001Um, I'd like to call this meeting of the Cincinnati Public Schools audit committee to order. Thank you all for being here. It's my understanding that we have a couple of new faces in the room. So, we want to go around and uh uh do some introductions. Um, you want to do it on that side of the room? >> Sure. >> Okay. Eric King, director of IT applications at Cincinnat Schools. Okay. >> Jim Crower, board member. >> Holding, board member. >> Kendra Matt, board member. >> Seth Harmon, audi committee member. >> Ed wholehouse, audit committee member. >> Carol Mitchell Lawrence, audit committee member. >> Clarice Warner, audit committee chair. >> Kevin Hoffman, uh, audit committee vice chair. >> Also, audit committee member. >> John Young, audit committee member. Laura Dea, audit committee member. Shauna Murphy, superintendent.
002>> Michael Gustin, treasurer. >> Lauren Hercuss, chief audit executive. >> Emma Mueller, internal audit supervisor. >> Brennan Zustavy, internal audit specialist. >> Phyllis Davis, the board's administrative assistant. >> Wilson, technician. >> All right. Oh, >> we got one more. >> Oh, misleading. Sorry. [laughter] Brandon Craig, board president, just coming by to visit for a minute. [laughter] >> All right. All right. Well, thank you all um for introducing yourselves and being here today. So, um just want to make sure that uh we have a full agenda today. Um and so we can go ahead and get started. We will start with the um fiscal year 2026 audit committee goals evaluation. This year we have uh three main goals that we are focusing on. Um first goal is the risk assessment and budget impact. I won't read
003all that for y'all. I think y'all can read. Okay. Goal two is measuring value and goal three is financial guidance. Um hopefully you all had an opportunity to take a look at these prior to the meeting and um I'll open the floor for any uh reflection or any takeaways or any comments that anyone may have regarding our goals. No, this go quicker than I thought. [laughter] Y'all know me I breeze right there. Okay. Do we need to >> So I think according to our timeline today, we'll just complete the evaluation and then uh perhaps that will start getting the wheels turning as we look into fiscal 27 what the goals for the coming year may be as well. So there's space on the back um of the digital forms to you know if the audit
004committee would like to document something to kind of memorialize where where we concluded this year um we can certainly do so and share that with the full committee at the next at the next meeting. >> Okay. [clears throat] So do you want them just to take the time after this meeting to do that and then just send the information to me and we can >> that that would be great if that if that's works well for you all. I think that's perfect. >> Okay. >> All right. Everybody's okay with that? All righty. Next, we'll have the internal audit updates. >> All right. So, we'll start as we normally do with our audit committee dashboard. Much of the top has stayed the same. All of that you can click into if you need any other information
005or want to read more of our reports in detail. If you scroll down a bit, you'll see that we then have our external audit tracker. So the notable thing within the district external audit section is that our fiscal 25 audit is complete with a clean opinion. Mike will go more into that, but congratulations [applause] And then the others that you see are the routine grant audits and review that the district goes through. Um big thing to note is our fisc year 26 internal audit project for this year is done. So you'll see a lot of green. I think it took a lot of hard work to get here. Um very happy to close out this year. >> Yeah. I think we had um we have a a a baby, a marriage, two new team members.
006It's been a year, [laughter] >> had a lot of changes. Um so we'll scroll through the individual project details and we'll start with the status of past wreck changes. Um the most notable thing at near the bottom, Rob, sorry. Uh the most notable I think is that this year management had closed out 28 recommendations total. Um that's huge especially in a year where things are constantly changing. Um part of that is transportation since our last conversation in February closed out four. So they're totally fully complete. >> 2018 ones that we kept talking about. So, um, we talked with them LA in in February. Business Plus closed out one. AP Agile Auditing employee versus vendor closed out one. And then student data before I even got the recommendations in our tracker also closed out one. So,
007kudos to them. But awesome. Um, I think if we don't have any questions on status of past Rex, uh, in July, we're going to come with you with kind of a new way of potentially going forward with implementation implementation dates, risk acceptance forms, and then what do we do in environment where we have resource limitations. Um, we're planning on having those within our planning conversations with management. So more to come in the July meeting. But other than that, I can move on to the IT audit. So for this audit, we looked specifically at focus user access. Um this review really served as a follow-up to the student data audit that we've uh brought to you guys in February. So with that earlier work, we looked at the broader student data process across the district. We
008um through that work and then with some conversations with ITM there were some staffing changes happening with that team. So we decided to go ahead and look at focus um as an important system to look at more closely. As a reminder, focus is the district's student information system. It supports daily operations across the school. It also supports compliance and state reporting. that makes it an important system for both day-to-day work and for the accuracy of the data that is going into it. For this audit, we narrowed specifically on user access. So, we wanted to understand whether people are getting into the system through the right process, whether changes are being approved and documented according to the ITM procedures and process they have in place and whether access is removed when it should be. We also
009looked at whether elevated access, so system admin user access appeared appropriate. So that sounds very technical, but it's really a simple question. Um, are the right people getting the right access at the right time and is access removed when it's no longer needed? So looking at the project summary, you can see um we bucketed into these the system audit origin. The evaluation was overall that we found it a very effective process. We tested 50 samples um in detail and none of those had any issues. So we'll go further into that. You can see our audit objective on the next slide was just to test and document the user access process from beginning to end. The areas that we reviewed on that next slide we go further into how access begins. So how an employee gets
010a focus account in the first place and what is standard when that employee starts with the district and what comes with that initial setup. We look at then what happens when access changes over time. So did that employee change a role? Did they request uh further access depending on what their job description might need? Um we also spent time on the higher level access. So, system admin, reviewing that, making sure any of the privileged users made sense from an audit perspective. And then finally, we looked at how they're removed from um focus when someone leads leaves the district. Here we kind of on the next slide go through, sorry, Rob, the next slide, uh our scope and approach. So, we sat down with management um and walked through the process from beginning to end. That
011was Eric and his team. that gave us a better understanding of who's responsible for each of these steps, how the requests move through the system and where those important handoffs um like review happen. So we also reviewed focus user data and then the related HR records. So if someone is active in HR, they should be active in focus. If someone is inactive in in our HR system, they should be inactive in focus. From there, we defined our population that we were testing and we only looked at CPS employees. So, we did not look at student accounts. We did not look at um parent accounts or nonCPS employee accounts. From there, we looked at the supporting policies, procedures, and any other materials that Eric and his team created to understand how the district's formal expectation is
012set up for access management. We assessed the design of the process itself, meaning whether the way the process was set up reasonably should help control the risk on the back end. And then we actually tested employee records, which usually we come to you with just a TOD. We did both this time um to confirm whether the process was not only designed up front appropriately, but also working in practice as intended. So you can see from that next slide um the summary of our testing. We go into detail in our report um how this chart kind of flows together. Uh and then on the next slide you can see all of our attributes that we looked at for each uh bucket. So you can see out of the 45 we looked at specific for user provisioning
