May 11, 2022 — Regular Meeting
Conroe ISD Board Meeting — 2022-05-11
Regular Meeting — Unofficial Notes
Based on auto-generated transcript. Not an official record.
Generated 2026-03-28 14:27 UTC
Unofficial Meeting Notes
Conroe Independent School District – Board of Trustees Audit Committee Meeting
Date: May 11, 2022 | Called to Order: 7:31 AM | Adjourned: 8:28 AM
Note: These are unofficial notes based on an auto-generated transcript of the meeting. They may contain errors or omissions. Please refer to official board minutes for the authoritative record.
Attendance & Quorum
- The chair (Mr. Sanders) noted that a quorum of the full board was not present, but the audit committee proceeded with its agenda.
- Committee members present included: Mr. Sanders (Chair), Mr. Hubert, Ms. Chase, and Dr. Knoll (Superintendent).
- Brian Hayden (Internal Auditor) presented, along with Maribel Castro (Manager) and Rima (Partner) from Weaver (co-source audit firm).
Public Comment
- No members of the public registered to speak.
Agenda Items
1. Approval of Minutes – January 12, 2022 Audit Committee Meeting
- Minutes were distributed in advance and no revisions were noted.
- Vote: Approved unanimously by show of hands.
2. Approval of 2022–2023 Audit Plan
Mr. Hayden presented the proposed audit plan for the upcoming fiscal year. Key areas include:
- Activity Funds: High schools plus a mix of elementary, intermediate, and junior high campuses.
- Maintenance Audit: Focus on inventory control (especially small consumables), safety and training, and preventative maintenance. This area has not been previously audited.
- Child Nutrition Audit: Delayed from the prior year. Will examine cash controls, inventory controls, and compliance with district/state/federal regulations.
- IT Audit: Audit of the CISD Cybersecurity Plan (originally developed in 2019, updated shortly after; will be ~3 years old at the time of audit).
- Standing/Recurring Items:
- Construction audit (Caney Creek High School remodel)
- ITGC follow-up (planned for ~February to allow one year since initial audit)
- Police audit follow-up
- Annual band and orchestra inventory
- PEIMS compliance review
Mr. Hayden noted the co-source arrangement with Weaver is working "fantastic," providing expertise (especially for IT audits) without needing additional full-time employees. Weaver staff have already been booked for the maintenance audit starting in September.
- Vote: Approved unanimously by show of hands.
3. Review of Internal Audit Schedule – Fiscal Year 2021–2022
Activity Funds
- Nearly all high school audits are complete (one remaining). Elementary campuses will be audited over the summer.
ITGC Audit
- Complete; discussed in detail later in the meeting.
Transportation Follow-Up
- All findings reviewed and closed out. Committee expressed satisfaction with the report. Mr. Davila and his team were commended.
Annual PEIMS Compliance
- Recurring issues: Inconsistency and missing daily attendance submissions by teachers.
- Discussion highlights:
- Teachers have a 30-minute window each day to submit attendance electronically.
- Dr. Knoll explained that while habitual non-compliance is addressed administratively, random misses occur due to classroom disruptions, substitutes, and the pace of teaching.
- Some campuses have implemented additional reminders (e.g., an "attendance bell," daily announcements).
- Campus PEIMS teams hold quarterly meetings to reconcile and "true up" attendance records, ensuring accuracy even if timing was off.
- Ms. Chase asked about the priority level of attendance submission for teachers and whether there are repercussions for non-compliance. Dr. Knoll confirmed corrective action exists for habitual offenders but acknowledged the challenge of hitting the exact window consistently.
- Mr. Hubert asked about peer districts; Mr. Hayden said he's never heard of a district that does it "really great" and that CISD is likely ahead of many in even tracking and worrying about it.
- Risk context: If the state audited daily attendance and rejected entries submitted outside the window, CISD could lose ADA (Average Daily Attendance) funding for those students on those days. Mr. Hayden noted he has never seen the state actually do this, but the risk exists.
- The committee discussed whether the state could be asked to lengthen the attendance window or change funding methodology.
- This will remain an annual audit focus.
Band and Orchestra Inventory
- Started Monday; high schools being audited now, junior highs in November.
- Weaver is not used for inventory work to manage costs.
Construction Audit
- Started Monday; currently auditing the Teacher Training Center.
Maintenance Inventory Observation
- Mr. Hayden will observe the annual maintenance inventory on May 18. Items include consumables (soap, paper towels, mops, brooms) as well as higher-dollar equipment (tools, mowers, heavy equipment).
4. ITGC (IT General Controls) Audit – Detailed Presentation
Presented by: Maribel Castro (Manager, Weaver IT Advisory) and Rima (Partner, Weaver IT Advisory)
Key Context: This was the first ITGC audit in approximately 13 years.
