001okay everyone good afternoon we have quorums so we're going to go ahead and call um today's uh March 17 2025 regular meeting of the Fairfax County Schoolboard audit committee to order miss lady has submitted a well is she there she's she's not there okay so we'll dispense with that for now um Janet just flag if she joins um so we will be moving to um item 1.02 the approval of minutes so we will now vote to approve the minutes of the January 133 2025 meeting of the audit committee which were sent around for everyone so um do we have a motion okay uh so miss St John cunning is moving that the audit committee will approve the minutes from the January 13 2025 meeting uh with leave for the clerk to make grammatical and formatting
002edits do we have a seconder second okay great miss Henderson seconding all those in favor okay okay unanimous of those at the table opposed none okay now moving on to uh 1.03 uh audit item ogag engagement status update so I call on Danielle Moore for item 1.03 thank you um so good evening everyone we will be going over the ogag internal audit status um right now I wanted to start with we have two items that we will present tonight that will be our proc procurement process audit as well as our student discipl disciplinary audit um those items are complete and as I mentioned we will present those tonight we do have two audits that are currently in process they are in ex our execution phase those are a construction and renovation Contracting process audit as
003well as our critical process review audit for hiring um and so we are scheduled as I mentioned they are in our execution phase and we are scheduled to present on those in our June audit committee meeting we also have our ongoing continuous monitoring we're currently in quarter two of the continuous monitoring um as of right now we are looking at some career um and Technical education sites that we are um conducting audits on as well as we have 15 schools that we will review um non-appropriate and appropriate transactions and we will be continuing our unannounced gate receipts um at a a couple of our schools um some other other duties would include our FY 26 risk assessment process um we have concluded doing our benchmarking um of other National um K12 organizations um we have
004interviewed and collected feedback from our external internal stakeholders and we are analyzing our financial indicators and we are hoping to present our final proposal in our April and May uh audit committee meeting after that the results will be presented to our school to the school board um we also have our fraud waste and abuse inquiries and we I wanted to refer that we will pres be presenting on some of those internal inquiry updates tonight we also have our recommendations followup um audit recommendations as of 30 January 31 it has been completed and we will also be presenting those um tonight in this meeting and I want to also mention that we have our art recent education we just completed a um a NBA training along with payroll and it was called bridging payroll and audit
005and audit tools for excellence that was presented on March 7th we had a wonderful turnout as it relates to um that nasar training and I also wanted to mention upcoming in April we uh April May we have our internal audit awareness month coming up so we are so excited for that so that will conclude our internal um audit status updates and I will give it back to Ryan okay thank you Miss Mor um does anyone have any questions on those updates seeing none uh and with thanks to Dr Reed and Mr Smith for letting in the light we will move in to item uh number uh 1.04 ogag internal um inquiry updates um so I turn it over to General Co thank you good afternoon everyone so we are at um the item for the
006uh office of auditor general internal uh inquiry updates um so what you see in front of you that is the uh the numbers of concerns and or situations that we receive through different means um until from the July 1 which is our the start of of our fiscal year through March 6 of this year um as of March 6 we got a total cases of 44 and on the list you can see that that by uh the themes and the area is that this claims are related to so as of today all of the cases that we received we have closed them um meaning that we have conducted uh a preliminary review according to our policy uh 1107 or regulation 140 uh 1410 to review them and then for some of them uh we may
007need to refer it out like let's say if they are human resources related or residency related then we are referring to the appropriate departments within uh f County Public Schools um and when situations like there are you know credible information that I would need to share more with the audit committee members those situation will either be discussed in the public meeting or discussed in the Clos meeting when uh if it is appropriate so with that would like to uh turn it back to Ryan thank you does anyone have any questions on our yes Mr Moon thank you Mr chairman I don't know whether it is appropriate for me to ask any questions about the nature of some of these inquiries in public setting but uh when I saw relatively higher number for human resources and
