Practices Make Imperfect

Well, the Office of Legislative Audits recently concluded it's audit of the Howard County Public School System.  And, although the report is due for release on Friday, the report made it's way out into the public Wednesday evening, and if you want to see it for yourself, you can, via the link below.

Download HowardSchools2016 (2)

So, having participated in audits of public agencies and programs before, here's how these things normally go.  The auditors review the data they requested, and issue a report.  The agency is given the opportunity to respond to the audit findings, and put forth a plan of correction in which the agency promises to make progress, if not do away with, any findings by some certain date.  Again, that's how it normally works.

But of course, this is the HCPSS, and there's not much of anything that's normal about that outfit!  First off, HCPSS offers absolutely no plan of correction to any of the findings of the report.  Second, through an incredibly incredulous letter from the Great COC, the HCPSS takes the position that the Office of Legislative Audits wasted their (HCPSS staff) precious time!  To the tune of $200,000.  I kinda see her point.  After all, that money coulda renovated about 40% of the board room.

The letter is page 34 of the document.  I find especially sociopathic, COC's statement that the state "failed to recognize the sound business practices we use".  Well, COC, if you're handing out $12.5 million in sole source contracts, chances are you're not.  If you're giving salary increases to people which weren't properly approved or ratified, then you certainly are not!  What's wrong with this COC?

Below, cut and pasted, are the findings of the State, the HCPSS response, and the State Response to the HCPSS Response.  I present this for your reading pleasure, and augment with my famous Red Text O' Truth!:

Revenue and Billing Cycle

Finding 1 Adequate control had not been established over summer school receipts, as checks were not restrictively endorsed upon receipt, and collections were not subject to independent deposit verification.

Recommendation 1 We recommend that HCPSS ensure a. collections are restrictively endorsed immediately upon receipt, b. employees independent of the cash receipts processes verify that collections as initially recorded were deposited, and c. collections are deposited in a timely manner (repeat).

HCPSS Response
We disagree with the finding and the recommendations. We restrictively endorse collections within 1 day after receiving them with an automated device rather than having the initial recipient endorse the collections immediately with a hand stamp. We believe the automated device provides greater control than a hand stamp. We will consider verifying deposits with the receipt books maintained at the schools where collections are received, although we do not necessarily believe that step is a necessary control. We believe that weekly deposits are an adequate control, particularly when taking into account the added cost of making daily versus weekly deposits and the average amount of the deposits.

Auditor’s Comment: Independent verifications that recorded collections were deposited is a necessary basic control to ensure all funds received are deposited. Controls would be further enhanced by restrictively endorsing checks immediately when received and by depositing collections sooner.

So we learn from this that unendorsed checks are just left laying around.  And already, COC's proclamation of "sound business practices" becomes lie number 4,543 that's come out of her mouth.  Because if it's not policy to endorse checks upon receipt, you're not following sound business practices.

Procurement and Disbursement Cycle

Finding 2 A number of contracts were awarded without competitive bids. We identified 15 contracts totaling $12.6 million that had been awarded by senior management employees as sole source contracts, without adequate justification to support a sole source procurement.

Recommendation 2 We recommend that HCPSS follow its procurement manual and related policies and laws and obtain competitive bids for goods and services unless an adequate and documented justification exists to not use competitive procurements (repeat).

HCPSS Response

We do not agree with the finding and recommendation and disagree this is a repeat recommendation. Sole source contracting is an acceptable business practice consistent with Board Policy 4050, Procurement of Goods and/or Services, and consistent with related laws. All the contracts discussed by OLA were obtained in a manner consistent with Board policy and law. We do sole source contracting on a limited basis – approximately 3 percent of our contracts are sole source – and we fully discuss the contracts with the Board before they are approved. We acknowledged to your staff that there is always an opportunity to further document the bases of such contracts, and said we would consider whether doing so would better serve the Board and the public.

Auditor’s Comment: Competitive procurements should be used to the extent practical to select vendors because competition promotes increased confidence in the integrity of the procurement process and helps ensure the fair and equitable treatment of vendors. Accordingly, using sole source contracts, although necessary under certain conditions, should be avoided when multiple vendors are available to provide the desired products and services.

