Text · page 3 of 12
Report Highlights Springville-Griffith Institute Central School District Audit Objective Background Determine whether Springville-Griffith Institute Central School District (District) officials The District serves the Towns of Aurora, adequately secured access to the network, Boston, Colden, Collins, Concord and student information and financial applications. Sardinia in Erie County and the Towns of Ashford, East Otto and Yorkshire in Cattaraugus County. Key Findings The District is governed by an elected Although District officials restricted access to seven-member Board of Education (Board). the student information application, they did not The Board is responsible for the general adequately secure access to the network and management and control of the District’s financial application. District officials did not: financial and educational affairs. The Superintendent of Schools is the chief ll Disable unnecessary generic network user executive officer and is responsible, along accounts. with other administrative staff, for the District’s ll Properly restrict user permissions in the day-to-day management under the Board’s financial application. direction. In addition, sensitive information technology The District relies on its IT assets for Internet access, email and for maintaining financial, (IT) control weaknesses were communicated personnel and student records and data. The confidentially to District officials. District employs a Director of Technology, Data and Assessment (Director) to manage Key Recommendations its IT department. ll Review generic network user accounts Quick Facts and ensure that unnecessary accounts are Student Enrollment 1,647 disabled. Employees 566 ll Review financial application user accounts Network Accounts and limit access rights and permissions Student 1,551 based on a user’s job responsibilities and to properly segregate duties. Employee 342 Generic 338 District officials agreed with our findings and Other 12 recommendations and indicated that they planned to take corrective action. Total 2,243 Audit Period July 1, 2020 – August 13, 2021. We extended our scope period back to the summer of 2019 before the COVID-19 pandemic to verify whether District officials reviewed network accounts. Of f ic e of t he New York State Comptroller 1