The offices of State Comptroller Alan G. Hevesi recently released an extensive audit report on the state of the Roslyn School District. The audit claimed that while the district has "taken some steps to strengthen their management of district resources, the board of education must take additional action to implement the financial safeguards auditors recommended last year."

These recommendations were issued in a 2005 audit from the comptroller's office that detailed how "lax" oversight allowed school officials to steal $11.2 million from the district.

In the progress report, auditors found that the district has fully implemented 12 of the 27 recommendations auditors made last year, but that some weaknesses in the district's fiscal management that allowed the original thefts to occur are continuing.

According to the report, these include budget transfers being made without appropriate approvals, use of a store credit card without the knowledge or awareness of the superintendent and Interim assistant superintendent for business, travel claims not being reviewed by appropriate officials, and computer system permissions not being updated.

The report was received with commentary--and rebuttal--from Dani Kline, the Roslyn School Board President. Gerard Dempsey, the district's interim superintendent, also commented on the findings.

A release from Dempsey's office noted "every one of the 27 items identified in the original audit report issued in March 2005 had since been addressed in full or in part."

"The comptroller has set an extraordinarily high level of expectation for Roslyn's fiscal controls and procedures--and with good reason, considering what happened here in the past," said Dempsey. "The measures taken to date, even those that the comptroller may have considered only partially in compliance with this initial recommendation, represent sweeping changes in the way the board and administration oversee the district's financial operations. We are working every single day to ensure that every one of the comptroller's recommendations is fully implemented and to rebuild the trust of the school community."

The follow-up audit found that the district has partially implemented 10 recommendations and has not implemented five recommendations, including increased public disclosure of the superintendent's compensation and needed controls over travel spending and computer permissions.

"Our recommendations if properly implemented will prevent a recurrence of the tragedy that we had here at Roslyn," Hevesi said. "After the most remarkable theft from a school district in New York State's history, the district needed to take swift actions to safeguard the funds entrusted to its care. District officials still have more work to do and I urge the board to move quickly to close the remaining loopholes."

In all, the audit found that the district has fully implemented 12 recommendations to improve oversight, including:

• Annual evaluations of fiscal and operational policies and procedures by the board;

• Monthly presentations of budget figures by the district treasurer;

• Monthly review of financial information by the board;

• Establishment of an audit advisory committee, done prior to State legislation requiring it to be done;

• Training of board members has been done beyond the law's requirements;

• Better control over purchase orders;

• Better control over computer user accounts;

• Elimination of remote access to the financial system software except as permitted by the Assistant business administrator;

• Better documentation for all payroll-related changes;

• Better documentation of employee benefits, including annual leave and salaries, in employee contracts;

• Better control over mail to ensure control over incoming checks; and

• Better control over making journal entries to limit the ability to adjust the district's accounting records only to those employees whose job would require that they perform this function.

The district has not implemented the following five recommendations from the prior audit:

• Travel. Auditors had recommended that the board adopt a travel policy and take steps to ensure that the board approved all travel claims prior to the travel occurring. While the board adopted a travel reimbursement policy as recommended, auditors found that district personnel are not following the policy and that the board did not review or approve five of 26 claims for conference registrations and mileage reimbursements prior to the travel occurring.

• Public Disclosure. Auditors had recommended that the board adopt a policy requiring the public disclosure of total compensation for the superintendent and any assistant or associate superintendent, as required by State Education Law. The district has not adopted such a policy.

• Filing of contract amendments. Auditors had recommended that all amendments to contracts and copies of the action sheets reflecting the board's approved changes to contracts be filed with the district clerk. Auditors found that the District Clerk only maintained contract amendments for the superintendent and her own contract, not for all board-approved changes to contractual employees' terms of employment, as recommended by auditors.

• Computer System Permissions. Auditors had recommended that the district assign computer system user permission to match job functions to reduce the potential for improper activities. Auditors found the district has not assigned computer system user permissions to match written job functions and that four employees inappropriately had permission to access the treasurer's check signature disk on the computer.

• Review of Computer System Permissions. Auditors had recommended that the district establish a procedure to review computer system user permissions on an ongoing basis. Auditors found that the district had not established policies to review computer system user permissions on an ongoing basis and that the district did not terminate three employees' ability to access the district's computer system until as much as four months after their employment ended.

The district has partially implemented 10 of the auditors' recommendations, including:

• Budget Transfers. Auditors had recommended that the district's policy on budget transfers and budget monitoring comply with the rules and regulations of the State Education Department. Although a policy on budget transfers was adopted as recommended, the superintendent did not routinely approve budget transfers up to $3,000, as required by the adopted policy. Auditors found that 10 of 11 transfers less than $3,000, totaling $10,023, were approved by the interim assistant superintendent for business rather than the superintendent.

• Purchasing Practices. Although the board's adopted purchasing policy designated the assistant superintendent for business as the district's purchasing agent as the auditors had recommended, auditors found that the assistant administrator for business had been approving purchase orders.

• Written Policies. While the board has developed written policies on 10 of the 12 areas identified by the auditors, it has not issued written policies for two areas: cash receipts and revenue collection; and bank and account reconciliation. The board has fully developed written policies that they are following on cash disbursements and accounts payable; payroll procedures; check signing; signature plates; and petty cash. In other areas, it has developed policies as recommended, but is not always following them. These areas include: accounting and auditing of extra-curricular classroom activity funds; credit cards; cellular phones and fixed assets. Some examples of auditors' findings include:

• Credit Cards. Although the district's adopted policy indicates that district personnel should not use district credit cards, auditors found five payments made by the district to Home Depot credit card services totaling $6,585. The superintendent and the interim assistant superintendent for business were not aware this card was still being used for district purchases.

