Pbsd Final Draft Reports

8/6/2019 Pbsd Final Draft Reports

1/53

PPaallmm BBeeaacchh CCoouunnttyy SScchhooooll DDiissttrriicctt

MMaarrcchh 3300,, 22001111


2/53

Table of Contents

Transmittal Letter ........................................................................................................................................ 1

Executive Summary ............................................................................................................................... 2 - 6

Procedures and Results by Objective .................................................................................................. 7 - 23

Recommendations and Management Response ............................................................................... 24 - 27

Management Responses:

From Mr. William Malone, Acting Superintendent, Palm Beach County School DistrictFrom Dr. Art Johnson, Former Superintendent, Palm Beach County School DistrictFrom Mr. Hernandez, Former District Employee

Appendix A:Calendar regarding Mr. Hernandez during January through June 2010


3/53

March 30, 2011

Chairman, Board Members, andAudit CommitteePalm Beach County School District3300 Forest Hill Blvd.West Palm Beach, FL 33408

As requested by Palm Beach County School Board (District) and pursuant to our agreement datedJanuary 20, 2011 (the Agreement), we performed various procedures related to the eight objectives

outlined in the Agreement.

During our initial meetings we were asked to expand the scope to include the retrieval of certain emails.Through our testing, we encountered a scope limitation related to the email retention function. Wedetermined that the email population inherently is not complete. Therefore, this limited our ability toaddress objectives #1, #7 and #8. We have expanded further on this limitation in objective #5 and haveincluded recommendations in the Executive Summary. We will be presenting this report to the AuditCommittee.

This report is organized into the following areas:

Executive Summary This provides a summary of the results related to ouraudit.


4/53

Executive Summary


5/53

Executive Summary

The objectives of the services as determined by the School Board of Palm Beach County and its AuditCommittee as outlined in the Agreement dated January 20, 2011 include the eight objectives noted

below. Our audit approach consisted of three phases: Understanding the Objectives and Scope, DetailedTesting and Reporting. The specific procedures performed and relevant results of our testing are detailedin the Procedures and Results by Objective section. We have included a summary of results below.

# Objectives Results

1 Determine the intent, reason, and impact ofany Temporary Duty Elsewhere (TDE) thathad been altered.

[Note: TDEs are required to be filled outand approved in order for any leave ofabsence time to be taken. Leave ofabsence time is defined in Policy 3.80Leave of Absence as permission...for anemployee to be absent from duty forspecified periods of time. See detaileddescription and definitions of leave policy inProcedures and Results by Objectives

Section of this report. ]

We noted that the following 5 out of 11 TDE formsprovided to us were manually modified to makechanges pertaining to dates, hours and / or type ofleave requested. We noted the TDEs were

processed in PeopleSoft for the manual alterations.

The original TDE form signed by the supervisoron 3/2/2010 was for Vacation from 2/18/2010 2/19/2010. Handwritten on the form was theadditional Vacation request for 2/25/2010 2/26/2010.

The original TDE form, signed by thesupervisor on 3/9/2010, was for Personal leave

for 3/4/2010 3/5/2010. Handwritten on theform was a change from Personal leave toVacation.

The original TDE form signed by the supervisoron 4/23/2010 was for Sick time for 4/20/2010 4/22/2010. Handwritten on the form was theadditional Sick time request for 4/13/2010 4/14/2010.

The original TDE form signed by the supervisor

on 5/7/2010 was for Vacation from 4/28/2010 4/30/2010. Handwritten on the form was theadditional Vacation request for 5/6/2010.

The original TDE form signed by the supervisor


6/53

Executive Summary - continued


2 Determine if the employee benefits toJeffrey Hernandez (District assignedvehicles, etc.) are properly captured andreported to the IRS.

Per our testing, the employee benefits to JeffreyHernandez were properly captured and reported tothe IRS.

3 Assess if Mr. Hernandez complied withDistrict Policy 2.28 School District OwnedVehicles in maintaining a vehicle utilizationlog.

Per the Follow-Up on Take-Home District VehiclesAudit report prepared by the Districts Internal Auditdepartment and dated February 11, 2011, Mr.Hernandez did not comply with District Policy 2.28School District Owned Vehicles in maintaining avehicle utilization log.

4 Determine if the leaves taken by Mr.Hernandez complied with the District Policy3.80 Leave of Absence, specifically,working for Memphis Schools during sickleave days, and the recording of leave daysbased on TDE forms.

We made multiple requests of Memphis CitySchools (MCS) to retrieve any documentationassociated with Mr. Hernandezs consultingservices; however, we have not received therequested documentation to date. We are thereforeutilizing documentation provided by the District.This documentation includes invoices which

provide dates, travel expense, and amounts forreimbursement. Dates of travel were specified inthese invoices, and include documentation detailfor various flight and hotel dates and costs,therefore we used this information to indicate thedates Mr. Hernandez worked at Memphis CitySchools.

Based on the comparison of all 11 TDEs and thePeoplesoft report, to the MCS documentation

provided by the District, we noted the followingviolations of District Policy 3.80:

Mr. Hernandez used sick time to work for MCS.These dates included April 13 14 2010 and


7/53



5 Determine if the Districts Record Retentionguideline was adhered to (for employeeaccess card and calendars).

Based on our testing and inquiry, we noted thefollowing:

Email: We could not determine if there was alack of compliance with the record retentionpolicy due to the present email back-up systemconfiguration and the fact that the emailretention period varies based on record type

Access Card: Based on discussions with PoliceDepartment Management and review of the

Florida Department of State interpretation, theDistrict appears compliant with the recordretention policy regarding access activity logs.

Calendars: Although the District is incompliance with its calendar retention policy of1 year for Mr. Hernandezs calendar data, theDistrict may not be in compliance for otheremployees that terminate because the identitymanagement system automatically deletes

employee accounts six months aftertermination.

6 Identify any potential gaps in policies orprocedures and provide suggestions toprevent similar issues from happeningagain.

We have listed our recommendations regarding theDistricts policies and procedures below in theRecommendations and Response section.

7 Identify misconduct, if any, on the part of

Mr. Hernandezs supervisor.

