syracuse

Document Sample
syracuse Powered By Docstoc
					 OFFICE   OF THE   NEW YORK STATE COMPTROLLER
                   D IVISION OF LOCAL GOVERNMENT
                       & SCHOOL ACCOUNTABILITY




           Syracuse
     City School District

Internal Controls Over Selected
     Financial Operations
            Report of Examination
                    Period Covered:
             July 1, 2006 — March 31, 2008
                       2009M-84




                Thomas P. DiNapoli
                                Table of Contents

                                                                               Page

AUTHORITY LETTER                                                                3

EXECUTIVE SUMMARY                                                               4

INTRODUCTION                                                                    7
           Background                                                           7
           Objective                                                            7
           Scope and Methodology                                                8
           Comments of District Officials and Corrective Action                  8

ACCOUNTS RECEIVABLE                                                             9
           Accounts Receivable Records                                          9
           Segregation of Duties                                               12
           Recommendations                                                     13

EXTRA-CLASSROOM ACTIVITY AND SCHOOL FUNDS                                      14
            School Accounts                                                    15
            Cash Disbursements                                                 18
            Cash Receipts                                                      20
            Periodic Reconciliations                                           20
            Interest Earnings                                                  21
            Inactive Accounts                                                  22
            Internal Control Improvements                                      22
            Recommendations                                                    23

PAYROLL AND BENEFITS                                                           24
            Segregation of Duties and Oversight                                24
            Retirement Reporting                                               27
            Recommendations                                                    28

PURCHASING                                                                     30
                Competitive Bidding                                            30
                Quotes                                                         33
                Legal Services                                                 34
                Recommendations                                                35

INFORMATION TECHNOLOGY                                                         36
            Disaster Recovery Plan                                             36
            User Access Rights                                                 37
            Audit Logs                                                         38
            Recommendations                                                    39
                      DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY          1
                                                                                      1
APPENDIX   A   Response From District Officials                 40
APPENDIX   B   Audit Methodology and Standards                 49
APPENDIX   C   How to Obtain Additional Copies of the Report   52
APPENDIX   D   Local Regional Office Listing                    53




 2     OFFICE OF THE NEW YORK STATE COMPTROLLER
                                                 State of New York
                                    Office of the State Comptroller


Division of Local Government
and School Accountability

November 2009

Dear School District Officials:

A top priority of the Office of the State Comptroller is to help school district officials manage their
districts efficiently and effectively and, by so doing, provide accountability for tax dollars spent to
support district operations. The Comptroller oversees the fiscal affairs of districts statewide, as well
as districts’ compliance with relevant statutes and observance of good business practices. This fiscal
oversight is accomplished, in part, through our audits, which identify opportunities for improving
district operations and Board of Education governance. Audits also can identify strategies to reduce
district costs and to strengthen controls intended to safeguard district assets.

Following is a report of our audit of the Syracuse City School District, entitled Internal Controls Over
Selected Financial Operations. This audit was conducted pursuant to Article V, Section 1 of the State
Constitution and the State Comptroller’s authority as set forth in Article 3 of the General Municipal
Law.

This audit’s results and recommendations are resources for district officials to use in effectively
managing operations and in meeting the expectations of their constituents. If you have questions about
this report, please feel free to contact the local regional office for your county, as listed at the end of
this report.

Respectfully submitted,


Office of the State Comptroller
Division of Local Government
and School Accountability




                           DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY                    3
                                                                                                     3
                                                                  State of New York
                                                     Office of the State Comptroller
                                                       EXECUTIVE SUMMARY



The Syracuse City School District (District) is governed by the Board of Education (Board) which
comprises seven elected members. The Board is responsible for the general management and control
of the District’s financial and educational affairs. The Superintendent of Schools (Superintendent) is
the chief executive officer of the District and is responsible, along with other administrative staff, for
the day-to-day management of the District under the direction of the Board.

There are 38 schools in operation within the District, with approximately 20,000 students and 4,300
employees. The District’s budgeted expenditures for the 2007-08 year were $494 million, which were
funded primarily with State aid, real property taxes and grants.

Scope and Objective

The objective of our audit was to examine the District’s internal controls over selected financial
activities for the period July 1, 2006 through March 31, 2008. We extended the scope of our audit
to test the District’s June 2008 report to the New York State Employees’ Retirement System and its
December 2008 outstanding accounts receivable report. We also reviewed user access right reports
for May 2008 and the disaster recovery plan created by the District during the 2008-09 fiscal year.
In some instances, we reported on transactions and activities outside of our audit period because we
considered it necessary and relevant to this audit.

Our audit addressed the following related questions:

   •   Are internal controls over accounts receivable appropriately designed and operating
       effectively to adequately safeguard District assets?

   •   Does the District have adequate internal control policies and procedures to protect and account
       for District extra-classroom activity and School Accounts?

   •   Has the District provided compensation and benefits to school employees and officials in
       accordance with the terms of relevant contractual agreements and Board policies?

   •   Has the District established policies and procedures to ensure that goods and services are
       purchased in the most prudent and economical way?

   •   Are the District’s controls over information technology adequately designed to protect the
       District’s financial data from loss or misuse?

   4        OFFICE OF THE NEW YORK STATE COMPTROLLER
Audit Results

District officials’ ineffective use of staff and data resources during our audit period resulted in
inaccurate records of accounts receivables and significant deficiencies in controls over these assets;
unsupported disbursements from School Accounts which the District is not legally authorized to have;
a number of purchases made without compliance with contracts or competitive bidding requirements;
routine payroll errors; and a lack of assurance that the District’s electronic data is properly safeguarded
from loss or misuse.

During our audit period, payments recorded as received in the accounts receivable records for the
various types of billed services totaled about $17 million. We found that internal controls over
accounts receivable were so poor that District officials had no way of ensuring that all the moneys due
the District were actually received. Our testing identified funds that the District should have, but had
not, collected. In addition, the records the District did maintain were so inaccurate they could not be
relied upon. For example, accounts receivable recorded in the District’s detailed records at December
2, 2008 were overstated by at least $1.24 million, or 40 percent. District officials did not have a formal
process to monitor and enforce unpaid bills.

We also found that certain District employees were responsible for incompatible duties. Several
individuals who handled cash receipts also had recordkeeping responsibilities or had access to the
computerized receivable records and could make changes to the accounts without supervisory review
or approval and without leaving an audit trail showing the adjustments made and who made them.
Consequently, there is an increased risk that District personnel could misappropriate funds and conceal
the theft by manipulating the records.

Thirty-seven of the District’s schools have a school account1 (School Account) that is controlled by the
principal or other staff members. As of June 30, 2008, school treasurers reported about $107,000 in
these School Accounts.2 However, the District had no legal authority to set up these School Accounts.

Furthermore, we found weak controls over extra-classroom activity (ECA) and School Accounts. Our
tests of disbursements disclosed payments totaling $3,400 that had no supporting documentation and
payments totaling $23,700 that lacked adequate support. Procedures to control cash disbursements
and cash receipts were circumvented or not followed; periodic reconciliations between the school
treasurers’ records and activity treasurers’ records were not completed; interest was not allocated
among the activities; and inactive accounts were not reviewed regularly. Given the lack of
documentation for numerous disbursements, District officials are unable to determine the propriety
of many of these transactions and there is an increased risk that District or student moneys could have
been misused.

We found that undetected errors routinely occur in the District’s payroll process. Our testing disclosed
that the District provided about $19,500 in compensation and benefits to employees that were either
overpayments, or lacked Board authorization or adequate supporting documentation. For example,
the Superintendent authorized a principal to roll over 50 sick days from her employment at another

1
  According to the District, moneys in these School Accounts may be used for direct and indirect benefits to the students
and the educational environment.
2
  At the time of our audit, the Business Office was in the process of verifying that all school accounts were properly
identified by the school treasurers.
                              DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY                              5
                                                                                                                  5
school district when the District hired her, without obtaining Board approval. These additional sick
days could result in extra cash payments of about $10,625. Furthermore, District management did not
adequately segregate the duties of the payroll clerks and properly oversee their work, and the District’s
computerized payroll system was not able to generate complete final payroll registers. The District did
not establish a standard work day for all employees for retirement reporting purposes and it incorrectly
reported the days worked for seven employees to the ERS. These errors resulted in part-time custodial
helpers being reported as working full-time and part-time typists being over-reported by one to 6.67
days during our test months.

The District did not consistently comply with policies and procedures regarding competitive bidding
and the Board and District management did not enforce the District’s policies and procedures
requiring oral or written quotes for purchases under competitive bidding thresholds. Our tests of 21
contracts for compliance with competitive bidding requirements disclosed that District officials did
not comply with either policies and procedures or contract requirements for 10 of these contracts
totaling about $1.25 million. Additionally, the District did not follow its procurement policy nor did
it comply with contract requirements for eight out of 20 contracts we tested that were not subject to
competitive bidding, totaling $26,229. As a result, the District may have paid more than it needed to
for its purchases of goods and services.

The Board adopted a school attorney policy in October 2006 that requires officials to use a request
for proposal (RFP) process “when seeking to retain a School Attorney.” District officials stated that it
is the intent of this policy to require an RFP process only when the Board seeks to retain a new legal
counsel, not when it continues to retain its existing counsel. As a result, the District did not use an
RFP process when it re-appointed a law firm as the school’s attorney in May 2007. We believe that it
is a good practice to solicit competition for legal services at reasonable intervals. Without the benefit
of periodic competition, there is an increased risk that the District will not secure legal services in a
manner that will optimize quality and cost.

Lastly, we found weaknesses in internal controls over the District’s computerized financial system.
Specifically, District officials have not developed an adequate formal disaster recovery plan for its
information technology, ensured that employees were given proper access rights or ensured that audit
logs and change reports were monitored. As a result, there is an increased risk that computer data
could be lost and the District would not be able to recover the data in the event of a disaster, and the
potential for misuse or alteration of data that could result in the compromise of sensitive information
and/or potential financial loss to the District.

Comments of District Officials

The results of our audit and recommendations have been discussed with District officials and their
comments, which appear in Appendix A, have been considered in preparing this report. District
officials generally agreed with our recommendations and indicated they plan to take or have already
taken corrective action.




   6        OFFICE OF THE NEW YORK STATE COMPTROLLER
                          Introduction
Background        The Syracuse City School District (District) is located in the City
                  of Syracuse in Onondaga County. The District is governed by the
                  Board of Education (Board) which comprises seven elected members.
                  The Board is an independent body responsible for the general
                  management and control of the City of Syracuse’s (City) educational
                  affairs. The Superintendent of Schools (Superintendent) is the chief
                  executive officer of the District and is responsible, along with other
                  administrative staff, for the day-to-day management of the District
                  under the direction of the Board. The District is not a department of
                  the City, but is a component unit. However, it lacks the authority to
                  levy taxes or incur debt and is, therefore, fiscally dependent upon the
                  City government. The District’s budget is subject to approval by the
                  City’s Common Council.

                  There are 38 schools in operation within the District, with
                  approximately 20,000 students and 4,300 employees. The District’s
                  budgeted expenditures for the 2007-08 year were $494 million, which
                  were funded primarily with State aid, real property taxes and grants.