008use of assets I just wanted to hear if you could share with us in public what nature of those inquiries might have been sure thank you Mr moon for the question so human resources are mainly uh Personnel uh related so for example if um someone may complain about about the supervisor or complain about their work environment um and um not really directly related to fraud ways or abuse and again we have very clear definition of each terms in our policy 1107 so then we will looked at those definition and then to see when the claims come in does it map to those and many times I I need to be you know just candid with you all many cases have fallen in the middle of it right so so then we will need to work
009with our human resources counterpart together uh for many some of the situations but depending on the majority of that case if that is Personnel related then we put under the human resources category if it makes sense and if I may also uh advise you all about the theme of the use of assets so um we have been very strong in um really uh educating our employees our community members that the bulk of our budget is for payment for our payroll right so we have to ensure that that kind of like our employees you know are working the contracted hours for example um for hourly or for salaried workers so when situations come up maybe uh there may be concerns about uh eser Co did not you know work my contracted hours depending on the claims
010come in I may put it under use of asss because talents and time is a very important asset or we may put it under documentation if there is no you know in my time I did not like put in correctly so it depends on the case by case level okay okay thank you mrman we're going to take a quick pause um a lady has entered the chat so um miss lady has submitted a written request to attend this afternoon's meeting virtually due to a personal conflict as she has another meeting directly after this meeting and is attending tonight's meeting from hearnen Virginia um all those in favor of uh approving Miss Lady's request um Miss St John cunning do you approve okay it's unanimous for those those at the table thank you um sorry now
011back to the item at hand any other questions on our internal inquiry updates I have one question which is that um you know we saw a huge Spike last year um and it doesn't like look like we're going to reach reach that level again this year can you kind of just give your own sense of why we saw that Spike and why it has evened out yeah thank you for the question uh Ryan so yeah I think in fisal year 24 we have started very aggressive you know education and community outreach and thank you also for all the AUD commit members and also our staff members you know to Advocate that for us we continue to do the same thing in fisal year 25 and my sense is that that because um we actually work
012very closely with the stakeholders and I feel like that many time the managers already you know know kind of what we are expecting and I think that that the self-awareness and then they try to you know resolve the issues even before they become an issue so I really think it's a great story to tell um and then out of the uh the the numbers that you see it here I also want to raise it the fact that the number for not related to fraud ways and abuse at FCPS number has dropped significantly also so what the does it tell me is that that people are really using is really using the hot this hot line for the purpose that it is designed for so while annualize the number doesn't really as much as last year
013but I think the solid the numbers is more solid great thank you for that so seeing no further questions I think we can move on to item 1.05 so I call on Luke Robertson and um time tishman for item 1.05 thank you so this is the procurement process audit that ogag performed uh in accordance with the fy2 approved plan audit plan by the school board so background and context is that FCPS has delegated purchasing Authority from the Fairfax County government executed by the office of procurement services for FCPS uh the office of cyber security and Technology architecture and assessment section within the department of Information Technology have established process cesses for evaluating vendor risk in the form of the security architecture and vendor acceptance questionnaires vendors complete these questionnaires before signing a contract or adopting
014a service or platform with FCPS and questioners collect information from vendors on various aspects including cyber security privacy accessibility Etc so the audit scope was for FY 24 and the objectives were to assess whether adequate controls are in place and have been achieving desired outcomes for the following process areas bidding process and vendor selection which includes relevant it processes uh such as the cyber security checklist and assess compliance with policies and regulations so in order to achieve the audit objectives ogag reviewed applicable FCPS policies and regulations reviewed the Virginia Public procurement act Fairfax County Purchasing resolution and applicable Fairfax County government policies and regulations we reviewed the procurement manual for prescribed best practices and standard operating procedures we conducted walkthroughs and interviews with stakeholders including Ops OCS and TAA and we assessed or we also
