We found that the Board could improve its oversight of the District's financial operations by updating District policies and procedures and then monitoring financial activities more closely to ensure that District personnel are adhering to its policies and procedures. The Board appointed a purchasing agent who presents them with purchasing recommendations. However, he does not provide the Board with the required quotes. When we asked the purchasing agent for this information, he stated that he does not retain the documentation. The District should have obtained multiple quotes in accordance with the purchasing policy for 11 purchases costing between $3,000 and $20,000, totaling $67,365. The District's procurement policy incorrectly exempts the District from seeking competition for professional services, with the exception of its statutorily-required annual audit – for which the policy appropriately requires a competitive request for proposal (RFP) at least every five years. We also found that the Board had not established a credit card policy that specifies authorized users, credit limits, types of purchases allowed, any required prior approval and documentation required to support each purchase. The District has not established written information technology (IT) policies or procedures for granting user access rights, has not developed formal back-up procedures or adopted an information breach notification policy. Finally, the Board had not adopted written procedures or proper internal controls over hall rentals.

The City's significant revenue and expenditure projections in the proposed budget are reasonable. The City faces potential increased salary costs when one of its expired collective bargaining agreements is settled. The City continues to budget minimal amounts for contingencies, which provides limited flexibility to address revenue shortfalls or unforeseen expenditures. The City's proposed budget complies with the property tax levy limit.

The County of Rockland, located in the downstate area and bordered by Orange, Putnam and Westchester counties, was authorized to issue debt not to exceed $96 million to liquidate the accumulated deficit in the County's general fund as of December 31, 2012. Additionally, Chapter 468 of the Laws of 2013 requires the County to submit to the State Comptroller each year, starting with the fiscal year during which it was authorized to issue obligations and for each subsequent fiscal year during which the deficit obligations are outstanding, its proposed budget for the next succeeding fiscal year. The significant revenue and expenditure projections in the proposed budget are reasonable. The County's proposed 2018 budget complies with the tax levy limit.

The Board did not provide adequate oversight of the Village's financial condition. The general fund's financial condition has been erratic, declining from $31,800 in 2014-15 to a $2,380 deficit in 2015-16 and then increasing to a surplus of $65,800 in 2016-17. Moreover, the general fund's reliance on water fund loans could adversely affect the water fund's financial condition in the next four years. This was driven primarily by the Board's reliance on fund balance as a financing source. The Mayor and Board also did not segregate the Clerk-Treasurer's duties over billing, cash collections and disbursements, or implement compensating controls over her incompatible financial duties. As a result, the Clerk-Treasurer did not always collect water rent and tax penalties or consistently enforce them. In addition, the Clerk-Treasurer disbursed payments before the Board approved them. Consequently, the Board has limited assurance that funds were used for legitimate Village purposes.

District officials did not establish effective procedures that ensured credit card claims were properly supported and for appropriate District purposes. The District has two credit cards, and the Commissioner, Chief, Secretary-Treasurer and fire personnel in travel status are authorized to use them. We tested all 22 credit card claims totaling $17,692 consisting of 38 purchases made during our audit period for both credit cards. We reviewed the claims packets that included the monthly credit card statement and supporting documentation. We found five purchases totaling $3,519 that did not have sufficient supporting documentation included with the claims packets but were still approved for payment by the Board. More specifically, these claim packets lacked itemized receipts. In addition, the Secretary-Treasurer did not reconcile monthly credit card statements to individual receipts. Finally, the District incurred $116 in late fees and $112 in finance charges because payments were not made timely.

The Town of Deerpark, located in Orange County, issued debt totaling $868,000 to liquidate the accumulated deficit in the Town's general fund as of December 31, 2008. New York State Local Finance Law requires all municipalities that have been authorized to issue obligations to fund operating deficits to submit their preliminary budgets for the next fiscal year to the State Comptroller for review while the deficit obligations are outstanding. Based on the results of our review, we found that revenue and expenditure projections in the proposed budget are reasonable. The Town's general fund balance has continued to increase for the past five years, from $898,669 to $1,459,107 (62 percent). This is a result of overestimating expenditures and underestimating revenues. The Town's preliminary budget complies with the property tax levy limit.