                  Responsibilities relating to District finances, accounting records and
                  reports are largely those of the Chief Financial Officer, the Director of
                  Fiscal Services and the Director of Accounting. The Board appointed
                  a claims auditor to assume the Board’s powers and duties in regard
                  to approving or denying claims against the District. All financial
                  transactions are processed on a financial accounting system located
                  on a server at the District.

Objective         The objective of our audit was to examine the District’s internal
                  controls over selected financial operations. Our audit addressed the
                  following related questions:

                     •   Are internal controls over accounts receivable appropriately
                         designed and operating effectively to adequately safeguard
                         District assets?

                     •   Does the District have adequate internal control policies and
                         procedures to protect and account for District extra-classroom
                         activity and School Accounts?

                     •   Has the District provided compensation and benefits to school
                         employees and officials in accordance with the terms of
                         relevant contractual agreements and Board policies?


             DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY                  7
                                                                                     7
                               •   Has the District established policies and procedures to ensure
                                   that goods and services are purchased in the most prudent and
                                   economical way?

                               •   Are the District’s controls over information technology
                                   adequately designed to protect the District’s financial data
                                   from loss or misuse?

Scope and                  The objective of our audit was to examine the District’s internal
Methodology                controls over selected financial activities for the period July 1, 2006
                           through March 31, 2008. We extended the scope of our audit to test
                           the District’s June 2008 report to the New York State Employees’
                           Retirement System and its December 2008 outstanding accounts
                           receivable report. We also reviewed user access right reports for May
                           2008 and the disaster recovery plan created by the District during the
                           2008-09 fiscal year. In some instances, we reported on transactions
                           and activities outside of our audit period because we considered it
                           necessary and relevant to this audit.

                           We conducted our audit in accordance with generally accepted
                           government auditing standards (GAGAS). More information on
                           such standards and the methodology used in performing this audit is
                           included in Appendix B of this report.

Comments of District       The results of our audit and recommendations have been discussed
Officials and Corrective    with District officials and their comments, which appear in Appendix
Action                     A, have been considered in preparing this report. District officials
                           generally agreed with our recommendations and indicated they plan
                           to take or have already taken corrective action.

                           The Board has the responsibility to initiate corrective action.
                           Pursuant to Section 35 of the General Municipal Law, Section 2116-
                           a (3)(c) of the Education Law, and Section 170.12 of the Regulations
                           of the Commissioner of Education, a written corrective action plan
                           (CAP) that addresses the findings and recommendations in this report
                           must be prepared and provided to our office within 90 days, with
                           a copy forwarded to the Commissioner of Education. To the extent
                           practicable, implementation of the CAP must begin by the end of
                           the next fiscal year. For more information on preparing and filing
                           your CAP, please refer to our brochure, Responding to an OSC Audit
                           Report, which you received with the draft audit report. The Board
                           should make the CAP available for public review in the District
                           Clerk’s office.




  8        OFFICE OF THE NEW YORK STATE COMPTROLLER
                            Accounts Receivable

                           The District provides various services for which it imposes charges
                           by billing individuals, departments of the District and the City of
                           Syracuse. These charges include such things as non-resident tuition,
                           charges for food services (within the District), charges for the use of
                           District facilities and other miscellaneous items such as charges for
                           photocopies. The District also bills to recapture certain reimbursable
                           costs. These include reimbursement for overpayments made by the
                           District, collection on insufficient fund checks, and retirees’ health
                           insurance reimbursements. During our audit period, payments
                           recorded as received in the detail accounts receivable records for the
                           various types of billed services totaled about $17 million.

                           District management is responsible for establishing appropriate
                           internal controls over the District’s accounts receivable process.
                           Essential to effective internal control over billed revenues/
                           reimbursements is the maintenance of complete, accurate and
                           functional accounts receivable records that are suitable for monitoring
                           outstanding balances. Good internal control over accounts receivable
                           should also provide for adequate segregation of duties to prevent any
                           single individual from routinely performing incompatible duties.
                           Good recordkeeping and the separation of incompatible duties helps
                           safeguard these assets and provides assurance that amounts due the
                           District are collected and deposited.

                           We found that internal controls over accounts receivable were so poor
                           that District officials had no way of ensuring that all the moneys
                           due the District were actually received. Our testing identified funds
                           that the District should have, but had not, collected. In addition,
                           the records the District did maintain were so inaccurate they can
                           not be relied upon. For example, accounts receivable recorded in
                           the District’s detailed accounting records at December 2, 2008 were
                           overstated by at least $1.24 million, or 40 percent. Although the
                           District did not rely on these records for its financial reporting, the
                           absence of reliable detailed receivable records and weak controls
                           significantly diminish District managers’ ability to monitor and
                           control these assets.

Accounts Receivable        Effective recordkeeping for accounts receivable requires maintaining
Records                    a general ledger control record that summarizes the billing and
                           payment activity and unpaid balance for all accounts as well as a
                           detailed subsidiary ledger showing the activity and unpaid balance
                           of each individual account. The control account and the detailed
                           records should be periodically reconciled to help ensure accuracy
                           and to detect errors or other irregularities. The accounts receivable
                      DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY                 9
                                                                                             9
                     detail records should provide sufficient information to link recorded
                     billings with their supporting invoices and should clearly indicate
                     the date and amount of each billing and payment. Adjustments to
                     accounts receivable balances not related to the normal billing and
                     payment process should be identified, supported and explained in
                     journal entries. In addition, no adjustment should be made to the
                     accounts without prior approval by an appropriate individual (i.e.,
                     a departmental supervisor) who is independent of the accounts
                     receivable function. Also, where the billing and accounts receivable
                     recording process is computerized, the software used should be
                     capable of providing an audit trail showing all changes made to the
                     accounts and the system user who initiated the change.

                     We found that the District did not maintain an accounts receivable
                     control account. The general ledger account is only posted once each
                     year to record the estimated balance of accounts receivable at year
                     end for financial reporting purposes. This estimate is based on the
                     actual payments on account received in the first three months of the
                     subsequent fiscal year. The entry to record the estimate is reversed
                     in the next year to zero out the general ledger account until the next
                     year-end estimate is posted. Because an accounts receivable control
                     account is not maintained, the District has no mechanism to reconcile
                     the detailed subsidiary receivable records. Such a reconciliation helps
                     ensure the accuracy of the subsidiary records and enables the District
                     to detect and correct errors or irregularities. Due to inaccuracies
                     contained in the detailed subsidiary receivable records, District
                     management did not rely on the subsidiary records for its financial
                     reporting.

                     At our request, the former Director of Accounting generated a report
                     of the detailed accounts receivable at December 2, 2008 that initially
                     showed a total accounts receivable balance of $3,043,269. However,
                     the former Director of Accounting performed an analysis of the report
                     and concluded that the actual balance of outstanding receivables was
                     only $2,093,275 and that the report included $949,994 in erroneous
                     open items.

                     However, we found that this reported figure of $2,093,275 was also
                     inaccurate. On a sample basis we identified another $290,722 that
                     was not outstanding. We judgmentally selected and analyzed 19 open
                     invoices, totaling $349,982. We determined that five of the invoices,
                     totaling $248,445, were not open invoices but instead had actually
                     been paid or partially paid with the remaining balance uncollectible.3
                     3
                       We verified that amounts collected in payment of four of the five invoices were
                     recorded in the cash receipts journal and deposited in the bank. Payment on the
                     other invoice was received in the form of a credit on an outstanding bill owed by the
                     District to the same party. We reviewed the related journal entry that was recorded
                     in the general ledger of the central records to reflect this offsetting transaction and
                     noted nothing irregular.

10   OFFICE OF THE NEW YORK STATE COMPTROLLER
     Five invoices, totaling $42,277, were subsequently determined by
     District personnel to be uncollectible. The remaining nine invoices
     totaling $59,260 were still outstanding. Therefore, only 17 percent
     of the sample items we tested were still viable accounts receivable.
     In total, the original report generated from the District’s detailed
     accounts receivable records was overstated by at least $1.24 million.

     We identified deficiencies within the District’s computerized
     accounts receivable billing module which have led to inaccuracies
     in the records and also make it difficult for the District to monitor
     accounts receivables. The system allows a report of the current
     status of invoices, but it is not capable of generating a report of the
     status of invoices at a previous point in time and it does not generate
     an accounts receivable aging schedule. An accounts receivable
     aging schedule is essential for monitoring detailed receivables and
     initiating collection activity.

     The District’s accounts receivable billing module also does not enable
     the District to apply multiple partial payments against an invoice.
     The system will only record the most recent payment on an invoice
     and it will not show the previous payment history for that invoice. As
     a result, when the Benefits Department receives a partial payment,
     staff will post the amount received to the ledger and then create a
     new invoice in the amount of the remaining unpaid balance of the
     original invoice. Consequently, if multiple payments are made for
     one invoice, the total amount recorded as billed will be overstated.
     This recordkeeping practice coupled with the fact that the unpaid
     balances of accounts must be manually calculated increases the risk
     of errors and makes monitoring of accounts difficult.

     Adjustments to accounts receivable to reflect voided invoices are not
     always recorded in a manner that accurately depicts the action taken.
     For example, when the Benefits Department wants to void an invoice
     in its receivable ledger, a fictitious payment entry is made. In other
     departments, a voided invoice is sometimes recorded by deleting the
     invoice amount from the accounts receivable ledger. If an invoice is
     voided in this manner, there is no record in the ledger of the amount
     originally billed. We were advised by the District’s Systems Analyst
     that the District’s computer operating system does not capture and
     provide a record or report of voided invoices or changes made to
     invoices and who made them.

     To determine whether recorded invoices had been improperly
     adjusted, we judgmentally selected 91 invoice entries representing
     billings totaling about $1.6 million. We compared the information
     shown in the ledgers to the original invoices (or our recalculation


DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY                11
                                                                      11
                           of the original invoice) and concluded that the adjustments were
                           appropriate.

                           We also judgmentally selected 21 voided invoices to determine if the
                           transactions had been voided for legitimate reasons. We were able to
                           satisfy ourselves through examination of original invoices and other
                           supporting documentation that 19 of the 21 were legitimate voids.
                           However, because original invoices and any other documentation to
                           support the other two voided invoices were not available we could
                           not ascertain the reason(s) why these invoices were voided or verify
                           that the voids were appropriate.

                           The failure to maintain accurate accounts receivable records that
                           provide a clear audit trail of all billings, receipts and adjustments
                           weakens controls, increases the risk that fraudulent transactions
                           could be entered into the system and not detected and diminishes the
                           District’s ability to effectively monitor and enforce amounts due to
                           the District.

Segregation of Duties      A fundamental concept of good internal control is the segregation
                           of incompatible duties. Authorizing transactions, recordkeeping and
                           receiving/handling cash should be performed by separate individuals.
                           When the same individual who handles cash also is involved in
                           billing and maintaining the accounts receivable records, there is
                           an opportunity to misappropriate funds and to conceal the theft by
                           manipulation of the records. Similarly, the ability to authorize and/
                           or make adjustments to accounts should not be held by someone who
                           handles cash.

