[read complete report – pdf] | [read complete 2022 report – pdf]

Purpose of Review

The purpose of our review was to assess the Starpoint Central School District’s (District’s) progress, as of May 2025, in implementing our recommendations in the audit report Starpoint Central School District – Network Access and Application User Permissions (2022M-101), released in October 2022. 

The audit determined that District officials did not adequately secure access to the network or properly manage user permissions to the financial and student information applications. As a result, compromised accounts may not be detected and increased opportunities for users to make unauthorized or improper changes, improperly access students’ private and personal information and/or modify accounting records to conceal malicious transactions exist. The audit included five recommendations to help District officials adequately secure access to the network and properly manage user permissions.

Background

The District serves the Towns of Cambria, Lockport, Pendleton, Royalton and Wheatfield in Niagara County. The District is governed by a five-member Board of Education (Board), that is responsible for managing and controlling the District’s financial and educational affairs. The Superintendent of Schools is responsible, along with other administrative staff, for the District’s day-to-day management under the Board’s direction.

The District has an educational services contract with Orleans/Niagara Board of Cooperative Educational Services (BOCES) that includes providing information technology support through Erie 1 BOCES. The District’s network and information systems are managed by the District’s Network Manager and the BOCES Coordinator assigned to the District.

Results of Review

While we  reviewed progress in implementing our recommendations related to sensitive IT control weaknesses, which we communicated confidentially to District officials, based on our limited procedures, we determined that the Board of Education (Board), District officials, and the Network Manager and District-assigned BOCES¹ Coordinator (IT Managers) fully implemented one recommendation, partially implemented three recommendations, and did not implement one recommendation.