Throughout our testing and inquiries we noted no

evidence of misconduct on the part of Mr.Hernandezs supervisor.

8 Identify misconduct or errors, if any, madeby current employees

Throughout our testing and inquiry we noted noevidence of misconduct made by current


8/53


Recommendation #1 Policy 3.80 Leave of Absence

Policy 3.80 Leave of Absence states that leave shall be officially granted in advance bythe School Board and shall be used for purposes set forth in the leave application. Thetypes of leave that are included in this requirement are personal leave, vacation, sickleave, and others which are listed in the policy. During our testing, we noted that for 10of 11 TDEs we reviewed, the supervisors approval signatures were dated after the leaveof absence was taken, which violates Policy 3.80 Leave of Absence.

In addition to recommendation #2, we recommend that the automated leave request

process require leave to be approved by the supervisor prior to the date the leave is tobe taken. This will prevent late approvals and will help to ensure compliance with Policy3.80.

Furthermore, we recommend that the Policy specify which types of leave and under whatcircumstances that such leave is required to be approved before the leave is taken. Forexample, it is not practical to approve sick leave before it is taken, as an employeegenerally does not know in advance when he/she will use sick leave. Therefore, thePolicy should specify the approval process for each type of leave as qualified for anyspecial circumstances, as applicable.

Recommendation #2 Leave of Absence Request Process

The Districts current Leave Request processes and procedures are automated, but arenot linked to the accounting system PeopleSoft. Furthermore, we noted that TDEs werealtered manually and we also noted that for 2 of 11 TDEs we reviewed, the supervisorsigned the TDE but he did not check the Approved or Not Approved box. Thesepractices defeat the purpose of an electronic form, which is to prevent manualintervention and mitigate errors.

We recommend that the District link the automated process to the accounting softwarePeopleSoft. We are aware that the District is taking steps to do so. This would reduceerrors in the leave reporting process by eliminating manual modifications and reducingapproval lag time.


9/53


Recommendation #4 Email Retention Policy

As set forth in District Record Retention Policy for Electronic Communications, there isno single retention period that applies to all electronic messages, including email sinceelectronic messages or communications include records that relate to a variety ofprograms and activities. Rather, the required retention period is determined by thecontent, nature, and purpose of the records. The end user needs to know and applythe record retention policy based on the type of record and then retain it for the specifiedretention period for that type of record.

Based on discussions with District IT Management, we understand that the District ismigrating from its present email system to Google Mail. We recommend that inconjunction with this that the District consider configuring Google Mails back-up andretention settings such that the District would be in control of the retention complianceprocess. This would facilitate adherence to the Districts Electronic Communications andCalendar (Outlook) Retention Policies as well as the Florida Statute Retentionrequirements.

Recommendation #5 Calendar Retention Policy

In conjunction with our review of email retention procedures, we noted that the retention

process for calendar records in Outlook is the same. However, the District RetentionPolicy for calendars specifies retention of one anniversary year. In the case of Mr.Hernandez, based upon our review of his Outlook calendar, we noted that ITManagement prevented the Courion script from removing his Outlook account topreserve the network email and calendar. Although the District is in compliance withJeffrey Hernandez calendar data, the District may not be in compliance for otheremployees that terminate because the Courion script automatically deletes employeeaccounts six months after termination.

We understand that the District is migrating from its present email system to Google Mail.We recommend that in conjunction with this that the District consider configuring GoogleMails back-up and retention settings such that the District would be in control of theretention compliance process. This would facilitate adherence to the Districts ElectronicComm nications and Calendar (O tlook) Retention Policies as ell as the Florida


10/53

Procedures and Results by Objective


11/53

7

Procedures and Results by Objective

Objective 1:Determine the intent, reason, and impact of any Temporary Duty Elsewhere (TDE) that appeared to have beenaltered.

Procedures Results Summary1. Obtain a report from the Districts accounting software of all leave of

absence time taken by Mr. Hernandez.

[Note: The forms we reviewed were called TDEs, or Temporary DutyElsewhere. TDEs are required to be completed and approved in order for anyleave of absence time to be taken. Leave of absence time is defined in Policy3.80 Leave of Absence as permission...for an employee to be absent fromduty for specified periods of time.]

Internal Audit provided us a report generated from PeopleSoft of the leave of

absence time taken by Mr. Hernandez during his employment at the District.

2. Obtain all the original TDE's submitted and approved for Mr. Hernandezduring his employment at the District.

Review the original TDE's submitted and approved for Mr. Hernandez anddocument any alterations.

Policy 3.80 includes the following:

SickLeave

Sick leave claims shall be honored as submitted by theemployee for personal illness, as well as illness or deathof father, mother, brother, sister, husband, wife, child orother close relative, or member of the employees ownhousehold. A Superintendent of his/her designee mayrequire a doctors statement of verification of illness. Afalse claim for sick leave shall be grounds for dismissalby School Board.

PersonalLeave

An employee shall be allowed six days paid leave forpersonal reasons each year to be charged againstaccrued sick leave, provided that such leave shall notinterfere with the school/department operation.

Annual/Vacation Annual leave may be granted by the Superintendent orhis/her designee upon the written request of theemployee, with prior recommendation by theemployees administrative superior.

Unpaid Leave Leave without pay less than ten days is approved usingthe same process as other leave requests.

We noted that the following 5 out of 11 TDE forms were manually modified tomake changes pertaining to dates, hours and / or type of leave requested. Wenoted the TDEs were processed in PeopleSoft for the manual alterations.

The original TDE form signed by the supervisor on 3/2/2010 was for

Vacation from 2/18/2010 through 2/19/2010. Handwritten on the form wasthe additional Vacation request for 2/25/2010 through 2/26/2010.

The original TDE form, signed by the supervisor on 3/9/2010, was forPersonal leave for 3/4/2010 through 3/5/2010. Handwritten on the formwas a change from Personal leave to Vacation.

The original TDE form signed by the supervisor on 4/23/2010 was for Sicktime for 4/20/2010 through 4/22/2010. Handwritten on the form was theadditional Sick time request for 4/13/2010 through 4/14/2010.

