oversight

North Carolina Department of Public Instruction's Oversight of Local Educational Agency Single Audit Resolution

Published by the Department of Education, Office of Inspector General on 2016-08-26.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

                                 UNITED STATES DEPARTMENT OF EDUCATION
                                                 OFFICE OF INSPECTOR GENERAL


                                                                                                                      AUDIT SERVICES
                                                                                                                 Sacramento Audit Region


                                                               August 26, 2016

                                                                                                                 Control Number
                                                                                                                 ED-OIG/A09P0005


Dr. June St. Clair Atkinson
State Superintendent
North Carolina Department of Public Instruction
301 North Wilmington Street
Raleigh, NC 27601

Dear Dr. Atkinson:

This final audit report, “North Carolina Department of Public Instruction’s Oversight of Local
Educational Agency Single Audit Resolution,” presents the results of our audit. The purpose of the
audit was to determine whether the North Carolina Department of Public Instruction (DPI) provided
effective oversight to ensure that local educational agencies (LEAs) took timely and appropriate
action to correct single audit findings. Our review covered DPI’s processes and activities related to
the resolution of LEA single audit findings that occurred in fiscal years (FYs) 2012 through 2014. 1
In this report, we use the term “audit resolution” to refer to all activities required to ensure that LEA
single audit findings are fully and appropriately corrected. The specific requirements of the audit
resolution process are described in the Background section of this report.

DPI improved its oversight of LEA single audit resolution during the period covered by our review
and several aspects of DPI’s oversight were effective. However, we also identified specific aspects
of DPI’s oversight that need to be improved to correct control weaknesses and ensure DPI and LEA
compliance with regulatory requirements.

We made a variety of recommendations that would require DPI to improve internal controls over its
oversight of LEA single audit resolution and ensure that its oversight processes meet all applicable
Federal requirements. Specifically, DPI should (1) finish developing and implementing written
policies and procedures for overseeing LEA single audit resolution, (2) establish an integrated
tracking system for individual LEA findings across the State, (3) implement a periodic quality
assurance process to assess DPI’s effectiveness in this area of oversight responsibility, and
(4) ensure that DPI’s management decisions meet Federal content requirements. DPI concurred
with three of the four recommendations and described steps it had taken or planned to take to
implement associated corrective actions. DPI did not concur with the recommendation to modify
its management decisions to include all content required by Federal regulations because it believed
its management decisions already contained the required content.


1
    North Carolina LEAs operate on a fiscal year that begins on July 1 and ends on June 30.
    The Department of Education's mission is to promote student achievement and preparation for global competitiveness by fostering educational
                                                      excellence and ensuring equal access.
Final Report
ED-OIG/A09P0005                                                                                            Page 2 of 22


                                                   BACKGROUND


The Single Audit Act of 1984 established uniform audit requirements for State and local
governments (recipients and subrecipients) 2 that receive Federal financial assistance. Many of
these recipients receive annual grant awards from multiple Federal agencies. Before the Single
Audit Act, the grant-by-grant audit processes of Federal agencies were not coordinated. This
resulted in overlapping audits in some cases, which increased costs to the Federal government and
placed an undue administrative burden on recipients. In other cases, recipients were not subject to
any grant audits for multiple fiscal years.

In 1985, the Office of Management and Budget (OMB) issued Circular A-128 to provide
implementing guidance for the Single Audit Act. In 1990, OMB issued Circular A-133 to extend
the single audit process to nonprofit organizations. Then, in 1997, OMB revised Circular A-133
pursuant to the Single Audit Act Amendments of 1996 to extend Circular A-133’s coverage to
audits of State and local governments and to rescind Circular A-128. For fiscal years ending after
December 31, 2003, recipients that spent $500,000 or more in Federal awards during a fiscal year
were required to have a single audit or program-specific audit conducted in accordance with
Circular A-133.

In December 2013, OMB published final regulations for Uniform Grant Guidance (Title 2 of the
Code of Federal Regulations), which consolidated and superseded requirements from eight OMB
Circulars, including A-133. Part 200 of the Uniform Grant Guidance streamlined the administrative
requirements, cost principles, and audit requirements for Federal awards, and increased the single
audit expenditure threshold to $750,000. Uniform Grant Guidance requirements became effective
for recipients’ fiscal years beginning on or after December 26, 2014.

As pass-through entities, State educational agencies (SEAs) are responsible for distributing U.S.
Department of Education (Department) grant funds to subrecipients. Circular A-133 specifies the
responsibilities of pass-through entities related to the administration of Federal awards. 3 In their
oversight role, SEAs are responsible for advising LEAs of the requirements associated with the use
of Federal funds; monitoring LEAs’ use of Federal funds to ensure they comply with laws,
regulations, and grant agreements; and ensuring that LEAs achieve program goals. SEAs must also
ensure that all LEAs that meet the expenditure threshold for a given fiscal year have a single audit
performed.

As part of the single audit resolution process, the SEA must issue a management decision 4 to the
LEA stating whether the SEA sustains each audit finding and the reasons why the SEA does or does



2
    In the remainder of this report, the term “recipient” is inclusive of subrecipients unless otherwise noted.
3
  Although Circular A-133 has been superseded by the Uniform Grant Guidance, the SEA requirements described in
this report continue to be in effect under the new regulations. We cite Circular A-133 requirements in this report
because the Uniform Grant Guidance was not in effect during the period covered by the audit.
4
 Under Section 105 of Circular A-133, the SEA must evaluate LEA audit findings and the LEA’s corrective action plan
and issue a written decision describing necessary corrective actions.
Final Report
ED-OIG/A09P0005                                                                                        Page 3 of 22

not sustain each finding. 5 The management decision must also describe the corrective actions that
the LEA is required to take. According to Circular A-133, Section 400(d)(5), SEAs must ensure
that LEAs take timely and appropriate action to correct any control weaknesses or instances of
noncompliance identified through the single audit process. Circular A-133 includes detailed
requirements for the content of the management decision, the timeframe for its issuance, and related
SEA responsibilities.

During the audit period, the Department did not directly monitor the LEA single audit resolution
practices of SEAs. 6 Instead, it relied on statewide single audits to identify SEAs that had
incomplete or ineffective oversight processes for LEA single audit resolution. The Department is
responsible for overseeing the resolution of single audit findings at SEAs that involve Federal
education programs.

According to Circular A-133, the auditee (SEA or LEA) holds primary responsibility for following
up on its audit findings and ensuring that corrective action is taken. This responsibility includes the
development of a corrective action plan to address each current-year finding and a schedule of
prior-year findings that details the status of each prior finding. For unresolved prior-year findings,
the SEA or LEA must describe any corrective action that has been taken to date and what remaining
corrective actions are planned. For subrecipient audits, the SEA has an oversight role and must
ensure that the LEA’s planned corrective actions are appropriate and implemented timely. LEA and
SEA officials must have a shared commitment to correcting LEA audit findings for the audit
resolution process to be successful.

North Carolina has received, on average, more than $900 million in Federal educational assistance
each year since 2011. The two largest Federal elementary and secondary education grant programs
are Title I, Part A of the Elementary and Secondary Education Act (Title I), which assists LEAs and
schools with high numbers or high percentages of children from low-income families, and Part B of
the Individuals with Disabilities Education Act (IDEA), which assists States and LEAs in meeting
the needs of children with disabilities. Figure 1 shows the total amounts of Federal elementary and
secondary education funds that the Department awarded to North Carolina from FYs 2011–2015 for
Title I, IDEA, and all other Federal elementary and secondary education programs combined.