Contrary to Town Law, the Board does not have a current written contract with the East Kingston Fire Company (East Kingston) to provide fire protection services for the East Kingston Fire Protection District (District). The last written contract with East Kingston was in 2003. Without a written contract establishing levels of and provisions for service, Town officials were unable to access East Kingston's financial records to determine whether the amount being paid was appropriate and necessary. Town officials told us that the Town rarely received any financial records from East Kingston to be used as a basis for determining the amount that should be paid annually for fire protection services. The Supervisor provided us with documentation indicating that the Town has been attempting to gather information regarding East Kingston's actual expenditures, staffing levels and training for the past two years to assess whether it is capable of providing the services the Town is paying it for. Because the Town did not enter into a contract with the District, the District is working under the premise that East Kingston would assist the District if it needed help.The lack of a written contract between the Town and East Kingston has limited Town officials' recourse when East Kingston does not provide the expected fire protection services to Town residents. By not ensuring that the Town has a valid contract with provisions for reviewing the service provider's operations, the Board has not fulfilled its oversight responsibility and may put Town residents at risk of loss of property, life and finances.

The Board and Company officials did not provide adequate oversight of Company financial activities. The Board did not segregate the Treasurer's incompatible financial duties or provide any oversight of the Treasurer's work, such as reviewing monthly bills or the Treasurer's records. As a result, the Treasurer was able to inappropriately make $69,084 in unauthorized withdrawals and disbursements from September 2007 through 2014 without detection. The Treasurer withdrew $51,228 from the Company's bank account and made $4,100 unauthorized credit card purchases without Company approval or detection. The Treasurer also wrote $13,756 unauthorized checks that included $6,547 in unauthorized payments to herself, $4,735 in checks written to cash, $1,650 check disbursements for personal expenses and $825 in unauthorized payments to her husband, the Chief. We referred these audit findings to OSC's Division of Investigations. After we concluded our fieldwork, the Treasurer pleaded guilty in Columbia County Court to Falsifying Business Records in the First Degree and was sentenced in August 2017.

District officials have generally established effective payroll-related policies and procedures. However, they have not established formal and adequate policies and procedures related to the processing of payroll outside of normal pay dates such as when employees do not submit payroll information in a timely manner. Additionally, District officials did not develop policies or procedures related to the periodic review and reconciliation of payroll withholdings, deductions and contributions, to ensure accuracy. This review would include bi-weekly (or semi-monthly), quarterly and annual payroll reports.

Except for minor discrepancies, which we discussed with District officials, we found that claims were for appropriate purposes, adequately documented, properly audited and approved before payment. We commend District officials for establishing effective procedures for processing claims. Establishing and adhering to effective claims auditing procedures decreases the risk that errors or irregularities in processing and paying claims could occur and not be detected in a timely manner.

The Board did not ensure the Village's accounting records were current, complete and accurate, and that purchases were made in accordance with the procurement policy. For example, the Board has been aware that the Village's cash accounts have not been accurately reconciled since November 2011 when the Clerk-Treasurer took office and notified the Board that there were issues with the accounting software and the records. However, these issues are still occurring and the accounting records are not properly reconciled to the bank statements. Furthermore, the Village's procurement policy is outdated and the current process does not comply with the procedures outlined in the policy. As a result, the 27 disbursements totaling $356,000 that we reviewed did not have purchase requisition forms in accordance with their procurement policy and four of those were for services totaling $45,250 that did not have any documentation to support the rationale for the vendors chosen.

District officials did not always use competitive methods when procuring goods and services. The District did not use competitive bidding for purchases totaling $64,405 from two vendors. In addition, the District made payments totaling $231,174 to 20 vendors without obtaining the required number of quotes as required by the District's purchasing policy. The Board did not follow its own procurement policy because at the District's organizational meeting each year, the Board appointed specific vendors to provide goods and services for the year, without obtaining competition. As a result, the Board does not have adequate assurance that these goods and services were procured in the most economical manner. In addition, officials did not ensure that the District was incurring only necessary overtime costs. There is also no documented prior approval of overtime by a Board member for employees. Therefore, the Supervisor assigns his own overtime without Board approval.