                           District personnel involved in the billing and accounts receivable
                           recording process are responsible for incompatible duties. An
                           account clerk in the Business Office is responsible for receiving
                           cash for all departments that bill for services, reimbursements etc.
                           However, the Benefits Department receives most of the payments
                           made on its billings and other departments occasionally do receive
                           cash before transmitting it to the Business Office. We found that the
                           same individuals, who handle cash receipts, including the Business
                           Office account clerk, are also responsible for and/or have the ability
                           to enter invoices and post payments in the accounts receivable
                           ledgers. Moreover, all of these individuals also have the ability to
                           change information previously posted to the ledgers with no record
                           produced of the adjustments they might make. Personnel responsible
                           for making adjustments to the accounts receivable ledger, such as
                           voiding invoices or changing the amount of billings or payments,
                           are not required to obtain prior approval from a supervisor before
                           initiating such adjustments. The risks associated with not segregating
                           these duties, such as the opportunity to misappropriate funds and to

  12       OFFICE OF THE NEW YORK STATE COMPTROLLER
                       conceal the theft by manipulation of the records, are exacerbated by
                       the internal control deficiencies in the accounts receivable records
                       that were previously discussed.

                       We judgmentally selected 75 invoices ($1,416,086 in total) that were
                       recorded as paid in the detail accounts receivable records during our
                       audit period, and we verified that the amounts recorded as paid agreed
                       with the amounts deposited in the bank. We also traced from duplicate
                       receipt books and cash receipts logs maintained in the Business Office
                       to the related bank deposits and we found no significant exceptions.

Recommendations        1. District officials should maintain an accounts receivable control
                          account and someone independent from the cash handling and
                          recordkeeping process should periodically reconcile that account
                          with the subsidiary receivable ledgers.

                       2. District officials should work with the Information Technology
                          (IT) department to ensure that the District’s computerized
                          accounts receivable system is able to accomplish the following:

                              •   Generate reports showing the status of invoices at any
                                  given point in time

                              •   Generate accounts receivable aging reports

                              •   Record multiple partial payments against original
                                  invoices

                              •   Track changes or adjustments made to the system and who
                                  made them.

                       3. District officials should require supervisory approval prior to
                          adjusting accounts receivable records and management should
                          periodically review change reports or logs for unusual activity.

                       4. District officials should develop enforcement procedures for
                          outstanding billed invoices to ensure moneys due are collected
                          timely.

                       5. District officials should review the District’s system of internal
                          controls over accounts receivable and address the risks. At a
                          minimum, cash handling and maintaining receivable records
                          should be segregated to the extent practical. Where incompatible
                          duties cannot be segregated, District officials should establish
                          supervisory review procedures to mitigate specific risks.



                  DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY              13
                                                                                      13
       Extra-Classroom Activity and School Funds

                      Regulations of the New York State Commissioner of Education
                      (Regulations) require each school district’s board of education4 to
                      make rules and regulations for the safeguarding, accounting, and
                      auditing of all extra-classroom activity fund moneys. Generally,
                      extra-classroom activity funds are raised through charges for, by,
                      or in the name of organizations whose activities are conducted by
                      students. Students raise and spend these funds to promote the general
                      welfare, education, and morale of all students, and to finance the
                      normal and appropriate extracurricular activities of the student body.

                      District management is responsible for the protection and oversight
                      of the District’s extra-classroom activity (ECA) moneys. These
                      responsibilities include adopting policies and procedures that
                      describe the methods for establishing the organization, the records
                      that District employees and students must maintain, and the duties
                      and control procedures that they must follow to adequately safeguard
                      ECA moneys. Having a good system of internal controls over these
                      funds helps minimize the risk that errors or irregularities may occur
                      and go undetected.

                      The District’s external auditor reported that the District had about
                      930 accounts5 in its extra-classroom activity fund during 2006-07.
                      These accounts include not only ECA accounts, but also individual
                      school accounts (“School Accounts” or “Accounts”). The School
                      Accounts are maintained by a treasurer in each school, but unlike
                      ECA accounts, the School Accounts are not maintained in connection
                      with student organizations. We found that the District is not
                      authorized to establish School Accounts.

                      The ECA accounts and School Accounts together recorded more than
                      $1.5 million of receipts and disbursements during the 2006-07 fiscal
                      year and had a cash balance of approximately $774,000 as of June
                      30, 2007. As part of our audit, we examined the financial practices
                      and records for ECA accounts and School Accounts at five schools –
                      Corcoran and Fowler High Schools, Huntington K-8 School, Grant
                      Middle School and Webster Elementary School.

                      Although the District has provided guidance on ECA accounts and
                      School Accounts in the form of policies and regulations, various
                      Board resolutions and a procedures manual, District officials and

                      4
                        This Regulation applies to school districts that have a population of less than one
                      million and an educational program beyond the 6th grade.
                      5
                        Moneys in these accounts were commingled in a bank account(s) for each school.

14   OFFICE OF THE NEW YORK STATE COMPTROLLER
                       employees did not always comply with this guidance. As a result, we
                       found weak controls over the ECA accounts and School Accounts.
                       For example, our tests of disbursements disclosed payments totaling
                       $3,400 that had no supporting documentation and payments totaling
                       $23,700 that lacked adequate support. We also noted instances in
                       which school treasurers disbursed and transferred funds without
                       required approvals and issued checks without the required dual
                       signatures. Additionally, school treasurers did not always issue
                       receipts, and the Board did not provide guidance on either the
                       distribution of the interest earned from the investment of the moneys
                       in ECA accounts and School Accounts, or the disposition of the
                       moneys in inactive accounts.

School Accounts        According to the Regulations, an ECA is an organization operating
                       within a school district whose activities are conducted by students
                       and whose financial support is raised other than by taxation or
                       through charges of the Board. One of the intended purposes of an
                       ECA is to allow students to operate an activity and be involved in
                       the financial management of that activity. Generally, only activities
                       conducted by students qualify as an ECA.

                       Realizing that a number of the accounts in the ECA fund were not
                       related to student organizations, the Board adopted a policy and
                       regulation governing individual School Accounts in April 2007.
                       The District defines individual School Account funds as those funds
                       raised on a local basis (e.g., by donations specific to the school and
                       other approved fund raising activities) which do not consist of funds
                       budgeted through the District budget. These moneys are raised
                       for, by, or in the name of a specific school, but they are not raised
                       or maintained by a school student body through extra-classroom
                       activities. According to the District’s procedures manual, both ECA
                       accounts and School Accounts are used for the benefit of students.
                       The main distinction between an ECA account and a School Account
                       is that an ECA account is restricted for the purpose of providing
                       direct benefit for the students, whereas a School Account may also
                       be used for indirect benefits to the students and the educational
                       environment.

                       There is no authority for the District to use School Accounts. Education
                       Law requires all funds raised for District purposes from any source
                       to be paid into the treasury of the City and disbursed by the City’s
                       chief fiscal officer after the District claims auditor has audited and
                       approved the related claims. Additionally, Education Law requires
                       the District to estimate revenues from all sources in its annual budget
                       estimate filed with the City. The District’s School Accounts do not
                       comply with these requirements because the receipts are collected and
                       deposited into the accounts by the school treasurers, who maintain
                  DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY                 15
                                                                                         15
                     custody of the funds, rather than transferring them to the City’s chief
                     fiscal officer. The school treasurers also disburse the moneys from the
                     accounts upon the approval of the building principal, without prior
                     audit and approval by the District’s claims auditor. Revenues and
                     expenditures of the School Accounts are not budgeted by the District,
                     and are not recorded in the District’s or the City’s central accounting
                     records.

                     During 2007-08, the District opened separate bank accounts for each
                     school to segregate School Account funds from ECA funds. School
                     treasurers in 37 schools reported about $107,000 in School Accounts
                     as of June 30, 2008, but at the time of our audit, the Business Office
                     had not yet verified that the reported balances represented all the
                     School Accounts. Although the District had not finished the process
                     during our audit, we identified at least 20 School Accounts in the five
                     schools we reviewed that should be accounted for in the District’s
                     general fund or trust and agency accounts, and disbursed following
                     audit and approval by the District’s claims auditor. These accounts
                     are funded by gifts, donations and grants, or funds raised by teachers,
                     coaches and parents rather than student organizations. Expenditures
                     from these accounts include payments for scholarships, purchases of
                     classroom supplies, and the costs associated with field trips, library
                     improvements and athletics. Our testing of claims paid out of
                     School Accounts also disclosed expenditures for meals, equipment,
                     office furniture, electronics, software, landscaping, sports field
                     improvements, and magazine subscriptions.

                     In some cases, the School Accounts were funded with moneys paid
                     from the District’s general fund. During our audit period, the Board
                     approved payment of a total of $43,000 from the general fund to
                     School Accounts maintained by the four high schools, so that the
                     schools could use the funds to pay entry fees for athletic meets and
                     events.6 From July 1, 2006 to March 31, 2008, the District also
                     paid about $165,500 in revenues it received from beverage vending
                     machine commissions7 to School Accounts maintained by 37 of its
                     schools. This revenue was initially recorded in the general fund and
                     then the moneys were distributed to the individual School Accounts
                     in proportion to the vending machine commissions generated by each
                     school. Pursuant to an August 2001 Board resolution, each building
                     principal was required to ensure the funds derived from the vending
                     machine commissions were used solely for student-related incentives
                     and/or activities, but not for staff or consultant compensation, staff
                     6
                       Each high school receives $5,000 or $6,000 each fiscal year.
                     7
                       The District entered into a contract with a vendor which grants the vendor
                     exclusive pouring and vending rights to supply beverages to all District facilities. In
                     consideration for this right, the vendor pays the District a 37 percent commission on
                     the moneys collected. The District also receives an annual license fee in connection
                     with the contract, but this revenue is not distributed to the individual schools.

16   OFFICE OF THE NEW YORK STATE COMPTROLLER
     development, staff travel or capital improvements. In November
     2007, the Board passed another resolution requiring building
     principals to use 60 percent of the funds derived from the vending
     machine commissions for student incentives, and 40 percent of the
     funds for staff development activities geared to improve student
     achievement. The District now distributes only 60 percent of the
     vending machine commission revenue to the School Accounts, and
     accounts for the remaining 40 percent in the special aid fund.8
     District officials told us they prefer to account for the 40 percent
     allocation in the special aid fund, rather than the general fund,
     because this enables them to roll over to the following year any
     unexpended balance instead of losing the identity of the funds when
     they are closed to fund balance at year-end.

     The revenues derived from vending machine commissions and
     expenditures financed with those funds should be accounted for in
     the general fund, and not paid into School Accounts or accounted
     for in the special aid fund. The special aid fund should only be used
     to account for special projects or programs supported in whole or
     in part by Federal funds or State-funded grants. Since the vending
     machine commission revenue does not relate to any Federal funds or
     State-funded grants, the District should account for the money in its
     general fund.

     Furthermore, we noted that the District’s April 2007 policy on
     individual School Accounts states that individual School Account
     balances shall not exceed $7,500. However, we found that the
     individual schools did not always comply with this requirement. For
     example, according to quarterly financial reports filed by the schools,
     as of March 31, 2008, Corcoran High School had $35,450 in its
     Athletics School Account and Fowler High School had over $15,000
     in its Principal School Account.

