MCPS audit shows lack of financial and fraud controls, poor cybersecurity

While the local media is serving up the official Montgomery County Council talking points about the record heist, er, "Education First Budget" officially approved by all 9 councilmembers yesterday, you are turning to this website to learn "the rest of the story."

The budget raised your taxes to historic levels, even requiring a unanimous vote to exceed the County's charter limit on property taxes. It jacked up the recordation tax that you will pay when you sell your condo or home, or even try to refinance your mortgage! And it hiked spending $90 million beyond what the Council was required to allot to MCPS in the budget under the maintenance of effort law - meaning that there's no going back; we will now have to maintain that unnecessarily-high level of spending in perpetuity, requiring additional tax hikes. Even County Executive Ike Leggett, often called "Tax-Hike Ike" by detractors, warned that the County will now face a financial crisis this time next year based on the revenue forecast, even with the new taxes.

Last week, I referred to that new revenue - being handed over without an audit of MCPS or definitively-new strategy to reduce the achievement gap - as just being more money down the MCPS fiscal toilet. Well, the Maryland State Office of Legislative Audits has just released a new report on that toilet - and it may have you reaching for a bottle of Liquid Plumbr.

Auditors found that MCPS had awarded a $900,000 contract for a survey of its employees without bothering to use a competitive procurement process, or even preparing a statement to explain why it was justified or necessary to not put the survey contract up for bid. An unnamed MCPS employee at the management level told auditors that a MCPS "executive management official" instructed those responsible for finding a vendor to choose that firm (believed to be Gallup) without putting it out for bid. The report notes that there are many firms that conduct surveys to choose from.

MCPS also failed to write up a required statement of benefit when it used Intergovernmental Cooperative Purchasing Agreements for computers, fuel and other commodities. It is illegal to execute an ICPA without first providing that statement, which needs to show the purchases will either save money or improve administrative efficiency.

Four MCPS departments did not record or endorse checks and cash receipts before they were transferred to the Controller's office. These receipts were handled by more than one employee in those departments, auditors found. "As a result," the report says, "cash receipts could me misappropriated without detection."

Perhaps even more disturbing - MCPS had no records it show the auditors to show how much money three of those four departments had collected. The one department that could show how much in checks/cash receipts it had taken in reported that $290,000 in such funds was handled at risk of misappropriation.

At the same time as the County Council and MCPS are aggressively pursuing your hard-earned money via record tax increase, auditors found MCPS is not aggressively attempting to collect debts owed to it (and in reality, owed to you, the taxpayer).

As of the last report counted by auditors, MCPS has outstanding accounts receivable (debts owed to it) that total $45 million - that is half of the $90 million that the Council just raised your taxes to give as an extra bonus to MCPS! You can't make this stuff up, folks. We are being governed by people who are either corrupt, or very stupid.

In many cases, auditors found, MCPS did not issue the "Dunning notices" that must be sent in order for debts to be turned over to collection agencies. They also found that three employees had the ability to process credits that would make the debts owed to MCPS appear to have been reduced, while in reality, no actual funds had been collected. Without oversight of those transactions, auditors say, "improper non-cash credits could be processed in the system without detection."

Were any such improper transactions made? The report says MCPS "could not provide supporting documentation for 5 credits totaling $22037. As a result, we could not determine whether these credits were proper."

Examining the procurement system at MCPS, auditors found that 41 employees have been assigned incompatible procurement and disbursement functions without independent review. They could modify purchase order or mark items in the system as having been received, and in one case, had access to the room where checks were printed.

With no independent review or approval of the transactions those 41 employees made, "improper or erroneous transactions could be processed without detection," auditors wrote.

Auditors found that MCPS does not monitor contracts to ensure that payment don't exceed the contracted amounts agreed to. For example, MCPS hired a law firm in a legal case regarding special needs education. It spent a total of $226,000 on that firm in FY-2014. MCPS had the contractual option of paying a daily hearing rate to the firm of $6300-per-day, or hourly services-plus-expenses. Auditors report that MCPS didn't bother to calculate the latter option for each day of the case, and the law firm's invoices did not list the number of hours each day. MCPS did not demand that information, and therefore may have paid more than necessary for the legal services.

