Financial Management Practices Audit Report

Montgomery County Public Schools

September 2022

Public Notice:

In compliance with the requirements of the State Government Article Section

2-1224(i), of the Annotated Code of Maryland, the Office of Legislative
Audits has redacted cybersecurity findings and related auditee responses
from this report.

OFFICE OF LEGISLATIVE AUDITS

DEPARTMENT OF LEGISLATIVE SERVICES
MARYLAND GENERAL ASSEMBLY
 Joint Audit and Evaluation Committee
Senator Clarence K. Lam, M.D. (Senate Chair) Delegate Mark S. Chang (House Chair)
Senator Malcolm L. Augustine Delegate Steven J. Arentz
Senator Adelaide C. Eckardt Delegate Nicholas P. Charles II
Senator George C. Edwards Delegate Andrea Fletcher Harrison
Senator Katie Fry Hester Delegate Trent M. Kittleman
Senator Cheryl C. Kagan Delegate Carol L. Krimm
Senator Benjamin F. Kramer Delegate David Moon
Senator Cory V. McCray Delegate Julie Palakovich Carr
Senator Justin D. Ready Delegate Elizabeth G. Proctor
Senator Craig J. Zucker Delegate Geraldine Valentino-Smith

To Obtain Further Information

Office of Legislative Audits
The Warehouse at Camden Yards
351 West Camden Street, Suite 400
Baltimore, Maryland 21201
Phone: 410-946-5900
Maryland Relay: 711
TTY: 410-946-5401 ꞏ 301-970-5401
E-mail: [email protected]
Website: www.ola.state.md.us

To Report Fraud
The Office of Legislative Audits operates a Fraud Hotline to report fraud, waste, or abuse involving State
of Maryland government resources. Reports of fraud, waste, or abuse may be communicated anonymously
by a toll-free call to 1-877-FRAUD-11, by mail to the Fraud Hotline, c/o Office of Legislative Audits, or
through the Office’s website.

Nondiscrimination Statement
The Department of Legislative Services does not discriminate on the basis of age, ancestry, color, creed,
marital status, national origin, race, religion, gender, gender identity, sexual orientation, or disability in the
admission or access to its programs, services, or activities. The Department’s Information Officer has been
designated to coordinate compliance with the nondiscrimination requirements contained in Section 35.107
of the United States Department of Justice Regulations. Requests for assistance should be directed to the
Information Officer at 410-946-5400 or 410-970-5400.
 September 29, 2022

Senator Clarence K. Lam, M.D., Senate Chair, Joint Audit and Evaluation Committee
Delegate Mark S. Chang, House Chair, Joint Audit and Evaluation Committee
Members of Joint Audit and Evaluation Committee
Annapolis, Maryland

Ladies and Gentlemen:

We conducted an audit of the financial management practices of the Montgomery

County Public Schools (MCPS) in accordance with the requirements of the State
Government Article, Section 2-1220(e) of the Annotated Code of Maryland. The
objectives of this audit were to evaluate whether MCPS’ procedures and controls
were effective in accounting for and safeguarding its assets and whether its
policies provided for the efficient use of financial resources.

Our audit disclosed that MCPS’ procurement policies were not sufficiently
comprehensive and were not always consistently used when obtaining goods and
services under intergovernmental cooperative purchasing agreements. In
addition, our test of 10 construction-related procurements totaling $192.3 million
disclosed that MCPS did not always document compliance with State
procurement laws and its policies for construction-related procurements, as it did
not maintain documentation for losing bids, fee negotiations, and bid openings in
the presences of witnesses. Furthermore, MCPS did not always perform
inspections of contracted construction projects or prepare reports of inspections
performed in accordance with written procedures, assess liquidated damages
when the related contractor missed project completion deadlines, or ensure proper
supporting information was provided prior to payment.

Our audit also disclosed that MCPS did not competitively procure or establish a
fixed cost to be paid on a contract to use a vendor’s school bus safety camera
system to assess violations against drivers that illegally pass a stopped school bus.
In addition, the contract lacked sufficient details to enable effective monitoring of
the amounts invoiced and paid to the vendor, which totaled $21.9 million as of
June 30, 2021.

Significant risks existed within MCPS’ computer network. However in

accordance with the State Government Article, Section 2-1224(i) of the
Annotated Code of Maryland, we have redacted these findings from this audit
report. Specifically, State law requires the Office of Legislative Audits to redact
cybersecurity findings in a manner consistent with auditing best practices before
the report is made available to the public. The term “cybersecurity” is defined in
the State Finance and Procurement Article, Section 3A-301(b), and using our
professional judgment we have determined that the redacted findings fall under
the referenced definition. The specifics of the cybersecurity findings were
previously communicated to MCPS as well as those parties responsible for acting
on our recommendations.

Furthermore, our audit also disclosed that MCPS needs to improve internal
controls and accountability in certain areas, including payroll processing and
health care claims and fee processing; and had not formalized its financial
relationship with an affiliated foundation. For example, MCPS did not ensure
critical human resources and payroll transactions were independently reviewed
for propriety.

Finally, based on our current audit assessment of significance and risk to our audit
objectives, our audit included a review to determine the status of 12 of the 16
findings contained in our preceding audit report. For the non-cybersecurity-
related findings we determined that MCPS satisfactorily addressed 2 of these
findings. The remaining 3 findings are repeated in this report as 4 findings.

MCPS’ response to this audit is included as an appendix to this report. We

reviewed the response to our findings and recommendations, and have concluded
that the corrective actions identified are sufficient to address all audit issues. In
accordance with our policy, we have edited MCPS’ response to remove any
vendor names or products mentioned by MCPS in this document. Consistent with
the requirements of State law, we have redacted the elements of MCPS’ response
related to cybersecurity audit findings.

We wish to acknowledge the cooperation extended to us during our audit by

2
MCPS and its willingness to address the audit issues and to implement
appropriate corrective actions.

Respectfully submitted,

Gregory A. Hook, CPA

Legislative Auditor

3
4
 Table of Contents

Background Information 7

Statistical Overview 7
Oversight 8
External Audits 9
Status of Findings From Preceding Audit Report 10
Transportation Management Personnel Under Investigation 11

Findings and Recommendations 14

Revenue and Billing Cycle 14

Federal Funds 15

Procurement and Disbursement Cycle

 Finding 1 – MCPS procurement policies did not incorporate certain 17
requirements of State law and recognized best practices when
participating in intergovernmental cooperative purchasing agreements
(ICPA). In addition, ICPA invoices were not always verified to
related contract pricing.

Human Resources and Payroll

 Finding 2 – MCPS did not ensure critical human resources and payroll 20
transactions were independently reviewed for propriety.

Equipment Control and Accountability 20

Information Technology
Finding 3 – Redacted cybersecurity-related finding 21

Finding 4 – Redacted cybersecurity-related finding 21

Finding 5 – Redacted cybersecurity-related finding 21

Finding 6 – Redacted cybersecurity-related finding 21

Finding 7 – Redacted cybersecurity-related finding 21

 Denotes item repeated in full or part from preceding audit report

5
 Facilities Construction, Renovation, and Maintenance
Finding 8 – MCPS did not always comply with State procurement laws 22
and its policies for construction-related procurements.

Finding 9 – MCPS did not always perform inspections of construction 24

projects, assess liquidated damages, or ensure proper supporting
information was provided prior to payment.

Transportation Services
 Finding 10 – MCPS contracted with a vendor for a school bus camera 28
system without a competitive procurement process or a fixed total
cost to be paid. In addition, the contract lacked sufficient details to
enable effective monitoring of the amounts invoiced and paid to the
vendor.

Finding 11 – Redacted cybersecurity-related finding 31

Food Services 31

School Board Oversight 32

Management of Other Risks

 Finding 12 – MCPS did not audit or adequately monitor the 34
performance of its third-party administrators that provide health care
claims processing services.

Finding 13 – MCPS did not have a memorandum of agreement with its 35

affiliated foundation to address each entity’s roles and
responsibilities.

Audit Scope, Objectives, and Methodology 37

Agency Response Appendix

 Denotes item repeated in full or part from preceding audit report

6
 Background Information

Statistical Overview

Enrollment
According to student enrollment records compiled by the Maryland State
Department of Education (MSDE), Montgomery County Public Schools (MCPS)
ranks first in student enrollment among the 24 public school systems in Maryland.
Fiscal year 2020 full-time student enrollment was 165,267 students. MCPS had
208 schools, consisting of 135 elementary schools, 40 middle schools, 25 high
schools, and 8 other types of schools (including 5 special, 2 early childhood
learning centers, and 1 alternative).

Funding
MCPS revenues consist primarily of funds received from the Montgomery
County, State, and federal governments. According to MCPS’ audited financial
statements, revenues from all sources totaled approximately $3.2 billion in fiscal
year 2020; including approximately $989.8 million from the State. See Figure 1
below for MCPS’ revenue sources per enrolled student in fiscal year 2020
according to its audited financial statements.

Figure 1
MCPS’ Revenue Sources Per Enrolled Student
Fiscal Year 2020
Federal Miscellaneous
$942 $208
5% 1%

State
$5,989
31%

Local
$12,143
63%

Source: MCPS’ Fiscal Year 2020 Audited Financial Statements and MSDE Data

7
Expenditures
According to MCPS’ audited financial statements, fiscal year 2020 expenditures
were approximately $3.4 billion. The largest expenditure category was salaries
and wages, including benefits, which accounted for approximately 74.5 percent of
total expenditures during fiscal year 2020. According to MSDE records, during
the 2019-2020 school year, MCPS had 22,447 full-time equivalent positions,
which consisted of 15,491 instructional and 6,956 non-instructional positions.
Instruction accounted for over half of MCPS’ expenditures on a categorical basis
(see Figure 2).