5
 In this report, “audit finding” refers to a compliance finding for a Federal education program reported in the single
audit, unless otherwise stated.
6
  Recently, Department officials informed us that they were in the process of expanding their monitoring to include
reviews of SEA oversight of LEA audit resolution.
Final Report
ED-OIG/A09P0005                                                                                      Page 4 of 22
Figure 1. Federal Elementary and Secondary Education Program Funds Awarded to North
Carolina in Millions (a)
$1,000             $933                $951                                      $956               $964
                                                                $900

    $800


    $600


    $400


    $200


       $0
                   2011                 2012                  2013              2014              2015 (b)
                  IDEA, Part B       Title I, Part A        Other Elementary/Secondary Level Programs

(a) Source: State formula grant allocation tables from the Department’s Web site. Award totals do not include Federal
education funds awarded directly by the Department on a competitive basis.
(b) 2015 grant totals are estimated.

According to DPI records, North Carolina had 115 LEAs in FY 2014. All North Carolina LEAs
met the Federal expenditure threshold requiring a single audit during our audit period
(FYs 2012–2014). We judgmentally selected four LEAs that had at least one audit finding during
the audit period for review. 7 Table 1 provides details about the four LEAs selected for review. We
assessed DPI’s oversight of the resolution of the LEAs’ audit findings in part by interviewing LEA
officials and obtaining relevant documentation, including the six management decisions that DPI
had issued to the four LEAs during the audit period. We also reviewed eight additional
management decisions that DPI had issued to seven other LEAs during the audit period. The 14
total management decisions that we reviewed covered 22 audit findings at 11 LEAs.

Table 1. North Carolina LEAs Selected for Review
                                                Enrollment
    Selected LEA                                                                  Audit Finding(s)
                                                   (a)
                                                                   Noncompliance with cash management and
    Cumberland County Schools                          51,119      procurement requirements. Charged incorrect
                                                                   indirect cost rate for Federal education grants.
                                                                   Noncompliance with procurement requirements
    Public Schools of Robeson County                   23,362
                                                                   and period of availability of Federal funds.
                                                                   Noncompliance with procurement requirements.
    Rowan-Salisbury Schools                            19,705      Not all paraprofessionals were “highly qualified”
                                                                   as required.
                                                                   Noncompliance with cash management
    Carteret County Public Schools                     8,352
                                                                   requirements.
(a) Student enrollment totals according to the 2013–2014 Average Daily Membership Report obtained from DPI’s Web
site.

7
    See the Objective, Scope and Methodology section of this report for more information on LEA selection.
Final Report
ED-OIG/A09P0005                                                                                         Page 5 of 22

In North Carolina, the Local Government Commission within the Department of State Treasurer
was responsible for identifying subrecipients that were required to have a single audit performed,
collecting the single audit reports, reviewing the reports for completeness, and then distributing the
reports to applicable State agencies (such as DPI) for finding resolution. The Monitoring and
Compliance Section (Monitoring and Compliance) within DPI’s School Business Division was
primarily responsible for oversight of LEA single audit resolution for DPI, including issuing
management decisions to LEAs. After Monitoring and Compliance received LEA audit reports
from the Local Government Commission, it evaluated any findings and associated corrective action
plans developed by the LEAs. In cases where DPI determined that it should issue a management
decision to the LEA, Monitoring and Compliance would either independently issue the
management decision or confer internally with DPI program officials before issuing the
management decision. 8 Generally, DPI program officials would advise Monitoring and
Compliance on whether DPI should collect any questioned costs associated with their programs.
Program officials might also provide feedback to Monitoring and Compliance, as necessary,
regarding the appropriateness of LEAs’ planned corrective actions.

The North Carolina statewide single audit reports contained findings related to DPI’s oversight of
LEA single audit resolution from FY 2009 through FY 2011. The findings stated that DPI was
not issuing management decisions for all LEA findings as required by Circular A-133. According
to the audit reports, DPI did not issue any management decisions for LEA findings in FYs 2009
or 2010. In FY 2011, DPI began issuing management decisions for LEA findings classified as
material weaknesses but still did not issue management decisions for findings classified as
significant deficiencies. The findings for FYs 2009 and 2010 stated that DPI was communicating
with LEA officials about resolving their findings even when it was not issuing formal
management decisions. For example, in FY 2009, DPI contacted LEAs if their corrective action
plans were not adequate. In FY 2010, DPI began communicating by email or phone with all
LEAs that had a finding to ensure that the LEAs took appropriate corrective action. DPI’s
findings related to not issuing management decisions were reported as resolved in the FY 2012
statewide single audit, which covered DPI’s audit resolution activities for LEA findings that
occurred in FY 2011. Thus, DPI’s findings for not issuing management decisions were reported
as having been corrected before our audit period.

DPI officials told us that DPI has made personnel changes and placed officials that are
knowledgeable about compliance requirements into management positions to improve oversight of
LEA fiscal compliance. In 2011, DPI appointed a new director of the School Business Division
with an audit and compliance background. The director subsequently hired an assistant director
with a similar background to overhaul DPI’s LEA oversight processes, including audit resolution
and fiscal monitoring. Finally, DPI hired a section chief with a compliance background to oversee
the day-to-day activities of the Monitoring and Compliance Section and implement the new
processes designed by the assistant director.




8
    As discussed in the finding, DPI did not issue all required management decisions during our audit period.
Final Report
ED-OIG/A09P0005                                                                                        Page 6 of 22


                                              AUDIT RESULTS


We determined that DPI improved its oversight of LEA single audit resolution during the period
covered by our review. DPI continued to improve and enhance its oversight of LEA audit
resolution in the years after its findings related to not issuing management decisions were reported
as fully resolved. DPI officials stated that they placed a special emphasis on improving DPI’s
oversight of LEA audit resolution as part of a larger effort to improve the effectiveness and
efficiency of DPI’s internal controls over Federal, State, and local funds.

We found that selected aspects of DPI’s oversight of LEA audit resolution were effective.
However, other aspects of DPI’s oversight require improvement to correct control weaknesses and
ensure compliance with regulatory requirements. DPI made significant changes to its audit
resolution processes during FYs 2013 and 2014. 9 As a result, DPI’s processes in the latter half of
our audit period were more effective than its earlier processes.

We provided a draft of this report to DPI for review and comment on May 5, 2016. DPI provided
its comments on June 30, 2016. DPI concurred with three of the four recommendations included in
our report and described steps it had taken or planned to take to implement associated corrective
actions. DPI did not concur with the recommendation to modify its management decisions to
include all content required by Federal regulations because it believed its management decisions
already contained the required content. We modified our finding but did not change our
recommendations based on DPI’s comments to the draft audit report. We summarized DPI’s
comments at the end of the finding and provided responses to its comments as warranted. We also
included the full text of DPI’s comments as Attachment 2 to our report.


