District officials did not seek competition for professional services obtained from seven providers who were paid a total of $172,184 in 2016-17. In addition, District officials did not require written quote documentation for purchases from 11 purchase contract vendors totaling $91,585 and four public work contract vendors totaling $27,319 in 2016-17. Finally, the Board did not appoint an independent claims auditor. The appointed claims auditor is not independent because she is a current District employee serving as a secretary in the District office and as the extra-classroom activities treasurer. Within these other duties, the claims auditor enters requisitions and receives goods which makes her directly involved in the purchasing process and in conflict with Education Law.

The District has maintained its unrestricted fund balance at the 4 percent statutory limit for the last three completed fiscal years (2014-15 through 2016-17). However, during the past two years, the District's total fund balance has increased nearly $1.66 million, or 43 percent (from $3.88 million to $5.54 million). The District allocated most of the fund balance increase to its reserve funds (restricted fund balance), which have increased 65 percent or $1.50 million (from $2.31 million to $3.81 million) during the same period. Fuel inventory reconciliations were not documented or reviewed. The secretary performs periodic fuel inventory reconciliations. She stick measures the two fuel tanks and then compares the readings for both diesel fuel and gasoline to the system's balance. However, the secretary did not retain system reports used to perform the reconciliations or document the results of the reconciliations. In addition, District officials do not regularly review fuel usage reports for reasonableness to help ensure that fuel was used for District purposes.

Although the Board received monthly budget-to-actual reports, it did not request or review monthly cash flow reports or assign a library official to review the supporting documents (e.g., bank reconciliations, bank statements or canceled check images). As a result, the Board has limited means of knowing whether transactions are properly recorded. The Board also did not audit all claims prior to payment. The Board has not adopted a policy to address the accrual and use of compensatory time for management confidential employees and guidelines instituted by the Director have not been clearly communicated to the Board or Library staff. In addition, based on our testing, Library officials did not always follow the collective bargaining agreement or employee handbook for vacation accrual for employees, and management confidential employees received vacation accrual benefits that were not Board-approved.

District officials balanced the best interests of students and program costs when they decided to keep certain special education classes in-house or to use Sullivan County Board of Cooperative Educational Services (BOCES) services. We found that District expenditures were $607,000 less by providing classes in-house. In addition, the District regularly participated with the Downsville Central School District (Downsville CSD) in a special education student exchange program (sharing) where each district sent students to the other to attend special education classes. From 2014-15 through 2017-18, Downsville CSD officials sent 18 more students to the District for classes than the number of students they accepted from the District. This has not created additional expenditures for the District, because the Downsville CSD students were placed into existing classes. Finally, the District reduced expenditures by approximately $364,000 or 44 percent over the past four years by sharing the Superintendent's position with Downsville CSD and by approximately $156,000 or 36 percent over the past three years by sharing the Business Official's position with Livingston Manor CSD.

We examined 59 purchases totaling approximately $1.4 million and found 17 purchases totaling approximately $124,000 showed no evidence quotes were obtained. For example, there was no evidence officials obtained quotes for trucking services costing $17,962, the purchase of a loader folding V-plow costing $19,999 or playground safety materials costing $4,875. We also reviewed 12 payments totaling approximately $938,600 that were subject to competitive bidding requirements and found that all payments complied with competitive bidding statutes and were for appropriate Village purposes. Village officials solicited competitive bids or purchased through county, Office of General Services or governmental group purchasing organization contracts. We also reviewed four professional service procurements totaling $62,000 and found no exceptions.

District officials did not adopt structurally balanced budgets and, instead, appropriated fund balance each year to finance recurring expenditures. For example, officials budgeted to appropriate more than $1.5 million in fund balance to finance operations in the 2018-19 budget when there was only $283,749 of available fund balance to appropriate. As a result, as of June 30, 2018, the fiscal year ended with an unassigned fund balance deficit of $1.2 million – a decrease of $3.3 million from June 30, 2015. Appropriating fund balance each year to help finance operations instead of using recurring revenues to finance recurring expenditures combined with unfavorable revenue and expenditure variances could eventually deplete fund balance to levels that are not sufficient to fund contingencies and amounts necessary for operational cash flow.

