We attempted to trace the 53 assets to their locations to determine whether they were in the District's possession and appropriately tagged. While we were able to locate and identify 39 of these assets, we were unable to locate 14 assets totaling $17,402 because either the asset was in the possession of a teacher on summer vacation, lacked a serial number and inventory tag or had a serial number that did not agree with the invoice. None of the 39 assets valued at $242,673 that we located were tagged. Officials told us that the provider comes to their location every five years to tag the assets and their next visit is scheduled for 2019. The process of tagging assets only once in five years is inadequate. Computer equipment, for example, is valuable when it is new and should be tagged as District property. However, by the time it is five years old it is of little value leaving little point to tagging it as District property. Additionally, because the Business Administrator was unaware that the policy assigned the business office as property control manager, a current up-to-date asset list was not maintained. Although we did not find any indication of fraud, without an accurate and up-to-date asset list officials cannot be sure that assets are protected against loss or unauthorized use and that the District is not incurring unnecessary insurance costs.

Cash receipt and disbursement duties were not adequately segregated and mitigating controls were not implemented. The Treasurer performed all cash receipt and cash disbursement duties. Fundraising revenues of more than $8,400 were deposited between 26 and 59 days after collection. More than $2,000 from the chicken barbeque was deposited over two months later, while more than $6,000 from food sales was deposited three weeks after it was collected. Therefore, the Treasurer had more than $8,400 located at her home during this time. The Treasurer told us that she was waiting for the membership to decide which account should receive the money. Finally, meeting minutes did not always contain adequate information regarding bills approved for payment.

The Board has not updated its purchasing procedures since 2010 to ensure that the procedures are still appropriate and the policy is enforced. As a result, District officials did not always comply with the District's purchasing policy. We reviewed 93 invoices totaling $134,876 and found that 12 invoices totaling $14,088 did not have the required quotes. For example, the District paid one invoice totaling $975 for printing services without the required two quotes. In another instance, office furniture was purchased totaling $2,404 without obtaining quotes. District officials and employees involved in the purchasing process did not always enforce the District's policies and procedures, and did not document their reasons for not soliciting written quotations.

The District's credit card policy states that receipts for all credit card purchases must be attached to a requisition form and submitted to the Board. We found that District officials did not establish effective procedures that ensured credit card claims were properly supported and for appropriate District purposes. Of the 240 credit card purchases totaling $69,465 made during our audit period, 60 purchases totaling $10,306 (15 percent) did not have adequate supporting documentation attached to the claims. In addition, the credit card policy did not establish written policies and procedures for monitoring gasoline credit card use. As a result, we found that of 389 gasoline credit card purchases, totaling $18,849 for over 6,000 gallons of unleaded gasoline, 195 purchases totaling $9,686 (51 percent) did not have original receipts.

The Board did not adequately segregate financial duties and did not provide sufficient oversight or compensating controls such as designating someone to review bank reconciliations and other supporting documentation. The Board also did not adopt any policies outlining the cash receipt duties of the Clerk and Treasurer and has not implemented sufficient monitoring procedures for the cash receipt process. In addition, the Treasurer, Clerk and a Board member shared passwords accessing the computerized central accounting records and the water and sewer program. Finally, the Board did not annually audit the Treasurer's books and records.

The Clerk-Treasurer and Deputy Clerk-Treasurer perform all of the cash receipts and disbursements duties, such as billing water and sewer rents, collecting and depositing receipts, recording transactions, processing payroll, preparing and disbursing checks and reconciling bank statements. Although the Mayor periodically reviews the accounting records and the Board receives monthly budget-to-actual reports, no one reviews bank reconciliations or canceled check images to ensure all disbursements made were Board-approved and for proper Village purposes. Furthermore, there is no routine review of cash receipts activity by someone independent of the collections process. Lastly, the Board did not annually audit the Clerk-Treasurer's annual financial report and supporting records. Finally, the Clerk-Treasurer has accrued compensatory time in excess of the 80-hour maximum, worth approximately $23,600. Furthermore, the two employees ineligible for comp time accrued over 90 hours of comp time, approximately $1,900 at their current pay rates.

