■ MONEY
Charles K. Trainor
Where the Money Is
Without strong internal controls in place, your school district
is vulnerable to fraud. How can you ensure that your district
does not become a white-collar crime scene?
W illie Sutton, the Brooklyn-
born bank robber and inaugural mem-
ber of the FBI’s Ten Most Wanted list,
was once asked why he robbed banks.
He responded: “Because that’s where
the money is.” According to the
National Center for Educational
Statistics, $487.8 billion in revenues
were collected in 2004-05 for public ele-
mentary and secondary education in the
50 states and the District of Columbia. It
is safe to say school districts qualify as
places “where the money is.”
Boards like to think of the K-12 world
66 American School Board Journal/September 2007
as a safe, secure environment with ded-
icated teachers, support staff, and
administrators collaborating to provide
children with a quality education. Most
boards have a high comfort level with
how the administration operates and
never expect the district to be a white-
collar crime scene. Think of how many
times you have heard this phrase:
“Problems happen somewhere else, not
in our district.”
But they could happen to you. Go to
Google and search the phrase “school
district fraud.” The results will stun you.
Real-life examples of fraud
Clearly, there is an urgent need for
boards to pay more attention to
fraud and to ensure that your dis-
trict has a robust internal control
environment. Or you could face
something like these school dis-
tricts:
■ In North Carolina, the Wake
County School District recovered
nearly $5 million in August 2006 in a
fraud scheme involving a trans-
portation parts supplier and
employees who took advantage of
weaknesses in the purchasing sys-
tem. For two years, phony invoices
were used to order and pay for
goods and parts that the district
never received. The district still
can’t calculate its total loss. Six indi-
Reprinted with permission from American School Board Journal, September 2007
© 2007 National School Boards Association. All rights reserved.
viduals have been jailed as a result of
the fraud.
■ In San Francisco, several corpora-
tions and individuals were indicted in
May 2004 for defrauding the Federal
Communications Commission’s E-Rate
program. The program was established
to provide funding to buy and install
wiring, routers, switches, and other
equipment to bring the Internet to urban
and rural school districts. An investiga-
tor for the San Francisco City Attorney’s
office estimated the loss to be hundreds
of millions of dollars.
■ In South Carolina, a 12-count
indictment in April 2006 alleged that a
former school district official commit-
ted mail and wire fraud in an unrelated
scheme to defraud the E-Rate program.
According to the indictment, the official
awarded $3.5 million in contracts to her
own company, bypassing the required
competitive bidding process.
Additional scandals involving school
districts have been reported in California,
New York, Texas, Pennsylvania, Michigan,
and Illinois, so it’s easy to see that K-12
districts are prime targets for fraud.
At the same time, you risk losing
something even greater if fraud hap-
pens on your watch—your reputation.
Community members remember when
things go wrong. Scandals are not soon
forgotten and lingering suspicion may
jeopardize future district projects or
programs. It can take years to recover
the public’s trust.
Tools to prevent fraud
How can you protect the district from
unscrupulous thieves and other risks?
You can’t guarantee that fraud can be
prevented, but strategies exist that can
make it more difficult.
 For example, you can establish an
anonymous fraud tip hotline and enact
a whistleblower protection policy. The
hotline can be a local program or one
established by the state attorney gener-
al or comptroller. A whistleblower pol-
icy protects individuals who report sus-
picions of fraud and waste in the dis-
trict.
Setting an example regarding ethical
behavior is another strategy the board
can implement. Policies outlining
expected ethical conduct of the board,
administrators, and staff send a clear
message, especially when specific
examples are included. The policies
should clearly communicate the severe
consequences of unethical or criminal
behavior. This process is called setting
the “Tone at the Top.”
Another valuable resource districts
can use is the Committee of Sponsoring
Organizations (COSO) framework to
manage risk. COSO, a voluntary private
sector organization, is an outcome of
the Treadway Commission, which was
formed in 1985 in response to the
Foreign Corrupt Practices Act.