013and initial account setup we had an 100% passing rate. So this means that we were looking at how access starts. We tested whether accounts were being created for employees who were active in HR and whether the that initial setup matched that employees status. We also looked at what access employees received when they were first added to the system. What we found was that the starting point appears to be standard across Active throughout Active Directory. Um and then it's assigned as dashboard access only for a majority of job profiles, but if a specific job profile is set up, they have specific access set up for that job profile. Um this is important because it shows there's a structure at the front end of the process. So employees are starting with a standard level of access and
014additional access is not supposed to be layered without then the change management that they have going further. So that next slide goes through that. We also had a uh 100% passing rate here. So once an employee is in the system, their access may change over time as their job responsibilities change. So for example, when I was looking at the student data audit in February, I had to go through the change request form that they have and ultimately I was approved, but that gave myself I gave they gave me more access to do the things I needed to do for my job. So part of this review, we looked at whether those changes were going through the right process, not necessarily whether that job profile was set up correctly. We've had conversations with ITM and I
015think that would be the next step we do down the line when we kind of um get that process working the way it needs to. Uh finally, we looked at termination and deprovisioning. So this part of the review looked at what happens when someone leaves the district. We only selected a handful of people here. uh we just wanted to see whether their access was being removed and in the appropriate way. This is a combination between HR putting in a term date at the right amount or at the right time and then it flowing through active directory and ultimately flowing through and getting Yep. >> I'm just curious uh what percentage of the population the sample represents. So, out of the I think 10,000 line items that had students, CPS employees, CPS non-emp employees, and um
016parents, it was around 10,000. We narrowed that down from 5,000 and we tested 50. Uh so for the termination and deprovisioning we checked whether the termination was entered into business plus on the HR side and then whether that flowed through active directory which then should turn off the uh focus act focus access that that user has. Um this is a very important control area since access stays active after termination can create unnecessary risk and can also point to a breakdown between systems or departments within the process. Uh there's a lot of information here but to conclude overall this was a very positive result based on the work performed. I think we were able to do a really deep dive of the test of design and actually have some test of effectiveness results which is in
017the um oh sorry can you go no this is right never mind um [clears throat] which we normally don't do in one audit. Uh this matters because it gives the district assurance over one of the most basic and important control areas in a very high priority system. Um it also helps us think about what comes next. So we've talked with management about what that looks like and what that future work would be. Um we would look eventually at job profiles still matching current responsibilities, whether any old or unnecessary profiles still exist and whether there are potential additional risks tied to other account types within that system. So all in all, does anyone have any questions? [laughter] >> I'd won out of curiosity and yeah, honestly great results. Most of these I've done in my career.
018Getting 100% right on them is just it's not seen. But I was curious on the rationale of testing a smaller population for change control and termination. Generally, you see that being kind of the more higher risk areas, I would think in my experience just just out of curiosity. >> Yeah. So when we were pulling our original population, we weren't exactly sure how we were going to test it. And when we narrowed it down from the initial 5,000ish samples we could have tested from, only 22 had an additional request. So we kind of I think tested a little bit backwards than forwards. But yes, you're right. we should normally you would test a sample out of each population. >> Couple thoughts. So one, uh I I'd echo what Seth said that this is pretty remarkable results
019from an audit test, especially talking about it access, it's surprising to me. I think for the first time that you would test this area that you would end up with 100%. So that's credit to to your team and to management for a well-ontrolled process. That's really incredible. >> Um but then just I I read management response and I think there's some interesting things in here. I'm wondering if you can talk a little bit about um you know maybe the concept of the risk profile for those nonCPS employee accounts like the other population that's out there that might be a potential future target. Um why that may or may not be as risky as the area that you targeted this time. >> Well, I think one of the main reasons why we looked at CPS accounts
020is because it'd be more of a straightforward audit and with the time that we had, we kind of had to condense it with what we could do. But that is something that I think between conversations with Eric and his team is they would like us to go and do that. So I don't know if that's when we talk with planning if that's a next step and we audit Eric's team again if he would like that. But definitely on the table um for future audits >> for the dis Oh sorry Jim [clears throat] >> I love your question the are you able to the risk of the other population. >> Um, I mean, off the top of my head, without doing like a detailed conversation with Eric and his team would just be, do those accounts
021still need access? And was there any cleanup, you know, after if a user hasn't logged into their account after a certain amount of days, are they being cleaned up? the access levels. >> Yes, but that would be based on however their job profiles are set up in the focus access database. So >> Eric can answer it. [laughter] >> By the way, this is why this is why the audit committee is so much better now because uh we got such great new members. >> So the three groups that we didn't test, noncps, parents, and students. Um the the parents I'll start with the parents and students. Those are both very lowrisk profiles. Students only have access to their own information. Certainly worth doing an audit on to verify that further and do some testing. Um, but
022it's pretty low low risk because they can only see their own information. Um, parents can only see students information of which they have access to. They would need some key information in order to gain access. Um and then once they have access they maintain that for as long as a student has an account at CPS which actually goes beyond um so if a student does leave the district and goes to another school often they still have a focus account because they get services back from CPS. So it's a it's harder to audit because and they should have accounts with us a really long time but they're very low risk because of what information they can actually see. The biggest risk is the one we were just talking about which is the nonCPS accounts. um those
023vary greatly based on what we hire outside people to do. Um we mitigate that risk because by every year those accounts have to be renewed by the supervisor which means they have to submit a new request that has to get approved. Um otherwise those accounts are terminated. Still all things that an audit should go through and validate and verify. Uh, but it is a proven process that we built on top of when we put brought focus in to help ensure consistency and they've audited some of those processes previously. So, we just built on top of them. But again, we should audit all of those things because that ensures that we're doing what we think we are and we're following our processes. >> Thank you, Eric. >> So, for those accounts when they're disabled, you took
024a smaller sample. Is that an automated process? as you disable them in HR, it automatically flows through and disables focus. Is that >> Yes. And they actually get double disabled. Um, so what HR goes in and puts an end date on that account. Um, that end date becomes the termination date of not only their focus account, but it's also their active directory account. And you can't log into focus without an active active directory account. And so we're or Entra as it's more commonly known in Microsoft. Um, and so we're basically double disabling those when they come through. And it is completely automated. >> So then you over test it, which is awesome. [laughter] Still found nothing. Like I I echo I I've never seen 100% test. I've done testing for 20 years. So >> So
025that was my question about um the provisioning how how security is provisioned. Um so you answered that question. Uh my next question is what is our turn rate like what is our turn percentage for terminated colleagues? So we're I know we we moni we reviewed audited 22 people but of those like I'm wondering how many terminated colleagues that we have because I think that's where our bigger risk is is making sure that the access no longer exists for our terminated colleagues. >> Yeah. So that's something that we could audit further. Um from the 50 that we selected, we there were only five within that population. So I think if we did something specific to termination and we wanted to look at the entire population there, that's um >> a potential next audit area as well.
