The Town Supervisor did not review and sign 379 checks totaling $375,916 and instead, allowed a County employee to use a stamp to affix his signature to the checks. However, we found that the checks were accurate and for an appropriate Town purpose. In addition, a County employee made 79 bank account transfers using an online banking profile totaling $427,704. Town officials did not monitor check disbursements or bank account transfers. By surrendering on-line banking privileges to a County employee and allowing the same employee to process disbursements exposes the Town to the potential for inappropriate bank transfers and disbursements to be made without being detected. Finally, the Board did not audit or obtain an audit of the Supervisor's records and reports.

District officials circumvented the statutory limit on surplus fund balance by making more than $12 million in unbudgeted year-end transfers to capital projects and reserves, overstating encumbrances by $827,000 and not using $5.3 million in appropriated fund balance as a funding source. We compared appropriations and estimated revenues with actual operating results for 2015-16 through 2017-18 and found that the total budget variance was more than $5 million each year. Revenues were annually underestimated by an average of $2.7 million (2.8 percent). Appropriations were overestimated by an average of $3.1 million (3 percent) each year. Because the Board included unrealistic estimates in its budget, the District generated operating surpluses each year, ranging from $988,000 to $1.8 million. By underestimating revenue and overestimating appropriations, the Board gave taxpayers the impression that it needed to both increase taxes and use appropriated fund balance and reserves to close projected budget gaps. The tax certiorari and unemployment insurance reserves were overfunded by $2.86 million as of June 30, 2018. The Board increased real property taxes by $2.6 million over the last three years despite having sufficient funds to finance the District's increased costs.

District officials provided the administrator and three of four utility vendors direct access to a District multi-fund bank account to disburse payments for services by electronic fund transfers (EFTs) or check. The Treasurer initiated and processed $266,854 in electronic payments to one natural gas vendor through EFTs. However, the third-party administrator (administrator), and three utility vendors, who disbursed $488,545 during the audit period (for dental plan benefits, administrative fees and utilities), had direct access to a District bank account to disburse these funds. In addition, payment of utilities totaling $60,641 and administrative fees totaling $1,144 were made without audit and approval by the claims auditor.

The District reported surplus fund balance at 4 percent in compliance with Real Property Tax Law in 2015-16 through 2017-18. However, this was achieved, in part, by making year-end unbudgeted transfers totaling approximately $2.4 million to reserves to reduce the amount of reported surplus fund balance. Prior to these decisions, year-end surplus fund balance exceeded the allowed fund balance level. In addition, because the District did not use its appropriated fund balance, actual surplus fund balance exceeded the statutory limit. The District further circumvented the statutory limit by maintaining unnecessary or overfunded reserves. We recalculated the District's surplus fund balance, which in total exceeded the statutory fund balance limit by 4 percentage points as of June 30, 2018. In addition, the Board and officials also annually increased school lunch meal prices, despite repeated warnings from its external auditor that the school food service surplus fund balance was excessive. Also, we found that the District had two overfunded general fund reserves with balances totaling more than $1.3 million as of June 30, 2018. Finally, the Board has not adopted a comprehensive written multiyear financial plan to help officials address and plan for the use of fund balance, including reserve funds, and prioritize and plan for future capital needs.

The Board adopted an acceptable use policy that states that computers are to be used for business purposes only. However, officials did not require users to sign the policy, enforce the policy or design and implement procedures to monitor compliance with the policy to determine the amount of employees' personal use. We examined 10 computers to determine whether they were used for nonbusiness purposes and found evidence of personal use on every computer. Although the Board has adopted an acceptable use policy, it did not provide users with IT security awareness training. In addition, the Board has not adopted and implemented a written disaster recovery plan. Finally, we reviewed the computer and server inventory lists maintained by the Town and determined there were a total of 41 computers and servers listed. However, we found that there are 49 computers and servers owned by the Town. We also found that there were incomplete descriptions on the inventory lists.

The District did not consistently comply with Education Law for employee criminal history background checks. Although District officials properly performed fingerprint-supported criminal history background checks on most District employees, some employees were not checked or not checked until after they had begun to work at the District. We tested 157 employees, six of whom had a 12-month gap or longer in District employment, and found that nine employees had not been properly fingerprinted. We tested all nine employees who were not fingerprinted at the time of hire against the State Sex Offender Registry web portal and found no exceptions. We also tested 38 volunteers and verified that all 20 volunteers prior to 2015 were properly Board-approved. We verified that a building principal or the athletic director interviewed and checked the references of 17 of the remaining 18 volunteers. One volunteer coach hired in early 2016 was not interviewed and did not have references checked. We also verified they were all properly Board-approved. We input our sample of volunteers into the District's software and a State Sex Offender Registry web portal and verified they were not listed on State or federal registries.

