While the District had acceptable use policies for IT assets, they were not readily available for our review, disseminated to officials and staff, or enforced. In addition, the policies did not address connecting personal mobile computing and storage devices to the network, which can create security vulnerabilities and allow inappropriate access to IT assets and data. The Board did not adopt IT security policies addressing data classification, regulations to help ensure the protection of PPSI or a breach notification policy in the event that attackers access PPSI. It also did not adopt policies addressing online banking, user access rights or sanitation and disposal of IT equipment. Officials did not maintain up-to-date hardware inventory records. District officials also did not maintain a comprehensive software inventory. Finally, the District did not implement comprehensive procedures for monitoring user accounts. During our review of the District's 833 enabled network user accounts for staff and students, we found that 332 accounts (40 percent) had not been used in the last six months.

The Treasurer appropriately paid health insurance buyout payments to seven eligible employees in 2017-18 and nine eligible employees in 2018-19 totaling $82,188, as of December 14, 2018. The average annual buyout payable to each participating employee during these two years was $7,793. If the District did not offer the health insurance buyout option, it could have been liable for a portion of the participating employees' health insurance had they chosen coverage from the District at an estimated cost of $182,254 during our audit period. The health insurance buyout may have saved the District as much as $100,066 during our audit period. However, we believe that the District's two collective bargaining agreements (CBAs) clearly state that employees wishing to participate in the buyout program must elect to have no health insurance through the District. However, we found that three employees received a health insurance buyout in 2017-18 and 2018-19 even though they were covered by the District's health insurance through a spouse or parent employed by the District. As a result, District officials paid these employees approximately $34,738 in health insurance buyouts during our audit period that appear inconsistent with the language contained in both CBAs. Finally, the Treasurer's buyout calculations were not reviewed by District officials.

The Town did not have an acceptable use policy. We reviewed the technology use section of the employee handbook and found that it did not clearly define use that was not acceptable or the consequences of violating the computer and communication systems. We reviewed the web browsing history for 10 computers used by 10 employees and found significant personal Internet use on all 10 computers that was not related to Town-business. This included social media use and accessing entertainment and leisure websites. All 10 employees' job duties included routinely accessing PPSI. As a result, their personal Internet use unnecessarily exposed this information to being compromised. Town officials also did not provide users with IT security awareness training to help ensure employees understood IT security measures. Town officials did not develop comprehensive written procedures for managing system access. During our review of all 15 network accounts, we found that five (33 percent) had not been used in six months or more. The Board did not adopt an information breach notification policy or a disaster recovery plan. Finally, the Town did not have a written contract or service level agreement with its IT consultant.

The Justices did not prepare monthly accountabilities or maintain sufficient records to identify outstanding balances. For example, we found that Justice Kline did not properly identify and pay Court funds to appropriate parties. We performed an accountability of Justice Kline's account as of the month she resigned (April 2018) and found that she had records to support $4,600 of outstanding bail (i.e., from defendants pending resolution of their cases); and $273 owed to defendants, the Town Supervisor and Justice Winsor's account. However, Justice Kline had unidentified funds of $8,906, the majority of which ($8,704) was transferred from the prior justice, Justice Daniels. Furthermore, she recorded $370 of receipts from three defendants, reported this amount to the JCF and remitted this amount from her account to the Town Supervisor. However, the $370 was not deposited into Justice Kline's account. We sent confirmations to the three defendants to determine whether Justice Kline recorded erroneous receipts or whether she failed to deposit the collections. We did not receive responses from the defendants to determine the cause of the $370 shortage in her account. Justice Kline transferred her bank balance of $13,359 to Justice Winsor when she left office in April 2018. Justice Winsor was unable to identify most of the outstanding liabilities because he was not provided monthly accountabilities from Justices Daniels and Kline. We commend Justice Winsor for researching the sources of unidentified funds transferred from prior Justices Daniels and Kline.

The Board underestimated revenues and overestimated expenditures in the general, water and sewer funds each year. The Board's budgeting practices resulted in an increase in the combined fund balance for the general, water and sewer funds from $2.4 million in 2014 to $4.1 million in 2018. The Board appropriated fund balance totaling $1.4 million of which only $340,000 (25 percent) was used to finance appropriations from 2014 through 2018. Furthermore, officials increased the real property tax levy in each of the five completed years reviewed while experiencing operating surpluses totaling $2 million. Officials told us that the Board has discussed establishing a fund balance policy, but never formalized one. Finally, the Board has not developed comprehensive written multiyear financial and capital plans.

While we found that generally billings were calculated accurately and properly supported, the School relies on staff at its accounting firm to calculate tuition. School officials provide the accounting firm with attendance and enrollment records but do not adequately review the tuition bills to ensure the correct district is being billed or that tuition charges have been calculated correctly. As a result, the School did not correctly calculate State aid attributable to students receiving special education services. The School billed the Buffalo City School District (District) $78,000 more than it would have had it followed New York State Education Department guidelines. In addition, the School did not use the correct number of school days to calculate tuition for 85 students who attended the School less than a full year. As a result, the School underbilled the District approximately $7,400.

