District officials did not establish adequate controls over cafeteria collections. The Board did not adopt written cash receipt policies, cash receipt duties were not properly segregated and the Cafeteria Manager did not adequately oversee the cash receipt function. As a result, one cafeteria employee, the head cashier, had almost complete control over cafeteria cash receipts without adequate oversight. Cashiers perform daily cash counts and prepare daily collection reports that must be manually entered into the point of sales (POS) system to ensure that recorded POS activity matches manually counted collections. These cash counts were not always recorded in the system. We identified 43 collections totaling $7,200 that were not properly recorded in the system but were collected and deposited. The Manager told us that employees may have forgotten to enter these collections into the system at the end of the day. Although we did not identify any theft or loss of cafeteria collections, by not establishing proper procedures to safeguard cafeteria collections, there is an increased risk that collections could be lost, stolen or misappropriated without detection.

Officials adequately segregated the duties of employees responsible for online banking transactions and adequately established security procedures over online banking. All online payments and transfers totaling $72 million during our audit period were appropriate. However, the District's online banking policy does not clearly indicate how online transfers will be authorized and processed. In addition, none of the employees involved in online banking received Internet security awareness training.

District officials ensured employees were accurately paid their approved salaries and wages. We reviewed all payroll records for 35 employees who were paid approximately $1.7 million during the audit period. District officials effectively designed and implemented procedures to ensure that compensation payments were accurate and properly authorized. There were no recommendations as a result of this audit.

Water officials have not implemented comprehensive procedures for managing, limiting, securing and monitoring user access. In addition, water plant personnel have not been provided with job-specific cybersecurity awareness training. Water officials did not prevent or monitor public disclosure of information on the Town's water system. Finally, there are no written policies, procedures, standards or guidelines related to the industrial control system cybersecurity. This includes the use of USB drives, personal devices and other mobile storage devices within the water control system network. Also, job duties do not specify security roles and responsibilities for water personnel to ensure users are aware of and understand what is expected of them to maintain the security of the water control system.

Town officials spent approximately $18,500 on wages, equipment use and materials to improve the Board member's property in May and June of 2015. However, the work performed raises potential issues under the Constitution, because no contract was in place at the time. Additionally, the Board did not perform a cost benefit analysis to make an informed decision on whether this project was necessary or publicly discuss, disclose or approve the work to be performed. Our review of Board minutes for the audit period did not disclose any Board discussion or authorization for the highway department to work on the Board member's property. Furthermore, the Department of Environmental Conservation (DEC) Deputy Regional Permit Administrator told us that any work done on a protected river or river bank, such as this river, would require a DEC permit and that he had no record of contact from the Board member or Town officials for the work performed.

The District has 19 active ECA clubs. We reviewed the collection records and fundraising activities of 10 clubs (53 percent). We traced all 67 deposits totaling $52,404 from July 1, 2017 through April 30, 2018 to the treasurers' records. While each activity had a properly authorized activity application, deposit breakdowns and completed profit/loss statements, 24 deposits (36 percent) totaling $40,515 lacked adequate supporting documentation. Sixteen deposits totaling $23,737 had no collection documentation and eight deposits totaling $16,778 had inadequate or incomplete documentation. The central treasurer's and clubs' ledgers agreed to deposit breakdowns, accurately recording amounts deposited. However, because supporting documentation was lacking at the club level, we could not determine whether all collections were remitted, recorded and deposited intact.

Our review of records for 15 noninstructional employees paid overtime totaling $54,041 during our audit period disclosed that District officials often did not document that prior approval was granted for overtime worked and that start and end times were documented on the time sheets in accordance with the overtime policy. In addition, the Superintendent told us that she permitted two noninstructional employees to earn overtime while they worked from home. However, this is neither specifically authorized nor prohibited by Board policy or in the employees' memorandum of understanding (MOU) with District officials. Although there was no documentation that these employees received prior approval for overtime worked, they were paid for 392 hours of overtime totaling $8,513 while working at home.

The School's previous Board entered into an agreement with National Heritage Academies, Inc. (NHA) that assigned it nearly all revenue the School receives. The initial agreement began in 2003 and was subsequently updated by a revised agreement approved by a previous School Board in 2011. NHA is responsible for the general management and control of the School's finances. As a result, NHA performs nearly all of the key financial duties and the Board relies almost exclusively on NHA to handle the School's finances. NHA has not fully disclosed detailed internal cost information and how operating costs are allocated to the School. As a result, the Board has limited ability to verify that the charges and reporting are accurate and appropriate. We question whether the Board can sufficiently monitor NHA to ensure that School funds are properly safeguarded and used for intended educational purposes.

Although leave accrual balances were accurate, the employees had sufficient leave accrual balances and timesheets were approved by the respective department head, leave hours used were not pre-approved. We examined attendance and accrual records for 41 of 284 employees entitled to leave benefits, and found that leave taken was not always pre-approved. Leave approval requests were missing for 10 employees for 72 days of 623 leave occurrences. These employees used a total of about 450 leave accrual hours and were paid a total of $9,927. For example, one employee from the Buildings and Grounds department used 106.5 hours of leave, totaling approximately $2,075, which was not pre-approved.

