Audit on town of Ramapo

8/2/2019 Audit on town of Ramapo

1/62

DIVISIONOF LOCAL GOVERNMENT

& SCHOOL ACCOUNTABILITY

O F F I C E O F T H E N E W YO R K ST A T E C O M P T R O L L E R

Report of Examination

Period Covered:

January 1, 2009 November 17, 2010

2011M-143

Town of Ramapo

Internal Controls OverSelected Financial Activities

Thomas P. DiNapoli


2/62

11DIVISIONOF LOCAL GOVERNMENTAND SCHOOLACCOUNTABILITY

Page

AUTHORITY LETTER 3

EXECUTIVE SUMMARY 4

INTRODUCTION 6Background 6

Objective 6

Scope and Methodology 7

Comments of Town Officials and Corrective Action 7

BOARD OVERSIGHT 8 Recommendations 9

BASEBALL STADIUM CAPITAL PROJECT 10

Stadium Financing 10

Feasibility Analysis 13

Recommendations 14

FINANCIAL CONDITION 15Budget Estimates 15

Operating Deficits and Fund Balance 16

Exceeding Appropriations 18

Inter-Fund Advances 19

Recommendations 20

INFORMATION TECHNOLOGY 21

Breach Notifi

cation 21 Disaster Recovery 22

Auto Complete Setting 22

User Accounts 23

Inappropriate Computer Use 24

Information Security Awareness Training 24

Banking Policy 25

Recommendations 25

Table of Contents


3/62

2 OFFICEOFTHE NEW YORK STATE COMPTROLLER2

APPENDIX A Response From Town Officials 26

APPENDIX B OSC Comments on the Town Officials Response 50APPENDIX C Audit Methodology and Standards 58APPENDIX D How to Obtain Additional Copies of the Report 60APPENDIX E Local Regional Office Listing 61


4/62


State of New YorkOffice of the State Comptroller

Division of Local Governmentand School Accountability

February 2012

Dear Town Officials:

A top priority of the Office of the State Comptroller is to help local government officials manage

government resources efficiently and effectively and, by so doing, provide accountability for

tax dollars spent to support government operations. The Comptroller oversees the fiscal affairs of

local governments statewide, as well as compliance with relevant statutes and observance of good

business practices. This fiscal oversight is accomplished, in part, through our audits, which identify

opportunities for improving operations and Town of Ramapo governance. Audits also can identify

strategies to reduce costs and to strengthen controls intended to safeguard local government assets.

Following is a report of our audit of Town of Ramapo, entitled Internal Controls Over Selected

Financial Activities. This audit was conducted pursuant to Article V, Section 1 of the State

Constitution and the State Comptrollers authority as set forth in Article 3 of the General Municipal

Law.

This audits results and recommendations are resources for local government officials to use in

effectively managing operations and in meeting the expectations of their constituents. If you have

questions about this report, please feel free to contact the local regional office for your county, as listed

at the end of this report.

Respectfully submitted,

Office of the State Comptroller

Division of Local Government

and School Accountability


5/62


Office of the State ComptrollerState of New York

EXECUTIVE SUMMARY

The Town of Ramapo (Town) is located in Rockland County and has 12 villages, including Airmont,

Chestnut Ridge, Hillburn, Kaser, Montebello, New Hempstead, New Square, Pomona, Sloatsburg,

Spring Valley, Suffern and Wesley Hills. The Town Board (Board) is the governing and legislative

body of the Town. It determines policy and appropriates funds for various governmental functions and

services. The Board has the rights to adopt and manage the budget, control and have custody of Town

property, and oversee the Towns various Departments.

The Town provides various services to its residents, including maintaining and improving Town

roads, snow removal, public improvements, recreation and cultural activities, water, and general

governmental support. Budgeted appropriations for the fiscal years 2009 and 2010 were $71.4 million

and $74.9 million, respectively.

Scope and Objective

The objective of our audit was to assess the Towns internal controls over selected financial activities

for the period January 1, 2009, to November 17, 2010. We expanded the scope of our audit to include

January 1, 2008, to May 18, 2011, to review the trends associated with the Towns finances and to

include the Towns actions related to the baseball stadium construction project. Our audit addressed

the following related questions:

Did Town officials properly oversee and monitor the planning and construction of the baseball

stadium?

Are internal controls over the Towns finances appropriately designed to safeguard Town

assets?

Are internal controls over the Towns information technology (IT) system appropriately

designed to protect electronic data?

