Text · page 9 of 12
Appendix B: Audit Methodology and Standards We conducted this audit pursuant to Article V, Section 1 of the State Constitution and the State Comptroller’s authority as set forth in Article 3 of the New York State General Municipal Law. To achieve our audit objective and obtain valid audit evidence, our audit procedures included the following: ll We interviewed District officials and reviewed Board policies, regulations and minutes to gain an understanding of the District’s policies, procedures, network and related IT controls. ll We provided a computerized audit script to the Director to run on the domain controller7 on June 1st and June 2nd, 2021. We analyzed each report generated by the script to identify network user accounts and security settings that indicated ineffective IT controls. ll We compared the District’s current student enrollment list and master payroll list to the network user accounts identified by the scripts to determine whether active network account users were either enrolled students or District employees. ll Using various software permission reports from the financial application, we determined how user permissions were managed. We examined the user permissions for all five Business Office employees to determine whether access to the financial application was appropriate based on their job duties. ll We reviewed access granted to the student information application and determined if the access is appropriate based on the employees’ job titles or students’ status. Our audit also examined the adequacy of certain IT controls. Because of the sensitivity of some of this information, we did not discuss the results in this report, but instead communicated them confidentially to District officials. We conducted this performance audit in accordance with generally accepted government auditing standards (GAGAS). Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objective. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective. Unless otherwise indicated in this report, samples for testing were selected based on professional judgment, as it was not the intent to project the results onto the entire population. Where applicable, information is presented concerning the value and/or size of the relevant population and the sample selected for examination. 7 The domain controller is the main server computer in the domain (network) that controls or manages all computers within the domain. It is responsible for allowing users to access network resources. Of f ic e of t he New York State Comptroller 7