Purpose of Audit

The purpose of our audit was to determine whether internal controls over information technology (IT) were appropriately designed and operating effectively for the period July 1, 2015 through June 9, 2017.

Background

The Florida Union Free School District is located in the Towns of Goshen and Warwick in Orange County and operates two schools with approximately 820 students. The District, which is governed by an elected five-member Board of Education, contracts with Orange-Ulster Board of Cooperative Educational Services (OUBOCES) and the Mid-Hudson Regional Information Center (MHRIC) for IT services.

Key Findings

• Employees do not comply with the District’s acceptable use policy.
• Controls over the collection, processing, transmission and storage of personal, private and sensitive information (PPSI) have not been developed.
• The District does not have service level agreements for services provided by OUBOCES and MHRIC, which could lead to confusion over roles and responsibilities of each party.

Key Recommendations

• Review and monitor employees’ computer use to ensure compliance with the District’s acceptable use policy.
• Inventory, classify and develop controls over PPSI maintained and collected by the District.
• Ensure that all IT services are provided based on a formal service level agreement.