State Agency Information Systems: Reviewing Security Controls in Selected State Agencies - Kansas State University (CY 2016)

View Abstract

Published: DECEMBER, 2016

NULL

Kansas Department of Revenue KanDrive IT Project Quarter Ending September 30, 2016

View Abstract

Published: DECEMBER, 2016

As of September 30, 2016, we consider the KanDrive (later renamed KanLicense) IT project within the Kansas Department of Revenue (KDOR) to be in caution status. The purpose of the KanDrive project is to replace KDOR’s old mainframe driver’s license system. The KanDrive project started as another project in 2007, as the DMV project. Phase one of the DMV project, which included the new motor vehicle titling and registration system, was deployed in May 2012. However, the department stopped the project in November 2015, before completing the driver’s license system in phase two. The KanDrive project was created to complete that project phase at an estimated $6 million and with a scheduled completion date of December 2017. We selected the KanDrive project for continuous monitoring due to its prior problems, criticality, and cost. During this quarter, we found the project scope is satisfactory, based on a clearly defined scope and controls to handle additional major improvements ideas in a separate project. Similarly, we considered project cost to be satisfactory and an improvement from our last report. However, we considered the project schedule to be in caution status because certain work segments are behind schedule and other work has been delayed. KDOR staff hold weekly conference calls to discuss progress with its contractor MorphoTrust. However, the contract has insufficient penalty clauses to ensure MorphoTrust meets intermediate milestones. Lastly, the project quality received a caution status, an improvement from last quarter’s rating of unsatisfactory. That is due to increased efforts on IT security during this quarter, but the first deliverable is not due to be completed until the end of November 2016.

State Agency Information Systems: Reviewing Security Controls in Selected State Agencies - 3 year Summary Report

View Abstract

Published: DECEMBER, 2016

Two-thirds of the 20 agencies we reviewed between 2014 and 2016 did not substantively comply with all applicable IT security standards. Specifically, few agencies properly scanned their workstations and servers or patched known vulnerabilities, increasing the number of weaknesses hackers might exploit. Many agencies used unsupported software or had vulnerable websites, creating risks which can be difficult to mitigate. Half the agencies had poor access or environmental controls for their data centers, increasing the risk of data loss. Several agencies did not adopt strong password settings, increasing their exposure to brute force attacks. Additionally, several agencies did not adequately protect their network boundaries or did not sufficiently protect their systems from malicious code, and they did not conduct background checks or follow security protocols for departing staff, all of which could lead to security incidents. Lastly, many agencies did not conduct security awareness training, and our social engineering tests demonstrated a lack of understanding for security protocols.

K-12 Federal Education Funds: Evaluating the Costs and Benefits Associated with K-12 Federal Education Funding

View Abstract

Published: DECEMBER, 2016

In terms of benefits, Kansas received about $507 million in K-12 education funding from the federal government in school year 2015-16. The main purposes of the six federal K-12 programs we reviewed are to help disadvantaged students and to provide funds for additional school services. These programs give districts significant discretion in how they spend federal K-12 funds. The 10 districts we reviewed in detail spent most of these funds on staff compensation. In terms of costs and obligations, we found accepting federal funds can limit budget flexibility because of maintenance of effort requirements. Additionally, by accepting federal funds, the state agrees to adopt the federal government’s K-12 education initiatives. Federal K-12 programs also impose some administrative requirements, but the cost of meeting these requirements is minimal and can be paid for with federal funds. Finally, only the National School Lunch Program imposes operational costs on school districts through its increased nutritional standards. In comparing the benefits of accepting federal funds with the costs and obligations, we found the administrative and operational costs are small compared to the amount school districts receive. In addition, school administrators overwhelmingly reported the costs associated with federal funding were worth the benefits. However, we could not objectively quantify or compare the budget and policy restrictions that come with accepting federal funds to the benefits. Finally, opting out of federal funding would result in increased state and local costs or reduced services for students.

