Coraggio Consulting
Loudoun County School Board, Audit Committee Meeting, Thursday, September 10, 2026

Date: Thursday, September 10, 2026
Place: Loudoun County Public Schools / School Board meeting (see BoardDocs / LCPS-TV)
Length: 1h 27m (video)
Official meeting video (Vimeo / LCPS-TV): https://player.vimeo.com/video/1225724996?rel=0
BoardDocs (School Board): https://go.boarddocs.com/vsba/loudoun/Board.nsf/Public

Machine transcript (speech-to-text) produced by Coraggio Consulting. Not an official county record. Names and numbers may be misspelled; check the video at the timestamp before quoting.
Speech-to-text: whisper.cpp, model large-v3-turbo. Produced 2026-10-30. Timestamps are [HH:MM:SS] into the meeting video.

----------------------------------------------------------------------

[00:00:12] Good evening, everyone. Welcome to the September 10th, 2026 meeting of the Audit Committee. I am Anne Donahue. I am the chair of this committee, and I apologize for being a few minutes late. I appreciate everyone's patience. With me are Mr. Pepper, the representative from the Dulles District, and Ms. Bricardi, the representative from the Sterling District.

[00:00:31] We will get started with our, we will get started with the second item on our agenda, which is public comment. they're seeing that there are no signups for public comment today we will move straight into item number three on our agenda which are minutes the draft minutes from our august 5th 2026 meeting were posted on board docs prior to this meeting hopefully my colleagues have had the opportunity to review the proposed draft if there are any recommended or requested changes or edits we can discuss those at this time and otherwise i will entertain a motion to approve so moved

[00:01:07] second thank you that motion has been properly made by Ms. Riccardi and seconded by Mr. Pepper all those in favor please raise your hand say aye abstain I was not in attendance at the last meeting rightfully abstain I should have maybe said if there is discussion okay so Ms. Riccardi was a yes I was a yes so that motion does pass with two board members in favor of the motion and with Mr. Pepper abstaining from the motion on the basis of his absence from the august 5th meeting

[00:01:46] thank you then we will move on having no action items for today we will move on to our one information item the annual audit plan debrief mr woods the floor is yours good evening madam chair members of the audit committee tonight's presentation is a retrospective on the fyi 2027 annual audit plan development process rather than discussing the audits themselves the focus is on on this debrief is on the planning cycle that produced the approved

[00:02:23] 2027 audit plan i'll walk you through how the audit universe was developed how risk information was gathered and evaluated what planning activities occurred after plan approval what lessons learned can be applied for the 2028 planning cycle but most importantly this discussion is intended to obtain your feedback with the goal is continuous improvement of both the planning process and the information provided to the committee during future audit plan development next slide please um this item is strictly for information today i'm requesting approval i'm not

[00:03:03] requesting any approval of any uh action or amendment to the audit plan at this point as the governing body responsible for the oversight of the office of the auditor general the audit committee plays a critical role in shaping the annual audit plan because of that oversight role i believe it is important to periodically step back and assess not only what we chose to audit also how we arrived at those decisions this debrief is intended to answer four questions did the planning process function as intended what worked well what did we learn after detailed planning began what should we

[00:03:38] change before developing the 2028 plan the feedback received tonight will be incorporated into next year's universe development risk assessment methodology and planned selection process next slide the 2027 planning process began with a division-wide risk assessment we gathered input from principals senior staff school board members audit committee members and observations from the broader DMV k-12 environment that assessment helped identify and validate 38 audit topics

[00:04:17] across nine risk domains establishing the 2027 audit universe. From that universe, I developed and endorsed a list of 13 candidates for the committee's consideration. The endorsed list was then presented to the audit committee for discussion and selection. During those discussions, the committee identified an additional audit topic for consideration, which was the LCPS Sheriff's Office MOU sharing, which was subsequently approved and incorporated into

[00:04:49] the 2027 annual audit plan following committee deliberations for a total of four were approved one thing i'd like to point out is that the 38 topics were not simply a list of potential audits they were the output of the oag's annual risk assessment process and represented the areas where stakeholders environmental factors and professional judgment collectively identified organizational risk so even though only four audits were ultimately selected every topic received

[00:05:25] documented consideration and risk evaluation during the audit planning next slide after the committee approved the plan a detailed planning began for each engagement that planning produced a comprehensive risk and control matrix for all four audits across those four audits we identified 88 individual risks of those eight were assessed as critical 33 as high and 42 as moderate and I want to take a step back and what this what this means is these are just questions that will

[00:06:01] potentially ask during the audit these were not actual audits that were performed that identified these steps these were general areas of risk identified just during the pre-planning of audits And so when we do our audits, these are the questions we ask.

[00:06:17] And so if you see employee reporting has two critical risks, it just means those are two areas during the audit process that we'll ask. It does not mean that those are two critical risk findings within the division.

[00:06:33] So look at this as 88 questions we will ask that we hope to gain questions to those questions during the audit. And we assess those questions as, is it a critical question, is it a high-risk question, or is it a moderate?

[00:06:49] And so these are really just 88 questions we identified. And so I think that's a way to look at these identified risks for the audit planning. And so I think this tells an important story of the audit steps we will perform during those audits.

[00:07:06] The approved plan is not concentrated in a single area of organizational risk. Instead, it provides coverage across multiple risk domains. For example, cybersecurity audit contains the largest concentrated of elevated risk, including issues related to security monitoring, network architecture, vulnerability management, and incident detection capability.

[00:07:29] The federal grants audit contains significant compliance and financial stewardship risks, particularly around allowability of expeditures, documentation, monitoring, and reporting requirements. For the Sheriff's Office information sharing protocols, the risks are associated with FERPA compliance, law enforcement information sharing, threat assessment participation, and statutory notification requirements.

[00:07:58] One of the most significant risks identified within the audit involves timely reporting of reportable offenses to law enforcement. So during the planning that risk remained in the critical category reflecting the potential student safety and legal implications of delayed notification for employee reporting and retaliation complaint oversight to reporting or two items were identified as high risk or critical risk profiles.

[00:08:29] They are employees may choose not to report concerns due to fear of retaliation and governance bodies may not receive sufficient reporting on complaint trends outcomes and emerging concerns. Again the way to look at this is these are questions we will ask during the audit and so we do not know at this point if employees fear reporting out of fear of retaliation.

[00:08:54] Those are just the questions we are trying to ask and determine during the audit. These risks are important because they can undermine management's visibility into issues before they become larger organizational problems.