     An audit by the District’s internal auditor and reviews of School
     Accounts by the District’s claims auditor and Fiscal Services
     Department identified a number of internal control deficiencies
     involving School Accounts. As a result, the Board put a “freeze” on all
     School Account expenditures effective July 1, 2008. Any expenses
     out of the Accounts during the freeze period must first be approved
     by the appropriate Deputy Superintendent and the District’s Chief
     Fiscal Officer, and any such expenses must be reported monthly to
     the Board. In December 2008, the Board also passed a resolution to
     reduce the cap on individual School Account balances to $1,500.

     8
       This new allocation went into effect in January 2008. Unlike disbursements out of
     the School Accounts, which are approved by the building principals, disbursements
     from the Special Aid Fund are required to go through the District’s normal
     procurement, claims audit and disbursement process.

DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY                           17
                                                                                 17
                          As discussed below, we found significant control weaknesses related
                          to the ECA accounts and School Accounts. With respect to the
                          School Accounts, compliance with the requirements of the Education
                          Law relating to cash custody, audit of claims and budgeting
                          would strengthen controls, and thereby increase accountability and
                          transparency in the use of the moneys in the Accounts.
Cash Disbursements        The District’s procedures manual, dated April 2007, outlines
                          procedures for the disbursement of moneys in ECA accounts and
                          School Accounts. The procedures manual requires the use of purchase
                          orders, and request for payment forms, to document requests and
                          approvals to make purchases and to disburse funds.9 Receipts or
                          invoices must be attached to request for payment forms and submitted
                          to the school treasurer in order to support the expenditures. The
                          District’s policies and procedures also require that all payments from
                          ECA accounts and School Accounts be made by checks signed by
                          both the Principal (or his or her designee) and the school treasurer,
                          and checks greater than $500 be pre-approved in writing by the
                          Central Office. Transfers between ECA accounts and between School
                          Accounts must be documented on transfer forms and approved by
                          the respective activity advisor or principal, the school treasurer and
                          the Central Office. Our tests of 368 cash disbursements out of ECA
                          accounts and School Accounts totaling about $212,000, and transfers
                          between accounts totaling about $31,000, disclosed the following
                          deficiencies:10

                              •   Nine payments totaling about $3,400 contained no supporting
                                  documentation. Eight of these payments totaling $2,710 were
                                  made out of Corcoran High School bank accounts and one
                                  payment for $690 was made out of a Grant Middle School
                                  account. Some examples of the Corcoran unsupported
                                  disbursements include $370 paid to a former principal,
                                  $207 paid to two local restaurants, and $715 paid to a fence
                                  company. The unsupported disbursement from Grant Middle
                                  School was made to a bus company.

                              •   Eighty-two payments totaling about $23,700 lacked adequate
                                  supporting documentation. For example, we noted 18
                                  disbursements totaling $3,753 paid out of Corcoran School
                                  Accounts that were only supported by post-it-notes or other
                                  informal notes that indicated the payee and amount, but
                                  generally did not explain the reason for the disbursements.
                          9
                             Prior to the development of the procedures manual, the District had a policy
                          that required all ECA funds to be handled in accordance with financial procedures
                          recommended by the State Education Department (SED). Similar to the District’s
                          current procedures manual, SED recommends the use of purchase and payment
                          orders.
                          10
                             Some disbursements had more than one deficiency.

 18       OFFICE OF THE NEW YORK STATE COMPTROLLER
            Two payments out of Corcoran’s vending machine School
            Account for $300 each were based only on invoices indicating
            “labor charges,” with no explanation of what services were
            provided. Another nine payments totaling $3,185 out of the
            Corcoran Athletics School Account were supported only by
            forms showing the payee, amount paid, and the Advisor’s
            signature. No invoices, receipts or explanations for the
            disbursements were attached. Fowler High School made 14
            payments to reimburse the school’s principal for expenses she
            incurred. These payments totaling $1,224 were supported
            by credit card receipts that lacked itemization to show what
            was purchased. Notations on the claims indicate that many
            of these purchases were for food or meals at meetings.
            Webster Elementary School paid $4,676 out of its Principal
            School Account for choral risers, but no invoice was attached
            to support the payment. Also, Huntington School made
            payments totaling $606 to a bus company without invoices or
            receipts.

        •   On 12 occasions, school treasurers wrote two to four checks
            to the same vendor on the same day, apparently in order to
            circumvent the Board’s policy requiring prior Central Office
            approval of checks over $500. In addition to these split
            check payments totaling $9,419, there were three other check
            payments, each in excess of $500, totaling $16,529, for which
            there is no evidence of Central Office approval.

        •   Twelve checks totaling $3,824 were signed by the school
            treasurer, but were not signed by the Principal (or his or her
            designee) as required by the District’s procedures.

        •   Twenty-eight transfers totaling $19,303 between ECA
            accounts and between School Accounts lacked the required
            forms to document approval of the transfers. The majority of
            these transfers (24 transfers totaling $17,771) were made by
            the school treasurer of Corcoran High School. We also found
            two transfers recorded to increase accounts in the amount
            of $543 and $100 that did not have corresponding transfers
            recorded out of other accounts.

     In addition, the five schools we examined did not always use the
     purchase and payment order forms that were included in the District’s
     procedures manual which went into effect in April 2007. While
     Fowler High School used the forms in some instances, we noted
     that the forms were not used for all disbursements, and some
     disbursements lacked required approvals (e.g., approval by the
     activity treasurer, activity advisor and/or the principal). Some of

DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY              19
                                                                    19
                           the District’s other schools used their own forms, but these forms did
                           not always include all the authorizations required by the procedures
                           manual. The Grant school did not use any authorization forms, so
                           there was no documented approval of disbursements in that school.

                           Internal controls are weakened when disbursements are made without
                           required authorizations or based on missing or incomplete supporting
                           documentation. Due to the lack of documentation for certain
                           payments, District officials are unable to determine the propriety of
                           transactions. In addition, the District’s failure to comply with its own
                           policies governing controls over these funds increases the risk that
                           errors and irregularities could occur and remain undetected and that
                           District or ECA moneys could be lost or misused.

Cash Receipts              The District’s procedures manual requires each school treasurer to
                           prepare a pre-numbered three-part receipt11 for all cash and checks
                           received from ECA advisors or the principal. Both the school treasurer
                           and ECA advisor must sign the receipt to document the transmittal of
                           the funds. The ECA advisor or principal must make copies of all
                           checks received and submit them to the school treasurer who should
                           keep them on file with a copy of the pre-numbered receipt.

                           Our tests of March 2008 receipts, cash receipt records, deposit slips
                           and bank statements at the five schools disclosed that the school
                           treasurers did not comply with the District’s procedures manual.
                           Three school treasurers did not issue any pre-numbered receipts
                           when money was received. Two school treasurers completed two-
                           part receipts, and did not require the ECA advisor to sign the receipts
                           when money changed hands. The receipts used by one of the school
                           treasurer’s were not pre-numbered.12 None of the school treasurers
                           retained copies of the checks they received as required by the
                           procedures manual. During our testing, we found no exceptions when
                           tracing recorded receipts of $50,990 to the bank statement deposits.
                           However, the failure to use duplicate receipts increases the risk that
                           collections will not be recorded and accounted for properly.

Periodic Reconciliations   The District’s policies and procedures require all ECA student
                           treasurers to maintain separate records of cash receipts and
                           disbursements. The activity advisor should guide the student treasurer
                           and review the student treasurer’s records. The school treasurer must
                           provide each ECA advisor with the activity’s beginning and ending
                           cash balances, and a quarterly list of transactions. The ECA advisor
                           11
                              The original receipt should be attached to copies of the checks and retained on
                           file by the school treasurer. One copy of the receipt should be given to the ECA
                           advisor/principal. The last copy should be retained in the receipt book maintained
                           by the school treasurer.
                           12
                              One school treasurer switched to three-part receipts during March 2008, but the
                           ECA advisor was not required to sign the receipts.

  20       OFFICE OF THE NEW YORK STATE COMPTROLLER
                         must verify the activity shown on the list and sign off on the report.
                         The District does not have a process in place to ensure that student
                         treasurers are maintaining separate records, and that those records
                         are periodically reconciled with the school treasurers’ records and
                         differences investigated. For example, the school treasurers for
                         Fowler and Corcoran High Schools were not sure if each ECA
                         student treasurer maintained separate records of their activities’
                         cash receipts and disbursements. The school treasurer for Corcoran
                         indicated that he did not provide quarterly reports to each ECA
                         advisor for review. The Fowler school treasurer said he provided
                         quarterly reports to each ECA advisor, but the advisors did not sign
                         off on the reports as required by the District’s procedures. When
                         student ledgers are not maintained or are not compared with the
                         school treasurers’ records, there is an increased risk that errors or
                         fraud could occur and remain undetected.

                         The reconciliation of bank balances to ledger cash balances
                         is essential to ensure that District records reflect correct cash
                         balances and that cash is safeguarded. Accurate and complete bank
                         reconciliations include the timely identification and investigation of
                         any differences. The District’s procedures manual requires school
                         treasurers to reconcile the ECA account and School Account bank
                         accounts on a monthly basis. Our review of March 31, 2008 bank
                         reconciliations disclosed no significant exceptions in four out
                         of the five schools we tested. However, we noted an unexplained
                         reconciliation adjustment in the Corcoran school treasurer’s records.
                         We expanded our review of the Corcoran records and noted six
                         adjustments were made during our audit period – four adjustments to
                         decrease recorded cash a total of $708 and two adjustments to increase
                         cash by $4,162. While the adjustments were made to increase or
                         decrease cash in three separate School Accounts, the school treasurer
                         did not document the reasons for the adjustments or explain why they
                         were related to these Accounts. These adjustments were made during
                         the time period when the ECA accounts and School Accounts were
                         combined in shared bank accounts. When the school treasurer adjusts
                         records to agree with adjusted bank balances without identifying
                         the underlying cause of the discrepancy, it could result in an ECA
                         or School Account receiving either more or less moneys than it is
                         entitled to receive. The adjustment could also be used to cover up
                         fraudulent transactions.

Interest Earnings        The District’s regulations on ECA accounts and School Accounts
                         provide that interest earnings for ECA accounts and School Accounts
                         must be distributed according to procedures established by the
                         District. However, the District has not established any additional
                         procedures to provide direction on how the interest earnings should
                         be distributed. During 2006-07, Corcoran High School had ECA

                    DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY               21
                                                                                         21
                           and School Account moneys pooled in an investment account13 that
                           had earnings of $3,432. The earnings were not credited to each
                           ECA account and School Account based on its pro-rata principal
                           investment. Instead, all of the earnings were distributed to the
                           Student Activities Account, which is a School Account controlled by
                           the principal. As a result, none of the ECAs received a pro-rata share
                           of the interest earnings.