026>> Okay. Do does anyone know what our turn rate is? >> Okay. All right. But I think to circle back to what Kevin was saying is since it's an automated IT control, typically a sample a low sample is representative that the IT control is functional. So I think if we wanted to dive deeper into the population of terminations, maybe in a different way, testing something that's not automated would be um a better use of a larger sample size. Mhm. >> And when you put that along with you're not just ending focus access, you're ending your access to the to the network as a whole. And if you can't get on to focus without the network, then I mean that's that I I would not test anymore. >> I think you you don't have enough people
027to test other things to test more in that area and I would focus on your higher risk stuff. I think you did a great job. >> Yeah. And I think that goes to the higher risk side of this with uh Eric's conversation and what Emma discussed with him around the job profiles. That's where that becomes a very very complex um conversation. I think you see that noted in the report and Eric's response as well. So um I we're just trying to peel back the layers of the onion as we go through these projects. I I just the other question I would have and again I'm only going to be here for like two more minutes but uh but I wanted to maybe ask the question around I think maybe another step in looking at is
028the purposes of those changes. So when we change access to someone are we using the right processes to evaluate whether or not those changes required the necessary access that they were given. Uh because I think what you described earlier is just whether or not when a request was made and approved, did they get the access they were supposed to get based on that approval? But I think maybe even the next charge is is whether or not the access that they were requesting maps to the work that was necessary to be done. And I and I don't know that that is or isn't done in that process. But I think if there was anything I would be looking at is that aspect of it as well. >> How it's set up right now. We didn't deep
029dive the audit and Eric can talk about it more, but they do have to put the reasoning on the form that they're submitting and their supervisor has to submit it and then they also have to have a sign off and approver on it. So there I would say at least the product the process as it stands mitigates a lot of that issue. But to look at every single one of the changes would be I think a huge undertaking. >> Yeah, as Emma said, a the person's supervisor has to submit it. So that helps ensure that like what they're asking for is legit for a job. Um and then my team, you know, smaller pieces of information, let's say it's a um hypothetically a student's address that and they can't see addresses for some reason. Um
030my team can make that kind of like low-level decision that okay, yeah, that does seem appropriate for what they're doing. um if it goes beyond maybe it's I don't know te test scores or IEPs or something like that they they'll refer it to me and then if it's if I'm not comfortable with it then I send it to the process owner who owns that information and so um if it's you know discipline I'm going to send it to Manisha House who owns PBIS if it's um I don't know I'm trying to there's a few things that we send to um Dr. Smith for approval. And so we do have that documented out on who we send these things to in order to get the right approval to make sure that it's not just random requests
031that are just blindly being filled. >> Any other questions over the IT focus user access audit? All right. So we will go into our next audit for agile auditing. This was specific to overtime. Um, we've talked about overtime quite a bit in this area or at audit committee. You, uh, know at this point our previous audit findings. Not necessarily that overtime is an issue, just there was no process of looking and approving overtime. Uh, we had our initial fisc year 22 recommendation. We went in again, had an additional recommendation in 2023. uh from conversations with management, they were originally planning on doing a district-wide overtime approval process. Unfortunately, because of how complex some of our CBAs are, it just doesn't work for every single area in every union and department. So, we had to figure
032out next steps to mitigate this risk and get the recommendation closed out. So, what we ended up doing um for testing on that next slide, it details out kind of what we went in and decided to look at. Uh we had conversations with and I want to say this was our in a lot of our intern Max. He's not here today. So, kudos to him for all this work. The CBAs are not easy to read. Uh he read every single one, pulled out all of the guidance and then went through with this testing. Um, we bucketed facilities and student dining because those are the two largest overtime spend departments. We also then looked and talked with the treasur's office because they had implemented in their department the business plus uh overtime request form. So with
033those conversations, we talked with facilities, what was their process, how do they track overtime, how do they approve overtime? We did the same thing with student dining and we also uh went through and had the same conversations with the treasur's office. We created um test of design walkthrough templates for each one because there are differences and nuances through each of these departments. And then we also did a test of one to see how for one sample if that design was set up properly. For facilities, you'll notice we did a test of two because they also have long-term approved overtime, which goes through a different process. I think the most notable um things that we've seen within overtime is that these departments have very well thought out, documented processes and procedures that they follow. and we
034didn't have any concerns about how overtime was being approved submitted within these departments. Uh you can go through and kind of see the differences between what the CBAs are asking for, what facilities does, what student dining does, treasur's office, but the key the key takeaways are that each department can be comfortable doing what they're currently doing. uh accountability needs to be put on each department if they choose to stay with their own process because at the end of the day we only looked at these three. So, um, if schools are doing something something differently or smaller departments are doing something differently, do they have a well documented process for submitting and approving overtime? And if not, are they able to take what Mike and his team created and use that or do they need to
035come up with something that we can eventually go in and audit? Um, I don't know if Mike wants to talk anymore about overtime. I know he's a little tired of it, but nice to have him here. This is our favorite subject, right? >> I know. >> No, I think >> appreciate internal audits. Um, work through this. I know this has been a long-term project. >> Um, you know, as a as a tech guy, when I started this project, you know, we thought we could come up with really easy tech solution, didn't quite work. Just the employee groups are so different and and we really found that that people make their own processes and as long as those processes work, I don't know that I know that we need to add extra steps. I mean, you
036know, you have everyone from from traditional kind of more office folks who could easily fill out a computer form to, you know, custodians, building engineers, trades folks, you know, and so and so they all had processes working inside their groups. Um so, so I didn't want to really jump on top of that. I think we did add a lot more um visibility. you know, every member of leadership team every payroll period gets an email with all of the folks in their area who've worked overtime and so they have the ability to review it. Um we cranked up the reviews at um our quarterly budget review. So our accountants do a quarterly budget review at least quarterly with every school or department. And so that's one of the key items we look at is what's your
