Syracuse City School District

Transcription

1 O FFICE OF THE NEW YORK STATE COMPTROLLER DIVISION OF LOCAL GOVERNMENT & SCHOOL ACCOUNTABILITY Syracuse City School District Internal Controls Over Selected Financial Operations Report of Examination Period Covered: July 1, 2006 March 31, M-84 Thomas P. DiNapoli

2 Table of Contents AUTHORITY LETTER 3 EXECUTIVE SUMMARY 4 INTRODUCTION 7 Background 7 Objective 7 Scope and Methodology 8 Comments of District Officials and Corrective Action 8 ACCOUNTS RECEIVABLE 9 Accounts Receivable Records 9 Segregation of Duties 12 Recommendations 13 EXTRA-CLASSROOM ACTIVITY AND SCHOOL FUNDS 14 School Accounts 15 Cash Disbursements 18 Cash Receipts 20 Periodic Reconciliations 20 Interest Earnings 21 Inactive Accounts 22 Internal Control Improvements 22 Recommendations 23 PAYROLL AND BENEFITS 24 Segregation of Duties and Oversight 24 Retirement Reporting 27 Recommendations 28 PURCHASING 30 Competitive Bidding 30 Quotes 33 Legal Services 34 Recommendations 35 INFORMATION TECHNOLOGY 36 Disaster Recovery Plan 36 User Access Rights 37 Audit Logs 38 Recommendations 39 Page DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 11

3 APPENDIX A Response From District Officials 40 APPENDIX B Audit Methodology and Standards 49 APPENDIX C How to Obtain Additional Copies of the Report 52 APPENDIX D Local Regional Office Listing 53 2 OFFICE OF THE NEW YORK STATE COMPTROLLER

4 State of New York Office of the State Comptroller Division of Local Government and School Accountability October 2009 Dear School District Officials: A top priority of the Office of the State Comptroller is to help school district officials manage their districts efficiently and effectively and, by so doing, provide accountability for tax dollars spent to support district operations. The Comptroller oversees the fiscal affairs of districts statewide, as well as districts compliance with relevant statutes and observance of good business practices. This fiscal oversight is accomplished, in part, through our audits, which identify opportunities for improving district operations and Board of Education governance. Audits also can identify strategies to reduce district costs and to strengthen controls intended to safeguard district assets. Following is a report of our audit of the Syracuse City School District, entitled Internal Controls Over Selected Financial Operations. This audit was conducted pursuant to Article V, Section 1 of the State Constitution and the State Comptroller s authority as set forth in Article 3 of the General Municipal Law. This audit s results and recommendations are resources for district officials to use in effectively managing operations and in meeting the expectations of their constituents. If you have questions about this report, please feel free to contact the local regional office for your county, as listed at the end of this report. Respectfully submitted, Offi ce of the State Comptroller Division of Local Government and School Accountability DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 33

5 State of New York Office of the State Comptroller EXECUTIVE SUMMARY The Syracuse City School District (District) is governed by the Board of Education (Board) which comprises seven elected members. The Board is responsible for the general management and control of the District s financial and educational affairs. The Superintendent of Schools (Superintendent) is the chief executive officer of the District and is responsible, along with other administrative staff, for the day-to-day management of the District under the direction of the Board. There are 38 schools in operation within the District, with approximately 20,000 students and 4,300 employees. The District s budgeted expenditures for the year were $494 million, which were funded primarily with State aid, real property taxes and grants. Scope and Objective The objective of our audit was to examine the District s internal controls over selected financial activities for the period July 1, 2006 through March 31, We extended the scope of our audit to test the District s June 2008 report to the New York State Employees Retirement System and its December 2008 outstanding accounts receivable report. We also reviewed user access right reports for May 2008 and the disaster recovery plan created by the District during the fiscal year. In some instances, we reported on transactions and activities outside of our audit period because we considered it necessary and relevant to this audit. Our audit addressed the following related questions: Are internal controls over accounts receivable appropriately designed and operating effectively to adequately safeguard District assets? Does the District have adequate internal control policies and procedures to protect and account for District extra-classroom activity and School Accounts? Has the District provided compensation and benefits to school employees and officials in accordance with the terms of relevant contractual agreements and Board policies? Has the District established policies and procedures to ensure that goods and services are purchased in the most prudent and economical way? Are the District s controls over information technology adequately designed to protect the District s financial data from loss or misuse? 4 OFFICE OF THE NEW YORK STATE COMPTROLLER

6 Audit Results District officials ineffective use of staff and data resources during our audit period resulted in inaccurate records of accounts receivables and significant deficiencies in controls over these assets; unsupported disbursements from School Accounts which the District is not legally authorized to have; a number of purchases made without compliance with contracts or competitive bidding requirements; routine payroll errors; and a lack of assurance that the District s electronic data is properly safeguarded from loss or misuse. During our audit period, payments recorded as received in the accounts receivable records for the various types of billed services totaled about $17 million. We found that internal controls over accounts receivable were so poor that District officials had no way of ensuring that all the moneys due the District were actually received. Our testing identified funds that the District should have, but had not, collected. In addition, the records the District did maintain were so inaccurate they could not be relied upon. For example, accounts receivable recorded in the District s detailed records at December 2, 2008 were overstated by at least $1.24 million, or 40 percent. District officials did not have a formal process to monitor and enforce unpaid bills. We also found that certain District employees were responsible for incompatible duties. Several individuals who handled cash receipts also had recordkeeping responsibilities or had access to the computerized receivable records and could make changes to the accounts without supervisory review or approval and without leaving an audit trail showing the adjustments made and who made them. Consequently, there is an increased risk that District personnel could misappropriate funds and conceal the theft by manipulating the records. Thirty-seven of the District s schools have a school account 1 (School Account) that is controlled by the principal or other staff members. As of June 30, 2008, school treasurers reported about $107,000 in these School Accounts. 2 However, the District had no legal authority to set up these School Accounts. Furthermore, we found weak controls over extra-classroom activity (ECA) and School Accounts. Our tests of disbursements disclosed payments totaling $3,400 that had no supporting documentation and payments totaling $23,700 that lacked adequate support. Procedures to control cash disbursements and cash receipts were circumvented or not followed; periodic reconciliations between the school treasurers records and activity treasurers records were not completed; interest was not allocated among the activities; and inactive accounts were not reviewed regularly. Given the lack of documentation for numerous disbursements, District officials are unable to determine the propriety of many of these transactions and there is an increased risk that District or student moneys could have been misused. We found that undetected errors routinely occur in the District s payroll process. Our testing disclosed that the District provided about $19,500 in compensation and benefits to employees that were either overpayments, or lacked Board authorization or adequate supporting documentation. For example, the Superintendent authorized a principal to roll over 50 sick days from her employment at another 1 According to the District, moneys in these School Accounts may be used for direct and indirect benefits to the students and the educational environment. 2 At the time of our audit, the Business Office was in the process of verifying that all school accounts were properly identified by the school treasurers. DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 55

7 school district when the District hired her, without obtaining Board approval. These additional sick days could result in extra cash payments of about $10,625. Furthermore, District management did not adequately segregate the duties of the payroll clerks and properly oversee their work, and the District s computerized payroll system was not able to generate complete final payroll registers. The District did not establish a standard work day for all employees for retirement reporting purposes and it incorrectly reported the days worked for seven employees to the ERS. These errors resulted in part-time custodial helpers being reported as working full-time and part-time typists being over-reported by one to 6.67 days during our test months. The District did not consistently comply with policies and procedures regarding competitive bidding and the Board and District management did not enforce the District s policies and procedures requiring oral or written quotes for purchases under competitive bidding thresholds. Our tests of 21 contracts for compliance with competitive bidding requirements disclosed that District officials did not comply with either policies and procedures or contract requirements for 10 of these contracts totaling about $1.25 million. Additionally, the District did not follow its procurement policy nor did it comply with contract requirements for eight out of 20 contracts we tested that were not subject to competitive bidding, totaling $26,229. As a result, the District may have paid more than it needed to for its purchases of goods and services. The Board adopted a school attorney policy in October 2006 that requires officials to use a request for proposal (RFP) process when seeking to retain a School Attorney. District officials stated that it is the intent of this policy to require an RFP process only when the Board seeks to retain a new legal counsel, not when it continues to retain its existing counsel. As a result, the District did not use an RFP process when it re-appointed a law firm as the school s attorney in May We believe that it is a good practice to solicit competition for legal services at reasonable intervals. Without the benefit of periodic competition, there is an increased risk that the District will not secure legal services in a manner that will optimize quality and cost. Lastly, we found weaknesses in internal controls over the District s computerized financial system. Specifically, District officials have not developed an adequate formal disaster recovery plan for its information technology, ensured that employees were given proper access rights or ensured that audit logs and change reports were monitored. As a result, there is an increased risk that computer data could be lost and the District would not be able to recover the data in the event of a disaster, and the potential for misuse or alteration of data that could result in the compromise of sensitive information and/or potential financial loss to the District. Comments of District Officials The results of our audit and recommendations have been discussed with District officials and their comments, which appear in Appendix A, have been considered in preparing this report. District officials generally agreed with our recommendations and indicated they plan to take or have already taken corrective action. 6 OFFICE OF THE NEW YORK STATE COMPTROLLER