Figure 2
MCPS Expenditures by Category and Selected Statistical Data
Fiscal Year 2020
(amounts in millions)

$2,022
Instruction
60%

$562
Facilities & Capital Projects
17%
$360
Enrollment
Special Education 165,267
10%

$274
Administration & Support 8% Employees
22,447
$109
Transportation
3%
Cost Per Pupil
$61 $20,502
Food Service
2%

Source: MCPS' Fiscal Year 2020 Audited Financial Statements and MSDE Data

Oversight

MCPS is governed by a local school board, consisting of seven elected voting

members and one voting student member. The student member has the same
rights and privileges as an elected member, and can vote on and participate in all
matters except those specifically prohibited by law, such as the suspension or
dismissal of teachers, principals, and other professional personnel. In accordance
with State law, MSDE provides considerable oversight of MCPS through the
establishment and monitoring of various financial and academic policies and
regulations. MSDE also works with MCPS to comply with the requirements and

8
mandates of federal law. The Montgomery County government also exercises
authority over MCPS primarily through the review and approval of MCPS’
annual operating and capital budgets.

External Audits

MCPS engages a certified public accounting firm to independently audit its

annual financial statements. The firm performs procedures to verify the amounts
and disclosures in the financial statements. The firm also evaluates the
appropriateness of accounting policies used and the reasonableness of significant
accounting estimates made by management. In the related audit reports, the firm
stated that the financial statements presented fairly, in all material respects, the
financial position of MCPS as of June 30, 2015, 2016, 2017, 2018, 2019, and
2020 and the changes in its financial position and its cash flows for the years then
ended in accordance with accounting principles generally accepted in the United
States of America.

Additionally, in accordance with Government Auditing Standards, as part of the

audited financial statements the accounting firm also issued separate reports on
MCPS’ control over financial reporting and its tests of MCPS’ compliance with
certain provisions of laws, regulations, contracts, grant agreements and other
matters. This report is an integral part of the annual independent audited financial
statements. The accounting firm also conducts the Single Audit of MCPS’ federal
grant programs. The Single Audit is intended to provide assurance to the federal
government that adequate internal controls are in place, and the entity is generally
in compliance with program requirements.

We reviewed the aforementioned financial statement audits and Single Audit

reports for fiscal years 2015 through 2020, and examined the related work papers
for the fiscal year 2020 audits, which were the latest available during our audit
fieldwork.

Certain work of the independent certified public accounting firm, which we

determined was reliable, covered areas included in the scope of our audit. As a
result, we did not conduct any audit work related to the following areas:

 State and local government revenues received via wire transfer

 Accounts receivables
 Federal grant activity

The independent accounting firm did not disclose any material deficiencies in
these areas.

9
 Status of Findings From Preceding Audit Report

Based on our current assessment of significance and risk relative to our audit
objectives, our audit included a review to determine the status of 12 of the 16
findings contained in our preceding audit report dated May 19, 2016. As
disclosed in Figure 3, for the non-cybersecurity-related findings, we determined
that MCPS satisfactorily addressed 2 of these findings. The remaining 3 findings
are repeated as 4 findings in this report.

Figure 3
Status of Preceding Findings
Preceding Implementation
Finding Description
Finding Status
Checks received at certain locations were not recorded nor restrictively endorsed
Not repeated
Finding 1 immediately upon receipt, and accountability over the transfer of collections to the
(Not followed up on)
controller’s office for deposit was not established.
MCPS had not sufficiently pursued collection of delinquent accounts receivable
Not repeated
Finding 2 and non-cash credits could be processed without independent approval and
(Not followed up on)
adequate supporting documentation.

A number of employees had procurement and disbursement system capabilities

Finding 3 Status Redacted1
assigned which allowed them to perform incompatible functions.

MCPS awarded a $900,000 contract without using a competitive procurement

Repeated
process or justifying that decision and, for five other contracts tested, MCPS did
Finding 4 (Current Findings 1
not assess the benefits of intergovernmental cooperative purchasing agreements as
and 10)
required by State law.
MCPS’ monitoring of certain contracts did not ensure that the best value was
Finding 5 Not repeated
obtained or that payments did not exceed the contract amounts.
Independent reviews did not provide sufficient assurance that certain personnel Repeated
Finding 6
transactions, such as changes to employee information and salary, were proper. (Current Finding 2)
The MCPS core network firewalls were not configured to properly secure the
Finding 7 MCPS network, allowing overly broad network level access with insufficient Status Redacted
security event logging and monitoring
The MCPS network was not sufficiently secured to assist in the
Finding 8 detection/prevention of potential network security breaches and attacks, and Status Redacted
restrict access to critical servers.
Workstations and servers were not sufficiently protected against malware, as
Finding 9 administrative access was not properly restricted and systems were running Status Redacted
outdated or unsupported system software.

1
Specific information on cybersecurity findings has been redacted from this publicly available
audit report in accordance with State Government Article, Section 2-1224(i) of the Annotated
Code of Maryland.

10
 Figure 3
Status of Preceding Findings
Preceding Implementation
Finding Description
Finding Status
Network, application, and database account and password controls were not
Finding 10 sufficient to properly protect critical resources, as they did not meet minimum Status Redacted1
thresholds in accordance with recognized best practices.

Controls over the critical student information and financial management system
Finding 11 databases were not sufficient, as security activity was not logged, and various Status Redacted
software in use was no longer supported by the respective developers.

MCPS did not have a complete information technology disaster recovery plan for
Finding 12 Status Redacted
recovering computer operations.

Maintenance supervisors did not ensure work orders were completed timely and Not repeated
Finding 13
that the completion of work was properly recorded in the automated system. (Not followed up on)
MCPS did not use formal targets for revising bus routes or fully use its automated
Finding 14 routing software to improve route efficiency and 300 routes were found with Not Repeated
ridership significantly below bus ridership goals.
Bus maintenance work order records frequently did not reflect the current status of
Not repeated
Finding 15 assigned maintenance work, and discrepancies in the maintenance parts and
(Not followed up on)
supplies inventory were not timely investigated and resolved.

MCPS did not ensure the propriety of certain employee and retiree healthcare Repeated
Finding 16
claims paid by its plan administrators. (Current Finding 12)

Transportation Management Personnel Under Investigation

In September 2021, MCPS’ Procurement Department identified questionable

purchases through its normal review of credit card activity, which was referred to
MCPS’ Internal Audit Unit in accordance with MCPS’ Policy for Reporting and
Handling Fraudulent Actions by MCPS Employees, Agents, or Contractors.
MCPS’ Internal Audit Unit conducted a limited review in October 2021 of a
transportation management employee’s credit card activity. The Internal Audit
Unit issued a report dated November 17, 2021, which identified questionable
purchases (such as gift cards, furniture, and purchases shipped to the employee’s
_____________________
1
Specific information on cybersecurity findings has been redacted from this publicly available
audit report in accordance with State Government Article, Section 2-1224(i) of the Annotated
Code of Maryland.

11
home) made by the management employee.

MCPS further discovered the existence of an account maintained by a

transportation vendor outside the control of MCPS’ Office of Finance that was
funded with amounts owed to MCPS. This “off the books” account was used to
make payments to several MCPS employees and to purchase goods and services
circumventing MCPS’ established policies and procedures. Specifically, the
account was funded with amounts due to MCPS for liquidated damages resulting
from the transportation vendor failing to deliver goods timely and credits for
certain items included in the original bus procurement contract and paid for that
were subsequently cancelled.

Based on the results of the internal audit and the discovery of the account
maintained by the vendor, MCPS reported the questionable activity to the
Montgomery County Police Department. Additionally, MCPS hired an
accounting and advisory firm in December 2021 to conduct an independent
forensic investigation of the aforementioned account and certain transactions
during the period from July 2016 to January 2022.

In February 2022, the firm issued a report which identified that approximately
$1.2 million had been deposited in the account and that payments totaling
approximately $649,000 were made either directly to MCPS employees or for
purchases of goods and services purportedly on behalf of MCPS during the period
from October 2017 to November 2021. As of November 16, 2021, the account
had a balance totaling $535,036. The firm also reviewed MCPS credit card
purchases during the period July 2016 to January 2022 and identified purchases
totaling approximately $572,000 made by transportation department employees
that were considered questionable or required additional review. The firm stated
in the report that additional work would be necessary to fully investigate the
aforementioned activity.

On November 15, 2021, MPCS placed two transportation management employees

on administrative leave pending investigation into the questionable purchases.
One of the employees was subsequently terminated in February 2022 and the
other employee resigned in March 2022.

As of April 7, 2022, we were advised by MCPS management that MCPS, the

Montgomery County Police and State’s Attorney Office, were still conducting
investigations related to these issues. Specifically, MCPS was pursuing collection
of the credit balance totaling $535,036 with the transportation vendor, was
modifying its process for purchasing buses, and developing procedures for how it
accounts for changes to bus specifications; including ensuring that credits from

12
vendors are handled properly. Furthermore, MCPS management advised us that it
provided training on proper credit card usage, decreased credit card purchasing
limits as necessary, and eliminated credit cards based on limited or no purchasing
activity. Finally, MCPS was planning to further review certain questionable
credit card purchases identified by the firm.

13
 Findings and Recommendations

Revenue and Billing Cycle

Background
Montgomery County Public Schools (MCPS) revenues consist primarily of funds
received from Montgomery County, the State, and the federal government.
According to MCPS’ audited financial statements, revenues from all sources
totaled approximately $3.2 billion in fiscal year 2020; including approximately
$989.8 million from the State.

External Audits
There were similarities between the work of the independent certified public
accounting (CPA) firm that audited MCPS’ financial statements and the
objectives of our audit for certain revenue activities. As a result, we relied on this
work to provide audit coverage for State and local government revenues received
via wire transfer and accounts receivable, for which the CPA’s procedural review
and testing disclosed no material weaknesses or significant deficiencies.