With regard to the first bullet: The contract was a cooperative procurement contract based on a competitive contract obtained by another school system. OLA did not obtain the other school system’s contract or our piggyback contract before OLA issued its preliminary findings. We obtained and reviewed the other school system’s contract and fee structure in detail before we awarded our contract. Purchasing additional modules and using a different fee structure did not disqualify us from using a cooperative procurement contract. Further, the law requires a determination of applicability, but does not spell out the extent to which the determination should be made in writing. We acknowledged to your staff that

there is always an opportunity to further document the bases of contract decisions, and said we would consider whether doing so would better serve the Board and the public. Lastly, we believe this procurement avoids redundant and repetitive administrative tasks and saved us a significant amount of time and money. We would also note the Maryland state government uses the vendor’s time and attendance module, and two other Maryland school systems are working with us to obtain our favorable pricing model from the vendor.

Auditor’s Comment: Regarding cooperative purchasing contracts, State Law clearly requires participating units to determine the benefits of such arrangements in writing and a written determination was not prepared for the cooperative procurement contract mentioned in the audit report.

Here, HCPSS has broken the law.  Prosecution is necessary.  Many millions of dollars in contracts have been let out as "sole source" engagements to Foose's allies.  And people like COC, ADL, and Janet Siddiqui have stood by and allowed our children to suffer for lack of funding.

With regard to the second bullet: At the time of procurement, there were only about 10 firms that were certified implementation partners in both human capital management and finance that could perform the necessary configurations for us. OLA stated in its preliminary findings there were 30 firms that could perform the necessary work. Those firms were certified at a later date, and some of them were service partners rather than implementation partners. Of the 10 firms that were certified implementation partners at the time of procurement, our research indicated most firms’ ultimate implementation costs were either too high, or the firms did not specialize in the supplier’s product. We obtained price proposals and did three reference checks for the two firms who appeared to be the best able to successfully implement the human capital and finance modules. We also compared the cost for the firm we selected to the cost for the firm for other school systems that hired the firm through a competitive process. There was no reasonable basis to believe firms would necessarily lower their published prices in a competitive bidding process. The final decision to sole source was based upon the highly rapid implementation methodology the selected firm deployed. Further, a competitive bidding process would have been costlier and delayed implementation. It is interesting to note that the University of Maryland University College now uses this firm. Lastly, the Executive Director of Budget and Finance did the bulk of the research for this procurement, but OLA did not discuss this procurement with her before OLA issued its preliminary findings.

With regard to the third bullet: We extensively researched and justified the bases for the contracts, and firmly believed based on that research that we could not have procured different firms for less cost and/or similar or higher quality. OLA did no work to demonstrate that other firms could provide services at less cost and/or similar or better quality. We believe OLA is ignoring the issue of quality and is supplanting its judgment for the judgment of the Superintendent and Board.

Why not?  Because the judgment of the Superintendent and Board are extremely poor.  And biased.

With regard to the fourth bullet: We extensively researched and justified the bases for the contracts, and firmly believed based on that research that we could not have procured different firms for less cost and/or similar or higher quality. As above, OLA did not do any work to demonstrate that other firms could provide services at less cost and/or similar or better quality. Further, OLA cited another school system that received six bids for the special education contract, but that contract was for different special education services.

Auditor’s Comment: Researching vendors may provide helpful information, but may also lead to false assumptions and is not a substitute for using competitive procurement processes. Competitive procurements take advantage of marketplace forces and help ensure the most qualified firms who represent the best value are selected.


Finding 3 HCPSS did not document its comparison of invoices for temporary service employees to timesheets approved at the schools.

Recommendation 3 We recommend that HCPSS document its comparison of vendor invoices to appropriate supporting documentation.

