Friday, May 27, 2016

MCPS audit shows lack of financial and fraud controls, poor cybersecurity

While the local media is serving up the official Montgomery County Council talking points about the record heist, er, "Education First Budget" officially approved by all 9 councilmembers yesterday, you are turning to this website to learn "the rest of the story."

The budget raised your taxes to historic levels, even requiring a unanimous vote to exceed the County's charter limit on property taxes. It jacked up the recordation tax that you will pay when you sell your condo or home, or even try to refinance your mortgage! And it hiked spending $90 million beyond what the Council was required to allot to MCPS in the budget under the maintenance of effort law - meaning that there's no going back; we will now have to maintain that unnecessarily-high level of spending in perpetuity, requiring additional tax hikes. Even County Executive Ike Leggett, often called "Tax-Hike Ike" by detractors, warned that the County will now face a financial crisis this time next year based on the revenue forecast, even with the new taxes.

Last week, I referred to that new revenue - being handed over without an audit of MCPS or definitively-new strategy to reduce the achievement gap - as just being more money down the MCPS fiscal toilet. Well, the Maryland State Office of Legislative Audits has just released a new report on that toilet - and it may have you reaching for a bottle of Liquid Plumbr.

Auditors found that MCPS had awarded a $900,000 contract for a survey of its employees without bothering to use a competitive procurement process, or even preparing a statement to explain why it was justified or necessary to not put the survey contract up for bid. An unnamed MCPS employee at the management level told auditors that a MCPS "executive management official" instructed those responsible for finding a vendor to choose that firm (believed to be Gallup) without putting it out for bid. The report notes that there are many firms that conduct surveys to choose from.

MCPS also failed to write up a required statement of benefit when it used Intergovernmental Cooperative Purchasing Agreements for computers, fuel and other commodities. It is illegal to execute an ICPA without first providing that statement, which needs to show the purchases will either save money or improve administrative efficiency.

Four MCPS departments did not record or endorse checks and cash receipts before they were transferred to the Controller's office. These receipts were handled by more than one employee in those departments, auditors found. "As a result," the report says, "cash receipts could me misappropriated without detection."

Perhaps even more disturbing - MCPS had no records it show the auditors to show how much money three of those four departments had collected. The one department that could show how much in checks/cash receipts it had taken in reported that $290,000 in such funds was handled at risk of misappropriation.

At the same time as the County Council and MCPS are aggressively pursuing your hard-earned money via record tax increase, auditors found MCPS is not aggressively attempting to collect debts owed to it (and in reality, owed to you, the taxpayer).

As of the last report counted by auditors, MCPS has outstanding accounts receivable (debts owed to it) that total $45 million - that is half of the $90 million that the Council just raised your taxes to give as an extra bonus to MCPS! You can't make this stuff up, folks. We are being governed by people who are either corrupt, or very stupid.

In many cases, auditors found, MCPS did not issue the "Dunning notices" that must be sent in order for debts to be turned over to collection agencies. They also found that three employees had the ability to process credits that would make the debts owed to MCPS appear to have been reduced, while in reality, no actual funds had been collected. Without oversight of those transactions, auditors say, "improper non-cash credits could be processed in the system without detection."

Were any such improper transactions made? The report says MCPS "could not provide supporting documentation for 5 credits totaling $22037. As a result, we could not determine whether these credits were proper."

Examining the procurement system at MCPS, auditors found that 41 employees have been assigned incompatible procurement and disbursement functions without independent review. They could modify purchase order or mark items in the system as having been received, and in one case, had access to the room where checks were printed.

With no independent review or approval of the transactions those 41 employees made, "improper or erroneous transactions could be processed without detection," auditors wrote.

Auditors found that MCPS does not monitor contracts to ensure that payment don't exceed the contracted amounts agreed to. For example, MCPS hired a law firm in a legal case regarding special needs education. It spent a total of $226,000 on that firm in FY-2014. MCPS had the contractual option of paying a daily hearing rate to the firm of $6300-per-day, or hourly services-plus-expenses. Auditors report that MCPS didn't bother to calculate the latter option for each day of the case, and the law firm's invoices did not list the number of hours each day. MCPS did not demand that information, and therefore may have paid more than necessary for the legal services.

In three other cases, where MCPS contracted purchases of computer equipment and milk, "MCPS paid the vendors approximately $1.3 million more than the contract amounts approved."

Regarding personnel and contracts, auditors determined that there are insufficient independent controls on changing employee and salary information in the MCPS computer system.