The School does not provide or require employees to attend any cybersecurity awareness training. In addition, our review of 11 District computers identified personal Internet use on seven computers including activities such as online shopping, personal email, web searches for non-School related subjects such as job openings and real estate, and signing on to a non-School guest network. We also found that virus protection was installed and available on all 11 computers in our sample. However, one computer did not have the installed virus protection activated and two computers had not been scanned for viruses in 30 and 44 days, respectively. Finally, School officials have not established a classification scheme for personal, private and sensitive information (PPSI). As a result, they have not assigned a security level to that data. School officials do not know what PPSI has been retained, where it is located, who has accessed it and whether it has been disposed of.

The Town granted a total of 1,421 agricultural, veteran and senior citizen exemptions on the 2017 assessment roll, collectively reducing the taxable assessed values for the Town, County and school districts by a combined total of more than $86 million. The total exempted value for these categories is almost 8 percent of the Town's 2017 assessed value used for levying the 2018 County and Town taxes and the 2017-18 school taxes. Of the 167 granted exemptions we reviewed totaling $13.3 million, we found 54 (32 percent) of the exemptions, valued at more than $6.6 million, lacked one or more pieces of supporting documentation to verify the eligibility of these exemptions and/or were incorrectly calculated. For example, all 23 properties we reviewed receiving an agricultural exemption, totaling $6.2 million, lacked one or more pieces of supporting documentation to verify the eligibility of the exemption.

Although the Board annually adopted energy program guidelines establishing rates and eligibility criteria, Board of Public Utilities (BPU) management did not implement procedures to ensure that all rebates and credits were accurately processed in accordance with these guidelines and management did not provide sufficient oversight. Twenty-six applications for energy rebates totaling $127,000 did not have sufficient technical documentation attached and 25 totaling $150,876 did not have required documentation to clearly identify the type and/or quantity of materials purchased. Finally, recycling credits were not processed accurately resulting in 1,004 customer accounts being under credited by $2,050 over a six-month period.

Payroll duties were not adequately segregated due to the Village's limited staff. Also, the Board does not collectively set and approve pay rates and salaries for part-time employees and the Superintendent. Instead, the Mayor sets these pay rates. We also determined the Clerk did not deduct required health insurance contributions totaling $5,392 from the Superintendent's gross pay for the period March 2016 through February 2018. As a result, the Village incurred additional costs by paying the Superintendent's portion of the premium. The Superintendent also did not maintain his leave accruals according to the compensation agreement and employee handbook. Finally, the Clerk did not maintain adequate accounting records and failed to provide financial information to the Board.

The Treasurer's duties are not properly segregated. The Treasurer is permitted to perform all financial duties with no oversight and, in some instances, without a claims audit. District officials do not review bank statements and canceled check images or certify payroll. The Board and District officials did not provide adequate oversight over disbursements. We reviewed 46 non-payroll disbursements totaling $531,934 and determined 19 (41 percent) totaling $233,492 did not include any Board members' initials to indicate they were audited. The remaining 27 claims totaling $298,442 that had initials did not include dates to determine when the claims audit had occurred. We also reviewed 76 payroll transactions totaling $113,485 and found the Principal had not certified any of them. Finally, the Board did not comply with Local Finance Law (LFL) when authorizing $220,000 of borrowing using a line of credit. School districts are not authorized by LFL to borrow by establishing a line of credit with a bank.