The original TDE form signed by the supervisor on 5/7/2010 was forVacation from 4/28/2010 through 4/30/2010. Handwritten on the form wasthe additional Vacation request for 5/6/2010.

The original TDE form signed by the supervisor on 5/20/2010 was for usePersonal leave for 5/18/10 through 5/19/10. Handwritten on the form was achange from Personal leave to Vacation.

Apparently the intent or reason for the TDE alterations was for clarification orcorrection as documented above which relate to requests to change the type ofleave or add leave. We noted no financial impact related to these TDEalterations.

[See Objective 6 for recommendations regarding this policy and practice.]


12/53

8

Procedures and Results by Objective - continued

Objective 1:Determine the intent, reason, and impact of any Time Date Entry (TDE) that appeared to have been altered. continued

Procedures Results Summary3. Reconcile the PeopleSoft report we obtained from Internal Audit which

included all leave of absence time booked by Mr. Hernandez to theoriginal TDEs submitted and approved for Mr. Hernandez to determine ifall of the leave of absence time taken by Mr. Hernandez had acorresponding submitted and properly approved TDE.

We noted that all time taken by Mr. Hernandez, per the PeopleSoft report

we were provided, had a corresponding submitted TDE; and Mr. HernandezTDE had been input into Peoplesoft.

We noted that the vacation time for 5/6/2010 had been approved on twoTDE forms. We confirmed it had been booked only once in PeopleSoft byreconciling to the PeopleSoft report of Mr. Hernandezs time.

[We noted exceptions during our reconciliation that do not pertain to thisobjective. Those errors / exceptions are detailed in Objectives 7 and 8.]

4. Discuss any alterations noted on Mr. Hernandezs original TDE forms withDr. Johnson in order to determine intent and/or reason.

Discuss these alterations with the Administrative Assistants in order to

determine intent and/or reason.

In the course of our interview with Dr. Johnson, we reviewed the fiveoriginal altered TDEs. Dr. Johnson stated he did not know the intent orreason beyond that which was indicated on the TDE, as detailed in theresults of procedure #2 above.

In the course of our interviews with the administrative assistants whoprocessed the TDEs and submitted them to the Superintendent forapproval, they stated that they made the manual alterations to the originallysubmitted TDE only at the request of Mr. Hernandez or Mr. Hernandezsadministrative assistant. These requests were received either by phone oremail.

For requests for alterations made via email, we reviewed the applicable emailsthat supported the reason for the alterations.

The original TDE form signed by the supervisor on 3/2/2010 was forVacation from 2/18/2010 through 2/19/2010. Handwritten on the form was

the additional Vacation request for 2/25/2010 through 2/26/2010.We viewed an email dated 2/25/2010 from Mr. Hernandez to hisadministrative assistant advising her that he would be taking Vacation on2/25/2010 and 2/26/2010.

The original TDE form, signed by the supervisor on 3/9/2010, was markedto use Personal leave for 3/4/2010 through 3/5/2010. Handwritten on theform was a change from Personal leave to Vacation.

We did not view an email from Mr. Hernandez or his administrativeassistant regarding these dates.


13/53

9


Objective 1:Determine the intent, reason, and impact of any Time Date Entry (TDE) that appeared to have been altered. continued

Procedures Results Summary The original TDE form signed by the supervisor on 4/23/2010 was for Sick

time for 4/20/2010 through 4/22/2010. Handwritten on the form was theadditional Sick time request for 4/13/2010 through 4/14/2010.


The original TDE form signed by the supervisor on 5/7/2010 was forVacation from 4/28/2010 through 4/30/2010. Handwritten on the form wasthe additional Vacation request for 5/6/2010.


The original TDE form signed by the supervisor on 5/20/2010 was markedto use Personal leave for 5/18/10- 5/19/10. Handwritten on the form was a

change from Personal leave to Vacation.


Apparently the intent or reason for the TDE alterations was for clarification orcorrection as documented above and procedure 2 which relate to requests tochange the type of leave or add leave. We noted no financial impact related tothese TDE alterations.

5. Review emails to and from Mr. Hernandez and Dr. Johnson, as well astheir respective administrative assistants, that were extracted from the

system and filtered using various queries.

Document any emails that may indicate the intent, reason, and impact ofany alterations to TDEs.

We viewed the emails that were extracted from the system and met thespecified queries. No emails were noted during our review as indicating intent,

reason, and impact of any alterations to TDEs, except as noted in procedure #4above.

[See Objectives 7-8 for more information on the email extraction process.]


14/53


15/53

11


Objective 3: Assess if Hernandez complied with District Policy in maintaining the vehicle log and documents.

Procedures Results Summary1. Review the internal audit report prepared by the District Auditor titled

Follow-Up on Take-Home District Vehicles Audit and dated February 11,

2011.

The District Auditors report dated February 11, 2011 noted that (1) Vehicle logswere not maintained by Mr. Hernandez, and (2) An estimated 99% of the

mileage usage of the car given to Mr. Hernandez was for staff commuting.


16/53

12


Objective 4:Determine if the leaves taken by Hernandez complied with Districts Leave Policies, specifically, working forMemphis Schools during sick leave days, the recording of leave days based on TDE.

Procedures Results Summary1. Obtain any documentation, including, but not limited to Mr. Hernandezs

invoices and any expense reports sent to Memphis City Schools for hisconsulting services that indicates the days Mr. Hernandez worked atMemphis City Schools.

We made multiple requests of Memphis City Schools to retrieve any

documentation associated with Mr. Hernandezs consulting services;however, we have not received the requested documentation to date.

We are therefore utilizing documentation provided by the District. Thisdocumentation includes invoices which provide dates, travel expense, andamount for reimbursement. Dates of travel were specified in the invoices,and some documentation detailed flight and hotel, therefore we used thisinformation to indicate the dates Mr. Hernandez worked at Memphis CitySchools.

2. Identify and categorize the days Mr. Hernandez had taken leave based onthe PeopleSoft report.

Compare this to the days he worked in Memphis as per thedocumentation received from the District, and document results.

