OFFICE OF THE NEW YORK STATE COMPTROLLER

D IVISION OF LOCAL GOVERNMENT

& SCHOOL ACCOUNTABILITY

Schenectady
City School District
Internal Controls Over
Selected Financial Activities

Report of Examination
Period Covered:
July 1, 2007 — January 6, 2009
2009M-154

Thomas P. DiNapoli
 Table of Contents

Page

AUTHORITY LETTER 2

EXECUTIVE SUMMARY 3

INTRODUCTION 5
Background 5
Objective 5
Scope and Methodology 5
Comments of District Officials and Corrective Action 6

PAYROLL DISBURSEMENTS 7
Payroll Processing 7
Payroll Certification 10
Recommendations 11

CLAIMS AUDIT 12
Recommendation 13

INTERNAL AUDITOR 14
Recommendation 14

INFORMATION TECHNOLOGY 15
Recommendation 16

APPENDIX A Response From District Officials 17

APPENDIX B OSC Comments on the District’s Response 22
APPENDIX C Audit Methodology and Standards 25
APPENDIX D How to Obtain Additional Copies of the Report 27
APPENDIX E Local Regional Office Listing 28

DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 11

 State of New York
Office of the State Comptroller

Division of Local Government

and School Accountability

November 2009

Dear School District Officials:

A top priority of the Office of the State Comptroller is to help school district officials manage their
districts efficiently and effectively and, by so doing, provide accountability for tax dollars spent to
support district operations. The Comptroller oversees the fiscal affairs of districts statewide, as well
as districts’ compliance with relevant statutes and observance of good business practices. This fiscal
oversight is accomplished, in part, through our audits, which identify opportunities for improving
district operations and Board of Education governance. Audits also can identify strategies to reduce
district costs and to strengthen controls intended to safeguard district assets.

Following is a report of our audit of the Schenectady City School District, entitled Internal Controls
Over Selected Financial Activities. This audit was conducted pursuant to Article V, Section 1 of
the State Constitution and the State Comptroller’s authority as set forth in Article 3 of the General
Municipal Law.

This audit’s results and recommendations are resources for district officials to use in effectively
managing operations and in meeting the expectations of their constituents. If you have questions about
this report, please feel free to contact the local regional office for your county, as listed at the end of
this report.

Respectfully submitted,

Office of the State Comptroller

Division of Local Government
and School Accountability

2 OFFICE OF THE NEW YORK STATE COMPTROLLER

 State of New York
Office of the State Comptroller
EXECUTIVE SUMMARY

The Schenectady City School District (District) is governed by the Board of Education (Board) which
comprises seven elected members. The Board is responsible for the general management and control
of the District’s financial and educational affairs. The Superintendent of Schools (Superintendent) is
the chief executive officer of the District and is responsible, along with other administrative staff, for
the day-to-day management of the District under the direction of the Board.

There are 15 elementary schools, an early childhood education center, three middle schools, one high
school, a career center, and an adult education center in operation within the District, with approximately
10,400 students and 1,700 employees. The District’s operating expenditures for the 2007-08 fiscal year
were $139.3 million, which were funded primarily with State and Federal aid, and real property taxes.

Scope and Objective

The objective of our audit was to examine the District’s internal controls over selected financial
activities for the period July 1, 2007 to January 6, 2009. Our audit addressed the following related
questions:

• Have District officials established adequate internal controls over payroll disbursements and
are those controls operating effectively to safeguard District assets?

• Have District officials established appropriate internal controls over the claims audit process
and are those controls operating effectively to safeguard District assets?

• Have District officials appropriately established the internal audit function?

• Have District officials appropriately designed the controls over the District’s information
technology (IT) system to protect District assets?

Audit Results

The Board and District administrators need to improve their oversight of District operations. As a
result of poor oversight, we found weaknesses in controls over the District’s payroll disbursements,
claims audit process, internal audit function, and information technology system.

The former Head Utility Worker received over $50,000 in overtime compensation for duties attributable
to facilities management and energy management during the 2007-08 fiscal year. However, his approved

DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 33

time sheets did not clearly state the overtime hours that were allocated to each responsibility, and
the District did not have additional supporting documentation detailing the duties that he performed
during these hours. Although the employee’s supervisor approved the time sheets, he could not verify
the specified hours claimed were actually worked. Approval of overtime payments without supporting
documentation or supervisory knowledge of hours worked could result in employees receiving
compensation they may not be entitled to.

Because District officials do not provide sufficient supervisory review of payroll transactions, employees
made clerical errors when calculating 12 of the payroll payments in our sample, which resulted in
incorrect payments totaling $2,373. We also found weaknesses in the District’s internal controls over
separation payments, resulting in questionable payments to employees totaling $26,026. In addition,
the Assistant Superintendent for Business did not certify 11 of the 14 final payroll reports that we
reviewed. These weaknesses can, and did, result in incorrect payments being made to employees.

