We examined 59 purchases totaling approximately $1.4 million and found 17 purchases totaling approximately $124,000 showed no evidence quotes were obtained. For example, there was no evidence officials obtained quotes for trucking services costing $17,962, the purchase of a loader folding V-plow costing $19,999 or playground safety materials costing $4,875. We also reviewed 12 payments totaling approximately $938,600 that were subject to competitive bidding requirements and found that all payments complied with competitive bidding statutes and were for appropriate Village purposes. Village officials solicited competitive bids or purchased through county, Office of General Services or governmental group purchasing organization contracts. We also reviewed four professional service procurements totaling $62,000 and found no exceptions.

District officials did not adopt structurally balanced budgets and, instead, appropriated fund balance each year to finance recurring expenditures. For example, officials budgeted to appropriate more than $1.5 million in fund balance to finance operations in the 2018-19 budget when there was only $283,749 of available fund balance to appropriate. As a result, as of June 30, 2018, the fiscal year ended with an unassigned fund balance deficit of $1.2 million – a decrease of $3.3 million from June 30, 2015. Appropriating fund balance each year to help finance operations instead of using recurring revenues to finance recurring expenditures combined with unfavorable revenue and expenditure variances could eventually deplete fund balance to levels that are not sufficient to fund contingencies and amounts necessary for operational cash flow.

Village officials did not ensure that money received for ambulance services was properly recorded, reported and disbursed. As a result, as of May 31, 2018, the Village had a $16,100 unidentified cash balance in the ambulance fund. The unidentified balance resulted from an accumulation of errors since the ambulance fund's inception in December 2011. The Emergency Medical Services Manager did not report or allocate $22,573 of payments received from patients in his monthly reports and therefore the Treasurer did not remit these funds to the appropriate municipalities. Additionally, he incorrectly calculated and allocated service fees to the municipalities because he based them on each payment (including partial payments) made by patients instead of on each service call as required by the contract with the third-party billing service. This resulted in $4,414 in excess withholdings. Furthermore, mathematical errors in written checks and monthly reports led to overpayments of $5,821 to the municipalities. Finally, the Village paid $5,066 in refunds to patients and payments to collection agencies without appropriately deducting these amounts from payments to the applicable municipalities. These errors went undetected by Village officials because they did not perform monthly accountabilities.

We reviewed the Village's 22 bank accounts and determined seven bank accounts totaling $317,988 were for restricted purposes. We found that Village officials did not maintain documentation for the $317,988 of restricted donations. In addition, of the 22 Village bank accounts, two accounts totaling $149,510 are not for Village purposes, even though these accounts are held in the Village's name. For example, the Millbrook Restoration account, totaling $149,266, receives donations from a local not-for-profit and distributes the funds to Main Street businesses for the purpose of renovating storefronts. Officials stated they did not know what the distributed funds were used for, even though the Board approved vouchers for payments from the Millbrook Restoration account. The Clerk-Treasurer writes and signs these checks without appropriate documentation for the use of the funds. The Village's procurement policy excludes professional services and does not require competitive methods to be used when procuring these services. As a result, Village officials did not seek competition for 15 professional service providers paid almost $1.3 million. Officials did not seek competition, such as a request for proposal (RFP), for any of the providers. Furthermore, 13 of these providers, who were paid $355,520 for services, did not have written contracts with the Village. Officials did not adhere to New York State General Municipal Law regarding soliciting bids for purchases over $20,000 or public work contracts over $35,000. The Village made seven procurements requiring bidding totaling $395,123 during our audit period. We reviewed all seven procurements and found that the Board did not obtain bids for four purchases totaling $265,429 that required bidding.

The Safe Schools Against Violence in Education Act (SAVE Act) was enacted in July 2000 to provide a safe learning environment for all students in New York State. To comply with the SAVE Act, the New York State Education Department developed the Uniform Violent and Disruptive Incident Reporting System (VADIR) to collect annual data from school districts. In addition, the Dignity for All Students Act (DASA) seeks to provide a safe and supportive environment for all students, free from discrimination, harassment and bullying. District officials implemented several policies and procedures, such as a bullying chart, code of conduct and leadership class, to prevent, investigate, address and report incidents to ensure a safe and supportive educational environment. We reviewed all of the 173 reported Uniform Violent and Disruptive Incident Reporting System and Dignity for All Students Act incidents and found that District officials appropriately investigated, addressed and reported all incidents. There were no recommendations as a result of this audit. We commend District officials for appropriately preventing, investigating, addressing and reporting VADIR and DASA incidents.