We created a color-coded calendar which is included as Appendix A to providea comprehensive reconciliation between PeopleSoft and the Memphisdocumentation provided by the District.

3. As noted in Objective 1, reconcile the PeopleSoft report we obtained fromInternal Audit which included all leave of absence time booked by Mr.Hernandez to the original TDEs submitted and approved for Mr.Hernandez to determine if all of the leave of absence time taken by Mr.Hernandez had a corresponding submitted and properly approved TDE.

We noted that all time taken by Mr. Hernandez, per the PeopleSoft reportwe were provided, had a corresponding submitted TDE; and his TDE hadbeen input into PeopleSoft.

We noted that the Vacation time for 5/6/2010 had been approved on twoTDE forms. We confirmed it had been booked only once in PeopleSoft byreconciling to the PeopleSoft report of Mr. Hernandezs time.

[We noted exceptions during our reconciliation that do not pertain to thisobjective. Those errors / exceptions are detailed in Objectives 7 and 8.]

4. Review District Leave Policy and document any noncompliance withDistrict Policies for leave taken by Mr. Hernandez.

Based on the comparison performed in step 3 above, Mr. Hernandez used sicktime to work for Memphis City Schools (MCS) which violated Policy 3.80Leave of Absence. These dates included April 13-14, 2010 and April 20-22,2010. The invoice to MCS billed for flight and hotel travel expenses for thesedates; however, receipts were not provided. This had no financial impact onPalm Beach County School District.


17/53

13


Objective 4:Determine if the leaves taken by Hernandez complied with Districts Leave Policies, specifically, working forMemphis Schools during sick leave days, the recording of leave days based on TDE. - continued

Procedures Results Summary

Per the PeopleSoft report and review of the TDEs, Mr. Hernandez had nottaken leave while he was in Memphis which violates Policy 3.80 Leave ofAbsence. These dates included:

1/19/2010 - We viewed a flight receipt for Mr. Hernandez to Memphis dated1/19/2010, and we also viewed a check stub from MCS that matched the exactamount of the flight receipt.

4/27/2010 & 5/11/2010 - The invoice to MCS billed for flight and hotel travelexpenses for these dates; however, receipts were not provided.

The financial impact of Mr. Hernandez not taking leave while he was inMemphis these three days amounted to three days of his regular pay.

5. Review sick and leave time accruals to ensure Mr. Hernandez accruedthese benefits properly.

Based on our testing, Mr. Hernandezs benefits have been accrued properlyand in accordance with policy.


18/53

14


Objective 5: Determine if the Districts Record Retention guideline was adhered to (for employee access card and calendars).Procedures Results Summary

1. Inquire of the Districts Chief Information Officer and Director of ITInfrastructure and Security how the MS Exchange system retains network

email.

We inquired of the Districts Chief Information Officer, and the Director of ITInfrastructure and Security who indicated that MS Exchange policies are

configured to only retain network email that has not been permanentlydeleted. MS Exchange policies will retain permanently deleted email forfour days. Any email moved to a personal or archive folder will be removedfrom the network email account.

Currently, the Districts retention configuration is to perform a full backup ofthe MS Exchange servers weekly (Saturdays) and incremental backupsdaily (Sunday - Friday). The weekly and incremental backup use 30 tapesin a rotation and are then reused which provides about 30 days of networkemail to recover if there is failure.

2. Inquire of the Districts Team Lead for Domains and Exchange how theback-up process is designed.

We inquired of the Districts Team Lead for Domains and Exchange, whocorroborated that MS Exchange and Tivoli Storage Manager, is designed to

back-up the MS Exchange servers for 30 days.

3. Perform system queries with the Districts MS Exchange Administrators tovalidate the MS Exchange system's configuration relating to emailretention.

We performed system queries and noted that all email in the network accountwill be retained except for permanently deleted email over four days.Additionally, the network account will stop receiving email when the account isat or over 135,000 KB.

4. Perform system queries with the Districts Team Lead for Domains andExchange to validate the Tivoli Storage Management system'sconfiguration relating to email backup.

We performed system queries with the Districts Team Lead for Domains andExhanges in order to obtain the Tivoli's configurations for email back-upsystem. This confirmed the 30 day back-up settings.


19/53

15


Objective 5:Determine if the Districts Record Retention guideline was adhered to (for employee access card and calendars). -continued

Procedures Results Summary5. Obtain and inspect the Districts Electronic Communications Retention

policy (that includes email) to validate the system configuration complieswith the policy.

There is no single retention period that applies to all electronic messages orcommunications, whether they are sent by email, instant messaging, textmessaging (such as SMS, Blackberry PIN, etc), multimedia messaging (suchas MMS), chat messaging, social networking (such as Facebook, Twitter,etc.), or any other current or future electronic messaging technology ordevice. Retention periods are determined by the content, nature, and purposeof records, and are set based on their legal, fiscal, administrative, andhistorical values, regardless of the format in which they reside or the methodby which they are transmitted. The retention of any particular electronic

message will generally be the same as the retention for records in any otherformat that document the same program function or activity.

We obtained and inspected the Districts email retention policy from the

following website link and noted the following:http://www.palmbeachschools.org/records/RecordsRetention.asp

As set forth in District Record Retention Policy for ElectronicCommunications, there is no single retention period that applies to allelectronic messages, including email since electronic messages orcommunications include records that relate to a variety of programs andactivities. Rather, the required retention period is determined by thecontent, nature, and purpose of the records. The end user needs to knowand apply the record retention policy based on the type of record and thenretain it for the specified retention period for that type of record. Forinstance, if the email relates to budget records then it has to be retained for

the period specified for budget records. If the email is just a communicationreminder to meet for lunch, this activity would fall under transitory and couldbe disposed when the employee determines the record is no longerrelevant or obsolete. This retention policy for emails is consistent with theretention for records in any other format that document the same programfunction or activity.

Further, an employee could retain the email and place in the appropriate fileand then delete the record. The policy does not state that it has to beretained electronically but just retained; thus it may be retained in a printedformat.

Based on the above two scenarios, we cannot conclude that all emails wereretained for the applicable required retention period.

