001Okay. Um, I would like to call to order the audit committee meeting. Thank you all for coming tonight. I'd like to welcome each of you to the audit committee. We'll start with introductions. I'll start with myself. My name is Patty Sullivan. I'm a member of the PPS board and chair of the My name is Jennifer Samuels. I'm a community member and member of the audit committee. Turn around. Uh Eddie Wong, board chair, member of the audit committee, Jervis County. Okay. And we have someone on Zoom. Hello, Caroline Zakovski. She her. I'm a community member of the audit committee. Great. Welcome. Okay. Thank you. Thank you all for being here. Um, first on the agenda is the followup on the status of the implementation of recommendations included in the student body funds audit. Janice, would you
002please introduce? Thank you. Um, so last year we issued a report, the student body funds report that had a couple of recommendations included. Um, so today we uh he is responsible for some of the implementation of the recommendations along with that he works with and so we can talk about these items. So in your packet I printed the um step implementation plan. So it looks like this here um and you will be able to see there are a total of seven recommendations that were made during that audit report. Um in the column on the far right hand side, the status update, that column is um our audit um status of where it is right now. So we did a spot check on a couple of these recommendations to confirm whether or not they were implemented.
003So based off of that spot check that is what is included in the status update listed in the far right hand column. So for each of them you know so the first one it says that in progress in progress um and number three shows as outstanding which we'll talk about that separately. The number four is one that I was able to confirm that I had completed the implementation of that recommendation. So, what I like to do is gray that out um in the first time we talk about it and then moving forward when we come back to talk about other re the implementation of the other recommendations, we'll just hide that row so we don't have to keep talking about the ones that are implemented. But we were able to confirm that implementation and we
004were able to confirm the other ones are all in progress which is great. Um a couple of things that um kind of came up specifically as I was talking to Jennifer yesterday. Thank you so much for chatting with me. Um one of the questions that she asked me was um what is the proper process or what do you do whenever the staff say they're not planning to implement a recommendation. So, for example, number three on this item, the recommendation says, "We recommend accounting services department strengthen internal controls to ensure student body fund transactions are for allowable purposes and are adequately supported by required documentation." So, the district's response was they agreed with the recommendation. Um however for the implementation plan you can see listed there they said unable to implement and provided some comments about
005staffing level. So what this is the first time that it's actually kind of come up where staff has responded um yes we agree with the recommendation but due to whatever circumstances we're not able to implement um and so Jennifer asked well what do you do? I was like, well, um, there is something we can do. It's called a risk acceptance letter. Um, so thank you for that. Um, so I provided a copy of what a risk assessment letter could look like. Um, you know, the it's not required to do something like this. Um so the next document there is u background information about what a risk assessment letter looks like and could be. So risk acceptance letters are not common practice. Um but it it is the way in which we could formally kind of
006close that loop of just the department saying yes, we agree with the recommendation and here's why we can't implement it or we're not planning to implement and just having that formally documented um would be one transparent way of kind of tying that all together. There could be a a variety of reasons which are all reasonable that the district would um not be able to implement a recommendation. So for example down on the the last recommendation number seven is related to the athletics pass through into the student body fund account and um athletics is just getting a new system. And so it makes sense to let that system get implemented and then create the um the guidance for how that will work as a pass through. So for example, that one shows that they're not planning
007to have it implemented until 2026, which makes sense because the new system will be implemented in next year. So there's lots of reasons why, but that risk acceptance letter is an opportunity to kind of formally document it. There are ways in which uh we're less formal. Um so for example on that background information down at the bottom of the page, what if we don't use uh risk acceptance letter? Um so in less formal environments, the same message really can be documented in the audit. report with the management's response or it could be documented in the comment section of theiration document which is where it is documented. So it's less formally documented u but it is documented. So my question to the audit committee is whether or not you think there would be value in doing