From 2013 through 2017, unrestricted fund balance increased in the four operating funds by nearly 100 to 200 percent, which led to accumulating excessive fund balances in the general, highway, water district and sewer district funds. The Board has not adopted a fund balance policy that addresses reasonable levels of fund balance to be maintained in each fund. In addition, Town officials have not developed comprehensive, written multiyear financial and capital plans. The Board did not adequately segregate cash disbursement duties or implement compensating controls to ensure that one employee does not control all phases of a transaction. The Board did not audit, or cause an audit of, the records and reports of all officers or departments that received or disbursed money. Finally, the Board did not establish or approve the fee amounts charged to the individuals who require ambulance services.

The Board could improve the management of fund balance. Unassigned fund balance increased from $66,600 to $134,300 (102 percent) from 2014 to 2017, which left the District with enough fund balance to cover over three years' worth of expenditures. This increase was due to unrealistic expenditure estimates. On average, from 2014 to 2017, actual expenditures were 39 percent less than amounts budgeted. These variances occurred mainly because District officials overestimated equipment repairs and purchases by over $8,400 (79 percent) and pager and radio repairs and purchases by over $4,400 (89 percent) in each of those years. In addition, building repairs and maintenance were overestimated by almost $7,000 (93 percent) in 2014 through 2016 and utilities were overestimated by almost $5,000 (49 percent) in 2015 through 2017. We project that unassigned fund balance will increase another $19,500, to over $153,800, by fiscal year-end 2018 due to similarly overestimated expenditures. Furthermore, the Board has not established any formal reserves or adopted financial plans outlining a reasonable level of fund balance to be maintained or the funding and use of reserves. However, District officials informed us they were saving for capital improvements to the firehouse and future equipment purchases, as needed. Additionally, they anticipate purchasing new radios because of the County's new 911 system.

City officials did not adequately safeguard electronic access to the water system. The Water and Sewer Superintendent (Superintendent) did not establish a formal process for staying current on system cybersecurity threats; water plant officials do not receive alerts to such threats from key sources, including the U.S. Department of Homeland Security. Further, as of May 2018, the City was not in compliance with New York State Public Health Law to protect drinking water because its vulnerability assessment (a required part of the water supply emergency response plan due by January 1, 2018) was not filed with the State Department of Health until August 2018. We also found unnecessary software installed on all three computers connected to the water system network, even though the City's technology use policy does not allow non-City licensed software. In addition, the policy had not been updated since 2008. City and water plant officials also did not periodically review website content for inappropriate disclosure of water system information. We found content and system information posted by vendors that should have been deleted in 2013 or earlier. Finally, the Superintendent did not provide water plant personnel with job-specific cybersecurity training in recognizing and appropriately responding to suspicious system activity.

The City Bureau of Buildings (Bureau) has not developed written policies and procedures for managing elevator inspections. Therefore, the clerk who manages elevator inspections has not been provided guidelines and the data management system used by the Bureau is not complete and updated. Also, there are no formal processes for monitoring elevator inspections, following up on identified violations and verifying that violations are corrected in a timely manner. As a result, there are no systems to ensure that elevators (1) are inspected as required, (2) are adequately monitored to ensure they are safe and running properly, (3) with safety violations are re-inspected in a timely manner and (4) that administrative fees are collected. Therefore, there is inadequate assurance that elevators are safe and in satisfactory operating condition, and that the City has collected all revenue owed to it. Specifically, we found that although the City's Elevator Master List included 226 properties with 308 elevators and related equipment, our visits to 58 properties disclosed 141 elevators and related equipment that were not included. In addition, 75 of 85 property owners did not submit either six month or annual inspection reports. Also, violation notices were not sent to 68 (91 percent) of these property owners. Finally, Bureau officials did not follow up on violations/deficiencies on the inspection reports submitted by property owners. Serious elevator deficiencies included 35 instances and included violations such as no emergency phone and no fire extinguisher.

