The Rundown with Kansas Legislative Division of Post Audit

Legislative Post Audit

The Rundown is your source for news and updates from the Kansas Legislative Division of Post Audit including conversations with staff discussing the findings of performance audits released to the Kansas Legislature.

  1. 2D AGO

    2-Year Summary of Security Controls in Selected State and Local Entities (2024-2025) [February 2026]

    We completed 15 audits on 13 state agencies, 1 school district, and 1 city between CY 2024 and CY 2025. This summary report shows 7 of the 15 entities did not substantially comply with applicable IT security standards and best practices. Entities struggled with properly scanning and patching their computers. Entities also had compliance problems because they did not create, maintain, or test continuity of operations and disaster recovery plans, as well as incident response plans. Other significant issues included poor security awareness training or failed social engineering tests. More than half the entities had significant management process weaknesses, including inadequate asset inventories, contract issues, or lacking a designated information security officer. Additional security weaknesses included inadequate network, boundary, and data protection processes. We also noted some entities did not adequately protect their electronic backup data. Some entities had poor access or environmental controls for their data centers, and a few entities had inadequate account security control. Lastly, we identified significant security issues within entities' specific IT systems. The findings in this report are similar to those in previous summary IT reports. The main reasons for compliance problems across the 15 entities included insufficient top management attention, inadequate resources, and poor contractor administration.

    13 min
  2. JAN 21

    Reviewing Supplemental Nutrition Assistance Program Payment Error Rates and Benefit Card Transactions, Part 1 [January 2026]

    DCF’s payment error rate exceeded federal standards in fiscal years 2023 and 2024 for multiple reasons including high staff turnover, the complexity of the SNAP eligibility rules, and inconsistent verification efforts. The Supplemental Nutrition Assistance Program (SNAP) is a federal program that provides monthly funds to low-income families to buy food. Individuals must submit an application and provide extensive financial and other information to the Department for Children and Families (DCF) to qualify for SNAP benefits. DCF takes several steps to process and verify each application. The SNAP benefit eligibility determination is complex, and errors can occur at many points. The federal government monitors states’ SNAP benefit payments to ensure accuracy. DCF’s SNAP payment error rate has exceeded the federal payment error rate threshold of 6% since 2019. In the 2 years we reviewed, most of the nearly 300 errors that contributed to the payment error rate were related to miscalculating an applicant’s income and resources. Staff turnover, the complexity of SNAP eligibility rules, and inconsistent verification efforts appear to be significant factors in the department’s SNAP payment errors. DCF told us modifications to KEES might reduce SNAP payment errors but it’s unclear how much impact additional actions might have. Across the 2 years we reviewed, we identified several hundred additional errors that were not included in the federal payment error rate because the dollar value of the error was less than the federal reporting threshold. Last, changes in federal law could result in the state paying for a larger share of SNAP costs.

    14 min
  3. 11/10/2025

    Reviewing Counties' Costs and Obligations to Meet State Requirements [November 2025]

    We estimate the 3 counties we reviewed spent $28.8 million providing a selection of 3 services in fiscal year 2024, which was partially offset by $9.7 million in state, federal, and user fee funding. State law requires counties to provide a variety of core services, such as election administration, law enforcement, and motor vehicle registration. Counties are primarily funded by local tax revenue, and they generally use this revenue to cover the costs of providing the services state law requires. We selected 3 core services and 3 counties to review. The services included criminal prosecution, motor vehicle registration, and ad valorem tax collection. The counties included Gove, Johnson, and Labette counties. We worked closely with county officials to determine how much the 3 counties spent to provide the 3 core services during fiscal year 2024. In total, we estimate the 3 counties we reviewed spent $17.3 million on criminal prosecution in fiscal year 2024, which was slightly offset with $846,000 in grants and user fees. In total, we estimate the 3 counties we reviewed spent $8.3 million providing motor vehicle registration services in 2024, which was partially offset by $5.0 million in user fees. In total, we estimate the 3 counties spent $3.2 million collecting ad valorem taxes in fiscal year 2024, which was fully offset by $3.9 million in user fees and fines. The 3 counties’ costs for the 3 services we reviewed were generally related to meeting requirements in state law. We estimate it would cost the state $19.1 million to cover the 3 counties’ fiscal year 2024 costs for the services we reviewed, but this likely isn’t consistent each year. Officials from the 3 counties we reviewed told us state process improvements would be more helpful than additional state funding. Other estimates for counties’ motor vehicle registration service costs used reasonable methods but differed from ours because we had more detailed and updated data.

    19 min
  4. 09/16/2025

    Evaluating Access Controls of School District Accounting Systems [September 2025]

    Of the 20 districts we reviewed, only some had adequate access controls for their accounting systems, and very few had adequate written policies. School districts use accounting systems to manage their expenses and report on their financial information. It’s critical that school districts protect their accounting systems against unauthorized access. School districts are not required to follow the state’s IT security policies. We compiled a set of IT security and accounting best practices to evaluate school districts’ access controls for accounting systems. We reviewed accounting system access control policies and practices for 20 judgmentally selected school districts across Kansas. None of the 20 districts we reviewed had adequate IT security access control practices in all 3 categories we evaluated. Almost all school districts we reviewed (19 of 20) lacked all expected account management control practices within their accounting systems. Most school districts we reviewed (16 of 20) also did not have all expected identity management practices in place within their accounting systems. About half of the school districts we reviewed (11 of 20) had all expected controls in place to limit user access to their accounting systems, and most school districts had at least 4 of the 5 controls we reviewed. Finally, very few of the 20 districts we reviewed had adequate written policies related to any access controls for their accounting systems. Smaller school districts tended to lack more access controls for their accounting systems, but all districts could benefit from formalized policies. KSDE told us that districts have been moving to computerized systems quickly, and it was not surprising that districts have very few policies.

    18 min

Ratings & Reviews

5
out of 5
3 Ratings

About

The Rundown is your source for news and updates from the Kansas Legislative Division of Post Audit including conversations with staff discussing the findings of performance audits released to the Kansas Legislature.