New York State Comptroller D Ivision Of Local Government &

OFFICE

OF THE

NEW YORK STATE COMPTROLLER D IVISION OF LOCAL GOVERNMENT & SCHOOL ACCOUNTABILITY

Schenectady City School District Internal Controls Over Selected Financial Activities Report of Examination Period Covered: July 1, 2007 — January 6, 2009 2009M-154

Thomas P. DiNapoli

Table of Contents

Page AUTHORITY LETTER

2

EXECUTIVE SUMMARY

3

INTRODUCTION Background Objective Scope and Methodology Comments of District Officials and Corrective Action

5 5 5 5 6

PAYROLL DISBURSEMENTS Payroll Processing Payroll Certification Recommendations

7 7 10 11

CLAIMS AUDIT Recommendation

12 13

INTERNAL AUDITOR Recommendation

14 14

INFORMATION TECHNOLOGY Recommendation

15 16

APPENDIX APPENDIX APPENDIX APPENDIX APPENDIX

17 22 25 27 28

A B C D E

Response From District Officials OSC Comments on the District’s Response Audit Methodology and Standards How to Obtain Additional Copies of the Report Local Regional Office Listing

DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY

11

State of New York Office of the State Comptroller

Division of Local Government and School Accountability November 2009 Dear School District Officials: A top priority of the Office of the State Comptroller is to help school district officials manage their districts efficiently and effectively and, by so doing, provide accountability for tax dollars spent to support district operations. The Comptroller oversees the fiscal affairs of districts statewide, as well as districts’ compliance with relevant statutes and observance of good business practices. This fiscal oversight is accomplished, in part, through our audits, which identify opportunities for improving district operations and Board of Education governance. Audits also can identify strategies to reduce district costs and to strengthen controls intended to safeguard district assets. Following is a report of our audit of the Schenectady City School District, entitled Internal Controls Over Selected Financial Activities. This audit was conducted pursuant to Article V, Section 1 of the State Constitution and the State Comptroller’s authority as set forth in Article 3 of the General Municipal Law. This audit’s results and recommendations are resources for district officials to use in effectively managing operations and in meeting the expectations of their constituents. If you have questions about this report, please feel free to contact the local regional office for your county, as listed at the end of this report. Respectfully submitted,

Office of the State Comptroller Division of Local Government and School Accountability

2

OFFICE OF THE NEW YORK STATE COMPTROLLER

State of New York Office of the State Comptroller

EXECUTIVE SUMMARY

The Schenectady City School District (District) is governed by the Board of Education (Board) which comprises seven elected members. The Board is responsible for the general management and control of the District’s financial and educational affairs. The Superintendent of Schools (Superintendent) is the chief executive officer of the District and is responsible, along with other administrative staff, for the day-to-day management of the District under the direction of the Board. There are 15 elementary schools, an early childhood education center, three middle schools, one high school, a career center, and an adult education center in operation within the District, with approximately 10,400 students and 1,700 employees. The District’s operating expenditures for the 2007-08 fiscal year were $139.3 million, which were funded primarily with State and Federal aid, and real property taxes. Scope and Objective The objective of our audit was to examine the District’s internal controls over selected financial activities for the period July 1, 2007 to January 6, 2009. Our audit addressed the following related questions: •

Have District officials established adequate internal controls over payroll disbursements and are those controls operating effectively to safeguard District assets?

•

Have District officials established appropriate internal controls over the claims audit process and are those controls operating effectively to safeguard District assets?

•

Have District officials appropriately established the internal audit function?

•

Have District officials appropriately designed the controls over the District’s information technology (IT) system to protect District assets?

Audit Results The Board and District administrators need to improve their oversight of District operations. As a result of poor oversight, we found weaknesses in controls over the District’s payroll disbursements, claims audit process, internal audit function, and information technology system. The former Head Utility Worker received over $50,000 in overtime compensation for duties attributable to facilities management and energy management during the 2007-08 fiscal year. However, his approved DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY

