North Collins Central School District – Information Technology Equipment Inventory (2023M-39) (full text)

North Collins Central School District Information Technology Equipment Inventory 2023M-39 l June 2023 Division of Local Government and School Accountability

Contents Report Highlights . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 IT Equipment Inventory. . . . . . . . . . . . . . . . . . . . . . . . . . 2 How Should District Officials Maintain IT Equipment Inventory? . . . . 2 Officials Did Not Maintain a Complete IT Equipment Inventory . . . . . 2 Officials Could Not Locate IT Equipment . . . . . . . . . . . . . . . . 5 What Do We Recommend? . . . . . . . . . . . . . . . . . . . . . . . 6 Appendix A – Response From District Officials . . . . . . . . . . . . . 8 Appendix B – Audit Methodology and Standards . . . . . . . . . . . . 9 Appendix C – Resources and Services. . . . . . . . . . . . . . . . . 11

Report Highlights North Collins Central School District Audit Objective Background Determine whether North Collins Central School District (District) officials maintained The District serves the Towns of North Collins, a complete and accurate inventory of Collins, Concord, Brant, Eden and Evans in Erie information technology (IT) assets. County. The District is governed by an elected seven- Key Findings member Board of Education (Board). The Board District officials did not maintain a complete is responsible for the general management and accurate inventory of IT assets and control of the District’s financial and (computers, tablets, document cameras, educational affairs. The Superintendent of etc.). As a result, District officials cannot be Schools (Superintendent) is the chief executive assured that these assets are adequately officer and is responsible, along with other accounted for and would be detected if lost, administrative staff, for the District’s day-to-day stolen, misused or if they became obsolete. management under the Board’s direction. l The District’s IT inventory records were The Director of Information Technology and incomplete and inaccurate, in part Communications Services, District Data because the records were not always Protection Officer (IT Director) is responsible for updated to include all acquisitions of, managing the IT Department and maintaining the removed/disposed of, or recycled IT District’s IT equipment inventory, along with other assets. functions. l Of the 79 IT assets tested, officials Quick Facts could not locate 30 IT assets: 22 that cost about $14,000 (eight computers, Student Enrollment 530 four tablets and 10 additional IT assets) Employees 137 and another eight IT assets (five Cost of Devices Acquired computers, one tablet and two other July 1, 2021 – September 22, 2022 items) of unknown cost. Officials could Leased From BOCES $101,000 not tell us how much they cost because the District’s inventory records were Purchased From Other $20,000 Vendors incomplete. l No annual physical inventory count was performed. Audit Period Key Recommendations July 1, 2021 – November 22, 2022 l Adopt a comprehensive written IT asset We extended our audit scope period back to inventory policy to track IT assets. review IT equipment disposal records. See Appendix B for details on our scope extensions. l Perform an annual physical inventory. District officials generally agreed with our findings and indicated they plan to initiate corrective action. Of f ic e of t he New York State Comptroller 1

IT Equipment Inventory The District leases most of its computers and other IT assets from the Erie 1 Board of Cooperative Educational Services (BOCES), but also purchases IT equipment from other vendors. District officials used How Should District Officials Maintain IT Equipment Inventory? an application A school board should adopt a comprehensive written policy that sets forth to track the guidelines and procedures for establishing and maintaining IT equipment inventory. School district officials should maintain detailed, up-to-date inventory District’s records for all IT equipment including adding new equipment to the inventory; notifying the IT Department when equipment is reassigned, lost or stolen; and IT assets documenting and updating the inventory for equipment disposal. Inventory (device records should include a description of each item including the make, model and serial number; the name of the individual to whom the device is assigned, list), but the if applicable; the physical location of the asset; and relevant purchase or lease records were information including the initial cost, depreciation and acquisition date. incomplete. In addition, school district officials should verify the accuracy of inventory records through periodic (i.e., annual) physical inventory counts. Also, officials should periodically examine devices to confirm the assets are in the District’s possession, to assess their condition and verify accurate location information in the inventory records. Maintaining complete and up-to-date IT inventory records also helps a school board develop and implement an effective IT equipment replacement plan. Officials Did Not Maintain a Complete IT Equipment Inventory District officials used an application to track the District’s IT assets (device list), but the records were incomplete. The device list included information such as tag number, make, model, serial number, building and room number, but did not include acquisition date, cost or whom the device was assigned to. Furthermore, certain fields and key information for some devices was not recorded or was inadvertently left blank. For example, the serial number field was left blank for 110 of the 1,846 devices on the list. Without a serial number, it would be more difficult for District officials to identify a device with certainty, especially if it was lost or stolen. Furthermore, the device list did not include certain types of devices such as security cameras, copiers, servers and server parts, wireless access points, power backups, network switchgears, and computer monitors. We found that 16 of 30 District-owned items acquired during our audit period – six security cameras, five computer monitors, three computers, one interactive display, and one printer − were not included on the District’s IT device list. The IT Director told us that the list did not include security cameras or computer monitors because they were not portable or frequently moved items. He also told us that it was an 2 Of f ic e of t he New York State Comptroller

