District officials need to improve budgeting practices to effectively manage the District's financial condition. Further, the Board and District officials have not implemented corrective action on our last audit report, in which we found that the District had accumulated unrestricted fund balance that exceeded the statutory limit by 64 percentage points over the five years ended June 30, 2012. Even after our last audit brought the issue to the attention of District officials, the Board continued to adopt budgets that resulted in further accumulation of fund balance. During the audit period, the District's unrestricted fund balance exceeded the statutory limit by as much as $2.2 million, or 73.4 percentage points. Although, the District has experienced operating deficits in two of the last three years, resulting in total fund balance decreasing by 9 percent, the District's unrestricted fund balance at fiscal year-end 2017-18 was still approximately $2 million, or 54.6 percentage points over the statutory limit. In addition, the Board appropriated $600,000 of fund balance in each of the adopted budgets for the years 2015-16 through 2017-18. However, in 2016-17, none of the appropriated fund balance was used, and for the fiscal years 2015-16 and 2017-18, only $516,193 of the $1.2 million appropriated was used. With unused appropriated fund balance added back, the District's recalculated unrestricted fund balance ranged from 58.6 to 90.5 percent of the subsequent year's budget. Finally, the Board approved inaccurate budgets with underestimated revenues and overestimated appropriations.

The Board did not adopt adequate policies and procedures for monitoring acceptable computer use and granting, revoking, modifying and monitoring individual access rights to the networks. In addition, the Board did not adopt a comprehensive disaster recovery plan or policies and procedures for password security management, data breach notification and backups. Town officials have an acceptable use policy, which is included in the employee handbook. However, employees and officials were generally unaware of the policy's existence and not required to sign a statement to acknowledge that they are aware of this policy. The Board also did not implement a process to address deactivating unnecessary user accounts and did not provide employees with security awareness training to help ensure they understand security measures necessary to protect the network. Town officials did not always maintain a comprehensive Town-wide inventory list of hardware and software. Finally, the Board did not develop a disaster recovery plan to address potential disasters and the continuity of operations, including IT.

Based on the results of our review, we found that the significant expenditure projections in the proposed 2019-20 budget are reasonable. However, the $47.1 million estimated revenues and $22 million property tax levy presented by the District are insufficient to finance the $78.2 million in expenditures. Adopting a $78.2 million budget would require the District to exceed the tax cap because it would need to levy an additional $9 million in real property taxes. District officials indicated that the cost-cutting required to balance the budget would severely impact services provided to students so they are exploring other options, but no decisions have been finalized. The District's proposed 2019-20 budget, as submitted, is in compliance with the property tax levy limit. However, the levy of $22 million is not sufficient to finance $78.2 million budgeted expenditures.

District officials did not establish adequate controls over cafeteria collections. The Board did not adopt written cash receipt policies, cash receipt duties were not properly segregated and the Cafeteria Manager did not adequately oversee the cash receipt function. As a result, one cafeteria employee, the head cashier, had almost complete control over cafeteria cash receipts without adequate oversight. Cashiers perform daily cash counts and prepare daily collection reports that must be manually entered into the point of sales (POS) system to ensure that recorded POS activity matches manually counted collections. These cash counts were not always recorded in the system. We identified 43 collections totaling $7,200 that were not properly recorded in the system but were collected and deposited. The Manager told us that employees may have forgotten to enter these collections into the system at the end of the day. Although we did not identify any theft or loss of cafeteria collections, by not establishing proper procedures to safeguard cafeteria collections, there is an increased risk that collections could be lost, stolen or misappropriated without detection.

Officials adequately segregated the duties of employees responsible for online banking transactions and adequately established security procedures over online banking. All online payments and transfers totaling $72 million during our audit period were appropriate. However, the District's online banking policy does not clearly indicate how online transfers will be authorized and processed. In addition, none of the employees involved in online banking received Internet security awareness training.

District officials ensured employees were accurately paid their approved salaries and wages. We reviewed all payroll records for 35 employees who were paid approximately $1.7 million during the audit period. District officials effectively designed and implemented procedures to ensure that compensation payments were accurate and properly authorized. There were no recommendations as a result of this audit.

Water officials have not implemented comprehensive procedures for managing, limiting, securing and monitoring user access. In addition, water plant personnel have not been provided with job-specific cybersecurity awareness training. Water officials did not prevent or monitor public disclosure of information on the Town's water system. Finally, there are no written policies, procedures, standards or guidelines related to the industrial control system cybersecurity. This includes the use of USB drives, personal devices and other mobile storage devices within the water control system network. Also, job duties do not specify security roles and responsibilities for water personnel to ensure users are aware of and understand what is expected of them to maintain the security of the water control system.

