Officials do not regularly review network user accounts and disable those that are determined to be unnecessary. In addition, the Board does not have an adequate contract and separate service level agreement for information technology (IT) services provided by the Broome Tioga Board of Cooperative Educational Services' South Central Regional Information Center (SRIC). Although SRIC provided a disaster recovery plan for the District, it is incomplete. The plan is clearly a template and lacks information. Finally, officials do not provide periodic IT security awareness training to staff.

As a result of our audit, we issued a report, dated October 2018, identifying certain conditions and opportunities for Village management's review and consideration. We revisited the Village in August 2019 to review progress in implementing our recommendations. Our follow-up review was confined to interviews with Village personnel and inspection of certain documents related to the issues identified in our report. Based on our limited procedures, it appears that the Village has made modest progress implementing corrective action. Of the 13 audit recommendations, two recommendations were implemented, seven recommendations were partially implemented and four recommendations were not implemented.

The Board did not establish policies to provide reasonable assurance that fuel was used for its intended purpose and properly accounted for. In addition, District officials did not design procedures to ensure fuel use and inventory records were properly maintained and reconciled. As a result, the responsibility for managing transportation fuel inventories was not clearly assigned and District officials did not maintain complete and accurate inventory records to safeguard and account for fuel inventories. We found that complete fuel inventory, delivery and usage records are not maintained and reconciliations are not performed. In addition, we found that 17 of 78 keys (22 percent) that allowed access to the fuel meter could not be located.

The surplus fund balance in the general fund exceeded the 4 percent statutory limit for the past three fiscal years. As of June 30, 2018, the District's surplus fund balance was $2.15 million, which was 4.9 percentage points or nearly $1.2 million over the legal limit. During the past three fiscal years, the District appropriated fund balance and reserves that it did not use and generated operating surpluses totaling about $5 million. The District also overestimated appropriations by an average of $2.4 million each year or by 10.5 percent. During this time, total reserves increased by $3.9 million. District officials have not developed a comprehensive multiyear financial plan.

We reviewed 1,963 water and electric cash receipts totaling $184,500 collected during four months of our audit period. We found that they were properly recorded and deposited timely and intact (in the same amount and form – cash or check – as received). In addition, we reviewed water and electric billings for 33 customer accounts and found that water and electric use was properly billed. However, the Deputy Clerk-Treasurer (Deputy) was responsible for recording water and electric use, printing and sending bills to customers, collecting payments, recording payments in the customers' accounts and making adjustments to customer account balances with no oversight. As a result, the Village had an increased risk that water and electric collections could be lost, stolen or misappropriated without detection because the Board did not adopt written cash receipt policies, Village officials did not properly segregate the Deputy's cash receipt duties and the Treasurer did not adequately oversee the Deputy's work.

The District lacked adequate policies and procedures to ensure Medicaid claims were submitted and reimbursed for all eligible services provided. Claims were not submitted and reimbursed for 312 eligible services totaling $11,896 and service providers did not document 948 scheduled services totaling $66,695 in the special education system as provided. Had these services been appropriately documented and claimed, the District could have realized potential revenues totaling $39,296. In addition, service records were not available for 10 students. As a result, we could not determine whether the District submitted all eligible claims for these students.

We selected all 16 assets valued at $440,242 listed as disposed of during our audit period and found none had Board approval. In addition, although District officials were able to provide documentation regarding the means of disposal for the two buses disposed of during the 2017-18 fiscal year, they could not provide documentation indicating the means of disposal, such as resale, donation or trashing of the items, for the remaining 14 assets. These assets had a book value of $4,483 and included a radio system ($1,657), a phone system ($1,183), an audio visual and lighting system ($871) and a communication system ($772). In addition, District officials did not maintain up-to-date disposal records. Finally, 10 of 25 assets (40 percent) totaling $43,330 were not traced to locations.

District officials did not always solicit competition by issuing requests for proposals (RFPs) when procuring professional services as required by the procurement policy. We reviewed the claims for 16 professional service providers who were paid more than $1.4 million during our audit period. We found that contracts for 10 providers paid in excess of $1 million were awarded without the benefit of competition. The payments for these services, approved by the claims auditor, did not include evidence that the required competitive method was followed. As a result, District officials did not obtain these services through a competitive process in accordance with the Board-adopted procurement policy. District officials did not enter into written agreements with four professional service providers we reviewed (the architect, behavioral analyst, engineer, and private investigator) who were paid a total $325,880 during our audit period. Additionally, the Board did not adopt a resolution authorizing these service providers to perform services for the District. As a result, the claims for these services did not include the basis for compensation or define the scope of services provided.