8 Introduction Background The Syracuse City School District (District) is located in the City of Syracuse in Onondaga County. The District is governed by the Board of Education (Board) which comprises seven elected members. The Board is an independent body responsible for the general management and control of the City of Syracuse s (City) educational affairs. The Superintendent of Schools (Superintendent) is the chief executive officer of the District and is responsible, along with other administrative staff, for the day-to-day management of the District under the direction of the Board. The District is not a department of the City, but is a component unit. However, it lacks the authority to levy taxes or incur debt and is, therefore, fiscally dependent upon the City government. The District s budget is subject to approval by the City s Common Council. There are 38 schools in operation within the District, with approximately 20,000 students and 4,300 employees. The District s budgeted expenditures for the year were $494 million, which were funded primarily with State aid, real property taxes and grants. Responsibilities relating to District finances, accounting records and reports are largely those of the Chief Financial Officer, the Director of Fiscal Services and the Director of Accounting. The Board appointed a claims auditor to assume the Board s powers and duties in regard to approving or denying claims against the District. All financial transactions are processed on a financial accounting system located on a server at the District. Objective The objective of our audit was to examine the District s internal controls over selected financial operations. Our audit addressed the following related questions: Are internal controls over accounts receivable appropriately designed and operating effectively to adequately safeguard District assets? Does the District have adequate internal control policies and procedures to protect and account for District extra-classroom activity and School Accounts? Has the District provided compensation and benefits to school employees and officials in accordance with the terms of relevant contractual agreements and Board policies? DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 77

9 Has the District established policies and procedures to ensure that goods and services are purchased in the most prudent and economical way? Are the District s controls over information technology adequately designed to protect the District s financial data from loss or misuse? Scope and Methodology The objective of our audit was to examine the District s internal controls over selected financial activities for the period July 1, 2006 through March 31, We extended the scope of our audit to test the District s June 2008 report to the New York State Employees Retirement System and its December 2008 outstanding accounts receivable report. We also reviewed user access right reports for May 2008 and the disaster recovery plan created by the District during the fiscal year. In some instances, we reported on transactions and activities outside of our audit period because we considered it necessary and relevant to this audit. We conducted our audit in accordance with generally accepted government auditing standards (GAGAS). More information on such standards and the methodology used in performing this audit is included in Appendix B of this report. Comments of District Officials and Corrective Action The results of our audit and recommendations have been discussed with District officials and their comments, which appear in Appendix A, have been considered in preparing this report. District officials generally agreed with our recommendations and indicated they plan to take or have already taken corrective action. The Board has the responsibility to initiate corrective action. Pursuant to Section 35 of the General Municipal Law, Section a (3)(c) of the Education Law, and Section of the Regulations of the Commissioner of Education, a written corrective action plan (CAP) that addresses the findings and recommendations in this report must be prepared and provided to our office within 90 days, with a copy forwarded to the Commissioner of Education. To the extent practicable, implementation of the CAP must begin by the end of the next fiscal year. For more information on preparing and filing your CAP, please refer to our brochure, Responding to an OSC Audit Report, which you received with the draft audit report. The Board should make the CAP available for public review in the District Clerk s office. 8 OFFICE OF THE NEW YORK STATE COMPTROLLER

10 Accounts Receivable The District provides various services for which it imposes charges by billing individuals, departments of the District and the City of Syracuse. These charges include such things as non-resident tuition, charges for food services (within the District), charges for the use of District facilities and other miscellaneous items such as charges for photocopies. The District also bills to recapture certain reimbursable costs. These include reimbursement for overpayments made by the District, collection on insufficient fund checks, and retirees health insurance reimbursements. During our audit period, payments recorded as received in the detail accounts receivable records for the various types of billed services totaled about $17 million. District management is responsible for establishing appropriate internal controls over the District s accounts receivable process. Essential to effective internal control over billed revenues/ reimbursements is the maintenance of complete, accurate and functional accounts receivable records that are suitable for monitoring outstanding balances. Good internal control over accounts receivable should also provide for adequate segregation of duties to prevent any single individual from routinely performing incompatible duties. Good recordkeeping and the separation of incompatible duties helps safeguard these assets and provides assurance that amounts due the District are collected and deposited. We found that internal controls over accounts receivable were so poor that District officials had no way of ensuring that all the moneys due the District were actually received. Our testing identified funds that the District should have, but had not, collected. In addition, the records the District did maintain were so inaccurate they can not be relied upon. For example, accounts receivable recorded in the District s detailed accounting records at December 2, 2008 were overstated by at least $1.24 million, or 40 percent. Although the District did not rely on these records for its financial reporting, the absence of reliable detailed receivable records and weak controls significantly diminish District managers ability to monitor and control these assets. Accounts Receivable Records Effective recordkeeping for accounts receivable requires maintaining a general ledger control record that summarizes the billing and payment activity and unpaid balance for all accounts as well as a detailed subsidiary ledger showing the activity and unpaid balance of each individual account. The control account and the detailed records should be periodically reconciled to help ensure accuracy and to detect errors or other irregularities. The accounts receivable DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 99

11 10 OFFICE OF THE NEW YORK STATE COMPTROLLER detail records should provide sufficient information to link recorded billings with their supporting invoices and should clearly indicate the date and amount of each billing and payment. Adjustments to accounts receivable balances not related to the normal billing and payment process should be identified, supported and explained in journal entries. In addition, no adjustment should be made to the accounts without prior approval by an appropriate individual (i.e., a departmental supervisor) who is independent of the accounts receivable function. Also, where the billing and accounts receivable recording process is computerized, the software used should be capable of providing an audit trail showing all changes made to the accounts and the system user who initiated the change. We found that the District did not maintain an accounts receivable control account. The general ledger account is only posted once each year to record the estimated balance of accounts receivable at year end for financial reporting purposes. This estimate is based on the actual payments on account received in the first three months of the subsequent fiscal year. The entry to record the estimate is reversed in the next year to zero out the general ledger account until the next year-end estimate is posted. Because an accounts receivable control account is not maintained, the District has no mechanism to reconcile the detailed subsidiary receivable records. Such a reconciliation helps ensure the accuracy of the subsidiary records and enables the District to detect and correct errors or irregularities. Due to inaccuracies contained in the detailed subsidiary receivable records, District management did not rely on the subsidiary records for its financial reporting. At our request, the former Director of Accounting generated a report of the detailed accounts receivable at December 2, 2008 that initially showed a total accounts receivable balance of $3,043,269. However, the former Director of Accounting performed an analysis of the report and concluded that the actual balance of outstanding receivables was only $2,093,275 and that the report included $949,994 in erroneous open items. However, we found that this reported figure of $2,093,275 was also inaccurate. On a sample basis we identified another $290,722 that was not outstanding. We judgmentally selected and analyzed 19 open invoices, totaling $349,982. We determined that five of the invoices, totaling $248,445, were not open invoices but instead had actually been paid or partially paid with the remaining balance uncollectible. 3 3 We verified that amounts collected in payment of four of the five invoices were recorded in the cash receipts journal and deposited in the bank. Payment on the other invoice was received in the form of a credit on an outstanding bill owed by the District to the same party. We reviewed the related journal entry that was recorded in the general ledger of the central records to reflect this offsetting transaction and noted nothing irregular.