Statewide Financial Compliance Audit--Fiscal Year 2016 Part 1, Office of the Chief Financial Officer Comprehensive Annual Financial Report

View Abstract

Published: DECEMBER, 2016

State law calls for an annual audit of the general purpose financial statements and “the financial affairs and transactions of a state agency required to comply with federal government audit requirements…” CliftonLarsonAllen, under contract with Legislative Post Audit, conducted this two-part audit. This first part is the report on the state’s Comprehensive Annual Financial Report (CAFR). The second part, the Independent Auditor’s Report on Compliance for the Major Program and on Internal Control over Compliance Required by the Uniform Guidance, will be issued as a separate report. The auditors expressed an unmodified opinion on the financial statements, meaning that, financial statements present the state’s financial position fairly and in conformity with generally accepted accounting principles in all material respects. However, the auditors did emphasize two matters with regard to the financial statements. First, at the end of fiscal year 2016, the state had a deficit in its general fund of $504 million which raises concerns about the state’s ability to meet its future financial obligations. Second, adjustments were made to the beginning net positions and fund balances to correct errors from prior years. The audit disclosed no instances of noncompliance with applicable legal requirements that were material to the state’s financial statements. However, the auditors reported two material weaknesses in the state’s internal control over financial reporting. The material weaknesses included various issues related to identification of errors that occurred in prior years. Because of this, some previous fund balances were restated.

Kansas Public Employees Retirement System: Financial Audit of Fiscal Year 2016

View Abstract

Published: DECEMBER, 2016

State law requires an annual financial audit of the Kansas Public Employees Retirement System. CliftonLarsonAllen, a certified public accounting firm under contract with Legislative Post Audit, conducted this audit. The auditors expressed an unmodified opinion on the financial statements, meaning that the financial statements present the Kansas Public Employees Retirement System’s financial position fairly and in conformity with generally accepted accounting principles in all material respects. In addition, the audit disclosed no significant deficiencies in KPERS’ internal control over financial reporting and no instances of noncompliance with legal requirements that were material to the financial statements.

Kansas Lottery: Financial Audit of Fiscal Year 2016

View Abstract

Published: DECEMBER, 2016

State law requires an annual financial audit of the Kansas Lottery. RubinBrown, a certified public accounting firm under contract with Legislative Post Audit, conducted this audit. The auditors expressed an unmodified opinion on the financial statements, meaning that the financial statements present the Kansas Lottery’s financial position fairly and in conformity with generally accepted accounting principles in all material respects. In addition, the audit disclosed no significant deficiencies in the Kansas Lottery’s internal control over financial reporting and no instances of noncompliance with legal requirements that were material to the financial statements.

Examining Selected Financial Management Practices of the State Treasurer's Office, Fiscal Year 2016

View Abstract

Published: DECEMBER, 2016

The Legislative Post Audit Act requires this examination of the State Treasurer’s Office. CliftonLarsonAllen, a certified public accounting firm under contract with Legislative Post Audit, conducted this examination. The examination addresses 10 selected financial management responsibilities of the State Treasurer’s Office. The auditors found that the management’s assertions were fairly stated in all material respects, meaning that, for the areas examined, the Office complied with the applicable statute.

Examining Selected Financial Management Practices of the Pooled Money Investment Board, Fiscal Year 2016

View Abstract

Published: DECEMBER, 2016

The Legislative Post Audit Act requires this examination of the Pooled Money Investment Board. CliftonLarsonAllen, a certified public accounting firm under contract with Legislative Post Audit, conducted this examination. The examination addresses nine selected financial management responsibilities of the Pooled Money Investment Board, mainly those involving the board's fiscal accountability for moneys. The auditors identified no deficiencies in the board’s practices and found that the fiscal year 2016 weighted average monthly yield of 0.44% was comparable to the benchmark of 0.38%.