33

time sheets did not clearly state the overtime hours that were allocated to each responsibility, and the District did not have additional supporting documentation detailing the duties that he performed during these hours. Although the employee’s supervisor approved the time sheets, he could not verify the specified hours claimed were actually worked. Approval of overtime payments without supporting documentation or supervisory knowledge of hours worked could result in employees receiving compensation they may not be entitled to. Because District officials do not provide sufficient supervisory review of payroll transactions, employees made clerical errors when calculating 12 of the payroll payments in our sample, which resulted in incorrect payments totaling $2,373. We also found weaknesses in the District’s internal controls over separation payments, resulting in questionable payments to employees totaling $26,026. In addition, the Assistant Superintendent for Business did not certify 11 of the 14 final payroll reports that we reviewed. These weaknesses can, and did, result in incorrect payments being made to employees. We also found weaknesses in the District’s claims audit process. Our review of 50 claims, totaling $1,082,675, disclosed that 26 of the claims tested, totaling $293,921, had one or more deficiencies. The claims auditor approved these claims for payment, although the claims did not comply with District purchasing procedures. As a result, the Board has limited assurance that the claims audit process is working as intended and that all paid claims were proper and necessary District expenditures. Education Law requires that each district has an internal auditor who will undertake annual risk assessments of district operations. The Board appointed a certified public accounting firm to serve as the District’s internal auditor on December 5, 2007, almost a year after the requirement went into effect. The District received the internal auditor’s final risk assessment statements for the year ended June 30, 2007 on February 11, 2009. While the internal auditor should have provided the District with a risk assessment for the year ended June 30, 2008 by December 31, 2008, the internal auditor had not yet started it at the end of our fieldwork in May 2009. The internal auditor’s failure to perform a timely annual risk assessment leaves the Board with limited assurance that potential risks at the District are identified and that appropriate internal controls are in place to address those risks. District officials have not established formal policies or procedures to limit users’ access within the financial software system. District officials do not sufficiently use audit logs or change reports to monitor the system for inappropriate access or unauthorized changes to the financial software. In addition, we found that employees had access rights to the financial software that were not required to perform their job duties. These weaknesses increase the risk that inappropriate payments or unauthorized changes to data could occur and not be detected in a timely manner. Comments of District Officials The results of our audit and recommendations have been discussed with District officials and their comments, which appear in Appendix A, have been considered in preparing this report. District officials generally disagreed with our findings and recommendations. Our comments concerning the District officials’ response can be found in Appendix B.

4

OFFICE OF THE NEW YORK STATE COMPTROLLER

Introduction Background

The Schenectady City School District (District) is located in the City of Schenectady, Schenectady County. The District is governed by the Board of Education (Board) which comprises seven elected members. The Board is responsible for the general management and control of the District’s financial and educational affairs. The Superintendent of Schools (Superintendent) is the chief executive officer of the District and is responsible, along with other administrative staff, for the dayto-day management of the District under the direction of the Board. There are 15 elementary schools, an early childhood education center, three middle schools, one high school, a career center, and an adult education center in operation within the District, with approximately 10,400 students and 1,700 employees. The District’s operating expenditures for the 2007-08 fiscal year were $139.3 million, which were funded primarily with State and Federal aid, and real property taxes.

Objective

Scope and Methodology

The objective of our audit was to examine the District’s internal controls over selected financial activities. Our audit addressed the following related questions: •

Have District officials established adequate internal controls over payroll disbursements and are those controls operating effectively to safeguard District assets?

•

Have District officials established appropriate internal controls over the claims audit process and are those controls operating effectively to safeguard District assets?

•

Have District officials appropriately established the internal audit function?

•

Have District officials appropriately designed the controls over the District’s information technology (IT) system to protect District assets?

We examined the District’s internal controls over payroll disbursements, claims auditing, the internal audit function and information technology for the period July 1, 2007 to January 6, 2009. We conducted our audit in accordance with generally accepted government auditing standards (GAGAS). More information on such standards and the methodology used in performing this audit is included in Appendix C of this report. DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY

55

Comments of District Officials and Corrective Action

The results of our audit and recommendations have been discussed with District officials and their comments, which appear in Appendix A, have been considered in preparing this report. District officials generally disagreed with our findings and recommendations. Our comments concerning the District officials’ response can be found in Appendix B. The Board has the responsibility to initiate corrective action. Pursuant to Section 35 of the General Municipal Law, Section 2116-a (3)(c) of the Education Law, and Section 170.12 of the Regulations of the Commissioner of Education, a written corrective action plan (CAP) that addresses the findings and recommendations in this report must be prepared and provided to our office within 90 days, with a copy forwarded to the Commissioner of Education. To the extent practicable, implementation of the CAP must begin by the end of the next fiscal year. For more information on preparing and filing your CAP, please refer to our brochure, Responding to an OSC Audit Report, which you received with the draft audit report. The Board should make the CAP available for public review in the District Clerk’s office.