HCPSS Response

We disagree with the finding and the recommendation. The Accountant Specialist in the Office of Special Education and Student Services received timesheets from schools and compared the timesheets to invoices from the vendor on a risk basis based on the Accountant Specialist’s experience with the invoices and timesheets, such as time charged around professional development days, holidays and breaks, and inclement weather. The Accountant Specialist documented his reviews when he found discrepancies, and will document all reviews in the future. We do not believe it is a prudent use of our resources to necessarily review all invoices and timesheets, particularly in light of the fact that OLA did very little testing and did not find any problems with any of the invoices or timesheets.

Auditor’s Comment: HCPSS provided no documentary evidence to us that timesheets were compared to the vendor’s invoices or that any invoice discrepancies were identified and challenged by HCPSS. Our recommendation does not address the extent of such comparisons but they should be sufficient to provide reasonable assurance that the vendor is only billing HCPSS for services actually provided.

OK, so this is idiotic.  When you have hourly employees,temps,  contracted labor, whatever you want to call it in your workplace, it is  a basic function to have the contractor provide timesheets for the employees, and the invoices that the contractor provides for services have to tie to the sums of the employee timesheets.  HAS to.  No brainer.  That the HCPSS doesn't do this is extremely careless.  That they don't think it's a big deal is simply ignorant.

Human Resources and Payroll

Finding 4 Independent reviews of certain personnel and payroll transactions processed, such as adding new employees and salary changes, were lacking, and the access capabilities assigned to users of the automated system were not adequately restricted.

Recommendation 4 We recommend that HCPSS a. perform a documented independent review and approval of all personnel and payroll transactions processed, b. eliminate the capability of system users to perform incompatible functions, and c. periodically review the access capabilities assigned to all users and eliminate those capabilities that are not required by those individuals to perform their job duties.

HCPSS Response

This finding is not relevant to our current operations. We decided before OLA began its audit to move to a new human capital management system which resolves concerns we and OLA had with the prior system. Implementation of the new system was completed in April 2016. We think it is important to note that OLA found no evidence of unauthorized transactions in either its 2009 or 2015 audits. As noted above for Finding 2, our new system is the same system the Maryland state government uses for time and attendance.

Ahh, yes, Workday.  What a great system that is.  And you teachers out there-- did anything screwed up happen with your summer pay this year?  Anyone have any problem with their personnel records in Workday, or some such thing?

Auditor’s Comment: We audited the payroll system in place during our audit. While that system has subsequently been replaced, the recommendations provide guidance to HCPSS for implementing proper controls under the new system.

Finding 5 HCPSS lacked evidence that the salaries for 142 administrative employees, which totaled $15.3 million in fiscal year 2014, had been approved by the Board as required by State Law.

Recommendation 5 We recommend that HCPSS ensure salaries of administrative employees are approved by the Board as required by State Law.

HCPSS Response
We disagree with the finding, recommendation and legal interpretation. The Board approved salary scales for Administrative, Management, and Technical (AMT) many years ago. Section 4-103 of the Education Article of the Annotated Code of Maryland does not require the Board to re-approve the scale every year. For fiscal year 2015, the Board approved raises for AMT employees in a Board meeting on July 1, 2015. The minutes of the meeting were approved July 10, 2015.

Auditor’s Comment: During the audit we made several requests for documentation of Board approval of salaries of administrative employees. HCPSS never provided such documentation. Furthermore, unlike HCPSS, other school systems provide lists of administrative employees’ salaries to their boards to comply with State Law.

Ahhh!  So here we have HCPSS not providing the State with information, as well as HCPSS at least, skirting the law, and I believe, ignoring the law.


Finding 6 Certain executive employees at HCPSS were receiving regular monthly mileage payments for amounts that could not be substantiated and were not authorized or approved by the Board.

Recommendation 6 We recommend that HCPSS a. maintain documentation establishing how such payments were determined, and b. ensure such compensation arrangements are authorized and approved by the Board.

HCPSS Response
We disagree with the finding and the recommendations, specifically OLA’s premise that we should not have stipends. We believe the stipends save us both mileage and administrative costs. We will consider periodically reviewing the stipends to ensure they approximate the cost of actual mileage, while also taking

into account the administrative savings of the stipends. The Board is not required to approve expense reimbursements for staff.