[00:09:11] Overall, the approved plan provides a mix of compliance, operational, governance, and cultural risk coverage. Next slide. So after looking at our planning process and the approval, I've assessed what I think went well.

[00:09:30] And looking back on the process, several elements worked particularly well. First multi-source risk assessment approach rather than relying on a single perspective we incorporated viewpoints from principals senior staff board members the committee and environmental scanning of the k-12 risks and so what that means is of those 38 topics that were in the audit universe they were developed with input from principals senior staff board members and the committee and so it really lives and incorporates the LCPS community when we developed those 38 topics.

[00:10:10] Second was documentation. Every major planning decision was supported by written rationale that created transparency and traceability throughout the process. Third, planning work began aggressively and early.

[00:10:26] Prior to field work beginning, preliminary risk control matrices, risk assessments, pre-audit surveys, and execution strategies have already been developed for all four audits. And so if you go back to the prior slide and saw those 88 identified critical risks, or not critical, but 88 identified risks, those have already began to be identified before we develop or before we get into the actual audits.

[00:10:51] And so we have performed some pre-planning ahead of execution of those audits. Finally, committee engagement was meaningful. The final approved plan reflects committee deliberation and discussion. It was not simply a staff-generated plan presented for approval without modification.

[00:11:12] So in my view, those are all positive indicators of a maturing audit planning process. Next slide, please. Once detailed planning began, several important observations emerged.

[00:11:28] The first was that planning successfully identified capability gaps before fieldwork started. Specifically, portions of the cybersecurity audit involved highly specialized areas, such as security monitoring effectiveness and network architectural evaluation.

[00:11:45] And so the cybersecurity had eight identified risks. Out of those 26, two of them, the OAG office has capability gaps. And so those two particular items, we will not be able to perform in-house.

[00:12:04] And so in order to resolve those, we'll have to have audit committee discussion. Also, there may be mitigating factors in that DDI or IT department may already receive outside expertise in those areas, which we'll dig into once we perform the audit.

[00:12:21] But out of those 26 areas that are risk-based, two of them, we do not have the internal expertise to perform. And again, those would be needed for IT experts to look at that. And so those items were identified prior to performing the audit.

[00:12:40] And personally, I think that is part of the process and a good practice. So planning exists partly to identify resource constraints before audit execution when corrective action is still possible. Second, planning highlighted the impact of mandatory topical requirements or mandatory professional requirements.

[00:13:04] As we map the cybersecurity audit, IIA, or Institute of Internal Auditors, has topical requirements that were applicable to that audit and that expanded the scope to include additional risks that had not been identified during the universe stage. Again, this is a normal process and expected outcome of planning. Third, we learned an important lesson regarding complexity versus risk. A highly complex audit is not necessarily the highest audit risk. Likewise, a relatively straightforward audit may address some of the

[00:13:40] most significant facing organization, risks facing the organization. So going forward, I believe separating complexity from risk more explicitly will improve committee decision-making next slide please after planning activities were completed I looked at the plan against our office capacity we currently have three staff available for fieldwork execution I invited three potential models a fully sequential approach would have us working on one audit at a time would be

[00:14:19] the least efficient and so after we complete one audit we start another audit and just doing preliminary planning doing it that way we believe that it would be the audit plan when it be completed until December 2027. Instead we like a fully parallel approach and so what that looks like is starting an audit most likely every six to eight weeks during the fiscal year so we'll start the LCPS Sheriff's Office audit first which began this week and then in six to eight weeks we'll

[00:14:53] start a second audit and from there on the operational plan is to follow the same cadence of every six to eight weeks for these four audits is to begin a new audit so they'll go parallel. Under that approach all four audits are projected to be completed sometime in spring 2027 leaving approximately a few weeks of contingency before fiscal year end. Based on current planning a

[00:15:20] assumptions. It's my assessment that the approved plan is achievable. Next slide please. During the audit plan approval there was discussion regarding whether audits should be added. So right now we have four and prior discussions in the audit committee. We discussed adding four to five and in the last meeting we talked about possibly adding them today. I recommend waiting until November before making that decision for three particular reasons. First we have not began field work on

[00:15:57] any of those audits, and so because we haven't generated any meaningful data, we just don't know how long it will be to analyze that data, so that's one of the reasons to wait until November. Second, the current schedule is already sequenced, and third, capability questions associated with portions of the cybersecurity audit have not yet been fully resolved, and so before adding work, I believe we should determine whether or where we are in that audit process for those audits that were approved so rather than deciding today and to add more

[00:16:33] audits I propose providing the committee with a formal capacity assessment in November based on actual engagement process and if capacity exists at that time to provide new audit topics that can be approved in December and so that is what I propose we do as opposed to adding new topics today. Next slide please. Planning also identified several opportunities to strengthen future cycles for university development. Increased survey participation.

[00:17:11] We surveyed all principals. We received 31. I don't control who responds but I do think if we engage them earlier then maybe we can increase participation and so giving them more time to respond. It helps you know it It helps suit their busy schedules to give them more time to review it and adequately address those surveys.

[00:17:41] For the risk assessment, apply formal likelihood and impact scoring sooner. So what that looks like is if we have an audit universe, we apply a likelihood and an impact of the audit topics, which is a risk practice.

[00:17:56] And so you'll see an audit topic and its associated likelihood and impact. Now, again, these are preliminary assessments, and we really truly get to a finalized risk until the end of the audit. But I do believe providing that to the audit committee in earlier stages helps with the approval process, and it helps you be more informed when looking at the audit universe.

[00:18:23] And lastly, plan selection. Provide capacity modeling before committee approval. And so we did discuss this in general where we anticipated performing four to six audits but it's performing that in a model where you can see a schedule when we present those audits on what four to six or any number of audits will look like over the course of a fiscal year.

[00:18:49] Also include a sequencing for that. So again that's just going back to a calendar to provide you if you do approve four audits this is what it looks like for certain audits and if you do approve six audits this is what it will look like the earlier those questions are addressed I think the better informed committee will be during the planning section next slide so at this point I would like to transition from a presentation and to discussion I especially appreciate feedback regarding five general areas

[00:19:25] they are did the committee receive enough information about each topic to inform to make an informed selection should the OAG present capacity and expertise constraints before the committee selects rather than after similar to the cyber security audit is november the right point to revisit adding audits or would the committee prefer a different checkpoint particularly earlier than november are there risk areas the committee expected to see in the universe or the audit plan that we're missing and lastly what would make the

[00:20:01] FY 2028 endorsement package more useful to the committee's decision making. Thank you and I open the floor for any feedback. Thank you Mr. Woods. Thank you for the presentation. Before we get into those questions I would like to ask you a few questions about some other points that you made backing up a little bit. So first I'm looking at slide number four in your presentation and it says here there was a total of 88 risks identified.