The District has designed their Courion Identity Management System toautomatically deactivate terminated employees Active Directory account toprevent network access to terminated employees. Additionally, Courionruns a script to remove terminated employees MS Outlook account sixmonths after the termination date permanently deleting the employeesemail and calendar information.

Based on discussions with IT Management, no policy or procedure is inplace to image terminated employees hard drives to preserve emailarchived or stored on local hard drives to ensure the District is incompliance with the record retention requirements.
http://www.palmbeachschools.org/records/RecordsRetention.asphttp://www.palmbeachschools.org/records/RecordsRetention.asphttp://www.palmbeachschools.org/records/RecordsRetention.asp


20/53

16


Objective 5:Determine if the Districts Record Retention guideline was adhered to (for employee access card and calendars). -continued

Procedures Results Summary6. Obtain and inspect the Districts Access Control Records Retention Policy

to determine if the policy was adhered to for Mr. Hernandez.

This record series consists of records pertaining to employee or contractoraccess to a facility or resource (e.g., office building, secure office area,parking facility, computer network) including, but not limited to,arrival/departure data, key assignment records, identification badge records,parking assignment records, network account and permission records, etc.

.

We inquired of the Districts Police Department Management regarding the

Access Control Records retention process related to the termination of Mr.Hernandez. In fulfilling the first public request for records regarding Mr.Hernandez, the District discovered that its procedures to remove terminatedemployees security badge access in the AMAG security system was todelete the employees profile. Deleting the employees profile resulted indeleting the record/history stored in the profile. Knowing that the policydictated this record/history be retained, the District was able to recover Mr.Hernandezs history. Additionally, the District changed their procedures forremoving access to terminated employees by deactivating the employeewithin AMAG. Deactivating the employee will immediate deactivate thesecurity cards access as well as preserve the history of the employee.Currently, AMAG is configured to keep one year of access history detailing

where and when a user accessed a secure area as well as if an employeetried to access an area not authorized by the badge. The PoliceDepartment Management also noted that Mr. Hernandez worked at aschool that did not utilize security cards to control access to the buildingand his recovered log had no activity.

We inspected a Florida Department of State email interpreting access auditlogs detailing employee arrival and departure activity falls under the GS1-SL Item #54 Visitor/Entry Logs retention schedule. This required only a 30day retention period. The 100 days of retained user access history notedabove complies with this policy.

Based on discussions with Police Department Management and review of

the Florida Department of State interpretation, the District appearscompliant with the record retention policy regarding access activity logs.


21/53

17


Objective 6: Identify policies or procedures to prevent similar issues from happening again.

Procedures Results Summary7. Obtain and inspect Employee Calendar Retention Policy to determine if

the policy was adhered to for Mr. Hernandez.

This record series consists of calendars, appointment books, planners, orother records showing official daily appointments and meetings. The seriesmight also include lists of prioritized daily tasks, background materials,issues for discussion, and speaking points or remarks

In conjunction with our review of email retention procedures detailed above, wenoted that the retention process for calendar records in Outlook is the same.

However, the District Retention Policy for calendars specifies retention of oneanniversary year. In the case of Mr. Hernandez, based upon our review of hisOutlook calendar, we noted that IT Management prevented the Courion script toremove Outlook accounts from deleting his account to preserve the networkemail and calendar. Although the District is in compliance with the RetentionPolicy regarding Jeffrey Hernandez calendar data, the District may not be incompliance for other terminated employees because the Courion scriptautomatically deletes employee accounts six months after termination.

Review the following related rules and District policies in conjunction with ourprocedures performed for objectives 1-6, 7-8:

Policy 2.28 School District owned Vehicles Policy 3.02 Code of Ethics Policy 3.20 Resignation and Termination of Employment Policy 3.29 Acceptable use of Technology by Employees Policy 3.80 Leave of Absence School Districts Record Retention Schedule Florida Statutes, 1012.61 Sick Leave, 1012.65 Terminal Pay for

Accrued Vacation Leave, and 1012.68 Records of Absences IRS Publication 15-B

We reviewed the related rules and District policies, and took them intoconsideration in the course of our procedures related to objectives 1-5, 7-8.

We have enumerated various recommendations included in theRecommendations and Management Response section that relate topolicies and procedures that may help to prevent similar issues fromhappening again.


22/53

18


Objectives 7 & 8Identify misconducts, if any, on the part of the employees supervisor and identify misconducts or errors, if any,made by current employees.

Procedures Results Summary1. Conduct interviews with relevant parties including the Superintendent,

District Auditor, Chief Information Officer, Chief Counsel, Audit CommitteeChair, Chief of Police, Administrative Assistants to the Superintendentand Mr. Hernandez, the Chief Operating Officer, the Chief FinancialOfficer, and certain other District management, staff and the stakeholders/ parents.

Through our interviews, review of documents and files provided by the School

District, and review of the School Board policy and related rules, we noted nomisconduct on the part of the employees supervisor and no misconduct madeby current employees. In addition, we noted no errors other than thoseincluded in this report.

2. Inquire of the Districts MS Exchange Administrators how the emailarchiving rules are established in MS Exchange.

We inquired of the Director of IT Infrastructure and Security, the IT SecuritySpecialist, the MS Exchange Administrator, the MS Exchange Administrator,and the Team Lead for Domains and Exchange, who noted the following:

Jeffrey Hernandez email account was shut down on July 2, 2010.

Currion will delete an active directory account after 6 months; however, the

IT department stopped the process to preserve the information. Mr.Hernandez had several MS Exchange Administrators during hisemployment with the school district.

Computer images are not taken of employee's computers upon terminationthat would preserve emails or documents.

Mr. Hernandez's computer was repurposed meaning that the IT Departmentinstalled new software although it had not been reissued to another user.


23/53

19


Objectives 7 & 8Identify misconducts, if any, on the part of the employees supervisor and identify misconducts or errors, if any,made by current employees. - continued

Procedures Results Summary3. Perform system queries with the Districts Exchange Administrators and

Team Lead for Domains and Exchange to validate network access toJeffrey Hernandez has been disabled and to identify users with access toJeffrey Hernandez's network email account.

