AFTER hearing the shocking
news that Spotsylvania
County Public Schools unwittingly paid a still-unidentified person or persons $600,000 based on a phony invoice, county supervisors and taxpayers were left wondering how such a thing could happen.
Who sent the fake invoice for a partial payment of the $1.2 million owed for synthetic blue turf that was recently installed at Courtland High School’s football field?
How did the criminals manage to create a fake invoice that was apparently indistinguishable from a real one? Did they have any inside help?
And why didn’t any school officials—up to and including Superintendent Scott Baker, who signed off on the $600,000 wire transfer—recognize the scam before they sent the money?
On Aug. 15, the Virginia State Police reported that it “began the cyber investigation Aug. 1, 2019, and has been working with local and state law enforcement in other states in order to track down the fraudulent deposits made into accounts at multiple banks. State Police are still pursuing individuals associated with the scam.”
The Culpeper Field Office of the VSP’s Bureau of Criminal Investigation has recovered $347,010.09 of the stolen money so far, which is being returned to the Spotsylvania Treasurer’s Office. The investigation is continuing, and hopefully the answers to the questions above about this sophisticated multi-state cybercrime will soon be forthcoming—along with the rest of the stolen cash.
The $600,000 theft exposed vulnerabilities in the county’s school system, including the fact that SCPS, whose fiscal 2020 budget is $350.3 million, doesn’t have an internal auditor to monitor internal controls and make sure there are adequate firewalls in place to prevent such a heist.
According to the Institute of Internal Auditors, the mission of an auditor is “to enhance and protect organizational value by providing risk-based and objective assurance, advice, and insight.” Internal audits assess risk and pinpoint flaws in an organization’s accounting, customer service, IT security, disaster recovery and compliance functions. The IIA has recommended that all publicly-traded companies be required to have this additional layer of scrutiny and protection for their shareholders.
Internal auditors should also be required in public bodies that spend hundreds of millions of tax dollars. To eliminate political pressure or conflicts of interest, an internal auditor should be completely independent, and shared with the Spotsylvania County government, which has had theft problems of its own.
Hiring an internal auditor would not, and indeed could not, guarantee the county and its schools won’t ever be the target of a financial crime in the future. But it would reassure taxpayers that Spotsylvania is doing everything in its power to thwart cybercriminals and that procedures are in place to make sure county funds earmarked for education are spent for the purpose intended and that every dollar is accounted for.
With four seats on the Spotsylvania School Board and three on the Board of Supervisors up for grabs in November, including several incumbents seeking reelection, running for reelection in the Chancellor, Courtland, and Livingston Districts, voters should ask candidates if they support hiring an internal auditor.
The only acceptable answer to that question should be a resounding “Yes!”