037overtime budget look like? You know, and if it's over, why is it over? And so yeah, we pushed through those things. So, so we felt pretty good from there and I think I think internal audit helped us kind of think how can we close this and so this isn't a neverending um project. >> Yeah. And so you'll kind of see this updated approach um in July and going forward with our status of past recommendations. We're going to meet with management and have some of these conversations. What is stopping the original audit recommendation from being closed? Is it something like we can't come up with a district-wide process because of all of these nuances within the district? Are there a lot of staffing changes in that area? And so if we can't close it out with
038our original recommendation, how can we mitigate the risk? Um, more to come on that, but I think uh that's it for overtime. If if anyone has any questions there, Yeah, just a quick question or comment. I think the overtime piece, it would be interesting to know overall how much money we do spend in the total budget in this district for overtime. But the real interest for overtime has to be uh if you found that where it is overused or what have you, it should be impacting your staffing. Um if I mean if you have to use a lot of overtime, maybe we're understaffed in that particular area. And I think that would be of interest uh to folks. And also something is remembering from previous times too. One of the other issues is that favorites
039get it. Uh and so the distribution of it across the scale would be important. So those would be two things I' I'd be interested in, but it doesn't wouldn't necessarily be part of the audit piece. >> Well, we did um have conversations [clears throat] with those departments over how they select individuals for overtime. So they do have a tracking mechanism for that if it was asked and offered and if they decline so then they go to the next person. Um and for overtime spend we did an analysis and from 2022 it has trended downwards. We don't have all of 20 this most recent fiscal year but it seemed like it would also be having that downwards trend. I think that chart that you have in any audit report is pretty impressive on the downward >>
040trend. [laughter] We like that. >> Yeah, there's an interesting interplay between in certain departments between vacancies and overtime and so and so as your number of vacancies goes down, imagine that your overtime goes down as well. >> Yeah. >> And I think that was one of the things that we wanted to ensure we were clear about. I think our takeaway unfortunately after our first audit was overtime was bad. And that wasn't at all our take. It was that overtime should be intentional and it should be controlled and should be reviewed and should be purposeful. And I think we've seen a tremendous amount of growth in that area. I'll give a quick example. We during our first audit saw some days that said there were 23-hour days being paid and worked. We said, "Oh my gosh,
041that seems, you know, what what in the world could be going on?" And what we've learned through this most recent uh rendition of the audit is it's the way that our hours are tracked in our system to say those are the hours paid. So if someone let's say on an inclement weather day gets paid a full day regardless of coming to work then they come to work for that full eight hours. So now you're at 16 and some of that's paid at time and a half. All of a sudden this looks like a wildly you know unrealistic day but it's really the way the data was looking. So, I think we've done a really great job in partnership with management to put some realistic terms to what's occurring. And our biggest thing is, do we
042know what we're doing and is it controlled? Especially, as Mike will go into and Superintendent Murphy will go into in the conversation around fiscal 27 budget, we're facing very significant reductions this year and so we will not unfortunately have wiggle room for overages like these in in the future. >> Seth, did you have a question? I saw you kind of go to your >> that it was mostly just what do you attribute to the huge decline, but it sounds like combination of a lot of things. >> I'll make one other point that um and I feel like how you frame that up as far as working creatively with management to address the aged um recommendation. That's a conversation that we've had in this room a few times recently. And so I think seeing um a
043great example of how maybe the addition or the original recommendation um was a peanut butter spread that didn't really work for all departments and so we kind of went back to the drawing board of what do we really mean by this and and is there another solution? Um that's really impressive and I I hope that we can use that same mindset going forward to some tackle some of the other aged recommendations out there because I think it's a really productive way without making these you know keeping things out there for eight years. That's not productive. >> That is the plan. [laughter] Uh, any other questions? >> All right. Well, that wraps up all of my talking for today. So, I'll move on to Lauren for the summary of work. >> Sorry. >> All right. Very
044good. Rob, I'll have you move forward to the summary of work slide if you would. Thank you. So, as a reminder, each year we produce a summary of work uh document that essentially summarizes all of our projects that don't conclude in a formal audit report. So, we'll take a few minutes just to briefly touch on the key takeaways of these projects, but I invite you, if you haven't yet, uh to review the descriptions in the report as they are much more detailed. I think the key takeaway is where are you spending this time? Why does it matter? And should we continue doing work like this? And I think it's yes to all of those things. I think this is very valuable um to the organization as well as to our team. So the first project
045you'll see is the district strategic support. This is the partnership essentially between internal audit and the management teams. And I'm looking at Miss Bolton because it's independent and objective. That is on the forefront of our mind as we partner. uh but I truly believe it is a mutually beneficial uh partnership and that this past year I've attended uh management's meeting the superintendent's meeting on a weekly basis and have been able to stay a breast of the key portions of our strategy challenges etc and then uh I've been kindly invited to offer the internal audits take on it you know as someone who's not in this what do you say what do you see about you know potential risk or some other considerations we may have come across through past audits so to us that's been
046tremendously valuable. I think it helps us to be a more integrated partner in our organization. Uh the next project you'll see is the auditor of state. So as we we just uh clapped for earlier, we had a successful unmodified opinion, which means clean audit for fiscal 25 audit. But this project was really focused on the fact that for the first time in the last 10 years, we had the auditor of state auditors perform the audit themselves rather than a third-party independent uh audit group. What that meant for us was I believed that there would be a lot greater focus on compliance issues uh where our other audits in my opinion are a little more financial audit in nature. So what we did is we took and you can see in the report a few areas
047and did some preliminary testing. So I downloaded the compliance supplement that they would be using and kind of did the practice run of things that we thought could be critical areas. Um, I think it was a great learning process for us, but I think the key takeaway is that we felt we were well prepared and ultimately I think the work of management and honestly every person in this district who follows process procedure and upholds high accounting um, and financial standards was a part of that. And then finally the human resources project was something that Emma focused on. Um, specifically the portion we'll speak about today related to the uh, lure process. So this has been a key topic for many areas essentially to say are those who are employed in our district and are being