015reviewed a sample of 63 contracts for compliance with procurement requirements so as a result ogag noted three moderate risk findings one lowrisk finding and one observation within the report we have uh what you can see is the onepage summary which uh describes a high level highlights of the report we also have the two-page executive summary which contains a little bit more information and everything else uh discussed today is found within the report so for today's presentation we're just discussing the key highlights for each of the findings detailed within the report so for the first finding uh it's moderate risk finding titled conflicting directives and guidance regarding approval Authority so procurement Services cyber security and Technology architecture and assessment each have functions to establish and document in the vendor approval process process through their policies regulations
016and internal and external Guidance the offices shared vendor approval process should succinctly align and agree between documents with clear language as of FY 24 there is conflicting and inconsistent language within their policies regulations and internal and external guidance regarding the shared vendor approval process functions of Ops OCS and TAA as an example regulation 6410 states that OCS is responsible for assessing security risk and approving hard software Hardware vendors and services which is supported by the related guidance that they provide to vendors requiring them to complete the security architecture and the vendor acceptance questionnaires and meanwhile regulation 512 which is uh a regulation owned by procurement services does not include requirements for vendors to complete questionnaires and participate procurement activities and additionally ops's Sops only denote questionnaires to be completed by vendors if applicable um inconsistent
017guidance May hinder the ability for FCPS to solicit vendors in a timely manner and then without process standardization there's an observed administrative inefficiency due to internal confusion and delays in decision- making so we recommended that OCS and TAA document a standardized risk assessment process that tailor vendor risk management practices on a case-by casee basis based off the type of products or Services being acquired and two the Ops OCS and TAA collaborate to revise the regulations to align with their agreed upon assessment processes and three that those three offices also ensure that vendor requirements within regulations and internal and external guidance for vendors are clear and consistent in messaging finding two is a moderate risk finding titled operational inefficiencies impacting vendor solicitation so at the time of the audit ogag found that the OCS and TAA
018vendor review controls were inefficiently designed as vendors are required to complete a standard comprehensive questionnaire regardless of the nature of the contract or the degree to which technology is involved in the terms of service so questionnaires are thorough and intricate in order to address thirdparty risk as most K12 data breaches are initiated by thirdparty vendors however questionnaires were not designed to be flexible based on resources or Ed based on the specific use case of services or products being acquired during fy4 there were two members of the OCS security architecture team responsible for conducting their security architecture questioner reviews and seven members of the TAA team responsible for conducting their vendor acceptance questionnaire reviews and as of the time of the audit um these offices had four and seven members respectively um in addition sorry I
019lost my place and although although the security architecture questionnaire aligns with other industry-leading questionnaires in k12 and higher education these are specific to organizations acquiring cloud-based Services um and questionnaires can take several months for vendors to complete which may cause FCPS to lose business and not acquire critical goods and services in a timely manner if vendors choose not to participate due to the length and scope of questionnaires relative to what they're offering in terms of service so per OCS inefficiencies stem from vendors either not completing questionnaires when they're sent out or not completing them in a timely manner which was validated for some for some vendors and support that they provided but was difficult for us to validate for the sample of contracts tested just due to the limited Milestone tracking and established indicators that
020we will describe in the next finding so we recommended that um OCS and TAA scope their questionaires based on the service or product being Acquired and consider imp m menting a third party risk management in trust software as well as consider accepting industry-leading certifications and attestations in lie of questionnaires or the next moderate finding finding three which is the limited performance monitoring for procurement activities Ops OCS and TAA have not established kpis key key performance indicators to track the effectiveness of procurement and vendor review activities there were noted inconsistencies in recording milestones in the contract request and management system or cram system which is uh managed by Ops with limited available Milestones available for security architecture and the vendor acceptance questionnaire activities uh per the government accountability office management may need to design performance measures