oversight on his part that the five other devices were not added to the device list when the District obtained them. After our inquiry, the IT Director subsequently added the five devices to the IT device list. District officials use a different module in the device list application to track who IT equipment was assigned to (assignment list) and another application to manage and track the assignment of student computers. In addition, BOCES maintained a list of the devices the District leased from BOCES. Although the BOCES list of IT equipment was available and provided to the District, it was not an adequate record for inventory purposes because it did not include the name of the individual assigned the equipment, the equipment’s physical location, or equipment purchased from other vendors. The IT equipment in each of these lists should also be on the District’s device list. District officials also maintain lists of devices that are Board-approved to be disposed of or recycled. Devices disposed of or recycled should be removed from the device list. To further test the accuracy of the District’s device list, we compared lists generated from the District’s other IT equipment tracking applications and the BOCES-maintained list of leased equipment to the District’s IT device list and found numerous discrepancies and inconsistencies. Assignment List − The District’s assignment list showed 583 devices were assigned out to individuals. Seventeen devices were assigned to individuals but the devices were not recorded in the device list. While different tag numbers were used in the device list and assignment list for two items, four items were never input into the device list even though they were assigned out to individuals. The IT Director corrected these six records after we brought the discrepancies to his attention. The remaining 11 devices had been previously recycled and removed from the IT device tracking portion of the application. As a result of our inquiry, the IT Director corrected the assignment list. According to the IT Director, the device tracking portion and the assignment portion of the application are not linked; therefore, any variances between the two lists would not be automatically identified within the application. The IT Director did not perform comparisons between the device tracking list and the assignment list and was therefore unaware of the discrepancies. Student Computers − The list generated from the application used to manage student computers indicated that there were 1,089 student computers currently in-service. Of these, 249 were not on the District’s device list. We followed up with the IT Director and determined the following: l 107 were new and had been shipped to the District about 20 working days before we conducted our test. They had not yet been entered into the device list but were subsequently added. Of f ic e of t he New York State Comptroller 3

l 100 had been recycled or approved to be recycled and should have been labeled as such on the student computer application, according to the IT Director. l 23 could not be explained and the IT Director did not have a record of these items being disposed of or recycled. Refer to the section Officials Could Not Locate IT Equipment. l 13 were missing from the device list even though 10 had District inventory tags and three had been assigned out. The IT Director subsequently added them to the District’s device list. l Four were listed with an incorrect serial number on the device list. The IT Director subsequently corrected the list. l Two were not included on the device list because their values were less than $100 each. The IT Director told us that the IT Department had not historically tracked IT items with costs under $100. In addition, 17 deprovisioned computers were still on the device list. We verified that 16 of these devices were recycled in fiscal year 2021-22. The IT Director told us that the remaining device had been accidentally marked as deprovisioned, and we verified it was re-provisioned a few days later. Devices on the BOCES List − The BOCES-owned device list included 1,574 devices with serial numbers listed. We identified 590 items that were not included on the District’s device list: l 371 were devices with acquisition costs totaling $313,186 that the IT Director explained were rarely moved and therefore not included on the District’s device list. l 164 were student computers which were not on the device list for the reasons noted above (Student Computers). l 18 were new devices shipped to the District on August 15, 2022 that had not yet been entered into the device list. The IT Director subsequently added them to the device list. l 12 were listed with an incorrect serial number on the device list; the IT Director subsequently corrected the list. l 11 were inadvertently not assigned inventory tags and not input into the District’s device list; the IT Director subsequently tagged these devices and added them to the District’s device list. l 11 devices’ whereabouts and status could not be explained by the IT Director and he did not have a record of these items being disposed of or recycled. Refer to the section Officials Could Not Locate IT Equipment. 4 Of f ic e of t he New York State Comptroller

