Collective bargaining agreements (CBAs) are not comprehensive, and payroll and personnel policies are outdated. We reviewed all six CBAs and determined that two had expired. Additionally, the CBAs were not comprehensive because they had multiple memorandum of agreements that were not attached to the contracts. We found that 11 retirees received payments they were not eligible for totaling $27,440 for not participating in the health insurance program. In addition, five received Medicare Part B reimbursements totaling $10,560 that they were not eligible for. Finally, four maintenance workers were paid a total of $26,088 for 168.5 days of accrued leave above the carryover limit without Board approval.

The Town had an acceptable use policy that defined proper procedures for using the Town's IT resources. However, Town officials did not design or implement procedures to monitor compliance with the policy or determine the amount of employees' personal use of Town computers. We found that employees accessed nonbusiness websites although it is prohibited by Town policy. Officials also did not adopt a data classification, breach notification or online banking policy or a written disaster recovery plan. Finally, employees were not provided with IT security awareness training.

District officials did not provide sufficient oversight to ensure that retirees' health insurance contributions were properly billed, collected and deposited. Officials did not adequately segregate duties related to billing, collecting and depositing retirees' health insurance contributions. The Treasurer performed all duties related to billing, collecting and depositing retiree health insurance contributions without any oversight. Also, the Treasurer determines whether a retiree is eligible to receive the District's health insurance at the time of retirement. The Treasurer maintained an electronic spreadsheet listing all retirees by type of coverage (i.e., single or family), which she also used to track retiree health insurance billings and contribution payments. However, officials did not ensure that sufficient documentation was maintained to verify the calculations of certain retirees' contributions.

While the Board adopted an online banking policy, it did not specify which employees are authorized to process transactions. The policy also did not establish a detailed approval process to verify the accuracy and legitimacy of transfer requests. Officials did not adequately segregate online banking duties and ensure that authorized access to online bank accounts was limited. In addition, the District's acceptable use policy and regulations provide detailed guidelines for using District IT assets and explicitly state that IT assets are provided solely for educational purposes and research consistent with the District's missions and goals. However, the District did not provide users with IT security awareness training to help ensure they understood IT security measures. Because officials did not provide IT security awareness training or enforce the District's acceptable use policy prohibiting personal use of District computers, we reviewed the website browsing histories on the Business Administrator's, Treasurer's and payroll clerk's computers and identified questionable personal use on all of these computers.

Town officials did not bill water and sewer charges in accordance with Town ordinances. We found the water ordinance did not provide a clear, consistent and equitable basis for billing property owners. In addition, certain charges stipulated in the water and sewer ordinances did not conform to applicable State law. We reviewed water and sewer billings totaling $82,649 for 70 property owners and identified about $10,339 in charges that were inconsistent with the ordinances. Finally, water meter readings were not always reliable during our audit period, but officials have taken measures to obtain more reliable readings.

The Board did not appoint a Chief Information Officer in charge of and responsible for all IT matters. Instead, the District's IT Department is comprised of four IT Specialists provided by the Nassau Board of Cooperative Education Services (BOCES) and a Secretary that is a District employee. The District's IT Coordinator told us that the District does not maintain a written agreement on file for each staff member indicating that the staff member's computer use will conform to the District's acceptable use policy. The District also did not provide employees and officials with IT security awareness training and the Board did not adopt a disaster recovery plan. Finally, the District does not have a written agreement with BOCES that clearly states the IT services to be provided.

District officials did not limit or monitor employees' personal Internet browsing and their use of social media on District computers. Officials also did not provide IT security awareness training to employees. In addition, officials did not restrict user permissions to the network and the student information system software application (SIS) based on job duties. Finally, District officials did not disable unneeded network and local user accounts.

The City approved $6 million in separation payments to 43 City officers and employees, of which $513,925 in payments to 10 individuals appear inconsistent with the City's code of ordinances (City Code) and/or collective bargaining agreements. In addition, the City approved certain payments for unused leave accruals, totaling $229,494 to eight City officers and employees at a time other than at separation from service. In the absence of specific authorization for such payments, we question the appropriateness of $224,852, or 98 percent of such payments. Finally, the City failed to take adequate corrective action in response to two prior audits that cited leave payments that were inconsistent with the City Code or contractual agreements.