12 Five invoices, totaling $42,277, were subsequently determined by District personnel to be uncollectible. The remaining nine invoices totaling $59,260 were still outstanding. Therefore, only 17 percent of the sample items we tested were still viable accounts receivable. In total, the original report generated from the District s detailed accounts receivable records was overstated by at least $1.24 million. We identified deficiencies within the District s computerized accounts receivable billing module which have led to inaccuracies in the records and also make it difficult for the District to monitor accounts receivables. The system allows a report of the current status of invoices, but it is not capable of generating a report of the status of invoices at a previous point in time and it does not generate an accounts receivable aging schedule. An accounts receivable aging schedule is essential for monitoring detailed receivables and initiating collection activity. The District s accounts receivable billing module also does not enable the District to apply multiple partial payments against an invoice. The system will only record the most recent payment on an invoice and it will not show the previous payment history for that invoice. As a result, when the Benefits Department receives a partial payment, staff will post the amount received to the ledger and then create a new invoice in the amount of the remaining unpaid balance of the original invoice. Consequently, if multiple payments are made for one invoice, the total amount recorded as billed will be overstated. This recordkeeping practice coupled with the fact that the unpaid balances of accounts must be manually calculated increases the risk of errors and makes monitoring of accounts difficult. Adjustments to accounts receivable to reflect voided invoices are not always recorded in a manner that accurately depicts the action taken. For example, when the Benefits Department wants to void an invoice in its receivable ledger, a fictitious payment entry is made. In other departments, a voided invoice is sometimes recorded by deleting the invoice amount from the accounts receivable ledger. If an invoice is voided in this manner, there is no record in the ledger of the amount originally billed. We were advised by the District s Systems Analyst that the District s computer operating system does not capture and provide a record or report of voided invoices or changes made to invoices and who made them. To determine whether recorded invoices had been improperly adjusted, we judgmentally selected 91 invoice entries representing billings totaling about $1.6 million. We compared the information shown in the ledgers to the original invoices (or our recalculation DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 1111

13 of the original invoice) and concluded that the adjustments were appropriate. We also judgmentally selected 21 voided invoices to determine if the transactions had been voided for legitimate reasons. We were able to satisfy ourselves through examination of original invoices and other supporting documentation that 19 of the 21 were legitimate voids. However, because original invoices and any other documentation to support the other two voided invoices were not available we could not ascertain the reason(s) why these invoices were voided or verify that the voids were appropriate. The failure to maintain accurate accounts receivable records that provide a clear audit trail of all billings, receipts and adjustments weakens controls, increases the risk that fraudulent transactions could be entered into the system and not detected and diminishes the District s ability to effectively monitor and enforce amounts due to the District. Segregation of Duties A fundamental concept of good internal control is the segregation of incompatible duties. Authorizing transactions, recordkeeping and receiving/handling cash should be performed by separate individuals. When the same individual who handles cash also is involved in billing and maintaining the accounts receivable records, there is an opportunity to misappropriate funds and to conceal the theft by manipulation of the records. Similarly, the ability to authorize and/ or make adjustments to accounts should not be held by someone who handles cash. 12 OFFICE OF THE NEW YORK STATE COMPTROLLER District personnel involved in the billing and accounts receivable recording process are responsible for incompatible duties. An account clerk in the Business Office is responsible for receiving cash for all departments that bill for services, reimbursements etc. However, the Benefits Department receives most of the payments made on its billings and other departments occasionally do receive cash before transmitting it to the Business Office. We found that the same individuals, who handle cash receipts, including the Business Office account clerk, are also responsible for and/or have the ability to enter invoices and post payments in the accounts receivable ledgers. Moreover, all of these individuals also have the ability to change information previously posted to the ledgers with no record produced of the adjustments they might make. Personnel responsible for making adjustments to the accounts receivable ledger, such as voiding invoices or changing the amount of billings or payments, are not required to obtain prior approval from a supervisor before initiating such adjustments. The risks associated with not segregating these duties, such as the opportunity to misappropriate funds and to

14 conceal the theft by manipulation of the records, are exacerbated by the internal control deficiencies in the accounts receivable records that were previously discussed. We judgmentally selected 75 invoices ($1,416,086 in total) that were recorded as paid in the detail accounts receivable records during our audit period, and we verified that the amounts recorded as paid agreed with the amounts deposited in the bank. We also traced from duplicate receipt books and cash receipts logs maintained in the Business Office to the related bank deposits and we found no significant exceptions. Recommendations 1. District officials should maintain an accounts receivable control account and someone independent from the cash handling and recordkeeping process should periodically reconcile that account with the subsidiary receivable ledgers. 2. District officials should work with the Information Technology (IT) department to ensure that the District s computerized accounts receivable system is able to accomplish the following: Generate reports showing the status of invoices at any given point in time Generate accounts receivable aging reports Record multiple partial payments against original invoices Track changes or adjustments made to the system and who made them. 3. District officials should require supervisory approval prior to adjusting accounts receivable records and management should periodically review change reports or logs for unusual activity. 4. District officials should develop enforcement procedures for outstanding billed invoices to ensure moneys due are collected timely. 5. District officials should review the District s system of internal controls over accounts receivable and address the risks. At a minimum, cash handling and maintaining receivable records should be segregated to the extent practical. Where incompatible duties cannot be segregated, District officials should establish supervisory review procedures to mitigate specific risks. DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 13

15 Extra-Classroom Activity and School Funds Regulations of the New York State Commissioner of Education (Regulations) require each school district s board of education 4 to make rules and regulations for the safeguarding, accounting, and auditing of all extra-classroom activity fund moneys. Generally, extra-classroom activity funds are raised through charges for, by, or in the name of organizations whose activities are conducted by students. Students raise and spend these funds to promote the general welfare, education, and morale of all students, and to finance the normal and appropriate extracurricular activities of the student body. District management is responsible for the protection and oversight of the District s extra-classroom activity (ECA) moneys. These responsibilities include adopting policies and procedures that describe the methods for establishing the organization, the records that District employees and students must maintain, and the duties and control procedures that they must follow to adequately safeguard ECA moneys. Having a good system of internal controls over these funds helps minimize the risk that errors or irregularities may occur and go undetected. The District s external auditor reported that the District had about 930 accounts 5 in its extra-classroom activity fund during These accounts include not only ECA accounts, but also individual school accounts ( School Accounts or Accounts ). The School Accounts are maintained by a treasurer in each school, but unlike ECA accounts, the School Accounts are not maintained in connection with student organizations. We found that the District is not authorized to establish School Accounts. The ECA accounts and School Accounts together recorded more than $1.5 million of receipts and disbursements during the fiscal year and had a cash balance of approximately $774,000 as of June 30, As part of our audit, we examined the financial practices and records for ECA accounts and School Accounts at five schools Corcoran and Fowler High Schools, Huntington K-8 School, Grant Middle School and Webster Elementary School. Although the District has provided guidance on ECA accounts and School Accounts in the form of policies and regulations, various Board resolutions and a procedures manual, District officials and 14 OFFICE OF THE NEW YORK STATE COMPTROLLER 4 This Regulation applies to school districts that have a population of less than one million and an educational program beyond the 6th grade. 5 Moneys in these accounts were commingled in a bank account(s) for each school.

16 employees did not always comply with this guidance. As a result, we found weak controls over the ECA accounts and School Accounts. For example, our tests of disbursements disclosed payments totaling $3,400 that had no supporting documentation and payments totaling $23,700 that lacked adequate support. We also noted instances in which school treasurers disbursed and transferred funds without required approvals and issued checks without the required dual signatures. Additionally, school treasurers did not always issue receipts, and the Board did not provide guidance on either the distribution of the interest earned from the investment of the moneys in ECA accounts and School Accounts, or the disposition of the moneys in inactive accounts. School Accounts According to the Regulations, an ECA is an organization operating within a school district whose activities are conducted by students and whose financial support is raised other than by taxation or through charges of the Board. One of the intended purposes of an ECA is to allow students to operate an activity and be involved in the financial management of that activity. Generally, only activities conducted by students qualify as an ECA. Realizing that a number of the accounts in the ECA fund were not related to student organizations, the Board adopted a policy and regulation governing individual School Accounts in April The District defines individual School Account funds as those funds raised on a local basis (e.g., by donations specific to the school and other approved fund raising activities) which do not consist of funds budgeted through the District budget. These moneys are raised for, by, or in the name of a specific school, but they are not raised or maintained by a school student body through extra-classroom activities. According to the District s procedures manual, both ECA accounts and School Accounts are used for the benefit of students. The main distinction between an ECA account and a School Account is that an ECA account is restricted for the purpose of providing direct benefit for the students, whereas a School Account may also be used for indirect benefits to the students and the educational environment. There is no authority for the District to use School Accounts. Education Law requires all funds raised for District purposes from any source to be paid into the treasury of the City and disbursed by the City s chief fiscal officer after the District claims auditor has audited and approved the related claims. Additionally, Education Law requires the District to estimate revenues from all sources in its annual budget estimate filed with the City. The District s School Accounts do not comply with these requirements because the receipts are collected and deposited into the accounts by the school treasurers, who maintain DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 15