In three other cases, where MCPS contracted purchases of computer equipment and milk, "MCPS paid the vendors approximately $1.3 million more than the contract amounts approved."

Regarding personnel and contracts, auditors determined that there are insufficient independent controls on changing employee and salary information in the MCPS computer system.

Moreover, MCPS is having overall computer security issues. This is notable for two reasons - 1) Many parents have expressed concern over both the handling of student information and the issuance of computer hardware to students by MCPS, and 2) Councilmember Hans Riemer has grandstanded as a guru of cybersecurity for self-serving political purposes. Four years after Riemer took office, it was found that the County was still running on Windows 2000, one of the most vulnerable platforms in the world.

Perhaps Riemer has been consulting for MCPS, as auditors concluded the school system's core network firewalls are not configured properly to secure the MCPS network. Auditors found that there is "overly broad" outside access to all devices on the MCPS network, "thereby placing these network devices at risk." Some exterior source locations could have access to "any destination on the MCPS network," auditors wrote.

Firewall logs are not being regularly reviewed, and core firewalls do not currently send urgent emails to MCPS system administrators to alert them to "high severity firewall operational events," the report says. An insecure connection protocol used by administrators shows login credentials in clear text, auditors noted.

Thirty critical non-public servers are improperly connected to a network containing publicly-accessible servers, and 13 email servers that were supposed to be private are instead publicly accessible.

86 third-party business partners of the school system improperly have "network-level access to the entire MCPS network." Oops.

Much like with the Riemer Windows 2000 debacle, every computer tested by state auditors was determined to be running an outdated operating system. 75% of the workstations they tested did not have the latest security updates downloaded. Whoops! Paging Hans Riemer, cybersecurity guru!

13,000 MCPS computers were determined to not even be compatible with the anti-malware software tool the school system uses.

Overall, auditors found, there was no automatic security update or patching system in place.

Speaking of student information, controls over that information were found by auditors to be "not sufficient." The installed version of the student information database software hasn't been supported by the developer since January 2012.

Currently, there is heated debate over a County Council blunder that now threatens to move school bus depots into at least two residential neighborhoods in Rockville. But auditors found that MCPS is doing a poor job of managing the school bus routes. 300 routes are currently failing to meet ridership goals, suggesting they could be consolidated with other low-ridership routes to save substantial funds. MCPS is not doing that, but demanding more money from you to throw after bad.

Bus maintenance work orders are not up to date, either. "MCPS work order reports in the system were not accurate, and could not be used to reliably track the status of bus maintenance work."

Bus parts are highly susceptible to theft and misappropriation, the report states. Indeed, the auditors' review of parts inventory identified "shortages totaling $92,000 and overages totaling $49,500." Sounds like a County Council salary increase's worth.

MCPS isn't doing a much better job controlling health care costs. In FY-2014, for example, MCPS paid $295 million in health care claims. But it didn't verify the legitimacy of those claims. Auditors say MCPS told them it doesn't believe there are any instances of fraud or improper billing. But auditors note that Maryland regularly reviews such claims by state employees, and found that improper health care payments identified by such audits have always exceeded the amount spent to review them. In short, significant funds may be being lost on health care expenses at MCPS. But of course, it doesn't matter - they can just hit you with another tax increase from their friends on the County Council to cover it!

In conclusion, the County Council has once again been proven incompetent and impotent. They have approved a massive increase in funds to a school system that once again has proven to have poor financial accountability. It's telling that the supposedly super-intelligent County Council did not have the intellectual curiosity to seek out the information the audit described above provides before voting to approve additional funds that put taxpayers behind the 8-ball next year. And with no credible new strategy to stop the decline of education in MCPS to justify the heist.

As the Parents' Coalition of Montgomery County reported on its blog yesterday, the Council will not even examine the audit until August, when many will be on vacation and not following Council business.

I guess when you have a Masters Degree in Taxation like the Council does, fiscal responsibility can wait.