Inactive Accounts          The District’s regulation on extra-classroom activities requires
                           each principal and activity advisor to perform a semi-annual review
                           of inactive clubs and to distribute funds in accordance with NYS
                           guidelines for ECA accounts. SED regulations require the District
                           to adopt rules and regulations addressing the method of disposing
                           of funds of defunct organizations, but they do not provide specific
                           guidance on how funds should be distributed – this is a responsibility
                           of the Board. Our review of the records of five schools disclosed
                           33 accounts with a combined balance of $7,840 that had no activity
                           from July 2006 through March 2008. Without defined procedures for
                           disposing of funds from inactive accounts, there is an increased risk
                           that moneys will not be available for valid uses, or that idle moneys
                           could be used inappropriately.

Internal Control           During our audit period, the District took a number of steps to help
Improvements               strengthen controls over ECA and School Accounts. In addition to
                           the annual external audits of ECA, these steps included developing
                           a procedures manual, conducting internal reviews/audits of the ECA
                           and School Accounts at four schools, initiating a process to segregate
                           School Accounts from ECA accounts, and implementing the use of
                           spreadsheets at most schools to record receipts and disbursements
                           for each ECA account and School Account. In February and March
                           2008 (near the end of our audit period), the District created a full-time
                           position in the Central Office to oversee ECA and School Account
                           activity and provided training to school treasurers and principals.
                           Currently, staff in the Central Office receives quarterly and annual
                           reports showing bank reconciliations and total receipts, disbursements
                           and balances for each ECA account and School Account, but in
                           general, no one regularly reviews the school treasurers’ records or
                           supporting documentation for receipts and disbursements. In the
                           future, the District plans to conduct random audits of ECA accounts
                           and School Accounts. These audits should help the District better
                           oversee school treasurers and determine if controls are operating as
                           intended.



                           13
                             The Corcoran High School had a money market mutual fund investment account
                           with a value of approximately $85,000. The District is not authorized by General
                           Municipal Law to invest funds in this type of an account.

  22       OFFICE OF THE NEW YORK STATE COMPTROLLER
Recommendations        6. District officials should continue the process of differentiating
                          ECA accounts and School Accounts, and discontinue the School
                          Accounts by transferring the balances to accounts within the
                          general fund or to trust and agency accounts as appropriate.

                       7. District officials should ensure that District staff properly
                          document and support all ECA account disbursements with
                          itemized vendor invoices or receipts and written explanations.

                       8. District officials should monitor compliance with the District’s
                          ECA account policies and procedures.

                       9. District officials should require all ECA student treasurers
                          to maintain separate ledger records of cash receipts and
                          disbursements. These records should then be compared with
                          those maintained by the school treasurer on a periodic basis.

                       10. School treasurers should reconcile bank accounts on a monthly
                           basis and investigate any differences.

                       11. The Board should amend its policies and procedures to provide
                           direction regarding the distribution of the interest earned from
                           the investment of ECA moneys and the disposition of funds in
                           inactive ECA accounts.

                       12. The Board should continue to ensure that periodic audits of the
                           school treasurers’ records are performed.




                  DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY             23
                                                                                     23
                             Payroll and Benefits

                           Our audit of the District’s payroll function revealed a lack of
                           segregation of duties without adequate independent monitoring
                           procedures to detect errors or irregularities. Our testing disclosed
                           that errors routinely occur in the District’s payroll process and go
                           undetected. We found that the District provided about $19,500
                           in compensation and benefits to employees that were either
                           overpayments, or lacked Board authorization or adequate supporting
                           documentation. We also found that District management did not
                           always establish a standard work day for reporting the days worked by
                           employees to the Employees’ Retirement System, leading to improper
                           reporting.

Segregation of Duties      Payroll duties should be segregated to ensure that no one employee
and Oversight              controls all or substantially all phases of the payroll cycle and the
                           work performed by one individual is verified in the normal course
                           of another employee’s regular duties. If this is not feasible, District
                           officials can implement mitigating controls such as having someone
                           independent of the payroll process perform a review of completed
                           payroll records. At a minimum, the review should include random
                           checks to verify that payrolls are based on actual hours or days worked
                           or authorized leave time; verification that the Board authorized the
                           hourly rate, salary or other compensation; a comparison of net payroll
                           checks or direct deposits to payroll journals; and an assessment of the
                           payrolls for reasonableness. A periodic review of change reports and
                           audit logs can also be implemented to help limit risk.

                           The District did not adequately segregate key duties related to payroll
                           processing. Although staff in the Personnel Department added new
                           employees to the computerized payroll system, five payroll clerks
                           were responsible for all other payroll functions. The other payroll
                           functions include: activating and deactivating employees in the
                           system; inputting employees’ initial salaries and any changes made
                           to their salaries or pay rates; entering regular and overtime hours
                           worked; updating leave records; and changing employee banking
                           information and appropriation account numbers. Furthermore, in
                           several instances the payroll clerks calculated unused leave payouts,
                           retirement stipends and retroactive payments that were added to
                           employees’ paychecks without any supervisory review of their work.
                           The payroll clerks also notified the console operator when the checks
                           were ready for printing. They picked up the signed payroll checks
                           after they were printed and sorted and sealed the checks for delivery.
                           While staff in the Personnel Department initially authorized many of
                           the changes made by the payroll clerks (i.e., initial salaries, salary

  24       OFFICE OF THE NEW YORK STATE COMPTROLLER
     changes and longevity payments), there was no review or verification
     of the changes made by the payroll clerks after they were entered into
     the financial system.

     The District’s procedures did not provide adequate oversight of the
     clerks’ work to compensate for their conflicting duties in processing
     payroll. Such duties could allow the payroll clerks to initiate
     inappropriate transactions which may not be detected. Although a
     payroll supervisor reviewed various preliminary payroll reports,
     these reports were printed before the payroll clerks finished inputting
     all timesheets and other payroll changes for the pay period, thus
     reducing the effectiveness of his supervisory review. In addition,
     the computerized payroll system does not generate a complete
     final payroll register which shows the gross pay, deductions and
     withholdings, and the net pay amount for each employee.14 As a
     result, District officials were not able to perform a comprehensive
     review of the final payrolls and there was no process in place for
     someone independent of the payroll process to certify the final
     payrolls. Furthermore, through March 2008, the majority of the
     payroll reports that could be generated by the payroll system (eg.,
     reports by withholdings or check lists) were shredded after three
     months.15 We also found that the payroll clerks were the only ones
     who reviewed system-generated change reports that summarize the
     changes they made in the computer system, including changes to
     salaries and pay rates.16 The review of these reports by supervisory
     personnel or someone independent of the payroll process would help
     the District to detect irregularities or mistakes in a timely manner.

     Based on the risks resulting from the inadequate segregation of duties
     and lack of oversight during our audit period, we tested the annual
     salaries of 43 employees totaling about $2.8 million, examined a
     sample of the associated cancelled checks or direct deposit listings,
     and verified the payments were made to bona-fide District employees.
     Additionally, we tested the time sheets of 60 employees for one
     pay period totaling $68,762 and examined the associated cancelled
     checks or direct deposit lists for 30 of these employees.17 We also
     tested a sample of 21 changes to employee salary and wage rates

     14
        The payroll system can produce a final payroll report showing gross and net pay
     amounts for employees who receive pay checks, but this report does not include
     the net pay for employees who received direct deposits, and it does not show the
     deductions and withholdings from each employee’s pay check. Withholdings are
     summarized by withholding type on a report separate from the final payroll report.
     15
        During our audit, District officials extended the retention period for these payroll
     reports to two years.
     16
        See the finding entitled “Information Technology” for additional information on
     change reports and audit logs.
     17
        Since final payroll registers were not available, we used computer generated
     individual employee earnings records for our audit testing.

DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY                              25
                                                                                    25
                     reflected in change reports. These tests were completed to determine
                     whether amounts paid or benefits provided to District employees
                     were appropriate. We found exceptions in the payments or benefits
                     provided to 20 of the 103 employees we tested (nearly 20 percent).
                     For example:

                        •   The Superintendent authorized a principal to roll over 50 sick
                            days from her employment at another school district when she
                            was hired by the District. This principal was covered under a
                            collective bargaining agreement and we found no indication
                            that the Board authorized this additional benefit. These sick
                            days should not have been granted without Board approval.
                            Due to the sick day buyback provision in her bargaining unit
                            contract, these additional sick days could result in extra cash
                            payments of about $10,625.

                        •   No supporting documentation could be found for payments
                            made to six employees totaling $4,298. Specifically, there
                            was no documentation on file to support the calculation of
                            retroactive payments made to four employees totaling $2,298.
                            Two other employees each received salary increases of $1,000,
                            but there was no documentation or Personnel Department
                            authorization to show the reason for the salary increases. A
                            payroll clerk believes the increases were longevity payments
                            for 30 years of service, but she was unable to verify whether
                            or not this was true.

                        •   The District paid the former chief financial officer and
                            three deputy superintendents annual stipends of $300 each
                            for professional dues ($2,400 in the 2006-07 and 2007-08
                            years combined). These stipends were not allowed by their
                            individual employment contracts. After we discussed these
                            overpayments with District officials, the District recouped the
                            funds from the employees.

                        •   Three employees were paid for an incorrect number of hours.
                            One was overpaid in the amount of $1,653 and the other two
                            were underpaid a total of $189.

                        •   Two employees were overpaid a combined total of $352 due
                            to errors in the calculation of their retroactive and resignation
                            payments.

                        •   Three employees were overpaid a total of $290 because they
                            were paid at the incorrect rate.



26   OFFICE OF THE NEW YORK STATE COMPTROLLER
                                 •   The Superintendent was overpaid $135 due to the
                                     miscalculation of a retroactive pay adjustment made after
                                     his employment contract was approved. After we discussed
                                     this overpayment with District officials, the Superintendent
                                     reimbursed the District.

                                 •   The direct deposits for 16 out of 48 employees could not
                                     be traced to the bank because payroll reports showing the
                                     breakdown of direct deposits were not retained.

                            We also noted that although the District had 26 regular bi-weekly
                            pay periods during the 2006-07 fiscal year, the District processed 68
                            payroll runs plus nine retroactive payment runs during the year. The
                            extra payrolls were primarily due to payroll mistakes, and time cards
                            and other paperwork that were submitted to the Payroll Department
                            too late to be incorporated in the normal payroll run. During our
                            audit period, the District began maintaining a log to summarize
                            the need for the unscheduled payrolls. This log is intended to help
                            officials identify and evaluate the causes of the extra payrolls so they
                            can identify process improvements to reduce the number of payrolls
                            in the future.

Retirement Reporting        One of the benefits offered to the District’s non-instructional
                            employees is the ability to join the New York State and Local
                            Retirement System.18 This retirement system actually comprises two
                            different systems, which are the Police and Fire Retirement System
                            and the Employees’ Retirement System (ERS). As a participating
                            employer in ERS, it is imperative that District management establish
                            criteria by which a standard workday is measured for reporting
                            purposes and ensure that each member is properly reported.