Moreover, MCPS is having overall computer security issues. This is notable for two reasons - 1) Many parents have expressed concern over both the handling of student information and the issuance of computer hardware to students by MCPS, and 2) Councilmember Hans Riemer has grandstanded as a guru of cybersecurity for self-serving political purposes. Four years after Riemer took office, it was found that the County was still running on Windows 2000, one of the most vulnerable platforms in the world.

Perhaps Riemer has been consulting for MCPS, as auditors concluded the school system's core network firewalls are not configured properly to secure the MCPS network. Auditors found that there is "overly broad" outside access to all devices on the MCPS network, "thereby placing these network devices at risk." Some exterior source locations could have access to "any destination on the MCPS network," auditors wrote.

Firewall logs are not being regularly reviewed, and core firewalls do not currently send urgent emails to MCPS system administrators to alert them to "high severity firewall operational events," the report says. An insecure connection protocol used by administrators shows login credentials in clear text, auditors noted.

Thirty critical non-public servers are improperly connected to a network containing publicly-accessible servers, and 13 email servers that were supposed to be private are instead publicly accessible.

86 third-party business partners of the school system improperly have "network-level access to the entire MCPS network." Oops.

Much like with the Riemer Windows 2000 debacle, every computer tested by state auditors was determined to be running an outdated operating system. 75% of the workstations they tested did not have the latest security updates downloaded. Whoops! Paging Hans Riemer, cybersecurity guru!

13,000 MCPS computers were determined to not even be compatible with the anti-malware software tool the school system uses.

Overall, auditors found, there was no automatic security update or patching system in place.

Speaking of student information, controls over that information were found by auditors to be "not sufficient." The installed version of the student information database software hasn't been supported by the developer since January 2012.

Currently, there is heated debate over a County Council blunder that now threatens to move school bus depots into at least two residential neighborhoods in Rockville. But auditors found that MCPS is doing a poor job of managing the school bus routes. 300 routes are currently failing to meet ridership goals, suggesting they could be consolidated with other low-ridership routes to save substantial funds. MCPS is not doing that, but demanding more money from you to throw after bad.

Bus maintenance work orders are not up to date, either. "MCPS work order reports in the system were not accurate, and could not be used to reliably track the status of bus maintenance work."

Bus parts are highly susceptible to theft and misappropriation, the report states. Indeed, the auditors' review of parts inventory identified "shortages totaling $92,000 and overages totaling $49,500." Sounds like a County Council salary increase's worth.

MCPS isn't doing a much better job controlling health care costs. In FY-2014, for example, MCPS paid $295 million in health care claims. But it didn't verify the legitimacy of those claims. Auditors say MCPS told them it doesn't believe there are any instances of fraud or improper billing. But auditors note that Maryland regularly reviews such claims by state employees, and found that improper health care payments identified by such audits have always exceeded the amount spent to review them. In short, significant funds may be being lost on health care expenses at MCPS. But of course, it doesn't matter - they can just hit you with another tax increase from their friends on the County Council to cover it!

In conclusion, the County Council has once again been proven incompetent and impotent. They have approved a massive increase in funds to a school system that once again has proven to have poor financial accountability. It's telling that the supposedly super-intelligent County Council did not have the intellectual curiosity to seek out the information the audit described above provides before voting to approve additional funds that put taxpayers behind the 8-ball next year. And with no credible new strategy to stop the decline of education in MCPS to justify the heist.

As the Parents' Coalition of Montgomery County reported on its blog yesterday, the Council will not even examine the audit until August, when many will be on vacation and not following Council business.

I guess when you have a Masters Degree in Taxation like the Council does, fiscal responsibility can wait.

33 comments:

Anonymous said...

I like how MCPS auditing itself to catch inefficiencies and oversights means it's "corrupt" and lacks "financial accountability," in Dyer's mind.

Does. Not. Compute.

Anonymous said...

8:39AM - Reading comprehension lessons can help you figure it out.
Sure some of the findings are checks + balances lapses, some more policy related, but what the report really suggests is before you start digging into citizen's pockets again, there's a lot of mismanagement and sloppy systems to address and tighten up.

Robert Dyer said...

8:39: As clearly stated several times in the article, this was a STATE AUDIT of MCPS. This was not a voluntary review sought by MCPS. You really need to read articles before you comment on them.

Anonymous said...

Audits are a regular part doing business for any large enterprise like MCPS. I don't see anything to get enraged about here. For example, any business will have an A/R balance at any given time. An A/R balance of $45M that is 60+ days overdue would likely be a problem.

Anonymous said...

Crazy Robert, meet Crazy Janis.

Crazy Janis, meet Crazy Robert.

Anonymous said...

Although this was a the state level rather than the county level, this is a routine procedure that is done one a regular basis.