Audit Results

Town officials have inappropriately mingled the activities of the Town and the Ramapo Local

Development Corporation (RLDC) in the construction of a minor league baseball stadium. These

actions allowed Town officials to circumvent laws the Town is required to abide by for the

approval and construction of such projects, and has resulted in the Town paying over $35.4 million in

improvement costs and being liable for at least $25 million in bonds issued for debt on property that


6/62


1 This includes $25 million in principal + $2.5 million in interest.

the Town no longer owns. In addition, there is little likelihood that the project will generate sufficient

revenue to help the Town pay for this outstanding liability.

The Town will pay approximately $27.5 million1 in principal and interest payments on these bonds

over the next five years. This is significantly more than the approximately $7 million a feasibility

consultant projected the baseball stadium would generate in net revenues available for debt service

during the same time frame. The Town does not have a written agreement with the RLDC outlining

how the RLDC will reimburse the Town for the principal and interest on these bonds. Supposedly,

the RLDC is relying on revenues that will be generated from the sale of affordable housing units to

reimburse the Town. However, the RLDC obtained loans of approximately $29.9 million that were

also guaranteed by the Town to build these units. These loans must be repaid before any revenues

generated from the sale of the units can be made available to reimburse the Town for payments related

to the $25 million bonds. As a result, it is unlikely that the RLDC will be able to reimburse the Town

for the full principal and interest payments made on the $25 million bonds.

We found that the Board has not exercised effective oversight of the Town. Board members told us that

they received no financial reports, such as detailed project cost reports for Town projects (including

the baseball stadium), budget versus actual reports, and generally did not receive or review contracts.Additionally, Board members told us that they did not know how much the baseball stadium would

cost the taxpayers or how it would be paid for.

We also found that, in 2010, the Town had depleted its fund balances in three major operating funds

because of unrealistic revenue estimates and the Boards failure to monitor and adjust the budget

when it became clear that the Town would not achieve anticipated results. During 2009 and 2010, the

Town advanced approximately $3.3 million and $3.9 million, respectively, among funds with differing

tax bases, but failed to pay back those funds by the close of the fiscal year as required by law. The

advancing funds lost $17,243 in interest because they were not paid back with a comparable rate of

interest.

The Board did not establish adequate information technology policies, including a breach notification

policy, online banking policy or policies for assigning or deactivating user accounts. Further, the

Board has not adopted an entity-wide disaster recovery plan; therefore, in the event of a disaster, Town

personnel have no guidelines or plan to follow to resume mission-critical functions. In addition, the

auto-complete setting was enabled on the online banking computer. We also found multiple instances

of non-work-related computer usage. As a result, the Towns computer system and electronic data may

be susceptible to loss, unauthorized use, or improper disclosure.

Comments of Town Officials

The results of our audit and recommendations have been discussed with Town officials and their

comments, which appear in Appendix A, have been considered in preparing this report. Town officials

disagreed with our findings. Appendix B includes our comments on issues that Town officials raised

in their response letter.


7/62


Background

Introduction

Objective

The Town of Ramapo (Town) is located in Rockland County and

has 12 villages, including Airmont, Chestnut Ridge, Hillburn, Kaser,

Montebello, New Hempstead, New Square, Pomona, Sloatsburg,

Spring Valley, Suffern and Wesley Hills. The Town provides variousservices to its residents, including maintaining and improving Town

roads, snow removal, public improvements, recreation and cultural

activities, water, and general governmental support.

The Town Board (Board) is the governing and legislative body of

the Town. It determines policy and appropriates funds for various

governmental functions and services. The Board comprises the Town

Supervisor (Supervisor) and four councilpersons. Councilpersons

are elected at large in odd-numbered years for four-year terms; these

terms are staggered so that two councilpersons are elected eachbiennial session.

The Supervisor is the chief executive officer of the Town and is

responsible, along with other administrative staff, for the day-to-

day management of the Town under the direction of the Board. The

Supervisor, who also is a voting member of the Board and Director

of Finance, is responsible for oversight of the Towns ongoing capital

projects and general Town finances. Budgeted appropriations for the

fiscal years 2009 and 2010 were $71.4 million and $74.9 million,

respectively.

The Director of Automated Systems (Director) is responsible for

the day-to-day operations of the Information Technology (IT)

Department, which is overseen by the Supervisor and the Board. The

Department comprises two IT personnel who report to the Director.

