We evaluated six important IT security controls and the comprehensive IT security management process at nine state agencies. We found that most agencies’ IT security controls we reviewed were not strong enough to help ensure that confidential information was adequately protected. Moreover, most agencies had weak controls to help ensure strong and secure staff passwords, and almost all agencies did a poor job of patching software vulnerabilities for both workstations and servers. Most agencies did not adequately train staff on IT security issues, and none of the agencies had fully developed and tested a continuity of operations plan. While most agencies adequately controlled their IT inventory, four agencies were missing or had lost track of computers. On the other hand, we found only a few problems with network access points, which were largely controlled by the Office of Information Technology Services. None of the agencies had a fully developed security management process, but all nine had at least some process components. Finally, security controls were far stronger at agencies where management made IT security a priority.
State law requires an annual financial audit of the Kansas Lottery. Cochran Head Vick & Co., P.A., a certified public accounting firm under contract with Legislative Post Audit, conducted this audit. The auditors expressed an unqualified opinion on the financial statements, meaning that the financial statements present the lottery’s financial position fairly and in conformity with generally accepted accounting principles in all material respects.
The auditors did report one material weakness in the lottery’s internal control over financial reporting, indicating that it does not have adequate controls to prevent or detect a misstatement. These problems included having certain amounts that did not agree with the underlying supporting documentation.
Kansas Public Employees Retirement System: Fiscal Year 2012
State law requires an annual financial audit of the Kansas Public Employees Retirement System. Cochran Head Vick & Co., P.A., a certified public accounting firm under contract with Legislative Post Audit, conducted this audit. The auditors expressed an unqualified opinion on the financial statements, meaning that the financial statements present KPERS’ financial position fairly and in conformity with generally accepted accounting principles in all material respects. The auditors did not report any deficiencies in the system’s internal control over financial reporting.
Examining Selected Financial Management Practices of the Pooled Money Investment Board, Fiscal Year 2012
The Legislative Post Audit Act requires this audit of the Pooled Money Investment Board. RubinBrown, a certified public accounting firm under contract with Legislative Post Audit, conducted this examination. The examination addresses five selected financial management responsibilities of the Pooled Money Investment Board, mainly those involving the board's fiscal accountability for moneys. The auditors identified no deficiencies in the board’s practices and found that the fiscal year 2012 average yield on investments was within 0.5% of the benchmark.
Examining Selected Financial Management Practices of the State Treasurer’s Office, Fiscal Year 2012
The Legislative Post Audit Act requires this audit of the State Treasurer’s Office. RubinBrown, a certified public accounting firm under contract with Legislative Post Audit, conducted this examination. The examination addresses 10 selected financial management responsibilities of the State Treasurer’s Office. The auditors found that the management’s assertions were fairly stated in all material respects, meaning that, for the areas examined, the Office complied with the applicable statute. The auditors noted some minor issues with delivery of the daily cash sheet and with a late distribution of highway equalization funds.
K-12 Education: Estimating Potential Costs Related to Implementing the No Child Left Behind Waiver in Kansas
Overall, school districts will likely incur between $34 million and $63 million in real or opportunity costs over the next five years to implement the four principles of the NCLB waiver, while the Kansas State Department of Education (KSDE) will incur little cost and may achieve savings during that time. Real costs refer to out-of-pocket expenditures for goods and services. Opportunity costs refer to the value of alternatives that must be foregone to pursue other options.
Most of the school district costs ($32 million to $60 million) are related to implementing the Common Core standards (Principle 1), but KSDE’s costs for this principle should be minimal. Our estimate of the total cost to implement the Common Core standards in Kansas significantly lower than other studies’ estimates to implement those standards.
Neither KSDE nor school districts should incur any significant costs to assess student and school performance (Principle 2), and KSDE could save about $3 million per year by not having to develop student assessment tests. We estimate school districts could incur costs of up to $3 million to train teachers and administrators to use the new evaluation system (Principle 3), but KSDE’s costs should be minimal. Finally, neither districts nor KSDE should incur any additional costs related to reducing paperwork and reporting (Principle 4).
State Asset Management: Evaluating the Possibility of Cost Savings and Revenue Enhancements through Property Sales.