We performed system queries with the Districts Exchange Administrators and

Team Lead for Domains and Exchange to validate network access to JeffreyHernandez has been disabled and to identify users with access to JeffreyHernandez's network email account and noted the following:

Network access for Jeffrey Hernandez was disabled on July 2, 2010.

We noted that there were three delegates with permitted access to Mr.Hernandez's email account granting them access to his account.

During the interview process with District IT Management, one DistrictAdministrative Assistant was identified to have access to Mr. HernandezsOutlook account. However, the Administrative Assistant was not listed as adelegate but had read and write permissions granted in Mr. Hernandezsaccount. This indicates that the Administrative Assistant had access to Mr.

Hernandez's email account at one point in time. Two other AdministrativeAssistants were listed as delegates to Mr. Hernandezs account but had notbeen granted any permissions to read or write within Mr. HernandezsOutlook account. Based on the delegate access at the time of review, wecannot determine whether the two Administrative Assistants had access toMr. Hernandez's email at any time.

Mr. Hernandezs primary administrative assistant had full access rights toread and create Mr. Hernandez's email.


24/53

20



Procedures Results Summary4. Perform system queries with the Districts Exchange Administrators and

Team Lead for Domains and Exchange to identify users with access toDr. Johnson's network email account.

We performed system queries with the Districts Exchange Administrators and

Team Lead for Domains and Exchange to identify users with access to Dr.Johnson's network email account and noted the following:

There were two email accounts for Dr. Johnson: A non-published emailaccount and a Blackberry account. His primary email account was a non-published account managed by his executive assistant. His executiveassistant logged into this account and received Dr. Johnson's email. Theother email account was for a Blackberry PDA email account established inthe summer of 2010 to view emails while on vacation.

Executive assistant was the delegate with permitted access to Dr.Johnson's email account. No permissions were granted to her.

Through discussions with the IT Team, Dr. Johnsons executive assistant

had Dr. Johnson's email account and signed into it directly eliminating theneed for delegate permissions.

5. Perform system queries with the Districts Exchange Administrators andTeam Lead for Domains and Exchange to identify the user definedarchiving settings for Dr. Johnson, Mr. Jeffrey Hernandez, Joyce Beninati(Dr. Johnson Executive Assistant) and Kristina Doctor (Mr. HernandezAdministrative Assistant).

We performed system queries with the Districts Exchange Administrators andTeam Lead for Domains and Exchange to identify the user defined archivingsettings for Dr. Johnson, Jeffrey Hernandez, Dr. Johnsons executive assistantand Mr. Hernandezs administrative assistant and noted the following:

Jeffrey Hernandez's computer was repurposed so the Auto Archiving ruleswere not detailed.

The system is configured to run auto archive every 14 days to archive emailolder than 6 months. However, each email account is configured to prompt

before auto archiving allowing the user to prevent email from archiving. Ifusers select the option to auto archive when prompted then email olderthan 6 months would be stored on their computer's hard drive. Additionally,users can set up offline personal email folders rather than the archivingfunctionality.


25/53

21



Procedures Results Summary6. Inspect the Districts Police Department report detailing the procedures

performed by the Police Department to collect and review employee'sdata.

We inspected the Districts Police Department report detailing the procedures

performed by the Police Department to collect and review employee's data andnoted the following:

The Investigative Officer filed a Non-Criminal Personnel Investigation reporton January 11, 2011 outlining his procedures of determining the personnelthat may have had access to Mr. Jeffrey Hernandez's computer andnetwork email account as well as how he collected the computer images ofeach identified non-IT person.

The Districts Network Administrators have access to all employees emailaccounts as part of their normal day to day activities and were excludedfrom the population.

The Investigative Officer noted that there was a gap in email beginning in

January 2010 but could not conclude whether any employee misconductoccurred.

Throughout our testing and inquiries, we did not identify any misconduct orerrors, other than those outlined in this report, on the part of the employeessupervisor or by any current employees.


26/53

22



Procedures Results Summary7. Obtain archived and network emails to and from Mr. Hernandez and Dr.

Johnson, as well as their respective administrative assistants.

Archived:

We obtained images of harddrives of all computers (8) used by the partiesin interest, including the laptop and desktop computers used by Mr.Hernandez and the computer used by Dr. Johnson

We located all electronic mail files (Outlook, Outlook Express, Lotus Notes,Netscape, Yahoo, and Hotmail) and extracted all emails in these files.

The extracted emails were queried to select all emails that were sentbetween 12/1/2009 and 7/1/2010, and that contained any of the various keywords and phrases we designated as relevant to our objectives.

Network: We performed system queries with the Exchange Administrator, the

Exchange Administrator and the Team Lead for Domains and Exchange, tocollect the network email for Dr. Johnson's Blackberry account, Dr.Johnson's non-published Superintendent account, Jeffrey Hernandez'saccount, Mr. Hernandezs administrative assistant account and Dr.Johnsons executive assistants account.

We observed the Exchange Administrators access each network emailaccount and save the contents as a PST file onto USB Drive provided byRSM McGladrey.

We conducted an analysis on the email by opening the PST files in MSOutlook on a McGladrey employee computer and searching the email filesusing the following criteria:

- Messages sent or received between December 1, 2009, and July 1,2010, and

- Messages containing particular keywords or phrases.


27/53

23



Procedures Results Summary8. Review archived and network emails obtained in procedure 7 and

document any potential misconduct by Dr. Johnson.

We reviewed the emails obtained from the queries noted in procedure 7. We did

not identify any misconduct on the part of the employees supervisor or by anycurrent employees.

For 2 of 11 TDEs we reviewed, the supervisor properly signed the TDE;however, the Approved box was not checked.


28/53

Recommendations and Management Response


29/53

24


Recommendation #1 Policy 3.80 Leave of Absence Management ResponsePolicy 3.80 Leave of Absence states that leave shall be officially grantedin advance by the School Board and shall be used for purposes set forth inthe leave application. The types of leave that are included in thisrequirement are personal leave, vacation, sick leave, and others which are

listed in the policy. During our testing, we noted that for 10 of 11 TDEswe reviewed, the supervisors approval signatures were dated after theleave of absence was taken, which violates Policy 3.80 Leave ofAbsence.