The IT Department is responsible for the Towns 41 laptops, 179

desktop computers, and 26 servers. The Town contracts with various

outside vendors for IT-related services.

The objective of our audit was to assess the internal controls over

selected financial activities including the construction of a baseball

stadium, financial condition and information technology. Our audit

addressed the following related questions:

Did Town officials properly oversee and monitor the planning

and construction of the baseball stadium?

Are internal controls over the Towns finances appropriately

designed to safeguard Town assets?


8/62


Scope and

Methodology

Comments ofTown Officials andCorrective Action

Are internal controls over the Towns IT system appropriately

designed to protect electronic data?

We examined the Towns internal controls over selected financial

activities, including the baseball stadium, financial condition and IT

for the period January 1, 2009, to November 17, 2010. We expanded

the scope of our audit to include January 1, 2008, to May 18, 2011, to

review the trends associated with the Towns finances and to include

the Towns actions related to the baseball stadium.

Our audit disclosed areas in need of improvement concerning some

IT controls. Because of the sensitivity of this information, certain

vulnerabilities relating to passwords are not discussed in this report

but have been communicated confidentially to Town officials so they

could take corrective action.

We conducted our audit in accordance with generally accepted

government auditing standards (GAGAS). More information onsuch standards and the methodology used in performing this audit is

included in Appendix C of this report.

The results of our audit and recommendations have been discussed

with Town officials and their comments, which appear in Appendix

A, have been considered in preparing this report. Town officials

disagreed with our findings. Appendix B includes our comments on

issues that Town officials raised in their response letter.

The Board has the responsibility to initiate corrective action. A

written corrective action plan (CAP) that addresses the findings andrecommendations in this report should be prepared and forwarded

to our office within 90 days, pursuant to Section 35 of the General

Municipal Law. For more information on preparing and filing your

CAP, please refer to our brochure, Responding to an OSC Audit

Report, which you received with the draft audit report. We encourage

the Board to make this plan available for public review in the Clerks

office.


9/62


Board Oversight

The Board has a fiduciary responsibility for Town assets and finances,

and an obligation to serve the community, protect taxpayers

interests, and exercise good faith and due diligence. The Board, along

with Town officials, is responsible for managing and overseeingthe Towns overall fiscal affairs and safeguarding its resources.

This responsibility includes establishing a sound internal control

environment.

An important component of any system of internal controls is the

control environment or the tone at the top. The control environment

is the foundation of a good internal control system, providing

discipline and structure upon which the other components are

based. It reflects managements attitude about internal controls and

includes the integrity, ethical values, and competence of the entityspersonnel, and managements philosophy and operating style. When

this foundation is not strong or the control environment is not positive,

the overall system of internal controls will not be as effective as it

should be. The Board and Town officials must act with the highest

ethical standards and carry out their oversight responsibilities in

conformance with applicable laws, rules and guidelines that they

expect their employees to follow. The Board and Town officials must

be leaders in diligently protecting Town resources that are entrusted

to them.

As the legislative body, the Board should establish and oversee muchof the policy, financial, and ethical framework within which the Town

operates. Through its actions and policies, the Board should chart

the course for the Towns activities. The Board is responsible for

monitoring the results of operations. Local governments routinely

participate in construction projects that span several years and cost

millions of dollars. It is important that the Board monitor the status of

these substantial projects. The most common disclosures are project-

based financial statements providing selected details of each project,

such as total cost-to-date compared to budget or authorization.

The Board has not exercised effective oversight of the Town. The

Board neither established policies nor oversaw the Towns financial

operations. Board members told us that they received no financial

reports, such as detailed project cost reports for Town projects

(including the baseball stadium discussed in the next section),

budget versus actual reports, and generally did not receive or review

contracts. The Board made its decisions based upon representations

from the Town Attorney and Supervisor. Additionally, although Board


10/62


Recommendations

members should ensure they receive all necessary information, for

the most part, they have not requested the information or ensured that

they received requested information. In fact, Board members told us

that they did not know how much the baseball stadium would cost the

taxpayers or how it would be paid for. Without proper information,

there is a risk that inappropriate decisions may be made which could

result in further costs to taxpayers.

1. The Board should establish and maintain a control environment

that fosters a commitment to compliance with relevant laws and

Town policies. The Board also should routinely monitor the

implementation and effectiveness of the internal control system.

2. The Board should ensure that financial decisions are based upon

competent information.

3. The Board should require the Supervisor to provide project-based

cost reports.