[00:20:32] But when you presented the audit universe to us, it was cut down to something like 38. So how do you develop the list of the 88 identified risks? So the 38 that were presented in the universe are audit topic.

[00:20:50] And so they're general at the top level of the pyramid, and then these 88 come from the four individual audits. And so out of those 38, if we looked at all 38 and identified risks within those audits, it would be exponentially larger than just 38. And so you can think of it as 38 is the top level of identified risks with their topic, and then the 88 is once we dive into each individual audit.

[00:21:16] And so these are the areas we look at per audit is what the difference is. Thank you. And can you walk us through at a very basic nuts and bolts level, you said you solicited input from principals and from other interested stakeholders in putting together the proposed audit topics and risk identification, but can you walk us through at the very most basic level, nuts and bolts, how did you do that?

[00:21:46] What exactly did you do? Who did you reach out to? Yes first we develop a set of questions to ask for principals and so it's a it's a survey asking principals about things that are related to training safety support services that they receive at the school level and it also asks them what risks they have or what concerns they have and so we send out a survey to all principals then we develop a second set of survey for senior staff who have a different set of responsibilities and so the surveys may look

[00:22:23] like but the questions vary vastly because their roles and responsibilities are different. So one question is geared toward school based staff and the other question is geared toward administrative staff and the other survey or questionnaire we send is to each board member.

[00:22:39] Now the difference between what the board members get and what senior staff and principals get is board members get open-ended questions where they can provide essay responses and so we can get their insight and whole at the top level from a governing body standpoint and so the difference is your questions aren't radio buttons or you decide between four questions they are giving you the chance to respond wholeheartedly and you can just write as much as you can because there's also nine

[00:23:14] board members and so it's easier to analyze nine responses that can have the potential to be long-winded as opposed to a potential of a hundred principals or however many senior staff we have and that's why there's a difference in the surveys we provide to the different individuals groups thank you that's very helpful um the the surveys are they anonymous um we have the ability to know who responded but no one outside of the office so we do protect their identities just because

[00:23:49] it's a google form and it does collect metadata that includes name date time of response and emails but that information is not shared outside the office you mentioned you received responses from 31 principals is that right what kind of rate of response did you get from senior staff

[00:24:07] if you give me a moment i can give you the exact response number but we received 16 responses from

[00:24:43] senior staff out of how many that i do not know okay i was just curious if that's if you know if that's like a quarter response you know 25 of 50 i i would believe it's more than 25 but an exact number i can tell you i can check and respond to you after the today's meeting thank you and can you also go back and go over one more time what you mean when you say risk in this context what

[00:25:17] does it any risk is anything that has the potential to have a negative impact on LCPS operations and so it could be do we have exit signs indoors the risk is that they don't all they're not all there and all the doors like they're supposed to on egress positions in the building and so if you saw the 88 it just asked does every door that is that you can go outside to does it have exit

[00:25:52] sign over. And so that's the risk exists, but we don't know until we perform the audit. We're just going to ask that question at the beginning to help form our audits. And so another way to look at it is it's the audit program. And the audit program are just the steps we're going to do to meet the objective of an audit. And so those questions that we'll ask doesn't mean at this point that they exist. It just means that these are the areas we need to look at during the audit to answer or to address the audit scope and the audit objective.

[00:26:30] Thank you. When you put together the surveys to send out to the principals and board members and senior staff, what are the you said especially you said only board members get open in a survey. So principals and senior staff do not obviously.

[00:26:48] So what kind of questions do you ask them and where do you come up with the range of topics to put into the surveys? Great question. And you know while we're on this subject we can gladly go over some of the questions to help you understand because I think this is a good exercise for future planning.

[00:27:08] So for principal some of the questions we ask populating now. So there's they're quartered off into different sections. So first we'll just go over the top. There's a financial management controls section of the survey.

[00:27:26] There's a compliance and reporting section of the survey. Operational effectiveness and efficiency. Student safety and well-being, staffing and human capital, technology and data security, facilities and assets management.

[00:27:45] And there are optional open-ended questions, but only two for the principal. And questions, for an example of a question related to financial management controls, financial processes at my school, example, budgeting, purchasing, activity funds, are consistently followed and well-controlled.

[00:28:06] And the responses include strongly agree agree. Neutral disagree or strongly disagree. I'll skip down to operational effectiveness and efficiency. An example question would be administrative processes at our school. Examples are scheduling substitute management records management operate efficiently with minimal disruption to instructional time.

[00:28:32] Again the responses are similar to the last question. And last I'll give you an example of a student safety and well-being question our school's physical security measures example access controls visitor sign in procedures emergency protocols are consistently followed by all staff.

[00:28:51] Again the responses are similar to the last two questions of strongly agree agree neutral disagree strongly disagree. And so when we send these out to principals we get the responses and based on their responses in the aggregate of strongly agree or agree or neutral disagree or strongly disagree we can identify where they're identifying risk at their school.

[00:29:13] Just to give you an example the open-ended questions that they get which are two are in your view what is the single greatest operation operational or compliance related risk facing your school at this time and what if anything is currently being done to address it.

[00:29:32] So that is open-ended question we ask principals. Would you like for me to go to the senior staff survey. That gives me a good flavor of the questions. Thank you. Part of the, my understanding is that part of the audit process, obviously your team is doing the bulk of the work, but you need to work with staff to be able to gather the information that you need.

[00:29:58] So is part of the process, do you have conversations with staff members to find out if they are going to have the bandwidth to be able to provide your office with what information is needed to be able to conduct the audits during the audit planning uh no but or at least not this year so last year uh or the prior year we did meet i did meet with all cabinet members and senior staff and had an extensive conversation with them usually lasted 30 minutes sometimes an hour to document questions that quite specific question was not asked but

[00:30:32] during the audit process we do work with staff because we do know they're not waiting to be audited they do have their day-to-day work and so those questions do not really arise until we are actually in the audit process thank you i'm definitely going to have more but i'll cede to my colleagues mr pepper thank you chair donahue um so i'm going to back up and this slide is actually perfect where i i want to be um so i know you you talked a little bit about the difference between the

[00:31:07] identified risks versus the overall topics and they're kind of larger risk what's the process for developing both the identification of these kind of leveled risks as well as classify them as whether they're critical, high, moderate? And the reason I'm asking is it seems like a lot of you're pre-planning an audit, but when I go into something like an audit, I feel like I don't know what I don't know, right? So what's the process for determining these things before you even dive into the work? You're 100% correct, and that's why these are questions or to help develop the audit

[00:31:44] plan so and I'll give you an example of what that looks like I will open up one of these matrices I'll open up the one for this one and what I'll go through are examples of the sheriff LCPS sharing and so what is the risk is FERPA health safety emergency disclosures so that is the compliance issue what is the risk that we fail that compliance and that

[00:32:21] is when a records custodian discloses student educational records to law enforcement under the FERPA health or safety emergency exception, the required documentation, articulable threat entities disclosed to rational basis is not consistently created or retained.