FINDING – DPI Improved Its Oversight of LEA Audit Resolution in Recent Years but
          Further Improvements are Needed

DPI has implemented several effective oversight practices, including requiring LEAs to take
appropriate corrective actions to resolve audit findings, placing extra emphasis on repeat findings to
ensure they are resolved promptly, engaging in proactive communication with LEAs related to audit
resolution, issuing management decisions for both Federal program findings and financial statement
findings, and enhancing management oversight over the audit resolution process. DPI was also able
to expedite the audit resolution process as a result of another North Carolina State agency’s
requirement that LEAs submit single audit reports 5 months before the deadline specified in
Circular A-133. Despite these effective practices, DPI should take additional action in several areas
to ensure its oversight processes and practices meet all Federal requirements and function
effectively. For example, DPI did not have adequate written policies and procedures describing all
aspects of its oversight of the LEA audit resolution process. DPI also did not have an adequate
system for tracking LEA findings across audit periods or across the State, nor did it have a quality
assurance process for its oversight of LEA audit resolution. Finally, even though DPI issued

9
 Our audit covered DPI’s audit resolution oversight activities for LEA audit findings reported in FYs 2012–2014.
DPI’s audit resolution activities generally took place in the year following the year that the finding was reported.
Unless otherwise stated, the year cited in the report refers to the year the finding was reported.
Final Report
ED-OIG/A09P0005                                                                          Page 7 of 22

management decisions for all LEA audit findings in the last year of our audit period, its
management decisions did not meet all Federal content requirements.

Strengths in DPI’s Oversight of LEA Audit Resolution

Required appropriate corrective actions. Based on our review of 14 management decisions that
covered 22 audit findings, we concluded that DPI generally identified and required corrective
actions that were appropriate to resolve the underlying problem described in the finding. DPI
significantly revised and improved the content and format of its management decisions during
FY 2013. Our analysis showed that all of DPI’s revised FY 2013 management decisions and all of
its FY 2014 management decisions that were included in our review required LEAs to take
appropriate corrective actions. The three management decisions covered by our review that did not
require appropriate corrective actions were all issued before DPI revised its management decisions.

Placed extra emphasis on repeat findings. DPI added a new step to its audit resolution process
for FY 2014 that required LEAs to provide additional information about corrective actions taken for
all repeat findings. This new process placed extra emphasis on correcting repeat findings in a
prompt manner and prevented LEAs from proposing the same corrective actions year after year
without taking steps to implement them. Below is an excerpt from a management decision that DPI
issued for a repeat finding reported in FY 2014 that illustrates DPI’s new approach:

       This is a repeat of the condition noted in Finding 2013-03 from the prior year single
       audit and thus prior corrective action has been ineffective at eliminating this condition.
       For this reason, [DPI] requests that the LEA respond in writing to describe what efforts or
       plans have been made or will be made to eliminate future occurrences of this condition in
       addition to those described in the audit report. The LEA’s response must (1) describe the
       additional corrective action proposed or taken since January 7, 2015 (i.e., the date of the
       Auditor’s report) and (2) be signed by the Board Chair or designee. The LEA should
       provide documentation where available to support the claim that corrective action was
       implemented.

DPI officials stated that although this was a new initiative, LEAs were complying with the
additional requirements and providing the requested information. Our review covered the
management decisions issued to six LEAs with FY 2014 audit findings. One of the six LEAs had
repeat audit findings. We confirmed that DPI issued the enhanced management decision described
above to the LEA. The LEA responded, describing additional corrective actions that it had taken to
address the findings.

For FY 2014, DPI also added a statement to its management decisions covering nonrepeat findings
to advise LEAs of DPI’s new process for repeat findings. The statement informed all LEAs with a
FY 2014 finding that if the finding repeated in the subsequent fiscal year, DPI would require
additional information and evidence of implemented corrective action.

Engaged in proactive communication with LEAs. DPI usually engaged in proactive
communication with LEA officials responsible for audit resolution for the 19 management
decisions covered by our review. The communication occurred throughout the audit resolution
process, as appropriate. For example, in some instances, DPI contacted LEA officials to gain more
information about their planned corrective actions. In another instance, DPI informed LEA
officials that their planned actions were not sufficient and requested a revised corrective action plan.
Final Report
ED-OIG/A09P0005                                                                                     Page 8 of 22
DPI also contacted LEAs to determine whether the LEA had implemented agreed on corrective
actions so that DPI could close the findings. As part of this contact, DPI obtained evidence that the
LEA had taken corrective actions or confirmation from LEA officials that the findings had been
corrected and would not repeat. We interviewed officials responsible for audit resolution at four
LEAs that had audit findings during our audit period. Officials at three of the LEAs were familiar
with DPI’s management decisions and officials at two of the LEAs stated that DPI had contacted
them by phone or email related to the resolution of the audit findings included in our review. 10

We also noted that DPI issued management decision letters directly to LEA officials responsible for
ensuring corrective actions were implemented (typically the finance officer), which helped to
ensure that LEA officials were actively engaged with DPI during the audit resolution process. DPI
officials stated that for FY 2014, they also began copying the superintendent on management
decisions to help ensure appropriate management oversight at the LEA level.

Enhanced management oversight. DPI officials stated that DPI enhanced its management
oversight over the LEA single audit resolution process during our audit period. Under this process,
the assistant director of the School Business Division reviewed all management decisions before
DPI issued them to LEAs. DPI also told us that during the FY 2014 review process, DPI added a
preliminary review of management decisions that the Monitoring and Compliance section chief
conducted before the assistant director’s review. Based on the information that DPI provided, this
resulted in multiple levels of review for at least half of management decisions issued for FY 2014
findings.

For FY 2014, the assistant director of the School Business Division implemented a monitoring tool
to enhance visibility over the performance of DPI’s audit resolution oversight activities. The tool
provides visibility over the full lifecycle of actions taken for each LEA audit report and finding,
including the date that the report was received; the dates that the management decision was drafted,
reviewed, and issued to the LEA; the dates that the LEA’s response was due and received; and the
date that the audit resolution activities were closed for the LEA. This monitoring tool should
promote more effective oversight to help ensure that DPI’s audit resolution activities are performed
timely and in accordance with policies and procedures.

Issued management decisions for financial statement findings. Although not required to, DPI
issued management decisions to LEAs that covered both financial statement findings and Federal
award findings. Each single audit finding is classified in the audit report as either a financial
statement finding or a Federal or State award finding. 11 Circular A-133 requires the SEA to issue
management decisions for findings applicable to the Federal awards that it makes to subrecipients,
but does not require the SEA to oversee the resolution of financial statement findings. However, in
some cases, financial statement findings can affect Federal program funds at the LEA. For
example, internal control weaknesses related to accounting processes, such as a lack of proper
segregation of duties, can be reported as a financial statement finding even though it may put
Federal grant funds at risk. DPI officials stated that they issued management decisions for financial
statement findings because it was a good practice. This practice may help safeguard Federal funds


10
  The official responsible for audit resolution at the fourth LEA was new to her position and the LEA had not had any
audit findings during her tenure. Thus, she could not comment on DPI’s communications related to audit resolution
activities.
11
     Our review did not cover findings related to State awards.
Final Report
ED-OIG/A09P0005                                                                       Page 9 of 22

from misuse or fraud by ensuring that financial statement findings are also corrected timely and
appropriately.

Required early submission of single audit reports from LEAs. The Federal regulatory deadline
for submitting single audit reports is 9 months after the end of the LEA’s fiscal year (March 31 for
North Carolina LEAs). However, the Local Government Commission required that single audit
reports be submitted only 4 months after LEAs’ fiscal year-end (October 31). Based on our
analysis of available data, the Local Government Commission had completed its review of almost
75 percent of LEA audit reports and provided them to DPI at least 3 months before the regulatory
deadline for submitting single audit reports. The expedited collection and distribution of LEA audit
reports resulted in LEAs receiving more timely guidance from DPI on the appropriateness of
proposed corrective actions and may have resulted in more timely correction of audit findings in
some cases.