Although the Board adopted a policy for managing access to the network and the information system, College officials did not enforce the policy. Consequently, the College has 824 network user accounts that do not match current employees and have not been used within the last six months. Of these, 616 accounts have never been used and another 69 accounts have not been used in more than three years. Officials told us that some network accounts are limited to email access and others are kept active due to contractual requirement. In addition, while some employees recently attended general cybersecurity training, this training was not mandatory for all employees and did not cover techniques relevant to college systems and assets accessible by employees. Most notably, employees responsible for safeguarding the website generally were not required to attend the training and had not been formally trained on common web application risks such as code injection and authentication vulnerabilities. Finally, although College officials have no formal policies governing online banking, we found that they had effective informal procedures in place for secure online banking and fund transfers.

The Board and ski area officials have not developed policies or procedures for how ski collections should be recorded, deposited and reconciled. Furthermore, the Board did not develop, adopt or implement policies and procedures to provide guidance for ski area staff for issuing complimentary lift tickets and season passes. Ski area officials have not developed a process to compare the number of printed season passes with the number sold as recorded in the point-of-sale (POS) system. As a result, there is a risk that season passes could be printed and issued without the associated cash receipts being recorded and deposited. The ski area also issued 14,729 lift tickets and season passes during our audit period of which 2,427 of the four types of $0 transactions were recorded in the POS system. Ski area staff were not required to retain supporting documentation for any of these $0 transactions recorded in the POS system and officials had no procedures in place to reconcile the daily transactions and verify whether these transactions were legitimate. Due to the lack of supporting documentation and details in the POS system, we were unable to determine the legitimacy of 1,493 complimentary, five-day and 70-or-over transactions recorded in the POS system.

The Council has not adopted an acceptable use policy or implemented procedures to properly monitor computer use. We reviewed 11 computers for non-business use and found evidence of personal use on seven computers. Such use included personal email, personal banking, social networking, online shopping, browsing travel and entertainment websites and other questionable Internet use. In addition, City officials did not maintain an inventory of IT assets. Prior to our audit, the Network Administrator documented the location of IT assets on the purchase order/invoice at the time of purchase but did not maintain inventory records for all computer hardware, software and data. The Council and City officials also have not developed and adopted a breach notification policy or local law because they were unaware of this requirement. City employees were not provided with IT security awareness training. Finally, the Council and City officials have not developed and adopted a written disaster recovery plan.

We audited the administration of the agricultural, Persons 65 Years of Age or Older (senior citizens) and veterans real property tax exemptions. The Assessor granted these exemptions for 898 parcels on the 2017 assessment roll, which reduced the taxable assessed value among all taxing jurisdictions by about $179 million. We found exceptions with 84 of the 125 (67 percent) agricultural, senior citizens and veterans exemptions we reviewed. These exemptions lacked adequate supporting documentation to verify their eligibility. The properties with exceptions had their total taxable assessed value reduced by about $35.3 million. For example, we reviewed 50 properties receiving an agricultural exemption and found 45 lacked one or more pieces of supporting documentation necessary to verify their eligibility for the exemption. Only one of the properties contained an original application with income verification for an agricultural land exemption. All 20 of the properties we reviewed receiving a senior citizens exemption lacked one or more pieces of supporting documentation to verify the eligibility and accuracy of these exemptions. Specifically, all properties lacked proof of age eligibility, 18 lacked income support (e.g., income tax return), and two did not have a renewal form on file. We reviewed 55 properties receiving veterans exemptions and found 19 properties (35 percent) lacked one or more pieces of supporting documentation to verify the eligibility and accuracy of these exemptions. Eleven properties lacked an original application, 17 did not contain acceptable military records to prove honorable discharge, and one was lacking supporting documentation regarding disability.

The significant revenue projections in the proposed budget are reasonable. However, there were errors in the projections for expenditures that should be addressed prior to adoption of the budget. The City underestimated pension costs by $576,193. The proposed budget did not include $841,622 in general fund debt service that was on the City's debt schedule. Based on our projections, the amounts budgeted for police and firefighting overtime is likely underestimated by $830,000. City officials have not included adjustments for the amount of taxes estimated to be uncollected and unavailable to finance the budgetary appropriations. The City continues to budget minimal amounts for contingencies, which provides limited flexibility to address revenue shortfalls or unforeseen expenditures. The City faces potential increased salary costs when one of its expired collective bargaining agreements is settled. The City's proposed budget does not comply with the tax levy limit.