School Activity Funds

Schools collect funds for other purposes such as student activities, clubs, and
school publications. Because they are not considered school revenue, these
school activity funds (referred to as Independent Activity Funds by MCPS) are
accounted for separately by each school, and reported in summary in the audited
financial statements. During fiscal year 2020, school activity collections totaled
$25.6 million and the June 30, 2020 fund balance was $15.4 million.

MCPS’ Board of Education (the Board) has a fiduciary responsibility to ensure

that school activity funds were used only for intended purposes. The independent
CPA firm contracted by MCPS to perform the annual financial audit also
conducts limited reviews of the school activity funds. These reviews consist
primarily of school activity fund bank reconciliations, and receipt and
disbursement transactions at selected schools performed on a rotating basis (five
were reviewed for fiscal year 2020). The CPA’s review did not disclose any
issues.

In addition, it is the policy of MCPS’ internal auditor to conduct annual audits of

the school activity funds at each of its schools.2 The reviews consisted of
evaluating and testing compliance with MCPS' policies, regulations, and

2
Due to the COVID-19 pandemic health crisis, audits of school activity funds were performed at
78 of the 208 schools in fiscal year 2020.

14
procedures as per the FY 2019 - 2020 Financial Manual - Cash Control of School
Funds. The Manual establishes standard procedures for all schools to follow to
ensure school activity funds are adequately safeguarded and accounted for in a
uniform manner. The results of the reviews were provided to the respective
school’s principal and MCPS management to be addressed. Our review of the
internal auditor’s findings for fiscal years 2019 and 2020 generally found the
management of these funds to be adequate and that any control weaknesses
identified were not prevalent. The internal audit reports reviewed did not identify
any improprieties regarding the misuse of funds.

Conclusion
Based on our current assessment of significance and risk relative to our audit
objectives, we relied on the work of the CPA and the MCPS internal auditor to
provide audit coverage in this area, including procedures and controls related to
the accounting for and safeguarding of cash receipts with respect to revenue and
billing.

Federal Funds

Background
MCPS receives funds pertaining to federal government programs that are
generally restricted for use for a specific program (such as the School Lunch
Program or Special Education). According to MCPS’ Single Audit, fiscal year
2020 expenditures totaled $123.8 million, not including federally funded fee-for-
service programs such as Medicaid reimbursement for special education services.

According to MCPS’ records, MCPS was awarded federal COVID-19 pandemic

grant funds totaling $422.7 million to be distributed over federal fiscal years 2020
to 2024 under the Coronavirus Aid, Relief, and Economic Security Act,
Coronavirus Response and Relief Supplemental Appropriations Act, and
American Recovery Plan Act. Eligible MCPS expenditures related to these
COVID-19 grant programs totaled $7.4 million, from March 2020 to May 2021,
and were primarily comprised of personal protection equipment and sanitary
supplies. MCPS initially funded the expenditures with State and local funds and
intends to obtain reimbursement from the aforementioned programs to the extent
allowed.

Single Audit Reports Disclosed Minimal Reportable Conditions Regarding

Federal Grant Management
There were similarities in the work performed by the independent certified public
accounting firm that conducted the Single Audit of MCPS’ federal grants and the

15
objectives of our audit in this area. In addition to expressing an opinion on
MCPS’ compliance with the terms of several grant programs, the auditor also
considered the existing internal control structure’s impact on compliance and
audited the required Schedule of Expenditures of Federal Awards (which includes
claimed and reported grant expenditures) for fiscal years 2015 through 2020.

The related reports stated that MCPS complied, in all material respects, with the
requirements applicable to its major federal programs. With respect to internal
controls over compliance with, and the operation of, major federal programs, the
auditors did not identify any material weaknesses or significant deficiencies,
except for fiscal year 2018, when the auditors identified two significant
deficiencies that were not considered to be material weaknesses. These
deficiencies were indicated as being resolved in the fiscal year 2019 report.

Medicaid Funds for Eligible Services

MCPS has established a procedure to identify children eligible for Medicaid-
subsidized services and the services rendered. Medicaid is an entitlement
program for which certain service costs can be reimbursed to MCPS. Medicaid
activity is not covered by the Single Audit of federal grants.

The Maryland State Department of Education’s Interagency Medicaid Monitoring

Team issued a report in February 2020 of the results of its review of 79 student
case files for 49 criteria (including the correct billing of Medicaid for eligible
services). The report found that MCPS was 100 percent compliant with 43
criteria and between 91 and 99 percent compliant with the remaining 6 criteria.
According to MCPS records, fiscal year 2020 state and federal reimbursements
for Medicaid-subsidized services totaled approximately $4.1 million, which was
22 percent lower than the previous year. We were advised by MCPS that this
decrease was due to the impact of the COVID-19 pandemic health crisis, as
certain services could not be provided, or did not qualify for reimbursement, in a
virtual environment.

Conclusion
Based on our current assessment of significance and risk relative to our audit
objectives, our audit did not include a review of Medicaid-subsidized services.
We relied on the work of the independent certified public accounting firm that
conducted the Single Audits for all other work in this area, including policies,
procedures, and controls with respect to federal grants and expenditures.

16
Procurement and Disbursement Cycle

Background
According to the audited financial statements and MCPS’ records, disbursements
(excluding payroll) totaled $863 million during fiscal year 2020. MCPS uses an
automated financial system for purchases and disbursements which was
implemented in November 2020. Requisitions are created in the system by
departments and are subject to on-line departmental and Purchasing Department
approvals. Purchases orders are prepared in the system by the Purchasing
Department based on approved requisitions received from the requesting
department. The Purchasing Department generally handles the solicitation, bid
evaluation, and establishment of contracts.

Hardcopy invoices related to the procurement of goods are generally submitted by

vendors directly to the accounts payable department for entry into the financial
management system. The invoices for services are submitted to the respective
school or department receiving the service for approval, and are then forwarded to
the accounts payable department. The system matches invoices to appropriate
purchasing documents and the verification of receipt entered by the receiving
school or department. The system then prints vendor checks or processes an
electronic payment and posts the payment to the financial records.

MCPS written procurement policies require that procurements exceeding $25,000

be competitively bid in accordance with Section 5-112 of the Education Article of
the Annotated Code of Maryland. Contracts and agreements exceeding $25,000
are to be approved by the Board.

Finding 1
MCPS procurement policies did not incorporate certain requirements of
State law and recognized best practices when participating in
intergovernmental cooperative purchasing agreements (ICPA). In addition,
ICPA invoices were not always verified to related contract pricing.

Analysis
Certain requirements of State law and recognized best practices were not
incorporated into MCPS policies and were not used consistently by MCPS when
participating in an ICPA. Specifically, our review of MCPS procurement policies
disclosed that the following statutory requirement and critical best practices were
not included.

 Prepare a written assessment of the benefits of using an ICPA, as required by

State law

17
 Analyze all costs of conducting competitive solicitations
 Research, compare, and evaluate available ICPAs
 Verify the ICPA solicitation was competitively bid and publicly advertised,
and obtain originating agency’s competitive procurement documentation
(including public advertisements and proposal evaluations)
 Verify that the terms, scope of services, specifications, and price meet MCPS
needs
 Obtain a copy of the ICPA and related price lists for invoice verification

We tested MCPS’ participation in three ICPAs (selected based on significance)

during fiscal years 2019 and 2020, with contract awards totaling approximately
$20.9 million. Our review disclosed that MCPS did not have a written assessment
of the benefits of using an ICPA for the ICPAs tested, as required by State law.
In addition, three of the five best practices (analyzing the costs of conducting
competitive solicitations; researching, comparing, and evaluating other available
ICPAs; and verifying that the ICPA was competitively bid) were not required by
MCPA policy or performed for the ICPAs tested. A similar condition was
commented upon in our preceding audit report.

Incorporating the statutory requirement and best practices into MCPS policies
could help ensure they are consistently used. In this regard, best practices for
allowing utilization by other parties was executed for all of the ICPAs, as required
by MCPS policy.

MCPS also did not ensure the amounts invoiced by the ICPA vendors agreed with
the original contract pricing. Specifically, our test of five payments totaling $3.3
million related to the three aforementioned ICPAs disclosed that MCPS had not
obtained the price information to verify it was receiving the discounts or pricing
as stated in the governing ICPA. MCPS relied on informal cost proposals
received from the vendors, instead of the actual contract terms and conditions
from the ICPAs, to verify invoice pricing. However, we were able to determine
the reasonableness of the prices charged through available price lists or internet
searches of comparable items.

State law, which legal counsel to the Maryland General Assembly advised us is
applicable to local education agencies, allows the use of cooperative purchasing
arrangements or ICPAs only after the using entity has determined (or assessed) in
writing that the use of such arrangements will provide cost benefits, promote

18
administrative efficiencies, or promote intergovernmental cooperation.3

Furthermore, the Institute for Public Procurement, formerly known as the

National Institute of Government Purchasing, as well as other public and
educational organizations have published ICPA best practices. These practices
include comprehensive multi-step checklists that require, among other things (as
per the list above), that prospective ICPA users verify that the contract allows
other entities to participate. In addition, ICPA users should ensure that the
contract was awarded through a competitive procurement process, and requires
that addendums be executed documenting their participation and incorporating
local required terms and conditions.

Recommendation 1
We recommend that MCPS
a. incorporate the aforementioned statutory requirement and other
identified and acknowledged best practices into its procurement policies,
and ensure that the performance of the requirement and best practices is
documented when evaluating participation in ICPAs (repeat); and
b. ensure that amounts invoiced by ICPA vendors agreed with the related
contract pricing.