l Three had acquisition costs under $100 each. The IT Director told us that the IT Department had not historically tracked IT items with costs under $100. Not tagging and adding acquired IT assets to the District’s device list in a timely manner places those assets at risk of loss or theft; if an item were to disappear before being tagged and inventoried, District officials may never know the item was lost. Recycled Devices – In April 2022, the Board approved 370 devices to be recycled but six were not removed from the device list. Because there was no process in place, such as an annual physical inventory to ensure all devices obtained by the District were added to the device list and all devices disposed of or recycled were removed from the device list, these errors and discrepancies were not identified and corrected. The Board did not develop and adopt a policy to convey its expectations for tracking IT equipment or maintaining proper inventory records. In addition, while the IT Director told us that each of the IT Department’s four employees update the device list and are responsible for ensuring the records are accurate, the IT Director did not develop written procedures to provide specific guidance to those individuals. The IT Director also did not review the device list to ensure new items were added and disposed items were removed; he said the District does not have the resources to do this. Due to a lack of oversight and guidance, and the absence of an annual physical inventory, the District’s IT inventory records were incomplete and inaccurate. Without complete, accurate, and up-to-date IT equipment inventory records, District officials cannot be assured that these assets are properly insured, adequately accounted for and would be detected if lost, stolen, misused or if they became obsolete. Officials Could Not Locate IT Equipment Due to the lack of complete IT equipment inventory records, we attempted to locate 79 IT devices1 with the IT Director and could not locate 30 of them (38 percent). These items included 13 computers, five tablets, two computer monitors, two projectors, two printers, two network switchgears, two internal power supplies for switches, a television and a cart. Although District staff was able to locate the other 49 items, much investigation was needed to locate them because of the District’s inaccurate IT inventory records. 1 Please see Appendix B – Audit Methodology and Standards for sampling methodology. Of f ic e of t he New York State Comptroller 5

The District had acquisition cost and approximate acquisition date information for 22 of the 30 items that could not be located. These 22 devices – eight computers, four tablets and 10 additional IT assets – cost approximately $14,000; 11 of Due to the them were purchased within the last six years and cost approximately $4,700. The remaining eight items – five computers, one tablet and two other items – District’s were more than six years old. The IT Director could not explain why they did not inaccurate maintain acquisition cost information for all the District’s IT equipment. IT inventory District officials were not aware that these devices were missing and, therefore, did not investigate them. The IT Director also told us that they do not conduct an records, annual IT equipment inventory count. Due to the District’s inaccurate IT inventory and lack of records, and lack of an annual physical inventory count, District officials could not account for all IT equipment paid for by the District. Furthermore, because an annual District officials did not maintain complete inventory records with acquisition cost physical information, the value or replacement cost for all of the missing items could not be determined. inventory count, District What Do We Recommend? officials could The Board should: not account 1. Develop and adopt a comprehensive written policy to appropriately track and inventory IT equipment. This policy should include guidance and for all IT processes for: equipment a. Maintaining detailed up-to-date inventory records for IT equipment, paid for by b. Establishing a cost threshold for tracking IT equipment, the District. c. Adding new equipment to the inventory, d. Documenting and updating the inventory for equipment disposal, e. Reviewing new equipment added and recycled devices removed to ensure they were done accurately as intended, and f. Annually reviewing the physical inventory. 2. Require the IT Director to perform a physical inventory of all IT equipment, including security camera, copiers, servers or server parts, wireless access points, power backup, network switchgear, computer monitors, etc., and locate missing and unaccounted-for equipment and update inventory records accordingly. 6 Of f ic e of t he New York State Comptroller

The IT Director should: 3. Establish written procedures in compliance with the Board-adopted policy to address the IT Department’s equipment inventory. 4. Maintain a complete and comprehensive IT equipment inventory list that includes a description of each item including the make, model and serial number; the name of the individual to whom the device is assigned, if applicable; the asset’s physical location; and relevant purchase or lease information including the initial cost and acquisition date in its inventory records. 5. Ensure inventory records are updated for all IT equipment purchases, assignments and disposals of BOCES-owned and District-owned IT equipment, including locating all unaccounted-for devices. 6. Perform an annual IT equipment physical inventory. 7. Reconcile the BOCES-owned inventory list and work with BOCES to remove and/or return devices that are no longer in service. 8. Continue to attempt to locate the 30 missing devices and take corrective action − such as working with the insurance carrier if needed − to minimize financial losses. Of f ic e of t he New York State Comptroller 7

Appendix A: Response From District Officials 8 Of f ic e of t he New York State Comptroller