[00:32:41] And so is that information that we provide to law enforcement consistently maintained and protected? So that's a risk that we can identify before we do the audit. And then once we do the audit, we just make sure that that information is protected and it's sensitive information is protected.

[00:32:59] And so we can't answer that question before the audit, but we can develop those questions before we do the audit. So I guess my question maybe is a little bit different than what's the planning like that even helps you develop those questions, right? Like how do I know your team is expert, your auditors, that's what you do for a living.

[00:33:18] But what's the process like? How do those questions come up? But I'm assuming, with kind of a follow-up question, that once you begin an audit, you're also probably identifying additional risk factors and coming up with additional questions for those. Several things.

[00:33:34] So for the LCPS sheriffs, there's the MOU. It's not a contract, but I just, when I'm preparing these things, I look at it as a contract. But there's also some things that are just standard like the FERPA, COPPA, student data that are just applicable to student data information across the board when we deal with audits.

[00:34:00] Secondly, for federal grant, there's the federal grant requirements. There's also guidance provided from professional organizations on federal grant auditing. Also for cybersecurity, because cybersecurity is what's considered a topical requirement by Institute of Internal Auditors, there are certain things we have to do under that audit if we want to be compliant to the standards.

[00:34:30] And so for that audit, the cybersecurity one, there's a shell that IA provides, and so that helps us develop it. And so there's many resources, there's professional judgment, there's professional organizations that provide guidance, there's the MOU which has requirements, there's federal grants which have requirements, and so all of those taken into consideration helped me develop the RCM or risk control matrix.

[00:35:04] We'll move on a little bit down to, I know we were talking, I believe it's either slide five or slide six, we were talking a little about the cybersecurity audit and how there is an expertise gap and that you will have to probably bring out outside personnel is that something that this committee is going to like maybe this question actually for mr. all is something this committee is likely going to have to approve the individuals that you're planning to bring on and then kind of piggy i'll answer that one first and i'll kind of piggyback off of that well i'll get into the does the committee have to approve i i would think if we co-sourced the committee would definitely have to approve because there may be a budget impact uh this year

[00:35:43] We might have a small budget to do that, but I don't think it would be enough to maybe cover the needed maybe 60 to 80 hours of work. Again, this is just a general question, a general response to what that would look like. Additionally, the IT department that we currently have may already have things in place that would address those identified risks.

[00:36:06] And they are, like I mentioned earlier, are monitoring and detection. And the risk is security, monitoring capability is insufficient to detect malicious activity in a timely manner. They may already have the external experts test these things.

[00:36:24] And so that may be a mitigating factor. So we may not be able to perform it internally because you would need an IT expert, but the IT department may currently already be doing these processes. we may not need to core source or hire an outside vendor because it may already be doing we may already be doing that and so during the audit we can look at that but if we needed to hire outside expertise yes I believe the audit committee would have to approve and I would defer that to Wes just to ensure I'm accurate.

[00:37:02] Thank you. There are a couple considerations too to ensure that it's properly procured under the Virginia Public Procurement Act it would depend on kind of the scope of work as well whether it qualifies as professional services or not so we would need to take a closer look and then actually we're on the perfect slide here so I do want to talk about kind of this order and the six-week stagger obviously based on these three possible predictions it does seem like the six-week stagger makes the most sense

[00:37:37] is there a possibility I know you mentioned kind of six to eight weeks really isn't a true six weeks but is there a possibility that we could delay in commencing you know for example a third audit if the first and second one seemed to be a little more complex in nature yes as you mentioned earlier earlier before the audit there's some things you just I don't know what I don't know and to answer that the answer is yes and my duty would be to report that in committee so you would be aware on delays and that would usually come in the form of quarterly updates and then the other question the last one I have and I'm going to let my other colleagues talk is what's the

[00:38:16] determination in the order in which we rank if we're going to do a staggered approach the sequencing of audits right we have four audits how do we decide which ones comes first and second is it complexity is it impact is it risk level what's what's the determining factor capacity looking at the staff with the performing currently and then looking at what audits would be most approachable first and how we can stagger those audits first and then go down to items that are more complex.

[00:38:48] And so the cybersecurity readiness and incident response audit is number four that we plan to start just because we think it will be the most complex. Also, because we believe it will be the most complex, we've already had auditors sign up for training, and that training will be the first two weeks of December to help enhance their skills during that audit.

[00:39:11] And so that's also what that's for. I'm sure I'll have more questions later when we discuss the questions you posed. Ms. Riccardi. Thank you, Madam Chair. Thank you so much for this. I think one of the things I'm finding really fascinating in this is that it's a learning process as far as learning how you're standing up the office and how we're crafting all this.

[00:39:33] I know we're going to get to the five questions next, right? So just more about the presentation. I think it's pretty straightforward for me. I guess a couple of the questions, I think 31 out of 100 principals is a, is this the first time we've done this survey in this manner with principals?

[00:39:50] No, we've done this, this is now the third year, I believe. And how has that response been compared to the other years? If you give me a second, I can give you the exact. Yeah, that'd be great. I just, yeah, I'm just trying to figure out, you know, in PMC we have a big question about surveys and survey responses right now.

[00:40:06] So I'm trying to kind of figure out what we're looking at. well in this case there's a lot of really great input that principals have in a unique perspective that they provide so I just want to make sure that we're I mean 31 percent is not necessarily a bad response rate but I don't know how that compares to other types of surveys that LCPS does so for staff in particular my memory from Tuesday is that the staff response for the calendar survey

[00:40:42] was one to two percent this is a little improvement from that yeah I would say it's trending greatly So, in 2024, for the 2025 planning, there were 13 responses. In the year of the 25-26 last year, there were, should I get this correctly because I'm in a spreadsheet and not Google Forms, 33.

[00:41:20] So, there was a slight dip by two principals, but 13 jumped to 33, and now it's settled in the low 30s. 31, okay. Yeah, I mean, that's, I think that's a pretty good response. Um, I would rather go on to the questions because I have feedback on the other five So I'm not gonna if I have any other questions. I'll just send those to you, but I'm game to move along Thank you, mr. Cardi before we jump into that mr. Woods. Can you just briefly?