Human Resources and Payroll

Background
Payroll expense represents the largest single cost component in the MCPS budget.
According to MCPS’ records, fiscal year 2020 salary, wage, and benefit costs
totaled approximately $2.5 billion, representing approximately 75 percent of the
total expenditures. According to Maryland State Department of Education
reports, during the 2019-2020 school year MCPS had 22,447 full-time positions,
which consisted of 15,491 instructional and 6,956 non-instructional positions.

3
Section 13-110 of the State Finance and Procurement Article, of the Annotated Code of
Maryland in part, defines an intergovernmental cooperative purchasing agreement (ICPA). As
defined, an ICPA is a contract that is entered into by at least one governmental entity in a certain
manner, that is available for use by the governmental entity entering the contract and at least one
additional governmental entity, and that is intended to promote efficiency and savings that can
result from intergovernmental cooperative purchasing. The aforementioned law applies to all
ICPAs regardless of the services, goods, or commodities purchased. In addition, Section 5-
112(a)(3) of the Education Article of the Code provides that local education agencies do not need
to conduct competitive procurements for goods and commodities if they use a contract awarded
by public agencies or intergovernmental purchasing organizations and the originating procuring
agency followed public bidding procedures.

19
MCPS uses automated systems to maintain human resources information, record
employee time, track employee leave usage, and process and record payroll
transactions. Employees are required to use direct deposit which is processed by
MCPS’ payroll system.

Finding 2
MCPS did not ensure critical human resources and payroll transactions were
independently reviewed for propriety.

Analysis
MCPS did not ensure critical human resources and payroll transactions were
independently reviewed for propriety. Specifically, MCPS did not use available
reports of new employees added to the system and salary changes to verify the
propriety of the transactions posted to the system. As a result, improper or
erroneous additions and salary changes could be processed without detection.
Our testing did not disclose any such improper transactions.

During fiscal year 2020, MCPS processed 3,110 employee additions and $41.8
million in salary increases. Similar conditions regarding the lack of an
independent review of human resources and payroll transactions were commented
upon in our preceding audit report.

Recommendation 2
We recommend that MCPS verify, at least on a test basis, the propriety of
personnel additions and salary changes recorded in the human resources and
payroll system (repeat). Specifically, independent supervisory personnel
should use transaction reports generated from the system to identify these
transactions and verify they were proper by reviewing related supporting
documentation.

Equipment Control and Accountability

Background
According to MCPS’ audited financial statements, the undepreciated value of its
capital equipment inventory totaled $228.7 million as of June 30, 2020. MCPS
maintains centralized automated records for all equipment with a cost of $5,000
or more (including assets capitalized for financial statement purposes) and certain
other categories of equipment deemed sensitive that exceed designated cost limits
(such as cafeteria equipment with a cost of $1,000 or more). Control and
recordkeeping of laptop computers assigned to employees and students was
maintained on a separate database. MCPS has established comprehensive written

20
equipment policies and performs inventories at each school on a staggered every
other year basis.

Conclusion
Based on our current assessment of significance and risk relative to our audit
objectives, our audit did not include a review of policies, procedures, and controls
with respect to the equipment area of operations.

Information Technology

We determined that Findings 3 through 7 related to “cybersecurity”, as defined by

the State Finance and Procurement Article, Section 3A-301(b) of the Annotated
Code of Maryland, and therefore are subject to redaction from the publicly
available report in accordance with the State Government Article, Section 2-
1224(i). Consequently, the specifics of the following findings, including the
analysis, related recommendations, along with MCPS’ responses, have been
redacted from this report copy.

Finding 3
Redacted cybersecurity-related finding.

Finding 4
Redacted cybersecurity-related finding.

Finding 5
Redacted cybersecurity-related finding.

Finding 6
Redacted cybersecurity-related finding.

Finding 7
Redacted cybersecurity-related finding.

21
Facilities Construction, Renovation, and Maintenance

Background
MCPS employs a staff of 1,970 employees to maintain its 208 schools (including
special schools, alternative programs, and early childhood learning centers) and a
number of other facilities (such as administrative and support offices). According
to its fiscal year 2021 Capital Improvement Plan, necessary construction, major
renovations, and systemic improvements to MCPS’ facilities over the next six
years are estimated to cost approximately $1.7 billion.

Processes are in Place to Promote On-Going Facility Maintenance and to

Minimize Energy Costs
MCPS has processes in place to promote on-going facility maintenance and to
minimize energy costs. For example, MCPS provides preventive maintenance of
its buildings and equipment to prevent emergency repairs. In addition, MCPS
utilizes a vendor energy management program to monitor and control heating and
air conditioning usage and a utility billing management system to monitor related
costs. MCPS also has written best practices that encourage both students and
employees to be aware of and limit their energy use and conducts internal on-site
reviews of building energy efficiency. MCPS also makes use of solar and
geothermal alternative energy sources. According to MCPS’ records, MCPS
saved over $4.2 million through energy cost avoidance from fiscal years 2016 to
2019 (which we did not audit).

Finding 8
MCPS did not always comply with State procurement laws and its policies
for construction-related procurements.

Analysis
MCPS did not always comply with State procurement laws and its policies for
construction-related procurements. We tested 10 procurements (generally
selected based on contract type and dollar significance) during fiscal years 2018
to 2020, that consisted of 2 architectural and engineering (AE), 3 construction
manager (CM), and 5 general contractor (GC) contracts valued at $192.3 million
(initial award and subsequent change orders), which disclosed the following
conditions:

 MCPS did not maintain critical documentation to support the award of 5

contract awards (2 AE and 3 CM) valued at $151.1 million. Specifically,
MCPS could not provide us with losing bidders’ technical proposals for the
contracts tested. In addition, MCPS could not provide us with documentation

22
 that the selection committee had evaluated the 12 AE and 7 CM MCPS
Board-approved selection criteria (such as, the firms past experience and
qualifications of key personnel) on these contracts. Specifically, for 2
contracts valued at $120.8 million, MCPS could not provide documentation of
the selection committee evaluations and ranking of the bidders, and for the
other 3 contracts valued at $30.3 million MCPS could not provide
documentation of the selection committee evaluations.

 MCPS could not provide documentation of how the fees were negotiated or
determined for the aforementioned 5 contract awards (2 AE and 3 CM) valued
at $151.1 million. In addition, for the 3 CM contracts valued at $148.8
million, MCPS procured and awarded the contracts without considering price
in making the selection, as required by State law. MCPS issued requests for
qualifications that did not require the amount of the costs and fees be included
by bidders; therefore the CMs were selected based on qualifications only. We
were advised by MCPS that the amount the CMs were to be paid under the
contract was negotiated, even though State law requires that contracts for
school building and improvements be awarded to the responsible bidder with
consideration given to the price offered by the bidder. Counsel to the
Maryland General Assembly has previously advised that the cited law applies
to local school system contracts for CM services.

 For 5 GC contracts valued at $41.2 million, MCPS did not have evidence that
one or more witnesses were present at the time of the bid opening, as required
by the FY 2019 - 2020 Financial Manual - Procurement procedures. Based
on our review of MCPS’ bid documentation for the related procurements we
determined that the lowest responsible bidder was selected.

 MCPS did not publish bids and awards on eMaryland Marketplace (eMM)4
for 8 procurements valued at $190 million as required by State law.
Publishing solicitations and awards helps provide transparency over the
procurements. State law requires a local school system to publish a
procurement solicitation or notice of award greater than $50,000.

Recommendation 8
We recommend that MCPS adhere to State procurement laws and policies,
Board approved procurement procedures, and properly document the bid
submission and evaluation, and fee negotiation process.

4
eMM is an internet-based, interactive procurement system managed by the Department of
General Services (DGS). Effective July 2019, DGS replaced eMM with eMaryland
Marketplace Advantage (eMMA).

23
Finding 9
MCPS did not always perform inspections of construction projects, assess
liquidated damages, or ensure proper supporting information was provided
prior to payment.

Analysis
MCPS did not always perform inspections of construction projects, assess
liquidated damages, or ensure proper supporting documentation was provided
prior to payment. We tested 30 payments totaling $42.4 million on 10
construction-related contracts valued at $192.3 million with payments totaling
$183.9 million during fiscal years 2019 and 2020.

 For 8 contracts, with payments totaling approximately $181.8 million, that

required daily inspections, the inspections were either not always performed
or inspection reports were not always prepared by on-site inspectors in
accordance with
MCPS’ written Figure 4
procedures. Inspectors Review of Inspections Conducted
are to make sure the March 2019 to June 2020
(Dollar amount in millions)
project is built per the Days Tested Number of
Contract
MCPS approved plans Project Location
Payments
for Daily
and specifications, and Inspections Inspections
Tilden Middle and Rock
prepare daily reports Terrace
$67.5 65 46
detailing weather Maryvale Elementary and
conditions and Carl Sandburg Learning 50.5 65 24
Center
manpower. Our review
Luxmanor Elementary 27.9 65 0
disclosed that daily Takoma Park Middle 15.1 65 0
inspections were only McAuliffe Elementary 8.6 67 0
performed for 70 of the Twinbrook Elementary 4.9 44 0
Ashburton Elementary 3.9 44 0
459 days tested (see Highland View Elementary 3.4 44 0
Figure 4). Although Total $181.8 459 70
there were periodic Source: MCPS records
progress meetings
between MCPS and the contractors, the failure to prepare written inspection
reports for MCPS’ review results in a reduced assurance that work was
performed as provided for in the contracts.

 For 5 construction contracts valued at $177.9 million, MCPS did not assess
required liquidated damages when the related contractor missed project
completion deadlines. Each contract stipulated that time is of the essence with
respect to the substantial completion dates and that if the substantial
completion date is not achieved the contractor shall pay MCPS liquidated

24
 damages of $2,500 for each day up to 30 days, $5,000 per day the second 30
days, and $500 per day every day thereafter.