Determine whether 17 school districts used their resources and two charter schools (collectively referred to as schools in this report) used their financial resources to develop, adopt, file and implement district-wide school safety plans and building-level emergency response plans in compliance with the New York State Safe Schools Against Violence in Education (SAVE) Act.

As of March 31, 2019, the District reported four general fund reserves with balances totaling $39,891,644. We compared the balances for each reserve to its historical expenditures and planned use and found three of them (capital, retirement and employee benefits) to be reasonably funded. However, based on the highest rate at which the District has paid out tax certiorari settlements for the past five fiscal years (4.75 percent of the total amount claimed), we found the tax certiorari reserve balance of $6,211,404 was sufficient to cover at least eight years of potential claims. This occurred because there was no reserve policy, the existing fund balance policy does not indicate a targeted funding amount and officials had used an estimate of 50 percent of open tax certiorari claims rather than analyzing the actual needs for the reserve. As a result, funds may be tied up in the reserve that could be applied to other District needs. In addition, although the Business Official submits an annual report to the Board, the report does not meet all the criteria of the Board's fund balance policy.

Agency officials have developed written procedures to provide detailed guidance to employees on receiving and recording transactions, issuing receipts to customers, keeping the cash drawer closed and preparing daily cash out reconciliations. However, Agency officials did not ensure that all employees followed the required procedures. Agency officials did not have adequate controls in place to help ensure that all cash receipts were recorded and deposited. In addition, officials did not perform periodic unannounced cash counts for all employees responsible for cash collection, as required by the Agency's written procedures. Furthermore, officials did not adequately track garbage disposal sticker and compost pass inventories and ensure that sales were properly accounted for.

The Clerk did not remit real property taxes totaling nearly $1.4 million in 2017 and 2018 to the Town Supervisor (Supervisor) or County Treasurer (Treasurer) each week, as required by law. For example, the Clerk collected taxes totaling $951,513 during the first seven weeks of 2017 (from January 2 through February 17) but made only one remittance totaling $909,157 to the Supervisor on February 14, 2017. In addition, the Clerk did not deposit real property tax collections within the required timeframe. For example, $468,215 or 34 percent of taxes paid by check in 2017 were deposited from 8 to 38 days late. The Clerk also did not always deposit Clerk fees within the required timeframe or remit them to the Supervisor in a timely manner. We found that the majority of checks received were deposited in a timely manner. However, collections paid by cash were not deposited intact in a timely manner.

The Board adopted budgets that conservatively estimated revenues and appropriations over the last three fiscal years, which resulted in unplanned operating surpluses totaling $2.3 million instead of planned deficits. In the last three completed fiscal years, the District generated $2.3 million in unplanned operating surpluses instead of $1.4 million in planned deficits. Over the past three completed fiscal years, the District reported surplus fund balance that ranged from 3.9 percent to 4 percent of the ensuing year's appropriations, which is within the 4 percent limit allowed by New York State Real Property Tax Law. However, when unused appropriated fund balance is added back, surplus fund balance exceeds the statutory limit. In addition, certain reserve balances were excessive or not needed. Of $3.7 million in seven reserves, three reserves totaling $636,665 may be unnecessary because related expenses were paid from operating funds. Finally, District officials did not develop comprehensive written multiyear financial or capital plans.

We have determined that the 2019-20 budget materially complies with the provisions of the Fiscal Agent Act. However, we identified the following issues which impact the City's financial condition in the current and future years. In prior years, we have expressed concern about the City's practice of financing recurring operating expenditures with nonrecurring funding sources. The 2019-20 budget continues this practice of reliance on nonrecurring funding of $50.3 million to finance operating expenditures. In addition, the City has not implemented procedures to reduce police overtime, so it is likely the historical trends will continue, which means the appropriation for overtime is likely underestimated by as much as $3 million. The adopted 2019-20 budget includes $500,000 for payment of tax certiorari claims, which is low compared to the $15.7 million in tax certiorari payments the City made so far in 2018-19. We also found that the water fund may be subsidizing the general fund for services not related to the water fund by as much as $3.7 million. The City will need $71.2 million to service its debt obligations during 2019-20 which represents about 6 percent of the City's annual budget. In addition, the City recently passed special ordinances authorizing the issuance of bonds up to $160.2 million with payments becoming due in 2020-21. As of June 28, 2019 the City has not completed the State Comptroller's Constitutional Tax Limit Form to verify this computation as required and the City has not finalized and submitted the Comptroller's Real Property Tax Cap Form as required.

The Board did not adopt adequate information technology (IT) policies and procedures. While the District has a written acceptable use policy, the Board has not adopted policies and procedures for granting, changing and terminating user access rights to the District's network and financial application. Additionally, District officials have not adopted policies and procedures for breach notification and have not developed a written disaster recovery plan. Although servers and financial data are backed up on a regular basis and backups are stored offsite, personnel have no guidelines to minimize the loss of equipment and data or implement data recovery in the event of a disaster. In addition, District officials told us that employees are not provided or required to attend formal cybersecurity awareness training. District officials also did not disable and/or remove unnecessary user accounts on the network or properly manage personal, private and sensitive information (PPSI) data.