11/62


Baseball Stadium Capital Project

Stadium Financing

Capital projects are usually long-term projects which require

relatively large sums of money to acquire, develop, improve, or

maintain. The Board is responsible for oversight and management of

the Towns capital projects, including establishing internal controls tohelp ensure that capital projects are properly and adequately planned

and managed. Effective controls help ensure that projects are

properly planned, funding is authorized, and project costs are kept

within their approved budget.

Local Development Corporations (LDCs) are private, not-for-profit

corporations often created by, or for the benefit of, local governments

for economic development or other public purposes. Although created

by, or for the benefit of a local government, an LDC is a separate

private corporation, distinct from the local government, having itsown set of powers under the governing statutes. In exercising these

powers, LDCs generally are not subject to the same requirements

and procedures as local governments with respect to borrowing,

procurements and certain other matters that relate to implementing

a capital project. These requirements and procedures applicable to

local governments are intended for the protection of taxpayers.

In September 2008, the Board formed the Ramapo Local

Development Corporation (RLDC). According to the RLDCs

Certificate of Incorporation, the RLDCs mission and objective is to

"lessen the burdens of government by undertaking and promotingurban redevelopment initiatives in the Townthat will include

real estate acquisition, development and management, real estate

project finance, and other [permissible] community-based economic

development activities The Supervisor, who is a voting member

of the Board, serves as the President and a voting member of the

RLDC.

In June 2009, the Board purchased approximately 61 acres of property

located at Firemans Memorial Drive and Pomona Road for a cost

of $8.4 million for general municipal purposes. Subsequent to the

purchase, the Board decided to build a baseball stadium, as part of an

urban renewal plan, which would serve as the home field for a minor

league baseball team with approximate seating capacity of 3,500 and

parking for 900 vehicles. In February 2010, the Board entered into an

agreement with the RLDC to assist the Town with the development

of the baseball stadium.


12/62


2 The cost shown above represents unaudited amounts as of June 8, 2011, and is not

the total cost, as the project was ongoing as of this date.

Board members indicated that they believed that the RLDC could

build the stadium at a lesser cost because the RLDC does not have

to comply with the Wicks Law. The Wicks Law generally requires

multiple prime contracts for public works projects for the construction

of buildings. When the Wicks Law applies, municipalities must

award separate prime contracts for three major components of the

work: electrical, plumbing, and HVAC (heating, ventilating and air

conditioning). One or more contracts generally are awarded to general

contractors for the remainder of the project scope. Furthermore,

General Municipal Law (GML) requires that local governments

competitively bid contracts for public work that involve expenditures

in excess of $35,000. By using the RLDC to construct the stadium,

the Board, in effect, circumvented the procurement laws that would

have applied if the Town directly pursued the project.

In May 2010, the Board, by resolution, agreed to guarantee $16.5

million in financing to be obtained by the RLDC. Generally, with

several exceptions, the States Constitution (article VIII, 1) prohibitsa town from loaning its credit (e.g., guaranteeing loans) to or in aid of

any public or private corporation or association.

Town taxpayers filed a petition for a special election on the

resolution. The petition sought to directly protest the Boards

resolution which authorized and agreed to provide a financial

guarantee of the financing to be obtained by the RLDC for the

development of the baseball stadium. In August 2010, the Boards

resolution was defeated, with 71 percent of the votes cast against it.

According to published reports, the Supervisor subsequently stated

that the stadium would be built with private and not taxpayer funding.

Following the vote, the Board continued to expend Town funds on

improvements to the property. In November 2010, with knowledge

that the RLDC was unable to obtain or generate the necessary

funds to complete the project, the Board, by resolution, transferred

the property to the RLDC. Although the Town transferred the

property, it retained responsibility to pay for the $8.4 million in debt

associated with the original purchase of the property and subsequent

improvements, which are estimated to be an additional $27 million.

As a result of this decision, Town taxpayers have liability, or potentialliability, for as much as $35.4 million2 in costs associated with a

property the Town no longer owns.

In February 2011, the Board passed a resolution agreeing to serve as

guarantor of $25 million in short term obligations to be issued


13/62


3 We understand that several issues related to the stadiums financing remain in

litigation. Therefore, we have not made findings on underlying legal issues relating

to the financing. Nonetheless, we find that the transaction raises significant legal

issues, including: 1) The New York State (NYS) Constitution generally prohibits

towns from loaning their credit (e.g., guaranteeing loans) to or in aid of any

private or public corporation or association; 2) A local government may not submita proposition to referendum, even upon petition of the voters, unless expressly

authorized or required by statute. It is not clear under what statute the resolution

was made subject to permissive referendum; 3) The NYS Constitution prohibits

towns from making gifts or loans of property to or in aid of private entities.