008a formal risk acceptance letter on some of the random not very common but um in some situations where staff is not going to implement recommendation. Do you think there's value in having it formally documented or are you okay with the way documented in the status implementation document and you can think about it. We don't have to make a decision. I just wanted to respond because there is a formal way of which to close that loop. So, I gave you an example of what that might look like and we can talk about it um moving forward as to whether or not you think there's value to documenting that and you can check out the example that I provided and get back to me. Yeah, just just a quick thought off the top of my head. I
009mean, I think to answer that question for me personally, it would need more I think the focus needs to be on for what purpose. So, think like for example in this case because of the reduction in 2.0 to to 1.0 FTE and the inability to comply with the recommendation even though there's agreement. Um you know my question for this case would be like it's not necessarily um a risk acceptance but you know me personally would like to see a risk assessment right in terms like you know what are the potential risks from having this not closed and if if that's the case um I would prefer something like that a risk risk assessment but if there is something that there's agreement that there isn't any risk or further personally speaking for myself I'm fine with
010the the way it's documented now because I think um again I think for me personally I think the focus needs to be on the purpose you know is it trying to fix something or is it just creating more I if if the documentation creates um for example like a road map to to fix in the future yeah that's that has worth but I I I would I guess b at any kind of just paperwork for the sake of paper I noticed One thing it says that um review procedures have been modified to align with current staffing level and it doesn't say how it's modified. So we don't know if it's modified to meet the risk. So all the risks are really identified in the actual report that was issued last year. So when we do
011the report we do a lot of testing to look to see if something is not happening the way we think it should be. And each of the recommendations are tied to an example identified in the audit report, but I could see some of that information that I'll try to come up with. circulated as a template to get some feedback about it next time. So I don't think what we have here is adequate to tie things off because um we had the finding um a recommend with a recommendation an agreement that staff was going to do it and now because I'm assuming intervening events now saying no we're not going to be do it. So to me it seems like there's should be some sort of tie off and whether it's the risk assessment letter or
012something else seems like that's or the something else is important because for example I'm not really comfortable with um just what it says here that because we um there was a reduction we're not going to be able to ensure that the transactions are for purpes. So my question is is there some other mechanism aside from having this more formal process um to ensure that so for example the person who's actually like engaging in the transaction not the reviewer like could they need like do they attest that they're for allowable purposes? So like that's then you're like moving the accountability to the person who's submitting them whatever the process is. So I'm wondering instead of having this other review that we're putting it back on person whatever the transactions are that they're actually attesting to a
013check or anything that says they're asserting that they're authorization. Yeah. Like depends on how has come along with that or if it's check that also has different levels from the staff writing the check to the principal spot checks. So there is some level of it just depends on how situations do for us to to determine wheation piece of it because that's where we really saw the biggest lacking it's hard to look so for as an example um if somebody puts Amazon, but it doesn't tell you what the actual item is. So, unless there's another piece of documentation that says what you bought at Amazon, we can't determine whether or not that Amazon purchase was not all that. Yeah. So, work places I've spent a lot of time in. Um, if you submitted something like the
014general Amazon thing, like you basically would get reimbured. Um, so I'm curious that we re that the district reimbures without supporting documentation because that's practice. So, and I'll I'll tell you, it motivates people to provide their supporting documentation if they don't get um reimbured. So, wondering if there's another mechanism versus having somebody else check did you provide the right supporting documentation so I would be a question that I would have and actually it then makes it a self enforcing mechanism and yeah every once in a while there is missing receipt but that should be the norm I know right now it's a whole other process versus I just submitted whatever and I got reimbured and then somebody's chasing me or I had something. So I don't know is there a way to to build that
015in that you don't get reimbured you don't provide the right documentation it's not allowed we're talking That doesn't necessarily. However, we're talking along with the dollar. And so in in the review process or audit process of check but Um, okay. So, I think I have an idea. I think I hear this is the first time we've had a situation come up where even though the district agrees with the recommendation, they've said that they reason. I think what I'm hearing from is that you expect a little bit more um than just that to kind of close off feel good about the implementation of this recommendation. So for those two items and I talk with Jay and bring back at our next meeting kind of in between uh where we can kind of document some of the