We also found weaknesses in the District’s claims audit process. Our review of 50 claims, totaling
$1,082,675, disclosed that 26 of the claims tested, totaling $293,921, had one or more deficiencies. The
claims auditor approved these claims for payment, although the claims did not comply with District
purchasing procedures. As a result, the Board has limited assurance that the claims audit process is
working as intended and that all paid claims were proper and necessary District expenditures.

Education Law requires that each district has an internal auditor who will undertake annual risk
assessments of district operations. The Board appointed a certified public accounting firm to serve
as the District’s internal auditor on December 5, 2007, almost a year after the requirement went into
effect. The District received the internal auditor’s final risk assessment statements for the year ended
June 30, 2007 on February 11, 2009. While the internal auditor should have provided the District with
a risk assessment for the year ended June 30, 2008 by December 31, 2008, the internal auditor had not
yet started it at the end of our fieldwork in May 2009. The internal auditor’s failure to perform a timely
annual risk assessment leaves the Board with limited assurance that potential risks at the District are
identified and that appropriate internal controls are in place to address those risks.

District officials have not established formal policies or procedures to limit users’ access within the
financial software system. District officials do not sufficiently use audit logs or change reports to monitor
the system for inappropriate access or unauthorized changes to the financial software. In addition, we
found that employees had access rights to the financial software that were not required to perform their
job duties. These weaknesses increase the risk that inappropriate payments or unauthorized changes to
data could occur and not be detected in a timely manner.

Comments of District Officials

The results of our audit and recommendations have been discussed with District officials and their
comments, which appear in Appendix A, have been considered in preparing this report. District
officials generally disagreed with our findings and recommendations. Our comments concerning the
District officials’ response can be found in Appendix B.

4 OFFICE OF THE NEW YORK STATE COMPTROLLER

 Introduction
Background The Schenectady City School District (District) is located in the City
of Schenectady, Schenectady County. The District is governed by the
Board of Education (Board) which comprises seven elected members.
The Board is responsible for the general management and control of
the District’s financial and educational affairs. The Superintendent of
Schools (Superintendent) is the chief executive officer of the District
and is responsible, along with other administrative staff, for the day-
to-day management of the District under the direction of the Board.

There are 15 elementary schools, an early childhood education center,

three middle schools, one high school, a career center, and an adult
education center in operation within the District, with approximately
10,400 students and 1,700 employees. The District’s operating
expenditures for the 2007-08 fiscal year were $139.3 million, which
were funded primarily with State and Federal aid, and real property
taxes.

Objective The objective of our audit was to examine the District’s internal
controls over selected financial activities. Our audit addressed the
following related questions:

• Have District officials established adequate internal controls

over payroll disbursements and are those controls operating
effectively to safeguard District assets?

• Have District officials established appropriate internal

controls over the claims audit process and are those controls
operating effectively to safeguard District assets?

• Have District officials appropriately established the internal

audit function?

• Have District officials appropriately designed the controls

over the District’s information technology (IT) system to
protect District assets?

Scope and We examined the District’s internal controls over payroll

Methodology disbursements, claims auditing, the internal audit function and
information technology for the period July 1, 2007 to January 6, 2009.

We conducted our audit in accordance with generally accepted

government auditing standards (GAGAS). More information on
such standards and the methodology used in performing this audit is
included in Appendix C of this report.

DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 55

Comments of District The results of our audit and recommendations have been discussed
Officials and Corrective with District officials and their comments, which appear in Appendix
Action A, have been considered in preparing this report. District officials
generally disagreed with our findings and recommendations. Our
comments concerning the District officials’ response can be found in
Appendix B.

The Board has the responsibility to initiate corrective action. Pursuant

to Section 35 of the General Municipal Law, Section 2116-a (3)(c)
of the Education Law, and Section 170.12 of the Regulations of the
Commissioner of Education, a written corrective action plan (CAP)
that addresses the findings and recommendations in this report
must be prepared and provided to our office within 90 days, with
a copy forwarded to the Commissioner of Education. To the extent
practicable, implementation of the CAP must begin by the end of
the next fiscal year. For more information on preparing and filing
your CAP, please refer to our brochure, Responding to an OSC Audit
Report, which you received with the draft audit report. The Board
should make the CAP available for public review in the District
Clerk’s office.

6 OFFICE OF THE NEW YORK STATE COMPTROLLER

 Payroll Disbursements

School districts establish the pay and benefits for professional

employees and support staff in the written employment contracts
and agreements they negotiate with employee bargaining units or
individual employees. Employment contracts, agreements, and
policies should contain clear language to allow proper interpretation of
their terms and conditions. In addition, controls such as a supervisory
review of payroll transactions help to ensure that compensation is
paid in accordance with employment contracts and District policies.
District officials and administrators must ensure that appropriate
controls are established to prevent and detect errors or irregularities
in the District’s payroll and personnel procedures and practices.
Education Law requires the District to certify all payrolls to ensure
that all payments are proper and necessary.