Our targeted review identified eight surplus properties that could be sold for an estimated $1.5 million to $2.2 million. We found that identifying surplus real property is a subjective, lengthy, and sometimes difficult process. That is because property use must be periodically evaluated, the owner and boundaries of land are not always clear, and lease agreements can make it more difficult to determine whether land or buildings are surplus. Additionally, the Department of Administration has not proactively identified surplus real property as required by law and lacks the authority to independently designate what properties are surplus. Moreover, the process for selling surplus real property includes several disincentives for state agencies. Finally, delays in selling the Atchison Juvenile Correctional Facility highlight problems with the surplus real property disposal process. We also found that the State Surplus Property program is not an efficient way of disposing of surplus personal property. In each of the past two years, the program operated at a net loss of approximately $50,000. Further, the state’s contractor for online auctions is better equipped to maximize agencies’ revenues from selling surplus items and several state agencies prefer to use the state’s contractor instead of the state’s program. Finally, agencies do not want to sell surplus vehicles because they are hard to replace once sold, and agencies have few negative consequences for holding onto surplus personal property.
JJA: Evaluating the Kansas Juvenile Correctional Complex, Part 2
This audit of the Kansas Juvenile Correctional Complex was issued in two parts. Part 1 evaluated safety and security at the facility and was released in July 2012. Part 2 focuses on education and substance abuse programs at the facility.
The Kansas Juvenile Correctional Complex (KJCC) provides adequate basic academic programs to help juvenile offenders earn a high school diploma or equivalent, and those programs are generally equitable for male and female offenders, although there are some exceptions. On the other hand, the technical education and work study programs are not adequate to prepare juveniles for future work opportunities and are not equitable because female offenders do not have access to comparable programs. In addition, KJCC does not currently offer any postsecondary programs to juvenile offenders. Overall, Juvenile Justice Authority (JJA) and KJCC officials have taken a hands-off approach to education programs. For example, they have not formulated plans or established partnerships for appropriate education programs at the facility, nor have they regularly or systematically assessed the effectiveness of the programs.
Under current state law, juvenile correctional facilities are allowed to provide substance abuse services without being licensed as a treatment facility. However, providing unlicensed substance abuse treatment could affect the quality of services and limit some funding opportunities. Although most offenders in Kansas’ juvenile correctional facilities need substance abuse services to reduce the likelihood they will reoffend, the substance abuse services at KJCC are not properly designed to meet the individual needs of offenders. In addition, JJA officials suspended all substance abuse services at KJCC for nearly six months in 2011. Finally, JJA and KJCC officials lack sufficient management information to ensure that juveniles receive adequate and appropriate substance abuse services.
The Board of Veterinary Examiners: Evaluating Issues Related to the Board’s Management
In fiscal year 2011, the board authorized two unconventional personnel actions; one was appropriate and one was not. The first was an almost 1,000 hour furlough of the director, which was not appropriate because it was not expressly allowed by law, was not submitted to the Department of Administration for approval, and did not appear to be necessary for budgetary reasons. It also coincided with a period when the director worked a second job in the veterinary field. However, the impact of the furlough on the state was relatively small because the director’s pay was reduced during the furlough and his other benefits remained largely unaffected. The second action was the board’s decision to reduce the director’s pay to give the other two agency staff pay raises. This action appeared to have been approved appropriately.
The director’s general lack of proper oversight resulted in poor management of board activities and staff. While the director was on furlough in 2010 and 2011, the other two agency staff were inadequately managed. In addition, we found problems with the agency’s cash handling process which is poorly designed and inadequately supervised, putting the agency at risk for fraud or abuse. The agency’s inspection process also has a number of deficiencies and appears superficial. Finally, the agency lacks written policies and procedures and does not maintain appropriate management data.
JJA: Evaluating the Kansas Juvenile Correctional Complex, Part I
The Kansas Juvenile Correctional Complex (KJCC) has not taken adequate steps to ensure the safety of juvenile offenders and staff. We identified numerous safety and security problems at the facility, including that staff have not adequately supervised juvenile offenders, which has led to offender injuries and misconduct. In addition, staff routinely have allowed doors to be propped open or unlocked, allowing offenders to freely roam living units and have access to unauthorized areas. Also, KJCC officials and staff have done a poor job of keeping prohibited items out of the facility and have not tracked, inventoried, or secured keys and tools.
