The Board increased the tax levy from $6.3 million in 2016-17 to over $6.6 million in 2019-20 and planned to use fund balance each year as a financing source. However, because the District experienced surpluses in two of the last three years, only $282,107 of the over $1.9 million appropriated was used and the surplus fund balance increased to more than $1.4 million by the end of 2018-19. Had officials maintained the same tax levy as in 2016-17 through 2018-19, taxpayers may potentially have realized approximately $319,000 in cumulative savings and the District still would not have used all of the fund balance that was appropriated. As of June 30, 2019, surplus fund balance totaled over $1.4 million, exceeding the statutory limit by approximately $590,000 or 2.7 percentage points. When unused appropriated fund balance was added back to the surplus fund balance, it totaled over $2.1 million, exceeding the statutory limit by approximately $1.3 million or 6 percentage points.

District officials did not implement procedures governing Extra-Classroom Activities (ECA) fund operations. As a result, the central treasurer and faculty advisers were not provided with guidance to properly account for and oversee ECA clubs. We reviewed the records and activities of 13 of the District's 59 ECA clubs. We found that 15 of 113 disbursements totaling $44,166 did not have disbursing orders that included the two required authorizing signatures. One of the disbursing orders totaling $15,700 lacked itemized receipts. In addition, 10 checks totaling $5,100 were written for petty cash use. The check amounts ranged from $300 to $900 which were all over the $100 limit established by the New York State Education Department (SED).

The Board did not adopt information technology (IT) security policies and procedures addressing key IT security issues, such as those related to acceptable use, online banking, password security use of and access to personal private and sensitive information (PPSI), and breach notification. The Board did not enter into a written agreement with the IT vendor for services provided to the Village. The Board also did not provide IT security awareness training to employees.

District officials did not establish written procedures for password management, wireless security, remote access and managing user access rights. District officials also did not adequately manage user accounts and permissions for the District's network, user computers and SMS servers. As a result, the District had unneeded network accounts that had not been disabled. Additionally, some District employees had excessive administrative rights to the network and user computers. Finally, officials did not develop a written disaster recovery plan.

College officials have developed a comprehensive, written travel authorization and reimbursement policy. However, the policy does not reflect the actual practices used by the College. For example, it does not specify the use of United States General Services Administration (GSA) rates for meals, yet these rates were implied in the policy and used in practice. Additionally, the policy did not provide guidance on the maximum reimbursement rates for lodging, but instead allowed for actual expenses. The College could have saved $18,135 on 76 lodging claims by using the GSA per diem rates. In addition, a credit card company was allowed to directly withdraw 18 payments totaling approximately $4 million from the College's bank account. Finally, a travel agent who is not an employee uses a College credit card to automatically charge fees.

The Supervisor was in office from January 1, 2002 through December 31, 2017. Among other duties, he was responsible for developing the tentative budgets, maintaining the accounting records and processing payroll. His wife was employed by the Town as the bookkeeper to assist with the payroll and recordkeeping duties and various other human resource and administrative functions. Effective March 31, 2015, the bookkeeper retired from the Town and subsequently began receiving a pension from the New York State and Local Retirement System. After the bookkeeper's retirement, she served as the Supervisor's secretary and continued to assist with fiscal and administrative duties, but to a lesser extent than before retiring and the Supervisor reduced her salary and began paying himself an additional salary for bookkeeper services. The Board did not adopt a resolution for the change in salaries and no notice was given to the public. The Supervisor re-allocated and collected additional salaries for bookkeeping duties totaling $73,794 from April 2015 through August 2017 without Board authorization. In August 2017, he reimbursed the Town for these extra payments and the Town paid $58,858 to the Supervisor's wife for services she provided during this period. In addition, the Board did not authorize salaries paid to officers and employees totaling $145,671 or certain health insurance benefits provided by the Town.

Of the 252 granted exemptions we reviewed totaling approximately $7.3 million of assessed value, 97 exemptions (38 percent), valued at approximately $2.4 million in assessed value, lacked one or more pieces of supporting documentation to verify their eligibility and/or were incorrectly granted or calculated. In addition, 10 agricultural building exemptions lacked supporting documentation necessary for the Assessors to determine that the building was essential to the operation of a bona fide agricultural or horticultural production carried on for profit. Finally, the Assessors did not review the exemptions calculated by the Real Property Tax System (RPTS) after they were entered by the clerk, allowing errors in the calculation of these exemptions to go undetected.

A Board member had a prohibited interest in the contracts between the Town and his machining company. During our audit period, the Town made seven purchases from the machining company totaling $3,029. In addition, the Clerk performs all cash receipts duties, including billing for water and sewer rents, receiving cash, recording transactions, depositing money and reconciling her bank account, without sufficient oversight. There is no routine review of cash receipts activity by someone independent of the collections process. Furthermore, the Board did not review and approve the list of unpaid water and sewer accounts to be relevied.

Although we did not find any significant errors in how cash receipts and disbursements were recorded and reported, we identified weaknesses. For example, the Board did not require pre-numbered duplicate receipts or cancelled checks to facilitate the review of accounting records and reports. In addition, controls over receipts and disbursements would be strengthened by adding mitigating controls. Finally, a privately contracted payroll vendor has access to the Yates County Industrial Development Agency's bank account to withdraw funds for payroll and processing fees.