Town officials spent approximately $18,500 on wages, equipment use and materials to improve the Board member's property in May and June of 2015. However, the work performed raises potential issues under the Constitution, because no contract was in place at the time. Additionally, the Board did not perform a cost benefit analysis to make an informed decision on whether this project was necessary or publicly discuss, disclose or approve the work to be performed. Our review of Board minutes for the audit period did not disclose any Board discussion or authorization for the highway department to work on the Board member's property. Furthermore, the Department of Environmental Conservation (DEC) Deputy Regional Permit Administrator told us that any work done on a protected river or river bank, such as this river, would require a DEC permit and that he had no record of contact from the Board member or Town officials for the work performed.

The District has 19 active ECA clubs. We reviewed the collection records and fundraising activities of 10 clubs (53 percent). We traced all 67 deposits totaling $52,404 from July 1, 2017 through April 30, 2018 to the treasurers' records. While each activity had a properly authorized activity application, deposit breakdowns and completed profit/loss statements, 24 deposits (36 percent) totaling $40,515 lacked adequate supporting documentation. Sixteen deposits totaling $23,737 had no collection documentation and eight deposits totaling $16,778 had inadequate or incomplete documentation. The central treasurer's and clubs' ledgers agreed to deposit breakdowns, accurately recording amounts deposited. However, because supporting documentation was lacking at the club level, we could not determine whether all collections were remitted, recorded and deposited intact.

Our review of records for 15 noninstructional employees paid overtime totaling $54,041 during our audit period disclosed that District officials often did not document that prior approval was granted for overtime worked and that start and end times were documented on the time sheets in accordance with the overtime policy. In addition, the Superintendent told us that she permitted two noninstructional employees to earn overtime while they worked from home. However, this is neither specifically authorized nor prohibited by Board policy or in the employees' memorandum of understanding (MOU) with District officials. Although there was no documentation that these employees received prior approval for overtime worked, they were paid for 392 hours of overtime totaling $8,513 while working at home.

The School's previous Board entered into an agreement with National Heritage Academies, Inc. (NHA) that assigned it nearly all revenue the School receives. The initial agreement began in 2003 and was subsequently updated by a revised agreement approved by a previous School Board in 2011. NHA is responsible for the general management and control of the School's finances. As a result, NHA performs nearly all of the key financial duties and the Board relies almost exclusively on NHA to handle the School's finances. NHA has not fully disclosed detailed internal cost information and how operating costs are allocated to the School. As a result, the Board has limited ability to verify that the charges and reporting are accurate and appropriate. We question whether the Board can sufficiently monitor NHA to ensure that School funds are properly safeguarded and used for intended educational purposes.

Although leave accrual balances were accurate, the employees had sufficient leave accrual balances and timesheets were approved by the respective department head, leave hours used were not pre-approved. We examined attendance and accrual records for 41 of 284 employees entitled to leave benefits, and found that leave taken was not always pre-approved. Leave approval requests were missing for 10 employees for 72 days of 623 leave occurrences. These employees used a total of about 450 leave accrual hours and were paid a total of $9,927. For example, one employee from the Buildings and Grounds department used 106.5 hours of leave, totaling approximately $2,075, which was not pre-approved.

Town officials have not implemented comprehensive procedures for managing, limiting, securing and monitoring user access. We noted inactive user accounts, user accounts that are for nonemployees and user accounts not assigned to a specific individual. In addition, the Town has an acceptable computer use policy in place that defines the procedures for computer, Internet and email use. However, Town officials have not designed or implemented procedures to monitor compliance with the policy or determine the amount of employees' personal use. Finally, the Board did not develop a formal disaster recovery plan to address potential disasters. Consequently, in the event of a disaster, Town officials have no guidelines to minimize or prevent the loss of equipment and data.

Although the Board has adopted a procurement policy, the policy does not require soliciting competition, such as written proposals or quotations, when procuring professional services. In addition, officials have not developed formal procedures for seeking competition when procuring professional services, including what documentation should be maintained to support decisions. As a result, employees did not always use competition when procuring professional services or document sufficient evidence to demonstrate whether the vendor selected was a prudent and economical use of public funds. BOCES procured professional services from 49 providers totaling approximately $1.9 million. We reviewed all providers, who were each paid $1,000 or more in either year of our audit period, for a total of 29 providers paid approximately $1.89 million. We found that BOCES sought competition for its external auditor services, as required by law. However, BOCES officials procured the services provided by the remaining 28 providers (totaling approximately $1.85 million) without any evidence that they sought competition. In addition, there were written agreements for 12 providers, with total expenditures of approximately $690,000, which typically outlined the service terms and compensation schedules. However, officials could not provide written agreements for 17 providers with total expenditures of $1.2 million.

We reviewed 58 out of 765 (8 percent) agricultural, veterans and senior citizen exemptions, totaling $2.9 million, on properties with a total assessed value of $7.7 million. We found that 20 exemptions (34 percent), totaling $1.4 million, were not properly supported by adequate documentation to establish and/or maintain exemption eligibility. We reviewed 21 agricultural exemptions totaling $1.36 million on properties with assessed values of $3.6 million. Fourteen exemptions valued at $927,000 lacked one or more pieces of supporting documentation to verify eligibility. We also reviewed 22 veteran exemptions totaling $921,000 on properties with assessed values of approximately $2.5 million. Six exemptions totaling $480,000 lacked the required supporting documentation. Finally, we reviewed 15 senior citizen exemptions totaling $600,000 on properties with assessed values of $1.6 million and found that they were generally properly supported.