City officials need to improve budgeting practices to effectively manage the City's financial condition. The City's adopted budgets and financial monitoring resulted in annual operating deficits in the general fund that totaled $8.5 million over the last four fiscal years (an average of $2.1 million per year). As a result, total general fund balance decreased 68 percent from $9.9 million at July 1, 2014 to $3.2 million as of June 30, 2018. Approximately $4 million of this fund balance was either restricted for specific purposes or in nonspendable form at the end of the 2017-18 fiscal year, leaving an unassigned fund deficit of $813,994. Over that same period, City officials have continued to make interfund advances from the general fund to the sewer and water funds each year to enable those funds to pay for certain expenditures, such as health insurance, without seeking short-term financing sources. In addition, the Council issued $8 million of bonds from 2014-15 through 2016-17 and used another $2.1 million of fund balance in 2017-18 to finance recurring expenditures, increasing the general fund debt service costs to 12.27 percent of the 2017-18 revenues. Finally, the City Manager has not prepared a multiyear financial plan including a fiscal improvement plan, in accordance with Local Finance Law.

We reviewed the Clerk's 2019 real property tax collections totaling approximately $1.4 million and found that the Clerk did not remit collections to the Supervisor and Treasurer in a timely manner. The Clerk did not remit collections to the Supervisor weekly or to the Treasurer by the 15th of the month as required. Additionally, as of September 5, 2019, the Clerk had not remitted interest and penalties related to tax collections totaling approximately $2,780 to the Supervisor. Finally, the Clerk did not always issue receipts or retain adequate evidence of receipt for tax payments collected or to establish tax payment dates.

The Board authorized fiscal year-end interfund transfers totaling $1.2 million to be used for a capital project which had not yet been approved by District voters. In addition, District officials overestimated appropriations from 2015-16 through 2018-19. We project appropriations were estimated more reasonably in 2019-20 but certain account lines continued to be overestimated. We also found that the unrestricted fund balance ranged between 5.9 and 9.8 percent of the ensuing years' appropriations, exceeding the 4 percent statutory limit. Finally, District officials did not develop, maintain, update and review a formal multiyear capital plan in conjunction with the projects approved by District voters in March 2019.

The Board-adopted purchasing policies were not updated and deficient. We found that all 10 purchase and public works contracts we reviewed totaling approximately $1.1 million were procured in accordance with the District's purchasing policies and statutory requirements. However, of the 15 purchase contracts we reviewed totaling $76,378 that did not exceed the competitive bidding threshold, 11 purchase contracts (73 percent) totaling $56,624 were not procured in accordance with the purchasing policy. In addition, of the services obtained from seven professional service providers, who were paid a combined total of $178,247 during the audit period, the services from six providers, who were paid $163,497, were not procured in accordance with the purchasing policy.

The Department hired a bookkeeper to maintain the accounting records. However, Department officials did not clearly define the responsibilities for this position. The Treasurer did not provide sufficient oversight of the bookkeeper hired to account for the Department's financial transactions. In addition, 44 credit card charges totaling $5,087 were paid without sufficient supporting documentation. Thirty-five check collections totaling $26,751 were not deposited in a timely manner. Finally, the Department's audit committee did not audit the Treasurer's records as required in the bylaws.

Town officials did not adopt adequate policies and implement sufficient procedures to account for the Town's fuel inventory. In addition, officials did not monitor fuel use, which resulted in unaccounted-for fuel of 21,806 gallons of gasoline and diesel valued at $49,278. Finally, officials did not prepare periodic fuel reconciliations. Without the proper controls over fuel inventories in place, there is an increased risk that unleaded gasoline and diesel could have been stolen or misused.

