Evaluating Access Controls of School District Accounting Systems [September 2025]

Of the 20 districts we reviewed, only some had adequate access controls for their accounting systems, and very few had adequate written policies. School districts use accounting systems to manage their expenses and report on their financial information. It’s critical that school districts protect their accounting systems against unauthorized access. School districts are not required to follow the state’s IT security policies. We compiled a set of IT security and accounting best practices to evaluate school districts’ access controls for accounting systems. We reviewed accounting system access control policies and practices for 20 judgmentally selected school districts across Kansas. None of the 20 districts we reviewed had adequate IT security access control practices in all 3 categories we evaluated. Almost all school districts we reviewed (19 of 20) lacked all expected account management control practices within their accounting systems. Most school districts we reviewed (16 of 20) also did not have all expected identity management practices in place within their accounting systems. About half of the school districts we reviewed (11 of 20) had all expected controls in place to limit user access to their accounting systems, and most school districts had at least 4 of the 5 controls we reviewed. Finally, very few of the 20 districts we reviewed had adequate written policies related to any access controls for their accounting systems. Smaller school districts tended to lack more access controls for their accounting systems, but all districts could benefit from formalized policies. KSDE told us that districts have been moving to computerized systems quickly, and it was not surprising that districts have very few policies.