[00:41:45] Remind us how you designate the critical high moderate risk assessment and what those Designations mean yes, so we look at the likelihood of an event occurring and then what is it in what's its impact?

[00:42:02] So if the likelihood is assessed at one and the impact is 10, so it's an event that would not happen very often, but if it were to happen, it would create such an impact that it would have critical negative impact on LCPS operations, then it is considered critical.

[00:42:25] if it has a assessed likelihood of three and a impact of three and I'm just going to use this on a one to ten scale that's around a six that's a moderate or high I would I would give six a high assessment and so it's what is the likelihood of an event occurring and what is the impact of an event and so it could have a low likelihood and a high impact or it could have a moderate likelihood and a moderate impact or it could have a high likelihood and a low impact and so we don't know

[00:43:04] if these things are actually happening it is just assessing what is the likelihood and the easiest thing to assess at this point is the impact because we know if we ask a question and if it's like if it's true there's a high impact if it's not true then it's a low impact and so effectively we don't have an understanding if the events could occur we are just taking a professional opinion and applying it to how we can perform the audit thank you for that we want to move on to discussion

[00:43:41] of these questions for the committee you want to go first all right well thank you um so for the are we gonna do one question at a time or you want to go through all of it i don't i don't have that much i just had a couple i mean there's a couple things go for it okay all right um so i would just say for um did the committee receive enough information i think we received enough information i'll tell you just and i can only speak for myself my personal take was i had to wrap my head really around this process because um you know from a consulting perspective this is like creating a lot of hypotheses about things and then now you're gonna have to go prove them or disprove them

[00:44:19] as you're going and that can be something that gets to be really hard to wrap your head around in some cases especially around themes and topics that i'm not sure i even have a full grasp of at this point so I think that's going to be an interesting thing I think as we move forward one of the things that that's going to be really helpful it one of things I'm wrapping my head around in this process is the school boards preferences and initiatives versus the principals and staff the principals and then the cabinet or leadership's perspective and their priorities so I

[00:44:56] think next time it'd be really good to maybe we did this and I just forgot but really divide up those three so that we can really kind of see the buckets um because there are for any number of reasons i may you know personally i may pick something that principals want to see or and or staff before the school board or whatever i don't know how you know what those instances would be but i may want to see it that way um i think number two i think we kind of already addressed that here a little bit so i'm not really too concerned about um that one at this point in time i mean i work in for different clients from different um that range from all

[00:45:35] different kinds of professions and industries i have no expertise in so you kind of have to get in and learn it and i'm assuming your office is the same way you're you're experts in the process and then you have to become subject wise as you're working through the different departments and so i would say as we're the kicker here is from a budget perspective if you do need to have outside expertise come in to help you with something i'm wondering if we need to align it with the budget ask and I'm not sure where the right timing is for that so I'll stop on that one

[00:46:13] so you can respond we would have to identify what audits need outside expertise a lot earlier than now so it would have to be in the spring I would assume or because if we do a if we do a budget request now as a regular business process that budget wouldn't be available to us till July 1 we'd have to do an ad hoc budget approval and I don't know what the appetite is for that yeah I mean we'd have to be doing it yeah we'd have to have them now so we could start as we're starting the budget process be able to budget for you for the next year cycle so that's a whole nother can of worms and

[00:46:51] timing and organizing the process and things but it's something that would be interesting so I just want to add for those two items that are identified that are out of our expertise you could just approach it in the next audit plan too and so that is also another way to address it and say we can perform what we can now and then those two items we can address on the next iteration of an audit plan for number four there are a couple risk areas I and I think I've already mentioned it in here too and it's just by nature of how the boards

[00:47:28] organized itself right now but you know we have a huge percentage of our budget that's in HRTD and salaries and whatnot but we don't have any school board oversight um committee that's looking at hrtv in particular so um i mean that's kind of a it raises some questions for me in a couple of different areas with regards to our work um i think you've done a really fantastic job though of grabbing a huge population of content and then helping to really kind of whittle it down and prioritize it so as far as the risk areas go i think we're good i think the question is with the collective bargaining agreement and all the kinds of things

[00:48:08] wrapped around people i think that's the one area that i'm not sure we've um from a risk perspective been able to really um provide good oversight to i feel like that's from a school board perspective and perhaps that's a retreat topic for another day but i think there's some things around that that would be interesting um and i think i've already covered five i mean i just think having having things brought the survey question results broken down by the three different groups of respondent pools or if there's more later on would be super helpful so i'll stop there since

[00:48:40] our time is getting tight. Thank you. Mr. Pepper. Thank you, Madam Chair. So I think I'm very much in agreement with my colleagues in that I do feel as though I, and although I wasn't present at the meeting where we determined the audit plan, I did feel like I was able to provide input in our prior discussions knowing that I was going to be out with the rationale that was provided. I would also like to kind of see how those topics came about as a result of the survey and who was putting what in. So I knew kind of who was prioritizing what things and how they were developed. I think that

[00:49:18] was very helpful. The other one I would say would really be number three is November, the right point to revisit adding audits. I almost think that might be, I know you think it's too late. I think it might be too early. Judging on, you know, you probably are in beginning the second audit at that point and know the complexity and the expertise. I would say it's probably that time where we're getting ready to at least finish the first audit and really see if there's going to be capacity i know you believe if everything goes according to plan but nothing goes according to plan there'll be a 13 week-ish buffer in april um but i'm thinking it might be closer to december

[00:49:56] or january i want to make that decision just seeing where we are and we'll get a quarterly update so that'll help us tremendously um are there risk areas the committee expects to see in the universe that we're missing once again that's a i don't know what i don't know right i don't i don't know the full results of the survey i think maybe that would be helpful in some ways to the committee to kind of see anonymously, of course, just what the community at large is identifying as risk areas and how that translates to a possible audit universe and step down all the way to the audit plan, and now we're really drilling it down.

[00:50:28] But I think those are the big things that would be much more helpful to me going forward. Thank you, Ms. Riccardi and Mr. Pepper. In reflecting on these questions, I think it's tough because this is, for all of us, an evolving process.

[00:50:51] So the way I feel about this right now might be different than the way I feel about this in six months or a year. But as far as did the committee receive enough information about each topic to make an informed selection? There were certainly some topics that I felt I wish that there was had been more specificity in what the risk was that you were looking for.