The Kansas 911 Act: Reviewing Implementation of the 2012 Act

View Abstract

Published: DECEMBER, 2016

The Kansas 911 Act requires this triennial audit of the 911 System. Bauknight Pietras & Stormer, P.A., under contract with Legislative Post Audit, conducted this audit. The audit is to determine: (1) the status of 911 service implementation; (2) whether the moneys received by PSAPs pursuant to this act are being used appropriately; and (3) whether the amount of moneys collected pursuant to this act is adequate. The auditors determined that migration to NG911 is in progress. Some PSAPs joined or will join the state-hosted platform, some joined other platforms, some implemented standalone systems, and some are undecided. The auditors found adequate documentation to support 123 of 128 the expenditures tested. Of the five transactions that the auditors questioned, the 911 Coordinating Council had already determined that two were not allowable or not adequately supported and are in the process of recouping the funds. The three transactions determined to be exceptions included $1,458 in expenditures that were determined to be unallowable. Finally, the auditors determined that about half of the PSAPs that responded to a survey believed that current funding is adequate, while the other half did not. PSAP funding increased only marginally since the last audit three years ago. Costs are expected to rise, and PSAPs expressed concerns about adequate funding.

Kansas Lottery: Security in the Operation of the Kansas Lottery

View Abstract

Published: DECEMBER, 2016

NULL

State Agency Information Systems: Reviewing Security Controls in Selected State Agencies - Kansas University Medical Center (Kansas City Campus) (CY 2016)

View Abstract

Published: SEPTEMBER, 2016

NULL

State Agency Information Systems: Reviewing Security Controls in Selected State Agencies - Kansas University Medical Center (Wichita Campus) (CY 2016)

View Abstract

Published: SEPTEMBER, 2016

NULL

State Agency Information Systems: Reviewing Security Controls in Selected State Agencies - Emporia State University (CY 2016)

View Abstract

Published: SEPTEMBER, 2016

NULL

State Agency Information Systems: Reviewing Security Controls in Selected State Agencies - Wichita State University (CY 2016)

View Abstract

Published: SEPTEMBER, 2016

NULL

Foster Care and Adoption in Kansas: Reviewing Various Issues Related to The State’s Foster Care and Adoption System, Part 2

View Abstract

Published: SEPTEMBER, 2016

We assessed DCF’s compliance with applicable state and federal laws governing the foster care system. We found that DCF has to meet many state and federal requirements for the foster care program. However, DCF had not followed some of the safety and living condition requirements we reviewed in Part 1 of the audit. Additionally, according to the 2014 and 2015 statewide single audits, DCF materially complied with most, but not all federal requirements. Further, DCF self-reported data shows Kansas met or exceeded about half of the federal outcome requirements for fiscal year 2016, but did not meet the others. Finally, we found DCF must implement a program improvement plan to address issues identified by a 2015 federal review.

KanCare: Reviewing the Timeliness of Medicaid Eligibility Determinations

View Abstract

Published: SEPTEMBER, 2016

In July 2015, the state launched the Kansas Eligibility Enforcement System (KEES)—a web-based application intended to help streamline eligibility determination for state medical and social service benefits, including Medicaid. As of June 2016, the state of Kansas had a backlog of 14,000 Medicaid applications. KDHE officials told us implementing the new KEES system and an influx of applications related to the federal Affordable Care Act contributed to the backlog. KDHE has tried to address the backlog by increasing staffing resources and modifying KEES to fix technical glitches. According to KEES’ reports, KDHE has reduced the backlog by thousands in recent months and hopes to have it resolved by October 2016. In its efforts to address the backlog, KDHE has stopped reviewing renewal applications. Further, Kansas is not in compliance with federal law related to timely eligibility determinations.

