External auditors give Timberlane clean opinion; warn on cybersecurity and policy review

Flotzikus Anderson partner Michael Campos presented the Timberlane Regional School District’s 2024 audit at the board’s February 20 meeting and delivered a clean opinion on the district’s financial statements.

“In our opinion, the accompanying financial statements present fairly in all material respects the financial position of…” Campos said, summarizing the firm’s conclusion that users can rely on the financial statements. Campos told the board the audit found no financial-statement findings and no federal-award findings in the single-audit component required because of federal-award thresholds.

Why it matters: A clean audit opinion signals that the district’s 2024 financial statements are free of material misstatement in the auditor’s judgment. Board members asked for guidance on interpreting an unusually large surplus; Campos recommended reviewing a three-year trend and a fund-balance policy. He noted the Government Finance Officers Association (GFOA) guidance as a reference point and suggested districts consider maintaining a healthy reserve to manage revenue and expenditure volatility.

Key audit takeaways presented: - Clean opinion on financial statements (no material misstatements reported). - No reportable findings on federal awards (the district’s single audit requirement applies when federal awards exceed the standard threshold). - Auditors performed a risk-based audit focused on internal controls, compliance samples, data analytics and transaction testing; typical onsite fieldwork scheduling is about four days plus remote work and additional field days as required. - Schedule highlights: Campos recommended the board review page 21 of the audit packet (a schedule that summarizes general-fund performance) and compare multi-year trends to improve budgeting practices.

Cybersecurity and governance guidance: Campos emphasized that cybersecurity incidents are increasing for local governments and school districts. He urged the district to maintain robust backups and active IT oversight. “Cybersecurity is not one of those things you do on an annual basis,” Campos said; he recommended ongoing attention and coordination with IT professionals and regular review of backup processes. The auditor noted one New Hampshire district that remains in recovery more than two years after an incident.

Forensic-audit guidance: Board members asked whether the audit would trigger a forensic review. Campos differentiated a forensic (agreed-upon-procedures) engagement — which is targeted, more expensive and requires narrower objectives — from the annual financial-statement audit. He said forensic engagements are appropriate when there is a specific objective (for example, tracing a particular bank account) but warned they can be costly and may not yield actionable prosecution-level evidence without additional legal work.

Recommendations and next steps: Campos suggested the board review fund-balance policy language, use multi-year comparisons on the key schedules, and consider a policy review cadence (he suggested a review every three years for significant financial policies, matching board term cycles).

Ending: The board accepted the auditor’s presentation and asked staff to circulate the audit materials for review; administrators said they will bring follow-up materials and any policy recommendations to a future meeting.