016things that they are doing in additional procedures that Oops. Caroline has her hand up. Thank you. Um I was just gonna say for this kind of form or some other process, it does seem like a pretty uh rare occurrence and it would be something to use sparingly. So not necessarily a lot of additional work. To me, it seems like it could also be risk based in terms of um you know, how much of a risk does the auditor see this as? If it seems like an unacceptable risk for the school district to be taking, then I think it could be elevated up to whoever is at a higher level to provide a little bit more explanation in terms of why we're why they're accepting the risk. Um but if it's something where it it's not
017as pressing um in terms of whether we're using this form moving forward, I think it could be helpful for very specific situations. Yeah, if I can kind of add on to what Caroline is saying because I I completely agree. Um, I think it would also be nice because I mean there's it looks like this problem is something that also may just require a little bit more problem solving to to figure out, right? Because we have less personnel to figure out. You have to be creative, right? Um, I think my I guess my point is is there my question maybe is doing something like this, the risk accepted lender, is it something a process that automatically triggers this to be revisited in the future? Because that would be probably the most important for me especially when
018things that you know should be looked at again, right? And so um having a a system where things that like this occurrence happens um automatically triggers like hey we will re-review this and you know set a deadline for example. So on the risk assessment letter it does have a date for reconsideration but we don't have to do the letter for that. We could I could just inter document to revisit it. So that is a thing. It is on the letter, but it could be done in multiple ways. And if that's what that is what I'm hearing from you. So that's what we do. We'll set a forit recommendations that are accept. The one thing I would not want is well the audit committee looked at this and like all you have to do if you
019don't want to implement something is like the staff to do it. Um because that seems like contrary I know that's not what happened but it seems like the audit committee then the audit committee accepting. So I think the what is the something else something else is somewhere putting that you're gonna review it. It's not just Yeah, this is the first time it's kind of come up in this way. So, I'm just kind of throwing out ideas and getting feedback for what is the best way. I think sounds like a little bit more than what we have in the spreadsheet, but maybe not as much as the formal risk acceptance letter. So, I will work on that and get something kind of with that in mind, come back with a proposal. Is that okay? Just for
020those two recommendations and I'll work. Thank you. Thanks for the discussion. Any other comments? Okay. Next going to go to the next item on the agenda and this is the status update related to the RFP process the external ACFR and I want you to know what those acronyms stand for anybody. The uh RFP is the request for proposal. The ACFR is the annual comprehensive financial That was the auditor's contract. So, Chief Morrison, would you please introduce item and good evening everyone? It's nice to see you. Um, as the situation page outlines, our um a contract with TKW had expired as of the end of March and we did go out for um additional proposals and we did only receive one and it was come back from um TKW and so we went through the process
021of evaluating it even though there was only one and they did meet all of the proposal requirements. So we have um accepted um proposal and have entered into contract. Currently scheduled to have our interim audit starts with CP next. Okay, that was pretty simple, very straightforward. Thank you. Um, thank you for that. Um, having the audit and this I know from our auditor, um, having the audit committee participate in the selection process for the external auditors is best practice and I would like to thank our community member Caroline. Thank you Caroline for your willingness to serve on the selection panel for this process and also thank you to the purchasing and contracting staff that were able to pro provide assistance and guidance for those of us who were doing this for the first time which
022was definitely so I learned a lot. Um the contract with TKW which is Talbet Corvola and Warwick LLP to provide these auditing services was approved by the full board in our regular board meeting on April 8th via resolution 7081. The contract with TKW shall continue through March 31st, 2030 and may be renewed for up to an additional five years by amendment signed by both parties. I think that wraps this process up. Before we move on, are there any questions or discussion from audit committee members about this contract? There's a comment. I think the committee members and chair um for um making sure we the right way. Um and I know know we had it there was a couple years to do that and this is practice. So really appreciate that you re you reestablish this