The County's financial condition has been deficient for a number of years, including our audit period (fiscal years ending December 31, 2014 through 2017). We project that the County will end 2018 in a similar position based on the four-year trend and information available at the completion of our fieldwork. The County's financial condition has improved slightly over the audit period as evidenced by the gradual decreases in the amounts of annual short-term debt and interfold advances used to address cash flow shortages. However, this improvement was largely the result of one-time revenues or fund balance increases that are unlikely to recur. Without identifying ways to significantly reduce expenditures or increase recurring revenues, the County will continue to have significant cash flow concerns that necessitate the use of short-term debt and interfold advances, and limit its ability to restore fund balances to reasonable levels. For example, the County's combined funds' available fund balance as of December 31, 2017 totaled only $1.9 million or .13 percent of gross expenditures.

District officials did not seek competition for professional services obtained from seven providers who were paid a total of $172,184 in 2016-17. In addition, District officials did not require written quote documentation for purchases from 11 purchase contract vendors totaling $91,585 and four public work contract vendors totaling $27,319 in 2016-17. Finally, the Board did not appoint an independent claims auditor. The appointed claims auditor is not independent because she is a current District employee serving as a secretary in the District office and as the extra-classroom activities treasurer. Within these other duties, the claims auditor enters requisitions and receives goods which makes her directly involved in the purchasing process and in conflict with Education Law.

The Board adopted insufficient credit card and meal reimbursement policies and did not enforce the procurement policy. The March 2017 credit card bill included a $288 charge for the Supervisor's personal cable bill. In May 2018, during our audit, the Supervisor reimbursed the Town for this personal credit card charge. The Board approved 19 vouchers totaling over $10,800 without sufficient supporting documentation. We also question the appropriateness of 31 vouchers totaling over $1,300 for food, drinks and tableware.

Although the Board received monthly budget-to-actual reports, it did not request or review monthly cash flow reports or assign a library official to review the supporting documents (e.g., bank reconciliations, bank statements or canceled check images). As a result, the Board has limited means of knowing whether transactions are properly recorded. The Board also did not audit all claims prior to payment. The Board has not adopted a policy to address the accrual and use of compensatory time for management confidential employees and guidelines instituted by the Director have not been clearly communicated to the Board or Library staff. In addition, based on our testing, Library officials did not always follow the collective bargaining agreement or employee handbook for vacation accrual for employees, and management confidential employees received vacation accrual benefits that were not Board-approved.

District officials balanced the best interests of students and program costs when they decided to keep certain special education classes in-house or to use Sullivan County Board of Cooperative Educational Services (BOCES) services. We found that District expenditures were $607,000 less by providing classes in-house. In addition, the District regularly participated with the Downsville Central School District (Downsville CSD) in a special education student exchange program (sharing) where each district sent students to the other to attend special education classes. From 2014-15 through 2017-18, Downsville CSD officials sent 18 more students to the District for classes than the number of students they accepted from the District. This has not created additional expenditures for the District, because the Downsville CSD students were placed into existing classes. Finally, the District reduced expenditures by approximately $364,000 or 44 percent over the past four years by sharing the Superintendent's position with Downsville CSD and by approximately $156,000 or 36 percent over the past three years by sharing the Business Official's position with Livingston Manor CSD.

The District has maintained its unrestricted fund balance at the 4 percent statutory limit for the last three completed fiscal years (2014-15 through 2016-17). However, during the past two years, the District's total fund balance has increased nearly $1.66 million, or 43 percent (from $3.88 million to $5.54 million). The District allocated most of the fund balance increase to its reserve funds (restricted fund balance), which have increased 65 percent or $1.50 million (from $2.31 million to $3.81 million) during the same period. Fuel inventory reconciliations were not documented or reviewed. The secretary performs periodic fuel inventory reconciliations. She stick measures the two fuel tanks and then compares the readings for both diesel fuel and gasoline to the system's balance. However, the secretary did not retain system reports used to perform the reconciliations or document the results of the reconciliations. In addition, District officials do not regularly review fuel usage reports for reasonableness to help ensure that fuel was used for District purposes.