The District does not provide or require employees to attend any formal cybersecurity awareness training. Employees do not comply with the District's acceptable use policy. Controls over personal, private and sensitive information (PPSI) collected, processed, transmitted and stored have not been developed. The District does not have service level agreements for services provided by Orange-Ulster Board of Cooperative Educational Services and Mid-Hudson Regional Information Center which could lead to confusion over roles and responsibilities of each party.

The Board did not establish adequate budgets and set long-term plans. The Board's financial planning was impaired, in part, because the Supervisor did not provide sufficient historical information or projections during the budget process. The Board also did not establish a level of acceptable fund balance or properly use money in the town-wide highway equipment reserve. As a result, there is an increased risk that unforeseen events could affect the Board's ability to provide necessary services.

We found that the significant revenue and expenditure projections in the tentative budget are reasonable. The Town's 2018 tentative budget complies with the property tax cap levy limit.

Significant revenue and expenditure projections in the proposed budget appear reasonable. City officials did not provide evidence that they prepared cash flow estimates for 2018, which would have allowed them to determine if unrestricted fund balance levels in the water, sewer and refuse funds were adequate. The Common Council needs to consider whether the contingency appropriations are adequate if collective bargaining agreements are approved and unanticipated retirements occur. The Common Council should ensure that the appropriation for police overtime is reasonable when adopting the final budget. The Common Council may need to increase sewer rent rates or decrease appropriations when adopting the final 2018 sewer fund budget. The City's proposed budget is in compliance with the property tax levy limit.

Significant revenue and expenditure projections in the proposed budget are reasonable. The proposed budget includes estimated revenues of $3.45 million for refuse and garbage fees to finance the City's waste and recycling services, but the Council has not yet authorized or approved a combined waste and recycling fee to realize the estimated revenues. All six of the City's collective bargaining agreements (CBAs) have expired and the City faces potential significant increased salary and wage cost when these agreements are settled. The City's proposed budget is in compliance with the property tax levy limit.

College officials need to improve safeguards over personal, private and sensitive information on College websites, applications and servers and ensure the data stored is adequately secured and protected against unauthorized use, access and loss. While College officials have taken steps to safeguard computerized data, we found unnecessary user accounts that were not disabled or removed and inadequate protection of server room equipment. Furthermore, the Board did not establish policies and procedures regarding breach notifications and disaster recovery plans. As a result, there is an increased risk that computerized equipment and data could be subject to unauthorized access and potential loss.

District officials did not always submit Form SA-16 promptly to ensure the timely receipt of transportation State aid. We reviewed all 19 of the District's new bus purchases during our audit period and found that District officials had submitted Form SA-16 to SED for 15 of the buses purchased. However, five of these were for buses purchased during the 2014-15 fiscal year, totaling $389,249, and weren't submitted until after our notification to the District of our intent to conduct a State aid audit. Additionally, District officials had not submitted Form SA-16 for four buses purchased during the 2016-17 fiscal year, totaling $308,545. We informed District officials during our audit fieldwork and they completed and submitted the paperwork to SED in May 2017. Had the District not submitted Form SA-16 for the nine buses in question they potentially may have lost approximately $400,000 in State aid, consisting of $136,245 that the District would have received during the 2015-16 through 2016-17 fiscal years and $264,133 that we project the District would receive during the 2017-18 through 2021-22 fiscal years.

While the Board has generally ensured that cash disbursements are adequately supported, for valid Authority purposes and properly recorded, it needs to improve the Authority's cash disbursements process to ensure that all aspects are properly performed. The Director, in his general management of the Authority's business affairs, approves purchases, audits all claims (after the account clerk assembles the claims packets and prepares the abstracts) and signs checks. The Assistant Director also audits the claims and countersigns the checks. However, these duties (i.e., approving purchases, auditing claims and signing checks) are incompatible because the Director has the ability to procure and pay for goods or services that may not be for valid Authority purposes. In addition, although the Director and Assistant Director manually sign many Authority checks, they also both have password-protected electronic signatures that are stored in the Authority's financial software. They authorized the account clerk to use their electronic signatures without their direct supervision.