Although characterized by the Town and the RLDC as a Purchase and Sale, the

Town received no cash consideration for transfer of property. The purchase price

under the transfer agreement was stated as RLDCs development and construction

of the Projectand the resulting community benefits to be derived therefrom It

is unclear whether the purchase and sale is for adequate consideration so as not to

constitute an unconstitutional gift by the Town.

by the RLDC with a maturity date not to exceed five years.

Taxpayers had previously indicated that they were opposed to the

guarantee of 30-year bonds; in an apparent attempt to avoid the

voters opposition and guarantee the RLDC bonds, bonds with five-

year terms were agreed upon. Under the guarantee, the Town has

agreed to be obligated to pay the principal and interest payments

directly, with reimbursement from the RLDC. The Town agreed

to a risky guarantee whereby revenues were pledged to pay these

liabilities before any other Town payments were made. This could

affect payments such as salaries and could impact essential services

provided by the Town. Further, this may give RLDC bondholders a

prior right to be paid over those holding obligations issued directly

by the Town.3

The Town does not have a written agreement with the RLDC

outlining how the RLDC will reimburse the Town for the principal

and interest on the $25 million bonds that the Town is obligated

to pay. To demonstrate the RLDCs ability to reimburse the Town,the bond prospectus indicates that the RLDC is relying on revenues

that will be generated from the sale of affordable housing units

to reimburse the Town for the principal and interest payments.

However, the RLDC obtained loans of approximately $29.9 million

that were guaranteed by the Town to build the affordable housing

units. These loans must be repaid before any revenues generated

from the sale of the units are made available to reimburse the Town

for payments related to the $25 million bonds. Further, due to the

economic downturn in the housing market, the sale of the housing

units may not occur within the anticipated timeframe and estimated

sales revenues may not be realized by the RLDC. As a result, theRLDC may be unable to reimburse the Town for the principal and

interest payments made on the $25 million bonds.


14/62


Feasibility Analysis

4 Capacity is the total amount of seating available; therefore, the cost per capacity

represents the amount of money it costs per seat. It is calculated by taking the total

cost to build and dividing it by the number of seats.

While there is no written agreement, the RLDC has committed to

provide the revenues generated from the sale of affordable housing

units to reimburse the Town for the principal and interest payments

on the short term obligations issued in connection with the baseball

stadium. These excess funds could have been used to fund other

RLDC initiatives. This commitment will significantly impact the

ability of the RLDC to further its mission and achieve its stated goals

of lessening the burdens of government by undertaking and promoting

urban redevelopment initiatives in the Town.

As a result of the decisions the Board made, Town taxpayers are

now potentially responsible for approximately $35.4 million in

expenditures for a property not owned by the Town. Furthermore, the

Town has agreed to guarantee an additional $25 million in short-term,

five-year bonds issued by the RLDC, after taxpayers had previously

voted against a resolution that guaranteed financing of 30-year bonds

that were to be issued by the RLDC.

When implementing a capital project, Board members should ensure

that there is a well-defined plan, which evaluates the cost of a project

and the potential costs to taxpayers.

In an effort to determine the feasibility of the baseball stadium, the

RLDC contracted with an outside vendor to perform a feasibility

analysis. We reviewed this analysis and found that it was inadequate.

We found that the consultant only considered the costs of the structure

to be built; it did not consider the total cost of the project. Specifically,

we found the following:

The consultant did not incorporate the cost of the land or necessary

property improvements to erect the structure.

The consultant chose facilities that were built in 2002 and prior,

which resulted in a cost per capacity4 of $3,581.

We found projects from 2005 to 2010 with cost per capacity

ranging from $3,900 to $6,788.

Thefi

gures used within the report were not consistent from onesection to the next, and figures such as cost per capacity could not

be recomputed based upon the information provided.


15/62


Recommendations

5 This includes $25 million in principal and $2.5 million in interest.

The consultants report also included revenue estimates from the

operation of the baseball stadium. The consultant estimated that the

baseball stadium would generate approximately $1.2 million in its

first year of operation that would be available to pay debt service.

The consultant projected this amount would increase gradually to

approximately $1.7 million in year 10.