[00:51:16] But it does seem like a little bit of a chicken and egg type situation to Mr. Pepper's point of you don't know what you don't know, that you might not be able to get more specific until you've had some initial conversations. For two, should OAG present capacity and expertise constraints before the committee selects?

[00:51:36] I think yes. I think that would be helpful both because of the potential expense, but also I assume that that is going to affect the time estimate of how long you think an audit is going to take. And so I do think both for you to conduct it and to issue a final report, I imagine would be affected by if you're going to need to be working with outside expertise.

[00:52:03] And I think that information would be helpful when we're trying to figure out what is a realistic audit plan for your office to accomplish in a fiscal year. Whether November is the right point to revisit, again, I think that's going to vary depending on the circumstances.

[00:52:22] Are there risks that I expected to see in the universe that we're missing? I don't think so. Would the endorsement package mean what would make it more useful? So things that we've discussed and Along those lines I wanted to wanted to invite mr. Smith to To come up to the microphone if you if you don't mind my My my understanding was that With regard to the cybersecurity audit that we approved a proposed audit that we approved as part of

[00:53:00] our audit plan that my understanding has been that DDI may have some concerns regarding the timing and their availability in working with this audit. And so I was hoping that Mr. Smith could speak to those concerns. Sure. So we have regular audit cadence already baked into our yearly calendar where we use our incident response retainer provider to do that security audit for us.

[00:53:32] So we've actually provided that to Mr. Woods so that he can have access to it. So the question is just, are we auditing the audit? Like, what does that process look like? Because we don't want it to be duplicative, and we have those individuals who are doing that work are cybersecurity experts to the nth degree, and so they provide a very robust report.

[00:53:56] And so is that what you were kind of asking about? Yes, that was one of one of the points. And then another another concern that I had understood was that some part of the of the identified risk may have to do with a system that is that we are no longer going to be using.

[00:54:17] That is there are several processes in place. The largest one we have right now is replacing Oracle ERP system. And so we have there's a lot of process baked around a system that doesn't fit our business needs that we've had to manually manipulate.

[00:54:33] And so auditing those processes are auditing a legacy environment that we are currently migrating away from. So the concern is, are we looking at as-is or to-be? Because most of those have already been identified as concerns and are already baked into this large ERP implementation project.

[00:54:53] Thank you, Mr. Smith. And Mr. Woods, do you have a sense right now of exactly what you'd be looking at in the cybersecurity audit? Governance, risk management, we take a broader look, like I said, how their risk are managed across the organization, how they're monitored.

[00:55:25] It goes beyond ERP, but in the universe, we did have an ERP implementation on the audit topic. We did say that we don't have the expertise to do that one. And so we kind of did approach the question two on the constraints, but I don't think it was as adequate as it could have been but again we take a general or more broader look cyber security experts are looking at technical testing we're not looking at that technical we

[00:56:00] definitely couldn't do architecture testing or penetration testing we couldn't do security on vpns or anything like that and so it's like are these things in place do we have an incident response plan is it is it reviewed on a regular basis also there are certain cyber security governance practices that extend beyond ddi cyber security is a team effort all of us are entrusted with cyber security and so we take a broad picture ddi would be the focus but they're

[00:56:36] not the only individuals because again we all take a we all have to participate in cyber security when we are provided these devices. And so we are not going to pretend to do really high technical areas on this audit, but we do look at overall governance on cybersecurity.

[00:56:56] Thank you, Mr. Woods. I feel like this is, and thank you, Mr. Smith. I wanted your input because for me, this contextualizes my points about what would be more useful, at least for me, as we move forward.

[00:57:11] And that includes, I don't, and this might be partly on me because I'm bad at computers generally, but I don't feel like I have a solid grasp on what you'd be looking for in a cybersecurity audit.

[00:57:27] And we all know cybersecurity is incredibly important, but we also don't want to duplicate efforts that DDI is already going through. And I did support adding that into the audit plan for next year, but I am wondering now if I would have felt similarly if I had known some of the information that Mr. Smith has raised, if it would be a productive use of time and resources at this juncture based on what his office is already doing.

[00:57:58] And it may well be, but because I still feel like the goal of the cybersecurity audit, for me, is feeling a little vague, that it's hard for me to make that balance assessment in my own.

[00:58:16] Ms. Riccardi. Thank you, Madam Chair. So I think this, for me, raises – so from a cybersecurity perspective, for me as a board member, looking at it really strategically, I think one of the questions I would personally have is, you know, God forbid, worst-case scenario, LCPS is under a major attack from a cybersecurity attack.

[00:58:42] And this is, by the way, probably not part of a publicly offered report, right? It would be something that the school board had. But, you know, what are the plans in place? And I'm assuming, and I know we do, I would never assume that we don't have this already covered, but I think some of those higher level things from a strategic perspective around cybersecurity would be really important.

[00:59:01] Like what happens and what are the plans? Should something happen? How do we communicate that out if we can't communicate it out? You know, like what's the plan? What's the strategy? So part of it would be that. And then I know there's obviously more things you'd want to get into, but I think for me, from that perspective, I think those are the kind of things that would be really interesting.

[00:59:21] I don't necessarily feel like I would care for us to get into the weeds in any one of these areas because we have people that are really good at doing what they do. So I don't know. Can you give us an example of what a cybersecurity audit looks like and similarly situated in the school context?

[00:59:41] Yes. So things that we can look at is do we have an incident response plan? Are roles and responsibilities assigned properly? Do individuals know their roles? Security awareness. Are individuals aware of their responsibilities with their devices?

[01:00:00] A portion would be third-party risk, which we've already done an audit in that area. Insurance and contractual readiness. So when we contract with our vendors, are there certain, are there pertinent clauses in those audits, or not audits, those contracts that protect us and our assets?

[01:00:16] Staffing capacity. Does DDI have the capacity to fulfill their cybersecurity duties or their IT duties? So do they need more FTEs? It's identifying those areas. Governance and strategy. What is our strategy position on cybersecurity attacks?

[01:00:32] So policies, SOPs, documents, roles, responsibilities are things we cannot look at. But when you're looking at some of the more technical expertise level areas of IT, then no, we can't.

