Internal audit finds one moderate control gap in capital programs; committee hears capital project and procurement dashboards

A Plant Moran internal audit of the district's capital programs identified generally mature controls and one moderate priority finding related to a budget‑override capability in the Munis requisition module. Audit staff said the override functionality existed for some users and recommended removal; district management removed the override for two capital staff while the audit report was finalized.

"We did identify one gap related to segregation of duties risk," Matthew Boat of Plante Moran told the committee while summarizing the report. He said auditors found no instances in the sample testing where the override had been used to exceed budgets, and management's corrective action disabled the override for two users in the capital office.

The audit also recommended documenting standard operating procedures and moving some manual processes into system workflows; auditors noted the capital program workflow remains largely manual and would benefit from additional automation. The committee asked for follow‑up documentation on who retains override authority across modules; staff agreed to provide a list of remaining users with override privileges for the capital project module.

In the same agenda block staff presented the monthly capital projects report and a new online procurement dashboard that shows contracts and solicitations greater than $250,000 by funding source, vendor and solicitation type. The capital projects report showed the 2023–2028 sales tax building program expenditures and that a FY26 fixed cost of ownership program had been board‑approved and started in March. Procurement staff said the dashboard will be updated monthly and allows trustees and the public to drill into solicitation days on the street, response counts and vendor names.

The committee discussed third‑party construction managers: staff confirmed there are two construction management firms currently assigned to different program phases and that selected roles for those firms have limited VPN access to the Munis project module. Staff said access is permissioned and training is provided; the auditors included contractor access in scope for the capital audit.

Next steps: staff will provide the committee with the list of Munis users who retain budget‑override privileges in capital modules and will schedule a follow‑up internal audit in a future year to reassess remediation and process automation.