6

OFFICE OF THE NEW YORK STATE COMPTROLLER

Payroll Disbursements School districts establish the pay and benefits for professional employees and support staff in the written employment contracts and agreements they negotiate with employee bargaining units or individual employees. Employment contracts, agreements, and policies should contain clear language to allow proper interpretation of their terms and conditions. In addition, controls such as a supervisory review of payroll transactions help to ensure that compensation is paid in accordance with employment contracts and District policies. District officials and administrators must ensure that appropriate controls are established to prevent and detect errors or irregularities in the District’s payroll and personnel procedures and practices. Education Law requires the District to certify all payrolls to ensure that all payments are proper and necessary. The former Head Utility Worker received over $50,000 in overtime compensation for duties attributable to facilities management and energy management during the 2007-08 fiscal year. Although his supervisor approved the overtime, he could not verify the specified hours claimed were actually worked, and the District did not have additional supporting documentation detailing the work performed. Therefore, the District could not be assured that the overtime the employee claimed was accurate and necessary. In addition, District officials do not sufficiently review payroll transactions initiated by the Human Resources Department or processed by the payroll clerks. We found clerical errors in the calculation of 12 of the payments in our test sample, which resulted in incorrect payments totaling $2,373. We also found weaknesses in the District’s internal controls over separation payments, resulting in questionable payments to employees totaling $26,026. Furthermore, the Assistant Superintendent for Business (ASB) did not certify 11 of the 14 final payroll reports that we examined. As a result of these weaknesses, the District cannot be assured that all payroll disbursements were proper and necessary District expenditures. Payroll Processing

The primary objective for internal controls over payroll processing is to ensure that employees are paid wages and salaries and provided benefits to which they are entitled. Controls, such as supervisory review of payroll transactions and certification of payrolls, help to ensure that compensation is made in accordance with Board action, employment contracts, and District policies. Employment contracts and policies generally address matters such as hours to be worked, rates of compensation, amount and type of leave time to be granted, eligibility for health insurance and other fringe benefits, and post employment benefits to be granted. DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY

77

Overtime — While overtime pay can be an expected cost of doing business for a school district, it is a cost that must be carefully controlled. A critical control over payroll and overtime expenditures is verification of overtime worked and subsequent approval of the employee’s time sheet for payment. This helps ensure that the District incurs only necessary overtime costs. Properly detailed logs of work performed can further provide control of overtime costs and allow for analysis of additional staffing needs or revision of work priorities and scheduling. The District paid the former Head Utility Worker $50,836 in overtime during the 2007-08 fiscal year. This individual’s time sheets indicated that the overtime coverage was for overtime split between his duties attributable to facilities management and energy management. Each duty performed had separate and distinct responsibilities. We reviewed the 26 time sheets that the former Head Utility Worker submitted for the 2007-08 fiscal year and found that he recorded that he worked at least 36 hours of overtime each two-week pay period. The former Head Utility Worker’s supervisor, the ASB, initialed his approval for all of the overtime hours documented on the time sheets. However, the Head Utility Worker’s approved time sheets were the only supporting documentation for the overtime that he claimed to have worked, and did not adequately document the reasons for overtime coverage. In fact, of the 26 time sheets reviewed, two did not document the reason for overtime coverage at all, and 19 included overtime hours worked that were consolidated into one number, but were attributable to both duties. Therefore, District officials did not have sufficient documentation of the overtime hours attributable to each duty. The District did not have documentation to describe in detail the work that he actually performed during these hours, such as a detailed log of completed tasks or progress that was made on tasks that were not yet completed. The ASB indicated that the former Head Utility Worker was required to enter District buildings when District officials were not present (e.g., nights, weekends); thus, the ASB was unable to verify the specified hours claimed were actually worked. Approval of overtime payments without supporting documentation or supervisory knowledge of hours worked could result in employees receiving compensation that they may not be entitled to. Payroll Calculation Errors — It is important that District officials review payroll transactions to ensure that they are correct and necessary District expenditures. District officials did not sufficiently review payroll transactions that were initiated by the Human Resources Department or processed by the payroll clerks to ensure that all payments were correct and made in accordance with District policies and employment contracts. 8

OFFICE OF THE NEW YORK STATE COMPTROLLER

We tested 54 payroll payments totaling $69,984 that the District made to 25 employees that included overtime payments to eligible employees to verify that they were accurate and properly approved. We found 12 calculation errors in payroll and overtime payments totaling $2,373. Errors in payroll and overtime payment calculations occurred because employees used incorrect pay rates when calculating these payments, and did not accurately calculate the number of hours worked. For example, the District incorrectly paid a maintenance employee his 2006-07 hourly overtime rate of pay for overtime that he completed in the 2007-08 fiscal year, which resulted in an underpayment of $328. Absent an adequate review and approval of payrolls, calculation errors were made and not detected or corrected. Therefore, employees received incorrect compensation for services rendered. Separation Payments — A total of 58 employees received retirement and/or separation payments during our audit period, totaling approximately $1.4 million. We tested seven separation payments for retiring employees, totaling $329,566, to determine if the payments were properly supported, calculated, and authorized. Due to complicated contract language and District officials’ failure to sufficiently review the separation payment calculations prepared by the Human Resources Administrator, we questioned payout calculations for five of the seven payments, amounting to $23,408. In addition, as part of our payroll disbursements testing, we questioned $2,618 in separation payments made to another individual. Examples of the problematic payments are below: •