We examined the continuing education department's cash receipts activity and found weaknesses in procedures. We found no significant discrepancies when comparing participant registration forms to cash receipts recorded in the Department's revenue ledger and to bank deposits. However, without duplicate press-numbered, itemized receipts, there is no assurance that all course registration fees paid to the Department were properly accounted for. Further, both the Coordinator and the clerk perform, or have access to perform, all of the same functions in the cash receipts process. As a result, incompatible duties (of receiving and having access to undeposited cash receipts and updating participant registrations and class rosters) were not properly segregated or mitigated by sufficient monitoring and oversight. These exceptions occurred because the Board did not establish a written policy and District officials did not develop detailed procedures to provide guidance for the Department on how to properly account for and handle cash receipts.

Due to the planned shutdown of Indian Point Nuclear Power Plant (Indian Point), District officials are faced with losing approximately $22 million in revenue within five years. If additional funding sources are not found, the revenues needed to balance future budgets will need to be raised through real property taxes. As a result, District officials have updated the multiyear financial plan. This plan is reevaluated each time the District obtains more information regarding Indian Point's closure. The revenues and expenditures are projected through the 2030-31 school year. However, we found that District officials' projections of operating surpluses in 2019-20 through 2028-29 may be unreasonable. These projected surpluses, which will be used to fund the ensuing year's budgeted appropriations, range from $1.5 million (approximately 1.8 percent of the budget) to $4 million (approximately 5 percent of the budget). Although District officials provided a rationale for the figures used, the projected surpluses appear high when compared to the operating results for the last five years. The average operating surplus for the audit period is approximately $1 million, and two of the five years experienced operating deficits. Since the Indian Point closure was announced, the Board has monitored financial condition and reduced expenditures and increased revenues to prepare for the significant loss of revenue.

The Board did not reasonably estimate certain general fund appropriations in the annual budget each year we reviewed. We compared budgeted revenues and appropriations to actual revenues and expenditures for 2013-14 through 2017-18 and found that while revenue estimates were generally reasonable, certain appropriations were overestimated each year. We analyzed the budget-to-actual expenditure reports individual accounts or line items for 2013-14 through 2017-18 and found that the Board and District officials did not reasonably estimate appropriations for three line items, Board of Cooperative Educational Services (BOCES) special education, health insurance, and social security each year by cumulative totals of approximately $6.45 million. We also reviewed the 2018-19 budget and found that, except for BOCES special education, the Board and officials continued these budget practices which resulted in property taxes being higher than needed. By not estimating certain appropriations conservatively, the Board created annual operating surpluses, resulting in the accumulation of significant fund balance. However, the District's tax levy has remained fairly consistent over the last five years, in spite of the consistent surpluses.

Checks were printed before the claims auditor audited and approved the corresponding claims. The Treasurer told us that she also signed and issued checks for certain claims before the regular monthly claims audit to meet payment deadlines. In addition, the Treasurer made non-check disbursements to pay claims before the regular monthly claims audit to meet payment deadlines. Claims for these disbursements were then presented to the claims auditor with other claims during the subsequent monthly cycle. As a result, claims totaling $172,760 for 35 check disbursements and 50 non-check disbursements made during the audit period were not audited and approved before payment.

The Board's budgets were incomplete and inaccurate. Also, appropriations were overestimated and transfers to reserves were not budgeted. Over the five-year period from 2014 through 2018, actual expenditures were approximately 24 percent or $605,479 less than budgeted appropriations. In addition, the Board was unable to provide documentation of four required permissive referendums and legal notices. The Board was unable to provide documentation of permissive referendums and legal notices that were required before expending reserve funds from type reserves. Finally, the Board did not adopt a reserve policy. Because the reserves were established over 10 years ago, Board members were unsure if a policy had been previously adopted and were not aware of the need for one.

District officials did not provide information technology (IT) cybersecurity awareness training for individuals who used District IT assets. In addition, personal Internet use was found on computers assigned to four employees who routinely accessed personal, private and sensitive information (PPSI). Finally, the Board and District officials have not established a disaster recovery plan.

District officials need to improve their claims audit process to ensure that the claims auditor properly audits and approves all claims before payment. The purchasing agent provides the claims and supporting documentation to the Business Administrator for review and approval before sending the claims to an Oneida-Herkimer-Madison Board of Cooperative Education Services' account clerk. The account clerk processes the claims and returns a warrant and the related check payments to the purchasing agent who compares the checks to the claims and warrant before mailing the checks. However, the purchasing agent provides the warrant, claims and check stubs to the claims auditor for review and approval after the checks have already been mailed. We found that the claims auditor did not audit and approve 116 claims we reviewed totaling $1.9 million (19 percent) until after the claims were paid, including five claims for travel reimbursements totaling $1,260 that were not submitted for payment within District policy timeframes. Finally, the claims auditor did not audit and approve 20 electronic payments for credit card charges totaling $11,600 and nine postage claims totaling $11,442.