021that indicate a level or degree of performance such as milestones and establishes activities to monitor performance measures and indicators the lack of established indicators does not allow for management to obtain a clear indication of the effectiveness of these controls so we recommended that Ops OCS and TAA consider building key performance indicators into their Cur into their current procurement and vendor review activities so they have a baseline formed against which to measure the effectiveness of their processes so for finding four which is lowrisk um titled contract file review o noted that nine of the 63 contract files reviewed were in compliance with procurement requirements but were missing some documentation that should have been maintained in their contract file per FCPS regulations and Sops and best practices found within the procurement manual additionally regulation 512 does not
022describe cooperative procurement processes as detailed in the procurement manual which made up 44% of contract activity in 2024 in FY 2024 so we recommended that Ops considered documenting current uh procurement methods in regulation 512 to include Pro uh Cooperative procurement types and that Ops consistently applies steps outlined in guidance and ensure that the documentation for contract files as maintained as required and lastly the the one observation titled Supplier Diversity initiatives facilitated by FCPS so in alignment with the Fairfax County Purchasing resolution and the one Fairfax policy and the Virginia Public procurement act uh the Fairfax County government's Department of procurement and material management which is their version of our office of procurement Services have established a Supplier Diversity Program with the mission to provide the necessary support to small women-owned minority owned and service disabled
023veteran-owned businesses which I'll be referring to as swam businesses um this community um they've they've established this program for this community Desiring to do business with in and with Fairfax County Ops has not established their own separate Supplier Diversity Program apart from the county it's unclear whether FCPS is required to establish its own Supplier Diversity Program as dpmm does include both Fairfax County government and Fairfax County Public Schools data in their reporting of the participation of swam suppliers in contracts awarded so we recommended that uh they can Ops consult with division Council and or the County government to review and evaluate whether FCPS is obligated to establish a separate program that mirrors the supplier divers the Supplier Diversity initiatives that um the county has established and Ops consider publicly advertising resources available to prospective swam
024vendors and consider updating regulation 512 to align with what is found within the Virginia Public procurement Act and the County's purchasing resolution so with that uh I would like to thank um Ops OCS TAA for working with us collaborating with us and um answering our emails and providing the support we need to complete this audit and with that I'd like to yield back to the chair for direction okay thank you Mr Robinson and apologies Tim that your name in the script was written is time so anyway we know your Tim uh so um anyway this is uh there's a lot here I know we have leadership from um the various departments here so thank you all for being here um so with that I open the floor for questions from committee members Mr Moon uh
025this is just from the lack of or or this is based upon my ignorance of reading your report on the first page report highlights uh could you explain to me what those financial indicators of the dollar figure and then positions is that is that the positions within that office correct respective office correct so uh for example eisa is a 77 positions with $29 million versus Ops is a 20 positions for $3 million yeah so the the TAA is a section of eisa so which is Enterprise information system an assessment apologies if I have got that incorrect but they maintain the TAA section who does the um vendor acceptance processes okay I was just looking at the a PO position differences amongst sure those so those are correct numbers mhm okay thank you uh so when
026we say a procurement PR process do we also look at whether certain contracts or services are actually needed or since that's not a process that's a substance questions we only look at when you do process audit we just look at the process so may I clarify the question uh Mr moon is it the question is through this audit do we also do a a need assessment to see whether that service or good is needed for FCPS including that yes um so I I think I would need to defer to my team to answer but likely we have reviewed the justification for why that service or goods are required and then review the sign off from the necessary um supervisor or approver but Luke you want to go ahead so for all the contract fil that
027we reviewed we were that was part of it was looking at compliance with the policies and regulations meaning that we're also looking to see um if the need for this the contract was justified properly and was within the the requirements to to initiate that contract as the part of the procurement process on it okay if I go one step further do you get to review whether a p number or vendor a is better than vendor B and vendor C and then how we got to choose A over B or C is that part of the audit so that comparing like Services between vendors wasn't within the objectives and and scope of what we looked at we were looking just to see whether or not contracts were um procured according to how they should be um