023chair because I say this one just is that oversight thanks to everybody participated process even though we had for just credibility and trust process. Thank you, Caroline. And thank you, Jul. The next item on the agenda is discussion of the Office of Internal Performance Audit budget request for the 2025 2026 school year. related benchmark again that I comes up often initials office. So Janice would you please in your packet you see the budget proposal document that looks like this. Um, so what I did is I put the budget request for next school year. I listed the current um or the current 2025 budget and the last year's budget just so you can see multiple years what the budget has been. You can see that the there is an estimated increase. The bulk of that is
024related to salaries and fringe benefits with the biggest piece of that be coming from hers. Um so I because there was a question after talking with Jennifer yesterday. Um I did a quick spreadsheet for you to show the difference in each line item um where the cost increases are coming. And you can see that about 20,000 of the $32,000 is related to the purse. Um, but there we are not requesting anything any significant changes from last I got the budget numbers related to salary benefits directly from the budget in our budget office. So feel really good about that estimate. Um and then um I did list a little bit of an increase related to professional development. Um I'm required to have myself and Mary Catherine both required to have 80 hours of professional development every
025two years. And I'm a little behind on getting to where I need to be. So I need to step that up this year. So there's just a little bit of an increase listed. So we can go to a couple more. Are there any questions? Anybody? Okay. Oh, I forgot I did the benchmarking data for you. Oh my goodness, I to spend a lot of time on these. Um, sorry about that. Also in here is benchmarking data um to show you um you know to kind of provide some perspective on the budget request. So in here in the um benchmarking data, you'll see a chart. The first one is the general fund investment and internal audit. So, it's a chart that shows um where PPS is in relationship to 31 other school districts that are mostly
026part of the Council of the Great City Schools. The council of great city schools um has a job alike quarterly meeting for internal auditors and so we've been working to gather all this data from the different school districts and so you can have an idea of where we are in comparison to other school districts. I would like to mention that um we are really on the small side of when you look at all the other members of the city schools were definitely one of the smaller ones. So, it's not apples to apples, but there are a couple of school districts um that I think are pretty comparable to us. And I like to point out Seattle as being a comparable district. They're the largest in the state of Washington, similar to the way we are.
027Um so, you in each of the charts I identified where Portland public schools are the average listed in there as well. Um so you can see for that first chart for the general fund investment we are slightly below average but not far below average. And so um that's one thing. The next chart talks about the number of auditors per 100 million in the general fund. Um this is sometimes a metrics for determining staff sizing for internal audit departments. It's not the only way in which people can use to create staffing, but um it's one of the metrics. So, we put a chart in here to show where we are in relationship to the other schools. Again, we're just um below average in that area. Um not quite as um not too far below average, but
028I think it's pretty The next chart talks about the number of auditors per 10,00 students. Sometimes this is also a metric some school districts use to help determine staff size for their internal audit department. So that's why collected the data and you can see Portland public schools is listed there and again just a little bit under average. The next chart listed is um the percentage of internal audit departments that report to the school board. I thought you might be interested in knowing what other school districts do in this area. And you can see that the largest portion of the school district internal auditors do report directly to the board. So 87% do report to directly to the board as do we. So that's good. Um, we also did a chart for the percentage of school
029districts that have an audit. Um, so we did have some where the auditor reports to the whole board but not through the audit committee. So that's 19% and 81% do have an audit committee like we do. The next chart is um the audit committee composition. So um we every school district does it a little bit different. Um some audit committee me boards or audit committees are made up of board members only. Some are made up of community advisors only and we fall in the mix category which is really considered best practices to have a mix of board members and community advisors. Um but you can that chart, the bulk of school districts only have school board members. So, we're leading the chart on best practices in that category. Um, the next chart shows professional audit
030standards. Um, it's a chart that just shows which audit standards are being followed by the schools and you can see the majority of school districts are using red book. Um, we by policy use yellow book. Um in the past there one of the biggest reasons differences between red book and yellow book was the yellow book um has a mandate to serve the public interest. Well and that was not included previously in the red book but they just did a new version of the red book. update these audit standards every now and then and serving in the public interest is now included in the red book so they're even more comparable. Um right now we primarily use the yellow book for everything that the yellow book covers. The yellow book is silent on a lot of