The former Head Utility Worker received over $50,000 in overtime

compensation for duties attributable to facilities management and
energy management during the 2007-08 fiscal year. Although his
supervisor approved the overtime, he could not verify the specified
hours claimed were actually worked, and the District did not have
additional supporting documentation detailing the work performed.
Therefore, the District could not be assured that the overtime the
employee claimed was accurate and necessary. In addition, District
officials do not sufficiently review payroll transactions initiated by
the Human Resources Department or processed by the payroll clerks.
We found clerical errors in the calculation of 12 of the payments in
our test sample, which resulted in incorrect payments totaling $2,373.
We also found weaknesses in the District’s internal controls over
separation payments, resulting in questionable payments to employees
totaling $26,026. Furthermore, the Assistant Superintendent for
Business (ASB) did not certify 11 of the 14 final payroll reports that
we examined. As a result of these weaknesses, the District cannot
be assured that all payroll disbursements were proper and necessary
District expenditures.
Payroll Processing The primary objective for internal controls over payroll processing
is to ensure that employees are paid wages and salaries and provided
benefits to which they are entitled. Controls, such as supervisory
review of payroll transactions and certification of payrolls, help to
ensure that compensation is made in accordance with Board action,
employment contracts, and District policies. Employment contracts
and policies generally address matters such as hours to be worked,
rates of compensation, amount and type of leave time to be granted,
eligibility for health insurance and other fringe benefits, and post
employment benefits to be granted.

DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 77

 Overtime — While overtime pay can be an expected cost of doing
business for a school district, it is a cost that must be carefully
controlled. A critical control over payroll and overtime expenditures
is verification of overtime worked and subsequent approval of the
employee’s time sheet for payment. This helps ensure that the District
incurs only necessary overtime costs. Properly detailed logs of work
performed can further provide control of overtime costs and allow for
analysis of additional staffing needs or revision of work priorities and
scheduling.

The District paid the former Head Utility Worker $50,836 in overtime
during the 2007-08 fiscal year. This individual’s time sheets indicated
that the overtime coverage was for overtime split between his duties
attributable to facilities management and energy management. Each
duty performed had separate and distinct responsibilities.

We reviewed the 26 time sheets that the former Head Utility Worker
submitted for the 2007-08 fiscal year and found that he recorded that
he worked at least 36 hours of overtime each two-week pay period.
The former Head Utility Worker’s supervisor, the ASB, initialed his
approval for all of the overtime hours documented on the time sheets.
However, the Head Utility Worker’s approved time sheets were the
only supporting documentation for the overtime that he claimed
to have worked, and did not adequately document the reasons for
overtime coverage. In fact, of the 26 time sheets reviewed, two did
not document the reason for overtime coverage at all, and 19 included
overtime hours worked that were consolidated into one number, but
were attributable to both duties. Therefore, District officials did not
have sufficient documentation of the overtime hours attributable to
each duty. The District did not have documentation to describe in
detail the work that he actually performed during these hours, such as
a detailed log of completed tasks or progress that was made on tasks
that were not yet completed. The ASB indicated that the former Head
Utility Worker was required to enter District buildings when District
officials were not present (e.g., nights, weekends); thus, the ASB was
unable to verify the specified hours claimed were actually worked.

Approval of overtime payments without supporting documentation

or supervisory knowledge of hours worked could result in employees
receiving compensation that they may not be entitled to.

Payroll Calculation Errors — It is important that District officials

review payroll transactions to ensure that they are correct and
necessary District expenditures. District officials did not sufficiently
review payroll transactions that were initiated by the Human
Resources Department or processed by the payroll clerks to ensure
that all payments were correct and made in accordance with District
policies and employment contracts.

8 OFFICE OF THE NEW YORK STATE COMPTROLLER

 We tested 54 payroll payments totaling $69,984 that the District
made to 25 employees that included overtime payments to eligible
employees to verify that they were accurate and properly approved.
We found 12 calculation errors in payroll and overtime payments
totaling $2,373. Errors in payroll and overtime payment calculations
occurred because employees used incorrect pay rates when calculating
these payments, and did not accurately calculate the number of hours
worked. For example, the District incorrectly paid a maintenance
employee his 2006-07 hourly overtime rate of pay for overtime
that he completed in the 2007-08 fiscal year, which resulted in an
underpayment of $328.

Absent an adequate review and approval of payrolls, calculation

errors were made and not detected or corrected. Therefore, employees
received incorrect compensation for services rendered.