COSO’s major objectives are to iden-
tify factors that lead to fraudulent
financial reporting and to improve
governance through business ethics
and effective internal controls. COSO
is funded by five professional organiza-
tions: American Institute of Certified
Public Accountants, American
Accounting Association, Financial
Executives Institute, the Institute of
Internal Auditors, and the Institute of
Management Accountants.
An integrated framework
COSO has developed an important tool
for assessing vulnerability to risk. Known
as the Internal Control Integrated
Framework, the tool takes a holistic view
of all risks an organization faces, not just
the financial risks.
The framework provides a struc-
tured approach to organize the compo-
nents of a district’s operation into a
manageable format, facilitating a con-
tinual review of policies and procedures
with administrators. The model com-
Reprinted with permission from American School Board Journal, September 2007
© 2007 National School Boards Association. All rights reserved.
prises five categories: control environ-
ment, control activities, information and
communication, monitoring, and risk
assessment.
Control environment refers to the dis-
trict’s culture. Codes of conduct and
other policies regarding acceptable busi-
ness practice, conflicts of interest, or
expected standards of ethical and moral
behavior are examined. The review
ensures that policies are in place and
implemented.
Evaluating control activities requires
an analysis to determine whether the
district has appropriate policies and
procedures to achieve its objectives of
providing a quality education at a rea-
sonable cost. An example is verifying
that your policies governing absences
provide administrators with the type
and volume of information they need to
evaluate teacher and student achieve-
ment and attendance. In addition, con-
trol activities are examined to see if they
are being applied properly.
Information and communication, the
third COSO component, examines how
the district obtains and transmits the
necessary external and internal infor-
mation to management. For example,
the tool evaluates how administrators
gather data to measure financial stabili-
ty, budgetary controls, and other perti-
nent data. Subsequent distribution of
this information both within the district
and to outside regulatory authorities is
also analyzed. In addition, the tool
reviews the development or revision of
information systems based on the dis-
trict’s overall strategy, activity level, and
objectives.
The COSO framework’s monitoring
component allows you to analyze how
your staff determines if the internal con-
trol measures are working. Staff mem-
bers who are committed to helping the
district achieve its mission or objectives
are well suited to determine whether
the controls put in place are effective.
This process encourages staff members
who recognize a problem to report the
information to administrators and possi-
bly suggest a solution.
Finally, the framework examines the
American School Board Journal/September 2007 67
thoroughness and relevance of the risk
analysis process, including estimating
the significance of risks, assessing the
likelihood of their occurring, and deter-
mining needed actions. For example, an
area with a high volume of small value
transactions may be assigned a lower
risk. On the other hand, an area with a
small volume of high value transactions
may warrant more scrutiny.
Additional information about the COSO
framework and a derivative of COSO
called Enterprise Risk Management can be
found on the Institute of Internal Auditors
website at www.theiia.org.
It’s your obligation
To fulfill your obligation to provide true
governance, you must elicit cooperation
and support from administrators who
implement internal controls on a day-to-
day basis. Without such collaboration,
your efforts to control risk will fail.
As board members, you are responsi-
ble for introducing the concept of con-
trol and convincing the administration
of its value to the district. Once admin-
istrators commit to the concept, they
can encourage all staff to participate in
the process of identifying and minimiz-
ing risks.
In the world of K-12 education, board
members control a great deal of taxpay-
er money and you are obliged to protect
these funds. The good news is that you
don’t have to do it alone. Local or region-
al school board associations, state
comptrollers, internal and external audi-
tors, and organizations such as COSO
are invaluable sources of assistance.
Your district could be targeted by
modern day Willie Suttons. It is your
responsibility to make sure that those
who would steal from taxpayers and
children find the task more difficult
than robbing a bank. ■
Charles K. Trainor (mgmtaudit@aol.com), a
certified internal auditor and certified fraud
examiner, is president of Management
Audit Consultants, Inc. An ASBJ contribut-
ing editor, he is a 21-year member and
president of New York’s Briarcliff Manor
School Board.