028and that all the contract files maintain that documentation and approvals okay if the board wants to go that one step further does your office have a capacity to be able to handle that so I I'd like to just to clarify that right so the question is that if we need to as do we independently agreed with management at the time when they make the decision like let's say they have three vendors vendor one two and three and do we will we reach an independent decision the same as management could we look into the decision my question is whether whether you whether your office has a capacity to ever look at part of this process procurement process uh audit a the a a the decision made by the management is is I guess you know picking
029one vendor over another it was the best decision whether whether you have the capacity to do that at all yeah I great question I think it depends on the services or Goods that are procured right if it is something more General right that we have the expertise the capabilities to review yes absolutely yes but if it is something very specialized like if it is related I'm just making you know an example like with special education population they may need a very unique type of services and the terminology I think that my existing team mrm will not be able to provide further judgment right um so it depends on what we are procuring okay as a part of this you know uh this procurement process you know audit this time have you also look at the
030any sourour contracts yes yes so if I may um I'm so sorry to steal the Thunder from Luke but yes the answer is uh so if you look at page five um it actually outlined the types of procurement uh that that was procured like by through Cooperative contract ifb RFP and soul source and then we also select samples right from each of these category and I believe um I believe under page seven and page eight there uh is a table so sorry that that is at the bottom it listed out the ifb and the RFP so request for proposal how many were in the population during the um the years of audit and then how many that we will selected and then if you looked at page eight the top that you can see that
031the only population for soul Source if this is the um area of you know Focus we only have nine total during the time frame and we have looked at four of them am I correct yeah so when you when you look at when you looked at those four sourour contracts Mr chairman is it okay for mle okay uh when you looked at those four sourour contract do you also look at or did you also look at whether it was really Soul Source whether there was any other vendor available throughout the world right right so I would defer I know look you have like the the information with you yeah so as part of the Soul Source we looked at specifically whether they had the findings and determination documentation saying that attesting to the fact that
032this is the only sole source for this specific type of purchase um I can say that for two of the Soul Source contracts we looked at they were related to fundraising services so essentially they were procured as a sole source so that they could be available to schools to then uh contract with a s with this provider to do fundraising services at their school um the other Soul Source contracts that we looked at um were related to and I've got that right here um an application tracking software as well as uh k6 language arts basil resources okay but whether whether you did make an independent Judgment at sore I don't know I'm making up the word sore sourceress of those contracts or you or you are just taking a certification by the management that those
033are the sourour I think we have to you know be making our professional judgment as well right Mr Moon so we have to reli on the management uh certification but at the same time I think Luke you Shar with me right like for the fundraising one you you can speak about what they actually are better than I or maybe I can defer to management to response to kind of do fundraising Fender but the other two from based upon my understanding they are indeed the only providers in the industry am I correct yeah that's correct so um one of them obviously being dependent on uh what recommendations vdoe has made in terms of who can provide what sort of resources So within that we did see that there was due diligence done to determine that that
034in fact was the only available uh provider of that contract as well as the um other uh Soul Source contract that okay thank you that's that's good good enough for me for now and I would love to entertain a offline conversation with a some time um superintendent Reed thank you Mr mine I Mr moon on the bottom of page five um I think um attorney general Co or auditor general Co talked about the chart I think at the bottom of the page this is a different bottom of the page but it really I think shows the work staff has gone to to minimize Soul Source um contracts and we've worked very hard I know in my three years uh to um and at times I worry it's actually created a challenge for us because we're
035working so hard to only RFP in some areas but I just wanted to draw your attention to the draw down on that I appreciate you know do Dr Reed pointing to that particular chart and and I mean I like what I see the number wise uh it's not that I am trying to second guess in know Management's you know judgment or certification of a s sourness uh and and I mean I don't I'm not even uh you know arguing that sour soures are not good I mean s Source may be very very needed very much needed for uh service that we should provide for our students and families and for the school system but as a a a as an elected official get to be asked by community members of whether we do what the