17 16 OFFICE OF THE NEW YORK STATE COMPTROLLER custody of the funds, rather than transferring them to the City s chief fiscal officer. The school treasurers also disburse the moneys from the accounts upon the approval of the building principal, without prior audit and approval by the District s claims auditor. Revenues and expenditures of the School Accounts are not budgeted by the District, and are not recorded in the District s or the City s central accounting records. During , the District opened separate bank accounts for each school to segregate School Account funds from ECA funds. School treasurers in 37 schools reported about $107,000 in School Accounts as of June 30, 2008, but at the time of our audit, the Business Office had not yet verified that the reported balances represented all the School Accounts. Although the District had not finished the process during our audit, we identified at least 20 School Accounts in the five schools we reviewed that should be accounted for in the District s general fund or trust and agency accounts, and disbursed following audit and approval by the District s claims auditor. These accounts are funded by gifts, donations and grants, or funds raised by teachers, coaches and parents rather than student organizations. Expenditures from these accounts include payments for scholarships, purchases of classroom supplies, and the costs associated with field trips, library improvements and athletics. Our testing of claims paid out of School Accounts also disclosed expenditures for meals, equipment, office furniture, electronics, software, landscaping, sports field improvements, and magazine subscriptions. In some cases, the School Accounts were funded with moneys paid from the District s general fund. During our audit period, the Board approved payment of a total of $43,000 from the general fund to School Accounts maintained by the four high schools, so that the schools could use the funds to pay entry fees for athletic meets and events. 6 From July 1, 2006 to March 31, 2008, the District also paid about $165,500 in revenues it received from beverage vending machine commissions 7 to School Accounts maintained by 37 of its schools. This revenue was initially recorded in the general fund and then the moneys were distributed to the individual School Accounts in proportion to the vending machine commissions generated by each school. Pursuant to an August 2001 Board resolution, each building principal was required to ensure the funds derived from the vending machine commissions were used solely for student-related incentives and/or activities, but not for staff or consultant compensation, staff 6 Each high school receives $5,000 or $6,000 each fiscal year. 7 The District entered into a contract with a vendor which grants the vendor exclusive pouring and vending rights to supply beverages to all District facilities. In consideration for this right, the vendor pays the District a 37 percent commission on the moneys collected. The District also receives an annual license fee in connection with the contract, but this revenue is not distributed to the individual schools.

18 development, staff travel or capital improvements. In November 2007, the Board passed another resolution requiring building principals to use 60 percent of the funds derived from the vending machine commissions for student incentives, and 40 percent of the funds for staff development activities geared to improve student achievement. The District now distributes only 60 percent of the vending machine commission revenue to the School Accounts, and accounts for the remaining 40 percent in the special aid fund. 8 District officials told us they prefer to account for the 40 percent allocation in the special aid fund, rather than the general fund, because this enables them to roll over to the following year any unexpended balance instead of losing the identity of the funds when they are closed to fund balance at year-end. The revenues derived from vending machine commissions and expenditures financed with those funds should be accounted for in the general fund, and not paid into School Accounts or accounted for in the special aid fund. The special aid fund should only be used to account for special projects or programs supported in whole or in part by Federal funds or State-funded grants. Since the vending machine commission revenue does not relate to any Federal funds or State-funded grants, the District should account for the money in its general fund. Furthermore, we noted that the District s April 2007 policy on individual School Accounts states that individual School Account balances shall not exceed $7,500. However, we found that the individual schools did not always comply with this requirement. For example, according to quarterly financial reports filed by the schools, as of March 31, 2008, Corcoran High School had $35,450 in its Athletics School Account and Fowler High School had over $15,000 in its Principal School Account. An audit by the District s internal auditor and reviews of School Accounts by the District s claims auditor and Fiscal Services Department identified a number of internal control deficiencies involving School Accounts. As a result, the Board put a freeze on all School Account expenditures effective July 1, Any expenses out of the Accounts during the freeze period must first be approved by the appropriate Deputy Superintendent and the District s Chief Fiscal Officer, and any such expenses must be reported monthly to the Board. In December 2008, the Board also passed a resolution to reduce the cap on individual School Account balances to $1, This new allocation went into effect in January Unlike disbursements out of the School Accounts, which are approved by the building principals, disbursements from the Special Aid Fund are required to go through the District s normal procurement, claims audit and disbursement process. DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 17

19 As discussed below, we found significant control weaknesses related to the ECA accounts and School Accounts. With respect to the School Accounts, compliance with the requirements of the Education Law relating to cash custody, audit of claims and budgeting would strengthen controls, and thereby increase accountability and transparency in the use of the moneys in the Accounts. Cash Disbursements The District s procedures manual, dated April 2007, outlines procedures for the disbursement of moneys in ECA accounts and School Accounts. The procedures manual requires the use of purchase orders, and request for payment forms, to document requests and approvals to make purchases and to disburse funds. 9 Receipts or invoices must be attached to request for payment forms and submitted to the school treasurer in order to support the expenditures. The District s policies and procedures also require that all payments from ECA accounts and School Accounts be made by checks signed by both the Principal (or his or her designee) and the school treasurer, and checks greater than $500 be pre-approved in writing by the Central Office. Transfers between ECA accounts and between School Accounts must be documented on transfer forms and approved by the respective activity advisor or principal, the school treasurer and the Central Office. Our tests of 368 cash disbursements out of ECA accounts and School Accounts totaling about $212,000, and transfers between accounts totaling about $31,000, disclosed the following deficiencies: OFFICE OF THE NEW YORK STATE COMPTROLLER Nine payments totaling about $3,400 contained no supporting documentation. Eight of these payments totaling $2,710 were made out of Corcoran High School bank accounts and one payment for $690 was made out of a Grant Middle School account. Some examples of the Corcoran unsupported disbursements include $370 paid to a former principal, $207 paid to two local restaurants, and $715 paid to a fence company. The unsupported disbursement from Grant Middle School was made to a bus company. Eighty-two payments totaling about $23,700 lacked adequate supporting documentation. For example, we noted 18 disbursements totaling $3,753 paid out of Corcoran School Accounts that were only supported by post-it-notes or other informal notes that indicated the payee and amount, but generally did not explain the reason for the disbursements. 9 Prior to the development of the procedures manual, the District had a policy that required all ECA funds to be handled in accordance with financial procedures recommended by the State Education Department (SED). Similar to the District s current procedures manual, SED recommends the use of purchase and payment orders. 10 Some disbursements had more than one deficiency.

20 Two payments out of Corcoran s vending machine School Account for $300 each were based only on invoices indicating labor charges, with no explanation of what services were provided. Another nine payments totaling $3,185 out of the Corcoran Athletics School Account were supported only by forms showing the payee, amount paid, and the Advisor s signature. No invoices, receipts or explanations for the disbursements were attached. Fowler High School made 14 payments to reimburse the school s principal for expenses she incurred. These payments totaling $1,224 were supported by credit card receipts that lacked itemization to show what was purchased. Notations on the claims indicate that many of these purchases were for food or meals at meetings. Webster Elementary School paid $4,676 out of its Principal School Account for choral risers, but no invoice was attached to support the payment. Also, Huntington School made payments totaling $606 to a bus company without invoices or receipts. On 12 occasions, school treasurers wrote two to four checks to the same vendor on the same day, apparently in order to circumvent the Board s policy requiring prior Central Office approval of checks over $500. In addition to these split check payments totaling $9,419, there were three other check payments, each in excess of $500, totaling $16,529, for which there is no evidence of Central Office approval. Twelve checks totaling $3,824 were signed by the school treasurer, but were not signed by the Principal (or his or her designee) as required by the District s procedures. Twenty-eight transfers totaling $19,303 between ECA accounts and between School Accounts lacked the required forms to document approval of the transfers. The majority of these transfers (24 transfers totaling $17,771) were made by the school treasurer of Corcoran High School. We also found two transfers recorded to increase accounts in the amount of $543 and $100 that did not have corresponding transfers recorded out of other accounts. In addition, the five schools we examined did not always use the purchase and payment order forms that were included in the District s procedures manual which went into effect in April While Fowler High School used the forms in some instances, we noted that the forms were not used for all disbursements, and some disbursements lacked required approvals (e.g., approval by the activity treasurer, activity advisor and/or the principal). Some of DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 19