[01:00:48] But we can look at the risk management process. There's one thing we do here is risk management or risk assessment. we can look at that we can look at controls and talent management so are we hiring the right people do they do they have the requisite requirements to do their duties do they have the requisite certificates to do their duties are they continuing to learn in their environment IT is always updating at a rapid pace are they continuing to learn do we have the do they have the resources that grant them the proper training on a continual basis and so I think cyber security

[01:01:25] management goes far beyond just a cyber security IT technical requirement it covers far more than that it's the governance framework in which we operate under here in LCPS. Thank you Mr. Woods you listed a number of possible topics that would fall under a cyber security at this point do you have a sense of what specifically you would want to look into with a cybersecurity audit or would

[01:01:57] that come later? We have it now. And so one thing I want to say is this is now a topical requirement by IA and try to explain what that means. And if there is an audit that is approved that falls under IA's topical requirement, there are certain things that we have to do under that audit. They provide guidance on and so they are fully aware that we are not the IT experts that would fall under auditors under ISACA what they provide us is a framework to perform audits knowing full well

[01:02:34] we're not IT auditors or IT experts so we do have a package to perform the audits and again there's three main areas one is risk governance the other one is training I can give you the specifics too because I have that as well.

[01:02:52] And so we do have the guidance and we do have requirements to perform these audits. And I think a lot of times when we are performing these audits, it's that we're going to do all of these areas of testing. And when we get into it, a lot of the testing and scope can be dwindled down by things we are already doing here that we can say we are already documented.

[01:03:14] The incident response plan, documented. Roles and responsibilities are assigned properly, documented. Individuals are assigned and monitored, their devices monitored. And so when we get into testing, we already have those things documented in the planning to say they're adequately doing these things and we don't need to test them.

[01:03:34] So we would identify that in the planning phase. A lot of those things we won't know until we actually do the planning phase. But I can tell you we already have information that DDI has provided. They provided an incident plan when I first started that I asked for, and they provided one today.

[01:03:50] I would take the incident response plans and compare to see if there's been any updates over the years and if there's been updates. That's a clear demonstration that they regularly review that response plan and that they're working on those areas. We could just say, hey, check. They're doing what they're supposed to. We move on to the next item.

[01:04:07] That item doesn't need to go into a long testing process. And so those are things we can do. Thank you, Mr. Woods. That's very helpful. Mr. Pepper? Mr. Cardi?

[01:04:23] Thank you. So, you know, I think one of the things that was also really interesting at the school board meeting where you did the presentation after we made this final selection was that there were some pieces of information that I wasn't aware of that came to light during that meeting.

[01:04:39] And so I think, and one example of that was the federal grant audits that are happening in that whole process. I think that in the process of doing this, as the committee comes to their selection, Or actually, I think the step before us coming to the selection would be, this is the down selection of the 13 items.

[01:05:04] Of these 13 items, where are we already internally doing some sort of internal audit anyway so that we're aware of it? Because right now, I think I would rather, depending on the topic, I guess, but I think I would rather be strategic about picking ones that don't have any internal audit mechanism in them currently before I'd pick stuff that does.

[01:05:29] But if I'm not aware that they're, I mean, I wouldn't know in many cases what's being audited or not. I think gathering that information before we get to the final selection after the down selection, I think in that window would be really helpful to get that kind of information.

[01:05:45] It might also be a really good opportunity at that point, and maybe we did, have that conversation with the full board to say, look, this is the 13. Did we do that in the timeline, or did we do the presentation after we selected? Okay, I think it'd be really great after we down selected the 13, having the conversation with the board at that point to say these are the topics and have even the board come back with some selection process perhaps to help us get to, because also we heard from the dais that there were plenty of people on the board that were uncertain about the process of having the final vote on this.

[01:06:22] Well, just to clarify that point, when audit was part of LA and P, the process was LA and P approved the audit plan, and then it was presented to the board after already having been approved by the committee.

[01:06:37] So I believed that the intent when we stood up audit as an independent standalone committee was to keep that same process in place, i.e. to have the committee approve the audit plan and then present it to the board, not to have the board as a whole vote on the audit plan.

[01:06:56] which is not to say they can't have input obviously they can contact us they can contact mr woods they can come to the committee meetings i'm i we welcome and i'm sure mr wood mr woods welcomes the input from from other board members as well but i i my understanding and certainly my intent was was that the intent was just to remain with the same process mr woods it was also the sequential order of events we updated the policy 3410 we couldn't update policy 3 2310 to have an

[01:07:30] audit committee until we updated 3410 and so we updated 3410 first and then we updated 2310 we did not go back and update 3410 to align with 30 2310 and so our policy oag 3410 could not have ever put in things or requirements into the policy that just didn't exist and they didn't exist because policy 2310 just didn't exist.

[01:07:55] And so when it was pointing out on the board, it was just identifying that the sequential order didn't align with the current policy. And so now we have to go back and update 3410 to align with 2310 on a section that just didn't exist when we last updated 3410.

[01:08:16] To your point, Ms. McCarty's, about the other audits related, the external audits related to Mr. Woods' proposed audit topic, We do have Ms. Willoughby here. Ms. Willoughby, I was wondering if you could review for us what external audits LCPS is currently subject to from what authorities vis-a-vis the proposed audit topic in the audit plan.

[01:08:54] I'd be happy to. Thank you. And some of this you will have heard during the school board meeting. But just to reiterate, our federal grant, any of our federal funds, not even just our grants because our school nutrition is funded through federal funds, goes through a process of a very extensive process where there's a pre-approval where you're having to submit how you plan to use these funds, what the specific plan is during the year.

[01:09:23] Some of those plans require coming to the school board for approval also. Some do not. And then once those are approved, then there's active monitoring during the year. VDOE is our go-between for all federal funds. We do not receive, except for maybe a few handfuls, I mean very small dollar amounts, all go through VDOE.

[01:09:47] They have oversight and administration responsibility. So that pre-approval process goes to VDOE for their review and approval, and then it goes into a management and oversight during the year. That during the year is also very extensive.

[01:10:04] They have a whole process and system actually called their Omega system where there's a lot of information going back and forth to help identify early on, hey, there may be an issue here before we actually close this out with the federal government. We want to make sure, you know, we're all on the same page.

[01:10:22] So that occurs during the year, And then there's the actual final closeout. VDOE does their own fiscal monitoring audits. They have a cycle that they publish when they rotate through those. In addition to that, our financials are, as you know, audited by our external auditing firm annually.

[01:10:45] And then thirdly, the federal funds are subject to the Federal Single Audit Act, which is required for those certain funds, and that is performed by another auditing firm.

[01:11:02] So there's multiple layers of monitoring, compliance, and auditing, which is also another area where we felt that it was perhaps duplicative to have an internal audit review. Thank you, Ms. Willoughby.

[01:11:20] Again, to me, I wanted to contextualize what for me I think is another aspect that would make this process more accessible next time around, which is if we had known when we were selecting the audit plan that there were these other audits, external audits going on.