Village officials did not ensure that money received for ambulance services was properly recorded, reported and disbursed. As a result, as of May 31, 2018, the Village had a $16,100 unidentified cash balance in the ambulance fund. The unidentified balance resulted from an accumulation of errors since the ambulance fund's inception in December 2011. The Emergency Medical Services Manager did not report or allocate $22,573 of payments received from patients in his monthly reports and therefore the Treasurer did not remit these funds to the appropriate municipalities. Additionally, he incorrectly calculated and allocated service fees to the municipalities because he based them on each payment (including partial payments) made by patients instead of on each service call as required by the contract with the third-party billing service. This resulted in $4,414 in excess withholdings. Furthermore, mathematical errors in written checks and monthly reports led to overpayments of $5,821 to the municipalities. Finally, the Village paid $5,066 in refunds to patients and payments to collection agencies without appropriately deducting these amounts from payments to the applicable municipalities. These errors went undetected by Village officials because they did not perform monthly accountabilities.

We reviewed the Village's 22 bank accounts and determined seven bank accounts totaling $317,988 were for restricted purposes. We found that Village officials did not maintain documentation for the $317,988 of restricted donations. In addition, of the 22 Village bank accounts, two accounts totaling $149,510 are not for Village purposes, even though these accounts are held in the Village's name. For example, the Millbrook Restoration account, totaling $149,266, receives donations from a local not-for-profit and distributes the funds to Main Street businesses for the purpose of renovating storefronts. Officials stated they did not know what the distributed funds were used for, even though the Board approved vouchers for payments from the Millbrook Restoration account. The Clerk-Treasurer writes and signs these checks without appropriate documentation for the use of the funds. The Village's procurement policy excludes professional services and does not require competitive methods to be used when procuring these services. As a result, Village officials did not seek competition for 15 professional service providers paid almost $1.3 million. Officials did not seek competition, such as a request for proposal (RFP), for any of the providers. Furthermore, 13 of these providers, who were paid $355,520 for services, did not have written contracts with the Village. Officials did not adhere to New York State General Municipal Law regarding soliciting bids for purchases over $20,000 or public work contracts over $35,000. The Village made seven procurements requiring bidding totaling $395,123 during our audit period. We reviewed all seven procurements and found that the Board did not obtain bids for four purchases totaling $265,429 that required bidding.

The Safe Schools Against Violence in Education Act (SAVE Act) was enacted in July 2000 to provide a safe learning environment for all students in New York State. To comply with the SAVE Act, the New York State Education Department developed the Uniform Violent and Disruptive Incident Reporting System (VADIR) to collect annual data from school districts. In addition, the Dignity for All Students Act (DASA) seeks to provide a safe and supportive environment for all students, free from discrimination, harassment and bullying. District officials implemented several policies and procedures, such as a bullying chart, code of conduct and leadership class, to prevent, investigate, address and report incidents to ensure a safe and supportive educational environment. We reviewed all of the 173 reported Uniform Violent and Disruptive Incident Reporting System and Dignity for All Students Act incidents and found that District officials appropriately investigated, addressed and reported all incidents. There were no recommendations as a result of this audit. We commend District officials for appropriately preventing, investigating, addressing and reporting VADIR and DASA incidents.

From 2013 through 2017, unrestricted fund balance increased in the four operating funds by nearly 100 to 200 percent, which led to accumulating excessive fund balances in the general, highway, water district and sewer district funds. The Board has not adopted a fund balance policy that addresses reasonable levels of fund balance to be maintained in each fund. In addition, Town officials have not developed comprehensive, written multiyear financial and capital plans. The Board did not adequately segregate cash disbursement duties or implement compensating controls to ensure that one employee does not control all phases of a transaction. The Board did not audit, or cause an audit of, the records and reports of all officers or departments that received or disbursed money. Finally, the Board did not establish or approve the fee amounts charged to the individuals who require ambulance services.

