City officials did not adequately safeguard electronic access to the water system. The Water and Sewer Superintendent (Superintendent) did not establish a formal process for staying current on system cybersecurity threats; water plant officials do not receive alerts to such threats from key sources, including the U.S. Department of Homeland Security. Further, as of May 2018, the City was not in compliance with New York State Public Health Law to protect drinking water because its vulnerability assessment (a required part of the water supply emergency response plan due by January 1, 2018) was not filed with the State Department of Health until August 2018. We also found unnecessary software installed on all three computers connected to the water system network, even though the City's technology use policy does not allow non-City licensed software. In addition, the policy had not been updated since 2008. City and water plant officials also did not periodically review website content for inappropriate disclosure of water system information. We found content and system information posted by vendors that should have been deleted in 2013 or earlier. Finally, the Superintendent did not provide water plant personnel with job-specific cybersecurity training in recognizing and appropriately responding to suspicious system activity.

The City Bureau of Buildings (Bureau) has not developed written policies and procedures for managing elevator inspections. Therefore, the clerk who manages elevator inspections has not been provided guidelines and the data management system used by the Bureau is not complete and updated. Also, there are no formal processes for monitoring elevator inspections, following up on identified violations and verifying that violations are corrected in a timely manner. As a result, there are no systems to ensure that elevators (1) are inspected as required, (2) are adequately monitored to ensure they are safe and running properly, (3) with safety violations are re-inspected in a timely manner and (4) that administrative fees are collected. Therefore, there is inadequate assurance that elevators are safe and in satisfactory operating condition, and that the City has collected all revenue owed to it. Specifically, we found that although the City's Elevator Master List included 226 properties with 308 elevators and related equipment, our visits to 58 properties disclosed 141 elevators and related equipment that were not included. In addition, 75 of 85 property owners did not submit either six month or annual inspection reports. Also, violation notices were not sent to 68 (91 percent) of these property owners. Finally, Bureau officials did not follow up on violations/deficiencies on the inspection reports submitted by property owners. Serious elevator deficiencies included 35 instances and included violations such as no emergency phone and no fire extinguisher.

Although the Board adopted a policy for managing access to the network and the information system, College officials did not enforce the policy. Consequently, the College has 824 network user accounts that do not match current employees and have not been used within the last six months. Of these, 616 accounts have never been used and another 69 accounts have not been used in more than three years. Officials told us that some network accounts are limited to email access and others are kept active due to contractual requirement. In addition, while some employees recently attended general cybersecurity training, this training was not mandatory for all employees and did not cover techniques relevant to college systems and assets accessible by employees. Most notably, employees responsible for safeguarding the website generally were not required to attend the training and had not been formally trained on common web application risks such as code injection and authentication vulnerabilities. Finally, although College officials have no formal policies governing online banking, we found that they had effective informal procedures in place for secure online banking and fund transfers.

The Board and ski area officials have not developed policies or procedures for how ski collections should be recorded, deposited and reconciled. Furthermore, the Board did not develop, adopt or implement policies and procedures to provide guidance for ski area staff for issuing complimentary lift tickets and season passes. Ski area officials have not developed a process to compare the number of printed season passes with the number sold as recorded in the point-of-sale (POS) system. As a result, there is a risk that season passes could be printed and issued without the associated cash receipts being recorded and deposited. The ski area also issued 14,729 lift tickets and season passes during our audit period of which 2,427 of the four types of $0 transactions were recorded in the POS system. Ski area staff were not required to retain supporting documentation for any of these $0 transactions recorded in the POS system and officials had no procedures in place to reconcile the daily transactions and verify whether these transactions were legitimate. Due to the lack of supporting documentation and details in the POS system, we were unable to determine the legitimacy of 1,493 complimentary, five-day and 70-or-over transactions recorded in the POS system.