Safety and security problems at the facility have been compounded by poor personnel management. KJCC officials have employed staff with felony or drug convictions because the background check process was inadequate. Also, juvenile corrections officers have not received sufficient and appropriate training in recent years. In addition, KJCC officials have done a poor job of disciplining staff for policy violations, and there is some evidence that shifts at KJCC have not been staffed and supervised properly to ensure safety and security.
Overall, the environment at KJCC has not been conducive to ensuring the safety and security of juvenile offenders and staff. KJCC’s management has been disorganized and has done a poor job of communicating safety and security policies. In addition, severe problems with turnover have increased safety and security risks. Finally, JJA and KJCC officials appear to have favored convenience and expedience over safety and security, and have done a poor job of addressing safety and security problems once they have become aware of them.
Foster Care Decisions: Reviewing Decisions To Remove Children from Their Homes
The Department for Children and Families (formerly SRS) serves about 5,200 children a day through foster care. Based on complaints made by foster care families, legislators wanted an independent review of several cases to determine if state officials acted appropriately. For the cases we reviewed, department, law enforcement and court officials had sufficient and convincing reasons for removing children from their parents and not reuniting them. Although our conclusions are based solely on our review of nine cases and cannot be projected to the foster care system as a whole, they are consistent with the findings of a recent internal audit conducted by the department. Although families alleged their cases were mishandled, the allegations we could evaluate were contradicted by the evidence we reviewed, and did not adversely affect case outcomes. In addition, family members consistently expressed concerns about the foster care program for several reasons. Sometimes, parents may not have fully understood all the aspects of their child’s case and therefore felt like they had been treated unfairly. Also, parents and relatives often disagreed with key decisions affecting where their child was placed. Lastly, parents’ actions or personal circumstances can further delay or prevent reunification with their children.
Kansas Lottery: Funding of Scholarships for Veterans
We looked to see whether the state’s National Guard Educational Assistance Program duplicates available federal benefits for members of the National Guard. We found that there is some limited duplication between the state’s program and federal Post 9-11 GI Bill (GI Bill), but eliminating the state’s program would significantly affect members of the Air National Guard. Specifically, state and GI Bill funding cover two different National Guard populations, although there is some overlap. Further, for veterans who are eligible for both the state and federal programs, it is rare that federal dollars could fully replace state benefits. Finally, eliminating the state’s National Guard Educational Assistance Program would have little impact on members of the Army National Guard, but would significantly affect members of the Air Guard. We also noted that while the National Guard Educational Assistance Program is supposed to be funded through the Lottery’s Veteran game, State General Fund monies have made up a significant portion of the program’s funding. Further, we noticed that language in the National Guard Educational Assistance Act may be outdated.
State of Kansas: Financial Audit of Fiscal Year 2011 (Reissued)
State law calls for an annual audit of the general purpose financial statements and “the financial affairs and transactions of a state agency required to comply with federal government audit requirements…” RubinBrown, under contract with Legislative Post Audit, conducted this two-part audit. This first part is the report on the state’s Comprehensive Annual Financial Report (CAFR). The second part, the Report on Federal Awards in Accordance with OMB Circular A-133, will be issued as a separate report.
The auditors concluded that the basic financial statements present the state’s financial position fairly and in conformity with generally accepted accounting principles and disclosed no instances of noncompliance with applicable legal requirements that were material to the state’s financial statements. However, the auditors did report four material weaknesses and one significant deficiency in internal control over financial reporting. The material weaknesses included not having sufficient controls to identify and correct potential misstatements, not reconciling the pooled cash account until after the fiscal year closed, not properly recording certain revenues, receivables, and payables, and not capturing and properly depreciating all capital assets. The auditors identified the need for several material adjusting entries as a result of these deficiencies, and several previous fund balances had to be restated.
Department on Aging: Evaluating the Effect of Increasing Minimum Nursing Hours on Resident Care and State Costs
Although the results are mixed, the most thorough research generally shows a positive relationship between staffing levels and quality of care outcomes in nursing facilities. Further, according to the federal Centers for Medicare and Medicaid Services (CMS), increasing staffing levels up to 4.1 hours of nursing care per resident day improved health outcomes. In addition to staffing levels, researchers also identified a number of other staff-related factors that are important in improving quality of care, such as staffing levels on different shifts or units and staff training. We were unable to detect a clear relationship between nursing hours and quality of care outcomes for Kansas’ nursing facilities, though this may be due to limitations in the data we were able to use.