036school board does uh uh a a ask either someone to verify the independent judgment made I mean uh the Judgment made by the management of the you know sourness so uh I think this is the right time this is the this is the venue to ask those questions hey thank you Mr Moon uh Miss St Johan Cy um so for um your first finding in terms of um there not being alignment between Ops OCS and dit can you identify what you think the barriers were and how difficult it's going to be to get that in alignment and what the risk of not having it in alignment is so I think this might also sort of be uh it the I guess the risk of them not being in alignment is that there is the increased
037risk of uh there being confusion delays in decisionmaking it impacts the ability for um the offices to understand their role in the procurement process who has ultimate approval Authority um and then it it just again creates the delay in procuring services that may be needed um Sor right what was the rest of it so what the barriers would be which I think you answered because you're saying what the barriers are that has kept them from being in alignment I think that uh priorities between the different offices obviously procurement Services wants to be able to uh procure stuff in a timely manner and then with the cyber security and Technology architecture they want to make sure that what is being procured our vendors that FCPS is working with are safe and properly vetted um to the
038the maximum exent extent possible and I think the two um priorities conflict a little bit and that's sort of what causes the the inconsistent uh application of the questionnaires and the vendor reviews so in terms of the questionnaires because you did mention that the questionnaires some were not answered at all or some took too long to answer is that standard practice how long are they is it necessary is you did mention an alternative which I would like for you to explain a little bit more elaborate on so the Alternatives being that that we accept certifications so ISO 2701 would be one of the certifications that we would accept uh that I'm a bit so I think I I can speak 27,1 is a certification that basically looks at the potential vendor um information system management
039system systems um and information security uh Management Systems um and they you know look at the controls in place um and ISO 270001 is more of a performance prescriptive based certification done by an independent um you know uh auditing body that will take a look at the organization and see if they have the proper up-to-date control such as multiactor authentic uh single sign on um things like that various controls that they're looking for and prescriptive policies and procedures um that you know are it's so ISO is a is a worldwide organization so it's worldwide recognized controls that they're looking for so it's a pretty um pretty good uh certification to um Carry with you uh you'll have an initial audit and then you would have um surveillance audits done every year so um you know
040there's no way to entirely control risk but you want to mitigate risk and it's a good way to mitigate risk for potential vendors so that's that certification like the Good Housekeeping stamp of approval is something that would not necess necessitate the questionnaire because the assumption is that if they have that certification that would have answered some of the questions does that make sense yeah you know the questionnaire is to reduce cyber security risk or um information uh security risk and uh you're mitigating it either through the questionnaire or a CER independent certification so one can be in lie of another is what the recommendation is for would you happen to know what the standard practices in other school systems of how they procure um companies to do this if they use the questionnaire or the
041stamp of approval I mean for lack of a better word well I W I was um part of a a electronic Round Table where um uh a former uh ciso from the uh the BOS uh the Boston um Precinct was talking about in lie of you know um the standard policy vetting they would look for both a ISO 27,1 and a sock 2 type 2 um audit report um so it is a practice that had that I have um participated in in roundtables and heard of maybe if I can just jump in um so benchmarking is not part of the scope of this audit because we would like to focus on procurement which is the big thing and of course that cyber security risk is is imminent right we would really want to do what
042we can to to mediate it but at the same time I think what is the right balance and I think um I would like to see if management if you have any thought to add at this point here because I think this is a great question M and I don't we don't have the answer I'd just like to add like you said it's all part of a defense in depth um security architecture where um as you were comparing the questionnaire to these um attestation reports or certifications you want to defense in depth with multi multiple layers and that's kind of speaking to where Luke is coming from um where you know cyber security has a duty and a fiduciary duty to protect FCPS from Cy cyber security events um but I'll defer back to Esther's