We recommend that the automated leave request process require leave tobe approved by the supervisor prior to the date the leave is to be taken.This will prevent late approvals and will help to ensure compliance withPolicy 3.80.

Furthermore, we recommend that the Policy specify which types of leaveand under what circumstances that such leave is required to be approvedbefore the leave is taken. For example, it is not practical to approve sick

leave before it is taken, as an employee generally does not know inadvance when they will use sick leave. Therefore, the Policy shouldspecify the approval process for each type of leave as qualified for anyspecial circumstances, as applicable.

Policy 3.80 Leave of Absence specifies that leave shall be officiallygranted in advance although leave for sickness or other emergencies maybe deemed to be granted in advance if prompt report is made to theproper authority. The policy does not specify that approval must be in

writing. Management agrees that the policy needs to be clarified. Basedon inherent limitations management has determined it is best to revise thepolicy to require written/electronic approval be timely or as the policystates, promptly.

Based on the findings within this report, it appears that Mr. Hernandezreceived pay for three days he was not at work or on approved leave.Management intends to request Mr. Hernandez to either reimburse thedistrict $1,709.50 to recover the net pay associated with these days orsubstantiate that he worked for the School District of Palm Beach Countyon these dates (Jan. 19, 2010, April 27, 2010 & May 11, 2010).

The report also indicates that Mr. Hernandez utilized sick leave in order towork for Memphis City Schools on five dates (April 13-14, April 20-22,2010). Management agrees this constitutes a violation of District Policy3.80. However, there is no financial impact as Mr. Hernandez would havebeen paid out upon termination for any remaining leave balances.


30/53

25


Recommendation #2 Leave of Absence Request Process Management ResponseThe Districts current Leave Request processes and procedures areautomated, but are not linked to the accounting system PeopleSoft.Furthermore, we noted that TDEs were altered manually and we alsonoted that for 2 of 11 TDEs we reviewed, the supervisor signed the TDE

but he did not check the Approved or Not Approved box. These thingsdefeat the purpose of an electronic form, which is to circumvent manualintervention and mitigate errors.

We recommend that the District link the automated process to theaccounting software PeopleSoft. We are aware that the District is takingsteps to do so. This would reduce errors in the leave reporting process byeliminating manual modifications and reducing approval lag time.

Further, the Districts TDE forms use terms for types of leave that do notmatch the terms as defined in the District Policy 3.80 Leave of Absence.For example, the TDE form lists Vacation as a leave option, but the policyuses the term Annual Leave.

Until the process is fully automated, we recommend that the Districtupdate the TDE forms to reflect the current version of Policy 3.80 Leaveof Absence.

Management concurs and plans to implement the PeopleSoft AbsenceManagement module in July 2012. The new module will interface withexisting PeopleSoft modules; the employee will initiate the process inPeopleSoft, the approval(s) will be routed through the system and after

the leave is approved, the time and type of leave will be automaticallyentered into the system. Management agrees the new process willreduce manual input errors, eliminate manual modifications and reduceapproval lag time, although it is still expected that certain types of leavemay be approved subsequent to the actual date of leave.

Recommendation #3 Vehicle Log Policy Management Response

The Districts Internal Audit Report Follow-Up on Take-Home DistrictVehicles Audit dated February 11, 2011 noted that Mr. Hernandez did notkeep a vehicle log, as required by policy.

We recommend that the District enforce Policy 2.28 School DistrictOwned Vehicles requiring all users of District vehicles to maintain avehicle utilization log.

Management concurs. Take home vehicles have since been limited toSchool Police, which are exempted from the IRS regulations as well asthe four area superintendents. Since January 1, 2011 the four areasuperintendents maintain monthly vehicle utilization logs that areapproved by the Chief Academic Officer (CAO) (previously Chief Learning

Officer (CLO)) and subsequently forwarded to the General ManagerTransportation/ Maintenance (GM). The GM reviews the monthly logs forthe proper approvals and maintains a copy on file.


31/53

26

Recommendations and Management Response - continued

Recommendation #4 Email Retention Policy Management Response

As set forth in District Record Retention Policy for ElectronicCommunications, there is no single retention period that applies to allelectronic messages, including email since electronic messages or

communications include records that relate to a variety of programs andactivities. Rather, the required retention period is determined by thecontent, nature, and purpose of the records. The end user needs toknow and apply the record retention policy based on the type of recordand then retain it for the specified retention period for that type of record.

Based on discussions with District IT Management, we understand thatthe District is migrating from its present email system to Google Mail. Werecommend that in conjunction with this that the District considerconfiguring Google Mails back-up and retention settings such that theDistrict would be in control of the retention compliance process. Thiswould facilitate adherence to the Districts Electronic Communications andCalendar (Outlook) Retention Policies as well as the Florida Statute

Retention requirements.

District IT Management concurs. We will configure Google to retain, asper the Districts Retention Policy, both email and calendar in the conditionit exists when the user departs the District.


32/53

27

Recommendations and Management Response - continued

Recommendation #5 Calendar Retention Policy Management Response

In conjunction with our email retention procedures detailed above, wenoted that the retention process for calendar records in Outlook is thesame. However, the District Retention Policy for calendars specifies

retention of one anniversary year. In the case of Mr. Hernandez, basedupon our review of his Outlook calendar, we noted that IT Managementprevented the Courion script from removing his Outlook account topreserve the network email and calendar. Although the District is incompliance with the Retention Policy regarding Jeffrey Hernandezcalendar data, the District may not be in compliance for other terminatedemployees because the Courion script automatically deletes employeeaccounts six months after termination.

Based on discussions with District IT Management, we understand thatthe District is migrating from its present email system to Google Mail. Werecommend that in conjunction with this that the District consider

configuring Google Mails back-up and retention settings such that theDistrict would be in control of the retention compliance process. Thiswould facilitate adherence to the Districts Electronic Communicationsand Calendar (Outlook) Retention Policies as well as the Florida StatuteRetention requirements

In the meantime, we recommend that the District evaluate extending theOutlook account retention to one year from the date of termination tomaintain compliance with current retention policies.