The Board and ski area officials have not developed policies or procedures for how ski collections should be recorded, deposited and reconciled. Furthermore, the Board did not develop, adopt or implement policies and procedures to provide guidance for ski area staff for issuing complimentary lift tickets and season passes. Ski area officials have not developed a process to compare the number of printed season passes with the number sold as recorded in the point-of-sale (POS) system. As a result, there is a risk that season passes could be printed and issued without the associated cash receipts being recorded and deposited. The ski area also issued 14,729 lift tickets and season passes during our audit period of which 2,427 of the four types of $0 transactions were recorded in the POS system. Ski area staff were not required to retain supporting documentation for any of these $0 transactions recorded in the POS system and officials had no procedures in place to reconcile the daily transactions and verify whether these transactions were legitimate. Due to the lack of supporting documentation and details in the POS system, we were unable to determine the legitimacy of 1,493 complimentary, five-day and 70-or-over transactions recorded in the POS system.

We examined 59 purchases totaling approximately $1.4 million and found 17 purchases totaling approximately $124,000 showed no evidence quotes were obtained. For example, there was no evidence officials obtained quotes for trucking services costing $17,962, the purchase of a loader folding V-plow costing $19,999 or playground safety materials costing $4,875. We also reviewed 12 payments totaling approximately $938,600 that were subject to competitive bidding requirements and found that all payments complied with competitive bidding statutes and were for appropriate Village purposes. Village officials solicited competitive bids or purchased through county, Office of General Services or governmental group purchasing organization contracts. We also reviewed four professional service procurements totaling $62,000 and found no exceptions.

Village officials did not ensure that money received for ambulance services was properly recorded, reported and disbursed. As a result, as of May 31, 2018, the Village had a $16,100 unidentified cash balance in the ambulance fund. The unidentified balance resulted from an accumulation of errors since the ambulance fund's inception in December 2011. The Emergency Medical Services Manager did not report or allocate $22,573 of payments received from patients in his monthly reports and therefore the Treasurer did not remit these funds to the appropriate municipalities. Additionally, he incorrectly calculated and allocated service fees to the municipalities because he based them on each payment (including partial payments) made by patients instead of on each service call as required by the contract with the third-party billing service. This resulted in $4,414 in excess withholdings. Furthermore, mathematical errors in written checks and monthly reports led to overpayments of $5,821 to the municipalities. Finally, the Village paid $5,066 in refunds to patients and payments to collection agencies without appropriately deducting these amounts from payments to the applicable municipalities. These errors went undetected by Village officials because they did not perform monthly accountabilities.

The Board could improve the management of fund balance. Unassigned fund balance increased from $66,600 to $134,300 (102 percent) from 2014 to 2017, which left the District with enough fund balance to cover over three years' worth of expenditures. This increase was due to unrealistic expenditure estimates. On average, from 2014 to 2017, actual expenditures were 39 percent less than amounts budgeted. These variances occurred mainly because District officials overestimated equipment repairs and purchases by over $8,400 (79 percent) and pager and radio repairs and purchases by over $4,400 (89 percent) in each of those years. In addition, building repairs and maintenance were overestimated by almost $7,000 (93 percent) in 2014 through 2016 and utilities were overestimated by almost $5,000 (49 percent) in 2015 through 2017. We project that unassigned fund balance will increase another $19,500, to over $153,800, by fiscal year-end 2018 due to similarly overestimated expenditures. Furthermore, the Board has not established any formal reserves or adopted financial plans outlining a reasonable level of fund balance to be maintained or the funding and use of reserves. However, District officials informed us they were saving for capital improvements to the firehouse and future equipment purchases, as needed. Additionally, they anticipate purchasing new radios because of the County's new 911 system.