Separation Payments — A total of 58 employees received retirement

and/or separation payments during our audit period, totaling
approximately $1.4 million. We tested seven separation payments
for retiring employees, totaling $329,566, to determine if the
payments were properly supported, calculated, and authorized. Due
to complicated contract language and District officials’ failure to
sufficiently review the separation payment calculations prepared
by the Human Resources Administrator, we questioned payout
calculations for five of the seven payments, amounting to $23,408. In
addition, as part of our payroll disbursements testing, we questioned
$2,618 in separation payments made to another individual. Examples
of the problematic payments are below:

• The District paid two administrators a total of $139,728 in

retirement benefits that consisted of a retirement incentive
and sick leave payments. Both administrators elected to defer
their retirement dates until the year following their first year
of eligibility. Their employment agreements stated that the
retirement incentive was a percentage of the employee’s base
salary payable in the first year of eligibility. However, District
officials incorrectly calculated the retirement incentive
payments based on total salary during the year of retirement
deferral, which included base salary, tax sheltered annuity
contributions, and credit hour stipends. Consequently, the
administrators were potentially overpaid a total of $10,605 in
retirement incentives.

• The District paid an Assistant Superintendent a total of

$109,031 in retirement benefits that consisted of a retirement
incentive, vacation leave, and sick leave payments. Her
employment agreement stated that her retirement incentive

DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 99

 would be a percentage of her base salary and that her vacation
and sick leave payments would be calculated using her
salary day rate. However, in addition to her base salary, her
employment agreement provided benefits including expense
reimbursement and tax sheltered annuity contributions.
Because of complicated contract language concerning how to
determine this individual’s salary day rate and base salary for
retirement purposes, District officials may have incorrectly
calculated all of her retirement benefits using her base salary
plus the additional benefits, which resulted in a potential
overpayment totaling $7,697.

The absence of clear contract language regarding the determination

of an employee’s separation payments raises questions about the
legitimacy of the amount that the District paid to its employees.
Employment contracts, agreements, or policies containing provisions
that are not clearly articulated or that do not address all pertinent
aspects of employment can lead to uncertainty about the rights, duties,
and responsibilities of all parties involved. Furthermore, the lack of a
process in place for reviewing separation payment calculations can,
and did, result in incorrect payments being made.

Payroll Certification Education Law requires the District to certify all payrolls. A
certified payroll is one that has been examined and approved by
an administrator who determines that the persons included in the
payroll reports have performed their duties in accordance with the
terms of their employment. The administrator who certifies payroll
must be independent of the human resources and payroll processes. A
properly certified payroll helps to ensure that payments are accurate
and justified.

The ASB certifies the payrolls; however, there is no District policy

or Board resolution designating him to do so. Furthermore, the ASB
is not independent of the payroll process because he has full access
rights to the financial management software system that is used
for payroll processing. The District’s payroll certification process
includes printing two payroll reports: a preliminary report prior to
printing the payroll checks and a final report containing a certification
page after the payroll checks are printed.

We examined 14 final payroll reports during our audit period to

determine whether the ASB had properly certified them. Although
the ASB initialed 13 of the 14 preliminary reports, he did not certify
11 of the 14 final payroll reports. For example, although a final
report was printed with a certification page for the pay period ending
November 21, 2008, totaling $3,562,967, the ASB did not certify the
payroll. In other instances, final reports were not even printed for the

10 OFFICE OF THE NEW YORK STATE COMPTROLLER

 ASB’s secondary review and proper certification. Failure to review
payroll reports prior to payroll checks being processed allows for
changes to be made that may not be detected or corrected. Without an
independent review and properly performed certification of payroll,
District officials cannot ensure that payroll payments are accurate and
justified.

Recommendations 1. The Board should investigate the discrepancies noted in this report
to determine whether the payments were appropriate, and recoup
any inappropriate amounts.

2. The District should require that employees properly document

overtime hours worked. Such documentation should include
detailed logs of the work performed during overtime hours.

3. District officials should provide adequate supervision to ensure

that payroll is processed accurately and that employees are paid
the wages and salaries which they are entitled to, as approved by
the Board.

4. The Board should ensure that collective bargaining agreements

and employment contracts that include provisions for separation
payouts are clearly written. District officials should make only
those payments that are authorized by such agreements.

5. District officials should ensure that separation payments are

calculated as intended by the District in compliance with collective
bargaining agreements and employment contracts. To help assure
this compliance, someone independent of the process should
review separation payment calculations prepared by the Human
Resources Administrator.

6. The Board should formally designate an administrator independent

of the payroll process to certify the payroll. The administrator or
his/her designee should certify each payroll by attesting that the
persons included in the payroll have regularly performed their
duties in accordance with the terms of their employment.

DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 11

11
 Claims Audit
Education Law requires that each claim against the District be
audited prior to payment to ensure that all payments are proper and
legal. The Board is responsible for auditing the District’s claims or,
alternatively, may appoint a claims auditor to assume the Board’s
powers and duties of auditing and approving or denying all claims for
payment. A proper claims audit is intended to ensure that each charge
is properly authorized, accurately calculated, adequately supported,
in conformance with District policy, and a valid District expense.
Employees must attach supporting documentation to each claim that
includes evidence that the District received the goods or services and
that employees followed District policy when procuring the goods or
services. The claims auditor is responsible for certifying a list of all
approved claims (warrant) and for communicating the claims audit
results to the Board.

The Board appointed a claims auditor to assume its claims auditing

duties. We examined 50 claims that the District paid during the audit
period, totaling $1,082,675, to determine whether they were properly
authorized, made in accordance with District policy, adequately
supported, and showed evidence of receipt of goods and services.
Twenty-six of the 50 claims, totaling $293,921, had one or more
deficiencies. Nineteen of these claims totaling $272,175 did not have
verbal or written quotes attached1 and therefore did not comply with
the District’s purchasing procedures. The claims auditor approved
these claims for payment, although the claims did not contain evidence
that employees had obtained the quotes in accordance with District
purchasing procedures. The remaining seven claims totaling $21,746
lacked supporting documentation. They either did not have purchase
receipts attached, did not contain sufficient itemization such as lists
of attendees who received District-paid meals and refreshments, and/
or did not have prior approvals attached, such as a District-issued
purchase order or authorization to attend a conference.

When District officials and employees do not adhere to the District’s

purchasing procedures and purchase goods and services without
the benefit of obtaining quotes, they cannot be sure that they have
acquired goods and services in the most economical manner and in
the best interest of District taxpayers. Failure of the claims auditor to
perform a proper audit could result in the inappropriate payment of
claims.
____________________
1
The District’s ‘Purchasing Procedures’ require a written request for quotation
from at least three vendors for purchases between $5,000 and $10,000 and a verbal
quotation from at least three vendors for purchases between $2,500 and $5,000.

12 OFFICE OF THE NEW YORK STATE COMPTROLLER

Recommendation 7. The Board should ensure that the claims auditor conducts a
proper audit of claims in accordance with District policies and
procedures. The claims audit should include verification that
District personnel complied with the District’s purchasing policy
and procedures.

DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 13

13
 Internal Auditor

By law, school districts must have had an internal audit function

in operation no later than December 31, 2006. The internal audit
function must include, at a minimum, the development of a risk
assessment of district operations. The risk assessment should include
a review of financial policies, procedures and practices; an annual
review and update of such risk assessment; and annual testing and
evaluation of one or more areas of the district’s internal controls. The
internal auditor is also required to prepare reports (at least annually
or more frequently as the Board may direct) that analyze significant
risk assessment findings, recommend changes for strengthening
controls and reducing identified risks, and specify timeframes for
implementation of such recommendations.

The Board appointed a certified public accounting firm to serve as the

District’s internal auditor on December 5, 2007, almost a year after the
requirement went into effect. Due to claimed scheduling conflicts, the
internal auditor did not present the draft risk assessment to the audit
committee until the Fall of 2008. Furthermore, the District received
the final risk assessment report for the year ended June 30, 2007 on
February 11, 2009. While the internal auditor should have provided
the District with a risk assessment for the year ended June 30, 2008
by December 31, 2008, the internal auditor had not yet started it at
the end of our fieldwork in May 2009.

The internal auditor’s failure to perform a timely annual risk

assessment leaves the Board with limited assurance that potential
risks are identified and that appropriate internal controls are in place
to address those risks.

Recommendation 8. The Board should ensure that the internal auditor performs risk
assessments in a timely manner and on an annual basis as required
by the law.

14 OFFICE OF THE NEW YORK STATE COMPTROLLER

 Information Technology

The use of information technology affects the fundamental manner

in which the District processes, records, and reports financial
transactions. The District’s widespread use of information
technology presents a number of internal control risks that must
be addressed, such as misuse or loss of data from unauthorized
access. District policies and procedures that limit user access to only
authorized persons protect the data from intentional or unintentional
manipulation. Furthermore, software access controls must restrict
user access to only those functions needed by staff to perform their
job duties and to prevent these users from being involved in multiple
aspects of financial transactions. In this way, software access controls
help to preserve proper segregation of duties. District officials can
implement compensating controls, such as reviewing edit/change
reports (audit logs), to help offset control weaknesses resulting from
the failure to properly restrict user access.

The District uses a financial accounting software package (financial

software) to process and maintain financial transactions. The financial
software can be programmed to restrict users’ access to transactions
within the scope of their responsibilities. District officials have not
established formal policies or procedures to limit users’ access within
the financial software system. Although the Assistant Superintendent
for Business (ASB) uses audit logs to monitor productivity, he
stated that he does not use audit logs or change reports to monitor
for inappropriate access or unauthorized changes to the financial
software.

