Audits Reveal Financial Management and Cybersecurity Issues in NY School Districts

New York State Comptroller Thomas P. DiNapoli has unveiled several audits targeting local governments and schools, highlighting significant noncompliance issues. Notably, one school district failed to manage its fund balance within statutory limits from the 2021-2022 to 2023-2024 fiscal years, with surpluses far exceeding the legal 4% cap. These surpluses ranged between $3.5 million and $11.1 million. Compliance was only achieved in the 2024-2025 fiscal year after an unplanned $15 million transfer to the capital projects fund. Furthermore, the district regularly overestimated budget appropriations by approximately $9.4 million annually, focusing on areas such as instruction, health insurance, and special education, amounting to overestimations of $28.2 million overall.

Additional scrutiny revealed inadequate management of nonstudent network user accounts, with auditors uncovering 488 unnecessary accounts in a pool of 6,386 active accounts as of November 15, 2024. Many accounts were dormant for extended periods, posing cybersecurity risks by potentially allowing unauthorized access to sensitive data. Consequently, the IT department has initiated deactivating these superfluous accounts to mitigate such risks. Similarly, town officials failed in effectively managing network and local user accounts and lacked a formalized IT contingency plan and security training for staff. Despite an expenditure of $14,790 on IT services, an absence of a formal contract has raised concerns about inadequate IT system security and data integrity.

Discrepancies were also noted in financial reporting processes, with the district's treasurer inconsistently providing complete and accurate financial reports to the board. Manual report preparation resulted in errors, where general fund checking account balances did not align with accounting records, showing variances between $12 and $4,701. Moreover, a sampling of 279 claims found discrepancies in 28 instances, collectively amounting to $4,464 out of a $340,597 total. These findings illuminate the critical necessity for rigorous compliance and accuracy in financial management and cybersecurity practices in local government and educational institutions, demanding enhanced oversight and control systems.