043comment I believe you deferred to management or okay Dr re thank you Mr mine so which specific question Esther are you wanting me to respond to no I just uh think that Mercia has a great question right like about what are the other alternative right like if the checklist is like very long and some maybe not or did I frame frame that questions correctly well I guess from what I heard was that it seems to be that there's a standard practice to accept the certifications versus the questionnaires and what from what was said about the questionnaires is that sometimes it will cost us business because it takes too long to answer so some vendors just won't do it they may be a great vendor they're just not going to do the questionnaire they're not doing
044it they're not finishing it so I was trying to find out what standard practices because I could I could see the benefit in terms of us learning what standard practices are across the board for other organizations ations because if we're losing business because of the questionnaire does that make sense or is that even efficient are these certifications valid enough that we could say you know we can trust them and then move forward and not wait so long so I think that you know you we have to be thoughtful about what um our cyber security team says and when if they and this is where EST had quite a little conversation when we I am not a cyber expert um and when the Cyber team says these are the I'm going to say 10 things that
045have to be done um if you want it quicker I want you to sign a form saying you're going to take full responsibility for the outcome I'm not going to sign that right because I don't have that expertise nor do I want other Personnel in the school division to be signing that because we don't have that expertise so if it's put in front of us that these are the 10 things you need to do then we're going to say to protect the School Division we're going to do those 10 things right I'm not going to take responsibility to do six of the 10 and if there's a breach then as I said to Esther then the next thing will be auditing the breach and saying well why did we not do the other four of
046the 10 right and we're going to be right back here so whatever the standard we choose to accept or it's referred to as our risk t to an it's going to be based on what we are told is the safest risk tolerance for the School Division and at this point I have to rely on our cyber team to say this is the safest whatever you know protocol and it is taking a long time guarantee and we have lost people because of it and we've had people say we're not applying because of it and yet I don't feel like I have the expertise to say well we're only going to do half of those those things or honor only a part of those that's it's not realistic right if there's another firm or another standard or
047another certification level that we think is sufficient of course we're going to implement it um but again we have to trust our cyber team to say that yes I don't know the acronym that you shared but if that is the acronym that we believe today moving forward is best and it's quicker and we know it'll safely protect the school Division I think we would all agree it's a good thing to do I haven't had that presentation right so absent that presentation we're going to continue to do what we think is going to protect the School Division at this point so that is a kind of a long answer to the question but that's as we look at this I don't know that we can pick off pieces of the uh cyber review that are more
048or less important at this point we're told they're important so procurement is following that and that's how we're managing it at the moment yeah I think my question was more the the the certification that you said like if this company a comes and they have this certification would that cover those 10 items like do we trust like I don't know what that certification from the Independent party that says this company is certified as a good company to do cyber security because they usually cover boom boom boom boom and I guess that's where I again I am not the I think we can look into that and get back to you yeah okay right now we're following the process that's been recommended uh or the risk tolerance recommended by our cyber team okay I think someone
049from wants that's okay I think that's the answer okay yeah I think somebody wanted to speak over there no that's okay yeah I think it's staff right yeah yeah he Mr M uh uh even though I appreciate the response given by uh Dr Reed uh I fear still uncomfortable at the fact that superintendent is in a position to just rely on you know staff cyber security staff to make those decisions uh a a Mis call you know just giving you as an example if you're adopting a digital textbook digital textbook and they have questionnaires given by our you know cyber security team for vendor to satisfy uh is there a way for us to be able to compare our questionnaire with some other school districts so I think there must be a way Mr moon
050to answer your question I'm sure there is a way is I don't know if we are the best person to get that list because we and just very candidly speaking I don't have those contacts in the other school districts so I'm wondering maybe management could we have that exercise right to see how the other not only K12 right because I don't think any organization can escape cyber security risk so maybe take a look at how the other like checklists are being done I just an idea okay thank you Dr thanks Mr mamine and I I think absolutely we could I do think it is important to stay in the K12 sphere because we have such unique student information which requires a different level of protection sometimes so I would but I'm happy to you know