The Board could improve the management of fund balance. Unassigned fund balance increased from $66,600 to $134,300 (102 percent) from 2014 to 2017, which left the District with enough fund balance to cover over three years' worth of expenditures. This increase was due to unrealistic expenditure estimates. On average, from 2014 to 2017, actual expenditures were 39 percent less than amounts budgeted. These variances occurred mainly because District officials overestimated equipment repairs and purchases by over $8,400 (79 percent) and pager and radio repairs and purchases by over $4,400 (89 percent) in each of those years. In addition, building repairs and maintenance were overestimated by almost $7,000 (93 percent) in 2014 through 2016 and utilities were overestimated by almost $5,000 (49 percent) in 2015 through 2017. We project that unassigned fund balance will increase another $19,500, to over $153,800, by fiscal year-end 2018 due to similarly overestimated expenditures. Furthermore, the Board has not established any formal reserves or adopted financial plans outlining a reasonable level of fund balance to be maintained or the funding and use of reserves. However, District officials informed us they were saving for capital improvements to the firehouse and future equipment purchases, as needed. Additionally, they anticipate purchasing new radios because of the County's new 911 system.

City officials did not adequately safeguard electronic access to the water system. The Water and Sewer Superintendent (Superintendent) did not establish a formal process for staying current on system cybersecurity threats; water plant officials do not receive alerts to such threats from key sources, including the U.S. Department of Homeland Security. Further, as of May 2018, the City was not in compliance with New York State Public Health Law to protect drinking water because its vulnerability assessment (a required part of the water supply emergency response plan due by January 1, 2018) was not filed with the State Department of Health until August 2018. We also found unnecessary software installed on all three computers connected to the water system network, even though the City's technology use policy does not allow non-City licensed software. In addition, the policy had not been updated since 2008. City and water plant officials also did not periodically review website content for inappropriate disclosure of water system information. We found content and system information posted by vendors that should have been deleted in 2013 or earlier. Finally, the Superintendent did not provide water plant personnel with job-specific cybersecurity training in recognizing and appropriately responding to suspicious system activity.

The City Bureau of Buildings (Bureau) has not developed written policies and procedures for managing elevator inspections. Therefore, the clerk who manages elevator inspections has not been provided guidelines and the data management system used by the Bureau is not complete and updated. Also, there are no formal processes for monitoring elevator inspections, following up on identified violations and verifying that violations are corrected in a timely manner. As a result, there are no systems to ensure that elevators (1) are inspected as required, (2) are adequately monitored to ensure they are safe and running properly, (3) with safety violations are re-inspected in a timely manner and (4) that administrative fees are collected. Therefore, there is inadequate assurance that elevators are safe and in satisfactory operating condition, and that the City has collected all revenue owed to it. Specifically, we found that although the City's Elevator Master List included 226 properties with 308 elevators and related equipment, our visits to 58 properties disclosed 141 elevators and related equipment that were not included. In addition, 75 of 85 property owners did not submit either six month or annual inspection reports. Also, violation notices were not sent to 68 (91 percent) of these property owners. Finally, Bureau officials did not follow up on violations/deficiencies on the inspection reports submitted by property owners. Serious elevator deficiencies included 35 instances and included violations such as no emergency phone and no fire extinguisher.

Although the Board adopted a policy for managing access to the network and the information system, College officials did not enforce the policy. Consequently, the College has 824 network user accounts that do not match current employees and have not been used within the last six months. Of these, 616 accounts have never been used and another 69 accounts have not been used in more than three years. Officials told us that some network accounts are limited to email access and others are kept active due to contractual requirement. In addition, while some employees recently attended general cybersecurity training, this training was not mandatory for all employees and did not cover techniques relevant to college systems and assets accessible by employees. Most notably, employees responsible for safeguarding the website generally were not required to attend the training and had not been formally trained on common web application risks such as code injection and authentication vulnerabilities. Finally, although College officials have no formal policies governing online banking, we found that they had effective informal procedures in place for secure online banking and fund transfers.

The Board and ski area officials have not developed policies or procedures for how ski collections should be recorded, deposited and reconciled. Furthermore, the Board did not develop, adopt or implement policies and procedures to provide guidance for ski area staff for issuing complimentary lift tickets and season passes. Ski area officials have not developed a process to compare the number of printed season passes with the number sold as recorded in the point-of-sale (POS) system. As a result, there is a risk that season passes could be printed and issued without the associated cash receipts being recorded and deposited. The ski area also issued 14,729 lift tickets and season passes during our audit period of which 2,427 of the four types of $0 transactions were recorded in the POS system. Ski area staff were not required to retain supporting documentation for any of these $0 transactions recorded in the POS system and officials had no procedures in place to reconcile the daily transactions and verify whether these transactions were legitimate. Due to the lack of supporting documentation and details in the POS system, we were unable to determine the legitimacy of 1,493 complimentary, five-day and 70-or-over transactions recorded in the POS system.