048paid and working with our our students and families are they properly licensed by the state of Ohio. So it's a rather complex area. However, we wanted to lend a hand from an advisory standpoint. Um so in partnership with uh treasure Gustin and our human resources teams have uh provided kind of point in time feedback to management as they've resolved and continued to fine-tune this process. So I think this is a more to come. We have a new HR director who's kind of getting into the the depths here in this um and we'll continue to offer our support ad hoc as needed as they move forward. the other side. So we have talked about this internal audit manual because as the auditors if we say where's your process and we ourselves do not have them that
049doesn't set a very good standard. Uh so we've made tremendous progress this year not only in uh documenting our key procedures but also to say what is this overarching roadmap to becoming compliant with IIA so the institute of internal auditors standards to us that would be that would be like the the the greatest accomplishment starting from a team of one 10 years ago to eventually passing a peer review would be like the most incredible thing. So, um, that's really what this project did is what's our map? What's our way forward? And I will say this project does fall by the wayside each year a bit when more pressing things arise. Um, but I think with this roadmap and a timeline now, there is a greater sense of accountability and urgency to ensure we're making progress
050each year. Um, so the other side of this, of course, as you all warned me, um, and in, uh, the most positive way possible, was that hiring is going to take a while and onboarding takes a while. So half of this project um was about offboarding two of our team members and onboarding two new team members. I will say those efforts efforts were very successful and we are so thrilled to have uh Brennan on our team and as well as Max who is um moving out of his dorm as we speak. [laughter] Um so that was half. The other half was professional development. We uh Emma served on the ALGA the association of local government auditors conference planning committee. I continued my involvement with the Institute of Internal Auditors local chapter. We went out and
051spoke to students um at Western High trying to incentivize them to become auditors. We don't Time will tell how successful I was, but we did our best to try to get out in the community a little bit in different ways, although most of our work tends to be behind the computer. So, that's our summary of work for the year. I'd be happy to pause um and answer any questions anyone may have. Fantastic. All right, we'll keep on chugging along. So, just a couple quick slides here. Um, moving forward, the fiscal 2026 internal audit plan and review. I think this is just an interesting opportunity to take a pause before you'll see in my next slide, we jump right into fiscal 27. But truly to appreciate the work that went into this year's audit plan. Uh,
052so we were successful in completing all nine audit projects. And it's interesting with our smart sheets data, we can pull the number of individual tasks. So that was nearly 1100 tasks that we completed as a team uh to accomplish all of those projects. So this is the next slide is a little bit um data heavy, but I just think it's interesting to see what we thought we would start at in terms of audit resources, the 4,400 hours. Then we came to you all and adjusted that after uh one of our team members left in December. And then ultimately we're able to adjust that back up to the 3,900 uh audit hours. Ultimately, we did exceed that a little, maybe putting in a few hours beyond uh the the standard work days, but I I think
053this is a helpful as we plan ahead for this coming year. Um you'll also see in appendix one, I believe I named it at the very end, a breakdown of all of the time that was spent on a percentage basis between audit projects um compared to non- audit projects. we were at about 71% of our time on the projects within the audit plan which I felt was pretty solid. Another big portion is about 500 hours a year on audit committee work prep past recommendations tracking. So I think that just helps put into context where the time went this year. And then further this final slide I think is um kind of shows the the movements that we've had but also a tribute to those who have uh played a part in helping us reach this
054end goal. So with six individuals that worked with us this year, we almost got to three full team members at 2.65. We did our best to fill it up uh and come back to a complete team. So as we look ahead, um I want to shift the conversation just briefly to fiscal 27. So we waste no time. You'll see on this next slide, April 30th is day one of fiscal 27 planning. If I'm being honest, Brendan has already spent a good deal of his time helping us prepare for that. So, as we look ahead, we are facing yet again a pretty challenging scenario as it relates to the district as a whole, the finances, and then specifically audits and risk assessment. So, of course, I'll just start by saying a risk assessment is only as
055good as the information available and known to those performing it. So that is really the key this year as we say what information will we know when and how do we still move forward with the ultimate goal of bringing to you all at the July 22nd audit committee meeting our fiscal 27 plan. So what you'll see we've kind of bucketed our thoughts here. So it's kind of this pre July 22nd and post. So what we plan to do is as we prepare for this audit plan is perform our risk assessment following our annual process and procedure where we analyze the data available do our risk rankings our risk maps like we did with you all last year but then taking it a step further each year we want to improve on that we'll build it
056out further so on and so forth the limitation to that though is the timing of our fiscal 27 budget so you'll see on the next slide essentially we would need data by June 10th to incorporate it into our risk workpapers for the July meeting if that makes sense. So how do we do both? How do we create a plan that's reflective of what we know now and how do we adapt and also assess the risk that will inevitably derive from the budget decisions. So if we go back to the last slide, you'll see we kind of drove drew a line in the sand. We will move forward. We will incorporate as much information as humanly possible to bring you all a plan at the July 22nd meeting. And when we did this when we started
057this conversation with our audit committee chairs, Kevin made a great point around well, what do I do if we get more information later? And he says, well then it becomes that next project. So you'll see in the orange box there that becomes the next level of work. So once the fiscal 27 budget is approved then we will have information we can further analyze dig into and um potentially I think the key deliverable there is the analysis itself and then potential projects we could perform that come from that work. The caveat that to that though as you'll see in the second bullet point in the purple is the board in this uh leadership has asked for internal audits insights as they go through what is a very challenging time in decision-m. So we would uh want
058to be ready and able to provide real-time feedback as much as we possibly can as they go through um their analysis and their big decisions ahead. So it just it could very easily become one big we don't know it all yet. And so we're trying to break it into buckets of analyzing what we do know, coming up with the best plan possible at that time and then leaving space to further dig deeper and then figure out what the best next thing is from there. So the next slide again is just kind of procedural in nature. But where I wanted to call out for this group and of course with our audit fe or our finance members in the room is rather than in the past we've sent out surveys and said what are your feelings
059on risk or you know these categories. I think this year is just so unique that we need to sit down and have some conversations to really understand uh your all's perspectives our board's perspective and our senior leadership's perspective. um it feels a bit insensitive to send out a survey to our directors and so on who really quite frankly don't none of us know what the outcomes will be yet. Um so that probably goes in our bucket for the fiscal 27 work once it's decided. Um so we have dates on there to share with you. Um we would so much appreciate your time in meeting with us uh in mid mid to the end of May. Um we could do it one-on-one or you know do small groups if that would be agreeable to the committee.