The consultant concluded that $20 million for vertical construction

was the maximum amount that could be supported by the projected

revenues. In making this assumption, the consultant anticipated that

the RLDC would issue 32-year bonds to finance the project.

Further, only one of the four Board members stated that he received

and reviewed the report; the remaining members did not receive the

report at all. The Supervisor, who is also the President of the RLDC,

relied upon this analysis to support his decision to construct and

operate a baseball stadium. The analysis did not contain sufficient

information to substantiate the decision to build the baseball stadium.

When the RLDC was unable to obtain financing consistent with the

terms used in the consultants feasibility analysis, the Board chose

to move forward with the $25 million bonds described above. The

feasibility analysis was not updated to reflect the change in financing.

The Town will pay approximately $27.5 million5 in principal and

interest payments for these bonds over the next five years. This is

significantly more than the approximately $7 million the consultant

determined the baseball stadium would generate in revenues available

for debt service during the same time frame. Therefore, it appears

that the RLDC has placed more financial burden on the Town andtaxpayers via these financial transactions, and the Board moved

forward with the project, whose feasibility is questionable.

4. The Board should not use the RLDC to, in effect, circumvent

procurement and financing laws that would have applied if the

Town directly pursued a capital project.

5. The Board should perform feasibility analyses for future capital

projects to determine all costs that will be associated with them.

The Board should review these analyses prior to committing tocapital projects.


16/62


Financial Condition

Budget Estimates

A local governments financial condition reflects its ability to provide

and finance services on a continuing basis. A local government is

considered to have sound financial health when it can consistently

generate sufficient revenues to finance anticipated expenditures, andmaintain sufficient cash flow to pay bills and other obligations when

due, without relying on short-term borrowings. Conversely, local

governments in poor financial condition often experience recurring

unplanned operating deficits. Persistent unplanned operating deficits

are usually indicative of poor budgeting and can result in cash flow

problems and/or deficit fund balances. Cash flow problems often

result in the need to borrow monies to finance day-to-day operations.

The Town has experienced a series of unplanned operating deficits

in its general, town-outside village, and part-town highway fundsover the last several years. These deficits were caused by inaccurate

budget estimates and the Boards insufficient monitoring offinancial

operations throughout the year. The resulting decline in fund balances

has, in turn, caused the Town to experience cash flow problems. The

Town has addressed its need for cash in the short-term by using inter-

fund advances. However, the Board has not adequately monitored the

funds, which resulted in funds not being paid back prior to the end of

the fiscal year at a comparable interest rate. Unless these budgetary

and cash flow problems are addressed, future Town operations could

be adversely impacted.

Board members must ensure that there is an adequate process in place

to prepare, adopt and amend budgets based upon reasonably accurate

assessments of resources that can be used to fund appropriations.

When estimating budgeted revenues, the Board and Town officials

must have current and accurate information. They also should use

historical data, such as prior years actual results of operations, to

guide them in determining whether revenues and expenditures are

reasonable.

As illustrated in the table below, the Town has experienced revenue

shortfalls in the general fund during fiscal years 2009 and 2010.

While we found that actual expenditures were within budget, Town

officials overestimated revenues for the past two years.


17/62


Table 1: General Fund Revenue Shortfalls

Description 2009 2010

Budgeted Revenues $28,501,877 $32,394,657

Actual Revenue $27,999,302 $28,867,620

Revenue Above/

(Below) Budgeted

Revenue

($502,575) ($3,527,037)

Operating Deficits andFund Balance

In particular, Town officials adopted an unrealistic budget for 2010

that resulted in $3.5 million in revenue shortfalls. For example, Town

officials overestimated mortgage taxes by $1.4 million, overestimated

golf fees by $342,207 and overestimated sales of real property by

$586,000. Town officials continued to budget unrealistically when

adopting the 2011 budget. We reviewed the 76 budgeted revenue

lines in the general fund and found that 34 appeared unreasonable

based upon historical trend data. For example, the Town budgeted

for $510,000 in tennis revenue although it had only received actual

revenue of $18,000 in 2010. Town officials budgeted for $1,850,000

in golf fees although the Town received only $1,507,793 in 2010.

Further, Town officials continued to overestimate mortgage taxes; the

2011 budget includes $2,200,000 for this revenue even though 2010

actual revenue was $1,321,126. Estimating a 67 percent growth in

mortgage tax revenue is unrealistic.