The Council has not adopted an acceptable use policy or implemented procedures to properly monitor computer use. We reviewed 11 computers for non-business use and found evidence of personal use on seven computers. Such use included personal email, personal banking, social networking, online shopping, browsing travel and entertainment websites and other questionable Internet use. In addition, City officials did not maintain an inventory of IT assets. Prior to our audit, the Network Administrator documented the location of IT assets on the purchase order/invoice at the time of purchase but did not maintain inventory records for all computer hardware, software and data. The Council and City officials also have not developed and adopted a breach notification policy or local law because they were unaware of this requirement. City employees were not provided with IT security awareness training. Finally, the Council and City officials have not developed and adopted a written disaster recovery plan.

We audited the administration of the agricultural, Persons 65 Years of Age or Older (senior citizens) and veterans real property tax exemptions. The Assessor granted these exemptions for 898 parcels on the 2017 assessment roll, which reduced the taxable assessed value among all taxing jurisdictions by about $179 million. We found exceptions with 84 of the 125 (67 percent) agricultural, senior citizens and veterans exemptions we reviewed. These exemptions lacked adequate supporting documentation to verify their eligibility. The properties with exceptions had their total taxable assessed value reduced by about $35.3 million. For example, we reviewed 50 properties receiving an agricultural exemption and found 45 lacked one or more pieces of supporting documentation necessary to verify their eligibility for the exemption. Only one of the properties contained an original application with income verification for an agricultural land exemption. All 20 of the properties we reviewed receiving a senior citizens exemption lacked one or more pieces of supporting documentation to verify the eligibility and accuracy of these exemptions. Specifically, all properties lacked proof of age eligibility, 18 lacked income support (e.g., income tax return), and two did not have a renewal form on file. We reviewed 55 properties receiving veterans exemptions and found 19 properties (35 percent) lacked one or more pieces of supporting documentation to verify the eligibility and accuracy of these exemptions. Eleven properties lacked an original application, 17 did not contain acceptable military records to prove honorable discharge, and one was lacking supporting documentation regarding disability.

The significant revenue projections in the proposed budget are reasonable. However, there were errors in the projections for expenditures that should be addressed prior to adoption of the budget. The City underestimated pension costs by $576,193. The proposed budget did not include $841,622 in general fund debt service that was on the City's debt schedule. Based on our projections, the amounts budgeted for police and firefighting overtime is likely underestimated by $830,000. City officials have not included adjustments for the amount of taxes estimated to be uncollected and unavailable to finance the budgetary appropriations. The City continues to budget minimal amounts for contingencies, which provides limited flexibility to address revenue shortfalls or unforeseen expenditures. The City faces potential increased salary costs when one of its expired collective bargaining agreements is settled. The City's proposed budget does not comply with the tax levy limit.

The District generally complied with New York State General Municipal Law and has established adequate procedures to procure goods and services not subject to competitive bidding. We reviewed the District's procurement of professional services from 26 providers paid $1.08 million and found, except for minor exceptions which we discussed with District officials, all providers were chosen through competitive methods. We also tested all purchases that required three written quotes totaling $224,086 and found that District officials obtained the required number of quotes or properly used State contracts. There were no recommendations as a result of this audit.

Despite the Board-adopted purchasing policy (policy) stating that the Board is responsible for ensuring procedures for the procurement of goods or services not subject to competitive bidding statutes be developed, District officials had not established or implemented any formal purchasing procedures. Additionally, because the Board did not annually review the policy as required, it did not ensure compliance with the policy. During audit fieldwork, District officials developed and the Board's audit and finance committee codified procedures in the District's purchasing and procurement regulations. We reviewed 60 purchases made during the audit period totaling $341,716 to determine whether District officials sought competition for purchases that fell below bidding thresholds. We found that 28 purchases (47 percent) totaling $152,001 were made without evidence that officials sought competition to obtain the lowest price. Inconsistencies in purchasing occurred because the Board did not ensure formal procedures were developed and provided to District officials and employees to follow when making purchases of goods and services under statutory bidding thresholds.