060Uh but we'd very much appreciate your insights as we go um and begin our planning for the year. And again for our board members, we're trying to layer folks in. You kind of see our schedule there. Um so that [clears throat] would be potential next steps if that's agreeable to the committee. And that concludes um kind of the look ahead. Really welcome your feedback. Unfortunately, we will not all be together before the July 22nd meeting. So, we really wanted to take the time to make sure our line of thinking was logical, kind of uh incorporate any additional thoughts we might be missing. Um, so when we get together in July, we are all on the same page. I think that's the best you can do. I mean, would you do it a different way if
061you could? I'm sure. But you can't. So you plan to the best of your ability and you move forward and adjust as needed. >> So what you plan and we may think the whole year looks like may not be the whole year come July 22nd. >> You know as you hit you know September 1st there we may no more. you have to change it and the next meeting there's a discussion about that and I think that's how you do and you you talk about the agile auditing you've done and things like agile is the whole framework is built on you constantly improve um and I think since I've been here I've seen that in the department as a whole so I don't think there's any reason not to continue to do that with this >>
062[clears throat] >> I think the idea of having conversations is fantastic. Uh really good method for where we are, where the district is right now, especially in terms of uh the budget we're having to put together. I also think that when you have those conversations, maybe you could even have them beyond one year. >> Look out maybe a a couple of years to So, for whatever that's worth, >> I think that's a great point, too. We'll have a speaker here soon uh from Bellweather who is leading our strategic planning. So, I think we're all trying to think what do we need to do today, tomorrow, but then also for the years to come. So, that's great feedback. >> Yeah. So, I was just going to say thank you for uh the consideration to really partner
063with us as we're looking into fiscal year 27 um and helping to provide that like ad hoc um perspective and feedback. I think that would really be helpful for us. Um in addition to I echo my colleague sentiments about um the conversations, right? Um that provides that level of personal connection and understanding so things aren't lost in translation. And I also think it could be helpful uh with bellweather support if there is that like scenariobased right um opportunity that we're able to think through different aspects uh as we're working through this upcoming year. >> Thank you. >> When is the budget anticipated to be completed? >> I mean I know that's a moving target. I know it's been [laughter] but just like >> you did >> how quickly I want to be a partner in
064that [laughter] No, really meme. >> Yes, she did. [laughter] >> Visibly flinched. Um the the re the hard deadline is end of June. So I think our last board meeting is June 22nd. So so that that would be the official date. Um hopeful I think that we we wrap things up a little sooner than that um and and can give give people some guidance on the way things are going, but end of June is the hard deadline. >> Okay. >> Thanks. >> I would I would add to that that it's it's hopeful that it'll be earlier, but I think it has to be earlier because the board has to face uh the decision about a levy and nobody's going to do that before the budget is over. And even with that, the board is still,
065I won't say divided, but has differing opinions about the levy, a levy, timing, type, what have you. But um so it'd be great if we can try to aim towards instead the end of May at the at the at the latest for a budget, but that depends on the recommendations that the administration brings whether or not they're ones we can agree with or send people back to do something else if that's possible. But it's there's it's slim pickings regardless uh of of what um can be done. All righty. Um so next we'll move on to the financial and strategic updates. >> Cool. This is my section. Rob, do we have Kenny on? >> Okay. Thank you. Thank you. So, um I know one of the one of the things that that was expressed from the
066audit committee was how they can engage with strategic plan work that's currently happening. Uh we are fortunate today to have Kenny Wang from Bellweather um joining us remotely, but Kenny's been one of the key consultants um with the Bellweather team. I've met with him quite a bit weekly at this point. Kenny and I have weekly meetings now, but um really good conversation, but he was going to once he gets in do a quick presentation for for you about kind of where the strategic plan process is and then very specifically um how the audit committee can engage with them. So, >> welcome Kenny. >> Hi, good evening. Can you guys hear me? All right. Yes. >> Okay, great. Um, I do have a few slides prepared. I didn't know if I should share via my screen
067or if there's a preferred process. I apologize for not being able to join you there in person. Um, but just let me know what works best for for the group. >> Kenny, you can go and share them on your screen, but we'll need you to email them to us for our records if you don't mind. >> Sure, we'll do. I can do that. I'll do that. Um, I'll do that sort of once we get off, but >> never mind. I understand they are already on board, doc, so we are good to go. >> Oh, great. >> All right. >> Good job, Laura. [laughter] >> Oh, okay. >> All right. Can you all see my screen? >> Yes. >> All right. Great. Um, well, my name is Kenny Wang. I'm a senior consultant with Belleather. We're
068a national nonprofit that partners with education systems to support strategic planning and implementation. Um, we're really honored to be partnering with, uh, Cincinnati public schools on the strategic planning project. Um, tonight is really just an introduction to the strategic planning effort and how we're approaching it. Um, I'll walk through where we are today, uh, what we're focused on and how the work will evolve from here. Um, as we move forward, we'll want to make sure that we're incorporating this group's perspective as well. Um, just given your lens on financial stewardship and risk. And so with that, I will start with just a quick overview of what this work is designed to do. All right. Um so just at a really high level the work is grounded in a small set of core questions um about
069what's working well today sort of within Cincinnati public schools and where there may be gaps how students and stakeholders are experiencing the system and ultimately how the district um should prioritize moving forward and um sort of underlining all this is how resource are aligned to those priorities and how progress will be measured over time. And so these questions will ultimately translate into a set of concrete deliverables um which you will see here. So the outputs of the work will include the strategic plan itself um a set of financial scenarios to help inform decision- making um and then a 12 to 18month implementation plan and a performance management approach. And so the intent here is not just to set direction, but to ensure that the plan is actionable and grounded in the district's operating context. So
