CCSD outlines COSO-based internal control framework; committee approves review 4-0

The Audit Advisory Committee reviewed the Clark County School District's internal control environment and approved the update, including COSO framework mapping and cybersecurity controls, by a 4-0 vote on Feb. 27.

Interim CFO Diane Bartholomew walked the committee through the COSO components — control environment, risk assessment, control activities, information and communication, and monitoring — and described how the district applies them in policies, organizational structure, and monitoring. She said the district's internal-control efforts include segregation of duties, preventative and detective controls (such as reconciliations and audits), automated workflow controls in SAP and PeopleSoft, and internal- and external-audit monitoring.

Bartholomew also described recent cybersecurity measures taken to strengthen account credentials, expand two-factor authentication, limit Google access, add incident hotlines and coordinate with law enforcement and cyber specialists. She said the district uses grants and available resources to enhance controls but noted funding constraints. "We've provided incident hotlines to respond to questions... We've secured the Google environment better by limiting access," she said.

Committee members discussed public access to internal audit reports. Jeanette Scott said reports are not routinely published online but are available on request through Internal Audit or the public information office; she noted the department issues more than 100 school audits annually and handles requests on a case-by-case basis. Member Thornberry emphasized that publishing reports and making contextual material available could support transparency and suggested the committee consider options for public access while protecting the integrity of audit sampling and timing.

After discussion, the committee voted to accept the internal control environment review with no additional formal directives recorded during the meeting.