The District paid two administrators a total of $139,728 in retirement benefits that consisted of a retirement incentive and sick leave payments. Both administrators elected to defer their retirement dates until the year following their first year of eligibility. Their employment agreements stated that the retirement incentive was a percentage of the employee’s base salary payable in the first year of eligibility. However, District officials incorrectly calculated the retirement incentive payments based on total salary during the year of retirement deferral, which included base salary, tax sheltered annuity contributions, and credit hour stipends. Consequently, the administrators were potentially overpaid a total of $10,605 in retirement incentives.

•

The District paid an Assistant Superintendent a total of $109,031 in retirement benefits that consisted of a retirement incentive, vacation leave, and sick leave payments. Her employment agreement stated that her retirement incentive

DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY

99

would be a percentage of her base salary and that her vacation and sick leave payments would be calculated using her salary day rate. However, in addition to her base salary, her employment agreement provided benefits including expense reimbursement and tax sheltered annuity contributions. Because of complicated contract language concerning how to determine this individual’s salary day rate and base salary for retirement purposes, District officials may have incorrectly calculated all of her retirement benefits using her base salary plus the additional benefits, which resulted in a potential overpayment totaling $7,697. The absence of clear contract language regarding the determination of an employee’s separation payments raises questions about the legitimacy of the amount that the District paid to its employees. Employment contracts, agreements, or policies containing provisions that are not clearly articulated or that do not address all pertinent aspects of employment can lead to uncertainty about the rights, duties, and responsibilities of all parties involved. Furthermore, the lack of a process in place for reviewing separation payment calculations can, and did, result in incorrect payments being made. Payroll Certification

Education Law requires the District to certify all payrolls. A certified payroll is one that has been examined and approved by an administrator who determines that the persons included in the payroll reports have performed their duties in accordance with the terms of their employment. The administrator who certifies payroll must be independent of the human resources and payroll processes. A properly certified payroll helps to ensure that payments are accurate and justified. The ASB certifies the payrolls; however, there is no District policy or Board resolution designating him to do so. Furthermore, the ASB is not independent of the payroll process because he has full access rights to the financial management software system that is used for payroll processing. The District’s payroll certification process includes printing two payroll reports: a preliminary report prior to printing the payroll checks and a final report containing a certification page after the payroll checks are printed. We examined 14 final payroll reports during our audit period to determine whether the ASB had properly certified them. Although the ASB initialed 13 of the 14 preliminary reports, he did not certify 11 of the 14 final payroll reports. For example, although a final report was printed with a certification page for the pay period ending November 21, 2008, totaling $3,562,967, the ASB did not certify the payroll. In other instances, final reports were not even printed for the

10

OFFICE OF THE NEW YORK STATE COMPTROLLER

ASB’s secondary review and proper certification. Failure to review payroll reports prior to payroll checks being processed allows for changes to be made that may not be detected or corrected. Without an independent review and properly performed certification of payroll, District officials cannot ensure that payroll payments are accurate and justified. Recommendations

1. The Board should investigate the discrepancies noted in this report to determine whether the payments were appropriate, and recoup any inappropriate amounts. 2. The District should require that employees properly document overtime hours worked. Such documentation should include detailed logs of the work performed during overtime hours. 3. District officials should provide adequate supervision to ensure that payroll is processed accurately and that employees are paid the wages and salaries which they are entitled to, as approved by the Board. 4. The Board should ensure that collective bargaining agreements and employment contracts that include provisions for separation payouts are clearly written. District officials should make only those payments that are authorized by such agreements. 5. District officials should ensure that separation payments are calculated as intended by the District in compliance with collective bargaining agreements and employment contracts. To help assure this compliance, someone independent of the process should review separation payment calculations prepared by the Human Resources Administrator. 6. The Board should formally designate an administrator independent of the payroll process to certify the payroll. The administrator or his/her designee should certify each payroll by attesting that the persons included in the payroll have regularly performed their duties in accordance with the terms of their employment.

DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY

11 11

Claims Audit Education Law requires that each claim against the District be audited prior to payment to ensure that all payments are proper and legal. The Board is responsible for auditing the District’s claims or, alternatively, may appoint a claims auditor to assume the Board’s powers and duties of auditing and approving or denying all claims for payment. A proper claims audit is intended to ensure that each charge is properly authorized, accurately calculated, adequately supported, in conformance with District policy, and a valid District expense. Employees must attach supporting documentation to each claim that includes evidence that the District received the goods or services and that employees followed District policy when procuring the goods or services. The claims auditor is responsible for certifying a list of all approved claims (warrant) and for communicating the claims audit results to the Board. The Board appointed a claims auditor to assume its claims auditing duties. We examined 50 claims that the District paid during the audit period, totaling $1,082,675, to determine whether they were properly authorized, made in accordance with District policy, adequately supported, and showed evidence of receipt of goods and services. Twenty-six of the 50 claims, totaling $293,921, had one or more deficiencies. Nineteen of these claims totaling $272,175 did not have verbal or written quotes attached1 and therefore did not comply with the District’s purchasing procedures. The claims auditor approved these claims for payment, although the claims did not contain evidence that employees had obtained the quotes in accordance with District purchasing procedures. The remaining seven claims totaling $21,746 lacked supporting documentation. They either did not have purchase receipts attached, did not contain sufficient itemization such as lists of attendees who received District-paid meals and refreshments, and/ or did not have prior approvals attached, such as a District-issued purchase order or authorization to attend a conference. When District officials and employees do not adhere to the District’s purchasing procedures and purchase goods and services without the benefit of obtaining quotes, they cannot be sure that they have acquired goods and services in the most economical manner and in the best interest of District taxpayers. Failure of the claims auditor to perform a proper audit could result in the inappropriate payment of claims. ____________________ 1

The District’s ‘Purchasing Procedures’ require a written request for quotation from at least three vendors for purchases between $5,000 and $10,000 and a verbal quotation from at least three vendors for purchases between $2,500 and $5,000.

12

OFFICE OF THE NEW YORK STATE COMPTROLLER

Recommendation

7. The Board should ensure that the claims auditor conducts a proper audit of claims in accordance with District policies and procedures. The claims audit should include verification that District personnel complied with the District’s purchasing policy and procedures.

DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY

13 13

Internal Auditor By law, school districts must have had an internal audit function in operation no later than December 31, 2006. The internal audit function must include, at a minimum, the development of a risk assessment of district operations. The risk assessment should include a review of financial policies, procedures and practices; an annual review and update of such risk assessment; and annual testing and evaluation of one or more areas of the district’s internal controls. The internal auditor is also required to prepare reports (at least annually or more frequently as the Board may direct) that analyze significant risk assessment findings, recommend changes for strengthening controls and reducing identified risks, and specify timeframes for implementation of such recommendations. The Board appointed a certified public accounting firm to serve as the District’s internal auditor on December 5, 2007, almost a year after the requirement went into effect. Due to claimed scheduling conflicts, the internal auditor did not present the draft risk assessment to the audit committee until the Fall of 2008. Furthermore, the District received the final risk assessment report for the year ended June 30, 2007 on February 11, 2009. While the internal auditor should have provided the District with a risk assessment for the year ended June 30, 2008 by December 31, 2008, the internal auditor had not yet started it at the end of our fieldwork in May 2009. The internal auditor’s failure to perform a timely annual risk assessment leaves the Board with limited assurance that potential risks are identified and that appropriate internal controls are in place to address those risks. Recommendation

14

8. The Board should ensure that the internal auditor performs risk assessments in a timely manner and on an annual basis as required by the law.

OFFICE OF THE NEW YORK STATE COMPTROLLER

Information Technology The use of information technology affects the fundamental manner in which the District processes, records, and reports financial transactions. The District’s widespread use of information technology presents a number of internal control risks that must be addressed, such as misuse or loss of data from unauthorized access. District policies and procedures that limit user access to only authorized persons protect the data from intentional or unintentional manipulation. Furthermore, software access controls must restrict user access to only those functions needed by staff to perform their job duties and to prevent these users from being involved in multiple aspects of financial transactions. In this way, software access controls help to preserve proper segregation of duties. District officials can implement compensating controls, such as reviewing edit/change reports (audit logs), to help offset control weaknesses resulting from the failure to properly restrict user access. The District uses a financial accounting software package (financial software) to process and maintain financial transactions. The financial software can be programmed to restrict users’ access to transactions within the scope of their responsibilities. District officials have not established formal policies or procedures to limit users’ access within the financial software system. Although the Assistant Superintendent for Business (ASB) uses audit logs to monitor productivity, he stated that he does not use audit logs or change reports to monitor for inappropriate access or unauthorized changes to the financial software. In addition, we found that the ASB and the Deputy Treasurer have full access rights to the financial software, including full administrative rights to modify user access. We also found that a payroll clerk has access rights to add, update, and delete journal entries, process payroll, and also print, void, and re-issue computer checks. With these capabilities, these individuals have the opportunity to initiate and conceal inappropriate financial transactions without detection. Due to these control weaknesses, we generated and reviewed eight audit logs for cash disbursements to determine if employees with incompatible duties inappropriately used their access rights to make changes to these modules. Although we found no instances of misuse, the failure to establish and monitor policies and procedures relating to financial data user access, restrict user access to the financial software, and review corresponding audit logs increases the risk that

DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY

15 15

inappropriate payments or unauthorized changes to data could occur and not be detected in a timely manner. Recommendation

16

9. District officials should adopt and monitor comprehensive policies and procedures that address user access rights to the financial software system. The Board should designate a responsible person to carry out these policies and procedures, and restrict user access based on users’ job duties. If this is not feasible, District officials should implement compensating controls, such as reviewing audit logs.

OFFICE OF THE NEW YORK STATE COMPTROLLER

APPENDIX A RESPONSE FROM DISTRICT OFFICIALS The District officials’ response to this audit can be found on the following pages. The page numbers included in the response letter refer to the "draft" audit report distributed earlier to District officials. The final audit report has been reformatted. Therefore, the page references in the response letter are no longer accurate.

DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY

17 17

See Note 1 Page 22

See Note 2 Page 22

18

OFFICE OF THE NEW YORK STATE COMPTROLLER

See Note 3 Page 22

See Note 4 Page 22

See Note 5 Page 23

See Note 6 Page 23

DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY

19 19

See Note 7 Page 23

20

OFFICE OF THE NEW YORK STATE COMPTROLLER

See Note 8 Page 23

See Note 9 Page 23

See Note 10 Page 24

DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY

21 21

APPENDIX B OSC COMMENTS ON THE DISTRICT’S RESPONSE Note 1 During our review of payroll processing, District staff and officials provided no information indicating that payroll transactions were reviewed by Business Office supervisory staff. Our review of District payroll transactions also did not provide any evidence that the transactions were reviewed. In addition, during our exit conference District officials did not provide any evidence that supervisory level staff in the Business Office reviewed the payroll documentation prepared by the Human Resources Office prior to payroll clerical staff processing the information. Note 2 It is important that District officials review payroll transactions to ensure that they are correct and necessary District expenditures. Our report does not conclude that “District officials should personally review each of the thousands of payroll checks issued each biweekly pay period.” Rather, in light of the payroll processing deficiencies cited in this report (e.g., calculation errors, questionable separation payments), we recommend that District officials provide adequate supervision to ensure that payrolls are processed accurately and that employees are paid the wages and salaries to which they are entitled, as approved by the Board. Because District officials did not perform an adequate review and approval of payrolls, calculation errors were made and not detected or corrected, resulting in employees receiving incorrect compensation for services rendered. Note 3 The District has no assurance that the employee did perform duties for which overtime payments were made. The only indication that the employee performed overtime duties was the “number of overtime hours” he recorded on his time sheets, initialed by the Assistant Superintendent for Business (ASB). Further, the ASB indicated that the employee was required to enter District buildings when District officials were not present (e.g., nights, weekends); thus, the ASB was unable to verify the specified hours claimed were actually worked. Approval of overtime payments without supporting documentation or supervisory knowledge of hours worked could result in employees receiving compensation that they may not be entitled to. Note 4 This statement is incorrect. We tested 54 payroll payments totaling $69,984 that the District made to 25 employees that included overtime payments to eligible employees to verify that they were accurate and properly approved. We found 12 calculation errors in payroll and overtime payments. The District paid the former Head Utility Worker $50,836 in overtime during the 2007-08 fiscal year. Due to calculation errors found during our initial payroll testing, coupled with the significant amount of overtime paid to this one employee, we performed further review.