Robert Dyer said...

10:45: In fact, many of the accounts were more than 360 days overdue. Indeed a problem.

Robert Dyer said...

1:17: And you're not alarmed by the findings?

Anonymous said...

6:11 PM: Who said that you or Janis Sartucci were "state auditors"?

Anonymous said...

MCPS web site has been down since Thursday evening. Security problem?

Anonymous said...

8:39 FYI reading is not your strong suit -State audited MCPS

Anonymous said...

Democrats love waste in government
they should be over joyed by this audit

Anonymous said...

mcps new math has brought county down to the level where council thinks millions flushed is good

Anonymous said...

"As of the last report counted by auditors, MCPS has outstanding accounts receivable (debts owed to it) that total $45 million - that is half of the $90 million that the Council just raised your taxes to give as an extra bonus to MCPS!"

Because shouting in bold wasn't enough. Dyer has to shout twice as loud in bold + italics". LOL

Anonymous said...

"FYI reading is not your strong suit"

Says the guy who can't be bothered to punctuate, use proper capitalization, or write in coherent paragraphs or even coherent sentences.

LOL

Anonymous said...

9:12 capitalization will change the audit finding?


Anonymous said...

We are all born ignorant, but one must work hard to remain stupid. Benjamin Franklin

Anonymous said...

I wonder if Dyer even understands how a snapshot of Accounts Receivable works.

Anonymous said...

9:28 State auditors did the audit. Try to get that through your fuzzy brain.

Anonymous said...

Auditor’s Comment
MCPS’ practice of primarily relying on historical ridership to design bus routes does not assure cost effectiveness as MCPS operates hundreds of buses on a daily basis at less than half of the ridership capacity. OLA has noted several local school systems that have used routing software to aid in maximizing bus ridership and other systems have acknowledged its usefulness and plan to more effectively use routing software.

Anonymous said...

Auditor’s Comment
MCPS indicated that it believes the quarterly review of personnel transactions is sufficient. When this issue was discussed with MCPS, we advised that this review would not detect improper transactions by certain employees responsible for updating salaries and benefits. In addition, the processes described by MCPS to compensate for this control weakness would not, in our opinion, provide sufficient assurance of detecting improper personnel transactions

Anonymous said...

Auditor’s Comment
MCPS disagrees with the finding and claimed that it receives good value using the all-inclusive per diem billing rate, and that the cost is comparable, if not better, than the cost from the same vendor under the hourly rate structure. As commented upon in the finding, MCPS had not obtained appropriate documentation necessary to support that assertion

Anonymous said...

Auditor’s Comment
The audit finding does not question the legality of MCPS’ use of Intergovernmental Cooperative Purchasing Agreements (ICPA); rather, the finding cites the necessity of complying with Section 13-110(e) of the State Finance and Procurement Article of the Annotated Code of Maryland. MCPS’ response appears to question the applicability of the law even though OLA obtained advice from the Office of the Attorney General confirming that MCPS is subject to those requirements when using an ICPA. Although MCPS indicates that its staff perform certain due diligence procedures for ICPA’s it used, we were advised during the audit by MCPS that there was no documentation to support that MCPS had determined for any ICPA’s used during the audit period that the use of such arrangements would provide a cost savings in purchase price or administrative burden; or further other policy goals, as required by law. Further, MCPS’ Procurement Manual does not contain requirements pertaining to the aforementioned section of la

Anonymous said...

Auditor’s Comment
During the audit, we provided MCPS management with the list of 20 employees who could initiate or modify, as well as approve purchase orders without account owner approval of a requisition. We also provided MCPS management with documentation of a demonstration, which confirmed that a procurement user was capable of processing a purchase order on its financial system without a requisition and without notification to the account owner.

Robert Dyer said...

6:41: You just called two people who have simply brought to public attention the facts in the audit report "crazy." So you are indirectly calling the auditors crazy. Which makes you sound crazy.

Anonymous said...

You two were crazy long before this audit report was released. LOL

Anonymous said...

Crazy Donna St. George meet Crazy Larry Bowers. LOL

Anonymous said...

Crazy Pat O'Neill meet Crazy Bill Turque. LOL

Anonymous said...

Crazy Joann Amao meet Crazy Craig Rice. LOL

Anonymous said...

It takes a village to cover up corruption, waste, fraud and abuse. Meet the village that does it! LOL

Anonymous said...

Screwing the kids, that's the MCPS motto. LOL

Anonymous said...

Five comments in five minutes. LOL

Anonymous said...

7:35 Bored out of your mind on this beautiful weekend with no family and nothing to do. LOL