070from there, let me just kind of show you where we are in the process today. First, I'll just sort of note that we are relatively early in the process still. So we're currently in phase one where we're really focused on building a clear understanding of the district's current state, including strengths, opportunities, and risks. Um and so that includes um a lot of stakeholder engagement um a review of uh district data and materials and then we're beginning to sort of do some early synthesis of themes across all of these sources. Um and we're really doing our best to engage a broad cross broad cross broad cross broad cross broad cross broad cross broad cross broad cross-section of stakeholders so far. Miss Havos, Miss Mr. Gustin have been kind enough to share um a lot of their
071time with me so far and that work is ongoing. Um, a key part of this phase is bringing together all of these different perspectives to build a shared view of where things stand today. And as part of that, we're also being intentional about grounding the work in the D in the district's financial context. So, I'll just talk a little bit about that. A core part of this work is ensuring the the strategy is financially viable. And so, as as Mr. Gustin alluded to, we are spending a lot of time together uh including earlier this this um this afternoon, but just trying to understand the district's current financial position and cost structure um and to begin to connect what we're hearing in the field from all of our stakeholder engagement um to the financial real realities
072that the district is navigating at this time. And so this helps to ensure that the plan ultimately reflects both the district's priorities and um its constraints. And so this work as I said is happening alongside just a broad set of engagement efforts which I will touch on next. Um so we are making progress um in terms of engaging stakeholders across the community. Um in terms of community engagement really want to give a shout out to our partners um on that work Rice Education Consulting. Um they are doing a lot of listening sessions. They're serveing the community. They're being present at community events. visiting schools, doing focus groups with student, staff, and um elected official community members. Um in parallel, uh we at Bellweather have been conducting interviews. Thank you. I saw um several members of
073the board of education. Thank you so much for for offering your time so far. As I alluded to, um you know, have done interviews with Mr. Augustine and Miss Havos and many others. We're also in the process of standing up a broader advis uh community advisory committee um just to bring in cross- sector perspectives. And so all of this input is being organized um and assessed through this uh framework um that we are using. Um before doing that just want to name that we also have a um really strong steering committee um that superintendent Murphy has helped us convene that will sort of be um one of the the spine of of this work here. Um and so we this is a framework that we've been um using with schools and districts around the country.
074It's a structured framework to assess um the district across key areas like academics, student experience, talent, operations, governance, and finance. And we use this to help ensure that we're taking a really comprehensive and consistent approach as we build out um sort of our review of the current state. Um and from that work we are beginning to see some really early patterns. Again sort of just going back to this first slide I want to reiterate that we recognize that we are just still like you know in the in the beginning part of or rather the middle of this phase one. So, um I do have a few early themes to share, but would just sort of again reiterate that these are early. Um but across our early conversation review, just a few themes are emerging. Really
075a strong appreciation for the range of programming and partnerships across the district that has come up consistently. Um there's also just uh you know, some people have pointed to a need for greater consistency in the student experience across the schools. Um, and lastly, I think that that top of mind for everyone is really just an awareness of financial pressures along with an interest in transparency around how decisions and trade-offs are are being made. And so again, these are still preliminary and will continue to be tested and refined as we gather additional input and look at the data and sort of have more conversations. I'll close just with with what's coming next. Um over the next few weeks we're going to continue doing our stakeholder engagement again with our partners at Bryce Education. Um next week
076actually a team of us will be doing site visits at seven schools um in the district where we're all really excited about and then um just really overall continuing to deepen our understanding of the district's current status. Um, as this work progresses, I think we'll want to stay closely connected with Miss Havocose and coordinate an opportunity to engage with this group, particularly as we continue um, building out our understanding of the current state and begin to think about implications for resource alignment responsibility. Both U Mr. Gustin and M. Havco sort of um were clear that that you all really wanted to have just an update on what's happening so far, but I think also we want to make sure that we are leveraging um your expertise and would would love an opportunity to um to
077come and sort of speak with you to to get your perspectives. Um so thank you again for the time. I'm happy to pause there and and take any questions that folks may have. I I do have one question. Maybe this is for management, but that this seems like a um a relatively robust undertaking. I'm curious of the timing of all of this knowing that you're going through a a budget cycle right now that has a an impending deadline. Um, do we have the ability to devote the time to this to get the most out of it while having competing priorities? >> Um, this is a this is an ambitious task. I will say that. I will also say that there are no quiet times at Cincinnat Schools. I can't I cannot think of a time
078where there's not lots of things going on, but but we realize how important this is. you know, we we thank our our partners for funding this. Um, really and and I think, you know, not to speak to the superintendent, but I know she is she's definitely dedicate herself and her team and I've dedicated myself and my team's time to make this a priority even with other computing priorities. >> I I definitely agree. is our priority right now. And it actually does work hand in hand with this budget season because it allows us to think futuristic what do we want to be able to provide for our children and helps us to drive making adjustments now that um may be needed. So a little bit of foreshadowing is really helpful. I've seen some of these preliminary
079bullets that uh Kenny has shared and so it just really reinforces what we know we need to do to move the district forward. So, while a little bit complicated, we're excited to be able to be involved in the task. >> And I honestly I think sometimes it's helpful. I mean I mean going through the budget process I would say is a bit of a drain. Um so so it's nice to to have a different set of conversation with this team to look in the future to give that future-looking looking looking kind of lens. The other cool part for me is that we do have the support of business community and partners who are in definitely demonstrated an investment in this work and so that's a driver too. I just wanted a couple years a lot