[01:11:40] Not to say I wouldn't support an audit, but it would have been helpful to have a live discussion, I think, about how they would interact with each other. Because I don't want to waste the time of anyone on the staff by going through duplicative efforts.

[01:11:56] But that being said, there is a reason that we have oversight. And maybe there is a need to make sure that the external audits that are being conducted are accurate. Because if they're not, then that's harmful to us. I can see the validity of that position. but so maybe maybe part of improving the process going forward is when you put together an audit universe possibly if it's possible to circulate it among cabinet or senior staff and get some amount of staff feedback before we actually vote on an audit plan so that we can weigh the value and the other

[01:12:36] metrics of how are we going to prioritize what we think should go into the plan I would just say that totally agree also that anything we would perform would be complementary to those audits we are again looking at broader management controls single audits are

[01:13:12] looking at particular compliance and reporting usually over major grants because again they're doing a risk assessment like we do a risk assessment and so we're not looking always at a particular grant we're also looking at internal governance which is something I'm not too sure that the single audit does but I would totally I would 100% agree that these conferences these conversations do help us because we also have limited resources and if the area still has some

[01:13:49] level of risk because everything has a level of risk is it high enough for us to perform that engagement. Ms. McCurdy. Thank you, Madam Chair. So as you're going through and building out these, kind of as the next steps for this process, and you're building out the plans for these four, I'm assuming then you're working with the cabinet level member who's oversees these things and trying to gather some information as you're defining the project a bit more or the audit a

[01:14:27] bit more. So what will happen? Ask that question first. Yeah. Yeah. So I'll tell you what happens is so we'll start an audit get into the audit we'll have an entrance conference but then we'll have walkthroughs where we will have the process owners walk us through their process that we are auditing to gain an understanding because again we are not the expert in their requisite area so we're relying on those process owners to walk us through and so they do fall under cabinet

[01:15:01] members controls but the individual performing those processes could come at the director level and lower and so they really walk us through that process and at that time we learn what areas we need to do further testing on also it's at that time where we say okay this may have been a risk but it's adequately there's adequate control framework in in that place and so 13 risks now goes to 12 and continue that process with other processes can go lower until we get to a point

[01:15:38] where there's risks that we say okay this one or this area let's go ahead and do further testing to back up what we learned the process owner does to what the actual process is in practice and so in the beginning we don't know what we don't know we are using professional judgment to develop those risk control matrix is and then we ask the process owners to educate us and then we ask questions and start to poke holes so to speak and also look at their control. Also one of the controls or one of

[01:16:15] the governance things is what level of expertise does this individual have? Are they newly appointed to their position and have limited LCPS knowledge or has this individual been there for several years and has more capacity to understand the LCPS environment those are things we can all find out after the audit starts and those are all different levels of review that do matter hope that answered your question but we really don't know until we start the audit what we're

[01:16:49] going to do further testing on the last I believe the last slide was next steps not to rush anyone but it is 620 be real quick uh next steps is one where i'll just take the information

[01:17:22] shared today uh and for the fiscal year 28 planning apply those practices uh and hopefully to enhance this process um in november the reason i identify november is because every january it's my understanding that we shuffle committees and so it was the time to give the current committee as it stands, the opportunity to revisit the annual plan that they approved to see if there was any updates that they want to do.

[01:17:54] And based on this conversation, there might be items that we can remove or add in November. So that's why November was identified for that capacity checkpoint. And again, the December mid-year assessment is really the action item to November's meeting.

[01:18:12] So whatever we identify in November that we want to do has to be an information item, followed by an action item, and that would be December. Lastly, we would take everything we learned today in this conversation and apply it next year when 2028 planning begins.

[01:18:28] Thank you. Ms. Riccardi. So I think, number one, I appreciate the work that you're doing. I think that as we're going into not only these topics, but in the out years, additional topics, I think one of the things that happens internally with staff is that it's a stressful kind of thing, or they could view it as a stressful kind of thing.

[01:18:58] But I think the way I would want to frame this is that this is an opportunity for us to celebrate the good work that we're doing internally from a risk perspective and all the things that are happening in all of our different departments that's working well and identify potentially areas where we just need to tighten things up.

[01:19:18] And in some cases, it might even be that it's an opportunity to identify areas that maybe nobody's ever thought about before and maybe rethink how we're doing things from a risk perspective. So I'm going to guess that the majority of these are going to come back with a lot of, you know, we're doing a lot of things here really, really well from a risk perspective.

[01:19:40] And there may be some things that need to get tightened up or even just identified. But I'm not looking at these in any kind of negative way. I think it's just a great way for a large organization to be able to provide just a wiser approach to risk management.

[01:19:58] And it helps us, from a board perspective, understand what that risk universe looks like for the organization as a whole. So I appreciate the work that all of you are doing in this area. Thank you. So I am not opposed to revisiting in November.

[01:20:20] I would request that my colleagues put some thought between now and our October meeting into, you know, where are your thoughts about changing up the audit plan, and if you have questions or want more information, if we can try to get those to Mr. Woods in advance of the October meeting so that we can discuss potentially.

[01:20:46] But otherwise, I think that's a good plan for right now. I think we are through this information item. I forgot to say at the beginning of the meeting that this meeting is being audio recorded, not video recorded, but it is being audio recorded and will be available on the LCPS website later on.

[01:21:09] We'll move on now to item number five, which is new business. Does anyone have any new business? We are also scheduled to have a closed session. Mr. Woods, seeing the time, do you still want to proceed with the closed session today?

[01:21:25] We can do it at the next audit committee meeting and still be within the LCPS timelines. Many members, do you have a preference as to whether we address this in October or finish now? Our October meeting is October 8th because our normal day would be October 1st, and that is my 15th wedding anniversary.

[01:21:46] And as fond as I am of all y'all, I would like to do something with my spouse that is not being here. I guess the question I would have, not about the October 1st date.

[01:22:03] I'm fine with the October 8th date. What does the remainder of our agenda look like? at the october mean do we have a concept of how meaty the other topics are going to be knowing that we've been here about an hour and a half already yes so off the top it would be the closed session um one audit will be presented with the potential for two audits uh that were completed so we just give a debrief on the audits uh they're finding recommendations management

[01:22:35] action plans um and so two audits on the agenda and then a follow-up to this conversation so it's the follow-up to this conversation that poses the lengthiest conversation i in that case i'm going to make an executive decision that we are going to um punt the closed session to our october meeting uh and that brings us to item number seven which is adjournment uh our next meeting will be

[01:23:15] October 8th at 5 p.m. Thank you everyone for being here and get home safely.

----------------------------------------------------------------------
Coraggio Consulting · aguyonx.com