031items related to the overall management and operations of an internal audit department. And for those type rules, we do refer to the red book only because the yellow book is silent on those titles. The next um the last slide is related to budget allocation for training and we listed in there how much of our budget is set aside for training for the auditors. And um you can just a little bit below average and just a little bit. We're testing just a little bit of an increase to that budget this time. Lots in that presentation. Um, I'd like to open it up for questions from any a committee members. I had a a certain point when we're at the the budget. Um I think one thing that would be useful just um not that we're going
032to spend a lot of time uh good fortunately for you um during the budget process probably on the internal office budget but I think it would be useful to um just share also have one last slide that that shares what other Oregon school district are doing because that I know we're the only ones that have so this is interesting national data. Thank you. Um, but I think in 2003 the state auditor did an audit on they basically had a series of recommendations for state agencies that if you had a budget over hund00 million um that you should have an internal auditor and after that that's when we instituted the internal number agency but we had a budget over 100 million time so we instituted the internal performance auditing function Um but no other school district
033has followed suit with creating a that I know of created a function. They all contract if they have anything it's relying on contract auditors and I just think it's worth worthwhile pointing out that PBS agency best practice um credit for that. Um like say this is more like here's what's happening nationally but I think we should also show follow best practice. Next five down or just a couple. I think Beaverton has a contracted model. Okay. Or I think some of the other districts when we need it like we have a we have an annual we have an annual financial audit which obviously everybody has but practice for government. Um, I would like a little bit of an explanation about the difference between the red and yellow and why use or have to use, choose to
034use or have to use it. So's policy is so when the school district the board set up the office of performance there was I think probably discussion back at that time period and development of policy to say which audit standard the board would like followed. And so that was a decision that was made for um back when the district was setting up the office of internal performance. I know director Edwards was around those conversations. Maybe she remembers some of the discussion about whether or not we should follow the runbook or the book. Um like I mentioned in the past, of the reason why is because the mandate public interest and that was not included in the most part in the past. However, with the UN standard for the red book that was just issued this
035year, that is now a mandate also. So, um I could do a pros and cons. Um there's been a lot of discussion amongst internal auditors about which one of these audit standards would be the would require the least amount of administrative work. Um, and you know, I don't really have an answer to say for sure following the red book would relieve some of the administrative burden and so free us up to do more audit work. It's not exactly that answer, but I put together for you for future conversations, but it's just not an easily answerable item. Okay. I don't want you to spend a lot of time on it. Just just curious. Yeah. Before we move on to the next item, we need to approve the budget for the office. Please note that we as
036the audit committee do not have the authority to formally approve this budget. Our approval allows Janice to submit this budget request. Formal approval of the budget will be made by the full board as part of the board's normal budget process. With that being said, members, would we like to approve the budget request or are there any objections? So far, we're approving the Okay. Uh, thanks. Thank you very much. Moving on to the next item on the agenda is status update on the audit committee's work plan. Janice again in your packet I provided the um audit committee work plan. This is the audit committee work that we started with at the And so what I did to give you an idea of where we are as far as achieving each one of these items on the
037plan, for the items that we've already achieved, I put a check mark by each of those items. And for items that have not we haven't gotten there yet, I put an ETA for when we are anticipating um getting to that item in the work. So, do you have any questions about or do you want to go over it in more detail? I just wanted to give you a quick visual check mark so you can easily see how how much progress we've made and what's still outstanding and rough ETA when those great I notice that a lot of them that are completed are saying carried over to there are two items we have to keep that in mindbody else we have a lot of discuss I just have one item that and this is to I
038think address something from last year uh Last year um the the audit committee did not get the bond audit until September and also the the audit committee did not inform auditors on the topics of the of this year's audit staff can't make recommendations but the audit they're being audited. Um so best practice is that they're being solicitation from other groups. So, um I'm noting on the bottom of page three and the top of page four is um we'll it says we'll probably be ready in June and um I would say that especially after last year um this absolutely should happen this year so that we get back on back on cycle um to be especially given the amount of money we have from the bond and that it was represent it's represented in the community