Based on our calculations, MCPS could have assessed approximately $1.4

million in liquidated damages for these contracts, which were delayed a
combined 808 days. For 3 of the 5 contracts, the MCPS Board waived a
combined $200,000 of the liquidated damages and approved change orders
that extended the substantial completion dates by a combined 327 days,
although there was no such waiver provision in the related contracts. Further,
we noted that the Board had not waived the remaining liquidated damages
totaling approximately $1.2 million, applicable to these 5 contracts, which
were still delayed a combined 481 days. MCPS advised us that it does not
routinely assess liquidated damages to avoid penalizing contractors and did
not have a formal policy to address processes for waiving liquidated damages.

 For 2 contracts valued at $71.1 million, required supporting documentation

was not provided for materials purchased totaling $560,000 and included in
four payments totaling $6.6 million. MCPS paid the invoices without
obtaining supporting documentation detailing the materials purchased, as
required by the contract.

Recommendation 9
We recommend that MCPS
a. perform and document daily inspections of projects as required;
b. assess and collect liquidated damages when appropriate, including the
contracts noted above, and implement a formal policy addressing a
process for waiving damages in conjunction with change orders
(extending contract delivery periods); and
c. ensure that required supporting documentation is received for all
amounts invoiced prior to payment.

Transportation Services

Background
According to statistics compiled by the Maryland State Department of Education
(MSDE), MCPS has approximately 103,973 students eligible to receive student
transportation services. MCPS reported that 20.2 million route miles were
traveled to transport students for the 2018-2019 school year and 17.4 million
route miles for the 2019-2020 school year. The decline in route miles was
attributed to students not requiring transportation during virtual learning as a

25
result of COVID-19.5 These students were transported using 1,375 system-owned
buses. According to MCPS’ financial records, fiscal year 2020 transportation
costs totaled $109.4 million.

Electric Bus Lease Agreement Was Properly Procured

Our review of a February 2021 lease agreement for $168.7 million for the use of
326 electric buses, to be phased into service over a 4-year period, found that the
lease was competitively bid and approved by the Board. In its award
recommendation, MCPS stated the lease would enable them to increase
sustainable practices, be good stewards of our natural resources, and operate in a
way that was healthy.

We were advised that the total cost of the electric buses is projected to be
recovered through funds that would have otherwise been spent on diesel school
bus purchases and operations. MCPS believes that the lease provides a turnkey
solution that includes lease costs, charging infrastructure and management,
electricity, and reimbursement for maintenance costs. Implementation includes
delivery of 25 electric buses in fall 2021, 61 in fall 2022, and approximately 120
electric buses each year thereafter.

School Bus Safety Cameras

As allowed by State and County law, MCPS contracted for the use of school bus
safety cameras to monitor drivers who illegally pass a stopped school bus. In
May 2016, the Board approved a five-year contract (with five one-year renewal
options) with a vendor to install and operate cameras that would be owned and
maintained by the vendor on MCPS’ school buses. The contract also provided for
cameras to monitor the conduct of drivers and students inside the bus along with
global positioning units to track the buses. Prior to this contract, MCPS was
purchasing buses with cameras inside the bus and global positioning units, which
were replaced with the vendor’s equipment. In June 2016, MCPS entered into a
memorandum of understanding (MOU) with Montgomery County since the
Montgomery County Police Department (MCPD) was responsible for the
issuance of citations processed by the camera system.

The vendor is responsible for operating the system and processing citation
payments. The vendor’s cameras take images of vehicles (including a specific
image of the vehicle license plate) passing a bus that is operating its alternating

5
Due to the COVID-19 pandemic, student transportation stopped on March 13, 2020 and did not
resume until March 1, 2021. During this time, MCPS continued to pay its employee bus drivers
and advised us that its drivers performed other duties including delivering food and laptops to
schools, and delivering materials to students' homes. Additionally, MPCS advised us that some
drivers assisted the Department of Maintenance with certain tasks, including carpentry, air filter
installations, and data entry.

26
flashing red lights. The registered owner(s) of the vehicles are identified by
vendor employees using access provided to Maryland Motor Vehicle
Administration (MVA) databases, through the MCPD MOU. After MCPD
verifies the image of the event constitutes a violation, a vendor employee prints
and mails the citation to the registered owner.

Citations can be paid in-person at the Montgomery County Finance Office, online
by credit card, electronically through the internet, by phone through an interactive
voice response system, or by mailing a check. The County Finance Office
processes citation payments paid in-person through the vendor’s system. The
vendor’s system stores the images of each check payment, remittance stub,
associated correspondence, envelope and certified mail receipt. All forms of
citation payments are deposited into a County bank account and the County
transfers all revenue to a MCPS bank account. MCPS is responsible for
distributing revenue to the vendor. The vendor is also required to operate a
customer service center with a toll-free number and respond to inquiries from the
public.

In July 2019, the Montgomery County Office of the Inspector General (OIG)
issued a report regarding the County’s MOU with MCPS for the School Bus
Safety Camera program. According to the report, the OIG initiated the review in
August 2018 after the County was made aware of concerns regarding the vendor’s
history of prior convictions involving fraud and bribery in another state where it
operated a similar program. Although the report disclosed that employees of the
County or MCPS did not violate a rule, law, or procedure, or had any
inappropriate relationship with the vendor, the report identified the following two
findings related to the County:

1. The business case for this program was built around the desired use of a
predetermined vendor rather than an objective analysis to design an
effective and economical method to achieve an identified outcome.
2. County officials relied, at least in part, on information provided by a
criminal conspirator in vetting the vendor and they continued to rely on
vendor supplied information when considering the future of the program.

Additionally, the report disclosed there was no revenue sharing agreement with
the vendor and it was unclear as to when, or even if, the County would recover its
investment in the program. Furthermore, the report disclosed the contract terms
appeared to be ambiguously, and generously, tilted toward profitability for the
vendor. Finally, as of the date of the OIG report, the County had paid more than
$750,000 for administrative and personnel expenses related to this program and
over $10 million in ticket revenue had been transferred to the vendor.

27
In addition to the concerns addressed by the aforementioned OIG report related to
the County, we received an allegation on our fraud, waste, and abuse hotline that
MCPS had entered into a contract to place monitoring cameras on school buses
that diverts fines to a private entity when they should be paid to the County.
Based on our review, we were able to substantiate the allegation as the contract
provided that all funds were to go to the vendor until the vendor recovered its cost
of investment. As noted below, as of August 31, 2019 MCPS had paid the vendor
$20.9 million, which exceeded the vendor’s initial $19 million estimated cost of
investment by $1.9 million. We also found certain deficiencies with the
procurement of the agreement, its terms, and how it was monitored; although, we
did not identify any issues that warranted a referral to the Office of the Attorney
General – Criminal Division.

Finding 10
MCPS contracted with a vendor for a school bus camera system without a
competitive procurement process or a fixed total cost to be paid. In addition,
the contract lacked sufficient details to enable effective monitoring of the
amounts invoiced and paid to the vendor.

Analysis
MCPS entered into a contract for the use of a vendor’s school bus camera system
without a competitive process or a fixed total cost to be paid. In addition, the
contract lacked sufficient details to enable effective monitoring of the amounts
invoiced and paid to the vendor.

Lack of a Competitive Procurement

MCPS did not conduct a competitive procurement for the camera system contract.
Rather, a vendor approached the County and MCPS to install and operate a school
bus camera system, including interior cameras and global positioning units that
MCPS was already purchasing for each bus. Although MCPS prepared a
schedule comparing four companies based on various factors (such as number of
interior cameras, but not including a financial or cost consideration), it did not
have supporting documentation or an indication of how the information was
obtained. MCPS management advised us that the contract with the vendor was
awarded under an Intergovernmental Cooperative Purchasing Agreement (ICPA)
from another state’s school system. However, our review of the ICPA noted the
following conditions (several of which were previously noted in finding 1 in this
audit report):

 Only a single bidder was evaluated by the other school system in awarding
the ICPA.

28
  The ICPA awarded by the other school system was for a 30 bus fleet,
while MCPS had a fleet of approximately 1,300 buses.
 MCPS did not prepare a written assessment of the benefits for using the
ICPA as required by State law and it did not research or compare other
available ICPAs.
 MCPS did not use any of the key terms and conditions of the existing
ICPA. Instead, it negotiated its own terms and conditions with the
contractor (see comments below).

As a result, we concluded that with the exception of the general service provided,
MCPA procured its own unique contract with the vendor without a competitive
procurement process and assurance that it obtained the best value for the school
bus cameras program. MCPS ultimately awarded the contract to the company
that approached them after visiting another state using the vendor’s camera
system and conducting a limited pilot program. A similar condition regarding
documentation of best value when procuring contracts was noted in our preceding
audit report.

Lack of Sufficient Financial Terms

The school bus camera contract did not specify the total amount to be paid to the
vendor. The contract provided that the vendor would receive all funds collected
from citations issued from the cameras (initially $125 per violation and
subsequently increased to $250 per violation) until the vendor recovered its initial
and on-going cost of investment which included the equipment, system
installation and operational expenses. At the time of the contract, these costs
were estimated by the vendor to be approximately $19 million. In addition, there
was no provision for the independent verification of the vendor’s cost of
investment. Further, the contract did not specify the payment terms once the
vendor’s cost of investment was recovered. Instead, the parties agreed to
negotiate, at a later date, a revenue sharing plan that would become effective upon
the recovery of investment costs (see below).

Monitoring of Vendor’s Recovery of Investment Costs

Although MCPS was monitoring the amount of citation payments made to the
vendor, MCPS was not monitoring the vendor’s investment costs. MCPS advised
us that the vendor did not periodically report its total actual investment costs
(including changes), and MCPS did not ask for documentation supporting the
investment costs since the contract did not specifically require the vendor to
provide this documentation. As a result, MCPS was unaware if the vendor had
been fully reimbursed for its cost of investment. As of August 31, 2019 MCPS
had paid the vendor $20.9 million, which exceeded the vendor’s initial $19
million estimated cost of investment by $1.9 million.

