Text · page 13 of 16
Read the whole document on one page (all 16 pages, each with its own heading)
Appendix C: Audit Methodology and Standards We conducted this audit pursuant to Article V, Section 1 of the State Constitution and the State Comptroller’s authority as set forth in Article 3 of the New York State General Municipal Law. To achieve our audit objective6 and obtain valid audit evidence, our audit procedures included the following: ll We reviewed Board policies, regulations and minutes and District procedures relating to IT operations and assets and interviewed District officials to obtain an understanding of the IT environment. ll We interviewed District officials to determine whether employees received IT cybersecurity awareness training and regularly reviewed acceptable use policies. ll We reviewed 15 employees’ web browsing history on the 15 computers assigned to them to evaluate whether their Internet use was in compliance with the AUP. We judgmentally selected the 15 employees for our sample based on job titles that indicated duties likely to involve accessing student, staff and financial PPSI. We chose to review the following titles and individuals: Superintendent; Assistant Superintendent for Administration and Finance; Director of Technology; District Treasurer; Director of Health, Physical Education and Recreation; Human Resources Manager; Maintenance Mechanic Crew Chief; community relations coordinator; high school nurse; payroll clerk; curriculum coordinator; webpage manager; and one teacher from each of the three District buildings. ll We provided the Director with a computerized audit script to run and asked him to copy the reports and files generated by the script from our sample of 15 employee user accounts for us. We analyzed the reports and files, including Internet browsing histories, looking for potential issues related to personal and high-risk activities. Our audit also examined the adequacy of certain information technology controls. Because of the sensitivity of some of this information, we did not discuss the results in this report, but instead communicated them confidentially to District officials. We conducted this performance audit in accordance with generally accepted government auditing standards (GAGAS). Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objective. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective. 6 We also issued a separate audit report, Hamburg Central School District – Continuing Education (2019M-11). Of f ic e of t he New York State Comptroller 11