                            Each member’s retirement benefits are integrally related to salary and
                            service history. Consequently, each member should be reported
                            to ERS with accurate information for earnings and days worked,
                            calculated in accordance with retirement system guidelines. The
                            number of days worked should be based on the number of hours
                            worked on payrolls paid during the monthly reporting period and
                            the number of hours set by the Board as a standard workday for
                            retirement purposes. The standard workday used for retirement
                            purposes can vary by position and/or individual but cannot be less
                            than six hours per day or more than eight hours per day. Part time
                            employees are those who work less than the standard workday and
                            their service should be reported as a pro-rated proportion of the
                            standard workday for that position.
                            18
                               Teachers, substitute teachers, teaching assistants, guidance counselors and
                            certain administrators participate in the New York State Teachers’ Retirement
                            System.

                       DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY                       27
                                                                                                    27
                         We tested the days worked reported for 70 employees19 in the
                         District’s monthly ERS reports for September and October 2007 and
                         June 2008 and found that the District over-reported the days worked
                         by one or more days in a month for seven of these employees. Two
                         of the employees were part-time custodial helpers, who the District
                         reported as having worked 20 days during the month tested which is
                         equivalent to full-time employment. Based on the employees’ actual
                         hours worked and the standard work day of eight hours set by the
                         District, the maximum number of days reported should have been
                         10.5 days for each employee. The other five employees that were
                         calculated incorrectly were part-time typists. They were reported
                         for having worked between 15 and 20 days per month. However,
                         the Board has not set a standard work day for these part-time typist
                         positions. Based on the minimum requirement of six hours per day,
                         the District over-reported the days worked for each of these employees
                         by one to 6.67 days during our test months. It appears that these
                         errors occurred because the District’s computer system uses incorrect
                         standard work day numbers to compute the days worked for certain
                         part-time employees. We have notified ERS of this misreporting so
                         that corrective action can be initiated.

Recommendations          13. District officials should segregate payroll related duties to
                             the extent possible or establish additional supervisory review
                             procedures to mitigate the risk of payroll errors or irregularities.

                         14. District officials should work with the IT department to develop a
                             final payroll register in order to provide them with a mechanism
                             to review and certify the complete payroll run.

                         15. District officials should ensure that supervisory personnel or
                             someone independent of the payroll process periodically reviews
                             change reports generated from the payroll system.

                         16. District officials should evaluate the overpayments and
                             underpayments to employees and determine if the District should
                             pursue the recovery of the funds or compensate employees.

                         17. The District should retain documentation to support the
                             appropriateness of all payroll payments.

                         18. District officials should not provide employees with benefits that
                             the Board has not authorized.


                         19
                            We initially tested 59 employees and found that the days worked was incorrectly
                         reported for four part-time employees. As a result, we expanded our testing to
                         review the days worked reported for 11 additional part-time employees.

 28      OFFICE OF THE NEW YORK STATE COMPTROLLER
     19. The Board should formally set a standard workday consisting
         of six to eight hours for calculating the days worked reported to
         ERS.

     20. District officials should develop review procedures to ensure
         that days worked for both full-time and part-time members are
         accurately computed and reported to ERS.




DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY              29
                                                                    29
                                     Purchasing

                          An effective purchasing process helps the District obtain services,
                          materials, supplies and equipment at the desired quality, appropriate
                          quantity, and lowest cost, in accordance with applicable Board
                          policies and procedures, and other legal requirements. This process
                          helps the District ensure that it expends taxpayer dollars in the most
                          efficient manner.

                          Both the City20 and District have developed policies and procedures
                          for purchasing to provide guidance to District officials responsible
                          for procuring goods and services. However, we found that District
                          staff did not consistently comply with the policies and procedures
                          regarding competitive bidding. Further, the Board and District
                          management did not enforce the District’s policies and procedures
                          requiring oral or written quotes for purchases under competitive
                          bidding thresholds. Also, the District’s school attorney policy requires
                          officials to use a request for proposal process when seeking to retain a
                          school attorney; however, the policy does not specify that the District
                          should solicit competition for legal services at reasonable, periodic
                          intervals. As a result, the District did not get the benefit of a formal,
                          open competitive process and may have paid more than it needed to
                          for its purchases of goods and services.

Competitive Bidding       The City Charter and District’s purchasing policy require that
                          purchase and public work contracts which exceed $7,500 and $10,000,
                          respectively, during any six-month period be publicly advertised for
                          bids and awarded to the lowest responsible bidder.21 The District may
                          also use certain contracts awarded by the New York State Office of
                          General Services (OGS), the City, Onondaga County or any other
                          county within the State, or it may participate in cooperative bidding
                          with other local governmental entities such as a Board of Cooperative
                          Educational Services (BOCES). The appropriate use of competition
                          provides taxpayers with assurance that goods and services are
                          procured in the most prudent and economical manner, of the desired
                          quality, at the lowest possible price and that procurement is not
                          influenced by favoritism, extravagance, fraud or corruption.

                          20
                             The District is governed by the purchasing provisions outlined in the City Charter
                          (Education Law, Section 2556(8)).
                          21
                              General Municipal Law (GML) requires school districts to competitively bid
                          purchase and public work contracts which involve expenditures in excess of $10,000
                          and $20,000, respectively. The dollar thresholds in GML have been interpreted to
                          apply to the aggregate amount of expenditures for the same or similar types of
                          commodities or services over the course of a fiscal year. In June 2008 (after our
                          audit period), the Common Council amended its City Charter to increase bidding
                          thresholds in the Charter to the amounts currently required by GML.

 30       OFFICE OF THE NEW YORK STATE COMPTROLLER
     The City Charter enables the Common Council to waive competitive
     bidding requirements for all City departments and the District by
     adopting an ordinance by at least two-thirds vote with the approval
     of the Mayor when it is impracticable to procure goods or services
     by bidding. The District’s purchasing policy states that the District
     is not required to secure alternative proposals or quotations in cases
     when purchases are exempt from bidding by a Common Council
     ordinance. While the Common Council may waive competitive
     bidding for certain purchases, it is still in the public interest that the
     District take steps to ensure that purchases be made at the lowest
     cost to the District. Although we noted certain instances in which
     the District did obtain quotes for purchases made pursuant to a
     Common Council ordinance waiving bidding, we question whether
     the District’s written policy to waive quotes in such instances is in the
     best interest of the tax payers.

     We tested 21 contracts totaling $1,681,306 for compliance with
     City and District competitive bidding requirements. District
     officials appropriately solicited competitive bids or used State or
     cooperatively bid contracts with BOCES for 11 of these contracts
     totaling $426,660. However, District officials did not comply with
     either the City or District’s policies and procedures or City or State
     contract requirements for 10 of these contracts totaling $1,254,646.

          •   In May 2007, the District purchased financial, payroll and
              human resource software and support/maintenance services
              totaling $910,120. District officials indicated the purchase
              was made from an OGS Miscellaneous Software Catalog
              (MSC) contract. As part of this State contract, a prohibited
              software manufacturer list is maintained online by OGS. If
              a manufacturer is on the prohibited list then its software
              products may not be purchased from the State’s MSC contract.
              The manufacturer of the software the District purchased was
              on the prohibited software list.22 As a result, the District
              was not authorized to purchase the software under this State
              contract23 and it should have used the competitive bid process
              prior to making the purchase. District officials told us they
              purchased the software because funding was available at the


     22
        Software manufacturers included in the prohibited list for the MSC contract
     have their own contracts with the State. While their software cannot be purchased
     through the MSC contract, it can generally be purchased under the manufacturer’s
     State contract. However, though the manufacturer that developed the software
     purchased by the District had its own State contract, that contract failed to provide
     updated approved prices for the software. Consequently, the District should not have
     purchased the software under either the MSC State contract or the manufacturer’s
     State contract.
     23
        We confirmed this with OGS.

DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY                             31
                                                                                   31
                            time of the purchase and they received a discount from the
                            vendor at that time.

                        •   Purchasing documentation indicates that the District
                            purchased five trucks totaling $164,682 from an OGS contract;
                            however we found that the purchases did not conform to the
                            State contract which was for a different model pickup truck.
                            Although the contract allowed certain upgrades, it did not
                            allow a change in the vehicle series. Since there was no State
                            contract available for the model that the District purchased, it
                            should have used a competitive bidding process.

                        •   On four occasions, the District purchased used vehicles
                            without publicly advertising for bids or purchasing the
                            vehicles from a State, City, County or cooperatively bid
                            BOCES contract. In all, seven used vehicles were purchased
                            at a total cost of $111,799. Although District officials did
                            obtain quotes from three vendors prior to making each of
                            these purchases, they told us they did not competitively
                            bid the vehicles because they purchased them under a
                            Common Council ordinance that waived competitive bidding
                            requirements. However, according to the ordinance, it only
                            waived bidding requirements for purchases of “…repair
                            services and overhauling including parts and labor, and
                            the purchase of repair parts and maintenance supplies for
                            automotive equipment.” When we contacted City purchasing
                            officials, they confirmed that the ordinance is for repairs and
                            it does not authorize the purchase of used vehicles without
                            competitive bidding. Therefore the District was required to
                            obtain competitive bids for these used vehicles.

                        •   The District purchased uniforms for various sport teams
                            totaling $24,581 during the period July 1, 2007 to March
                            31, 2008. According to the District’s purchasing officer, the
                            uniforms were purchased under a Common Council ordinance
                            that waived competitive bidding requirements; however, the
                            District did solicit quotes from four vendors to obtain the best
                            prices. The ordinance used by the District for this purchase
                            authorized the purchase of various non-copyrighted items,
                            such as instructional supplies and materials, instructional toys,
                            instructional equipment, maps and globes and miscellaneous
                            office supplies for the District. The purchase of sports
                            uniforms does not fall under this ordinance and therefore the
                            District should have used the competitive bidding process.

                        •   The District’s purchasing documentation indicates the District
                            purchased toilet tissue and paper towels totaling $31,612 from

32   OFFICE OF THE NEW YORK STATE COMPTROLLER
                     a contract that was competitively bid by the City. However,
                     when we reviewed the contract that includes toilet tissue
                     and paper towels, we noted the District did not purchase the
                     supplies from the vendor that won the contract.

                 •   The District made two purchases of ice melt totaling $11,852
                     within three months. While the District did obtain three
                     quotes prior to making the first purchase, it did not advertise
                     for bids as required by the City and District’s policies and
                     procedures.

              Because the District did not fully comply with City and District
              policies and procedures and State and City contract requirements, the
              District may have paid more than necessary for the above purchases
              and did not otherwise get the benefit of a formal, open competitive
              process.

Quotes        District officials informed us that the District follows the City’s
              procurement policy for non-bid purchases. The policy requires the
              District to obtain oral quotes from vendors for purchase contracts
              between $501 and $3,000 and written quotes for purchase contracts
              between $3,001 and $7,500. The policy also requires verbal quotes
              for public works contracts between $501 and $3,000 and written
              quotes for public works contracts between $3,001 and $10,000.

              We tested 20 contracts aggregating $70,186 that were not subject
              to competitive bidding requirements but were subject to the
              purchasing policy related to oral and written quotes. District officials
              appropriately solicited quotes, made purchases under OGS, county or
              City contracts or made purchases under appropriate ordinances for 12
              of these contracts totaling $43,957. However, the District either did
              not follow the procurement policy or it did not comply with contract
              requirements for eight of these contracts totaling $26,229.