Appendix B: Audit Methodology and Standards We conducted this audit pursuant to Article V, Section 1 of the State Constitution and the State Comptroller’s authority as set forth in Article 3 of the New York State General Municipal Law. To achieve our audit objective and obtain valid audit evidence, our audit procedures included the following: l We interviewed District officials and reviewed Board policies and Board meeting minutes to gain an understanding of the processes used for maintaining IT equipment inventory records. l We reviewed cash disbursements reports and claim vouchers to identify the total District-owned devices purchased during the period July 1, 2021 through September 22, 2022. We determined that the District purchased 30 devices for $19,646; we reviewed these 30 newly purchased devices to determine whether they were added to the District device list accurately and in a timely manner. l From the BOCES-owned inventory list, we determined the District leased 230 IT devices through BOCES during the period July 7, 2021 through September 22, 2022, for a total of $101,173. l We compared the device list from BOCES and the device lists from two other device management applications used by the District to the District’s main IT device list to determine whether there were any discrepancies. l We obtained the 2021-22 recycled IT device list and compared it to the District device list to determine whether they were removed from the District device list as intended. We extended our scope period back to verify IT equipment disposals per the IT Director to the Board-approved disposal lists. l Using our professional judgment, we selected and attempted to locate 79 devices: 23 student computers assigned but not on the District’s main device list; 11 devices from the BOCES device list but not on the District’s main device list; 27 devices not on the District’s device list due to oversight or because they were the type of device the IT Director told us the District did not track; and 18 devices selected from the District’s device list chosen to include a different variety or type of devices. We analyzed available cost information for devices that could not be located to determine the approximate cost of any missing devices. We conducted this performance audit in accordance with generally accepted government auditing standards (GAGAS). Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objective. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective. Unless otherwise indicated in this report, samples for testing were selected based on professional judgment, as it was not the intent to project the results Of f ic e of t he New York State Comptroller 9

onto the entire population. Where applicable, information is presented concerning the value and/or size of the relevant population and the sample selected for examination. The Board has the responsibility to initiate corrective action. A written corrective action plan (CAP) that addresses the findings and recommendations in this report must be prepared and provided to our office within 90 days, pursuant to Section 35 of General Municipal Law, Section 2116-a (3)(c) of New York State Education Law and Section 170.12 of the Regulations of the Commissioner of Education. To the extent practicable, implementation of the CAP must begin by the end of the next fiscal year. For more information on preparing and filing your CAP, please refer to our brochure, Responding to an OSC Audit Report, which you received with the draft audit report. The CAP should be posted on the District’s website for public review. 10 Of f ic e of t he New York State Comptroller

Appendix C: Resources and Services Regional Office Directory www.osc.state.ny.us/files/local-government/pdf/regional-directory.pdf Cost-Saving Ideas – Resources, advice and assistance on cost-saving ideas www.osc.state.ny.us/local-government/publications Fiscal Stress Monitoring – Resources for local government officials experiencing fiscal problems www.osc.state.ny.us/local-government/fiscal-monitoring Local Government Management Guides – Series of publications that include technical information and suggested practices for local government management www.osc.state.ny.us/local-government/publications Planning and Budgeting Guides – Resources for developing multiyear financial, capital, strategic and other plans www.osc.state.ny.us/local-government/resources/planning-resources Protecting Sensitive Data and Other Local Government Assets – A non-technical cybersecurity guide for local government leaders www.osc.state.ny.us/files/local-government/publications/pdf/cyber-security-guide.pdf Required Reporting – Information and resources for reports and forms that are filed with the Office of the State Comptroller www.osc.state.ny.us/local-government/required-reporting Research Reports/Publications – Reports on major policy issues facing local governments and State policy-makers www.osc.state.ny.us/local-government/publications Training – Resources for local government officials on in-person and online training opportunities on a wide range of topics www.osc.state.ny.us/local-government/academy Of f ic e of t he New York State Comptroller 11

Contact Office of the New York State Comptroller Division of Local Government and School Accountability 110 State Street, 12th Floor, Albany, New York 12236 Tel: (518) 474-4037 • Fax: (518) 486-6479 • Email: [email protected] www.osc.state.ny.us/local-government Local Government and School Accountability Help Line: (866) 321-8503 BUFFALO REGIONAL OFFICE – Melissa A. Myers, Chief of Municipal Audits 295 Main Street, Suite 1032 • Buffalo, New York 14203-2510 Tel (716) 847-3647 • Fax (716) 847-3643 • Email: [email protected] Serving: Allegany, Cattaraugus, Chautauqua, Erie, Genesee, Niagara, Orleans, Wyoming counties osc.state.ny.us