Because the Board did not adopt realistic budgets, the sewer fund incurred operating deficits and a decline in its overall financial health. The Board overestimated revenues by $379,000 in fiscal years 2014-15 through 2018-19, resulting in net operating deficits in the sewer fund totaling $144,000. The Board also did not annually review contractual revenues, resulting in potential unrealized revenue totaling approximately $295,000. Finally, the Board did not document a basis for, or adequately monitor, shared service costs, resulting in possible sewer fund inequities. However, with rate increases in effect and the adoption of more realistic revenue estimates in 2018-19 and 2019-20, there has been marked improvement.

We conducted an audit of the Town of Carroll (Town) to assess the maintenance of the Supervisor's records and reports and the Justice Court operations of the Town. As a result of our audit, we issued a report in March 2014, identifying certain conditions and opportunities for Town management's review and consideration. To further our policy of providing assistance to local governments, we revisited the Town in October 2019 to review progress in implementing our recommendations. Our follow-up review was limited to interviews with Town personnel and inspection of certain documents related to the issues identified in our report. We limited our review to the Supervisor's records and reports section of our audit. Based on our limited procedures, it appears that the Town has made some progress implementing corrective action. Of the four audit recommendations, three recommendations were partially implemented and one recommendation was not implemented.

District officials did not develop procedures for managing, limiting and monitoring user accounts and securing personal, private and sensitive information (PPSI). We reviewed all of the District's 395 non-student accounts and found 14 accounts (4 percent) had not been used in at least one year and were not associated with current employees. In addition, 65 accounts (16 percent) were generic accounts and had not been used in at least one year. However, District officials generally maintained proper asset inventory records and provided IT security awareness training for District employees.

The Board could improve its budgeting and management of fund balance and reserves. The Board adopted unrealistic budget estimates, which resulted in operating surpluses, unused appropriated fund balances and increasing fund balances in the general and highway funds. In addition, the Board did not adopt a multiyear financial and capital plan or detailed reserve plan that included the need and optimal funding level for each reserve. We also found that Town department procedures for cash receipts were deficient because officials lacked adequate documentation for cash receipts collected by certain departments, recorded receipts using deficient software programs and did not always deposit receipts timely, or thoroughly reconcile them.

The Supervisor neither maintained, nor required the bookkeeper to maintain, complete, accurate and up-to-date accounting records and reports. The bookkeeper recorded all check disbursements made from the major operating funds in a timely manner but did not record revenues or electronic disbursements in the Town's accounting software for fiscal year 2018 until September 2018. In addition, the bookkeeper has not recorded revenues received or electronic disbursements made after September 2018 through the end of our audit period in the Town's accounting software. Although the bookkeeper reconciled the Town's six checking accounts to manual check register balances monthly, he did not reconcile the other eight bank accounts due to their low activity. The Board also has not received a monthly Supervisor's report since February 2018. Furthermore, the two monthly reports that were presented to the Board during our audit period (January 2018 and February 2018) did not accurately reflect the Town's financial position then. Finally, the annual update documents (AUDs), which are the annual financial reports, have not been filed for the fiscal years ending December 31, 2017 and 2018.

Collections were not always adequately supported to allow officials to determine whether funds were deposited. We also found that 462 collections paid by checks totaling $84,076 were not deposited in a timely manner. In addition, 12 credit card payments totaling $6,855 were not approved by the Board as required by the bylaws. Finally, the Board did not ensure that the Treasurer's records were annually reviewed, as required by the bylaws, or obtain the statutorily required annual audit.

Officials did not properly manage the District's network and local user accounts to safeguard data from potential abuse and loss. We reviewed all 323 nonstudent network accounts and 10 local user accounts on eight computers assigned to eight District employees to determine whether the accounts were active, assigned to current District employees and had proper user permissions. We found that District officials did not adequately manage user accounts and their user permissions. For example, former employees and an unknown person had active accounts, and administrative permissions were granted to individuals who did not need these rights. In two instances, officials did not know why the users had excessive permissions. In addition, the Board did not establish a disaster recovery plan and officials did not provide IT security awareness training to employees.

The Superintendent purchases, safeguards and disposes of highway assets with minimal Board oversight. The Superintendent maintained an inventory list for some Department assets. However, he did not maintain an inventory for small equipment, implements and tools and did not annually submit an inventory report to the Board, as required. Furthermore, although officials discussed selling equipment at Board meetings, the Superintendent did not always report to the Board when equipment was sold and the Board did not formally approve all asset sales. In addition, officials need to improve procurement procedures. For example, during our audit period, the Town overpaid for fuel by $5,600 because they did not verify that they were paying the State contract price for fuel. Finally, a Board member had a prohibited conflict of interest totaling $4,400.

The Board did not update the procurement policy annually. The Board also did not seek competition for professional services totaling approximately $1.6 million or competitively bid purchase and public works contracts totaling approximately $6.1 million during the audit period. In addition, the Board did not have written agreements with nine professional service providers paid a total of $968,545 during the audit period. Furthermore, claims were audited and approved without proper documentation. Finally, the Director for Technology circumvented the procurement policy and ordered various items online totaling $71,226 during the audit period, including $4,596 for shipping costs.

The Board adopted adequate policies and guidelines for project approval. In addition, payments in lieu of taxes (PILOTs) for four projects and 26 revolving loan payments were accurate and received on time. However, the Board and the Administrator did not properly monitor tax abatement and loan projects. The Board did not require the Administrator to compare reported job creation and retention figures with project goals or track sales tax abatements to ensure that the exemptions taken were within allowable limits.