The Council has not adopted an acceptable use policy or implemented procedures to properly monitor computer use. We reviewed 11 computers for non-business use and found evidence of personal use on seven computers. Such use included personal email, personal banking, social networking, online shopping, browsing travel and entertainment websites and other questionable Internet use. In addition, City officials did not maintain an inventory of IT assets. Prior to our audit, the Network Administrator documented the location of IT assets on the purchase order/invoice at the time of purchase but did not maintain inventory records for all computer hardware, software and data. The Council and City officials also have not developed and adopted a breach notification policy or local law because they were unaware of this requirement. City employees were not provided with IT security awareness training. Finally, the Council and City officials have not developed and adopted a written disaster recovery plan.

We audited the administration of the agricultural, Persons 65 Years of Age or Older (senior citizens) and veterans real property tax exemptions. The Assessor granted these exemptions for 898 parcels on the 2017 assessment roll, which reduced the taxable assessed value among all taxing jurisdictions by about $179 million. We found exceptions with 84 of the 125 (67 percent) agricultural, senior citizens and veterans exemptions we reviewed. These exemptions lacked adequate supporting documentation to verify their eligibility. The properties with exceptions had their total taxable assessed value reduced by about $35.3 million. For example, we reviewed 50 properties receiving an agricultural exemption and found 45 lacked one or more pieces of supporting documentation necessary to verify their eligibility for the exemption. Only one of the properties contained an original application with income verification for an agricultural land exemption. All 20 of the properties we reviewed receiving a senior citizens exemption lacked one or more pieces of supporting documentation to verify the eligibility and accuracy of these exemptions. Specifically, all properties lacked proof of age eligibility, 18 lacked income support (e.g., income tax return), and two did not have a renewal form on file. We reviewed 55 properties receiving veterans exemptions and found 19 properties (35 percent) lacked one or more pieces of supporting documentation to verify the eligibility and accuracy of these exemptions. Eleven properties lacked an original application, 17 did not contain acceptable military records to prove honorable discharge, and one was lacking supporting documentation regarding disability.

The significant revenue projections in the proposed budget are reasonable. However, there were errors in the projections for expenditures that should be addressed prior to adoption of the budget. The City underestimated pension costs by $576,193. The proposed budget did not include $841,622 in general fund debt service that was on the City's debt schedule. Based on our projections, the amounts budgeted for police and firefighting overtime is likely underestimated by $830,000. City officials have not included adjustments for the amount of taxes estimated to be uncollected and unavailable to finance the budgetary appropriations. The City continues to budget minimal amounts for contingencies, which provides limited flexibility to address revenue shortfalls or unforeseen expenditures. The City faces potential increased salary costs when one of its expired collective bargaining agreements is settled. The City's proposed budget does not comply with the tax levy limit.

The District generally complied with New York State General Municipal Law and has established adequate procedures to procure goods and services not subject to competitive bidding. We reviewed the District's procurement of professional services from 26 providers paid $1.08 million and found, except for minor exceptions which we discussed with District officials, all providers were chosen through competitive methods. We also tested all purchases that required three written quotes totaling $224,086 and found that District officials obtained the required number of quotes or properly used State contracts. There were no recommendations as a result of this audit.

Despite the Board-adopted purchasing policy (policy) stating that the Board is responsible for ensuring procedures for the procurement of goods or services not subject to competitive bidding statutes be developed, District officials had not established or implemented any formal purchasing procedures. Additionally, because the Board did not annually review the policy as required, it did not ensure compliance with the policy. During audit fieldwork, District officials developed and the Board's audit and finance committee codified procedures in the District's purchasing and procurement regulations. We reviewed 60 purchases made during the audit period totaling $341,716 to determine whether District officials sought competition for purchases that fell below bidding thresholds. We found that 28 purchases (47 percent) totaling $152,001 were made without evidence that officials sought competition to obtain the lowest price. Inconsistencies in purchasing occurred because the Board did not ensure formal procedures were developed and provided to District officials and employees to follow when making purchases of goods and services under statutory bidding thresholds.