21 the District s other schools used their own forms, but these forms did not always include all the authorizations required by the procedures manual. The Grant school did not use any authorization forms, so there was no documented approval of disbursements in that school. Internal controls are weakened when disbursements are made without required authorizations or based on missing or incomplete supporting documentation. Due to the lack of documentation for certain payments, District officials are unable to determine the propriety of transactions. In addition, the District s failure to comply with its own policies governing controls over these funds increases the risk that errors and irregularities could occur and remain undetected and that District or ECA moneys could be lost or misused. Cash Receipts The District s procedures manual requires each school treasurer to prepare a pre-numbered three-part receipt 11 for all cash and checks received from ECA advisors or the principal. Both the school treasurer and ECA advisor must sign the receipt to document the transmittal of the funds. The ECA advisor or principal must make copies of all checks received and submit them to the school treasurer who should keep them on file with a copy of the pre-numbered receipt. Our tests of March 2008 receipts, cash receipt records, deposit slips and bank statements at the five schools disclosed that the school treasurers did not comply with the District s procedures manual. Three school treasurers did not issue any pre-numbered receipts when money was received. Two school treasurers completed twopart receipts, and did not require the ECA advisor to sign the receipts when money changed hands. The receipts used by one of the school treasurer s were not pre-numbered. 12 None of the school treasurers retained copies of the checks they received as required by the procedures manual. During our testing, we found no exceptions when tracing recorded receipts of $50,990 to the bank statement deposits. However, the failure to use duplicate receipts increases the risk that collections will not be recorded and accounted for properly. Periodic Reconciliations The District s policies and procedures require all ECA student treasurers to maintain separate records of cash receipts and disbursements. The activity advisor should guide the student treasurer and review the student treasurer s records. The school treasurer must provide each ECA advisor with the activity s beginning and ending cash balances, and a quarterly list of transactions. The ECA advisor 20 OFFICE OF THE NEW YORK STATE COMPTROLLER 11 The original receipt should be attached to copies of the checks and retained on file by the school treasurer. One copy of the receipt should be given to the ECA advisor/principal. The last copy should be retained in the receipt book maintained by the school treasurer. 12 One school treasurer switched to three-part receipts during March 2008, but the ECA advisor was not required to sign the receipts.

22 must verify the activity shown on the list and sign off on the report. The District does not have a process in place to ensure that student treasurers are maintaining separate records, and that those records are periodically reconciled with the school treasurers records and differences investigated. For example, the school treasurers for Fowler and Corcoran High Schools were not sure if each ECA student treasurer maintained separate records of their activities cash receipts and disbursements. The school treasurer for Corcoran indicated that he did not provide quarterly reports to each ECA advisor for review. The Fowler school treasurer said he provided quarterly reports to each ECA advisor, but the advisors did not sign off on the reports as required by the District s procedures. When student ledgers are not maintained or are not compared with the school treasurers records, there is an increased risk that errors or fraud could occur and remain undetected. The reconciliation of bank balances to ledger cash balances is essential to ensure that District records reflect correct cash balances and that cash is safeguarded. Accurate and complete bank reconciliations include the timely identification and investigation of any differences. The District s procedures manual requires school treasurers to reconcile the ECA account and School Account bank accounts on a monthly basis. Our review of March 31, 2008 bank reconciliations disclosed no significant exceptions in four out of the five schools we tested. However, we noted an unexplained reconciliation adjustment in the Corcoran school treasurer s records. We expanded our review of the Corcoran records and noted six adjustments were made during our audit period four adjustments to decrease recorded cash a total of $708 and two adjustments to increase cash by $4,162. While the adjustments were made to increase or decrease cash in three separate School Accounts, the school treasurer did not document the reasons for the adjustments or explain why they were related to these Accounts. These adjustments were made during the time period when the ECA accounts and School Accounts were combined in shared bank accounts. When the school treasurer adjusts records to agree with adjusted bank balances without identifying the underlying cause of the discrepancy, it could result in an ECA or School Account receiving either more or less moneys than it is entitled to receive. The adjustment could also be used to cover up fraudulent transactions. Interest Earnings The District s regulations on ECA accounts and School Accounts provide that interest earnings for ECA accounts and School Accounts must be distributed according to procedures established by the District. However, the District has not established any additional procedures to provide direction on how the interest earnings should be distributed. During , Corcoran High School had ECA DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 21

23 and School Account moneys pooled in an investment account 13 that had earnings of $3,432. The earnings were not credited to each ECA account and School Account based on its pro-rata principal investment. Instead, all of the earnings were distributed to the Student Activities Account, which is a School Account controlled by the principal. As a result, none of the ECAs received a pro-rata share of the interest earnings. Inactive Accounts Internal Control Improvements The District s regulation on extra-classroom activities requires each principal and activity advisor to perform a semi-annual review of inactive clubs and to distribute funds in accordance with NYS guidelines for ECA accounts. SED regulations require the District to adopt rules and regulations addressing the method of disposing of funds of defunct organizations, but they do not provide specific guidance on how funds should be distributed this is a responsibility of the Board. Our review of the records of five schools disclosed 33 accounts with a combined balance of $7,840 that had no activity from July 2006 through March Without defined procedures for disposing of funds from inactive accounts, there is an increased risk that moneys will not be available for valid uses, or that idle moneys could be used inappropriately. During our audit period, the District took a number of steps to help strengthen controls over ECA and School Accounts. In addition to the annual external audits of ECA, these steps included developing a procedures manual, conducting internal reviews/audits of the ECA and School Accounts at four schools, initiating a process to segregate School Accounts from ECA accounts, and implementing the use of spreadsheets at most schools to record receipts and disbursements for each ECA account and School Account. In February and March 2008 (near the end of our audit period), the District created a full-time position in the Central Office to oversee ECA and School Account activity and provided training to school treasurers and principals. Currently, staff in the Central Office receives quarterly and annual reports showing bank reconciliations and total receipts, disbursements and balances for each ECA account and School Account, but in general, no one regularly reviews the school treasurers records or supporting documentation for receipts and disbursements. In the future, the District plans to conduct random audits of ECA accounts and School Accounts. These audits should help the District better oversee school treasurers and determine if controls are operating as intended. 22 OFFICE OF THE NEW YORK STATE COMPTROLLER 13 The Corcoran High School had a money market mutual fund investment account with a value of approximately $85,000. The District is not authorized by General Municipal Law to invest funds in this type of an account.

24 Recommendations 6. District officials should continue the process of differentiating ECA accounts and School Accounts, and discontinue the School Accounts by transferring the balances to accounts within the general fund or to trust and agency accounts as appropriate. 7. District officials should ensure that District staff properly document and support all ECA account disbursements with itemized vendor invoices or receipts and written explanations. 8. District officials should monitor compliance with the District s ECA account policies and procedures. 9. District officials should require all ECA student treasurers to maintain separate ledger records of cash receipts and disbursements. These records should then be compared with those maintained by the school treasurer on a periodic basis. 10. School treasurers should reconcile bank accounts on a monthly basis and investigate any differences. 11. The Board should amend its policies and procedures to provide direction regarding the distribution of the interest earned from the investment of ECA moneys and the disposition of funds in inactive ECA accounts. 12. The Board should continue to ensure that periodic audits of the school treasurers records are performed. DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 23

25 Payroll and Benefits Our audit of the District s payroll function revealed a lack of segregation of duties without adequate independent monitoring procedures to detect errors or irregularities. Our testing disclosed that errors routinely occur in the District s payroll process and go undetected. We found that the District provided about $19,500 in compensation and benefits to employees that were either overpayments, or lacked Board authorization or adequate supporting documentation. We also found that District management did not always establish a standard work day for reporting the days worked by employees to the Employees Retirement System, leading to improper reporting. Segregation of Duties and Oversight Payroll duties should be segregated to ensure that no one employee controls all or substantially all phases of the payroll cycle and the work performed by one individual is verified in the normal course of another employee s regular duties. If this is not feasible, District officials can implement mitigating controls such as having someone independent of the payroll process perform a review of completed payroll records. At a minimum, the review should include random checks to verify that payrolls are based on actual hours or days worked or authorized leave time; verification that the Board authorized the hourly rate, salary or other compensation; a comparison of net payroll checks or direct deposits to payroll journals; and an assessment of the payrolls for reasonableness. A periodic review of change reports and audit logs can also be implemented to help limit risk. The District did not adequately segregate key duties related to payroll processing. Although staff in the Personnel Department added new employees to the computerized payroll system, five payroll clerks were responsible for all other payroll functions. The other payroll functions include: activating and deactivating employees in the system; inputting employees initial salaries and any changes made to their salaries or pay rates; entering regular and overtime hours worked; updating leave records; and changing employee banking information and appropriation account numbers. Furthermore, in several instances the payroll clerks calculated unused leave payouts, retirement stipends and retroactive payments that were added to employees paychecks without any supervisory review of their work. The payroll clerks also notified the console operator when the checks were ready for printing. They picked up the signed payroll checks after they were printed and sorted and sealed the checks for delivery. While staff in the Personnel Department initially authorized many of the changes made by the payroll clerks (i.e., initial salaries, salary 24 OFFICE OF THE NEW YORK STATE COMPTROLLER