039that on the bond. So just um I would hope that the word probably be would be struck and that we've got the auditors um for sure coming in in in June and again that they're um having conversations with committee members um about topics for just got off cycle back on cycle so that engagement director would had her meeting with the bond auditors. a couple weeks ago, right? I think they wereaching out to get your good. Okay. But you had yours. I think potentially um we've had a lot of discussions now as a board about the cost of the high schools and frankly that could have been an audit topic last year that could have provided some guidance as we headed into the um into the the referrals and some other topics that we've had whether
040it's curriculum and some variety things from 2020 um bond audit that would have been really helpful for us to have this refer referral. So it's more I'm glad those conversations are happening but it's also tie it out versus having it. So the reason why I put probably is because I don't want to make any commitments on behalf of other staff but I did already reach out and have talked to the applicable staff and they have said yes we think that we'll be good to go for the meeting. So but I didn't want to say for sure because I don't want to commit on behalf of somebody else. So well I think this is what the audit committee should be ask I mean yes and I think the audit should be committee should be asking for
041that presentation to get that scheduled yeah I think we did ask for a date that's what we're trying to get yeah at the end of this meeting I think director is going to talk about scheduling Um, and so if we could kind of firm up a date, then it might make it easier to do that communication with the bond auditors to help facilitate them doing the presentation. Um, so yes. Yes. And we it is definitely the plan to have that at our next I mean this is one of those things that sort of like Um, but it's not the thing that everybody wants to schedule, but like we just I mean hopefully it's just a boring meeting. Um, but it needs to happen because when it doesn't happen, that's when it becomes um reciting it.
042I wasn't following the the pond auditors as closely as I am now um in the past, but I made some notes in my internal workflow so I can send out an email to help provide a little bit facilitation when it comes to those things. So I got an email saying we issued the audit report. ready. We're waiting for the district to respond. So, I'm kept in a little bit more. So, I hadn't done that in the past. I'll do a better movie for just to help facilitate because I've noticed that you and your efforts were trying to put all of the things needed to do on our regular in a right. So, it just happens like and then it becomes like, oh, we're having that boring meeting again that like everything's going well. Um, but
043it's when you don't have them and you start skipping. So, I really appreciate um and appreciate Janice very much for helping me. Yeah. And in this particular case, because the auditors have provided the audit to the district, it's really they need to file their response and then it needs to be delivered to the audit board. So it's not like we're waiting for the auditors. We're really staff. It's a process, but I agree. Yeah, you've been reaching out already. I have and I definitely think it's I think it's the I just can't be but we will as we get closer to that meeting send a formal email to confirm and I'll let you know for sure whether or not they're ready and if the answer is no they're not okay I'm just gonna say I think
044we should be much it's not to you but we should much more directive is like we expect to get the audit like um here's the date it is um well we I I will skip to the end here ask about that date about June 17th if that could work for members of the audit then we'd have to reach out and see if it works for anybody else but it works for us at least we can have a starting point so Maybe I don't know if you have your calendars right now, but if you could look at them and get back to me or andor J or and Janice um in the next day actually and see if that's free for us and we can work from there. If as I think I heard staff then
045we're gonna have to look at something else. But let's start there. which gives them almost two months. So Roseanne is mentioning the staff will be that week at OSA. Well, we are going to work on it. Okay. Yeah. I mean, there's Well, that's like tomorrow staff getting the number of dates that they're there that the auditor is there, but it seems like people are on vacation. It's like there's a whole host of reasons. Last year it was four to five months late and it didn't come back and say there are emails about that tomorrow. Thank you. Okay. anything more on this? Okay. Um the next item on the agenda is discussion of the performance evaluation to the district's internal auditor. Uh one of the ways we help preserve the independence of our internal auditor is