Department officials did not properly assess County fees or adequately monitor and enforce fee collection. We reviewed 35 cases (20 open cases and 15 closed cases) during our audit period to determine whether the Department followed local law and policy requirements for assessing supervision and alcohol and drug testing fees and enforcing collection of restitution and fees. These cases had court ordered restitution totaling $52,670 and fee assessments totaling $12,280. Our testing disclosed weak monitoring and enforcement of unpaid fees, instances where Department staff did not follow the policies, and numerous errors in the financial records. Officials did not establish adequate cash receipt and disbursement procedures. We reviewed all 210 cash receipts for July 2017 totaling $22,283 and found that they were deposited in a timely manner. However, the payment deposit reports were not signed by both the finance manager or clerk and receptionist for four days (21 percent of the 19 days tested). In addition, two receipts recorded on the manual log were $80 more than the amount recorded in the financial system and deposited. Finally, officials did not disburse more than $60,000 in restitution payments to crime victims. Department officials told us that they have not disbursed money from the victims trust account (VTA) since 2012 when they began using their current financial system because there are no procedures in place for disbursing these payments to victims. As a result, the VTA has $60,363 that remains idle while other victims' court-ordered restitution, some over 25 years old, remain unpaid.

Due to the District's well designed system of internal controls over claims processing, we performed limited testing to determine if these procedures were being followed consistently. We reviewed 79 of the 4,439 claims totaling $122,475 and found that control procedures were followed for all claims selected ensuring they were adequately documented, for appropriate purposes and were properly audited and approved prior to payment and in a timely manner. There were no recommendations as a result of this audit.

The Board adopted a fund balance policy in June 2011, which requires the Library to maintain unassigned fund balance at a minimum of 20 percent of general fund operating expenditures to guard against temporary revenue shortfalls or unpredicted expenditures. The policy also requires the Library to establish a plan to replenish unassigned fund balance should it fall below the minimum. However, the policy does not set a maximum for unassigned fund balance and does not address the other categories of fund balance reported by the Library, such as assigned or committed funds. From 2012-13 through 2016-17, the Library maintained unassigned fund balance of over 50 percent of operating expenditures, and as high as 65 percent, without a rationale to support the amounts in excess of the policy minimum of 20 percent, or the conditions under which excess funds will be used including a timeframe for using them. As of June 30, 2017, the level of unassigned fund balance totals almost $3.3 million, which represents 51 percent of the Library's operating expenditures, or 2.5 times the amount established by policy.

The District needs to improve its claims audit process to help ensure all claims are adequately documented and properly audited and approved before payment. The Board appointed a claims auditor to assume its powers and duties to examine and approve or disapprove claims. The claims auditor did not review the detailed, supporting documentation for all 17 health insurance claims paid during the audit period totaling $8.1 million. Although the Business Manager reviewed detailed support, the claims auditor was required to conduct an independent and thorough audit of the claims. In addition, the claims auditor did not audit and approve any of the 38 scholarship payments paid totaling $9,485 for 2016-17. Although the scholarship committee reviewed and approved the awards, the claims auditor was required to audit and approve the scholarship payments.

Total taxes collected for the years 2009 through 2014 were $8,890,255, of which $8,471,675 were collected by the Tax Collector (Collector) and $423,757 were collected by the District's bank. The Collector recorded that she collected $94,713 in cash. However, the Collector remitted $92,323 in cash collections to the Business Manager for deposit, resulting in a shortage of $2,390. The shortage occurred because the Collector did not record certain payments made by check and substituted the checks for the cash recorded but not remitted to the Business Manager for deposit. The Collector did not provide the Business Manager with sufficient records to identify these discrepancies when she turned over the collections for deposit or maintain sufficient records of collections. Furthermore, the Collector recorded $22,805 of cash payments for taxes due after the date that penalties would be assessed but did not record or remit the associated penalties. Because the Collector did not maintain accurate and complete records, we could not determine whether $456 of penalties that should have been paid for those taxes were actually collected. Additionally, the Collector accepted payments made by check after the date that penalties would be assessed but did not record the payment of penalties. Due to the lack of adequate records, it is unclear whether residents paid penalties in cash and the Collector did not record or remit them or whether the Collector waived penalties for those residents.