22

OFFICE OF THE NEW YORK STATE COMPTROLLER

Note 5 Audit staff held discussions with numerous District officials and staff, including the Human Resources Administrator, ASB, Deputy Treasurer, Senior Payroll Audit Clerk and Payroll Clerk regarding the District’s payroll process, supporting documentation and payroll payments made. Audit staff also had discussions with these individuals to gain an understanding of the District’s collective bargaining agreements, memorandums of agreement, and employment contracts, when warranted. Our findings were based on a sample of transactions, not the entire population. Given the significant error rate that we found, the actual level of inaccurate payments in the District’s payroll will be much higher than $2,373. The fact that we found so many errors in the payments that we tested indicates an internal control weakness that should be addressed by District officials. Note 6 Except where contract language explicitly stated that the retirement incentive was a percentage of the employee’s “base salary payable in the first year of eligibility,” and the District instead calculated the retirement incentive payment based on “total salary during the year of retirement deferral,” our report did not conclude that the District incorrectly calculated separation payments that resulted in overpayments, since the contracts are unclear and complicated. Rather, our report questioned payments that were made and recommended that District officials ensure that separation payments are calculated as intended by the District in compliance with collective bargaining agreements and employment contracts. To help ensure this compliance, the School Attorney, in conjunction with the ASB, should review separation payment calculations prepared by the Human Resources Administrator. Note 7 Nowhere in this report do we counsel the District to renege on contracts, violate collective bargaining agreements, or abridge the Taylor Law. Our report simply points out that contract language is unclear and complicated regarding separation payments, which raises questions as to the legitimacy of separation payments. Note 8 Effective internal controls provide for a payroll certification control by requiring a periodic sign-off by a management level employee independent of the payroll operation. This procedure should ensure that all payments are made to bona fide employees and reflect the proper pay rate. Minimally, the administrator who certifies the payroll should sign-off on the final bi-weekly payroll and employ a sampling process for a more in-depth review. This control is essential, particularly in light of the payroll processing deficiencies cited in this report resulting from an insufficient review of payroll transactions. Our report states that the ASB did not certify 11 of the 14 final payroll reports. Note 9 During the audit, audit staff made specific requests to District officials for additional documentation when items were not attached to a claim. At the exit discussion, District officials did not request this information. We will provide this information to District officials under separate letter. DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY

23 23

Note 10 The Senior Payroll Audit Clerk is the official Civil Service title for the payroll clerk. However, the Senior Payroll Audit Clerk has access rights to add, update, and delete journal entries, process payroll, and also print, void, and re-issue computer checks, thereby resulting in an inadequate separation of duties. Further, the Senior Payroll Audit Clerk’s access is not restricted to only those functions needed by her to perform her job duties. Absent restricted user access, employees have the opportunity to initiate and conceal inappropriate financial transactions without detection. Software access controls must restrict user access to only those functions needed by staff to perform their job duties and to prevent these users from being involved in multiple aspects of financial transactions. In this way, software access controls help to preserve proper segregation of duties. District officials can implement compensating controls, such as reviewing change reports/audit logs, to help offset control weaknesses resulting from the failure to properly restrict user access. Although the ASB uses audit logs to monitor productivity, the ASB stated that he does not use audit logs or change reports to monitor for inappropriate access or unauthorized changes to the financial software. There is an audit trail recorded within the District’s financial software application that captures who is entering transactions with a date and time stamp. It provides details on the point of entry (e.g., workstation identification). Reports can be generated from this audit trail. The ASB does not generate exception and change reports and stated that these reports would be too cumbersome to generate due to the system not being fast enough.

24

OFFICE OF THE NEW YORK STATE COMPTROLLER

APPENDIX C AUDIT METHODOLOGY AND STANDARDS Our overall goal was to assess the adequacy of the internal controls put in place by officials to safeguard District assets. To accomplish this, we performed an initial assessment of the internal controls so that we could design our audit to focus on those areas most at risk. Our initial assessment included evaluations of the following areas: financial oversight, cash receipts and disbursements, purchasing, payroll and personal services, and information technology. During the initial assessment, we interviewed appropriate District officials, performed limited tests of transactions, and reviewed pertinent documents, such as District policies and procedures manuals, Board minutes, and financial records and reports. In addition, we obtained information directly from the computerized financial databases and then analyzed it electronically using computer-assisted techniques. This approach provided us with additional information about the District’s financial transactions as recorded in its databases. Further, we reviewed the District’s internal controls and procedures over the computerized financial databases to help ensure that the information produced by such systems was reliable. After reviewing the information gathered during our initial assessment, we determined where weaknesses existed, and evaluated those weaknesses for the risk of potential fraud, theft and/ or professional misconduct. We then decided on the reported objective and scope by selecting for audit those areas most at risk. We selected payroll disbursements, claims audit process, internal audit function, and information technology for further audit testing. To determine if the Board and District officials had properly designed and implemented internal controls over the selected audit areas, we inquired and observed District staff and examined the following records and reports for the period July 1, 2007 through January 6, 2009: •

We reviewed minutes from the proceedings of Board and Audit Committee meetings and selected supporting documentation.