                 •   Five contracts totaling $11,204 had no documentation to
                     indicate that District officials obtained quotes. These goods
                     and services included a calling system ($4,999), stereo
                     headsets ($1,799), wiping rags ($1,740) four stoves ($1,476),
                     and transportation for a field trip ($1,190).

                     District officials indicated that various departments may
                     have included a summary of the quotes they obtained on
                     electronic requisitions for some of these purchases, but the
                     quotes were automatically deleted when the requisitions were
                     processed and purchase orders were issued. Due to the lack
                     of such documentation, the Board has no assurance that these
                     items were purchased at the lowest cost and the procurement
                     process is operating effectively.
         DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY                33
                                                                               33
                              •   Purchasing documentation on file for three contracts totaling
                                  $15,025 indicated that the District purchased the items on an
                                  OGS, City or County contract; however, we noted that the
                                  District either did not use the vendor that held the contract
                                  or it purchased items that were not included in the contract.
                                  For example, purchasing documentation indicated the District
                                  purchased an envelope imager and software totaling $9,090
                                  on an OGS contract, but the vendor did not have this State
                                  contract. Documentation related to the purchase of concrete
                                  cubes totaling $1,600 indicated they were purchased from a
                                  County contract, but the cubes were not part of the contract.
                                  Purchasing documentation for radio/CD players totaling
                                  $2,645 and wooden puzzles totaling $1,690 referenced a City
                                  contract. While the City did award certain bid items to this
                                  vendor, the items the District purchased were not part of the
                                  bid documents or award.

                           When District officials do not obtain quotations as required by the
                           procurement policies and procedures, or do not comply with contract
                           provisions, the District risks acquiring goods and/or services at higher
                           costs than necessary.

Legal Services             Goods and services not required by law to be competitively bid must
                           be procured in a manner that assures the prudent and economical
                           use of public moneys in the best interests of the taxpayers. A request
                           for proposals (RFP) process is an effective means of procuring
                           professional services at the best value and documenting how the
                           selection of providers was made.

                           The Board adopted a school attorney policy in October 2006 that
                           requires officials to undertake a competitive process “when seeking
                           to retain a School Attorney.” Specifically, the policy requires officials
                           to “locate prospective qualified lawyers/law firms” by advertising in
                           professional journals and/or newspapers, checking listing of lawyers/
                           law firms, or making inquires of other districts or other appropriate
                           sources. In selecting a School Attorney, the District must consider
                           cost as well as certain other factors, including the special knowledge
                           or expertise of the attorney or firm. The District must then prepare a
                           written RFP which contains details of the services sought and submit
                           this request to prospective applicants. The policy also requires the
                           District to maintain documentation of the written proposals submitted
                           by lawyers/law firms for the position of school attorney.

                           The Board re-appointed a law firm as the school’s attorney in May
                           2007 without soliciting competition through an RFP process. We
                           have been advised by the District that it is the intent of this policy to
                           require this competitive process only when the Board seeks to retain

  34       OFFICE OF THE NEW YORK STATE COMPTROLLER
                       a new legal counsel. Nonetheless, we believe that it is good practice
                       to solicit competition for legal services at reasonable intervals. In
                       this regard, as a general guide, we note that school districts generally
                       are required to utilize a competitive RFP process when contracting
                       for outside audit services no less frequently than once every five
                       years. The District paid $113,157 for legal services to this law firm
                       for the period November 2006 through June 2007 and $128,741 for
                       the period July 2007 through March 2008. Without the benefit of
                       periodic competition, there is an increased risk that the District will
                       not secure legal services in a manner that will optimize quality and
                       cost.

Recommendations        21. District officials should ensure that all District employees who
                           are involved in the purchasing process are aware of the District’s
                           requirements for competitive bidding and obtaining quotes. Also,
                           District officials should periodically determine whether District
                           personnel are complying with the procurement policies and
                           procedures.

                       22. The Board should review and amend its purchasing policy to
                           require officials to obtain quotes when the Common Council has
                           waived competitive bidding requirements.

                       23. Purchasing officials should verify that purchases conform
                           to OGS, City, County or District contracts prior to approving
                           purchases.

                       24. District officials and staff should retain documentation showing
                           the quotes they obtain.

                       25. The Board should amend its policy to require the solicitation of
                           proposals for legal services at reasonable, periodic intervals, such
                           as once every five years.




                  DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY                 35
                                                                                         35
                          Information Technology

                           The District relies on an information technology (IT) system for
                           providing computer education, accessing the Internet, communicating
                           by email, storing student data, maintaining financial records, and
                           reporting to State and Federal agencies. Therefore, the IT system
                           and the data it holds are valuable District resources. The District’s
                           widespread use of information technology presents a number of
                           internal control risks such as unauthorized access to data and the
                           potential loss of data. District officials must design an effective system
                           of internal controls to safeguard computerized data from loss and
                           misuse. It is important that this system include policies and procedures
                           to control and monitor access to financial data and a formal disaster
                           recovery plan to minimize the damage that a disaster would cause to
                           operations if the IT system fails.

                           We found weaknesses in internal controls over the District’s
                           computerized financial system. Specifically, District officials have
                           not developed an adequate formal IT disaster recovery plan, ensured
                           that employees were given proper access rights and those access
                           rights were promptly updated when needed, or ensured that audit logs
                           and change reports were monitored. As a result, there is an increased
                           risk that computer data could be lost and the District would not be
                           able to recover the data in the event of a disaster, and the potential
                           for misuse or alteration of data that could result in the compromise
                           of sensitive information and/or potential financial loss to the District.

Disaster Recovery Plan     An effective system of internal controls over IT includes a formal
                           disaster recovery plan that addresses the possible loss of computer
                           equipment and data and establishes procedures for recovery in the
                           event of such a loss. It is essential that the plan provide precautions
                           that staff must take to minimize the effects of any disaster and enable
                           the District to either maintain or quickly resume its mission-critical
                           functions. Also, this plan should include a significant focus on
                           disaster prevention. The Board should communicate the plan to all
                           responsible parties and periodically test it to ensure its effectiveness.

                           While District officials had not established a formal disaster recovery
                           plan during our audit period, the District did provide us with a plan
                           for the 2008-09 year during the time of our fieldwork. However,
                           the plan had a number of deficiencies which need to be remedied
                           if it is to effectively serve its intended purpose. The plan did not
                           specifically address the current financial system nor did it provide
                           specific actions to be taken in the event that the server that runs the
                           District’s financial system is damaged or destroyed. Consequently,

 36        OFFICE OF THE NEW YORK STATE COMPTROLLER
                          in the event of a disaster, District personnel have no guidelines to
                          follow to help minimize or prevent the loss of equipment and data,
                          and no guidance on how to implement data recovery procedures. If
                          the computer system fails, the problems that result could range from
                          inconvenient to catastrophic. Even small disruptions in computer
                          systems can require extensive effort to evaluate and repair. The lack
                          of an adequate formal disaster recovery plan could negatively impact
                          the District’s ability to resume normal operations.

User Access Rights        To ensure proper segregation of duties and internal controls, the
                          District must grant users of the computer system only the access that
                          is required to perform their job duties and responsibilities. Access
                          controls are intended to provide reasonable assurance that computer
                          resources are protected from unauthorized use and modifications.
                          Having access controls in place prevents users from being involved
                          in multiple aspects of financial transactions and ensures that users are
                          restricted from unauthorized areas where they can intentionally or
                          unintentionally destroy or change critical financial data.

                          As of May 2008, the District had not adequately restricted user
                          access rights to financial data based on the duties and responsibilities
                          of staff. We found that three employees had access rights to functions
                          in the computer system that were incompatible with their other
                          duties and/or unnecessary for the performance of those duties. For
                          example, the accounts payable clerk had the ability to approve and
                          release invoices for payment in the computer system, which is the
                          responsibility of the claims auditor, and is incompatible with her
                          other accounts payable duties. Two other employees who no longer
                          work in the Payroll Department still had access to payroll modules
                          within the financial system even though they do not need this access
                          to perform their current job duties. One of these employees had
                          access to confidential employee information and leave records and
                          the other employee had the ability to change employee pay rates and
                          salaries. We also found that two employees who no longer work for
                          the District still had access rights to the payroll or benefits modules
                          within the financial system.

                          The former Director of Accounting informed us that she performs an
                          annual review of user access rights. However the report she reviews
                          does not provide all the necessary detailed individual computer
                          access rights information. There is a separate report that provides
                          information pertaining to additional accesses within the financial
                          system that is available for review; however the former Director of
                          Accounting does not generally use this report to monitor employee
                          access rights.



                     DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY                37
                                                                                           37
                             According to the former Director of Accounting, a lack of
                             communication between department heads responsible for informing
                             the systems analyst to update the access rights may have resulted in
                             the unnecessary access rights we identified during our audit. When
                             the District does not strictly control computer access rights, there is
                             an increased risk that unauthorized changes could be made to the data
                             or inappropriate transactions could be initiated and not detected by
                             District managers.

Audit Logs                   It is important that the District’s computerized financial system
                             allow officials to determine who is accessing the system and what
                             transactions are being processed. Ideally, District management, or its
                             designee(s), should review audit logs, change reports and/or exception
                             reports to monitor the activity of users who access the financial
                             system. Audit logs provide information such as the identity of each
                             person who has accessed the system, the time and date of access,
                             what activity occurred, and the time and date of sign off. Change
                             reports can be used to show changes made to data such as vendor
                             information or employee data, and exception reports can be used by
                             management to identify any instance where financial information
                             has violated a pre-determined set of parameters. These reports
                             help provide the District with a mechanism for overseeing financial
                             activity, determining individual accountability, reconstructing events
                             and problem monitoring.

                             The District’s financial system is able to produce various audit log
                             reports; however management does not review them. The system
                             also generates daily change reports for payroll, which detail all of the
                             changes that each of the payroll clerks made in the payroll system
                             the day before. While the payroll clerks review the change reports,
                             the reports are discarded and not reviewed by District management
                             (see our finding entitled Payroll and Benefits). The system does not
                             provide vendor change reports, however it can produce a daily report
                             of purchase orders by account number which lists purchase order
                             additions, changes, and deletions, and the last user. This report is not
                             reviewed by District management. The system also does not provide
                             change reports for accounts receivable (see our finding entitled
                             Accounts Receivable).

                             District officials have stated that it is not practical to review the
                             lengthy reports that are generated by the financial system. As a result,
                             day-to-day activities are not being monitored and there is an increased
                             risk that District officials would not detect errors or inappropriate
                             transactions.




 38          OFFICE OF THE NEW YORK STATE COMPTROLLER
Recommendations        26. The Board should ensure that the District’s disaster recovery
                           plan is updated to include guidance on how to implement data
                           recovery procedures for the District’s financial system. The
                           plan should be distributed to all responsible parties, periodically
                           tested, and updated as needed.

                       27. District officials should monitor users’ access rights to ensure
                           they are appropriate based on job functions and responsibilities,
                           and that the level of access allowed promotes the proper
                           segregation of duties.

                       28. District officials should periodically review audit logs and
                           change reports for unusual activity. If desired reports are not
                           currently available on the system, Management should work with
                           the IT department to obtain these reports.