Senate Bill 184, which was introduced but not passed during the 2011 legislative session, would have increased minimum nursing staff requirements in Kansas nursing facilities over a three-year period. However, the bill’s third year staff level requirements of 4.44 nursing hours per resident day are beyond the level the Centers for Medicare and Medicaid Services identified as leading to improved quality of care. We estimated it would cost the state up to $43 million annually to fully implement Senate Bill 184’s requirements. Although increasing staffing levels may improve health outcomes, better outcomes are unlikely to result in meaningful savings for the state. This is because the most significant costs associated with negative health outcomes are paid for with federal funds. As a result, most savings achieved through better outcomes will benefit the federal government, but not the state.
State of Kansas: OMB Circular A-133 Audit of Fiscal Year 2011 (Reissued)
State law calls for an annual financial-compliance audit of the general purpose financial statements and “the financial affairs and transactions of a state agency required to comply with federal government audit requirements…” RubinBrown, under contract with Legislative Post Audit, conducted this two-part audit. The first part was the report on the Office of Management Analysis and Standards Comprehensive Annual Financial Report. This second part, the Report on Federal Awards in Accordance with OMB Circular A-133, reports on compliance with laws, regulations, and provisions of contracts and grant agreements.
The auditors concluded that, except for the Special Education Cluster, the state complied, in all material respects, with the requirements applicable to each of the federal programs audited. However, the auditors reported seventeen deficiencies in internal control, one of which was a material weakness, and identified a total of $34.2 million in questioned costs. Six of the findings were repeated from prior years.
State Employee Residence: Assessing Potential Increases in Revenues by Requiring State Employees to Reside in Kansas
We estimate that about 3,600 state and school district employees live outside Kansas. Imposing a residency requirement for state employees would only generate new tax revenues if out-of-state employees move to Kansas. If 25% of all out-of-state employees move to Kansas, a residency requirement could generate approximately $2 million a year in state and local tax revenues. This includes $1.4 million in new taxes paid by the employees, and another $650,000 in indirect tax revenues from increased economic activity. However, in order to generate meaningful revenues, a residency requirement would need to be implemented aggressively, which would significantly affect out-of-state employees. If the requirement was put into effect in the near term, employees would have to move or seek new employment. Grandfathering in current out-of-state employees would remove the impact on them, but would essentially eliminate the new tax revenue. Finally, adopting a residency requirement would limit the labor pool for state agencies and could be expensive to administer.
Kansas Board of Regents: Evaluating the Effects of Eliminating the Kan-ed Program
The Kan-ed program provides access to a network to which schools, libraries and hospitals can connect for broadband Internet, video conferencing, and distance learning. Access is free for those entities, but Kan-ed pays about $690 per month for each connection. The network was designed to support high-quality video conferencing and distance learning, and although the network can be used to access the Internet, it is a very slow and expensive way of providing Internet access. Further, most members connected to the network don’t need the network—they need only commercial Internet access (for about $70 per month) or no Internet connection at all. By disconnecting members that do not need the network for video conferencing and using commercial Internet connections instead, Kansas could save as much as $2 million a year, although some one-time penalties may apply. In addition, we found that about one-third of connected members used the network for video conferencing or distance learning. Most of those members were K-12 schools and higher education institutions. Hospitals and libraries rarely used the network for video conferencing. While we identified a number of less costly alternatives that could support video conferencing and distance learning, the costs and quality would vary. Next, although Kan-ed has routinely funded databases and software services, it is not part of their mission and it is not clear if the Kansas Universal Service Fund can be used for this purpose. Further, the Kan-ed program has focused on connecting new members and has not been managed to control costs. Related to that, Kan-ed has not formally assessed each member’s needs before connecting them and has done a poor job of monitoring network connections to ensure that members actually need them and has rarely disconnected unneeded connections. Finally, the program has provided almost $1 million in grants and subsidies since 2009 to entities who are not eligible for membership.