How State Auditors Track Education Testing Deals and Student Data

When a state signs a multi-million dollar contract with a company to deliver standardised tests, somebody has to check whether the money is spent sensibly and whether student data is handled with care. In New York, that responsibility largely falls to the State Comptroller, an independently elected officer who audits how government agencies spend public funds. Australians will recognise the parallel: each state has an Auditor-General, and the federal Australian National Audit Office reviews departments, including NAPLAN contracts.

Testing companies such as Pearson and Questar have scored contracts worth hundreds of millions of dollars. The details of those deals — what data is collected, who owns it, how long it is retained — rarely make headlines until something goes wrong. Parents in Sydney, Brisbane or Perth often assume that the same scrutiny applied to road construction or hospital procurement also applies to classroom software, but the picture is more complicated.

This piece walks through how a state comptroller fits into the picture, why their audits matter for families, and where Australian parents can look for equivalent oversight closer to home. It also touches on why private schools in New York have chosen a different path.

The Comptroller's Authority and Reach

The New York State Comptroller is the state's chief fiscal officer, elected to a four-year term. The office can audit every state agency, every public authority, and many of the contractors that receive taxpayer money. When the State Education Department signs a deal with a testing vendor, the comptroller can demand the contract, deliverables, data-sharing clauses, and performance reports.

In practice, this means the office can investigate whether a contractor delivered what it promised, whether invoices matched reality, and whether penalties for late or shoddy work were ever applied. Findings are published as public records, and parents or journalists can request copies. The audits regularly surface in education debates at the state capitol.

Australian readers will recognise the structure. The NSW Auditor-General has tabled reports in Macquarie Street reviewing ICT procurements, including systems that hold student records. The Victorian Auditor-General's Office has examined how that state's education department manages vendor risk and digital infrastructure, often highlighting gaps in practice.

Scrutiny of Testing Vendor Contracts

Testing contracts bundle several services: printing, distribution, scoring, reporting, and increasingly, online delivery platforms. Auditors focus on a handful of pressure points that determine whether a contract delivers genuine value.

Common red flags in testing contracts

• Pricing structures that shift sharply after the initial term, locking agencies into renewal costs well above market rates.
• Performance penalties written into the contract but rarely invoked, even when service levels slip.
• Data clauses that let vendors reuse de-identified student responses for research or product development.

When the New York comptroller examines these clauses, the findings can trigger renegotiation, cancellation, or legislative hearings. A similar dynamic played out in Queensland in 2019, when an audit of an online learning platform led to a public rebuke and a vendor change.

Student Records and Privacy Safeguards

Data privacy sits alongside fiscal oversight as the second pillar of the watchdog role. Education departments collect extraordinarily sensitive information: full names, dates of birth, home addresses, free-lunch eligibility, disability status, and behavioural screening results. Once that data enters a vendor's platform, controlling its flow grows harder.

Under New York Education Law §2-d and the federal Family Educational Rights and Privacy Act, contractors are supposed to act as school officials for data-handling purposes. The comptroller checks whether vendors actually comply, whether encryption standards are met, and whether breach notification procedures are workable. A 2020 audit found one vendor had stored assessment data on servers outside the United States.

In Australia, the Privacy Act 1988 and the Australian Privacy Principles create a similar framework, with the Office of the Australian Information Commissioner able to investigate serious breaches. State audits have flagged that school administration systems sometimes lack basic access controls, a concern echoed by privacy advocates from Adelaide to Canberra.

Where Audits Have Changed Policy

An audit report that sits unread on a shelf changes nothing. The most consequential reports spark legislative action, force renegotiation, or shift public sentiment.

In New York, audits into standardised testing in the late 2010s fed the opt-out movement. Lawmakers cited the fiscal findings when questioning why so much money flowed to out-of-state vendors while local districts struggled. The pressure contributed to a reduction in testing time and changes to the contract structure.

Comparable shifts have occurred in Australia. A 2017 audit of ACARA prompted parliamentary scrutiny of NAPLAN, and a later review delayed the move online in several states. Tasmania's experience is telling: after repeated findings about ICT procurement, the state department consolidated its vendor list and tightened its data-sharing protocols.

How Parents Can Stay Engaged

Audits rarely happen by accident. They are usually triggered by a complaint, a whistleblower tip, or a legislative referral. Parents who suspect contracts are being mishandled or student data shared without proper consent have more leverage than they realise.

Practical steps for engaged families

• Write to your state Auditor-General or the New York Comptroller's office if you spot irregularities in testing contracts.
• Request vendor agreements through freedom-of-information channels available in every Australian jurisdiction.
• Attend school council or P&C meetings where data-sharing arrangements are often discussed without fanfare.
• Share findings with local media; journalists frequently rely on tips to pursue audit stories.

The organisation's about us page outlines the broader coalition it is building among parents, teachers and concerned citizens.

A state comptroller's office, or its Australian equivalent, can only audit what it knows to look at. When parents, teachers and concerned citizens pay attention, request documents, and turn up at hearings, the system of checks and balances becomes stronger for everyone in the classroom.