29
Due to the lack of specific financial terms and the lack of documentation for the
vendor’s investment costs, in June 2019, Montgomery County engaged a
consulting firm to conduct a financial compliance review of the bus camera
vendor for transactions occurring from July 1, 2016 to August 31, 2019. The
consultant was able to verify that citation revenue totaling $20.9 million was paid
to the vendor, but it was unable to definitively determine the amount of the
vendor’s investment. The consultant offered four options for determining the
investment amount which ranged from $13 million to $20 million. In response to
the consultant’s report, the vendor offered an alternative calculation that increased
its investment cost from its initial estimate of $19 million to $26 million.

Effective October 2019, MCPS executed a contract amendment to address the

vendor’s compensation and resolve all disputes concerning the vendor’s cost of
investment. The amendment acknowledged the vendor had recovered its cost of
investment without specifying an amount, and stipulated that going forward the
vendor would not be required to provide any records concerning the cost to
install, operate, or maintain the bus camera system. The amendment also
provided that the County would receive an invoice credit of $1.6 million for
certain costs incurred for processing citations.

Finally, the amendment established citation revenue sharing whereby the vendor
would receive 60 percent of the citation revenue going forward for additional
future vendor costs. The remaining 40 percent was to be received by the County
for its citation processing costs. MCPS could not provide us with documentation
to support how the revenue sharing percentage was determined or its justification.
As of June 30, 2021, MCPS had paid the vendor citation revenue totaling $21.9
million and the County had received $4.8 million since the inception of the
contract.

Recommendation 10
We recommend that, in the future, MCPS
a. adhere to statutory requirements for competitive bidding, where
appropriate (repeat);
b. ensure contracts include adequate and properly defined financial terms,
such as total amounts to be paid, and how costs are to be independently
verified; and
c. document the basis and reasoning for revenue sharing percentages.

30
We determined that Finding 11 related to “cybersecurity”, as defined by the State
Finance and Procurement Article, Section 3A-301(b) of the Annotated Code of
Maryland, and therefore is subject to redaction from the publicly available report
in accordance with the State Government Article, Section 2-1224(i).
Consequently, the specifics of the following finding, including the analysis,
related recommendation(s), along with MCPS’ responses, have been redacted
from this report copy.

Finding 11
Redacted cybersecurity-related finding.

Food Services

Background
According to MCPS’ audited financial statements, food service operating
expenditures totaled $60.7 million in fiscal year 2020, and were primarily funded
with federal funds totaling $42.4 million and food sales totaling $12.8 million.
According to MSDE records, in fiscal year 2020 MCPS had 490 food service
positions for its 208 schools, consisting of 461 cafeteria positions and 29
administrative positions.

Similar to other Maryland Local Education Agencies, MCPS continued to serve

meals from certain schools during the COVID-19 pandemic health crisis by
distributing food through
the use of refrigerated food
trucks and also backpack
food sacks. As shown in
Figure 5, the number of
meals served declined 57
percent from fiscal year
2019 (17.1 million) to
fiscal year 2021 (7.4
million). MCPS’ food
service expenditures
declined 17 percent during
the same period, from
$60.6 million to $50.5
million. MCPS advised it
chose to retain all of its
food service employees
during the COVID crisis.

31
Conclusion
Based on our current assessment of significance and risk relative to our audit
objectives, our audit did not include a review of policies, procedures, and controls
with respect to the Food Service financial area of operations.

School Board Oversight

Background
The Montgomery County Board of Education (the Board) is composed of seven
elected members and one voting student member who has the same rights and
privileges except for certain matters (such as the suspension or dismissal of
teachers, principals, and other professional personnel). The Board contracted
with a certified public accounting firm to conduct independent audits of the
MCPS financial statements and federal programs.

To assist in its oversight of various areas of MCPS operations and governance, the
Board established several committees, such as Fiscal Management, Policy
Management, Special Populations, Strategic Planning, and Communication and
Stakeholder Engagement. Additionally, the Board has established two citizen
advisory committees, the Collaboration Board for Career and Technology
Education, and the District Committee on Assessments, which meet periodically
in an open forum to hear public concerns, and submit an annual report to the
Board.

MCPS Adopted an Ethics Policy that Met the Requirements of State Law
The Board has adopted a detailed ethics policy that conforms to State law and was
approved by the State Ethics Commission. The policy is applicable to both Board
members and MCPS employees and includes provisions for conflicts of interest
and financial disclosures by Board members and certain employees. Specifically,
annual financial disclosure statements are required to be filed by Board members,
candidates for the Board, the Superintendent, and other administrators (such as
supervisors, school principals, and agency buyers) by April 30th of each year.

In accordance with the policy, MCPS established an Ethics Panel consisting of

five members appointed by the Board to interpret ethics policies and provide
advice on policy implementation. The Panel also reviews and rules on any
reported complaints of ethics violations. Our review of the records for Board
members and MCPS employees required to submit financial disclosure forms for
calendar year 2019 disclosed that all forms were submitted as required.

32
Conclusion
Our audit did not disclose any reportable conditions related to school board
oversight.

Management of Other Risks

Healthcare Background
MCPS participates in a cooperative purchasing agreement with other regional
agencies to obtain employee and retiree health insurance. MCPS is self-insured
and contracts with five third-party administrator firms (TPA) for health care
claims processing services6 for employee and retiree medical, prescription, dental,
and vision costs. MCPS also contracts with a consultant to help manage the
health plans. The consultant
performs data analysis of the health Figure 6
services utilization and costs, MCPS 2021 Healthcare Financing
provides recommendations on (In Millions)
potential rate changes, and evaluates Revenues
the merits of the health plan Employer Contributions $321.4
proposals. Employee/Retiree Contributions 90.2
Medicare Reimbursements 31.3
The health benefit plans for MCPS Investments 27.2
employees and retirees are financed Pharmacy Rebates 25.4
through separate trust funds and Other Revenue 9.4
provide plan coverage under contracts Total Revenue $504.9
with several insurance companies and
health maintenance organizations. Expenditures
According to MCPS records, trust Claims Payments $426.7
fund revenues and expenditures for Health and life insurance premiums
79.0
fiscal year 2021 totaled $504.9 (including administrative fees)
million and $510.5 million Actuary Reserves and Other Expenses 4.8
respectively (see Figure 6). As of Total Expenditures $510.5
June 30, 2021, the balance of the trust Source: MCPS Records
funds was $56.9 million.

MCPS employs a verification process in its enrollment procedures whereby

employees must submit documentation (such as, birth certificates) for any
dependents they want added to their health plan. As of November 11, 2021,
MCPS provided health insurance benefits to approximately 70,100 enrolled
employees, dependents, and retirees.

6
There is a separate TPA for the claims for each of the preferred provider medical, health
maintenance organization medical, prescription, dental, and vision plans.

33
Finding 12
MCPS did not audit or adequately monitor the performance of its third-
party administrators that provide health care claims processing services.

Analysis
MCPS did not audit or adequately monitor the performance of its third-party
administrators (TPAs) that provide health care claims processing services.
Specifically, MCPS did not verify the propriety of TPA billings for employee and
retiree health care claims, administrative fees, and the receipt of prescription drug
rebates. Additionally, MCPS did not perform audits of TPA performance
measures.

 MCPS did not obtain and review claim data to support the amounts billed by
the five TPAs for health care claims. MCPS was provided with a schedule of
the total claims paid for each health plan, rather than detailed claims data.
Also, MCPS did not document its review of the accuracy of monthly
administrative fees billed by the TPAs. Finally, MCPS did not have a process
to ensure that it received all the prescription drug rebates from the pharmacy
TPA.

 MCPS did not routinely audit health care claims paid by the TPAs to ensure
that the billed services were provided to participants, were covered by the
health plans, and that amounts paid were proper. We were advised by MCPS
that the sole audit it conducted was for pharmacy claims in 2008. In addition,
past and current TPA contracts did not provide for periodic independent third-
party audits of the accuracy and validity of claim reimbursements and the
TPA’s administrative fees paid by MCPS. A similar condition was
commented upon in our preceding audit report.

 MCPS did not audit, or otherwise verify, the accuracy of 5 TPAs’ self-
reported compliance with performance measures. The contracts included 28
performance measures relating to implementation and critical operational
areas, including claim accuracy, customer service, customer satisfaction, and
reporting. Additionally, the contracts allow for the assessment of penalties
(for example, up to a total of $1.9 million each year for one TPA) if the
performance measures are not met. For example, although one medical TPA
reported self-assessed penalties of approximately $228,000 in calendar years
2017 through 2021 based on its reported compliance, MCPS did not have a
process in place to verify the TPA’s reported compliance even though the
contract allows for an independent audit of the performance measures.

34
Recommendation 12
We recommend that MCPS
a. establish procedures to independently verify the propriety of TPA
billings, and receipt of all prescription drug rebates due;
b. compare TPA invoices to its records of enrolled participants and contract
rates to determine the propriety of administrative fees billed;
c. conduct claims audits to assess the accuracy and validity of claim
reimbursements made by the TPAs (repeat); and
d. independently verify, on an annual basis, the TPAs’ compliance with
reported performance measures and assess penalties when performance
goals are not met.

Finding 13
MCPS did not have a memorandum of agreement with its affiliated
foundation to address each entity’s roles and responsibilities.

Analysis
MCPS did not have a memorandum of agreement (MOA) with its affiliated
foundation (Montgomery County Public Schools Educational Foundation) to
address each entity’s roles and responsibilities. The Foundation is a tax exempt
charitable organization under Section 501(c)(3) of the Internal Revenue Service
(IRS) code that was created in 1988. According to filings with the IRS and its
website, the Foundation’s purpose is to support and enhance the educational goals
established by the Board of Education of Montgomery County, which it
accomplishes through fundraising and providing grants to teachers and
scholarships to students.