Over the last five years, budgeted expenditures were overestimated by a total of $16.4 million leading to $13.1 million of the appropriated fund balance not being used. By overestimating appropriations, the Board may have given taxpayers the impression that it needed to both increase taxes and use appropriated fund balance to close budget gaps. However, due to the overestimated appropriations, the District realized operating surpluses in four of the last five years totaling $9.6 million, or an average of over $1.9 million per year. As a result, from 2014-15 through 2018-19, the Board appropriated approximately $14 million in fund balance, but only used $938,715 in one year of the five-year periods, leading to $13.1 million in unused appropriated fund balance. By appropriating fund balance each year that was not needed to finance operations, the District was, in effect, reserving fund balance in a manner not provided for by statute and circumventing the statutory limit. In addition, the tax certiorari reserve may be overfunded by $13.4 million based on past settlement rates. Finally, the District does not have a comprehensive multi-year financial plan.

The Board and District officials need to improve budgeting practices to ensure that budgets are realistic and take action to address the reasonableness of fund balance. While the District's unrestricted fund balance was reported to the New York State Education Department as being within the legal limit for the past three years, we found the unrestricted fund balance was actually underreported during this time period. District officials circumvented the statutory limit on surplus fund balance by not using $3.7 million in appropriated fund balance as a financing source, improperly booking $3.6 million in encumbrances and improperly reserving $7.7 million for debt service. Recalculated surplus fund balance exceeded the statutory limit by 10 to 12 percentage points for the fiscal years 2015-16 to 2017-18. The District also maintained 11 proper reserve funds totaling $34 million at June 30, 2018. During the last three fiscal years, District officials could have funded operations and reduced surplus fund balances which impact real property tax levies.

The Board did not adopt adequate information technology (IT) policies or a disaster recovery plan. School officials did not provide IT security awareness training to staff. In addition, the School relied on the charter management organization (Company) and an IT service provider for managing its IT assets, and for IT services and technical assistance. School officials used the same IT service provider the Company used for its IT support. However, officials did not have a written contract with the service provider for the services provided. We also found that hardware and software inventory records were inaccurate and outdated.

During our audit period, four different individuals served in the Treasurer position, and during a three-month period (July 9, 2016 through September 5, 2016) this position was vacant. Due to the high turnover in the Treasurer position, we reviewed and prepared the 43 monthly general fund bank reconciliations previously prepared by the four Treasurers from July 1, 2015 through January 31, 2019 to determine whether the reconciliations were accurate and prepared in a timely manner. While 17 of these reconciliations were prepared in a timely manner (i.e., within 30 days), we found that the 26 reconciliations for July 2016 through August 2018 were prepared between 46 and 551 days after month-end. Furthermore, the Treasurers' reconciliations were inaccurate because, for 34 of these months, we found unreconciled differences of as little as $13 for an unrecorded stop payment fee in August and September 2015 and February 2016, to as much as nearly $3.4 million for several unrecorded transactions in April 2017, including deposits, transfers between funds and payments for debt service and employee health insurance. Even when the Treasurers' bank reconciliations identified reconciling items, the related accounting adjustments were often not made until the end of the fiscal year, if at all.

The Board created a position titled Controller/Process Compliance Officer (Controller) and engaged an independent contractor to perform these duties. The stated purpose of this position is to improve and develop the accuracy of the Treasurer's office by developing better financial insight for department heads and officials. According to contract, the Controller reports to the Board. The Treasurer remains the Village's chief fiscal officer and works with input and guidance from the Controller. Certain duties, which Village Law and GML require the Treasurer to perform, were performed by the Controller with no oversight by the Treasurer or other official. All of these duties should be either performed, or reviewed and approved by the Treasurer. We did not find any discrepancies with the records, but the Controller performed many of the Treasurer's duties and the Treasurer performed some of the Treasurer's duties in addition to the clerk duties. If the Board intended to separate the duties in this manner, it could have complied with the law by separating these two offices and designating that the Controller position (as a Village employee) act as treasurer and creating a separate Clerk position.

District officials did not provide IT security awareness training to all employees. Also, the District had a written policy directing the Superintendent, or his or her designee, to provide staff with training in the proper and effective use of the District's computer system. However, we found that the District did not provide training to all users regarding proper usage of the IT infrastructure, software and data. District officials also did not develop procedures for managing, limiting and monitoring user accounts and permissions and securing personal, private and sensitive information (PPSI). As a result, we found that the District had unneeded and shared accounts that had not been disabled and/or monitored, and some District employees who had access to the financial application had excessive user permissions to employees' PPSI. Finally, the District did not have a disaster recovery plan.