Weaknesses in DPI’s Oversight of LEA Audit Resolution

Despite DPI’s efforts to enhance and improve its oversight processes, parts of the process still
require improvement to correct control weaknesses and minor areas of noncompliance.

Lack of adequate written policies and procedures. During our audit period, DPI did not have
written policies or procedures covering all processes and practices needed to effectively oversee
LEA single audit resolution. At the time we conducted our audit work at DPI, the written policies
that were available provided only a high-level description of DPI audit resolution activities for
FY 2009 and did not reflect current practices. As a result, personnel responsible for carrying out
DPI’s oversight of LEA audit resolution did not have written instructions describing the activities
that they should perform. The assistant director of the School Business Division told us that DPI’s
focus was on developing and implementing revised audit resolution oversight practices, and that it
wanted to complete that process before updating its written policies and procedures. The assistant
director stated that new written policies and procedures for overseeing the LEA audit resolution
process were under development at the time of our audit fieldwork. This official also said that DPI
was awaiting completion of its new audit tracking system so that steps pertaining to its use could be
incorporated into the policies before they are finalized. However, DPI should not delay
implementation of policies and procedures while waiting for the tracking system to be completed.
Doing so could result in DPI’s audit resolution oversight activities being implemented incorrectly
or ineffectively if key personnel leave the organization and comprehensive written policies are not
available for replacement personnel to follow.

Written policies and procedures are an essential component of effective internal control. The
“Internal Control–Integrated Framework,” (Framework) published by the Committee of Sponsoring
Organizations of the Treadway Commission (COSO) is a widely accepted standard for internal
control in organizations. The Framework identifies five components of internal control (control
environment, risk assessment, control activities, information and communication, and monitoring)
that must all be adequately designed, implemented, and operating in an integrated manner for
internal control to be effective. The Government Accountability Office’s “Standards for Internal
Control in the Federal Government” (Green Book) adapts the COSO Framework for the
government environment. According to the Green Book, management is responsible for designing
policies and procedures to fit the organization’s circumstances and incorporating them as an integral
part of its operations. An organization’s control activities are the actions management establishes
Final Report
ED-OIG/A09P0005                                                                      Page 10 of 22
through policies and procedures to achieve objectives and respond to risks in the internal control
system.

To ensure that the policies and procedures that DPI implements will result in effective oversight of
LEA audit resolution activities, the policies and procedures should:

   •   address all aspects of DPI’s process for overseeing LEA audit resolution activities,
   •   clearly identify which DPI personnel are responsible for the activities,
   •   contain specific instructions on how to perform required tasks, including a description of the
       order in which the oversight activities should be performed,
   •   contain templates for any forms that are used during the process, and
   •   include a requirement that the policies and procedures be reviewed periodically and updated
       to reflect any changes to the process.

Tracking system for LEA findings was not adequate. DPI should improve its process for
tracking LEA findings to enhance its ability to effectively oversee LEA audit resolution activities.
DPI maintained a statewide tracking log for each fiscal year that listed all LEAs and included high-
level information such as the number of findings at each LEA. However, the tracking log did not
include detailed information on individual LEA findings. DPI also maintained a separate tracking
log with detailed information for each LEA by fiscal year that included a description of individual
findings. However, DPI did not have an integrated system or process to track individual LEA
findings or the status of related corrective actions on a statewide basis or across multiple fiscal
years. Monitoring and Compliance personnel initially told us that they would have to manually
search more than 100 separate LEA tracking logs to determine which LEAs had repeat findings or
analyze the frequency of specific findings across the State. Monitoring and Compliance officials
later said that they could use an automated process to consolidate the tracking logs and generate
reports that identified the desired information. However, DPI did not perform any process of this
type during our audit period.

Neither DPI’s current tracking system nor the assistant director’s monitoring tool discussed earlier
provides the comprehensive tracking functionality that would enable DPI to ensure that individual
findings were resolved timely and appropriately or track multiyear trends or other relevant data
across the State. DPI officials acknowledged that their current tracking system had limitations and
stated that they were developing a more sophisticated tracking system using database software. Use
of a database to track the resolution of LEA audit findings would provide many benefits over DPI’s
current tracking process, which uses spreadsheets. Database software offers enhanced functionality
for large datasets, including improved data integrity, ease of querying the data and generating
reports, and simultaneous access by multiple users.

Tracking the status of LEA findings is an important part of multiple components of an SEA’s
internal control over LEA audit resolution, including risk assessment, control activities, and
monitoring. Without a comprehensive multiyear tracking system for individual findings, DPI
cannot easily track the resolution of LEA findings, including repeat findings, across the more than
100 LEAs operating in the State. In addition, DPI lacks a valuable control mechanism that would
allow it to periodically assess the pervasiveness of LEA risks of noncompliance with Federal
requirements, the existence of systemic control weaknesses across LEAs, and the risk of improper
payments.
Final Report
ED-OIG/A09P0005                                                                           Page 11 of 22

Lack of a quality assurance process. Although DPI had implemented certain management
oversight processes, such as performing multiple reviews of management decisions before they
were issued, DPI had not instituted a quality assurance process to assess its oversight of LEA audit
resolution activities. DPI officials stated that they did not have a quality assurance process because
they were continuing to refine and improve audit resolution oversight activities and further develop
associated policies and procedures. Quality assurance is an important part of the monitoring
component of internal control. According to the Green Book, monitoring includes activities that
management establishes and operates to assess the quality of performance over time, such as
separate evaluations performed by both internal and external sources to provide feedback on the
effectiveness of internal controls. Without a quality assurance process for its audit resolution
oversight activities, DPI lacks a mechanism to systematically detect and correct errors, control
weaknesses, and noncompliance with regulatory requirements. Once DPI has finalized its oversight
processes, it should implement a quality assurance process to periodically evaluate its effectiveness.

Management decisions lacked required content and were not always issued as required. We
reviewed 14 management decisions that DPI issued for 22 LEA audit findings reported in FYs 2012
through 2014 and determined that none of the decisions contained all required content. According
to Section 405(a) of OMB Circular A-133,

       [t]he management decision shall clearly state whether or not the audit finding is sustained,
       the reasons for the decision, and the expected auditee action to repay disallowed costs, make
       financial adjustments, or take other action. If the auditee has not completed corrective
       action, a timetable for follow-up should be given. … The management decision should
       describe any appeal process available to the auditee.

We concluded that DPI had improved the content of its management decisions over the course of
our audit period. Management decisions that DPI issued for FY 2012 audit findings did not identify
the required corrective actions or include a timetable for follow-up. However, DPI began adding
this information to its management decisions during FY 2013. While all of the FY 2014
management decisions covered by our review identified the required corrective actions and
included a timetable for follow-up, when appropriate, none of them clearly stated whether or not the
audit finding was sustained, the reasons for the decision, or the appeal process available to the
auditee.

We also found that DPI did not issue a management decision for nine FY 2012 and 2013 audit
findings covered by our review, as shown in Table 2.

