; observed food service operations; and reviewed the food service vendor contract and invoices. • To assess whether the District was in compliance with Proposition 301’s Classroom Site Fund requirements, auditors reviewed fiscal year 2012 expenditures to determine whether they were appropriate and if the District properly accounted for them. No issues of noncompliance were identified. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. The Auditor General and her staff express their appreciation to the Tolleson Elementary School District’s board members, superintendent, and staff for their cooperation and assistance throughout the audit. Arizona Office of the Auditor General Tolleson Elementary School District • Report No. 15-209 Page a-3 DISTRICT RESPONSE DISTRICT RESPONSE Finding 1: District had higher administrative costs and lacked adequate controls to protect it from errors and fraud District Response: The District agrees with these findings Recommendation 1: The District should review its administrative positions and related duties and salaries to determine how it can reduce administrative costs. District Response: Since Fiscal Year 2012, TESD has reduced administrative spending over 10% from $952 per student in 2012 to $855 per student in 2014, which is below our peer group average for 2014. The District, however, concurs with the recommendation and will continue to look for opportunities to reduce administrative costs and direct more dollars into the classroom. Recommendation 2: The District should implement proper controls over its payroll process to ensure proper separation of responsibilities. District Response: The District concurs with this recommendation and has implemented changes to separate payroll and personnel functions in the accounting software. Recommendation 3: The District should ensure that it requires independent review and approval for all of its purchases prior to the purchases being made. District Response: The District concurs with this recommendation and is pleased to report that subsequent USFR audit findings in the purchasing process have decreased significantly. Recommendation 4: The District should implement and enforce stronger password requirements. District Response: The District concurs with the recommendation and recently implemented stronger password requirements within our network systems. We are in the process of implementing those changes to our student information systems as well. Recommendation 5: The District should limit employees’ access to its computerized accounting system to only those accounting system functions needed to perform their work. District Response: The District concurs with this recommendation and will implement an annual review process to identify, review, and evaluate each users appropriate access levels. Recommendation 6: The District should develop and implement a formal process to ensure that terminated employees have their network and system access promptly removed. District Response: The District concurs with this recommendation and has formed a task force comprised of Human Resource, Business Office, Technology, and Welcome Center personnel to implement a universal notification process when an employee or student leaves the District. Recommendation 7: The District should eliminate or disable unnecessary generic user accounts in its network and systems. District Response: The District concurs with this recommendation and has taken the appropriate steps to remove generic users in its network and systems. Recommendation 8: The District should review its formal disaster recovery plan to ensure it is complete and test it periodically to identify and remedy deficiencies. District Response: The District concurs with this recommendation and is in the process of refining its disaster recovery plan. Recommendation 9: The District should implement controls over its process for producing, distributing, and tracking building keys, including maintaining a complete and up-to-date distribution log, establishing a process for determining the access level given to employees, and implementing a user agreement outlining the rules and policies an employee must follow regarding the use of district keys. District Response: The District agrees with this recommendation and is working on improving its key tracking and access controls at all locations. Recommendation 10: The District should establish a written agreement with the service provider who is leasing space at a district school that outlines each party’s responsibilities. District Response: The District agrees with this recommendation and currently maintains written agreements with organizations and providers regarding District facilities. Finding 2: District may be able to lower transportation costs by improving bus route efficiency District Response: The District agrees with these findings and is taking steps toward improving efficiency. Recommendation 1: The District should closely review its regular education bus routes to determine how it can improve route efficiency and adjust its bus routes accordingly. District Response: The District concurs with this recommendation. We recently acquired route software to assist in improving route efficiencies. Recommendation 2: The District should develop and monitor performance measures such as cost per mile, cost per rider, and bus capacity usage to help evaluate and improve the efficiency of its transportation program. District Response: The District concurs with this recommendation. We have established a transportation metrics worksheet to compute cost per mile, cost per rider, and bus capacity usage. Recommendation 3: The District should accurately calculate and report to the Arizona Department of Education the riders transported for state funding purposes. District Response: The District concurs with this recommendation. We have recently received guidance and training from our peer districts in calculating and reporting transportation ridership each year.