Auditor’s Comment: The finding did not take issue with the use of stipends but rather the lack of any documentation as to how the amounts of the mileage payments were determined. We understand the Board does not need to approve expense reimbursements; however, because HCPSS’s payments are not based on actual mileage driven but are a form of employee compensation, they should be approved by the Board.

That is correct-- the state didn't take issue with the issuance of stipends.  Hmmm, an unforced error on HCPSS's part?  Anything about these stipends that we should know about?


Inventory Control and Accountability

Finding 7 HCPSS had not performed a complete inventory of its information technology equipment as approximately 9,600 of the 28,500 items added to the equipment database between 2009 and June 2014 had not been inventoried.

Recommendation 7 We recommend that HCPSS a. modify its policy on information technology equipment to specify how often physical inventories should be performed; and b. periodically inventory all sensitive items in the information technology equipment records, in accordance with the modified HCPSS policy.

HCPSS Response

We partially agree with the finding and the recommendation. Board Policy 3040 requires technology equipment to be tested periodically so as to identify and resolve the type of discrepancies such as those identified in OLA’s testing. The policy does not require full inventories every year. We will consider whether we should modify our policy to specify how often physical inventories should be performed. In addition, we will review our periodic testing procedures to ensure they are effective.

OK, so, the HCPSS has only inventoried about a third of its computers.  Yet, we're supposed to believe that they need more technology? They don't eve know what they have now!

I get that inventory/property control is no fun.  But I can't get how any manager or leadership member in the HCPSS can make the case that they need more money for technology when they have absolutely no clue of what they currently have!

Information Technology

Finding 8 Controls over the critical student information and financial management system databases were not sufficient as neither database was configured to log any database security activity, and certain operating system and database software had not been updated for critical security patches.

Recommendation 8 We recommend that HCPSS a. set the student information and the financial management system databases to log all critical security related events, regularly review these logs, document these reviews, and retain this documentation for future reference (repeat); and b. ensure that all production database and operating system software is patched and updated for all critical security vulnerabilities on a timely basis (repeat).

HCPSS Response

This finding is not relevant to our current operations. We replaced the student information and financial management systems with new systems. We implemented logging for all critical security related events and processes and review and document the logs regularly.

But, your new systems are terrible, so.....


Finding 9 Network, application, and database account and password controls were not sufficient to properly protect critical resources.

Recommendation 9 We recommend that HCPSS establish appropriate network, application, and database account and password controls in accordance with the aforementioned best practices noted in the aforementioned Information Security Policy.

HCPSS Response

We agree with the finding and recommendation. We implemented a new password policy that aligns with the State of Maryland Information Security Policy.

YAY!!!!!!

Finding 10 The HCPSS computer network was not adequately secured as intrusion detection prevention system software was not used to protect the network, and firewall rules allowed insecure and unnecessary connections to several critical network devices.

Recommendation 10 We recommend that HCPSS a. perform a documented review and assessment of its network security risks and identify how IDPS coverage should be best applied to its network and implement this coverage; b. configure its firewall rules to adequately secure connections from untrusted third parties (including the Internet); c. regularly review the firewall logs, document all reviews performed and retain the documentation for future reference; and d. restrict remote administrative connections to the firewalls to only authorized users and use only secure connection protocols for this remote administration.

HCPSS Response

We agree with the finding and recommendations. We conducted an independent assessment of our network security and determined how best to apply IDPS coverage. We implemented (1) IDPS and firewall rules to adequately secure connections from untrusted sources, (2) processes to regularly review and document firewall and IDPS logs, and (3) security controls to ensure remote administrative access to the firewalls is only available to individual administrators through secure connections.

Double yay!!!!


Finding 11 Workstations and servers were not sufficiently protected against malware.