Table 2. FY 2012 and 2013 Audit Findings for Which Management Decisions Were Not
Issued
  LEA                                                       Auditor’s Finding Reference Number
  Stanly County Schools                                     2012-6, 2012-7
  Wilson County Schools                                     2012-2, 2012-3
  Cumberland County Schools                                 2013-1
  Rowan‐Salisbury Schools                                   2013-2
  Winston Salem/Forsyth County Schools                      2013-3, 2013-4, 2013-5
Final Report
ED-OIG/A09P0005                                                                       Page 12 of 22
According to Section 400(d)(5) of OMB Circular A-133, DPI was required to issue a management
decision for each LEA finding related to the Federal grant awards that it made.

DPI officials explained that it was DPI’s policy for FYs 2012 and 2013 to not issue a management
decision under certain circumstances. For example, DPI did not issue a management decision when
DPI program officials had determined that the LEA’s corrective action plan was sufficient and the
finding had no associated questioned costs. DPI officials stated that DPI had not issued a
management decision for the nine audit findings above in accordance with this policy. DPI revised
its policy for FY 2014 and began issuing management decisions for every applicable LEA finding
as required. Our analysis showed that DPI issued management decisions for all of the FY 2014
audit findings covered by our review.

Although DPI did not issue formal management decisions for the nine audit findings shown above,
it provided evidence that, in some cases, it had taken other actions to ensure that the findings were
properly resolved. For example, DPI performed program reviews at two of the LEAs, and during
that process obtained documentation from the LEAs to verify that they had implemented
appropriate corrective actions.

DPI officials attributed the deficiencies related to its earlier management decisions to a lack of
understanding of compliance requirements by audit resolution staff. DPI officials stated that DPI’s
later management decisions met the content requirement to sustain the finding and provide the
reasons for the decision. However, DPI’s FY 2014 management decisions covered by our review
stated that DPI concurred with the auditor’s recommendation and management’s response but did
not clearly state whether the finding itself was sustained and the reasons for the decision as required
by Section 405(a) of Circular A-133. DPI officials also questioned whether there was a need for an
appeal process statement in their management decisions because DPI did not have a policy that
would enable LEAs to appeal DPI’s determinations on findings. However, Section 405(a) of
Circular A-133 requires any appeal process available to LEAs to be noted in the management
decision. This includes any State-level general administrative appeal process. North Carolina has a
general appeal process. 12

By not always issuing formal management decisions and not including all necessary content in its
management decisions, DPI did not comply with regulatory requirements. In addition, DPI may not
have provided the information needed by LEA officials to timely and appropriately implement
corrective actions.

Recommendations

We recommend that the Director of the Office of the Chief Financial Officer’s Post Audit Group
require DPI to—

1.1        Finalize the development and implementation of comprehensive written policies and
           procedures for DPI’s oversight of LEA single audit resolution. The policies and procedures
           should cover the entire audit resolution process, including DPI’s review of each LEA
           finding and corrective action plan, preparation of management decisions, use of a finding
           status tracking system, follow-up activities with LEAs, and steps to effectively resolve
           repeat findings.

12
     G.S. Gen. Stat. Ann. 150B-23.
Final Report
ED-OIG/A09P0005                                                                      Page 13 of 22

1.2    Establish an integrated tracking system for individual LEA findings across the State that
       includes data for current and prior years to facilitate effective oversight. Once DPI enters a
       finding into the tracking system, it should not close the finding until the LEA has fully
       implemented all required corrective actions.

1.3    Implement a periodic quality assurance process for the oversight of LEA single audit
       resolution to detect and correct errors, control weaknesses, and noncompliance with
       regulatory requirements in DPI’s oversight processes.

1.4    Ensure that all management decisions issued by DPI meet Federal regulatory requirements
       for content.


DPI Comments and OIG Responses

We summarize DPI’s comments and provide our responses, when necessary, in the following
sections. See Attachment 2 for a copy of the full text of DPI’s comments.

Recommendation 1.1

DPI Comments

DPI concurred with our recommendation on comprehensive policies and procedures for oversight
of the LEA audit resolution process and stated that it had finalized all procedures effective
July 1, 2015. DPI also said that it planned to review the procedures on an annual basis and make
any necessary revisions.

OIG Response

As stated in the report, DPI did not have current policies and procedures applicable to its audit
resolution activities during the audit period. The only policies and procedures available at the time
of our audit fieldwork provided a high-level description of DPI’s audit resolution activities for
FY 2009 but did not reflect current practices. In December 2015, 6 months after we began
fieldwork, DPI provided a revised document titled “Audit Resolution for Local Education Agencies
and Charter Schools” with an effective date of July 1, 2015. The document included high-level
policies for audit resolution but did not include procedures specifically describing activities that
DPI personnel should perform to ensure that LEAs correct their findings timely and appropriately.
The document stated that DPI would develop procedures for the implementation of the policies.
We did not evaluate DPI’s revised policies and procedures because they were still under
development at the time of our fieldwork. The Director of the Post Audit Group should assess the
sufficiency of DPI’s policies and procedures for the oversight of LEA audit resolution. The final
policies and procedures should, at a minimum, include the elements listed on page 10 of this report
and contain sufficient detail to allow someone unfamiliar with DPI’s oversight responsibilities
related to LEA audit resolution to monitor or complete the associated activities.
Final Report
ED-OIG/A09P0005                                                                        Page 14 of 22
Recommendation 1.2

DPI Comments

DPI concurred with our recommendation to establish a statewide integrated tracking system for
LEA findings that includes data for current and prior years. DPI stated that its existing tracking log
captured information such as whether a finding was a State or Federal program finding and whether
it was classified as a material weakness or a significant deficiency. However, DPI agreed that there
would be value in tracking additional data elements in the log, such as finding number and title, and
an indication of whether the finding was a repeat. DPI stated that it would add the additional data
elements to its existing tracking log by September 30, 2016. DPI also stated that it would research
all available technology options for developing the most comprehensive and efficient integrated
tracking system.

In comments related to its tracking system, DPI stated that its existing practice is to not close a
finding until DPI is satisfied with the LEA’s management response and corrective action plan from
the audit report or the LEA has provided additional documentation and evidence of implementation.

OIG Response

DPI officials told us on several occasions during our audit that they planned to develop a tracking
system using database software, and in its comments to our draft report, DPI stated that it would
research available technology options for its tracking system. We believe that a database would be
a more effective mechanism than DPI’s existing tracking process, which uses spreadsheets. We
added statements to the report describing the advantages of a database system for tracking LEA
audit resolution (see section on tracking system weaknesses).

In its comments to our draft report, DPI stated that under its existing practice, DPI may close a
finding in its tracking system if it is satisfied with the LEA’s planned corrective actions even if the
LEA has not completed the actions. As stated in our recommendation, it is important that the LEA
has implemented all corrective actions before DPI closes the finding in its tracking system.
Otherwise, the SEA will lose visibility over the actual status of the finding and the risk of repeat
findings will increase.

Because DPI’s integrated tracking system is not yet complete, we were not able to assess its
effectiveness. An effective tracking system would enable DPI to track the status of corrective
actions, including those associated with repeat findings; ensure that individual findings are resolved
timely and appropriately; and identify other issues such as increasing frequency of specific types of
findings across the State or growth in the number of findings that repeat for multiple years.