District IT Management concurs. The Districts plan is to implementGoogle email on June 13, 2011. On that date, the District will possess thecapability necessary to retain email accounts for over one year after the

date of separation of an employee.

Recommendation #6Terminated Employees Hard Drives Management Response

Based on discussions with IT Management, no policy or procedure is in

place to image terminated employees hard drives to capture all data filesstored on the hard drive.

We recommend that the District evaluate the cost benefit to implement apolicy and/or procedure to image all terminated employee hard drives Ata minimum the District should consider implementing this policy for allsenior management. This will preserve any email archived or stored onlocal hard drives and other records that should be retained to ensure theDistrict is in compliance with the Districts record retention requirements.

District IT Management concurs. The Districts plan is to implement

Google email and Google Calendar on June 13, 2011. On that date, theDistrict will not need to retain local computer hard drive data for emailbecause all original email will be saved, accessed, and archived directlyfrom Google online.

The Districts IT management will prepare a cost/benefit analysis ofcapturing all data files stored on the hard drive for all separated employees(non-email related items), and will provide a recommendation to the boardas this will bear a cost.


33/53

Management Response from Mr. William Malone,

Acting Superintendent,Palm Beach County School District


34/53


35/53

McGladrey Response

April 18, 2011

Page Two

Recommendation #1 Policy 3.80 Leave of Absence

Management Response:

Policy 3.80 Leave of Absence specifies that leave shall be officially granted in advance although leave

for sickness or other emergencies may be deemed to be granted in advance if prompt report is made to

the proper authority. The policy does not specify that approval must be in writing. Management agrees

that the policy needs to be clarified. Based on inherent limitations management has determined it isbest to revise the policy to require written/electronic approval be timely or as the policy states,

promptly.

Based on the findings within this report, it appears Mr. Hernandez received pay for three days he was

not at work or on approved leave. Management intends to request Mr. Hernandez to either reimburse

the district $1,709.50 to recover the net pay associated with these days or substantiate that he worked

for the School District of Palm Beach County on these dates (Jan. 19, 2010, April 27, 2010 & May 11,

2010).

The report also indicates that Mr. Hernandez utilized sick leave in order to work for Memphis County

Schools on five dates (April 13-14, April 20-22, 2010). Management agrees this constitutes a violation

of District Policy 3.80. However, there is no financial impact as Mr. Hernandez would have been paid

out upon termination for any remaining leave balances.

Recommendation #2 Leave of Absences Request Process


Management concurs and plans to implement the PeopleSoft Absence Management module in July


36/53

McGladrey Response

April 18, 2011

Page Three

Recommendation #3 Vehicle Log Policy


Management concurs. Take home vehicles have since been limited to School Police, which are

exempted from the IRS regulations as well as the four area superintendents. Since January 1, 2011 the

four area superintendents maintain monthly vehicle utilization logs that are approved by the Chief

Academic Officer (CAO) (previously Chief Learning Officer (CLO)) and subsequently forwarded to the

General Manager Transportation/ Maintenance (GM). The GM reviews the monthly logs for the properapprovals and maintains a copy on file.

Recommendation #4 Email Retention Policy


District IT Management concurs. We will configure Google to retain, as per the Districts Retention

Policy, both email and calendar in the condition it exists when the user departs the District.

Recommendation #5 Calendar Retention Policy


District IT Management concurs. The Districts plan is to implement Google email on June 13, 2011. On

that date, the District will possess the capability necessary to retain email accounts for over one year

after date of separation of an employee.

Recommendation #6 Terminated Employees Hard Drive


37/53

Management Response from Dr. Art Johnson,

Former Superintendent, Palm Beach County School District


38/53


39/53


40/53


41/53

Mr. Hernandez, Former District Employee


42/53


43/53


44/53


45/53


46/53

Appendix ACalendar regarding Mr. Hernandez during January through June 2010


47/53


48/53

Sunday Monday Tuesday Wednesday Thursday Friday Saturday

Worked in

Memphis *

Legend:

Sick Day at PBCSD

Annual Leave at PBCSD

Personal Day at PBCSD

* Exception as noted in Objective #4

January 2010

No days taken off from PBCSD in January

5 6 7

2

3 4

12 13 14

9

10

8

11

19 20 21

16

17

15

18

26

23

24

22

25

1

27

Notes:

28 29 30

31 Notes:


49/53


Worked in

Memphis

Worked in

Memphis

Legend:

Sick Day at PBCSD



February 2010

6

7 9 108 11 12 13

14 16 1715 18 19 20

21 23 2422 25 26 27

51 2 3 4

Notes:

Notes:

28


50/53


51/53


Billed MCS Billed MCS

Worked in

Memphis

Worked in

Memphis

Worked in

Memphis*

Worked in

Memphis*

Worked in

Memphis*

Worked in

Memphis*

Worked in

Memphis*

Worked in

Memphis

Worked in

Memphis

Legend:

Sick Day at PBCSD




April 2010

3

4 5 6 10

11 17

18 24

25

12 13

19 20

26

7 98

14 1615

21 2322

1 2Notes:

27 28 Notes:29 30


52/53


Billed MCS Billed MCS Billed MCS Billed MCS Billed MCS

Worked in Memphis

*

Worked in Memphis

Legend:

Sick Day at PBCSD




May 2010

2 3

1

4 5 6 7

9 10

8

11 12 13 14

16 17

15

18 19 20 21

23 24

22

25

Notes:

26 27 28 29

30 Notes:31


53/53


4 hours annual

leave; 6 hours

Personal unpaid

leave

Legend:

Sick Day at PBCSD



Personal unpaid leave

from PBCSD

Note: There are no records of the days Mr. Hernandez worked in Memphis after May 12, 2010.

June 2010

Mr. Hernandez's final day of work at PBCSD was

6/30/10

4 5

6 8 9 1110 12

13 19

20 26

27

14 15 16 1817

22 23 2524

28

7

21

1 2 3Notes:

29 Notes:30

Pbsd Final Draft Reports

Documents