046to have her report directly to the board. As a result, the board has the responsibility to complete an annual performance evaluation for the internal audit. As the chair of the audit committee, it is my responsibility to draft and deliver the performance evaluation. And I would really appreciate input from you. Um, over the next week, will each of you please take a few minutes to think about the performance of our internal auditor and send me an email or give me a call to provide your input. Are there any questions about this? Maybe a suggestion to send us a like here are the things that we're measuring and comment on that and then um just question but maybe let us know what that's more valuable maybe include a job description it's helpful for comment what I will
047try to put that together in the next. Okay. Next, planning for future audit topics. Janet, please present this item. So, One of the things that the audit community do is to suggest audit topics for us to audit in the future. Um, and I think it's a really great opportunity for members to really participate in the process and think critically about risks. What are risks? What do they look like? What form are they in? And whether or not doing an audit related to the topic would really add value in that situation. Um sometimes there risks that are risks u that are not really suitable for an audit or whether an audit wouldn't necessarily um address the risk. So, I wanted to give you guys some examples of um ideas of what brisk might look like. So,
048I printed a an example sheet for you guys. And so, in here, there's just a list of what a risk. So, we'll just talk about the first one as an example. So, one risk might be cyber security. related to fishing attacks. So the risk description is employees may fall victim to fishing emails leading to credential theft or malware malware installation. Sorry. So this is an example of a risk and then so those are the things that I'm asking you guys to give me. So foram I gave you template where that's list a place for you to list out three different risks. So, I would like if at all possible for each of you to think about the example risks that I gave you as examples and fill in the template with at least three risks
049that you would like me to look into. Um, I also printed a copy of the portals for you guys just as a refresher because when you're thinking about what could go wrong, what are some of the biggest risks, maybe um, connecting them to our boards adds value. So, just as a refresher, I printed that so you can each take a look at that and think of risk associated to some of the portals as well. Um, What I'll do is you'll send me those three with just the risk description and what I will do is I'll collect those risks and answer some of the questions that are below in the examples. So for example, if if one of you had sent me the risk related to the cyber security, then I would get the risk and
050I would do some um asking questions around about what are the existing controls that we have and so I'll be able to let you know what we have in place and then we can have a better discussion about does it warrant an audit, do we do we really need to look into this based off what the internal controls that are already in place or perhaps maybe um even though there's internal controls in place that look great, maybe there's a risk that the internal controls are not being performed timely or consistently. And so um but that will help facilitate the question with a little bit more detail to have more robust conversation about future audit topics in our next meeting. Does that make sense? What um the list of risks as examples? Do you want to
051talk about them? I wanted to give you an example to look at so you have an idea of what kinds of information, what is considered a risk. Um, a couple of other prompts that auditors like to ask when talking about risks is questions like, "What keeps you up at night when you think about PPS?" Um, and you lose sleep over it. Hopefully none of you are, but um what do you lose sleep over? What keeps you up? If this happens, I it really worries me that if this happens, that is what I'm looking um and as detailed as you can be. Um you can so I you can handr write them and hand it to me or you can fill it out online. I'll email you the document and you fill it out and send
052it to me. Um, you know, and if there if I have a lot of questions about I'll reach out and talk to you individually about what it is before putting it all together to come back for a discussion in our next meeting. I'm curious how many new um do I know we're carrying quite a few. We're going to talk about that next time, please. Okay. So, you want to get the best one. But yeah, when we look at all the risks that were suggested, we'll we'll be able to say, well, this one looks like the most significant one. this is the biggest priority. So, we're not going to be able to pick all of the audits that are suggested, especially if each of you come up with three ideas. We definitely won't be doing that
053many, but it does help us think about it and um put some thought and process behind identifying those risks, assessing them to really know whether or not it's a real risk or potentially just perceive public perception of a risk. Um so that's what I would like to do. That's how you guys could help. Yeah. See how many overlaps there are to if there's overlap that's good because that means it's something more important more important. Yeah. Um Caroline um you have your hand up. Thank you. Thank you for involving us in this process. Um I have a couple really quick questions. One, um if I'm thinking about risk, sometimes I'm thinking about what hasn't been looked at in a while. Um, and I'm wondering if there's any audits that you have done that we should be