In addition, we found that the ASB and the Deputy Treasurer have full
access rights to the financial software, including full administrative
rights to modify user access. We also found that a payroll clerk
has access rights to add, update, and delete journal entries, process
payroll, and also print, void, and re-issue computer checks. With
these capabilities, these individuals have the opportunity to initiate
and conceal inappropriate financial transactions without detection.

Due to these control weaknesses, we generated and reviewed eight

audit logs for cash disbursements to determine if employees with
incompatible duties inappropriately used their access rights to make
changes to these modules. Although we found no instances of misuse,
the failure to establish and monitor policies and procedures relating
to financial data user access, restrict user access to the financial
software, and review corresponding audit logs increases the risk that

DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 15

15
 inappropriate payments or unauthorized changes to data could occur
and not be detected in a timely manner.

Recommendation 9. District officials should adopt and monitor comprehensive policies

and procedures that address user access rights to the financial
software system. The Board should designate a responsible person
to carry out these policies and procedures, and restrict user access
based on users’ job duties. If this is not feasible, District officials
should implement compensating controls, such as reviewing audit
logs.

16 OFFICE OF THE NEW YORK STATE COMPTROLLER

 APPENDIX A

RESPONSE FROM DISTRICT OFFICIALS

The District officials’ response to this audit can be found on the following pages.

The page numbers included in the response letter refer to the "draft" audit report distributed earlier
to District officials. The final audit report has been reformatted. Therefore, the page references in the
response letter are no longer accurate.

DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 17

17
 See
Note 1
Page 22

See
Note 2
Page 22

18 OFFICE OF THE NEW YORK STATE COMPTROLLER

 See
Note 3
Page 22

See
Note 4
Page 22

See
Note 5
Page 23

See
Note 6
Page 23

DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 19

19
 See
Note 7
Page 23

20 OFFICE OF THE NEW YORK STATE COMPTROLLER

 See
Note 8
Page 23

See
Note 9
Page 23

See
Note 10
Page 24

DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 21

21
 APPENDIX B

OSC COMMENTS ON THE DISTRICT’S RESPONSE

Note 1

During our review of payroll processing, District staff and officials provided no information indicating
that payroll transactions were reviewed by Business Office supervisory staff. Our review of District
payroll transactions also did not provide any evidence that the transactions were reviewed. In addition,
during our exit conference District officials did not provide any evidence that supervisory level staff
in the Business Office reviewed the payroll documentation prepared by the Human Resources Office
prior to payroll clerical staff processing the information.

Note 2

It is important that District officials review payroll transactions to ensure that they are correct and
necessary District expenditures. Our report does not conclude that “District officials should personally
review each of the thousands of payroll checks issued each biweekly pay period.” Rather, in light of
the payroll processing deficiencies cited in this report (e.g., calculation errors, questionable separation
payments), we recommend that District officials provide adequate supervision to ensure that payrolls
are processed accurately and that employees are paid the wages and salaries to which they are entitled,
as approved by the Board. Because District officials did not perform an adequate review and approval of
payrolls, calculation errors were made and not detected or corrected, resulting in employees receiving
incorrect compensation for services rendered.

Note 3

The District has no assurance that the employee did perform duties for which overtime payments were
made. The only indication that the employee performed overtime duties was the “number of overtime
hours” he recorded on his time sheets, initialed by the Assistant Superintendent for Business (ASB).
Further, the ASB indicated that the employee was required to enter District buildings when District
officials were not present (e.g., nights, weekends); thus, the ASB was unable to verify the specified hours
claimed were actually worked. Approval of overtime payments without supporting documentation or
supervisory knowledge of hours worked could result in employees receiving compensation that they
may not be entitled to.

Note 4

This statement is incorrect. We tested 54 payroll payments totaling $69,984 that the District made to 25
employees that included overtime payments to eligible employees to verify that they were accurate and
properly approved. We found 12 calculation errors in payroll and overtime payments. The District paid
the former Head Utility Worker $50,836 in overtime during the 2007-08 fiscal year. Due to calculation
errors found during our initial payroll testing, coupled with the significant amount of overtime paid to
this one employee, we performed further review.

22 OFFICE OF THE NEW YORK STATE COMPTROLLER

Note 5

Audit staff held discussions with numerous District officials and staff, including the Human Resources
Administrator, ASB, Deputy Treasurer, Senior Payroll Audit Clerk and Payroll Clerk regarding the
District’s payroll process, supporting documentation and payroll payments made. Audit staff also had
discussions with these individuals to gain an understanding of the District’s collective bargaining
agreements, memorandums of agreement, and employment contracts, when warranted.

Our findings were based on a sample of transactions, not the entire population. Given the significant
error rate that we found, the actual level of inaccurate payments in the District’s payroll will be much
higher than $2,373. The fact that we found so many errors in the payments that we tested indicates an
internal control weakness that should be addressed by District officials.