Although the Board adopted a procurement policy in 2015, it did not ensure that the policy and related written procedures adequately address the procurement of goods and services below the competitive bidding thresholds. The policy also does not address how professional services would be procured. District officials provided written procedures that require price comparisons for purchases exceeding $100 and written quotes for purchases exceeding $1,000. The purchasing agent told us that officials no longer follow these requirements because they believe the procedures are outdated. However, officials were unable to provide any documentation indicating how procurements not required to be competitively bid are handled. The purchasing agent told us that sometimes she reminds individuals who made purchase requests to compare prices, but that she does not require such comparisons. We reviewed 42 purchases totaling $184,000 to assess how District officials procured goods and services that were not required to be competitively bid. We found that 39 purchases totaling $176,000 were made without evidence that officials used a competitive process or obtained the required written quotes.

We reviewed 91 (15 percent) out of approximately 600 agricultural, veteran and senior citizen exemptions totaling $6 million on properties with a total assessed value of $15.5 million. We found that 81 (89 percent) exemptions totaling approximately $5.8 million were not properly supported by adequate documentation to establish and/or maintain eligibility. We reviewed 49 agricultural exemptions totaling approximately $5.3 million on properties with assessed values of approximately $12.2 million. Forty-one exemptions valued at $5.2 million lacked one or more pieces of supporting documentation to verify its eligibility. We also reviewed 26 veteran exemptions totaling $470,000 on properties with a total assessed value of $2.1 million. The Assessor did not have proof of eligibility documentation for any of these exemptions. The Assessor indicated that he relies on the County's Veterans' Service Agency (Agency) to verify the property owner's military service. As such, our exemption verification computation was based on the forms signed and stamped by the Agency that appear to certify the veteran's military service and certain ratings (compensation, disability) for the exemption amounts. Based on our review, it appears that these exemptions were accurately calculated. Finally, we reviewed all 16 of the Town's senior citizen exemptions totaling $190,000 on properties with a total assessed value of $1.2 million. Fourteen exemptions totaling $130,000 lacked annual renewal documents evidencing the property owner's income, as required to maintain eligibility.

District officials accurately paid salaries and wages according to their payroll process established to ensure that employees are paid in accordance with Board authorizations and payroll transactions are appropriately supported and authorized by management. The Superintendent reviews the payroll register for any apparent discrepancies or significant changes and certifies the payroll. However, when the Superintendent signs the certification form he does not date the signature; thus there is no way to determine whether the certification was completed prior to the Treasurer distributing paychecks and processing direct deposits for employees' pay. Based on our observations and interviews, the Superintendent did not always certify the payroll prior to the Treasurer issuing paychecks and processing the direct deposits. Additionally, a payroll change report indicating any changes to pay rates, or adding or deleting employees since the prior payroll, was not produced to assist the Superintendent or anyone else in reviewing the payroll.

We reviewed 60 out of 369 (16 percent) agricultural, veterans, disability and senior citizen exemptions totaling $2.5 million, on properties with a total assessed value of $16.4 million. We found that 27 exemptions (45 percent), totaling approximately $1.5 million, were not properly supported by adequate documentation to establish and/or maintain exemption eligibility. We reviewed 23 agricultural exemptions totaling $1.2 million on properties with a total assessed value of $11.1 million. Seventeen exemptions totaling $1 million lacked one or more pieces of supporting documentation necessary to verify exemption eligibility, and eight exemptions totaling $181,800 lacked required soil survey forms. We also reviewed 21 veteran exemptions totaling $750,000 on properties with assessed values totaling approximately $3.2 million. Ten exemptions totaling approximately $516,000 did not have completed applications on file or sufficient documentation to establish eligibility. We reviewed all six disability exemptions totaling $100,600 on properties with assessed values totaling approximately $528,000 and found that these exemptions were generally properly documented and supported. Finally, we reviewed 10 senior citizen exemptions totaling $491,000 on properties with assessed values totaling $1.5 million and found that all were properly documented and supported.

The District needs to improve its claims audit process to help ensure all claims are properly audited and approved before payment. The Board appointed a claims auditor to assume its powers and duties to examine and approve or disapprove claims. However, health insurance claims and Medicare reimbursement payments to retirees do not go through the claims audit process. During our audit period, the District paid claims totaling $3,313,264 for health insurance and $141,082 in Medicare reimbursements that were not audited and approved by the claims auditor. Lastly, we identified 13 scholarship disbursements totaling $5,700 for the audit period. We reviewed 11 payments totaling $5,500 (96 percent). All of the awards we reviewed were approved by the trust representatives, adequately supported and complied with trust requirements. However, none of the scholarship payments were audited and approved by the claims auditor.