Kansas Department of Revenue KanDrive IT Project Quarter Ending June 30, 2016

View Abstract

Published: SEPTEMBER, 2016

As of June 30, 2016, we consider the KanDrive (later renamed KanLicense) IT project within the Kansas Department of Revenue (KDOR) to be in caution status. The purpose of the KanDrive project is to replace KDOR’s old mainframe driver’s license system. The KanDrive project started as another project almost 10 years ago, as the DMV project. Phase one of the DMV project, which included the new motor vehicle titling and registration system, was deployed in May 2012. However, the department stopped the project in November 2016, before completing the driver’s license system in phase two. The KanDrive project was created to complete that project phase at an estimate $6 million and with a scheduled completion date of December 2017. We selected the KanDrive project for continuous monitoring due to its prior problems, criticality, and cost. During this quarter, we found the project scope is satisfactory, based on a clearly defined scope and controls to handle additional major improvements ideas in a separate project. However, we considered the project schedule to be in caution status because certain work segments are behind schedule and other work has been delayed. The KanDrive project has a designated project manager to oversee successful integration with the existing driver’s license information and issuance system which we considered satisfactory. We found the project cost to be in caution status. That’s because internal project management has approved a cumulative cost increase of $1 million thus far, but those revised cost baselines were not properly disclosed outside the agency. Lastly, the project quality received a caution status because it does not include sufficient consideration for IT security, and because the periodic independent verification and validation assessments, which were part of the project’s quality plan, were eliminated.

Osawatomie State Hospital: Reviewing the Hospital’s Recent Loss of Federal Funding

View Abstract

Published: JULY, 2016

Osawatomie State Hospital’s Medicare funding was terminated in December 2015 because it failed to comply with federal regulations related to staff and patient safety. The Kansas Department on Aging and Disability Services (KDADS), which oversees the facility, plans to seek recertification for 60 of the facility’s 206 beds. However, officials from the Centers for Medicare and Medicaid Services (CMS) and KDADS offered significantly different estimates of the time it will take to recertify the 60 beds (9-15 months versus 2-4 months). As of June 2016, the loss of Medicare funding and additional expenses to address the deficiencies have cost an estimated $15 million. Finally, even if the 60 beds are recertified, the hospital will continue to lose significant Medicare funding until the entire facility is recertified.

K-12 Education: Efficiency Audit of the Attica School District

View Abstract

Published: JULY, 2016

Pursuant to K.S.A. 46-1133, we randomly selected the Attica school district for an audit of its operations to help identify potential efficiencies and cost savings. We identified a number of opportunities for the district to operate more efficiently and reduce its costs or generate additional revenue. First, we identified options that would have little to no impact on students or the community. We estimated the district could save between $55,300 and $59,300 annually if it implemented all savings options in this category. These options include providing IT support similar to peers and eliminating 0.9 FTE food staff to align with peers. The district could also save money by adopting better purchasing practices, purchasing instead of renting a dishwasher, setting a food service budget, soliciting bids or competitively shopping for property insurance, and using and maximizing a cash-back purchasing card. Next, we identified one option that could have a moderate impact on students or the community. The district could save $40,000 annually by incorporating sixth graders in the junior high school which would eliminate one teaching position. In addition to the savings and revenue options listed above, we also found that the district had several weak accounting practices which put the district at greater risk for fraud or abuse. Further, the district lacks practices and policies to adequately protect its assets. Finally, the district appears to have accepted a donation of a new gymnasium without considering the long-term cost obligations.

K-12 Education: Efficiency Audit of the Frontenac School District

View Abstract

Published: JULY, 2016

Pursuant to K.S.A. 46-1133, the Frontenac school district volunteered for an audit of its operations to help identify potential efficiencies and cost savings. We identified a number of opportunities for the district to operate more efficiently and reduce its costs or generate additional revenue. First, we identified options that would have little to no impact on students or the community. We estimated the district could save money and increase revenue by $35,000 to $44,000 annually by eliminating routine food service transfers and increasing meal prices to the state or peer average. Next, we identified one option that could have a moderate impact on students or the community. The district could save $180,000 annually by switching to a traditional eight-period schedule and filling its core high school classes. Last, we identified one savings option that could have a significant impact on students or the community. The district could save up to $20,000 annually by ending the current practice of busing students who live less than 2.5 miles from school. Alternatively, the district could offset about the cost of busing those students by about $3,500 by charging these students a fee to ride the bus. In addition to the savings and revenue options listed above, we found the district lacks certain practices and policies to adequately protect its assets. Last, it created an expensive retirement bonus that it is unlikely to be able to eliminate.