26 changes and longevity payments), there was no review or verification of the changes made by the payroll clerks after they were entered into the financial system. The District s procedures did not provide adequate oversight of the clerks work to compensate for their conflicting duties in processing payroll. Such duties could allow the payroll clerks to initiate inappropriate transactions which may not be detected. Although a payroll supervisor reviewed various preliminary payroll reports, these reports were printed before the payroll clerks finished inputting all timesheets and other payroll changes for the pay period, thus reducing the effectiveness of his supervisory review. In addition, the computerized payroll system does not generate a complete final payroll register which shows the gross pay, deductions and withholdings, and the net pay amount for each employee. 14 As a result, District officials were not able to perform a comprehensive review of the final payrolls and there was no process in place for someone independent of the payroll process to certify the final payrolls. Furthermore, through March 2008, the majority of the payroll reports that could be generated by the payroll system (eg., reports by withholdings or check lists) were shredded after three months. 15 We also found that the payroll clerks were the only ones who reviewed system-generated change reports that summarize the changes they made in the computer system, including changes to salaries and pay rates. 16 The review of these reports by supervisory personnel or someone independent of the payroll process would help the District to detect irregularities or mistakes in a timely manner. Based on the risks resulting from the inadequate segregation of duties and lack of oversight during our audit period, we tested the annual salaries of 43 employees totaling about $2.8 million, examined a sample of the associated cancelled checks or direct deposit listings, and verified the payments were made to bona-fide District employees. Additionally, we tested the time sheets of 60 employees for one pay period totaling $68,762 and examined the associated cancelled checks or direct deposit lists for 30 of these employees. 17 We also tested a sample of 21 changes to employee salary and wage rates 14 The payroll system can produce a final payroll report showing gross and net pay amounts for employees who receive pay checks, but this report does not include the net pay for employees who received direct deposits, and it does not show the deductions and withholdings from each employee s pay check. Withholdings are summarized by withholding type on a report separate from the final payroll report. 15 During our audit, District officials extended the retention period for these payroll reports to two years. 16 See the finding entitled Information Technology for additional information on change reports and audit logs. 17 Since final payroll registers were not available, we used computer generated individual employee earnings records for our audit testing. DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 25

27 reflected in change reports. These tests were completed to determine whether amounts paid or benefits provided to District employees were appropriate. We found exceptions in the payments or benefits provided to 20 of the 103 employees we tested (nearly 20 percent). For example: The Superintendent authorized a principal to roll over 50 sick days from her employment at another school district when she was hired by the District. This principal was covered under a collective bargaining agreement and we found no indication that the Board authorized this additional benefit. These sick days should not have been granted without Board approval. Due to the sick day buyback provision in her bargaining unit contract, these additional sick days could result in extra cash payments of about $10,625. No supporting documentation could be found for payments made to six employees totaling $4,298. Specifically, there was no documentation on file to support the calculation of retroactive payments made to four employees totaling $2,298. Two other employees each received salary increases of $1,000, but there was no documentation or Personnel Department authorization to show the reason for the salary increases. A payroll clerk believes the increases were longevity payments for 30 years of service, but she was unable to verify whether or not this was true. The District paid the former chief financial officer and three deputy superintendents annual stipends of $300 each for professional dues ($2,400 in the and years combined). These stipends were not allowed by their individual employment contracts. After we discussed these overpayments with District officials, the District recouped the funds from the employees. Three employees were paid for an incorrect number of hours. One was overpaid in the amount of $1,653 and the other two were underpaid a total of $189. Two employees were overpaid a combined total of $352 due to errors in the calculation of their retroactive and resignation payments. Three employees were overpaid a total of $290 because they were paid at the incorrect rate. 26 OFFICE OF THE NEW YORK STATE COMPTROLLER

28 The Superintendent was overpaid $135 due to the miscalculation of a retroactive pay adjustment made after his employment contract was approved. After we discussed this overpayment with District officials, the Superintendent reimbursed the District. The direct deposits for 16 out of 48 employees could not be traced to the bank because payroll reports showing the breakdown of direct deposits were not retained. We also noted that although the District had 26 regular bi-weekly pay periods during the fiscal year, the District processed 68 payroll runs plus nine retroactive payment runs during the year. The extra payrolls were primarily due to payroll mistakes, and time cards and other paperwork that were submitted to the Payroll Department too late to be incorporated in the normal payroll run. During our audit period, the District began maintaining a log to summarize the need for the unscheduled payrolls. This log is intended to help officials identify and evaluate the causes of the extra payrolls so they can identify process improvements to reduce the number of payrolls in the future. Retirement Reporting One of the benefits offered to the District s non-instructional employees is the ability to join the New York State and Local Retirement System. 18 This retirement system actually comprises two different systems, which are the Police and Fire Retirement System and the Employees Retirement System (ERS). As a participating employer in ERS, it is imperative that District management establish criteria by which a standard workday is measured for reporting purposes and ensure that each member is properly reported. Each member s retirement benefits are integrally related to salary and service history. Consequently, each member should be reported to ERS with accurate information for earnings and days worked, calculated in accordance with retirement system guidelines. The number of days worked should be based on the number of hours worked on payrolls paid during the monthly reporting period and the number of hours set by the Board as a standard workday for retirement purposes. The standard workday used for retirement purposes can vary by position and/or individual but cannot be less than six hours per day or more than eight hours per day. Part time employees are those who work less than the standard workday and their service should be reported as a pro-rated proportion of the standard workday for that position. 18 Teachers, substitute teachers, teaching assistants, guidance counselors and certain administrators participate in the New York State Teachers Retirement System. DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 27

29 We tested the days worked reported for 70 employees 19 in the District s monthly ERS reports for September and October 2007 and June 2008 and found that the District over-reported the days worked by one or more days in a month for seven of these employees. Two of the employees were part-time custodial helpers, who the District reported as having worked 20 days during the month tested which is equivalent to full-time employment. Based on the employees actual hours worked and the standard work day of eight hours set by the District, the maximum number of days reported should have been 10.5 days for each employee. The other five employees that were calculated incorrectly were part-time typists. They were reported for having worked between 15 and 20 days per month. However, the Board has not set a standard work day for these part-time typist positions. Based on the minimum requirement of six hours per day, the District over-reported the days worked for each of these employees by one to 6.67 days during our test months. It appears that these errors occurred because the District s computer system uses incorrect standard work day numbers to compute the days worked for certain part-time employees. We have notified ERS of this misreporting so that corrective action can be initiated. Recommendations 13. District officials should segregate payroll related duties to the extent possible or establish additional supervisory review procedures to mitigate the risk of payroll errors or irregularities. 14. District officials should work with the IT department to develop a final payroll register in order to provide them with a mechanism to review and certify the complete payroll run. 15. District officials should ensure that supervisory personnel or someone independent of the payroll process periodically reviews change reports generated from the payroll system. 16. District officials should evaluate the overpayments and underpayments to employees and determine if the District should pursue the recovery of the funds or compensate employees. 17. The District should retain documentation to support the appropriateness of all payroll payments. 18. District officials should not provide employees with benefits that the Board has not authorized. 28 OFFICE OF THE NEW YORK STATE COMPTROLLER 19 We initially tested 59 employees and found that the days worked was incorrectly reported for four part-time employees. As a result, we expanded our testing to review the days worked reported for 11 additional part-time employees.