The District generally complied with New York State General Municipal Law and has established adequate procedures to procure goods and services not subject to competitive bidding. We reviewed the District's procurement of professional services from 26 providers paid $1.08 million and found, except for minor exceptions which we discussed with District officials, all providers were chosen through competitive methods. We also tested all purchases that required three written quotes totaling $224,086 and found that District officials obtained the required number of quotes or properly used State contracts. There were no recommendations as a result of this audit.

Despite the Board-adopted purchasing policy (policy) stating that the Board is responsible for ensuring procedures for the procurement of goods or services not subject to competitive bidding statutes be developed, District officials had not established or implemented any formal purchasing procedures. Additionally, because the Board did not annually review the policy as required, it did not ensure compliance with the policy. During audit fieldwork, District officials developed and the Board's audit and finance committee codified procedures in the District's purchasing and procurement regulations. We reviewed 60 purchases made during the audit period totaling $341,716 to determine whether District officials sought competition for purchases that fell below bidding thresholds. We found that 28 purchases (47 percent) totaling $152,001 were made without evidence that officials sought competition to obtain the lowest price. Inconsistencies in purchasing occurred because the Board did not ensure formal procedures were developed and provided to District officials and employees to follow when making purchases of goods and services under statutory bidding thresholds.

Department officials did not properly assess County fees or adequately monitor and enforce fee collection. We reviewed 35 cases (20 open cases and 15 closed cases) during our audit period to determine whether the Department followed local law and policy requirements for assessing supervision and alcohol and drug testing fees and enforcing collection of restitution and fees. These cases had court ordered restitution totaling $52,670 and fee assessments totaling $12,280. Our testing disclosed weak monitoring and enforcement of unpaid fees, instances where Department staff did not follow the policies, and numerous errors in the financial records. Officials did not establish adequate cash receipt and disbursement procedures. We reviewed all 210 cash receipts for July 2017 totaling $22,283 and found that they were deposited in a timely manner. However, the payment deposit reports were not signed by both the finance manager or clerk and receptionist for four days (21 percent of the 19 days tested). In addition, two receipts recorded on the manual log were $80 more than the amount recorded in the financial system and deposited. Finally, officials did not disburse more than $60,000 in restitution payments to crime victims. Department officials told us that they have not disbursed money from the victims trust account (VTA) since 2012 when they began using their current financial system because there are no procedures in place for disbursing these payments to victims. As a result, the VTA has $60,363 that remains idle while other victims' court-ordered restitution, some over 25 years old, remain unpaid.

Due to the District's well designed system of internal controls over claims processing, we performed limited testing to determine if these procedures were being followed consistently. We reviewed 79 of the 4,439 claims totaling $122,475 and found that control procedures were followed for all claims selected ensuring they were adequately documented, for appropriate purposes and were properly audited and approved prior to payment and in a timely manner. There were no recommendations as a result of this audit.

The Board adopted a fund balance policy in June 2011, which requires the Library to maintain unassigned fund balance at a minimum of 20 percent of general fund operating expenditures to guard against temporary revenue shortfalls or unpredicted expenditures. The policy also requires the Library to establish a plan to replenish unassigned fund balance should it fall below the minimum. However, the policy does not set a maximum for unassigned fund balance and does not address the other categories of fund balance reported by the Library, such as assigned or committed funds. From 2012-13 through 2016-17, the Library maintained unassigned fund balance of over 50 percent of operating expenditures, and as high as 65 percent, without a rationale to support the amounts in excess of the policy minimum of 20 percent, or the conditions under which excess funds will be used including a timeframe for using them. As of June 30, 2017, the level of unassigned fund balance totals almost $3.3 million, which represents 51 percent of the Library's operating expenditures, or 2.5 times the amount established by policy.

The District needs to improve its claims audit process to help ensure all claims are adequately documented and properly audited and approved before payment. The Board appointed a claims auditor to assume its powers and duties to examine and approve or disapprove claims. The claims auditor did not review the detailed, supporting documentation for all 17 health insurance claims paid during the audit period totaling $8.1 million. Although the Business Manager reviewed detailed support, the claims auditor was required to conduct an independent and thorough audit of the claims. In addition, the claims auditor did not audit and approve any of the 38 scholarship payments paid totaling $9,485 for 2016-17. Although the scholarship committee reviewed and approved the awards, the claims auditor was required to audit and approve the scholarship payments.