Recommendation 1.3

DPI Comments

DPI concurred with our recommendation to implement a periodic quality assurance process for its
oversight of LEA audit resolution activities and stated that it would add a description of the new
quality assurance process to its audit resolution policy by September 30, 2016.
Final Report
ED-OIG/A09P0005                                                                                   Page 15 of 22

Recommendation 1.4

DPI Comments

DPI did not concur with our recommendation to modify the content of its management decisions to
ensure that they meet all Federal requirements for content. DPI said that its FY 2014 management
decisions already met all content requirements and had standard language that clearly stated
whether DPI concurred with the auditor’s finding. DPI further stated that the management
decisions clarify that DPI’s decision is based on its review of the audit report, including
management’s response and corrective action plan, as well as review of any additional
documentation it obtains from the LEA.

DPI also stated that its interpretation of the requirement to include an appeal process in the
management decision differed from the OIG’s interpretation. DPI stated that it believes it is not
required to describe an appeal process in the management decision because its policy does not
provide for appeals on audit determinations. However, DPI said it will follow up with its legal
counsel as well as the North Carolina Office of Administrative Hearings to determine whether
inclusion of an appeal process in its management decisions based on the State-level general
administrative appeal process is warranted.

OIG Response

All of the FY 2014 management decisions covered by our review stated that DPI concurred with the
auditor’s recommendation and management’s response. However, none of these decisions
explicitly stated whether DPI concurred with the audit finding itself and the reason for its decision,
as required by Section 405(a) of OMB Circular A-133. 13

Also, as stated in our report, the management decision should describe “any appeal process
available to the auditee.” This requirement is not exclusive to an appeal process established by the
SEA for its determinations related to audit resolution. The requirement also includes any means of
appeal that may be available to the auditee through the State’s general administrative appeal
process, and North Carolina has such a process. DPI should include information on this general
administrative appeal process in its management decisions.

The Director of the Post Audit Group should ensure that DPI adds all required content to its
management decisions, including a clear statement as to whether DPI concurs with the audit
finding, the reasons for the decision, and a description of any appeal process available to the LEA.

DPI Responses to Specific Statements in the Report

DPI Comments

DPI disagreed with two statements in the draft report because it believed they were inaccurate, as
follows.


13
   According to Section 405(a) of OMB Circular A-133, the management decision must clearly state whether the
finding is sustained. We recognize that other words that convey the same meaning as “sustain,” such as “concur” or
“agree,” may be used instead.
Final Report
ED-OIG/A09P0005                                                                     Page 16 of 22
   1. “Monitoring and Compliance personnel told us that they would have to manually search
      more than 100 separate LEA tracking logs to determine which LEAs had repeat findings or
      analyze the frequency of specific findings across the State” (see section on tracking system
      weaknesses). DPI said that it was not accurate to credit this statement to DPI officials. DPI
      stated that it had attempted to correct this inaccuracy at the time of our fact-checking and in
      later conversations with the OIG audit team. DPI also stated that it had the ability to use the
      existing audit tracking logs to identify multi-year trends in the finding data by consolidating
      the spreadsheet files or using another system to generate reports.

   2. “Regarding the deficiencies in the later management decisions, DPI officials did not
      understand that explicit statements regarding whether each finding was sustained and the
      reason for that decision were required.” DPI said that this statement was inaccurate. DPI said
      that its interpretation of the Federal requirements differed from that of the OIG, but that DPI
      officials had not misunderstood the requirements.

OIG Response

   1. This statement is correctly attributed to DPI officials. DPI officials made this statement
      during a conference call on November 5, 2015, when we asked whether DPI could identify
      repeat findings and other trend information using its current tracking process.

      We included the statement in the summary of our audit results that we discussed with DPI
      officials during our exit conference on February 11, 2016, and officials did not tell us that it
      was inaccurate. In its response to our fact-checking inquiry on March 18, 2016, DPI deleted
      the statement in question from the fact-checking document and added alternate language
      describing a different method that it could use to identify repeat findings. However, DPI
      did not inform us that it believed that the statement it had deleted was inaccurate and did not
      provide support documentation for the changes it made. Our instructions at the beginning of
      our fact-checking document were to identify any incorrect statements and provide
      documentation to support any changes. We interpreted DPI’s change as a wording
      preference because DPI made many other line edits to our fact-checking document that
      appeared to reflect DPI wording preferences and clearly identified other cases where it
      thought a statement was not correct in the fact-checking document. We did not have any
      conversations with DPI regarding the statement between the time of the fact-checking
      activity and receipt of DPI’s formal comments to the draft audit report.

      We added DPI’s description of the method it says it could use to identify repeat findings and
      other multi-year trends to the section of the report discussing tracking system weaknesses.
      We still believe that use of database software would provide a more effective way to track
      the status of LEAs’ audit findings.

   2. We modified our characterization of this matter, which included removing this statement
      from the report, adding additional details to the section on management decision
      deficiencies to explain DPI’s position that its decisions met all requirements, and contrasting
      the content of DPI’s FY 2014 decisions with the requirements of Circular A-133.
Final Report
ED-OIG/A09P0005                                                                      Page 17 of 22



                   OBJECTIVE, SCOPE, AND METHODOLOGY


The objective of our audit was to determine whether DPI provided effective oversight to ensure that
LEAs took timely and appropriate action to correct single audit findings. Our audit covered DPI’s
processes and activities related to the resolution of LEA single audit findings that occurred in FYs
2012–2014.

To achieve our audit objective, we performed the following procedures:

   1. Reviewed applicable sections of the Single Audit Act of 1984, Circular A-133, the Circular
      A-133 Compliance Supplement dated March 2014, and the Uniform Grant Guidance to gain
      an understanding of the oversight responsibilities of the Department and SEAs related to
      LEA single audit resolution.

   2. Reviewed reports issued by the Department’s Office of Inspector General and the U.S.
      Government Accountability Office that addressed various aspects of SEA oversight of
      LEAs, including the resolution of LEA audit findings.

   3. Judgmentally selected four North Carolina LEAs for review (see “Sampling Methodology”
      below).

   4. Reviewed DPI’s FYs 2010–2014 single audit reports to identify information relevant to the
      audit objective, including the details of DPI’s prior-year audit findings and potential areas of
      internal control weakness at the SEA.

   5. Reviewed selected single audit reports from FYs 2012–2014 for the four LEAs included in
      our review to identify information relevant to the audit objective, including the details of the
      LEAs’ audit findings. We also reviewed selected FY 2012–2014 single audit reports for
      nine additional LEAs to identify the details of the audit findings covered by our review of
      DPI’s management decisions (see procedure 8 below).

   6. Interviewed DPI officials and reviewed DPI’s written policies and procedures to gain an
      understanding of DPI’s oversight processes related to LEA single audit resolution and other
      areas relevant to the audit objective.

   7. Interviewed officials at each of the four LEAs to obtain information about their processes
      related to single audit resolution and to evaluate the nature and extent of DPI’s interaction
      with the LEAs related to the resolution of their findings.

   8. Obtained 14 management decisions that DPI issued to 11 LEAs for 22 audit findings (see
      “Sampling Methodology” below) and reviewed the letters for adherence to regulatory
      requirements for content and timeliness. We also obtained and reviewed other available
      documentation regarding DPI communications with the LEAs related to the resolution of
      audit findings.
Final Report
ED-OIG/A09P0005                                                                     Page 18 of 22
   9. Evaluated DPI’s internal control over LEA single audit resolution by reviewing DPI’s
      policies and procedures, internal audit tracking sheets, and other relevant documentation;
      interviewing DPI and LEA officials; and testing the content and timeliness of management
      decision letters.