Town officials have not implemented comprehensive procedures for managing, limiting, securing and monitoring user access. We noted inactive user accounts, user accounts that are for nonemployees and user accounts not assigned to a specific individual. In addition, the Town has an acceptable computer use policy in place that defines the procedures for computer, Internet and email use. However, Town officials have not designed or implemented procedures to monitor compliance with the policy or determine the amount of employees' personal use. Finally, the Board did not develop a formal disaster recovery plan to address potential disasters. Consequently, in the event of a disaster, Town officials have no guidelines to minimize or prevent the loss of equipment and data.

Although the Board has adopted a procurement policy, the policy does not require soliciting competition, such as written proposals or quotations, when procuring professional services. In addition, officials have not developed formal procedures for seeking competition when procuring professional services, including what documentation should be maintained to support decisions. As a result, employees did not always use competition when procuring professional services or document sufficient evidence to demonstrate whether the vendor selected was a prudent and economical use of public funds. BOCES procured professional services from 49 providers totaling approximately $1.9 million. We reviewed all providers, who were each paid $1,000 or more in either year of our audit period, for a total of 29 providers paid approximately $1.89 million. We found that BOCES sought competition for its external auditor services, as required by law. However, BOCES officials procured the services provided by the remaining 28 providers (totaling approximately $1.85 million) without any evidence that they sought competition. In addition, there were written agreements for 12 providers, with total expenditures of approximately $690,000, which typically outlined the service terms and compensation schedules. However, officials could not provide written agreements for 17 providers with total expenditures of $1.2 million.

We reviewed 58 out of 765 (8 percent) agricultural, veterans and senior citizen exemptions, totaling $2.9 million, on properties with a total assessed value of $7.7 million. We found that 20 exemptions (34 percent), totaling $1.4 million, were not properly supported by adequate documentation to establish and/or maintain exemption eligibility. We reviewed 21 agricultural exemptions totaling $1.36 million on properties with assessed values of $3.6 million. Fourteen exemptions valued at $927,000 lacked one or more pieces of supporting documentation to verify eligibility. We also reviewed 22 veteran exemptions totaling $921,000 on properties with assessed values of approximately $2.5 million. Six exemptions totaling $480,000 lacked the required supporting documentation. Finally, we reviewed 15 senior citizen exemptions totaling $600,000 on properties with assessed values of $1.6 million and found that they were generally properly supported.

Although the Board adopted a procurement policy in 2015, it did not ensure that the policy and related written procedures adequately address the procurement of goods and services below the competitive bidding thresholds. The policy also does not address how professional services would be procured. District officials provided written procedures that require price comparisons for purchases exceeding $100 and written quotes for purchases exceeding $1,000. The purchasing agent told us that officials no longer follow these requirements because they believe the procedures are outdated. However, officials were unable to provide any documentation indicating how procurements not required to be competitively bid are handled. The purchasing agent told us that sometimes she reminds individuals who made purchase requests to compare prices, but that she does not require such comparisons. We reviewed 42 purchases totaling $184,000 to assess how District officials procured goods and services that were not required to be competitively bid. We found that 39 purchases totaling $176,000 were made without evidence that officials used a competitive process or obtained the required written quotes.

We reviewed 91 (15 percent) out of approximately 600 agricultural, veteran and senior citizen exemptions totaling $6 million on properties with a total assessed value of $15.5 million. We found that 81 (89 percent) exemptions totaling approximately $5.8 million were not properly supported by adequate documentation to establish and/or maintain eligibility. We reviewed 49 agricultural exemptions totaling approximately $5.3 million on properties with assessed values of approximately $12.2 million. Forty-one exemptions valued at $5.2 million lacked one or more pieces of supporting documentation to verify its eligibility. We also reviewed 26 veteran exemptions totaling $470,000 on properties with a total assessed value of $2.1 million. The Assessor did not have proof of eligibility documentation for any of these exemptions. The Assessor indicated that he relies on the County's Veterans' Service Agency (Agency) to verify the property owner's military service. As such, our exemption verification computation was based on the forms signed and stamped by the Agency that appear to certify the veteran's military service and certain ratings (compensation, disability) for the exemption amounts. Based on our review, it appears that these exemptions were accurately calculated. Finally, we reviewed all 16 of the Town's senior citizen exemptions totaling $190,000 on properties with a total assessed value of $1.2 million. Fourteen exemptions totaling $130,000 lacked annual renewal documents evidencing the property owner's income, as required to maintain eligibility.

District officials accurately paid salaries and wages according to their payroll process established to ensure that employees are paid in accordance with Board authorizations and payroll transactions are appropriately supported and authorized by management. The Superintendent reviews the payroll register for any apparent discrepancies or significant changes and certifies the payroll. However, when the Superintendent signs the certification form he does not date the signature; thus there is no way to determine whether the certification was completed prior to the Treasurer distributing paychecks and processing direct deposits for employees' pay. Based on our observations and interviews, the Superintendent did not always certify the payroll prior to the Treasurer issuing paychecks and processing the direct deposits. Additionally, a payroll change report indicating any changes to pay rates, or adding or deleting employees since the prior payroll, was not produced to assist the Superintendent or anyone else in reviewing the payroll.