The District has two above-ground fuel tanks, a 5,000 gallon diesel tank and a 1,000 gallon unleaded gasoline tank located at the District's bus garage. The Board did not establish policies to provide reasonable assurance that fuel was used for its intended purpose and properly accounted for. In addition, District officials did not design procedures to ensure fuel use and inventory records were properly maintained and reconciled. District officials also did not ensure that the fuel tanks were properly secured or in working order. In addition, the Transportation Supervisor did not perform fuel reconciliations, and our reconciliations resulted in unaccounted-for fuel totaling $8,034. Officials did not perform stick-measured readings to ensure fuel deliveries were accurate. Finally, while the Board did not enter into written shared service agreements with the Town of Moravia, Village of Moravia or two fire districts that receive fire protection services from the Moravia and Locke Fire Departments, District officials had informal arrangements allowing these entities to use District fuel.

The purchasing policy is outdated and inconsistent with purchasing procedures and is not communicated to all College staff involved in the purchasing process. In addition, the purchasing policy and procedures do not address the solicitation of competition for professional services and insurance. The College also made nearly $1 million of purchases without seeking competition. In addition, we examined 26 purchases totaling $257,635 subject to the College's policy for verbal and written quotes and found that the required number of quotes were not obtained for 20 of the purchases totaling $204,235 (79 percent). Finally, the College did not issue requests for proposals to procure its general liability, crime and commercial insurance coverage totaling $333,199 and services provided by all six of the professional service providers totaling $368,817.

The Justices did not deposit 234 out of 720 fine and fee receipts totaling $31,056 within 72 hours. They also did not prepare monthly accountability reports and bank reconciliations. We reviewed all 48 monthly reports by the current Justices that were submitted to the Justice Court Fund (JCF) during our audit period and determined none were reviewed by the Justices prior to being submitted to JCF. Because the Justices review their monthly report after it has been submitted to JCF and then sign the checks, fines and fees are not always remitted by the 10th of the ensuing month. Finally, the Justices did not forward 34 out of 48 remittances to the Village totaling $523,381 within 10 days of the ensuing month.

The Town lacked adequate procedures to ensure employees' leave accrual records were accurately maintained. We reviewed 15 employees' leave accrual records during the audit period and found that none were accurately maintained. As a result, six employees were paid for 110.5 hours of leave time to which they were not entitled, resulting in overpayments totaling $2,288. We also found that, as of May 31, 2019, the 15 employees' leave accrual balances were overstated by 701.75 hours, valued at $15,253 and understated by 86.5 hours, valued at $1,484. We found that multiple employees were responsible for manually accounting for employees' leave accrual records and/or their own records with limited to no oversight. In addition, officials did not perform independent periodic reviews of employee leave accrual balances to ensure their accuracy.

Although City officials developed informal procedures related to the security of the water system, they did not have any written policies or procedures. There were no policies and procedures to document security roles and responsibilities for employees, vendors and consultants; explain appropriate use of mobile storage devices, such as USB flash drives; or require monitoring and logging of networked and Internet-facing devices. Because there were no written policies and procedures, officials could not ensure employees were aware of or understood what was expected of them in maintaining the security of the water system. In addition, City officials did not provide water system employees with IT security awareness training. The IT cybersecurity community identifies people as the weakest link in the chain to secure data and IT systems. Officials cannot protect the confidentiality, integrity and availability of data and computer systems without ensuring that employees understand their roles and responsibilities related to IT and data security.

The Comptroller did not perform bank reconciliations to ensure cash activity was properly accounted for and did not maintain accurate accounting records. The Board and Supervisor did not develop policies and procedures to ensure that the Town's accounting records and reports were complete, accurate and up-to-date. In addition to the differences between cash in the bank and cash recorded in the accounting records, we found many errors and inaccuracies in the accounting records. Due to deficiencies in the records, the Annual Update Documents, which are the Annual Financial Reports, were not filed on a timely basis. Also, we found a number of instances in which the direct deposit payments reported to the bank did not agree with the supporting payroll records. Finally, the Board did not annually audit the Comptroller's records.