Town officials indicated that they review historical data when

preparing the budget; however, they did not estimate revenues to

reasonably respond to a clear and obvious downward trend or adjust

estimates in accordance with the revenue shortfalls in prior years.In addition, we found no indication that the Board monitored actual

results compared to the budget during the year. Further, the Supervisor

could not provide any explanations for the budget estimates for

2011. Without realistic estimates, there is a risk that the Town will

experience further revenue shortfalls and therefore, operating deficits.

Budgets are meant to balance revenues and expenditures, so that

the local government is able to provide needed services with the

resources available. However, the reality is that budgets will rarely

work out precisely as planned, which can lead to operating deficits

if expenditures exceed revenues. An operating deficit can be plannedfor and financed by appropriating fund balance. An unplanned

operating deficit results from over-expending appropriations, not

receiving budgeted revenues, or a combination of the two. Although

operating deficits can be planned as a means of prudently using

excess accumulated fund balance to finance operations, persistent

and recurring operating deficits are usually indicative of structurally

imbalanced budgets and financial stress.


18/62


Table 2: General Fund BalanceDescription 2008 2009 2010

Operating

Surplus/(Deficit)

$45,941 ($391,081) ($2,103,899)

Ending Fund

Balance

$4,501,665 $4,110,584 $2,006,685

Table 3: Town-Outside-Village Fund Balance

Description 2008 2009 2010

Operating

Surplus/(Deficit)

($109,385) ($503,027) ($107,606)

Ending Fund

Balance

$676,651 $173,624 $66,018

Fund balance is the difference between revenues and expenditures

accumulated over a period of time. The unreserved, unappropriated

amount is the portion of fund balance that can be used to manage

unexpected occurrences such as emergency repairs, cost and

demand fluctuations in commodities such as utilities and gasoline,

and unanticipated shortfalls in estimated revenues. Inadequate

unreserved, unappropriated fund balance limits Town officials

ability to manage emergencies and other unanticipated occurrences.

The Town incurred unplanned operating deficits in the general,

town-outside village, and part-town highway funds for the fiscal

year ending December 31, 2010. The deficits occurred because of

unrealistic revenue estimates and Town officials failure to monitor

and adjust the budget when it became clear that anticipated results

would not be achieved. A three-year history of the operating surplus

or deficit for each of the operating funds is shown in the tables below.

The general fund had operating deficits of $391,081 and $2,103,899

in 2009 and 2010. The deficits occurred because of the Boards

unrealistic budgeting practices, as previously discussed, which

created revenue shortfalls and decreased fund balance. As a result of

the operating deficits incurred, the fund balance has declined from$4.5 million to $2.0 million.

The town-outside-village funds operating deficits stemmed fromrevenue shortfalls caused by overestimating revenues. For example,

in 2010 Town officials had revenue shortfalls for building permits

totaling $240,807 and for for departmental income totaling $316,374.


19/62


Table 4: Part-Town Highway Fund Balance

Description 2008 2009 2010

Operating

Surplus/(Deficit)

($169,168) ($110,450) ($215,068)

Ending Fund

Balance

$371,553 $261,103 $46,035

Exceeding Appropriations

Table 5: Over-Expended Appropriations as of December 31, 2010

Fund Total AccountsTotal Over-

Expended

Percentage ofAccounts Over-

Expended

Dollar Amount

Over-Expended

General Fund 684 314 46% $3,716,581

Police Fund 116 58 50% $2,252,264

Town Outside Village 59 28 47% $102,529

Highway Town-Wide 34 21 62% $414,328

Highway Part Town 42 15 36% $332,145

Totals 935 436 47% $6,817,847

For the part-town highway fund, Town officials caused these deficits

by overestimating revenues and by over-expending budget line items.

For example, Town officials over-expended the salaries budget line

item by $223,305 in 2010. In addition, Town officials did not realize

revenue totaling $97,674 in the transportation services to other

government budget line item.

The Town has depleted its fund balances and has limited financial

cushions in the event of an emergency. Further, if the Town continues

to experience operating deficits, there is a risk that it may need

to borrow funds to finance the deficit and to finance day-to-dayoperations.

Formal budgetary accounting is a management control technique used

to assist in controlling expenditures. Budgetary accounting techniques

are important because the annual budget is a legal compliance standard

against which the Towns operations are evaluated. The law requires

the Town to maintain separate accounts for each appropriation. The

law does not permit the Town to overdraw an appropriation or use

a fund or appropriation to pay a claim chargeable to another fund

or appropriation. Town officials must obtain Board approval before

exceeding any appropriation. In fiscal year 2010, the Town over-

expended $6.8 million in individual accounts in the Town's five

major funds. While total expenditures were within the budget, many

individual account lines were exceeded, as shown below.