District officials did not use a request for proposals process or seek competition for three professional service providers paid $220,748. Although the Board adopted a purchase policy that required bidding when purchasing either a single item or group of similar items over $5,000, competitive bidding was not always used. Four vendors were paid $48,816 for goods procured without a competitive bid as required by District policy. Due to the District's inconsistent purchasing policies, officials do not have clear guidelines to follow when making purchases and therefore, officials may not be procuring goods and services as intended by the Board.

District officials obtained parental consent to submit Medicaid claims for reimbursement of services provided to 43 eligible students during 2017-18. We reviewed the records of services provided to 20 of these students (47 percent) and found that claims were not submitted and reimbursed for all eligible services provided. Claims were not submitted and reimbursed for 628 of 2,168 (29 percent) eligible services totaling $24,179 recorded as being provided in the special education system (system). As a result, the District did not realize revenue totaling $12,090. In addition, except for receiving notification of the total amounts of claims submitted for reimbursement by the vendor on the District's behalf, District officials did not receive or review any other documentation of claims submitted for reimbursement. As a result, officials had no way to ensure that claims were submitted for all eligible services provided or any rejected or disallowed claims were resubmitted.

The Treasurer did not accurately record and report Village financial transactions in a timely manner. There was a complete lack of internal controls over the Village's financial activities. The Treasurer collected, recorded and deposited cash, processed payroll, made purchases and prepared abstracts and checks without Board oversight. The Treasurer was solely responsible for calculating and preparing real property tax and water bills; collecting, recording and depositing payments; and making adjustments to water customer accounts. The Treasurer did not always issue press-numbered receipts and did not prepare bank reconciliations or provide monthly reports to the Board that contained sufficient financial information to allow it to effectively perform its oversight duties. Additionally, the Board did not annually perform or provide for an annual audit of the Treasurer's records and financial reports. This lack of oversight allowed the Treasurer to misappropriate Village funds and make questionable payments to herself totaling as much as $4,442.

District officials need to improve budgeting practices to more effectively manage fund balance. The District's reported fund balance has increased significantly over the past three fiscal years and the surplus fund balance was in excess of the statutory limit at fiscal year-ends 2015-16 through 2017-18 by 6.9 to 15.3 percentage points. Appropriations were consistently overestimated which resulted in the increasing fund balance levels and the District not using any of the fund balance it appropriated to finance 2017-18 operations. Finally, the District has not formalized or adopted a multiyear financial and capital plan.

During our audit period, the District disbursed separation payments totaling $286,872 to 13 employees who retired or otherwise left the District. While District officials generally made accurate separation payments, the former Business Manager was overpaid by $16,700. The former Business Manager, who retired on March 31, 2016, incorrectly calculated his separation payment of $86,324 without an independent review. As of September 30, 2018, separation payments made to the former Business Manager had accumulated to $84,063 in accordance with a Board agreement to distribute the separation payment over several fiscal years, beginning before his effective retirement date. The amount paid was $16,700 more than he was eligible for and $64,063 was paid prior to his actual retirement date.

We found that officials did not develop and manage a comprehensive investment program to ensure interest earnings were maximized. For example, during the audit period officials did not prepare any cash flow forecasts to estimate available funds for investment. In addition, as of January 31, 2019, officials had not invested any funds in the financial institution approved by the Board on May 8, 2018. Instead, officials maintained the District's operating funds (except for scholarships and extra-classroom activities) at one financial institution. During the audit period, operating funds were deposited in four interest bearing checking accounts with a monthly interest rate of .1 percent, one certificate of deposit (certificate) with an interest rate of .25 percent and one non-interest bearing checking account. We found that officials could have invested idle operating funds averaging approximately $2.7 million during the audit period in another financial institution with higher available interest rates between .81 percent and 2.28 percent or an average interest rate of 1.5 percent during the audit period. If officials had invested funds in this financial institution, interest earnings would have been increased by $61,162 for the audit period.

We identified 25 professional service providers who were paid a total of $1.2 million during our audit period. District officials did not seek competition for seven professional service providers who were paid $128,205. Officials referred to these providers as proprietary services because they were recommended and used by other school districts. However, the District's procurement policy did not include provisions for the use of certain vendors based on recommendations of other districts. Three of these proprietary service providers who were paid $33,215 have been providing services to the District for between five to 17 years. Although District officials issued request for proposals when selecting three providers who were paid $191,480 during the audit period, they continued obtaining services from these providers for a period of eight to 16 years without seeking competition. These providers were paid for legal, architectural and claims auditing services. We also reviewed documentation for the 25 professional services providers paid during our audit period and found that officials did not have written agreements with four providers who were paid a total of $58,409. These providers included insurance and engineering services.