City officials did not adequately safeguard electronic access to the water system. The Water and Sewer Superintendent (Superintendent) did not establish a formal process for staying current on system cybersecurity threats; water plant officials do not receive alerts to such threats from key sources, including the U.S. Department of Homeland Security. Further, as of May 2018, the City was not in compliance with New York State Public Health Law to protect drinking water because its vulnerability assessment (a required part of the water supply emergency response plan due by January 1, 2018) was not filed with the State Department of Health until August 2018. We also found unnecessary software installed on all three computers connected to the water system network, even though the City's technology use policy does not allow non-City licensed software. In addition, the policy had not been updated since 2008. City and water plant officials also did not periodically review website content for inappropriate disclosure of water system information. We found content and system information posted by vendors that should have been deleted in 2013 or earlier. Finally, the Superintendent did not provide water plant personnel with job-specific cybersecurity training in recognizing and appropriately responding to suspicious system activity.

We reviewed the Village's 22 bank accounts and determined seven bank accounts totaling $317,988 were for restricted purposes. We found that Village officials did not maintain documentation for the $317,988 of restricted donations. In addition, of the 22 Village bank accounts, two accounts totaling $149,510 are not for Village purposes, even though these accounts are held in the Village's name. For example, the Millbrook Restoration account, totaling $149,266, receives donations from a local not-for-profit and distributes the funds to Main Street businesses for the purpose of renovating storefronts. Officials stated they did not know what the distributed funds were used for, even though the Board approved vouchers for payments from the Millbrook Restoration account. The Clerk-Treasurer writes and signs these checks without appropriate documentation for the use of the funds. The Village's procurement policy excludes professional services and does not require competitive methods to be used when procuring these services. As a result, Village officials did not seek competition for 15 professional service providers paid almost $1.3 million. Officials did not seek competition, such as a request for proposal (RFP), for any of the providers. Furthermore, 13 of these providers, who were paid $355,520 for services, did not have written contracts with the Village. Officials did not adhere to New York State General Municipal Law regarding soliciting bids for purchases over $20,000 or public work contracts over $35,000. The Village made seven procurements requiring bidding totaling $395,123 during our audit period. We reviewed all seven procurements and found that the Board did not obtain bids for four purchases totaling $265,429 that required bidding.

The City Bureau of Buildings (Bureau) has not developed written policies and procedures for managing elevator inspections. Therefore, the clerk who manages elevator inspections has not been provided guidelines and the data management system used by the Bureau is not complete and updated. Also, there are no formal processes for monitoring elevator inspections, following up on identified violations and verifying that violations are corrected in a timely manner. As a result, there are no systems to ensure that elevators (1) are inspected as required, (2) are adequately monitored to ensure they are safe and running properly, (3) with safety violations are re-inspected in a timely manner and (4) that administrative fees are collected. Therefore, there is inadequate assurance that elevators are safe and in satisfactory operating condition, and that the City has collected all revenue owed to it. Specifically, we found that although the City's Elevator Master List included 226 properties with 308 elevators and related equipment, our visits to 58 properties disclosed 141 elevators and related equipment that were not included. In addition, 75 of 85 property owners did not submit either six month or annual inspection reports. Also, violation notices were not sent to 68 (91 percent) of these property owners. Finally, Bureau officials did not follow up on violations/deficiencies on the inspection reports submitted by property owners. Serious elevator deficiencies included 35 instances and included violations such as no emergency phone and no fire extinguisher.

Although the Board adopted a policy for managing access to the network and the information system, College officials did not enforce the policy. Consequently, the College has 824 network user accounts that do not match current employees and have not been used within the last six months. Of these, 616 accounts have never been used and another 69 accounts have not been used in more than three years. Officials told us that some network accounts are limited to email access and others are kept active due to contractual requirement. In addition, while some employees recently attended general cybersecurity training, this training was not mandatory for all employees and did not cover techniques relevant to college systems and assets accessible by employees. Most notably, employees responsible for safeguarding the website generally were not required to attend the training and had not been formally trained on common web application risks such as code injection and authentication vulnerabilities. Finally, although College officials have no formal policies governing online banking, we found that they had effective informal procedures in place for secure online banking and fund transfers.