30 19. The Board should formally set a standard workday consisting of six to eight hours for calculating the days worked reported to ERS. 20. District officials should develop review procedures to ensure that days worked for both full-time and part-time members are accurately computed and reported to ERS. DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 29

31 Purchasing An effective purchasing process helps the District obtain services, materials, supplies and equipment at the desired quality, appropriate quantity, and lowest cost, in accordance with applicable Board policies and procedures, and other legal requirements. This process helps the District ensure that it expends taxpayer dollars in the most efficient manner. Both the City 20 and District have developed policies and procedures for purchasing to provide guidance to District officials responsible for procuring goods and services. However, we found that District staff did not consistently comply with the policies and procedures regarding competitive bidding. Further, the Board and District management did not enforce the District s policies and procedures requiring oral or written quotes for purchases under competitive bidding thresholds. Also, the District s school attorney policy requires officials to use a request for proposal process when seeking to retain a school attorney; however, the policy does not specify that the District should solicit competition for legal services at reasonable, periodic intervals. As a result, the District did not get the benefit of a formal, open competitive process and may have paid more than it needed to for its purchases of goods and services. Competitive Bidding The City Charter and District s purchasing policy require that purchase and public work contracts which exceed $7,500 and $10,000, respectively, during any six-month period be publicly advertised for bids and awarded to the lowest responsible bidder. 21 The District may also use certain contracts awarded by the New York State Office of General Services (OGS), the City, Onondaga County or any other county within the State, or it may participate in cooperative bidding with other local governmental entities such as a Board of Cooperative Educational Services (BOCES). The appropriate use of competition provides taxpayers with assurance that goods and services are procured in the most prudent and economical manner, of the desired quality, at the lowest possible price and that procurement is not influenced by favoritism, extravagance, fraud or corruption. 30 OFFICE OF THE NEW YORK STATE COMPTROLLER 20 The District is governed by the purchasing provisions outlined in the City Charter (Education Law, Section 2556(8)). 21 General Municipal Law (GML) requires school districts to competitively bid purchase and public work contracts which involve expenditures in excess of $10,000 and $20,000, respectively. The dollar thresholds in GML have been interpreted to apply to the aggregate amount of expenditures for the same or similar types of commodities or services over the course of a fiscal year. In June 2008 (after our audit period), the Common Council amended its City Charter to increase bidding thresholds in the Charter to the amounts currently required by GML.

32 The City Charter enables the Common Council to waive competitive bidding requirements for all City departments and the District by adopting an ordinance by at least two-thirds vote with the approval of the Mayor when it is impracticable to procure goods or services by bidding. The District s purchasing policy states that the District is not required to secure alternative proposals or quotations in cases when purchases are exempt from bidding by a Common Council ordinance. While the Common Council may waive competitive bidding for certain purchases, it is still in the public interest that the District take steps to ensure that purchases be made at the lowest cost to the District. Although we noted certain instances in which the District did obtain quotes for purchases made pursuant to a Common Council ordinance waiving bidding, we question whether the District s written policy to waive quotes in such instances is in the best interest of the tax payers. We tested 21 contracts totaling $1,681,306 for compliance with City and District competitive bidding requirements. District officials appropriately solicited competitive bids or used State or cooperatively bid contracts with BOCES for 11 of these contracts totaling $426,660. However, District officials did not comply with either the City or District s policies and procedures or City or State contract requirements for 10 of these contracts totaling $1,254,646. In May 2007, the District purchased financial, payroll and human resource software and support/maintenance services totaling $910,120. District officials indicated the purchase was made from an OGS Miscellaneous Software Catalog (MSC) contract. As part of this State contract, a prohibited software manufacturer list is maintained online by OGS. If a manufacturer is on the prohibited list then its software products may not be purchased from the State s MSC contract. The manufacturer of the software the District purchased was on the prohibited software list. 22 As a result, the District was not authorized to purchase the software under this State contract 23 and it should have used the competitive bid process prior to making the purchase. District officials told us they purchased the software because funding was available at the 22 Software manufacturers included in the prohibited list for the MSC contract have their own contracts with the State. While their software cannot be purchased through the MSC contract, it can generally be purchased under the manufacturer s State contract. However, though the manufacturer that developed the software purchased by the District had its own State contract, that contract failed to provide updated approved prices for the software. Consequently, the District should not have purchased the software under either the MSC State contract or the manufacturer s State contract. 23 We confirmed this with OGS. DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 31

33 32 OFFICE OF THE NEW YORK STATE COMPTROLLER time of the purchase and they received a discount from the vendor at that time. Purchasing documentation indicates that the District purchased five trucks totaling $164,682 from an OGS contract; however we found that the purchases did not conform to the State contract which was for a different model pickup truck. Although the contract allowed certain upgrades, it did not allow a change in the vehicle series. Since there was no State contract available for the model that the District purchased, it should have used a competitive bidding process. On four occasions, the District purchased used vehicles without publicly advertising for bids or purchasing the vehicles from a State, City, County or cooperatively bid BOCES contract. In all, seven used vehicles were purchased at a total cost of $111,799. Although District officials did obtain quotes from three vendors prior to making each of these purchases, they told us they did not competitively bid the vehicles because they purchased them under a Common Council ordinance that waived competitive bidding requirements. However, according to the ordinance, it only waived bidding requirements for purchases of repair services and overhauling including parts and labor, and the purchase of repair parts and maintenance supplies for automotive equipment. When we contacted City purchasing officials, they confirmed that the ordinance is for repairs and it does not authorize the purchase of used vehicles without competitive bidding. Therefore the District was required to obtain competitive bids for these used vehicles. The District purchased uniforms for various sport teams totaling $24,581 during the period July 1, 2007 to March 31, According to the District s purchasing officer, the uniforms were purchased under a Common Council ordinance that waived competitive bidding requirements; however, the District did solicit quotes from four vendors to obtain the best prices. The ordinance used by the District for this purchase authorized the purchase of various non-copyrighted items, such as instructional supplies and materials, instructional toys, instructional equipment, maps and globes and miscellaneous office supplies for the District. The purchase of sports uniforms does not fall under this ordinance and therefore the District should have used the competitive bidding process. The District s purchasing documentation indicates the District purchased toilet tissue and paper towels totaling $31,612 from

34 a contract that was competitively bid by the City. However, when we reviewed the contract that includes toilet tissue and paper towels, we noted the District did not purchase the supplies from the vendor that won the contract. The District made two purchases of ice melt totaling $11,852 within three months. While the District did obtain three quotes prior to making the first purchase, it did not advertise for bids as required by the City and District s policies and procedures. Because the District did not fully comply with City and District policies and procedures and State and City contract requirements, the District may have paid more than necessary for the above purchases and did not otherwise get the benefit of a formal, open competitive process. Quotes District officials informed us that the District follows the City s procurement policy for non-bid purchases. The policy requires the District to obtain oral quotes from vendors for purchase contracts between $501 and $3,000 and written quotes for purchase contracts between $3,001 and $7,500. The policy also requires verbal quotes for public works contracts between $501 and $3,000 and written quotes for public works contracts between $3,001 and $10,000. We tested 20 contracts aggregating $70,186 that were not subject to competitive bidding requirements but were subject to the purchasing policy related to oral and written quotes. District officials appropriately solicited quotes, made purchases under OGS, county or City contracts or made purchases under appropriate ordinances for 12 of these contracts totaling $43,957. However, the District either did not follow the procurement policy or it did not comply with contract requirements for eight of these contracts totaling $26,229. Five contracts totaling $11,204 had no documentation to indicate that District officials obtained quotes. These goods and services included a calling system ($4,999), stereo headsets ($1,799), wiping rags ($1,740) four stoves ($1,476), and transportation for a field trip ($1,190). District officials indicated that various departments may have included a summary of the quotes they obtained on electronic requisitions for some of these purchases, but the quotes were automatically deleted when the requisitions were processed and purchase orders were issued. Due to the lack of such documentation, the Board has no assurance that these items were purchased at the lowest cost and the procurement process is operating effectively. DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 33

