WCPS Audit Reveals $57M in Unpublished Contracts, Oversight Gaps, Cybersecurity Concerns

A recent audit of Washington County Public Schools (WCPS) by the Maryland Office of Legislative Audits uncovered significant weaknesses in financial oversight, procurement compliance, and contract transparency. The findings point to over $57 million in contract awards not publicly disclosed as required, nearly $100 million spent through improperly managed cooperative purchasing agreements, and deficiencies in third-party healthcare and payroll administration.

Covering the period from July 2022 to February 2024, the audit identified multiple areas where WCPS failed to follow established state procurement laws and best practices. Chief among the issues was the district’s failure to publish 78 contract awards—each worth more than $50,000—on eMaryland Marketplace Advantage (eMMA), the state’s required platform for public contract transparency. Instead, WCPS posted award details only on its own website, bypassing state law and reducing public access to critical procurement data. The total value of these unpublished contracts was approximately $57.3 million.

In addition, WCPS had not subjected a recurring $3.6 million nursing services contract to competitive bidding since 2013. The same vendor has been awarded the contract annually, and the district lacked documentation to verify the legitimacy of billed services. For two selected invoices in fiscal year 2023, totaling more than $840,000, the district had not obtained supporting timesheets or assignment reports. While auditors found no discrepancies in a sample of employee records, they concluded that WCPS did not maintain adequate controls to confirm the accuracy of vendor charges.

The audit also exposed longstanding issues with the school system’s use of intergovernmental cooperative purchasing agreements (ICPAs), a method used to streamline procurement by leveraging contracts established by other public entities. Between 2018 and 2023, WCPS spent approximately $94.2 million through 82 such agreements, but did so without required written assessments to demonstrate cost-effectiveness or administrative efficiency. In multiple sampled cases, WCPS failed to conduct cost comparisons, validate contract terms, or ensure the agreements met state bidding standards—steps that are both best practices and legal requirements.

The audit identified multiple critical cybersecurity deficiencies within Washington County Public Schools’ information technology systems. Although specific technical details were redacted from the public report to comply with Maryland law, the findings included issues related to inadequate system monitoring, weak password controls, and insufficient disaster recovery planning. One finding noted substantial gaps in the district’s intrusion detection and malware protection capabilities, which could leave systems vulnerable to unauthorized access or malicious attacks. Another cited the lack of a comprehensive disaster recovery plan, meaning the school system may be unprepared to restore operations after a significant IT failure. A third concerned outdated or poorly maintained database software, increasing the risk of data breaches or system instability. While these vulnerabilities were not disclosed in detail to the public, they were formally shared with WCPS leadership, who agreed with the findings and committed to implementing corrective actions.

Weaknesses in financial oversight extended to payroll processing. WCPS processed $1.2 million in payroll adjustments during fiscal year 2023—covering items like overtime, summer school, and leave payouts—without any independent supervisory review. Although a sample of transactions did not reveal errors, this lapse was flagged as a repeated issue from prior audits dating back over a decade. Previous audit recommendations had called for documented reviews of high-risk transactions, which WCPS had agreed to implement but failed to fully carry out.

Another major area of concern was healthcare benefits administration. WCPS, which is self-insured, contracts with third-party administrators (TPAs) to handle claims related to medical and pharmacy benefits. The audit found that the district had not conducted a claims audit since fiscal year 2018, nor had it regularly reviewed claim data to verify TPA charges or ensure reimbursement for claims exceeding stop-loss insurance thresholds. The 2018 audit of medical claims found a claims accuracy rate below industry standards, and identified over $19,000 in recoverable costs.

In fiscal year 2023 alone, WCPS paid $1.1 million in administrative fees to TPAs, and received $7.3 million in prescription drug rebates. However, it had no process to verify that all rebates due were received or that TPAs met contractual performance guarantees. The audit noted that the district had the contractual right to impose penalties of up to $223,334 annually if TPAs failed to meet service benchmarks, but had never determined whether penalties should be assessed.

The report further highlighted governance issues with WCPS’s affiliated nonprofit foundations, the Barbara Ingram School for the Arts Foundation and the Washington County Public Schools Education Foundation. Despite close operational ties, WCPS lacked memorandums of agreement (MOAs) outlining the foundations’ responsibilities, including fund administration, conflict-of-interest policies, and procurement procedures. The foundations managed assets totaling over $2.1 million but operated without formal oversight mechanisms from the school district.

The audit also noted that the district’s capital projects and transportation operations were appropriately managed, and that its food services program had adjusted well to pandemic-related demands.

In its formal response, WCPS agreed with all recommendations and provided estimated completion dates ranging from early to late 2025. Planned corrective actions include updating procurement policies to incorporate best practices, conducting competitive solicitations for nursing services, enhancing payroll review protocols, and initiating healthcare claims audits. The school system also pledged to execute MOAs with its affiliated foundations to ensure clarity and accountability.

Associated documents for this story are available in our Public Information Archive.

Article by multiple RFHC contributors, based upon information from the Office of Legislative Audits, Maryland General Assembly

---