According to the Foundation's fiscal year 2020 audited financial statements,

revenues and expenditures totaled $1.8 million and $1.2 million, respectively.
Additionally, as of June 30, 2020, the Foundation’s assets totaled $7.7 million,
which primarily consisted of cash of $1.2 million and investments of $6.5 million.
The Foundation’s unrestricted funds totaled approximately $2.3 million.

Under the circumstances, given the Foundation’s public purpose and its
relationship to MCPS, it would be appropriate to enter into a formal MOA that
specifies the roles and responsibilities of each entity, which could include the
following:

 The Foundation’s solicitation, collection, and administration of funds.

Although the Foundation had an investment policy, the policy did not address
controls over collected funds including proper collateralization of funds, the

35
 use of interest bearing accounts, and procedures for the accounting and
reporting of fund balances. The policy also did not address the need for a
long-term plan that maximizes the use of unrestricted funds.

 The Foundation’s conflict of interest policy for board members and

Foundation employees. Although the Foundation had an ethics policy, the
policy was not as comprehensive as those provided for under the State Ethics
law, which addresses standards of conduct, ethics training, and completing
annual financial disclosures by board members and officers. Such a policy
would provide additional assurance regarding the integrity of the Foundation’s
board and its processes, and should include a requirement to advise MCPS of
conflict of interest issues.

 The Foundation’s procurement policies for purchases donated to MCPS.

 The Foundation’s submission of an annual audit report to MCPS’ Board of

Education.

 MCPS’ sharing of priorities, projects and resource requirements; including the

sharing of any non-private data to assist the Foundation’s effort.

 MCPS’ providing of any in-kind support functions and the use of its facilities
to the Foundation.

Recommendation 13
We recommend that MCPS enter into an MOA with its affiliated Foundation
detailing the roles and responsibilities for each entity in critical areas such as
conflicts of interest, collection and safeguarding funds, and procurement
policies.

36
 Audit Scope, Objectives, and Methodology
We conducted a performance audit to evaluate the effectiveness and efficiency of
the financial management practices of the Montgomery County Public Schools
(MCPS). We conducted this audit under the authority of the State Government
Article, Section 2-1220(e) of the Annotated Code of Maryland, and performed it
in accordance with generally accepted government auditing standards. Those
standards require that we plan and perform the audit to obtain sufficient,
appropriate evidence to provide a reasonable basis for our findings and
conclusions based on our audit objectives. We believe that the evidence obtained
provides a reasonable basis for our findings and conclusions based on our audit
objectives.

We had two broad audit objectives:

1. Evaluate whether the MCPS procedures and controls were effective in

accounting for and safeguarding its assets.

2. Evaluate whether the MCPS policies provided for the efficient use of
financial resources.

In planning and conducting our audit of MCPS, we focused on 11 major financial-

related areas of operations as approved on December 6, 2016 by the Joint Audit
and Evaluation Committee of the Maryland General Assembly in accordance with
the enabling legislation. The scope of the work performed in each of these areas
was based on our assessments of significance and risk. Therefore, our follow-up
on the status of findings included in our preceding audit report on MCPS dated
May 19, 2016, was limited to those findings that were applicable to the current
audit scope for each of the 11 areas.

The audit objectives excluded reviewing and assessing student achievement,

curriculum, teacher performance, and other academic-related areas and functions.
Also, we did not evaluate the MCPS Comprehensive Education Master Plan or
related updates, and we did not review the activities, financial or other, of any
parent teacher association, group, or funds not under the local board of
education’s direct control or management.

To accomplish our objectives, we reviewed applicable State laws and regulations

pertaining to public elementary and secondary education, as well as policies and
procedures issued and established by MCPS. We also interviewed personnel at
MCPS and the Maryland State Department of Education (MSDE), and staff at
other local school systems in Maryland (as appropriate). Our audit procedures

37
included inspections of documents and records, and to the extent practicable,
observations of MCPS operations. We also tested transactions and performed
other auditing procedures that we considered necessary to achieve our objectives,
generally for the period from January 1, 2020 to June 30, 2021. Generally,
transactions were selected for testing based on auditor judgment, which primarily
considers risk, the timing or dollar amount of the transaction, or the significance
of the transaction to the area of operation reviewed. As a matter of course, we do
not normally use sampling in our tests, so unless otherwise specifically indicated,
neither statistical nor non-statistical audit sampling was used to select the
transactions tested. Therefore, unless sampling is specifically indicated in a
finding, the results from any tests conducted or disclosed by us cannot be used to
project those results to the entire population from which the test items were
selected. For certain areas within the scope of the audit, we relied on the work
performed by the independent accounting firm that annually audits MCPS’
financial statements and conducts the federal Single Audit, as well as the reviews
of student activity funds performed by MCPS’ Internal Audit Department.

We used certain statistical data—including financial and operational—compiled

by MSDE from various informational reports submitted by the Maryland local
school systems. This information was used in this audit report for background or
informational purposes, and was deemed reasonable.

We also extracted data from the MCPS automated financial management system
for the purpose of testing expenditure and payroll transactions. We performed
various audit procedures on the relevant data and determined the data were
sufficiently reliable for the purposes the data were used during the audit.

MCPS’ management is responsible for establishing and maintaining effective

internal control. Internal control is a process designed to provide reasonable
assurance that objectives pertaining to the reliability of financial records;
effectiveness and efficiency of operations including safeguarding of assets; and
compliance with applicable laws, rules, and regulations are achieved. As
provided in Government Auditing Standards, there are five components of
internal control: control environment, risk assessment, control activities,
information and communication, and monitoring. Each of the five components,
when significant to the audit objectives, and as applicable to MCPS, were
considered by us during the course of this audit.

Because of inherent limitations in internal control, errors or fraud may

nevertheless occur and not be detected. Also, projections of any evaluation of
internal control to future periods are subject to the risk that conditions may
change or compliance with policies and procedures may deteriorate. In addition

38
to the conditions included in this report, other findings were communicated to
MCPS that were not deemed significant and, consequently, did not warrant
inclusion in this report.

State Government Article Section 2-1224(i) requires that we redact in a manner

consistent with auditing best practices any cybersecurity findings before a report
is made available to the public. This results in the issuance of two different
versions of an audit report that contains cybersecurity findings – a redacted
version for the public and an unredacted version for government officials
responsible for acting on our audit recommendations.

The State Finance and Procurement Article, Section 3A-301(b), states that
cybersecurity is defined as the “processes or capabilities wherein systems,
communications, and information are protected and defended against damage,
unauthorized use or modification, and exploitation”. Based on that definition, and
in our professional judgment, we concluded that certain findings in this report fall
under that definition. Consequently, for the publicly available audit report all
specifics as to the nature of cybersecurity findings and required corrective actions
have been redacted. We have determined that such aforementioned practices, and
government auditing standards, support the redaction of this information from the
public audit report. The specifics of these cybersecurity findings have been
communicated to MCPS and those parties responsible for acting on our
recommendations in an unredacted audit report.

MCPS’ response to our findings and recommendations is included as an appendix

to this report. Depending on the version of the audit report, responses to any
cybersecurity findings may be redacted in accordance with State law. As
prescribed in the State Government Article, Section 2-1224 of the Annotated
Code of Maryland, we will advise MCPS regarding the results of our review of its
response.

39
APPENDIX
 Montgomery County Public Schools

Agency Response Form

Procurement and Disbursement Cycle

Finding 1
MCPS procurement policies did not incorporate certain requirements of State law and
recognized best practices when participating in intergovernmental cooperative purchasing
agreements (ICPA). In addition, ICPA invoices were not always verified to related
contract pricing.

We recommend that MCPS

a. incorporate the aforementioned statutory requirement and other identified and
acknowledged best practices into its procurement policies, and ensure that the
performance of the requirement and best practices is documented when evaluating
participation in ICPAs (repeat); and
b. ensure that amounts invoiced by ICPA vendors agreed with the related contract
pricing.

Agency Response
Analysis Factually accurate
Please provide
additional comments as
deemed necessary.

Recommendation 1a Agree Estimated Completion Date: January 2023

Please provide details of The MCPS procurement policy is due for an update, and MCPS plans on
corrective action or adding a section that will outline the use of ICPAs per the
explain disagreement. recommendation based on the National Institute of Governmental
Purchasing, Inc., best practices, and will include all statutory
requirements.

Recommendation 1b Agree Estimated Completion Date: January 2023

Please provide details of Procurement relies on the project coordinator of the user department to
corrective action or confirm that the invoices agree with the governing ICPA, therefore,
explain disagreement. Procurement will work to educate end users on their role in verifying
and approving costs related to purchases conducted through the use of
ICPAs, and ensuring that amounts invoiced are in agreement with the
related contract pricing.

Page 1 of 10
 Montgomery County Public Schools

Agency Response Form

Human Resources and Payroll

Finding 2
MCPS did not ensure critical human resources and payroll transactions were
independently reviewed for propriety.

We recommend that MCPS verify, at least on a test basis, the propriety of personnel
additions and salary changes recorded in the human resources and payroll system (repeat).
Specifically, independent supervisory personnel should use transaction reports generated
from the system to identify these transactions and verify they were proper by reviewing
related supporting documentation.

Agency Response
Analysis Factually Accurate
Please provide As a result of the recommendation from the previous Legislative audit
additional comments as (report dated May 2016), MCPS began and continues to review a
deemed necessary. sampling of HR/Payroll changes in the system on a quarterly basis. This
is performed by the MCPS Internal Audit Unit that gets
system-generated reports on a quarterly basis. Currently the selection
sample is limited to eight randomly selected staff that had changes.

