Purpose of Audit

The purpose of our audit was to review the School’s procurement processes and internal controls over information technology for the period July 1, 2011 through December 31, 2012.

Background

The Eugenio Maria de Hostos Charter School, located in the City of Rochester in Monroe County, is governed by a Board of Trustees which is comprised of 15 members, including three parent representatives. The School’s 2011-12 fiscal year operating expenses totaled approximately $5.3 million.

Key Findings

• We reviewed four building leases and 12 service contracts entered into by the School and found that the School entered into the leases without any process for determining the fair rental value of the buildings. Similarly, although competitive bidding is not required, we found that the School only sought competition for one of the service contracts. These findings are of particular concern because the leases and contracts were entered into with organizations having various types of business or occupational relationships with members of the Board or their family or friends. Under these circumstances, it is questionable whether the leases and contracts were in the best interest of the School.
• The School paid for use of a building and for certain services without having entered into written agreements.
• The School also lacked appropriate information technology (IT) policies and procedures. The School did not properly control user access rights to the IT system and did not properly establish a disaster recovery plan.
• The School lacked accurate IT inventory records.

Key Recommendations

• Properly document the analysis and actions taken related to leasing buildings in the official Board record to help provide assurance that the terms and conditions of the lease agreements are in the School’s best interest. Develop policies and procedures for procuring services to encourage competition.
• Ensure that all leases and contracts are in writing and provide adequate information regarding payments and the services to be provided.
• Adopt comprehensive written IT policies and procedures including those addressing user access controls. Develop a formal disaster recovery plan.
• Implement and maintain accurate, up-to-date inventory records for computer hardware and softwa