•

We reviewed pertinent District policies and procedures.

•

We reviewed employee personnel files, collective bargaining agreements, and individual employment contracts.

•

We reviewed supporting documentation for payroll payments including payroll journals and reports, time sheets, payroll payment requests, canceled payroll checks, and separation payment calculations.

•

We reviewed selected claims packets, corresponding warrants, and canceled accounts payable checks.

•

We reviewed documents pertaining to the internal auditor including the completed risk assessment, a risk assessment process document prepared by the CPA firm, and Board resolutions. DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY

25 25

•

We reviewed user-access permission rights reports and audit logs generated from the financial accounting software package.

We conducted our performance audit in accordance with generally accepted government auditing standards (GAGAS). Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objective. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective.

26

OFFICE OF THE NEW YORK STATE COMPTROLLER

APPENDIX D HOW TO OBTAIN ADDITIONAL COPIES OF THE REPORT To obtain copies of this report, write or visit our web page:

Office of the State Comptroller Public Information Office 110 State Street, 15th Floor Albany, New York 12236 (518) 474-4015 http://www.osc.state.ny.us/localgov/

DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY

27 27

APPENDIX E OFFICE OF THE STATE COMPTROLLER DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY Steven J. Hancox, Deputy Comptroller John C. Traylor, Assistant Comptroller

LOCAL REGIONAL OFFICE LISTING BUFFALO REGIONAL OFFICE Robert Meller, Chief Examiner Office of the State Comptroller 295 Main Street, Suite 1032 Buffalo, New York 14203-2510 (716) 847-3647 Fax (716) 847-3643 Email: [email protected]

GLENS FALLS REGIONAL OFFICE Karl Smoczynski, Chief Examiner Office of the State Comptroller One Broad Street Plaza Glens Falls, New York 12801-4396 (518) 793-0057 Fax (518) 793-5797 Email: [email protected]

Serving: Allegany, Cattaraugus, Chautauqua, Erie, Genesee, Niagara, Orleans, Wyoming counties

Serving: Clinton, Essex, Franklin, Fulton, Hamilton, Montgomery, Rensselaer, Saratoga, Warren, Washington counties

ROCHESTER REGIONAL OFFICE Edward V. Grant, Jr., Chief Examiner Office of the State Comptroller The Powers Building 16 West Main Street – Suite 522 Rochester, New York 14614-1608 (585) 454-2460 Fax (585) 454-3545 Email: [email protected]

ALBANY REGIONAL OFFICE Kenneth Madej, Chief Examiner Office of the State Comptroller 22 Computer Drive West Albany, New York 12205-1695 (518) 438-0093 Fax (518) 438-0367 Email: [email protected]

Serving: Cayuga, Chemung, Livingston, Monroe, Ontario, Schuyler, Seneca, Steuben, Wayne, Yates counties

Serving: Albany, Columbia, Dutchess, Greene, Schenectady, Ulster counties

SYRACUSE REGIONAL OFFICE Eugene A. Camp, Chief Examiner Office of the State Comptroller State Office Building, Room 409 333 E. Washington Street Syracuse, New York 13202-1428 (315) 428-4192 Fax (315) 426-2119 Email: [email protected]

HAUPPAUGE REGIONAL OFFICE Jeffrey P. Leonard, Chief Examiner Office of the State Comptroller NYS Office Building, Room 3A10 Veterans Memorial Highway Hauppauge, New York 11788-5533 (631) 952-6534 Fax (631) 952-6530 Email: [email protected]

Serving: Herkimer, Jefferson, Lewis, Madison, Oneida, Onondaga, Oswego, St. Lawrence counties

Serving: Nassau, Suffolk counties

BINGHAMTON REGIONAL OFFICE Patrick Carbone, Chief Examiner Office of the State Comptroller State Office Building, Room 1702 44 Hawley Street Binghamton, New York 13901-4417 (607) 721-8306 Fax (607) 721-8313 Email: [email protected]

NEWBURGH REGIONAL OFFICE Christopher Ellis, Chief Examiner Office of the State Comptroller 33 Airport Center Drive, Suite 103 New Windsor, New York 12553-4725 (845) 567-0858 Fax (845) 567-0080 Email: [email protected]

Serving: Broome, Chenango, Cortland, Delaware, Otsego, Schoharie, Sullivan, Tioga, Tompkins counties

28

Serving: Orange, Putnam, Rockland, Westchester counties

OFFICE OF THE NEW YORK STATE COMPTROLLER