We reviewed 60 out of 369 (16 percent) agricultural, veterans, disability and senior citizen exemptions totaling $2.5 million, on properties with a total assessed value of $16.4 million. We found that 27 exemptions (45 percent), totaling approximately $1.5 million, were not properly supported by adequate documentation to establish and/or maintain exemption eligibility. We reviewed 23 agricultural exemptions totaling $1.2 million on properties with a total assessed value of $11.1 million. Seventeen exemptions totaling $1 million lacked one or more pieces of supporting documentation necessary to verify exemption eligibility, and eight exemptions totaling $181,800 lacked required soil survey forms. We also reviewed 21 veteran exemptions totaling $750,000 on properties with assessed values totaling approximately $3.2 million. Ten exemptions totaling approximately $516,000 did not have completed applications on file or sufficient documentation to establish eligibility. We reviewed all six disability exemptions totaling $100,600 on properties with assessed values totaling approximately $528,000 and found that these exemptions were generally properly documented and supported. Finally, we reviewed 10 senior citizen exemptions totaling $491,000 on properties with assessed values totaling $1.5 million and found that all were properly documented and supported.

The District needs to improve its claims audit process to help ensure all claims are properly audited and approved before payment. The Board appointed a claims auditor to assume its powers and duties to examine and approve or disapprove claims. However, health insurance claims and Medicare reimbursement payments to retirees do not go through the claims audit process. During our audit period, the District paid claims totaling $3,313,264 for health insurance and $141,082 in Medicare reimbursements that were not audited and approved by the claims auditor. Lastly, we identified 13 scholarship disbursements totaling $5,700 for the audit period. We reviewed 11 payments totaling $5,500 (96 percent). All of the awards we reviewed were approved by the trust representatives, adequately supported and complied with trust requirements. However, none of the scholarship payments were audited and approved by the claims auditor.

Our previous audit found that the District accumulated excessive unrestricted fund balance in the general fund. The audit recommended that the Board develop a plan to reduce fund balance by financing one-time expenditures, funding reserves, reducing District property taxes or paying off debt. From 2015-16 through 2017-18, the District reduced its unrestricted fund balance from $15.9 million (51 percent of the next year's budget) to $1.9 million (5.9 percent of the next year's budget). The District exceeded the 4 percent statutory limit by about $609,000 (2 percentage points) at the end of 2017-18. The Board and District officials used most of the excess unrestricted fund balance to fund the District's reserves, which increased by $13.6 million (479 percent) from 2015-16 through 2017-18. They also used excess fund balance to finance one-time expenditures. For example, in 2016-17, District officials transferred $4 million from unrestricted fund balance to the capital projects fund to finance a voter-approved roofing project. The District also created a capital reserve for security and safety improvements and funded it in 2017-18 with $2 million. Furthermore, the District created a repair reserve in 2016-17 and initially funded it with $5.1 million of the excess fund balance. The Board increased the reserve to approximately $11 million at the end of 2017-18. From 2015-16 through 2017-18, the Board also decreased the tax levy by about $535,000 (8 percent).

We found that the Clerk did not always remit real property taxes totaling $3.1 million in 2017 and $3.0 million in 2018 to the Town Supervisor (Supervisor) and County Treasurer in a timely manner. For example, in 2017 the Clerk collected $929,290 from January 20, 2017 through February 8, 2017 before remitting any funds to the Supervisor. Similarly, in 2018 the Clerk collected $852,219 from December 29, 2017 through February 2, 2018 before remitting any funds to the Supervisor and did not remit all outstanding collections to the Supervisor at time of remittance. In addition, we reviewed all facility use applications completed during our audit period and found that the Clerk waived 10 fees totaling $1,650 for non-resident applicants. Finally, during the 2017 and 2018 tax collection periods, 29 transactions totaling $56,308 were deposited from one to 19 days late.

Company officials did not adequately safeguard cash assets. Consequently, there is a significant risk that funds were possibly misspent, possibly misused or improper. This amount included debit withdrawals ($67,303) and check payments ($78,441) to questionable businesses in which there was no evidence that they provided any services to the Company. We also found unsupported and questionable payments to restaurants, grocery stores and office supply companies. Without appropriate documentation confirming that these purchases were for valid Company purposes, the risk exists that they could have been for personal use. This misuse of Company funds occurred because of inadequate oversight by Company officials and because the former Treasurer circumvented what minimal internal controls were in place. Moreover, Company officials issued inherently high risk debit cards to various officers. The Board did not conduct a comprehensive audit of all the bills prior to payment as required. Furthermore, the former Treasurer did not have canceled checks or check images on file which would allow for a thorough review of disbursements made by check.