35 Purchasing documentation on file for three contracts totaling $15,025 indicated that the District purchased the items on an OGS, City or County contract; however, we noted that the District either did not use the vendor that held the contract or it purchased items that were not included in the contract. For example, purchasing documentation indicated the District purchased an envelope imager and software totaling $9,090 on an OGS contract, but the vendor did not have this State contract. Documentation related to the purchase of concrete cubes totaling $1,600 indicated they were purchased from a County contract, but the cubes were not part of the contract. Purchasing documentation for radio/cd players totaling $2,645 and wooden puzzles totaling $1,690 referenced a City contract. While the City did award certain bid items to this vendor, the items the District purchased were not part of the bid documents or award. When District officials do not obtain quotations as required by the procurement policies and procedures, or do not comply with contract provisions, the District risks acquiring goods and/or services at higher costs than necessary. Legal Services Goods and services not required by law to be competitively bid must be procured in a manner that assures the prudent and economical use of public moneys in the best interests of the taxpayers. A request for proposals (RFP) process is an effective means of procuring professional services at the best value and documenting how the selection of providers was made. 34 OFFICE OF THE NEW YORK STATE COMPTROLLER The Board adopted a school attorney policy in October 2006 that requires officials to undertake a competitive process when seeking to retain a School Attorney. Specifically, the policy requires officials to locate prospective qualified lawyers/law firms by advertising in professional journals and/or newspapers, checking listing of lawyers/ law firms, or making inquires of other districts or other appropriate sources. In selecting a School Attorney, the District must consider cost as well as certain other factors, including the special knowledge or expertise of the attorney or firm. The District must then prepare a written RFP which contains details of the services sought and submit this request to prospective applicants. The policy also requires the District to maintain documentation of the written proposals submitted by lawyers/law firms for the position of school attorney. The Board re-appointed a law firm as the school s attorney in May 2007 without soliciting competition through an RFP process. We have been advised by the District that it is the intent of this policy to require this competitive process only when the Board seeks to retain

36 a new legal counsel. Nonetheless, we believe that it is good practice to solicit competition for legal services at reasonable intervals. In this regard, as a general guide, we note that school districts generally are required to utilize a competitive RFP process when contracting for outside audit services no less frequently than once every five years. The District paid $113,157 for legal services to this law firm for the period November 2006 through June 2007 and $128,741 for the period July 2007 through March Without the benefit of periodic competition, there is an increased risk that the District will not secure legal services in a manner that will optimize quality and cost. Recommendations 21. District officials should ensure that all District employees who are involved in the purchasing process are aware of the District s requirements for competitive bidding and obtaining quotes. Also, District officials should periodically determine whether District personnel are complying with the procurement policies and procedures. 22. The Board should review and amend its purchasing policy to require officials to obtain quotes when the Common Council has waived competitive bidding requirements. 23. Purchasing officials should verify that purchases conform to OGS, City, County or District contracts prior to approving purchases. 24. District officials and staff should retain documentation showing the quotes they obtain. 25. The Board should amend its policy to require the solicitation of proposals for legal services at reasonable, periodic intervals, such as once every five years. DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 35

37 Information Technology The District relies on an information technology (IT) system for providing computer education, accessing the Internet, communicating by , storing student data, maintaining financial records, and reporting to State and Federal agencies. Therefore, the IT system and the data it holds are valuable District resources. The District s widespread use of information technology presents a number of internal control risks such as unauthorized access to data and the potential loss of data. District officials must design an effective system of internal controls to safeguard computerized data from loss and misuse. It is important that this system include policies and procedures to control and monitor access to financial data and a formal disaster recovery plan to minimize the damage that a disaster would cause to operations if the IT system fails. We found weaknesses in internal controls over the District s computerized financial system. Specifically, District officials have not developed an adequate formal IT disaster recovery plan, ensured that employees were given proper access rights and those access rights were promptly updated when needed, or ensured that audit logs and change reports were monitored. As a result, there is an increased risk that computer data could be lost and the District would not be able to recover the data in the event of a disaster, and the potential for misuse or alteration of data that could result in the compromise of sensitive information and/or potential financial loss to the District. Disaster Recovery Plan An effective system of internal controls over IT includes a formal disaster recovery plan that addresses the possible loss of computer equipment and data and establishes procedures for recovery in the event of such a loss. It is essential that the plan provide precautions that staff must take to minimize the effects of any disaster and enable the District to either maintain or quickly resume its mission-critical functions. Also, this plan should include a significant focus on disaster prevention. The Board should communicate the plan to all responsible parties and periodically test it to ensure its effectiveness. While District officials had not established a formal disaster recovery plan during our audit period, the District did provide us with a plan for the year during the time of our fieldwork. However, the plan had a number of deficiencies which need to be remedied if it is to effectively serve its intended purpose. The plan did not specifically address the current financial system nor did it provide specific actions to be taken in the event that the server that runs the District s financial system is damaged or destroyed. Consequently, 36 OFFICE OF THE NEW YORK STATE COMPTROLLER

38 in the event of a disaster, District personnel have no guidelines to follow to help minimize or prevent the loss of equipment and data, and no guidance on how to implement data recovery procedures. If the computer system fails, the problems that result could range from inconvenient to catastrophic. Even small disruptions in computer systems can require extensive effort to evaluate and repair. The lack of an adequate formal disaster recovery plan could negatively impact the District s ability to resume normal operations. User Access Rights To ensure proper segregation of duties and internal controls, the District must grant users of the computer system only the access that is required to perform their job duties and responsibilities. Access controls are intended to provide reasonable assurance that computer resources are protected from unauthorized use and modifications. Having access controls in place prevents users from being involved in multiple aspects of financial transactions and ensures that users are restricted from unauthorized areas where they can intentionally or unintentionally destroy or change critical financial data. As of May 2008, the District had not adequately restricted user access rights to financial data based on the duties and responsibilities of staff. We found that three employees had access rights to functions in the computer system that were incompatible with their other duties and/or unnecessary for the performance of those duties. For example, the accounts payable clerk had the ability to approve and release invoices for payment in the computer system, which is the responsibility of the claims auditor, and is incompatible with her other accounts payable duties. Two other employees who no longer work in the Payroll Department still had access to payroll modules within the financial system even though they do not need this access to perform their current job duties. One of these employees had access to confidential employee information and leave records and the other employee had the ability to change employee pay rates and salaries. We also found that two employees who no longer work for the District still had access rights to the payroll or benefits modules within the financial system. The former Director of Accounting informed us that she performs an annual review of user access rights. However the report she reviews does not provide all the necessary detailed individual computer access rights information. There is a separate report that provides information pertaining to additional accesses within the financial system that is available for review; however the former Director of Accounting does not generally use this report to monitor employee access rights. DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 37

39 According to the former Director of Accounting, a lack of communication between department heads responsible for informing the systems analyst to update the access rights may have resulted in the unnecessary access rights we identified during our audit. When the District does not strictly control computer access rights, there is an increased risk that unauthorized changes could be made to the data or inappropriate transactions could be initiated and not detected by District managers. Audit Logs It is important that the District s computerized financial system allow officials to determine who is accessing the system and what transactions are being processed. Ideally, District management, or its designee(s), should review audit logs, change reports and/or exception reports to monitor the activity of users who access the financial system. Audit logs provide information such as the identity of each person who has accessed the system, the time and date of access, what activity occurred, and the time and date of sign off. Change reports can be used to show changes made to data such as vendor information or employee data, and exception reports can be used by management to identify any instance where financial information has violated a pre-determined set of parameters. These reports help provide the District with a mechanism for overseeing financial activity, determining individual accountability, reconstructing events and problem monitoring. The District s financial system is able to produce various audit log reports; however management does not review them. The system also generates daily change reports for payroll, which detail all of the changes that each of the payroll clerks made in the payroll system the day before. While the payroll clerks review the change reports, the reports are discarded and not reviewed by District management (see our finding entitled Payroll and Benefits). The system does not provide vendor change reports, however it can produce a daily report of purchase orders by account number which lists purchase order additions, changes, and deletions, and the last user. This report is not reviewed by District management. The system also does not provide change reports for accounts receivable (see our finding entitled Accounts Receivable). District officials have stated that it is not practical to review the lengthy reports that are generated by the financial system. As a result, day-to-day activities are not being monitored and there is an increased risk that District officials would not detect errors or inappropriate transactions. 38 OFFICE OF THE NEW YORK STATE COMPTROLLER

40 Recommendations 26. The Board should ensure that the District s disaster recovery plan is updated to include guidance on how to implement data recovery procedures for the District s financial system. The plan should be distributed to all responsible parties, periodically tested, and updated as needed. 27. District officials should monitor users access rights to ensure they are appropriate based on job functions and responsibilities, and that the level of access allowed promotes the proper segregation of duties. 28. District officials should periodically review audit logs and change reports for unusual activity. If desired reports are not currently available on the system, Management should work with the IT department to obtain these reports. DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 39

41 APPENDIX A RESPONSE FROM DISTRICT OFFICIALS The District officials response to this audit can be found on the following pages. 40 OFFICE OF THE NEW YORK STATE COMPTROLLER

42 DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 41

43 42 OFFICE OF THE NEW YORK STATE COMPTROLLER

44 DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 43

45 44 OFFICE OF THE NEW YORK STATE COMPTROLLER

46 DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 45

47 46 OFFICE OF THE NEW YORK STATE COMPTROLLER

48 DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 47