051collect that information if that would be helpful you know Dr we you know if he could have maybe compared with some other large school districts you know and and if all other La critics take as cautionary as cautious approach as we do that may be one thing but if we just stand out among all other school dists that's that will give us something to think about yes sir great well thank you everyone for this uh fullsome conversation and thanks to Luke and Tim for your work on this um so we're now going to be moving to um item 1.06 fiscal year 25 student disciplinary audit so I call on Mona chab for item 1.06 thank you Ryan good afternoon everyone so our office conducted a performance audit of student disciplinary process in accordance with the
052FY 25 approved audit plan the scope of this audit was school year 2024 we also Incorporated data from previous school year 2023 for comparative analysis the primary objective of this audit were to assess compliance with with reg applicable regulations guidelines and policies evaluate the effectiveness of students in student discipline internal control and Benchmark the process against other educational institutions and uh leading pract best leading practices due to the confidential nature of the audit report and exception from the Freedom of Information Act requirement the detail of this report will be will not be uh shared publicly as they will be shared in the Clos viewing soon great any comments on this comments and questions okay um seeing none we're going to move on to item 1.07 audit followup I call again Amia chab right okay okay
053so the following document uh presents our other our other recommendation followup as of January 2025 as you can see since our last audit followup we were able to close three three audit and currently we have only two outstanding items which are highlighted in the next slide thank you okay so uh this is food and nutrition services followup uh we have two recommendation that are outand in and are currently in process while we were able to verify that kpi were developed or establish benchmarking data collection is ongoing to is ongoing process to create a a baseline for future comparison we also the updates for food and nutrition services regulation is um ongoing also and is expected to be completed by March 2025 or this month next we have facilities maintenance um oag verified and closed two
054recommendation related to preventive maintenance firstly we were able to verify that several trades for tomorrow graduates have obtained full-time position during this school year also HR address or reduce the year of experience to facilitate graduate highing secondly a new standard operating procedure or an sop was created or developed to schedule twicy twice a weekly preventive maintenance also within the SOP a risk based prioriti prioritizations model um utilizing schedule and facility condition assessment data is being developed to optimize the current resource allocations for the remaining two recommendations related to forming dedicated preventive maintenance team and exploring information system functionality um I'm sorry management has asked to close them per our understanding due to budget constraints management was unable to implement them as such oag proposed to close these two items understanding that management has evaluated implementation
055feasibility within the existing budget next item we have uh grants the recommendation related to Grants applicant training is now closed Financial Services fast team has created an electronic local school activity fund or lsaf Grant report in web form and phase two is now completed our last items are howand middle elementary elementary school business process audit the two recommendations related to monitoring of donation related projects and payment to FCPS person personnel are now closed during our followup we were able to review cash dispersements over over a 4mon period and noted no donation or Personnel payments were made we will also continue our monitoring on part as part of the oag fy2 continuous monitoring efforts where oeg considers to include a review of donation as an other step ogag will continue to follow up on outstanding outstanding
056items on a courtly basis the next followup will be in will be as of April 30th of 2025 and it's scheduled to be presented at the June audit committee meeting great thank you are there any questions or comments on these follow-up items St John cunning is that a okay wonderful well um thank you all so um at 5:22 this meeting of the audit committee is adjourned um we will be meeting again when our next meeting do you remember it will be April 28th April 28th yes so we will see you then now um the audit committee will make a motion to go into close meeting to discuss Personnel matters pursuant to section 2.2 3711 A1 of the code of Virginia and to consult with legal council regarding specific matters requiring the provision of legal advice
057by such Council pursuant to section 2.2 37 A8 of the code of Virginia specifically a Personnel matters and two student disciplinary processes and procedures do I have a motion moveed by