Springville-Griffith Institute Central School District – Access to Network and Information Applications (2021M-148)

Issued Date

January 07, 2022

Audit Objective

Determine whether Springville-Griffith Institute Central School District (District) officials adequately secured access to the network, student information and financial applications.

Key Findings

Although District officials restricted access to the student information application, they did not adequately secure access to the network and financial application. District officials did not:

Disable unnecessary generic network user accounts.
Properly restrict user permissions in the financial application.

In addition, sensitive information technology (IT) control weaknesses were communicated confidentially to District officials.

Key Recommendations

Review generic network user accounts and ensure that unnecessary accounts are disabled.
Review financial application user accounts and limit access rights and permissions based on a user’s job responsibilities and to properly segregate duties.

District officials agreed with our findings and recommendations and indicated that they planned to take corrective action.

Background

The District serves the Towns of Aurora, Boston, Colden, Collins, Concord and Sardinia in Erie County and the Towns of Ashford, East Otto and Yorkshire in Cattaraugus County.

The District is governed by an elected seven-member Board of Education (Board). The Board is responsible for the general management and control of the District’s financial and educational affairs. The Superintendent of Schools is the chief executive officer and is responsible, along with other administrative staff, for the District’s day-to-day management under the Board’s direction.

The District relies on its IT assets for Internet access, email and for maintaining financial, personnel and student records and data. The District employs a Director of Technology, Data and Assessment (Director) to manage its IT department.

Quick Facts
Student Enrollment	1,647
Employees	566
Network Accounts
Student	1,551
Employee	342
Generic	338
Other	12
Total	2,243

Audit Period

July 1, 2020 – August 13, 2021. We extended our scope period back to the summer of 2019 before the COVID-19 pandemic to verify whether District officials reviewed network accounts.