Town officials did not effectively manage the financial condition of the water and sewer districts. We found officials did not budget accurately nor raise sufficient revenues to fund water and sewer operations, which resulted in five districts incurring unplanned operating deficits annually. In addition, five of the seven water and sewer districts had deficit fund balances ranging from $13,620 to $113,900 as of December 31, 2018. These deficit fund balances ranged from 14 to 217 percent of 2019 budget appropriations. Finally, officials relied on interfund advances to finance operations in the five districts during the past three years. The Board did not approve these advances, which totaled more than $312,000 at the end of 2018.

Collective bargaining agreements (CBAs) are not comprehensive, and payroll and personnel policies are outdated. We reviewed all six CBAs and determined that two had expired. Additionally, the CBAs were not comprehensive because they had multiple memorandum of agreements that were not attached to the contracts. We found that 11 retirees received payments they were not eligible for totaling $27,440 for not participating in the health insurance program. In addition, five received Medicare Part B reimbursements totaling $10,560 that they were not eligible for. Finally, four maintenance workers were paid a total of $26,088 for 168.5 days of accrued leave above the carryover limit without Board approval.

The Town had an acceptable use policy that defined proper procedures for using the Town's IT resources. However, Town officials did not design or implement procedures to monitor compliance with the policy or determine the amount of employees' personal use of Town computers. We found that employees accessed nonbusiness websites although it is prohibited by Town policy. Officials also did not adopt a data classification, breach notification or online banking policy or a written disaster recovery plan. Finally, employees were not provided with IT security awareness training.

District officials did not provide sufficient oversight to ensure that retirees' health insurance contributions were properly billed, collected and deposited. Officials did not adequately segregate duties related to billing, collecting and depositing retirees' health insurance contributions. The Treasurer performed all duties related to billing, collecting and depositing retiree health insurance contributions without any oversight. Also, the Treasurer determines whether a retiree is eligible to receive the District's health insurance at the time of retirement. The Treasurer maintained an electronic spreadsheet listing all retirees by type of coverage (i.e., single or family), which she also used to track retiree health insurance billings and contribution payments. However, officials did not ensure that sufficient documentation was maintained to verify the calculations of certain retirees' contributions.

While the Board adopted an online banking policy, it did not specify which employees are authorized to process transactions. The policy also did not establish a detailed approval process to verify the accuracy and legitimacy of transfer requests. Officials did not adequately segregate online banking duties and ensure that authorized access to online bank accounts was limited. In addition, the District's acceptable use policy and regulations provide detailed guidelines for using District IT assets and explicitly state that IT assets are provided solely for educational purposes and research consistent with the District's missions and goals. However, the District did not provide users with IT security awareness training to help ensure they understood IT security measures. Because officials did not provide IT security awareness training or enforce the District's acceptable use policy prohibiting personal use of District computers, we reviewed the website browsing histories on the Business Administrator's, Treasurer's and payroll clerk's computers and identified questionable personal use on all of these computers.

Town officials did not bill water and sewer charges in accordance with Town ordinances. We found the water ordinance did not provide a clear, consistent and equitable basis for billing property owners. In addition, certain charges stipulated in the water and sewer ordinances did not conform to applicable State law. We reviewed water and sewer billings totaling $82,649 for 70 property owners and identified about $10,339 in charges that were inconsistent with the ordinances. Finally, water meter readings were not always reliable during our audit period, but officials have taken measures to obtain more reliable readings.

The Board did not appoint a Chief Information Officer in charge of and responsible for all IT matters. Instead, the District's IT Department is comprised of four IT Specialists provided by the Nassau Board of Cooperative Education Services (BOCES) and a Secretary that is a District employee. The District's IT Coordinator told us that the District does not maintain a written agreement on file for each staff member indicating that the staff member's computer use will conform to the District's acceptable use policy. The District also did not provide employees and officials with IT security awareness training and the Board did not adopt a disaster recovery plan. Finally, the District does not have a written agreement with BOCES that clearly states the IT services to be provided.

District officials did not limit or monitor employees' personal Internet browsing and their use of social media on District computers. Officials also did not provide IT security awareness training to employees. In addition, officials did not restrict user permissions to the network and the student information system software application (SIS) based on job duties. Finally, District officials did not disable unneeded network and local user accounts.

The City approved $6 million in separation payments to 43 City officers and employees, of which $513,925 in payments to 10 individuals appear inconsistent with the City's code of ordinances (City Code) and/or collective bargaining agreements. In addition, the City approved certain payments for unused leave accruals, totaling $229,494 to eight City officers and employees at a time other than at separation from service. In the absence of specific authorization for such payments, we question the appropriateness of $224,852, or 98 percent of such payments. Finally, the City failed to take adequate corrective action in response to two prior audits that cited leave payments that were inconsistent with the City Code or contractual agreements.

City officials need to improve budgeting practices to effectively manage the City's financial condition. The City's adopted budgets and financial monitoring resulted in annual operating deficits in the general fund that totaled $8.5 million over the last four fiscal years (an average of $2.1 million per year). As a result, total general fund balance decreased 68 percent from $9.9 million at July 1, 2014 to $3.2 million as of June 30, 2018. Approximately $4 million of this fund balance was either restricted for specific purposes or in nonspendable form at the end of the 2017-18 fiscal year, leaving an unassigned fund deficit of $813,994. Over that same period, City officials have continued to make interfund advances from the general fund to the sewer and water funds each year to enable those funds to pay for certain expenditures, such as health insurance, without seeking short-term financing sources. In addition, the Council issued $8 million of bonds from 2014-15 through 2016-17 and used another $2.1 million of fund balance in 2017-18 to finance recurring expenditures, increasing the general fund debt service costs to 12.27 percent of the 2017-18 revenues. Finally, the City Manager has not prepared a multiyear financial plan including a fiscal improvement plan, in accordance with Local Finance Law.