The Board has not adopted any long-term plans to address replacement of the water and sewer operations' aging infrastructure. The Village's updated 2018 infrastructure study estimated the water infrastructure requires $6.3 million in improvements. The sewer plant was built in the 1950s. A sewer study completed in May 2017 estimated necessary sewer infrastructure costs to be $5 million. During fiscal years 2015-16 through 2017-18, the Board developed water fund budgets to fund a water capital reserve and also start funding a water tower reserve that was established in 2016. Village officials also sought grant assistance from the New York State Environmental Facilities Corporation to help fund the projects. In November 2018, the State awarded $3 million to assist with the Village's water infrastructure improvements and $1.2 million for sewer infrastructure, leaving $7 million to be funded with local funds. The Village's water system covers 322 customers and the sewer system covers 279 customers. Therefore, we estimate that, in the best case scenario, residents having both water and sewer services would see their rates increase initially from a combined $320 per year to about $950 per year to finance the new debt and continuing operational expenses. The Board did not adopt IT policies addressing acceptable use, password security management, remote access, wireless technology, mobile devices and breach notification because it was unaware it should have them. Officials did not assign unique login credentials to each financial application user. The Board and Village officials have not developed, adopted and implemented a disaster recovery plan or formal backup procedures. Finally, the Board did not provide employees with IT security awareness training.

The District obtained parental consent to submit Medicaid claims for reimbursement of services provided to 25 eligible students during 2017-18. We reviewed the records of services provided to all of these students and found that claims were not submitted and reimbursed for all eligible services provided. Claims were not submitted and reimbursed for 517.5 of 1,142 (45 percent) eligible services totaling $21,211 recorded as being provided in the system, resulting in the District not realizing revenue totaling $10,606 (50 percent of the Medicaid reimbursements). In addition, providers did not document all service encounters in the related services logs in the system. We found that 1,769.5 scheduled services totaling $56,998 were not documented as having been provided to these students in 2017-18. Consequently, the District did not submit claims for all eligible services provided. If these services were actually provided to students, the District could have received potential Medicaid reimbursements totaling $56,998 and realized potential revenues of $28,499.

During our audit period, the District did not provide any information technology (IT) security awareness training. The Technology Coordinator told us that the District relied on BOCES to provide updates and information related to IT environments and cybersecurity. However, during our audit period, the District did not use the BOCES web-based IT security awareness training resources. We also found evidence that some employees did not comply with the District's acceptable use policy. We reviewed the web browsing history on 15 computers and found significant personal Internet use on three computers. This included personal shopping and email use, social media use, web searches for travel and other Internet browsing of a personal nature.

For the last three completed fiscal years (2015-16 through 2017-18) the District has reported surplus fund balance in the general fund that exceeded the statutory limit by $1.15 to $1.83 million or 5.3 to 8.5 percentage points. Officials need to improve budgeting practices and establish long term financial plans to effectively manage fund balance and maintain it within the legal limit. Although the total budget variances were not significant in terms of their percentage, they led to the District generating operating surpluses totaling $1.5 million over the three-year period, which doubled the total fund balance from about $1.5 million at the beginning of 2015-16 to nearly $3 million at the end of 2017-18. The Board and District officials have taken limited actions to reduce the unassigned fund balance to the legal limit and to use the surplus funds in a manner that benefits taxpayers.

We found evidence that some employees did not comply with the acceptable use policy. We reviewed the Internet browsing histories on 10 employee computers and found evidence of inappropriate personal use on six computers. All six employees' job duties included routinely accessing personal, private and sensitive information (PPSI). As a result, their personal Internet use unnecessarily exposed this information to being compromised. In addition, during our review of the 184 enabled employee network accounts, we found that two belonged to former employees, one of whom had left District employment in 2017. We also found 11 generic accounts that the technology coordinator told us were unnecessary. Finally, the District did not provide users with information technology security awareness training to help ensure they understood security measures to protect PPSI.

While we noted no significant exceptions with the initial student enrollment, supporting residency documentation was lacking for students in subsequent years of enrollment with the School. As a result, School officials cannot ensure they billed districts of residence accurately. We found that 34 of the 60 students in our sample (57 percent) did not have appropriate proof of residency. We examined the billing accuracy for 60 students with base billings to districts of residence totaling approximately $1 million. While we found that generally, billings were calculated accurately, the School should continue its efforts to obtain and update billings in a timely manner for student residency changes. Finally, we examined the School's student tuition billing of special education services to districts of residence. We identified six billings for five students where the services billed did not agree with the student's individualized education program due to the School's delay in updating billings for changes in special education services provided to the students. We also found that the School used the incorrect rate when billing for services that generate special education State aid. While two of the instances for one student were minimal, the remaining four discrepancies resulted in the district of residence being underbilled by approximately $4,200.

The District paid nine professional service providers $8.3 million during the 2017-18 school year for various services. We found that the District had Board-approved contracts or agreements on file for all nine service providers. Payments to the service providers were generally made at the appropriate rates and in accordance with contract provisions. However, we found payments to two service providers totaling $477,000 (10 percent) were not supported by sufficient documentation to ascertain that services were rendered in accordance with the contract. The District paid $275,000 for information technology support services even though the claims lacked descriptions of the services provided and documentation demonstrating how the rate of compensation was determined or by whom. We also found that invoices submitted by the occupation and physical therapy service provider totaling $202,000 were not sufficiently itemized or detailed to support all hours billed.