K-12 Education: Efficiency Audit of the Maize School District

View Abstract

Published: JULY, 2016

Pursuant to K.S.A. 46-1133, we randomly selected the Maize school district for an audit of its operations to help identify potential efficiencies and cost savings. We identified a number of opportunities for the district to operate more efficiently and reduce its costs or generate additional revenue. First, we identified options that would have little to no impact on students or the community. We estimated the district could save between $546,000 and $556,000 annually if it implemented all savings options in this category. These options included eliminating 9.0 FTE IT support positions, eliminating the district's leave buy-back policy, using food service fund moneys instead of general fund moneys to pay for lunch room supervisors, and offering district-owned cell phones or reducing cell phone stipends. Next, we identified two options that could have a moderate impact on students or the community. The district could save between $523,000 and $635,000 annually by eliminating 2.0 to 3.0 FTE assistant superintendent positions and eliminating 4.0 FTE elementary school assistant principal positions. Last, we identified two savings options that could have a significant impact on students or the community. The district could save between $608,000 and $667,000 annually by switching to a traditional eight-period schedule at both high Schools, and establishing school boundaries to reduce transportation expenditures. In addition to the savings and revenue options listed above, district officials reported taking steps to correct inadequate IT inventory and purchasing controls that appear to have contributed to a suspected fraud in 2014.

Seized and Forfeited Property: Evaluating Compliance with State Law and How Proceeds Are Tracked, Used, and Reported

View Abstract

Published: JULY, 2016

The Kansas Standard Asset Seizure and Forfeiture Act (K.S.A. 60-4101 et seq.) gives law enforcement agencies in Kansas authority to seize money or property acquired in connection with certain illegal activities. As part of this audit we compared the seizure and forfeiture process in Kansas to four states (Iowa, Nebraska, Missouri, and New Mexico) and the federal government. We found that Kansas is similar to the other states and the federal government in terms of what property can be seized by law enforcement agencies and under what conditions. However, we also found that requirements for forfeiting property, spending forfeiture proceeds, and reporting on forfeiture activity varied across all states we reviewed and the federal government. We also evaluated two state and four local law enforcement agencies’ processes for property seizures and forfeitures under the state’s Forfeiture Act. Although there were some exceptions, we found that all six law enforcement agencies adequately safeguarded seized property, appropriately liquidated forfeited property, and appropriately spent forfeiture proceeds. However, the six law enforcement agencies lacked important controls for tracking forfeiture proceeds. Additionally, although state law enforcement agencies complied with reporting requirements in state law, local agencies did not. As a result of this work, we also identified several other findings related to the seizure and forfeiture process. Overall, we found that agencies have broad discretion over how forfeiture proceeds can be used, which creates a risk agencies could begin to depend on them for operating funds. Specific to the law enforcement agencies we reviewed, we found that the Coffeyville Police Department’s arrangement with the Montgomery County Attorney to handle forfeiture cases creates a conflict of interest and that the Salina Police Department lacked important controls for money used for controlled drug buys. Finally, none of the law enforcement agencies we reviewed had complete and written policies and procedures for seized and forfeited property.

Foster Care and Adoption in Kansas: Reviewing Various Issues Related to the State’s Foster Care and Adoption System, Part 1