The Board's reserve fund policy, dated August 2017, requires “an analysis of projected needs of the reserves in the upcoming fiscal year and a recommendation regarding funding those projected needs.” However, the District did not perform this analysis. As of June 30, 2018, the District had eight reserves, totaling approximately $9.1 million or 24 percent of 2018-19 budgetary appropriations. Subsequently, during our audit fieldwork in 2018-19 the District reduced two of these reserves by a total of $1.7 million. After this reduction, the same eight reserves totaled $7.4 million. Because the Board and District officials did not prepare or provide an annual analysis as the policy requires, they could not demonstrate the need to restrict funds at these levels in four reserves with balances totaling $2.7 million. The remaining four reserves were reasonably funded.

City officials did not develop adequate information technology (IT) policies or procedures. For example, although the City's employee manual requires City-owned computers and email accounts to be used for appropriate business purposes only, officials did not develop adequate written City-wide IT policies or procedures for acceptable computer use. In addition, City officials have not developed comprehensive written procedures for managing system access for the City's 240 user accounts. We found that 70 user accounts have not been used in the last six months, 19 of these accounts were never used and one account was last used to logon to the network more than nine years ago. City officials also have not developed a disaster recovery plan or provided users with IT security awareness training to help ensure they understand IT security measures. Finally, financial application users had excessive permissions.

The Board and District officials could have improved their management of the 2016 capital project (Project). From February 2017 through February 2019, the District paid over $3 million for the Project's professional services. Of that amount, nearly $2.1 million went toward architectural services and $886,000 for construction management services. The District did not comply with its procurement policy for these services. We also found District officials did not always obtain competitive pricing or obtain alternative proposals or quotations for Project purchases. In addition, the Board did not always approve change orders. Finally, monthly financial reporting to the Board did not include all Project costs.

The Tax Collector did not maintain complete, accurate and timely records. In addition, the Board and District officials did not provide sufficient oversight of the tax collection process. While the Board adopted a written policy governing and describing the Collector's duties, the current Collector indicated that she was not aware of it. Furthermore, the District did not have written day-to-day tax collection procedures which could have assisted the Collector with performing her duties. The Treasurer did not perform a timely reconciliation of tax collection activities, resulting in undetected errors totaling approximately $3,900.

The Board failed to implement proper internal controls and the former Clerk-Treasurer did not adequately perform her duties. As a result, during our audit period, the former Clerk-Treasurer received inappropriate payments totaling $8,828. This matter has been referred to the Schoharie County District Attorney's Office. Furthermore, the financial records maintained by the former Clerk-Treasurer were significantly deficient; the CPA issued a disclaimer of opinion and we were unable to determine whether all water, sewer and refuse receipts were deposited. The former Clerk-Treasurer also did not calculate health insurance benefits in accordance with the employee handbook. Finally, the former Mayor was aware of some of these deficiencies, but did not inform the Board.

Our follow-up review was limited to interviews with District personnel and inspection of certain documents related to the issues identified in our report. Based on our limited procedures, it appears that the District has made minimal progress implementing corrective action. Of the nine audit recommendations, two recommendations were implemented, two recommendations were partially implemented and five recommendations were not implemented.

Due to the District's well-designed system of internal controls, we designed our testing to determine whether the District's control procedures were consistently followed. We reviewed 82 claims totaling $560,008 of the $4.5 million (12 percent) claims paid during our audit period. We found that for the claims reviewed, procedures were followed and these claims were adequately documented, for appropriate purposes and properly audited and approved before payment. District officials implemented well-designed internal controls over the claims audit process. There were no recommendations as a result of this audit.

Because the Board did not adopt realistic budgets, the sewer fund incurred operating deficits and a decline in its overall financial health. The Board overestimated revenues by $379,000 in fiscal years 2014-15 through 2018-19, resulting in net operating deficits in the sewer fund totaling $144,000. The Board also did not annually review contractual revenues, resulting in potential unrealized revenue totaling approximately $295,000. Finally, the Board did not document a basis for, or adequately monitor, shared service costs, resulting in possible sewer fund inequities. However, with rate increases in effect and the adoption of more realistic revenue estimates in 2018-19 and 2019-20, there has been marked improvement.

We conducted an audit of the Town of Carroll (Town) to assess the maintenance of the Supervisor's records and reports and the Justice Court operations of the Town. As a result of our audit, we issued a report in March 2014, identifying certain conditions and opportunities for Town management's review and consideration. To further our policy of providing assistance to local governments, we revisited the Town in October 2019 to review progress in implementing our recommendations. Our follow-up review was limited to interviews with Town personnel and inspection of certain documents related to the issues identified in our report. We limited our review to the Supervisor's records and reports section of our audit. Based on our limited procedures, it appears that the Town has made some progress implementing corrective action. Of the four audit recommendations, three recommendations were partially implemented and one recommendation was not implemented.

District officials did not develop procedures for managing, limiting and monitoring user accounts and securing personal, private and sensitive information (PPSI). We reviewed all of the District's 395 non-student accounts and found 14 accounts (4 percent) had not been used in at least one year and were not associated with current employees. In addition, 65 accounts (16 percent) were generic accounts and had not been used in at least one year. However, District officials generally maintained proper asset inventory records and provided IT security awareness training for District employees.

The Board could improve its budgeting and management of fund balance and reserves. The Board adopted unrealistic budget estimates, which resulted in operating surpluses, unused appropriated fund balances and increasing fund balances in the general and highway funds. In addition, the Board did not adopt a multiyear financial and capital plan or detailed reserve plan that included the need and optimal funding level for each reserve. We also found that Town department procedures for cash receipts were deficient because officials lacked adequate documentation for cash receipts collected by certain departments, recorded receipts using deficient software programs and did not always deposit receipts timely, or thoroughly reconcile them.