Sampling Methodology

Selection of LEAs. From the 115 North Carolina LEAs, we judgmentally selected four LEAs with
at least one audit finding during the audit period (FY 2012–2014) for review. We extracted and
analyzed data from the Federal Audit Clearinghouse to identify LEAs with audit findings, reviewed
the LEAs’ single audit reports, and selected the four LEAs on the basis of the nature and
significance of their audit findings and their size in terms of student enrollment. The LEAs selected
for review were Carteret County Public Schools, Cumberland County Schools, Public Schools of
Robeson County, and Rowan-Salisbury Schools. The results of our work at the four LEAs cannot
be projected to the population of all North Carolina LEAs.

Selection of Management Decision Letters. We requested the management decision letters that DPI
issued to 13 LEAs for 31 audit findings reported in FYs 2012–2014. DPI provided 14 management
decisions that it had issued to 11 of the LEAs for 22 of the audit findings. DPI had not issued
management decisions for the remaining nine audit findings. The results of our review of the
14 management decision letters cannot be projected to the population of all management decision
letters issued by DPI.

We selected management decisions for review in two steps, as described below.

   1. We requested the management decisions that DPI had issued to each of the four LEAs
      included in our review (Carteret County Public Schools, Cumberland County Schools,
      Public Schools of Robeson County, and Rowan-Salisbury Schools) for audit findings
      reported in FYs 2012–2014.

   2. To increase the number of management decisions covered by our review, we requested the
      management decisions that DPI had issued to nine additional LEAs for audit findings
      reported in FYs 2012–2014.

           a. We reviewed the listing of LEAs with audit findings in FYs 2013 and 2014 that we
              had identified during the LEA selection process and judgmentally selected four of
              the LEAs based on the number and significance of their audit findings and their size
              in terms of student enrollment. Based on this work, we requested the management
              decisions issued to Alamance-Burlington Schools and Winston Salem/Forsyth
              County Schools for audit findings reported in FYs 2013 and 2014 and to Buncombe
              County Schools and Guilford County Schools for audit findings reported in
              FY 2014.

           b. We reviewed DPI’s finding tracking logs and judgmentally selected five LEAs
              shown as having audit findings in FY 2012 or 2013, focusing on LEAs with multiple
              audit findings or high questioned costs. Based on this work, we requested the
              management decisions issued to Rockingham County Schools, Stanly County
              Schools, and Wilson County Schools for audit findings reported in FY 2012 and to
Final Report
ED-OIG/A09P0005                                                                     Page 19 of 22

               Clay County Schools and Warren County Schools for audit findings reported in
               FY 2013.
Because DPI did not have an integrated tracking process to facilitate tracking individual findings
across the State or across multiple fiscal years, we did not analyze DPI’s tracking logs or other
computer-processed data to support our finding or conclusions regarding DPI’s effectiveness in
overseeing LEA audit resolution. We did not perform a reliability assessment for DPI’s
computer-processed data because we did not use it to support our audit results.

We held an entrance conference with DPI officials and performed audit work at DPI’s offices in
Raleigh, North Carolina, in June 2015. We interviewed officials at Carteret County Schools,
Cumberland County Schools, Public Schools of Robeson County, and Rowan-Salisbury School
System at their offices or by telephone in June 2015. We discussed the results of our audit with
DPI officials on February 11, 2016.

We conducted this performance audit in accordance with generally accepted government auditing
standards. Those standards require that we plan and perform the audit to obtain sufficient,
appropriate evidence to provide a reasonable basis for our findings and conclusions based on our
audit objectives. We believe that the evidence obtained provides a reasonable basis for our finding
and conclusions based on our audit objective.
Final Report
ED-OIG/A09P0005                                                                     Page 20 of 22


                             ADMINISTRATIVE MATTERS


Statements that managerial practices need improvements, as well as other conclusions and
recommendations in this report, represent the opinions of the Office of Inspector General.
Determinations of corrective action to be taken will be made by the appropriate Department of
Education officials.

This report incorporates the comments that you provided in response to the draft audit report. If
you have any additional comments or information that you believe may have a bearing on the
resolution of this audit, you should send them directly to the following Department of Education
official, who will consider them before taking final Departmental action on this audit:

                              Charles Laster
                              Director, Post Audit Group
                              Office of the Chief Financial Officer
                              U.S. Department of Education
                              550 12th Street SW
                              6th Floor
                              Washington, D.C. 20202

It is the policy of the U. S. Department of Education to expedite the resolution of audits by
initiating timely action on the findings and recommendations contained therein. Therefore, receipt
of your comments within 30 calendar days would be appreciated.

In accordance with the Freedom of Information Act (5 U.S.C. §552), reports issued by the Office of
Inspector General are available to members of the press and general public to the extent information
contained therein is not subject to exemptions in the Act.

We appreciate the cooperation and assistance extended by your employees during our audit. If you
have any questions or require additional information, please do not hesitate to contact me at
(916) 930-2399.


                                             Sincerely,

                                             /s/

                                             Raymond Hendren
                                             Regional Inspector General for Audit

Attachments
Final Report
ED-OIG/A09P0005                                                             Page 21 of 22

                                                                              Attachment 1


          Abbreviations, Acronyms, and Short Forms Used in this Report

Audit finding        Compliance finding for a Federal education program reported in an OMB
                     Circular A-133 single audit

Circular A-133       Office of Management and Budget Circular A-133

Department           U.S. Department of Education

DPI                  North Carolina Department of Public Instruction

FY                   Fiscal Year

Green Book           Government Accountability Office’s “Standards for Internal Control in
                     the Federal Government”

LEA                  Local Educational Agency

Monitoring and
Compliance           DPI Monitoring and Compliance Section

OMB                  Office of Management and Budget

SEA                  State Educational Agency

Uniform Grant
Guidance             Title 2 of the Code of Federal Regulations
Final Report
ED-OIG/A09P0005                            Page 22 of 22
                                             Attachment 2




                   Auditee Comments on
                  the Draft Audit Report
June 30, 2016


Raymond Hendren
Regional Inspector General for Audit
U.S. Department of Education
Office of Inspector General
501 I Street, Suite 9-200
Sacramento, CA 95814-2559

Reference: Audit Control Number ED-OIG/A09P0005

Dear Mr. Hendren:

The North Carolina Department of Public Instruction (NCDPI) appreciates the opportunity to
respond to the draft audit report, “North Carolina Department of Public Instruction’s Oversight
of Local Educational Agency Single Audit Resolution.” We understand that the objective of
the audit was to determine whether DPI provided effective oversight to ensure that local
educational agencies (LEAs) took timely and appropriate action to correct single audit findings.

While NCDPI oversees a wide range of oversight efforts for LEAs’ expenditure of federal
education funding, the agency placed a special emphasis on improving the agency’s oversight of
LEA audit resolution. This emphasis was part of a larger effort to improve the effectiveness and
efficiency of DPI’s internal controls over Federal, State, and local funds. DPI appreciates the
insights the report provides regarding its oversight of LEA audit resolution and would like to
thank the USDE Inspector General audit team for the courtesy extended to DPI and district staff
during the audit process.