View Abstract

Published: JULY, 2016

We reviewed components of the foster care system, including safety of children during the removal and placement process. We found that DCF does not always follow adequate policies to ensure the safety of children during the removal and placement process. DCF has not yet implemented several recommendations from a 2013 evaluation of its child protective services function and has not responded to all report center calls in a timely manner. We also found that DCF does not ensure that required background checks of individuals in foster homes happen as often or as thoroughly as they should. In addition, DCF does not always take steps to ensure that monthly in-person visits happen for children in foster care, adoptive homes, or for children reintegrated with their family. Results from our survey of case-management staff and guardians ad litem also indicate that monthly in-person visits do not always happen. Finally, survey respondents also expressed concerns with staff turnover, morale and training. As for placement of children, we found DCF’s child placement process does not ensure that children are placed in foster care homes with sufficient living and sleeping space and financial resources. That is because DCF allows nearly all requests for exceptions, which results in inadequate sleeping space for some foster children. Our review showed that DCF does not have an adequate process to ensure that licensed foster homes have sufficient financial resources. We also found that despite the lack of DCF requirements related to capacity, living space or financial sources for adoptive placements, few stakeholders had concerns. Finally, we found that child placing agencies both sponsor and regulate foster homes which may create a conflict of interest. We also found several aspects of the foster care and adoption system are designed to keep family members together. Federal law requires that states’ foster care and adoption programs have a formal preference to keep families together. The majority of stakeholders responding to our survey indicated there was appropriate emphasis placed on keeping families together, with a small portion responding that there was too much emphasis.

Kansas Corporation Commission: Evaluating Savings Achieved through the Facility Conservation Improvement Program

View Abstract

Published: APRIL, 2016

In 2000, the Kansas Legislature enacted legislation establishing the Facility Conservation Improvement Program (FCIP). Public entities can use the program to streamline the process for energy-efficient and deferred-maintenance projects such as installing new lighting or replacing boilers or chillers. The program is designed for project costs to be paid for with energy savings within a set period of time. We reviewed three FCIP projects and were unable to determine whether the public entity achieved the energy savings guaranteed under the terms of the contract with an energy service company because follow-up verification reports either were not required, were missing, or were based on faulty analysis. We made a number of recommendations to address issues with the program, and identified issues for further study.

Statewide Single Audit--Fiscal Year 2015

View Abstract

Published: APRIL, 2016

State law calls for an annual financial-compliance audit of the general purpose financial statements and “the financial affairs and transactions of a state agency required to comply with federal government audit requirements…” CliftonLarsonAllen, under contract with Legislative Post Audit, conducted this two-part audit. The first part was the report on the state’s Comprehensive Annual Financial Report (report R-15-018, released in December 2015). This second part, the Report on Federal Awards in Accordance with OMB Circular A-133, reports on compliance with laws, regulations, and provisions of contracts and grant agreements. The auditors concluded that the state complied, in all material respects, with the requirements applicable to each of the federal programs audited. The auditors reported 21 deficiencies in internal control, including one material weakness. The auditors also identified questioned costs for a number of programs. Eleven of the findings were repeated from prior years.

State Agency Information Systems: Reviewing Security Controls in Selected State Agencies - Kansas Insurance Department (CY 2015)

View Abstract

Published: APRIL, 2016

NULL

Kansas Department of Wildlife, Parks and Tourism: Evaluating a Jefferson County Land Purchase

View Abstract

Published: MARCH, 2016

In 2014 , the Department of Wildlife, Parks and Tourism (KDWPT) purchased several tracts of land in Jefferson County for recreation and conservation purposes. KDWPT needed to comply with several state and federal requirments in order to purchase the Jefferson County land. We found that KDWPT demonstrated compliance with most, but not all of those state and federal requirements. Additionally, KDWPT paid about $20,000 for a 14-acre tract of land as part of the acquisition, but never actually acquired legal ownership of the property. Finally, KDWPT’s land purchase procedures lacked guidance on how to comply with state legal requirements.

K-12 Education: Evaluating the Costs and Benefits of Smoky Hill Education Service Center Membership

View Abstract

Published: FEBRUARY, 2016

The Smoky Hill Education Service Center is one of seven education service centers in Kansas that offer support services to school districts. For a sample of districts we reviewed, the cost of membership in Smoky Hill was greater than the financial benefit, primarily because districts did not purchase large enough quantities of discounted items to offset the costs. Additionally, the results of our comparison of Smoky Hill’s prices for certain technology items to prices from other vendors had mixed results, though Smoky Hill’s prices were lower for many items.