Recommendation 11 We recommend that HCPSS a. ensure that administrative rights on workstations are restricted to network administrators and other select users requiring such rights; b. configure its malware protection software so that users cannot disable the settings which allow users to override and modify default security controls established by management; c. verify that all computers are properly updated, on a timely basis, with operating system updates approved by the agency; and

d. obtain a vendor supported enterprise-wide management tool to regularly confirm that all workstations and servers are configured with malware protection software that is operating properly, up-to-date, and has current definition files.

HCPSS Response

We agree with the finding and recommendations. We implemented security controls to ensure that administrative rights on workstations are restricted to system administrators and select users that require such rights. Further, we implemented processes to ensure operating system software updates are being approved and installed by system administrators on a timely basis. We are implementing an enterprise-wide management tool to confirm the configuration and operation of anti-malware software and ensure users cannot disable default security controls established by the system administrator.

Triple yay!!!!!!


Facilities Construction, Renovation, and Maintenance

Finding 12 HCPSS did not select certain construction management firms by competitive bids as required by State Law.

Recommendation 12 We recommend that HCPSS use a competitive procurement process to select construction management firms as required by State Law.

HCPSS Response

We disagree with the finding, recommendation, and legal interpretation. We use a competitive procurement process for construction management firms subject to Board Policy 6030, Procurement of Architectural/Engineering and Construction Management Services. Our contracts are construction management-agency contracts rather than construction management at-risk contracts. Section 5-112 of the Education Article of the Annotated Code of Maryland does not apply to construction management-agency contracts. We recommend OLA correct its interpretation of the law as it applies to that method.

Auditor’s Comment: The finding is based on written interpretations provided to us by legal counsel to the General Assembly. The interpretations advised that Section 5-112 of the Education Article applies to the type of construction management contracts used by HCPSS and that such contracts should be award by competitive

bidding. HCPSS never provided any legal opinion that was contrary to that provided by the legal counsel to the General Assembly.

Again with the noncompetitive contracts!  And again with not providing the State with information!  Why is the HCPSS afraid to give the state information?  I mean, we all know that the HCPSS is paying off their friends and buddies by giving them contracts that shouldn't be sole source.  Are people who work for the HCPSS getting kickbacks too?  Maybe some of these contractors should also be audited.  I'd like to know!


Transportation Services

Finding 13 Bus vendor payment information was not independently reviewed, and user access capabilities for the automated bus vendor payment system were not adequately controlled.

Recommendation 13 We recommend that HCPSS improve internal controls over the bus vendor payment process by a. ensuring that payment information is independently reviewed by Transportation department personnel before transmission to the Finance Office for payment (repeat), and b. removing unnecessary system access capabilities.

HCPSS Response

We generally disagree with the finding and the recommendations and disagree the first recommendation is a repeat recommendation. We designed a decentralized review and payment system for bus vendor payments that does not require review by the Budget and Finance Office. We reassigned a Certified Public Accountant with approximately 10 years of experience overseeing accounts payable from the Budget and Finance Office to the Transportation Department to enter information in the bus vendor payment system. The information is first approved by another manager in the Department, and there are automated flags for any entries that are unusual. The Director of Transportation is furnished with a summary payment report which ensures alignment with budgeted expenditures. In addition, OLA did not note any improper or inaccurate bus vendor payments in its 2009 and 2015 audits. (The Transportation Department has a detailed 38-page manual which explains the bus vendor payment system.) We will consider the cost feasibility of adding an additional level of independent review for bus contractor payments, although we believe OLA’s recommended additional control may be costly and unnecessary.
OLA did not talk with the Director of Transportation during the audit about the three unassigned accounts in TOPS, so we will review the accounts to determine whether there are any control weaknesses. The three staff with access mentioned by OLA still actively support the system and still need access to the system. The Director of Transportation had access to certain screens during the transition process to TOPS but no longer has access.

Auditor’s Comment: The automated flags would only detect unusually large payments. Such automated controls and a comparison of actual expenditures to budgeted expenditures are not an adequate substitute for independent verifications that critical data was properly recorded in a system that processes payments in excess of $30 million per year.

Transportation is a huge expense in the HCPSS.   An unbiased set of eyes to look at vendor payments makes sense and is a best practice.  Again, as with other items, why doesn't HCPSS want an additional level of internal review?