Note 6

Except where contract language explicitly stated that the retirement incentive was a percentage of
the employee’s “base salary payable in the first year of eligibility,” and the District instead calculated
the retirement incentive payment based on “total salary during the year of retirement deferral,” our
report did not conclude that the District incorrectly calculated separation payments that resulted in
overpayments, since the contracts are unclear and complicated. Rather, our report questioned payments
that were made and recommended that District officials ensure that separation payments are calculated
as intended by the District in compliance with collective bargaining agreements and employment
contracts. To help ensure this compliance, the School Attorney, in conjunction with the ASB, should
review separation payment calculations prepared by the Human Resources Administrator.

Note 7

Nowhere in this report do we counsel the District to renege on contracts, violate collective bargaining
agreements, or abridge the Taylor Law. Our report simply points out that contract language is unclear
and complicated regarding separation payments, which raises questions as to the legitimacy of
separation payments.

Note 8

Effective internal controls provide for a payroll certification control by requiring a periodic sign-off
by a management level employee independent of the payroll operation. This procedure should ensure
that all payments are made to bona fide employees and reflect the proper pay rate. Minimally, the
administrator who certifies the payroll should sign-off on the final bi-weekly payroll and employ a
sampling process for a more in-depth review. This control is essential, particularly in light of the
payroll processing deficiencies cited in this report resulting from an insufficient review of payroll
transactions. Our report states that the ASB did not certify 11 of the 14 final payroll reports.

Note 9

During the audit, audit staff made specific requests to District officials for additional documentation
when items were not attached to a claim. At the exit discussion, District officials did not request this
information. We will provide this information to District officials under separate letter.

DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 23

23
Note 10

The Senior Payroll Audit Clerk is the official Civil Service title for the payroll clerk. However, the
Senior Payroll Audit Clerk has access rights to add, update, and delete journal entries, process payroll,
and also print, void, and re-issue computer checks, thereby resulting in an inadequate separation of
duties. Further, the Senior Payroll Audit Clerk’s access is not restricted to only those functions needed
by her to perform her job duties. Absent restricted user access, employees have the opportunity to
initiate and conceal inappropriate financial transactions without detection. Software access controls
must restrict user access to only those functions needed by staff to perform their job duties and to
prevent these users from being involved in multiple aspects of financial transactions. In this way,
software access controls help to preserve proper segregation of duties.

District officials can implement compensating controls, such as reviewing change reports/audit logs,
to help offset control weaknesses resulting from the failure to properly restrict user access. Although
the ASB uses audit logs to monitor productivity, the ASB stated that he does not use audit logs or
change reports to monitor for inappropriate access or unauthorized changes to the financial software.
There is an audit trail recorded within the District’s financial software application that captures who
is entering transactions with a date and time stamp. It provides details on the point of entry (e.g.,
workstation identification). Reports can be generated from this audit trail. The ASB does not generate
exception and change reports and stated that these reports would be too cumbersome to generate due
to the system not being fast enough.

24 OFFICE OF THE NEW YORK STATE COMPTROLLER

 APPENDIX C

AUDIT METHODOLOGY AND STANDARDS

Our overall goal was to assess the adequacy of the internal controls put in place by officials to safeguard
District assets. To accomplish this, we performed an initial assessment of the internal controls so
that we could design our audit to focus on those areas most at risk. Our initial assessment included
evaluations of the following areas: financial oversight, cash receipts and disbursements, purchasing,
payroll and personal services, and information technology.

During the initial assessment, we interviewed appropriate District officials, performed limited tests
of transactions, and reviewed pertinent documents, such as District policies and procedures manuals,
Board minutes, and financial records and reports. In addition, we obtained information directly from
the computerized financial databases and then analyzed it electronically using computer-assisted
techniques. This approach provided us with additional information about the District’s financial
transactions as recorded in its databases. Further, we reviewed the District’s internal controls and
procedures over the computerized financial databases to help ensure that the information produced by
such systems was reliable.

After reviewing the information gathered during our initial assessment, we determined where
weaknesses existed, and evaluated those weaknesses for the risk of potential fraud, theft and/
or professional misconduct. We then decided on the reported objective and scope by selecting for
audit those areas most at risk. We selected payroll disbursements, claims audit process, internal audit
function, and information technology for further audit testing.

To determine if the Board and District officials had properly designed and implemented internal
controls over the selected audit areas, we inquired and observed District staff and examined the
following records and reports for the period July 1, 2007 through January 6, 2009:

• We reviewed minutes from the proceedings of Board and Audit Committee meetings and
selected supporting documentation.

• We reviewed pertinent District policies and procedures.

• We reviewed employee personnel files, collective bargaining agreements, and individual

employment contracts.

• We reviewed supporting documentation for payroll payments including payroll journals and
reports, time sheets, payroll payment requests, canceled payroll checks, and separation payment
calculations.