080of engaging Did you hear any Did you hear Did you hear any of that, Kenny? Did you get >> I'm sorry. Was it I I did not hear that. I apologize. >> Sorry, I forgot to turn on I forgot to turn on my microphone. I will say this again. A couple years ago, we had a consultant in who was helping us with our audit strategy. And the consultant's view was this is the best, most robust audit committee in Ohio. And we have a lot of great great engagement and brain power from our community members here in this committee. And you mentioned you might reach out to them. Please take advantage of it as as you can. This is a really great group. We're very very lucky to have this kind of engagement in an urban
081district like like ours. So, >> no, I appreciate that. And as I said, both um Mr. Gustin and Miss Havos sort of made the same point to me and we are taking that seriously and and not to put something else on Miss Havos's plate, but I'm going to ask her to help me coordinate that so that we can um as as folks are available and and want to that we are able to engage with you all to get your perspectives. Any other questions or comments for for Kenny? >> All right. Well, thank you for coming joining us tonight. Um >> All right. >> We'll we'll talk again in a [laughter] couple days. >> All right. Thank you all for the time. Have a good evening. >> Thanks. You too. Okay. Well, is there uh any
082other business to come before the committee this evening? Um, financial update. [laughter] Okay. Um, sure. I don't know Lauren's over here like financial update. Financial. Sure. Sure. Um, >> so, so yeah, I mean I mean we've talked about the audit, so you know, always a good thing to say. You know, we >> finished our financial audit, unmodified opinion, all all very good. Um, good stuff. Great work. You know, I know Mr. Ashley's not here today, but he he helps coordinate it. Um, kind of a cool thing. For the first time, we had they really dug into our IT stuff. Um, Adam Gapner from our team and Mr. King who's here worked on that. Um, that was that was kind of a new different thing. Um, but but really a good a good group. Um, financially
083high level because I I know we want to get to know there's an executive session after this. um basically on track of where we expected. You know, slight variations as you can imagine. Uh really most of our our work here is just finishing out um this fiscal year. You know, there's still still some big things to come. You know, this is the end of the year, so we're kind of at the end of the spending season. Still have significant revenue to book in, but really have moved our focus um towards towards a budget for next year. I think it's where everyone's focus is and brain is and we spend a lot of lot of brain power on that. Um board has board has helped us out a lot by approving um we'll call legal requirements
084and approving school school-based staffing. Um, and so, you know, I think I think just from the presentations you've probably seen, there's about $150 million, you know, left to budget. And so, that will be that will be obviously more difficult, but um, but, you know, it's that's part of the process. We do it every year. Uh, we are not alone. I know I just returned from our annual kind of school treasurer conference, which was which they were a depressing bunch this year. I think most most school districts are going through the same sort of thing that we are. You know, Cleveland Cleveland announced shuttering 20ome schools um laying off 400 plus employees. Columbus has a similar gap to us to close. Toledo going through it. Um Brendan Akran was was was having a moment there with
085their budget. So So everyone's going through it. really this is the realization of what two things of two things property tax reform has hit um and hit the schools are this year and folks that were that were used to seeing revenue increases are not seeing them um and so that's kind of dampened down people's outlook going forward at the same time uh not updating the fair school funding formula has has really leveled people off um you're seeing a lot of school districts including us starting and next year starting to go in what's called the guarantee, which means that your actual state funding is now dipped down to the same level you would have gotten in 2020. Um, obviously, if you do a little math there, you know that the things that you purchased in 2020
086don't cost anywhere near what they cost today. And and so everyone is going through going through that going through that as well. So, so not a fun time to be in school finance, but but we're working through it. Um, yeah, happy to take any questions you have. So, now that I've completely bummed out the entire room, [laughter] >> that's completely driven. >> How about them rats? >> Yeah, how about them rats? I will say that um the process that the superintendent and the treasurer have put forth to our board is a new different process and it it >> Yeah. Is it on? >> Okay. The what we've been doing uh with the superintendent and treasure in our board meetings regarding our budget budgeting has been uh it we've really tried to avoid just cutting. We've
087tried to have it be a process of what can we build up with what we've got. And so we have already approved uh things like the legal requirements and the schoolbased staffing which is about almost 70 70% 75% of the budgets already approved. Have I said that percentage about right? >> Probably you you are Mr. Percentages >> anyway. I always forget what's left you know. So it it has it does enable us from a budget standpoint to really focus on the things that potentially could be variable and and uh get out of the way that the uh uh expense expenditure requirements that we just have to make have already all been approved. So uh that's been a really helpful design and and u so thank you for that. Eve's not correcting me, so that's pretty
088good. >> And if I might encourage audit committee members to continue to join into the next upcoming board meetings, uh they are posted on our website, but I think those conversations are really transparent conversations. The documents that are linked, you can go into great detail. And my request for that is as we look ahead to our next audit committee conversations as well as the strategic planning uh we really appreciate you all kind of staying in lock step with us so when uh you know we can kind of pull on your expertise uh you kind of have all that current information. Of course things are also available um if you're not able to attend live on the YouTube channel thereafter. [clears throat] >> Okay. Thank you. Any other questions? No. Any other business? No. Okay. Well,
089um, at this time I will So, if I entertain the motion, normally we close out after the So, do I need two motions for the executive session and close out or can it all be combined into one? to go to executive session >> and then when we close out I don't >> generally you just tell the audience >> that okay >> we will not will not resume with public session >> all right so at this time I will entertain a motion to um enter executive session for the purpose of um employment of a public official employee or official and safety and security matters I motion >> second. >> Do you have the room? >> Do you have the vote? [laughter] >> Uh, uh, Clarice Warner, >> yes. >> Kevin Hoffman, >> yes. >> Uh, Laura
090Dio Liviera, >> yes. >> Seth Harmon, >> yes. >> Dian House, >> yes. >> Paul Kitsm Miller, >> yes. >> Uh, John Young, >> yes. [clears throat] >> Carol Mitchell Lawrence, >> yes. Uh, Eve Bolton, >> yes. >> Jim Cassett, >> yes. >> Kendra Mack, >> yes. >> Thank you. >> Okay. Well, thank you all for joining us. Um, we will adjourn immediately following um our executive session and our next meeting will take place on Wednesday, July 22nd. Um,