Based on the results of our review, except for certain matters, we found that the significant revenue and expenditure projections in the proposed budget appear reasonable. However, the City's fund balance policy states that the water, sewer and refuse funds should maintain unrestricted fund balance at a level needed to maintain positive cash balances throughout the year. City officials did not provide evidence that they prepared cash flow estimates for 2019, which would have allowed them to determine if unrestricted fund balance levels in these three funds were adequate. The Common Council also needs to consider whether the contingency appropriations are adequate if collective bargaining agreements are approved and unanticipated retirements occur. Finally, the proposed budget includes a property tax levy which is the maximum levy that the City can impose without the Common Council needing to override the tax levy limit.

Based on the results of our review, we found that the significant revenue and expenditure projections in the proposed budget are reasonable. The County's proposed budget complies with the property tax levy limit.

Although the Board adopted a purchasing policy that required using competition for purchases not subject to bidding requirements, the purchasing agent and claims auditor did not always ensure that purchases were made in compliance with the requirements. District officials made 40 purchases, of 77 reviewed, totaling approximately $184,000 without always obtaining or documenting price quotes as required by the purchasing policy. District officials told us that employees generally obtained quotes prior to making purchases but did not retain the required documentation. For nine purchases totaling $37,000, officials told us that they thought there was only one vendor capable of providing the item or service. However, they did not check whether there were other vendors selling the same products and services.

The District’s enrollment increased during the years prior to 2015-16 from an average of 384 students in 2012-13 to 465 in 2015-16. This resulted in additional revenue totaling $6.1 million. During this same time period, the District reported an operating surplus in each of the five years allowing the District to resolve the majority of its deficit. This was primarily due to the increase in students. While the District expenditures increased during their period of growth, they have remained relatively stable from 2014-15 to 2016-17. The operating surpluses allowed the District to reduce the fund balance deficit of $7.5 million to a deficit of $437,000. In an effort to meet SED regulations regarding maximum student teacher ratios, the District has begun reducing the number of students they are accepting. The average number of students for the 2017-18 fiscal year was 411 which will result in a corresponding reduction of revenues. For the 2017-18 fiscal year, the District adopted a budget of almost $26 million, which is consistent with expenditures for the past three years. As a special act district with no fund balance to rely on, there is a risk that the decreasing revenue without a corresponding reduction to expenditures may prevent the District from making a full financial recovery or cause the District financial condition to deteriorate.

The Board needs to improve its monitoring and oversight of the sewer fund’s financial condition. The Board routinely adopted budgets that were not reasonably estimated. This caused three years of operating deficits, which required the Board to make interfund transfers and temporarily borrow cash from the general fund to support sewer fund financial operations. While the Clerk-Treasurer prepared and provided monthly budget-to-actual status reports on the sewer fund’s activities to the Board, she did not include a cash flow analysis. In addition, because the Board did not annually audit the Clerk-Treasurer’s financial records, it did not identify errors or inaccuracies in the records. Finally, the Board did not develop and adopt multiyear capital and financial plans or receive comprehensive financial reports. Information about cash flows and comprehensive multiyear financial and capital plans, along with the statutorily required annual audit, would have provided the Board with better information to evaluate and manage sewer fund operations.

The Board did not effectively manage unrestricted fund balance. From fiscal years 2013 through 2017, the Town’s general fund balance increased by $624,571, from $292,780 to $917,351 (213 percent). The Town’s unrestricted fund balance grew from 19.54 percent of the ensuing year’s budgeted appropriations at fiscal year-end 2013 to 53.49 percent of the ensuing year’s budgeted appropriations at fiscal year-end 2017. Fund balance increased because the Town experienced operating surpluses, mostly in fiscal year 2015. While the Town experienced minor operating surpluses in the preceding and following fiscal years, it incurred a $355,158 operating surplus in 2015. The Town received $159,441 more in revenues and incurred $195,717 less in expenditures than anticipated. Further, contingency funds totaling $377,000 were left unused in fiscal years 2013 through 2017, significantly contributing to operating surpluses. The Board adopted a fund balance policy that allowed for unexpended surplus funds of up to 70 percent of annual expenditures. The policy was not comprehensive and did not define the time periods or means for which fund balance will be used and replenished. Finally, the Board also has not formalized comprehensive multiyear financial and capital plans specifying the Town’s objectives and goals for using accumulated funds.