Scope
- Evaluated IT controls for CISD Technology Services across key systems:
- eFinance Plus (general ledger/financial system)
- eSchool Plus
- Chronos (time entry)
- School Cash (parent payment portal)
- Absence Management
- Special Education software
- Child Nutrition Program Management software
- Windows Active Directory / Network
- Coverage period: September 1, 2021 – February 28, 2022
Overall Results
- 22 expected controls evaluated
- 13 designed appropriately
- 8 operating effectively
- 14 Opportunities for Improvement (higher risk; management response required)
- 5 Observations (lower risk; management response optional)
Note: Many findings were related to lack of formal documentation — teams were often following processes but had not formalized or documented them. Several remediation actions were already underway or completed at the time of the report.
Opportunities for Improvement (OFIs)
| # | Area | Finding Summary | Status |
|---|------|----------------|--------|
| 1 | IT Policies & Procedures | No formal IT policies/procedures defining minimum information security requirements. Some informal process documents existed but were not formally reviewed or approved. | In progress |
| 2 | IT Asset Inventory | Network Operations Center did not maintain a formal inventory of assets. | In progress |
| 3 | Change Management – Segregation of Duties (eFinance Plus) | Six users had access to both develop and implement changes to production in a source code repository tool integrated with eFinance Plus. No systematic enforcement of segregation of duties. | Remediated – access removed |
| 4 | User Access Reviews | No formal periodic user access reviews performed for in-scope systems. Some informal reviews existed but were not documented. | In progress (some quarterly, some monthly) |
| 5 | Access Revocation (Non-SSO Systems) | School Cash and Child Nutrition Program Management were not single sign-on; no formal process to notify teams when users were terminated and needed access removed. | In progress; School Cash moving to SSO |
| 6 | Chronos Administrator Access | One user retained IT privileged access after transferring to a different department (~within the past year). | Remediated |
| 7 | School Cash Administrator Access | A shared system account had elevated privileges that were not required for its purpose. | Remediated |
| 8 | Access Provisioning (School Cash) | Formal approval documentation could not be obtained for one user's access, though the access itself was appropriate. | In progress |
| 9 | Authentication/Passwords (School Cash) | Minimum password security requirements not configured. | In progress (evaluating SSO or vendor password parameters) |
| 10 | Authentication/Passwords (Child Nutrition) | Same as above for Child Nutrition Program Management software. | In progress |
| 11 | Physical Access – Server Room | Four users maintained server room access that was no longer required. | In progress |
| 12 | Physical Access – Badge Revocation | No expiration dates set for non-employee (contractor) badge access; no formal termination/notification process for contractors. | In progress |
| 13 | Physical Access – Provisioning | Formal access approval documentation could not be obtained for two contractors (access was appropriate but not formally documented). Forms are being developed. | In progress |
| 14 | Vendor Management – Third-Party (SOC) Reports | SOC reports were obtained for some vendor-managed systems but were not reviewed. No mapping of complementary user entity controls to CISD controls. | In progress |
Observations (Lower Risk)
| # | Area | Finding Summary |
|---|------|----------------|
| 1 | Change Management | No central repository for tracking changes moved to production; details kept in email (risk of losing approval records if employees leave). |
| 2 | Windows AD Admin Access | Schema Admins group had standing access; recommended to eliminate standing access for this high-privilege group. |
| 3 | Windows AD Passwords | Minimum password age not set (users could change passwords multiple times per day). |
| 4 | Application Admin Access | Business users had application administrator access in five in-scope systems; access was appropriate but recommended to segregate or implement mitigating review controls. |
| 5 | SQL Authentication | 10 of 13 privileged database system accounts were not enforcing Windows password policies. |
Key Discussion Points
- Dr. Knoll emphasized that staffing constraints are a significant factor behind many findings. CISD operates with very lean teams (e.g., one person managing physical access controls for 70+ facilities and ~10,000+ people). He noted that remediation may require hiring additional staff in some areas.
- Dr. Knoll commended the existing staff, noting there have been no breaches or major incidents despite the lack of formal processes, and praised the audit committee for expanding its scope beyond traditional activity fund audits to address these harder, more technical areas.
- Mr. Sanders emphasized the importance of physical security controls given the board's strong commitment to school safety and security.
- Mr. Hubert stressed the importance of prompt initial user access inventories and prioritization of remediation actions.
- The committee noted the value of the co-source model with Weaver, which provides continuity (same consultants returning for follow-up audits) and specialized IT audit expertise.
No vote was required on audit review items.
5. Next Meeting
- Confirmed: Wednesday, September 14, 2022, at 7:30 AM
Key Takeaways
1. First ITGC audit in 13 years revealed 14 opportunities for improvement and 5 observations, predominantly related to lack of formal documentation, user access management, and physical security controls. Several items were already remediated.
2. PEIMS attendance compliance remains a recurring challenge; will continue to be audited annually as a continuous improvement effort.
3. Co-source arrangement with Weaver is working well and enabling expanded audit scope, particularly for IT audits.
4. Staffing levels in IT and physical security were identified as a constraint on the district's ability to implement all recommended controls and may need to be addressed.
5. 2022–2023 audit plan approved, with major new audits of Maintenance and Child Nutrition departments, plus a cybersecurity plan audit and multiple follow-ups.