We found that Village officials appropriately sought competition for the two purchases exceeding the $10,000 bidding threshold as required by the procurement policy. In addition, we tested 19 purchases totaling $30,870 that required quotes to determine whether officials complied with the policy. Officials were unable to provide documentation showing that they sought competition for any of these purchases and told us that they were unaware of the policy requirement that documentation of quotes was required for purchases of $250 or more. We also identified 17 professional service providers who Village officials paid a total of $191,575 during our audit period. We reviewed the payments to all these providers and found that officials did not seek competition when selecting any of them. In addition, the Board did not review the procurement policy annually as legally required. Finally, the Board did not properly audit claims.

Online banking payments totaling $65,456 initiated by business office staff were not included on the warrants or audited by the Board. Also, of the 76 claims we reviewed that were paid in advance of audit, 26 totaling $59,691 were not of the type legally permitted to be paid in advance. In addition, the Treasurer did not maintain custody and control of her signature stamp and check signatory policies were not followed. Although we did not find any improper charges, the policies and procedures governing credit card use resulted in high credit limits, an unknown number of users – none authorized by the Board, unused reward program balances, recurring automatic charges and credit card account numbers saved in online accounts. We reviewed 16 credit card payments totaling $52,793. Although our review did not find any improper charges, we did identify instances where the credit card policy was not followed and areas where the policy and procedures could be improved.

The Board and District officials need to improve budgeting practices to ensure that budgets are realistic and avoid generating excessive surpluses. We compared appropriations and estimated revenues with actual operating results for 2015-16 through 2017-18. We found that overall District officials budgeted reasonably in most years for revenues; however, appropriations were overestimated by $9.3 million (8.9 percent) during this period resulting in operating surpluses. As a result of the operating surpluses, District officials made unbudgeted year-end transfers to reserves of $3.4 million and to the capital project fund of approximately $5.9 million to keep the unrestricted fund balance under the 4 percent statutory limit. Generally, District officials transferred surplus funds to reserves at the end of the fiscal year that were not originally budgeted to fund reserves to stay within the 4 percent fund balance limit. As a result, general fund reserves increased by $2.3 million over the last three completed fiscal years. As of June 30, 2018, the District reported a debt service reserve and 10 general fund reserves with balances totaling $20.4 million, or 51 percent of the District's annual budget. We found six reserves, with balances totaling $9.6 million (47 percent of total reserves) as of June 30, 2018, are potentially overfunded or unnecessary. Finally, the Board did not develop or adopt comprehensive, multiyear financial and capital plans.

Officials could not demonstrate that they complied with competitive bidding statutes when awarding two contracts totaling $549,000 and did not seek competition as required by the procurement policy for five professional service contracts totaling $2.8 million and nine purchases totaling $125,000. In addition, the Board has not sufficiently segregated cash disbursement duties and has not established adequate compensating controls such as an independent claims audit function. Finally, the President received approximately $142,000 in monetary benefits over six years that were not clearly stated by his employment contract.

During our audit period, the District did not provide formalized IT security awareness training to employees or students. We also found evidence that some employees did not comply with the acceptable use policy. We reviewed the web browsing history on 26 computers and found significant personal Internet use on four computers. This included personal shopping, banking and email use; social networking; web searches for non-District related subjects; and filing personal income tax returns. In addition, we found evidence of inappropriate and other questionable Internet use on one of the four computers that was assigned to a member of the District's administrative staff. Finally, the Board did not adopt a comprehensive written plan to describe how officials would respond to potential disasters.

We found the School did not obtain proof of residency for all students in order to bill the resident school districts for all students enrolled. We examined all 713 bills totaling $8.8 million submitted for the 2017-18 school year to the three largest resident school districts, based on revenue and enrollment, and determined that amounts billed for eight students totaling $68,940 were rejected by resident school districts due to the lack of current proof of residency. For seven students at Albany City School District, the School could not provide documentation showing contact made with parents to retrieve documentation and billed the resident district even though it did not maintain adequate proof of residency. One student's bill to Schenectady City School District was rejected for $3,754 because the School did not have proof of residency documentation. The student's parent was a School employee and School officials had assumed the parent would provide the documentation, but the parent never did. Also, the School failed to bill Schenectady City School District $1,252 for a student because of an oversight; the student was enrolled for one month between billing periods. In addition, the Finance Director does not provide the Board with a detailed statement of billing progress including the actual enrollment of students and the corresponding amounts billed, received or rejected to date. Finally, there is no record of amounts billed and received entered into the Board minutes.