Finding 14 HCPSS was not fully using its automated routing software to plan bus routes, and many HCPSS bus routes were operating significantly below ridership goals.

Recommendation 14 We recommend that HCPSS fully use its automated routing software to more efficiently plan bus routes on a system-wide basis in an effort to achieve ridership goals (repeat).

HCPSS Response

We partially agree with the finding and the recommendation, but do not believe it is a repeat recommendation. OLA misstated our capacity goals; the goals are a range, not a set number. We continually use our software to plan bus routes to try to achieve maximum efficiency while taking into account a multitude of other critically important factors such as safety, the time and distance of routes, and use of buses for multiple schools to minimize overall bus route costs. We will continue to do so, and will consider other means such as outside studies to help us optimize our transportation planning. For example, the University of Maryland recently studied our bus route planning and found we are close to maximum efficiency when considering all cost and other factors.

Who at the University of Maryland?  Names, we need names!  And credentials!  How do we know they have the experience?

Auditor’s Comment: We have revised our report to address HCPSS’s comments regarding its bus capacity goals. The revision does not alter our finding that many HCPSS bus routes were operating below the capacity goals.

Other Financial Controls

Finding 15 HCPSS did not ensure the propriety of certain claim payments for employee and retiree health care costs.

Recommendation 15 We recommend that HCPSS establish procedures to verify the amounts paid for health insurance (repeat).

HCPSS Response

We disagree with the finding and the recommendation. We perform ongoing dependent eligibility verifications and have a series of automated controls to prevent improper claims payments. In addition, our third party administrators have certain controls and procedures to ensure that claims are paid properly and accurately. We explored the use of claims payment audits in the past, and based on that experience, do not believe additional claims payment audits would be cost effective.

We would appreciate OLA providing us additional information on the Maryland State audits, including more detailed information on the Maryland State government’s health benefits programs and operations, how those programs and operations compare to us, and how OLA determined that we would also obtain net savings from the audits.

Auditor’s Comment: Due to the significant expense represented by employee and retiree health care at the local school systems, a health care claims audit is a reasonable approach for detecting health care billing errors or fraud and ensuring plan administrators only issued claims payments for allowable benefits for eligible participants. A health care claims audit would also determine whether third-party administrators’ controls for detecting health care billing errors or fraud are adequate and functioning properly. We were not provided with any evidence of automated controls at HCPSS to prevent improper claim payments. We provided HCPSS information on how the State implements its health care audits, including the use of liquidated damages provisions in the related contracts.

So, we have heard a lot of bleating and braying from the HCPSS that they need more money for employee/retiree health care, and woe is us, we have a budget gap because the Big ol' Bad ol' county failed to fully fund us, wah wah wah, boo hoo hoo.

Yet, the above finding would suggest that the HCPSS has no flipping clue how much money they need for these costs!  This is deception of the highest order, and indicative of a culture in the HCPSS where they feel it appropriate not to discuss or negotiate financial needs in good faith.

That's all I got, folks.  Read the report for yourselves.  And uh, Board Candidate Kirsten Coombs is a CPA and Board Candidate Christina Delmont-Small used to be a Congressional auditor.  Just putting that out there.

And let's be careful out there.

#hcpss #hcboe #betterBOE #hocoschools #hocomd #mdschools #MDeducation #hocopolitics

Comments

[Barb Krupiarz]

Since I am intimately familiar with the $300,000 Special Ed audit, I have a couple of things to say. Montgomery County, three times the size of Howard, paid $150,000 for the same kind of audit. They competitively bid their contract. We sole sourced ours to a firm run by Harvard MBAs who promised to save us money. And, by the way, taxpayers fund the Superintendent's "membership" with this company - for which we are supposed to get "competitive pricing on services".

[Chao Wu]

Thanks for this detailed analysis. For Finding 5, it talks about the problem with 142 staff "salaries". The HCPSS responded with the "salary scale". It is just so weird. I am thinking of my recent article "The art of debate" ( this egg tastes really bad).