                  DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY                39
                                                                                        39
                                          APPENDIX A

                      RESPONSE FROM DISTRICT OFFICIALS

The District officials’ response to this audit can be found on the following pages.




  40        OFFICE OF THE NEW YORK STATE COMPTROLLER
DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY   41
                                                         41
42   OFFICE OF THE NEW YORK STATE COMPTROLLER
DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY   43
                                                         43
44   OFFICE OF THE NEW YORK STATE COMPTROLLER
DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY   45
                                                         45
46   OFFICE OF THE NEW YORK STATE COMPTROLLER
DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY   47
                                                         47
48   OFFICE OF THE NEW YORK STATE COMPTROLLER
                                          APPENDIX B

                     AUDIT METHODOLOGY AND STANDARDS

Our overall goal was to assess the adequacy of the internal controls put in place by officials to
safeguard District assets. To accomplish this, we performed an initial assessment of the internal
controls so that we could design our audit to focus on those areas most at risk. Our initial assessment
included evaluations of the following areas: financial oversight, cash receipts and disbursements,
purchasing, payroll and personal services and information technology.

During the initial assessment, we interviewed appropriate District officials, performed limited tests
of transactions and reviewed pertinent documents, such as District policies and procedures manuals,
Board minutes, and financial records and reports. In addition, we obtained information directly from
the computerized financial databases and then analyzed it electronically using computer-assisted
techniques. This approach provided us with additional information about the District’s financial
transactions as recorded in its databases. Further, we reviewed the District’s internal controls and
procedures over the computerized financial databases to help ensure that the information produced by
such systems was reliable.

After reviewing the information gathered during our initial assessment, we determined where
weaknesses existed, and evaluated those weaknesses for the risk of potential fraud, theft and/or
professional misconduct. We then decided upon the reported objectives and scope by selecting those
areas most at risk for further audit testing. We selected accounts receivable, ECA and School Accounts,
payroll, purchasing, and IT for further audit testing. To accomplish the objectives of this audit, our
procedures included the following:

   •   We interviewed appropriate District officials and employees to gain an understanding of the
       procedures and the corresponding controls related to each of our audit objectives.

   •   We reviewed the District’s policies and procedures governing ECA and School Accounts.

   •   We reviewed payments of vending machine commission revenues and other general fund
       moneys to individual School Accounts.

   •   We examined the financial practices and records for ECA and School Accounts at five schools –
       Corcoran and Fowler High Schools, Huntington K-8 School, Grant Middle School and Webster
       Elementary School. Our tests included the following:

       o   We tested 368 cash disbursements out of ECA and School Accounts totaling about
           $212,000 and transfers between clubs/accounts totaling about $31,000 to determine if
           the disbursements were approved and supported and if they complied with the District’s
           policies and procedures. We traced a sample of these payments to cancelled checks.

       o   We reviewed March 2008 bank reconciliations and traced March 2008 duplicate receipts
           and other records to cash receipt books, deposit slips and bank statements. We also
           reviewed the allocation of interest earnings.


                          DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY                 49
                                                                                                 49
           o   We reviewed account activity from July 2006 to March 2008 to determine if the schools
               had inactive accounts.

      •    To determine whether recorded invoices had been improperly adjusted, we judgmentally
           selected 91 paid invoices totaling $1,643,080 recorded in the accounts receivable records and
           traced to the original invoice or our recalculation of the invoice.

      •    We judgmentally selected 75 invoices ($1,416,086 in total) that were recorded as paid during
           our audit period. We verified that the amounts recorded as paid agreed with the amounts
           deposited in the bank. We also traced all duplicate cash receipts issued during the audit period
           to the cash receipts journal and bank statement deposits. We selected three days from March
           2008 and traced all entries from the daily cash receipts log to the cash receipts journal and then
           to the bank deposit detail.

      •    We judgmentally selected 21 voided invoices to determine if the transactions had been voided
           for legitimate reasons.

      •    To determine the collectability of accounts receivable, we judgmentally selected and
           analyzed 19 open invoices, totaling $349,982 that appeared on the District’s December 2008
           outstanding accounts receivable report.

      •    For payroll, we examined Board policies and procedures, employee personnel files, collective
           bargaining agreements, individual employment contracts, Board minutes, payroll reports,
           leave records, payroll logs and time cards to determine if the District had properly designed
           and implemented internal controls and segregated payroll duties.

      •    We tested annual wages totaling $2,843,407 paid to 43 employees (including the
           Superintendent, former Chief Financial Officer, payroll supervisor24 and five payroll clerks)
           during the 2006-07 fiscal year. We reviewed Board approvals, bargaining unit contracts or
           District records for salary authorization. We also reviewed personnel files to verify they were
           bona-fide employees and a sample of cancelled checks and direct deposit transmittals to verify
           that payments made agreed to the records.

      •    We tested 60 employees’ time cards for one pay period to verify that the hours recorded in the
           payroll records agreed to the authorized and approved time cards. For 30 of these employees,
           we verified their pay rate to bargaining unit contracts or other Board approvals. We also
           verified the payments to the cancelled check or direct deposit transmittal.

      •    We tested a sample of 21 changes to employee salary and wage rates reflected in payroll
           change reports.

      •    Internal controls over the District’s administration of the Employees’ Retirement System
           (ERS) were determined by interviewing employees and reviewing collective bargaining
           agreements to ensure the Board had established a standard work day. We reviewed monthly


24
     The payroll supervisor’s salary was tested for the period August 2007 through March 2008.

     50          OFFICE OF THE NEW YORK STATE COMPTROLLER
       retirement system reports for September and October 2007 and June 2008 and compared
       reported compensation and service time to employee payroll information for the same period.

   •   We obtained copies of District and City procurement policies and procedures and the City
       Charter and evaluated the adequacy of these policies.

   •   We interviewed appropriate District officials and employees regarding the District’s
       procurement policies and procedures. These discussions allowed us to analyze the District’s
       internal control structure governing the procurement of goods and services.

   •   We tested 21 contracts totaling $1,681,306 to determine if the District complied with
       competitive bidding requirements. We also tested 20 other contracts totaling $70,186 to
       determine if the District sought competition for purchases below the bidding thresholds.

   •   We reviewed the contract for legal services and sample of four claims paid to the law firm
       totaling $65,929, and we determined if the District used an RFP process to select the law firm
       serving as the school attorney.

   •   We examined user permission reports to determine if users were granted access rights only to
       the computer applications that were appropriate for their job duties.

   •   We examined available audit logs and change reports generated from the computerized
       financial system.

We conducted this performance audit in accordance with generally accepted government auditing
standards (GAGAS). Those standards require that we plan and perform the audit to obtain sufficient,
appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit
objective. We believe that the evidence obtained provides a reasonable basis for our findings and
conclusions based on our audit objective.




                          DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY               51
                                                                                               51
                                           APPENDIX C

           HOW TO OBTAIN ADDITIONAL COPIES OF THE REPORT


To obtain copies of this report, write or visit our web page:




                                    Office of the State Comptroller
                                    Public Information Office
                                    110 State Street, 15th Floor
                                    Albany, New York 12236
                                    (518) 474-4015
                                    http://www.osc.state.ny.us/localgov/




  52        OFFICE OF THE NEW YORK STATE COMPTROLLER
                                                    APPENDIX D
                             OFFICE OF THE STATE COMPTROLLER
                              DIVISION OF LOCAL GOVERNMENT
                               AND SCHOOL ACCOUNTABILITY
                                            Steven J. Hancox, Deputy Comptroller
                                            John C. Traylor, Assistant Comptroller

                                      LOCAL REGIONAL OFFICE LISTING
BUFFALO REGIONAL OFFICE                                      GLENS FALLS REGIONAL OFFICE
Robert Meller, Chief Examiner                                Karl Smoczynski, Chief Examiner
Office of the State Comptroller                               Office of the State Comptroller
295 Main Street, Suite 1032                                  One Broad Street Plaza
Buffalo, New York 14203-2510                                 Glens Falls, New York 12801-4396
(716) 847-3647 Fax (716) 847-3643                            (518) 793-0057 Fax (518) 793-5797
Email: Muni-Buffalo@osc.state.ny.us                          Email: Muni-GlensFalls@osc.state.ny.us

Serving: Allegany, Cattaraugus, Chautauqua, Erie,            Serving: Clinton, Essex, Franklin, Fulton, Hamilton,
Genesee, Niagara, Orleans, Wyoming counties                  Montgomery, Rensselaer, Saratoga, Warren, Washington
                                                             counties

ROCHESTER REGIONAL OFFICE                                    ALBANY REGIONAL OFFICE
Edward V. Grant, Jr., Chief Examiner                         Kenneth Madej, Chief Examiner
Office of the State Comptroller                               Office of the State Comptroller
The Powers Building                                          22 Computer Drive West
16 West Main Street – Suite 522                              Albany, New York 12205-1695
Rochester, New York 14614-1608                               (518) 438-0093 Fax (518) 438-0367
(585) 454-2460 Fax (585) 454-3545                            Email: Muni-Albany@osc.state.ny.us
Email: Muni-Rochester@osc.state.ny.us
                                                             Serving: Albany, Columbia, Dutchess, Greene,
Serving: Cayuga, Chemung, Livingston, Monroe,                Schenectady, Ulster counties
Ontario, Schuyler, Seneca, Steuben, Wayne, Yates
counties

SYRACUSE REGIONAL OFFICE                                     HAUPPAUGE REGIONAL OFFICE
Eugene A. Camp, Chief Examiner                               Jeffrey P. Leonard, Chief Examiner
Office of the State Comptroller                               Office of the State Comptroller
State Office Building, Room 409                               NYS Office Building, Room 3A10
333 E. Washington Street                                     Veterans Memorial Highway
Syracuse, New York 13202-1428                                Hauppauge, New York 11788-5533
(315) 428-4192 Fax (315) 426-2119                            (631) 952-6534 Fax (631) 952-6530
Email: Muni-Syracuse@osc.state.ny.us                         Email: Muni-Hauppauge@osc.state.ny.us

Serving: Herkimer, Jefferson, Lewis, Madison,                Serving: Nassau, Suffolk counties
Oneida, Onondaga, Oswego, St. Lawrence counties

BINGHAMTON REGIONAL OFFICE
Patrick Carbone, Chief Examiner                              NEWBURGH REGIONAL OFFICE
Office of the State Comptroller                               Christopher Ellis, Chief Examiner
State Office Building, Room 1702                              Office of the State Comptroller
44 Hawley Street                                             33 Airport Center Drive, Suite 103
Binghamton, New York 13901-4417                              New Windsor, New York 12553-4725
(607) 721-8306 Fax (607) 721-8313                            (845) 567-0858 Fax (845) 567-0080
Email: Muni-Binghamton@osc.state.ny.us                       Email: Muni-Newburgh@osc.state.ny.us

Serving: Broome, Chenango, Cortland, Delaware,               Serving: Orange, Putnam, Rockland, Westchester
Otsego, Schoharie, Sullivan, Tioga, Tompkins                 counties
counties



                                  DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY                            53
                                                                                                                    53