054aware of, like something that's not um on the work plan, either as a followup or or like a status update or a a current audit that has already been done that maybe we should know about. So we don't suggest that risk or maybe we do if it's a really big risk but um and then my other question is if you have any guidance on scope um like the example risk of declining student achievement is pretty broad like broader than say something like more focused on third grade reading. Um, so just in terms of your capacity if it would be better to look at things that are broader or more narrow. Well, thank you so much for that. I appreciate the question. It is definitely my intent to try to do narrower scoped audits. Um, the
055long audits are just it's just too much for the our audit size. We need to reduce the scope and be more focused and cover one specific thing and kind of move on. So as uh we can talk about that uh at a more detailed level based off the risk that is identified and maybe there is multiple elements within the risk and maybe we just pick one to as far to help reduce the scope so we can turn more on its um so we'll maybe perhaps only the biggest risk within that category. Um, and the other question is I actually do have a risk register of risks that we've talked about in the past and maybe not selected. So I can send that out as an email so you'll have a list of the ones that
056we've talked about in the past. Whether or not we've selected them, you'll have a complete list. Would that be helpful? Yes. Um, thank you, Jenn. In fact, maybe you and I together good an email that will be helpful. Okay. I appreciate the context around including the board goals for students when we're thinking about what risks to take a look at. Caroline um stated more eloquently than I will what trying to figure out a scope of um you know what the size and shape of something like this could be. Um, but keeping our goals for our students in mind, I wonder if there are I'm not sure if this is relevant in auditing, but I wonder if there are examples or case studies that we can look at from other districts who have done risk studies
057and made recommendations that have directly positively impacted things that would be included in the stated goals, board goals for students. Thank you for that question. Um, let me think about it and get back to you. Um, I'm not 100% aware of some exactly what you're talking about. However, most school districts do some sort of formal risk assessment. The last time PPS had a formal risk assessment was back in 2016. And so that risk assessment is posted on the PPS audit report page and it just identifies a lot of all all the risks that people can come up with. So that is an opport you guys want to check that out on PPS's audit report web page. It does give a very high level um identification of risks that were back in 2016. So, um, we
058definitely want to do base our audit plan, our future audit topics off of risks, but I haven't done a formal risk assessment um, like broad over the whole district. So, I hear what you're saying and there might be an opportunity for me to come up with something. So, let me think about that and I will get back to you. Frankly from an enterprise um risk level probably our largest risk right now it's real and immediate what the administration might do in terms of reductions of key federal funding streams I think it's bigger I think it's bigger than the zoda committee but for sure um I think we should be assessing that because as we head into the budget cycle we can't just head into the budget cycle as if nothing might happen because I think
059a lot of things could happen so I'm not suggesting is not a topic, but suggest conversation because I do think that larger risk for um us being able to move ahead. So that's that's one thing. The other thing I had a question about and I don't know the answer to this, but maybe Chief Morrison might as well. Does the Health and Welfare Trust, which the district sends um a huge contribution to every year, did they have a separate independent auditor that we'd have access to that? I think for the purposes of the PPS budget, we usually just see like here's the amount we send. They do have an annual uh financial report. It's on a calendar year basis. So they're under current review for fiscal or their fiscal year 24. We're expecting to see their
060report very soon. And is it just a financial audit? It is. I am not clear on that yet. I am a brand new member of the trust. So I look forward to learning more about it. So that would be my question best practice where we contribute a very substantial sum is it I don't off the top my head I'm happy to circle back um we they do provide um kind of an annual report for utilization by carrier um but that doesn't reconcile necessarily to the premiums that we are submitting to them and that we're submitting. So I do look forward to seeing that report as it comes out and um reconciling it to the actual costs. Can you circulate last year's any more discussion? Um, it looks like I'm going to be sending some things
061out to everybody about evaluating Janice and then Janice and I will Thomas. Yeah. Yes. Okay, that sounds good. So, we'll leave. Um so thank you everybody really great ideas discussion. Um the final agenda item for today's meeting is public comment. Okay so to wrap up the meeting I just want to remind them well I already said uh just remind everybody that we have two take home assignments stuff about code for the internal auditor's performance and also our audit topic ideas and we already talked about that June 17th date. It looks like all of us are available but we have to find out if other people and I think that's it. Thank you everyone. This meeting is