Recommendation 2 Agree Estimated Completion Date: November

2022
Please provide details of Based on the recent recommendation, MCPS agrees that these
corrective action or independent reviews of human resource/payroll changes should be
explain disagreement. sampled on a more frequent basis (coinciding with biweekly payroll),
and utilizing a few layers of criteria such a dollar threshold (i.e., a
$10,000 increase in any given pay period), and a minimum number of
samples (e.g., 25). These tests will be performed by Payroll, and
supporting documentation for the items selected will be reviewed and
maintained. Internal Audit will continue to perform quarterly reviews of
the biweekly reviews of HR and Payroll.

Page 2 of 10
 Montgomery County Public Schools

Agency Response Form

Information Technology

The Office of Legislative Audits (OLA) has determined that Findings 3 through 7 related to
“cybersecurity”, as defined by the State Finance and Procurement Article, Section 3A-301(b) of
the Annotated Code of Maryland, and therefore are subject to redaction from the publicly
available audit report in accordance with State Government article 2-1224(i). Although the
specifics of the findings, including the analysis, related recommendations, along with MCPS’
responses, have been redacted from this report copy, MCPS’ responses indicated agreement with
the findings and recommendations.

Finding 3
Redacted cybersecurity-related finding.

Agency Response has been redacted by OLA.

Finding 4
Redacted cybersecurity-related finding.

Agency Response has been redacted by OLA.

Finding 5
Redacted cybersecurity-related finding.

Agency Response has been redacted by OLA

Finding 6
Redacted cybersecurity-related finding.

Agency Response has been redacted by OLA.

Finding 7
Redacted cybersecurity-related finding.

Agency Response has been redacted by OLA.

Page 3 of 10
 Montgomery County Public Schools

Agency Response Form

Facilities Construction, Renovation, and Maintenance

Finding 8
MCPS did not always comply with State procurement laws and its policies for
construction-related procurements.

We recommend that MCPS adhere to State procurement laws and policies, Board
approved procurement procedures, and properly document the bid submission and
evaluation, and fee negotiation process.

Agency Response
Analysis Factually accurate
Please provide
additional comments as
deemed necessary.

Recommendation 8 Agree Estimated Completion Date: August 2022

Please provide details of MCPS will adhere to state procurement laws (including that contracts for
corrective action or school and improvements be awarded to the responsible bidder with
explain disagreement. consideration given to the price offered by the bidder), and policies and
Board of Education-approved procurement procedures, and properly
document the bid submission and evaluation, and fee negotiating
process.

Page 4 of 10
 Montgomery County Public Schools

Agency Response Form

Finding 9
MCPS did not always perform inspections of construction projects, assess liquidated
damages, or ensure proper supporting information was provided prior to payment.

We recommend that MCPS

a. perform and document daily inspections of projects as required;
b. assess and collect liquidated damages when appropriate, including the contracts noted
above, and implement a formal policy addressing a process for waiving damages in
conjunction with change orders (extending contract delivery periods); and
c. ensure that required supporting documentation is received for all amounts invoiced
prior to payment.

Agency Response
Analysis Factually accurate
Please provide
additional comments as
deemed necessary.

Recommendation 9a Agree Estimated Completion Date: August 2022

Please provide details of MCPS has since initiated a web-based system for the use of the
corrective action or inspection team to document jobsite visits through the written word and
explain disagreement. photographs, and to note any quality control issues. For major projects,
the construction manager is responsible for the overall supervision,
inspection, and quality control of the projects. The construction manager
records the weather, manpower and job progress, and these reports will
be maintained on file. MCPS will also examine existing policy on
inspections and may update to address the frequency and responsibilities
of inspections based on the size of the project.
Recommendation 9b Agree Estimated Completion Date: January 2023
Please provide details of MCPS continues to include a liquidating damage clause in its contracts,
corrective action or and will enforce this option, when appropriate. Although liquidating
explain disagreement. damages were not collected on the contracts noted, going forward,
MCPS will develop a formal policy to address the process for waiving
damages.
Recommendation 9c Agree Estimated Completion Date: August 2022
Please provide details of MCPS will ensure that appropriate backup documentation is received
corrective action or and reviewed prior to payment and stored with the office file copy and
explain disagreement. the accounting file copy.

Page 5 of 10
 Montgomery County Public Schools

Agency Response Form

Transportation Services

Finding 10
MCPS contracted with a vendor for a school bus camera system without a competitive
procurement process or a fixed total cost to be paid. In addition, the contract lacked
sufficient details to enable effective monitoring of the amounts invoiced and paid to the
vendor.

We recommend that, in the future, MCPS

a. adhere to statutory requirements for competitive bidding, where appropriate (repeat);
b. ensure contracts include adequate and properly defined financial terms, such as total
amounts to be paid, and how costs are to be independently verified; and
c. document the basis and reasoning for revenue sharing percentages.

Agency Response
Analysis Factually Accurate
Please provide
additional comments as
deemed necessary.

Recommendation 10a Agree Estimated Completion Date: January 2023

Please provide details of When the current contract expires, MCPS will utilize a competitive bid
corrective action or process and adhere to all statutory requirements.
explain disagreement.

Recommendation 10b Agree Estimated Completion Date: January 2023

Please provide details of Future contract will address adequate and properly defined financial
corrective action or terms, total amounts to be paid and independent verification of costs.
explain disagreement.

Recommendation 10c Agree Estimated Completion Date: January 2023

Please provide details of Future contract will satisfy the recommendation to document the basis
corrective action or and reasoning for the revenue sharing percentages.
explain disagreement.

Page 6 of 10
 Montgomery County Public Schools

Agency Response Form

OLA has determined that Finding 11 related to “cybersecurity”, as defined by the State Finance
and Procurement Article, Section 3A-301(b) of the Annotated Code of Maryland, and therefore
is subject to redaction from the publicly available audit report in accordance with State
Government article 2-1224(i). Although the specifics of the finding, including the analysis,
related recommendation(s), along with MCPS’ response, have been redacted from this report
copy, MCPS’ response indicated agreement with the finding and related recommendation(s).

Finding 11
Redacted cybersecurity-related finding.

Agency Response has been redacted by OLA.

Page 7 of 10
 Montgomery County Public Schools

Agency Response Form

Management of Other Risks

Finding 12
MCPS did not audit or adequately monitor the performance of its third-party
administrators that provide health care claims processing services.

We recommend that MCPS

a. establish procedures to independently verify the propriety of TPA billings, and receipt
of all prescription drug rebates due;
b. compare TPA invoices to its records of enrolled participants and contract rates to
determine the propriety of administrative fees billed;
c. conduct claims audits to assess the accuracy and validity of claim reimbursements made
by the TPAs (repeat); and
d. independently verify, on an annual basis, the TPAs’ compliance with reported
performance measures and assess penalties when performance goals are not met.

Agency Response
Analysis Factually accurate
Please provide
additional comments as
deemed necessary.

Recommendation 12a Agree Estimated Completion Date: June 2023

Please provide details of MCPS agrees that periodic audits would be prudent and included
corrective action or language in the recent Request For Proposal (RFP) to have it funded
explain disagreement. through contract. Intent is to conduct an audit every 3-4 years, that
would review the propriety of billings and prescription drug rebates.

Recommendation 12b Agree Estimated Completion Date: January 2023

Please provide details of MCPS does review administrative fee expenses as submitted by vendors.
corrective action or We acknowledge the concern expressed and will formalize the review
explain disagreement. process in written form for clarity.

Recommendation 12c Agree Estimated Completion Date: August 2024

Please provide details of MCPS agrees that periodic audits would be prudent and included
corrective action or language in the recent RFP to have it funded through contract. Intent is
explain disagreement. to conduct the audit following the 2023 Plan year on the selected vendor
with results provided in the July/August 2024 timeframe.

Page 8 of 10
 Montgomery County Public Schools

Agency Response Form

Recommendation 12d Agree Estimated Completion Date: June 2024

Please provide details of MCPS does receive self-reported performance guarantee failures as
corrective action or noted in the Third Party Administrator contracts. Neither MCPS nor our
explain disagreement. benefits consultants are aware of any independent verification process or
organization that offers this type of monitoring on contracts for
performance guarantees as the areas are uniquely separate (telephone
response time, network management, member service metrics, etc.).
However, MCPS will continue to look further into performance
guarantees. The financial performance indicators would be captured
within the medical audit. MCPS will perform a search to identify
appropriate vendors.

Page 9 of 10
 Montgomery County Public Schools

Agency Response Form

Finding 13
MCPS did not have a memorandum of agreement with its affiliated foundation to address
each entity’s roles and responsibilities.

We recommend that MCPS enter into an MOA with its affiliated Foundation detailing the
roles and responsibilities for each entity in critical areas such as conflicts of interest,
collection and safeguarding funds, and procurement policies.

Agency Response
Analysis Factually accurate
Please provide
additional comments as
deemed necessary.

Recommendation 13 Agree Estimated Completion Date: October 2022

Please provide details of MCPS and the Educational Foundation are currently working to put
corrective action or together a memorandum of agreement (MOA). This MOA will address
explain disagreement. roles and of each entity within the relationship. This will include the
Foundation’s procurement policies, conflict of interest policy, sharing of
resources, audit process, and any in-kind support in regards to its
relationship with MCPS.

Page 10 of 10
 AUDIT TEAM
Raymond G. Burton Jr., CPA, CFE
Audit Manager

R. Brendan Coffey, CPA, CISA

Edwin L. Paul, CPA, CISA
Information Systems Audit Managers

Ken H. Johanning, CPA, CFE

Senior Auditor

Peter W. Chong
Matthew D. Walbert, CISA
Information Systems Senior Auditors

Matusala Y. Abishe
Stephen R. Alexander, CFE
Dianne P. Ramirez
Nga T. Nguyen Simmons
Staff Auditors

Dominick R. Abril
Charles O. Price
Information Systems Staff Auditors