DPI is pleased that the audit team recognized that the agency has implemented several effective
oversight practices and noted the following strengths of the agency’s audit resolution process:

   •   Required appropriate corrective actions.
   •   Placed extra emphasis on repeat findings.
   •   Engaged in proactive communication with LEAs.
   •   Enhanced management oversight.
   •   Issued management decisions for financial statement findings.
   •   Required early submission of single audit reports from LEAs.

                       OFFICE OF FINANCIAL AND BUSINESS SERVICES
                       Philip W. Price, Chief Financial Officer | Philip.Price@dpi.nc.gov
                 6326 Mail Service Center, Raleigh, North Carolina 27699-6326 | (919) 807-3600
                                              | Fax (919) 807-3604
                         AN EQUAL OPPORTUNITY/AFFIRMATIVE ACTION EMPLOYER
Reference: Audit Control Number ED-OIG/A09P0005
June 30, 2016
Page 2

We also appreciate the help provided by your office to identify areas for improvement in our
audit resolution process. The report noted one finding, “DPI Improved Its Oversight of LEA
Audit Resolution in Recent Years but Further Improvements are Needed,” regarding areas for
improvement including written policies and procedures, the tracking system for LEA audit
findings, a formal quality assurance process and management decision required content.

DPI’s comments and anticipated completion dates with respect to the specific recommendations
made in the report are as follows:

Recommendation 1.1: Finalize the development and implementation of comprehensive written
policies and procedures for DPI’s oversight of LEA single audit resolution. The policies and
procedures should cover the entire audit resolution process, including DPI’s review of each LEA
finding and corrective action plan, preparation of management decisions, use of a finding status
tracking system, follow-up activities with LEAs, and steps to effectively resolve repeat findings.

DPI concurs with the recommendation and has finalized all procedures. DPI’s Division of
School Business Monitoring and Compliance Section policy “Audit Resolution” and “Procedures
for LEA, Charter School and Nongovernmental Audit Resolution” were finalized effective July
1, 2015. Review, evaluation, and revisions (applicable) for these documents will occur on an
annual basis to ensure the agency’s audit resolution efforts are clearly documented and sufficient
in nature.

Recommendation 1.2: Establish an integrated tracking system for individual LEA findings
across the State that includes data for current and prior years to facilitate effective oversight.
Once DPI enters a finding into the tracking system, it should not close the finding until the LEA
has fully implemented all required corrective actions.

DPI concurs with the recommendation for an integrated tracking system for LEA findings across
the State including current and prior years’ information. The existing tracking log captures
detailed finding information such as the identification of the nature of a finding as to whether it
is one of the following:

•   Child Nutrition federal program finding
•   State award finding
•   Federal program funding finding
•   Internal control finding

The current tracking log also identifies whether the finding is a Material Weakness, Significant
Deficiency or Immaterial. We agree that the addition of certain data elements such as those
listed below would ensure all pertinent criteria are documented in one location.

•   Finding number and title
•   Indication of a repeat finding
Reference: Audit Control Number ED-
OIG/A09P0005 June 30, 2016
Page 3

We will be adding the additional detail to the LEA and charter school audit tracking log for the
FY 2016 audits by September 30, 2016. Research into all technology options available will be
ongoing in an effort to develop the most comprehensive and efficient integrated tracking system
possible.

DPI’s existing practice, as indicated in the audit resolution policy, is that no finding is closed
until the agency is satisfied with the LEA’s management response and stated corrective action
plan (CAP) as documented in the audit or with additional documentation and evidence of
implementation of CAP (if applicable) provided upon request.

Recommendation 1.3: Implement a periodic quality assurance process for the oversight of LEA
single audit resolution to detect and correct errors, control weaknesses, and noncompliance with
regulatory requirements in DPI’s oversight processes.

DPI concurs with the recommendation to implement a periodic quality assurance process for the
oversight of audit resolution activities. Detailed description of the determined quality assurance
process will be added to the existing Audit Resolution Policy by September 30, 2016.

Recommendation 1.4: Ensure that all management decisions issued by DPI meet Federal
regulatory requirements for content.

As communicated during the audit, our position is that all DPI-issued management decisions
(beginning in FY 2014 and going forward) meet the Federal regulatory requirements for content
as identified in Section 405(a) of OMB Circular A-133, “[t]he management decision shall clearly
state whether or not the audit finding is sustained, the reasons for the decision, and the expected
auditee action to repay disallowed costs, make financial adjustments, or take other action. If the
auditee has not completed corrective action, a timetable for follow-up should be given.”

DPI-issued determination letters include standard language clearly stating whether we “concur”
or “agree” with the auditor’s finding and management’s response as included in the audit report.
Audit determination letters standard language clarifies that our determination is based on our
review of the audit, including management’s response and corrective action plan as well as
review of documentation provided at our request. Expected actions of the grantee, up to and
including repayment of disallowed costs, are duly noted in each determination letter with the due
date for response and provision of supporting documentation clearly stated.

We acknowledge that DPI’s interpretation of the requirement for language regarding an appeal
process differs from that expressed by the audit team. DPI’s position continues to be that no
appeal process is included in determination letters as neither DPI nor the State Board of
Education (SBE) policy provides for appeals for audit determination. However, we will provide
due diligence and follow-up with legal counsel as well as the North Carolina Administrative
Office of Hearings (AOH) staff to determine if the audit team’s proposed use of GS § 150B-23.
Commencement; assignment of administrative law judge; hearing required; notice; intervention
is merited. If so determined by counsel and agreed upon by NC AOH, DPI will evaluate the
inclusion in audit determination policy and procedures.
Reference: Audit Control Number ED-OIG/A09P0005
June 30, 2016
Page 4

DPI Response to Certain Specific Comments Made in the Audit:
In addition to the responses provided above, we respectfully submit the following
observations regarding certain statements contained in the draft report for consideration:

•   On page 10 of 16, under Tracking system for LEA findings was not adequate, the
    report reads, “Monitoring and Compliance personnel told us that they would have to
    manually search more than 100 separate LEA tracking logs to determine which LEAs had
    repeat findings or analyze the frequency of specific findings across the State.” Crediting
    this comment to Monitoring and Compliance staff is inaccurate. The OIG audit team
    included the following sentence in Item 14 of the OIG’s “Fact Checking Document, “As a
    result, Monitoring and Compliance personnel would have to manually search more than
    100 separate LEA tracking logs to determine which LEAs had repeat findings or analyze
    the frequency of specific findings across the State.” DPI staff attempted to correct this
    inaccuracy in its response to the “Fact Checking Document” and in later conversations
    with the OIG Audit team. DPI staff explained that DPI has always had the ability to
    implement a process utilizing existing audit tracking logs and/or individual files to
    identify multi-year trends. Consolidation of the excel file format annual audit logs or use
    of another system by any of School Businesses’ Data Analysts could have created reports
    for this information in a short amount of time.


•   On page 12 of 16, under the Management decisions lacked required content and were not
    always issued as required section, the report reads, “Regarding the deficiencies in the later
    management decisions, DPI officials did not understand that explicit statements regarding
    whether each finding was sustained and the reason for that decision were required.” This
    statement is inaccurate. While our interpretation of the federal requirements differs from that
    of the OIG Audit Team, at no time did DPI officials misunderstand the requirements.
The Department appreciates the opportunity to offer these responses, and welcomes any
questions or feedback.

Sincerely,

Signature on file

Philip W. Price

PWP/LAK/tm

c: June Atkinson, State Superintendent
Alexis Schauss, Director of School Business
Leigh Ann Kerr, Assistant Director of School Business