• Extra-Curricular Fund Policy. Although the district's extra-curricular fund policy indicates that all spending from the fund must be by a check signed by three officials, auditors found two instances where checks were only signed by one official and that the superintendent had not presented a monthly report of the funds to the board as required by the policy.

• Changing Computer Passwords. Auditors recommended that the district institute controls over passwords, that passwords be changed every 30 to 60 days, and that policies on password complexity be established to reduce the potential for unauthorized access to data. Auditors found that while the software requires employees to change their passwords every 60 days, however the district does not have a written policy on this subject or on the subject of password complexity, as recommended.

• Ethics. Auditors recommended that the district develop a code of ethics and communicate it to employees. Although the district's new policies require the superintendent to distribute a copy of the code of ethics to all employees and officers, auditors found that some employees had not received them.

• Superintendent's Employment Contract. Auditors recommended that signed copies of the superintendent's contract be maintained by the district clerk. Though auditors found that the agreements were properly signed and maintained, the board has not established policy requiring that the board president and the superintendent sign the agreements as the auditors had recommended.

• Payroll Action Sheets. Auditors recommended that the Bboard adopt a policy requiring payroll action sheets be prepared and signed by the board president whenever personnel actions are approved or amended by the board. The board did not adopt a policy requiring that action sheets be prepared and signed by the board president whenever personnel contracts with administrators are approved or amended by the board.

• Approval of Journal Entries. Auditors recommended that the board adopt a policy designating a specific individual to approve all journal entries and found that the board had not done so during the audit period. However, after the audit fieldwork was completed, an individual was designated to approve all journal entries. Auditors found that district officials had not approved 14 of the 17 journal entries ranging from $250 to $904,000.

• Government Rates. Auditors found two instances out of 26 claims reviewed where district employees did not secure government rates for lodging and for one instance where the employee exceeded the per diem rates for meal allowances adopted by the board.

• Duplicate Deposit Slips. Auditors recommended that duplicate deposit slips should contain additional information such as check numbers or individuals' names. Auditors found that two deposit slips out of 18 reviewed did not have additional information on them such as check numbers or individuals' names.

In a letter to Comptroller Hevesi, Dani Kline also noted that many of the recommendations had been implemented. She also addressed some of the areas where the comptroller's office claimed that implementation is falling short.

On travel policy, Ms. Kline said that the BOE is "in the process of reviewing methods by which we can insure that his [travel] policy is implemented fully including a review of the forms and procedures we sue to collect data about conference attendance and travel reimbursements."

Concerning budget disclosures, Ms. Kline claimed that the district's budget disclosure documents did accompany the budget document. Such documents "were appended in a separate book along with school report card data and were not physically attached to the budget document. In the budget presented for 2007-08 and in all future budgets, the disclosure documents will be physically attached to the budget document."

On the issue of the filing of contract amendments, Ms. Kline asserted that contracts for certain school district employees, including that superintendent of schools, were "actually filed with the minutes of the board of education at which they are formally approved."

Furthermore, all budget transfers, Ms. Kline said, "now conform with both Education Law and board of education policy in that they are approved by the superintendent if the transfer is less than $3,000 and by formal resolution of the board if the transfer is $3,000 or more."

Finally, on journal entries, Ms. Kline claimed that beginning in February 2006, all journal entries were approved by the assistant business administrator. "As of today, all journal entries are approved by both the assistant business administrator and the assistant superintendent for business."

In addition, the superintendent's office reported that the latest report found no fraudulent activity of any kind in the school district. The report, school officials noted, describes significant progress on the most important reforms, such as the training of board members in financial oversight, which the report acknowledges has been done beyond the law's requirements and establishing a Citizen's Advisory Audit Committee, which was done even before it was required by law.

In the year since the follow-up audit was conducted, every item identified in the report, school officials claim, has been acted upon at least in part. For example, they note:

• The use of credit cards for any reason was already expressly forbidden by board policy and when it came to light last year during the course of the audit that a credit card account was, in fact, still active, it was immediately cancelled (even though its use was for entirely legitimate district expenses).

• The signature disk, which is used to sign checks, is now held under very tight security: the information is encrypted and is kept in a locked box within a locked safe. In fact, Roslyn's internal controls require 13 separate security checkpoints to prevent unauthorized check printing. Access to the disk alone would never have permitted the user to write checks, in any event.

School officials added that other items represent technical violations that are unrelated to the scandal and do not present any risk of fraud; for example, not including the superintendent's compensation package in the budget document for 2005-2006 in a format prescribed by the state. (The district was fully in compliance with reporting procedures by duly submitting the information to the State Education Department where it was publicly available online.) This item, school officials said, has already been corrected and was included last spring in the budget document for the current year, 2006-2007.

In addition to continuing and even accelerating the process of reform, Joseph Dragone, who has served as the district's interim assistant superintendent for business since September of this year, is extensively revising the school budget to create, for the first time in Roslyn, a program-based budget. This revision, school officials said, will make information about the cost of particular programs more readily accessible, an important change that many feel will make the budget more understandable and transparent. The Budget Advisory Committee, which, like the Audit Committee, is a group of citizen volunteers, will continue to provide close oversight of the board and administration's budget preparations, as it has over the last two years.

"I think it's fair to say that an audit conducted during the same period this year would demonstrate how much additional progress has been made since last year," Gerard Dempsey said. "This district had a very long way to go to climb out of the difficult position it was in, in 2004. This board and administration are deeply committed to getting it right."