• We reviewed selected claims packets, corresponding warrants, and canceled accounts payable
checks.

• We reviewed documents pertaining to the internal auditor including the completed risk
assessment, a risk assessment process document prepared by the CPA firm, and Board
resolutions.

DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 25

25
 • We reviewed user-access permission rights reports and audit logs generated from the financial
accounting software package.

We conducted our performance audit in accordance with generally accepted government auditing
standards (GAGAS). Those standards require that we plan and perform the audit to obtain sufficient,
appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit
objective. We believe that the evidence obtained provides a reasonable basis for our findings and
conclusions based on our audit objective.

26 OFFICE OF THE NEW YORK STATE COMPTROLLER

 APPENDIX D

HOW TO OBTAIN ADDITIONAL COPIES OF THE REPORT

To obtain copies of this report, write or visit our web page:

Office of the State Comptroller

Public Information Office
110 State Street, 15th Floor
Albany, New York 12236
(518) 474-4015
http://www.osc.state.ny.us/localgov/

DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 27

27
 APPENDIX E
OFFICE OF THE STATE COMPTROLLER
DIVISION OF LOCAL GOVERNMENT
AND SCHOOL ACCOUNTABILITY
Steven J. Hancox, Deputy Comptroller
John C. Traylor, Assistant Comptroller
LOCAL REGIONAL OFFICE LISTING
BUFFALO REGIONAL OFFICE
Robert Meller, Chief Examiner
Office of the State Comptroller
295 Main Street, Suite 1032
Buffalo, New York 14203-2510
(716) 847-3647 Fax (716) 847-3643
Email: Muni-Buffalo@osc.state.ny.us
Serving: Allegany, Cattaraugus, Chautauqua, Erie,
Genesee, Niagara, Orleans, Wyoming counties
ROCHESTER REGIONAL OFFICE
Edward V. Grant, Jr., Chief Examiner
Office of the State Comptroller
The Powers Building
16 West Main Street – Suite 522
Rochester, New York 14614-1608
(585) 454-2460 Fax (585) 454-3545
Email: Muni-Rochester@osc.state.ny.us
Serving: Cayuga, Chemung, Livingston, Monroe,
Ontario, Schuyler, Seneca, Steuben, Wayne, Yates
counties
SYRACUSE REGIONAL OFFICE
Eugene A. Camp, Chief Examiner
Office of the State Comptroller
State Office Building, Room 409
333 E. Washington Street
Syracuse, New York 13202-1428
(315) 428-4192 Fax (315) 426-2119
Email: Muni-Syracuse@osc.state.ny.us
Serving: Herkimer, Jefferson, Lewis, Madison,
Oneida, Onondaga, Oswego, St. Lawrence counties
BINGHAMTON REGIONAL OFFICE
Patrick Carbone, Chief Examiner
Office of the State Comptroller
State Office Building, Room 1702
44 Hawley Street
Binghamton, New York 13901-4417
(607) 721-8306 Fax (607) 721-8313
Email: Muni-Binghamton@osc.state.ny.us
Serving: Broome, Chenango, Cortland, Delaware,
Otsego, Schoharie, Sullivan, Tioga, Tompkins
counties
28 OFFICE OF THE NEW YORK STATE COMPTROLLER
GLENS FALLS REGIONAL OFFICE
Karl Smoczynski, Chief Examiner
Office of the State Comptroller
One Broad Street Plaza
Glens Falls, New York 12801-4396
(518) 793-0057 Fax (518) 793-5797
Email: Muni-GlensFalls@osc.state.ny.us
Serving: Clinton, Essex, Franklin, Fulton, Hamilton,
Montgomery, Rensselaer, Saratoga, Warren, Washington
counties
ALBANY REGIONAL OFFICE
Kenneth Madej, Chief Examiner
Office of the State Comptroller
22 Computer Drive West
Albany, New York 12205-1695
(518) 438-0093 Fax (518) 438-0367
Email: Muni-Albany@osc.state.ny.us
Serving: Albany, Columbia, Dutchess, Greene,
Schenectady, Ulster counties
HAUPPAUGE REGIONAL OFFICE
Jeffrey P. Leonard, Chief Examiner
Office of the State Comptroller
NYS Office Building, Room 3A10
Veterans Memorial Highway
Hauppauge, New York 11788-5533
(631) 952-6534 Fax (631) 952-6530
Email: Muni-Hauppauge@osc.state.ny.us
Serving: Nassau, Suffolk counties
NEWBURGH REGIONAL OFFICE
Christopher Ellis, Chief Examiner
Office of the State Comptroller
33 Airport Center Drive, Suite 103
New Windsor, New York 12553-4725
(845) 567-0858 Fax (845) 567-0080
Email: Muni-Newburgh@osc.state.ny.us
Serving: Orange, Putnam, Rockland, Westchester
counties