20/62


Inter-Fund Advances

These over-expenditures occurred for several reasons. First, the

finance software used by the Town has settings that would prohibit

the creation of requisitions if funds are unavailable; however,

these settings are currently disabled, which allows users to create

requisitions against funds that are not available. In addition, during

the purchasing process, when requisitions become formal purchase

orders, there is no control in place to identify requisitions that do not

have sufficient funds available. Further, Town officials do not provide

the Board with regular budget reports for monitoring purposes.

However, the Board does approve a year end budget transfer to

rectify the over-expenditures and, therefore, should be aware of the

issue. Without proper controls, there is a risk that the Towns already

declining financial position may worsen.

General Municipal Law (GML) allows municipalities to temporarily

advance monies from one fund to another (with certain restrictions).

Towns generally are not authorized to make budgetary transfers

between funds that have different tax bases. When Town officialsadvance monies between funds that have different tax bases, they

must repay the advance, with a comparable amount of interest, by the

end of the fiscal year in which the advance was made.

As a result of the Towns declining financial position, the Town has

depended on inter-fund advances from the other Town operating

funds to help finance operations. At fiscal years ended December 31,

2009 and December 31, 2010, the Town advanced approximately

$3.3 million and $3.9 million, respectively, between funds with

differing tax bases. Town officials did not pay back these funds prior

to the end of the fiscal year. Town officials were not aware that theadvanced funds were required to be paid back by the end of the fiscal

year.

Further, Town officials did not repay these interfund advances with a

comparable amount of interest. For example, in 2009, the police fund

loaned $3.3 million to the general fund. These funds were originally

invested in CDs earning 1.45 percent; if these funds had remained

in the CDs, they would have earned interest totaling $19,973. Town

officials only paid the police fund $2,730 in interest. Therefore, the

police fund lost $17,243 in interest because it was not paid back witha comparable rate of interest.

The Board is responsible for approving all inter-fund advances, and

must ensure that all temporary inter-fund advances are repaid by

fiscal year end with interest at a comparable rate to what the fund

would have earned if the monies had not been advanced. If repayment

does not occur at a comparable interest rate, taxpayer inequities will

occur.


21/62


Recommendations 6. The Supervisor should develop reasonable budget estimates.

7. The Board should monitor its budget continuously and make

necessary adjustments to avoid operating deficits and continued

decline in fund balance.

8. The Board should activate the control feature in the financial

system that prevents requisitions from being created without

proper funding.

9. The Board should ensure that funds advanced are paid back in a

timely manner and with a comparable rate of interest.


22/62


Information Technology

Breach Notification

Computerized data is a valuable resource that Town officials rely

on to make financial decisions. The Towns information technology

(IT) system is an essential part of operations used for accessing the

Internet, email communication, processing and storing data, andreporting to State and Federal agencies. If the IT system fails, or

the data is lost or altered, either intentionally or unintentionally, the

resulting problems could range from inconvenient to severe; even

small disruptions in electronic data systems can require extensive

effort to evaluate and repair. An effective system of internal controls

to safeguard computerized data includes policies and procedures that

address key aspects of computer use and data security, including

system security and the protection of data from loss due to threats or

accidents (disasters). The Board and Town officials are responsible for

establishing, designing, and implementing a comprehensive systemof internal controls over the Towns IT system and data to protect

these assets against the risk of loss, misuse, or improper disclosure

of sensitive data.

The Board has not established policies and procedures related to

breach notification, disaster recovery planning, and online banking.

We also found weaknesses in the Towns internal controls relating to

the auto complete function, deactivating terminated user accounts,

and limiting personal computer use. Further, the Board has not

provided Town employees with security awareness training. These

control weaknesses increase the risk that the Towns IT system andelectronic data may be susceptible to loss, unauthorized use, or

improper disclosure.

The law requires local governments to establish an information

breach notification policy. The policy should detail how employees

would notify residents whose personal, private or sensitive

information was, or is reasonably believed to have been, acquired

by a person without valid authorization. The disclosure should be

made in the most expedient time possible and without unreasonable

delay, consistent with the legitimate needs of law enforcement or any

measures necessary to determine the scope of the breach and restore

the reasonable integrity of the data system.

Town personnel in several departments collect social security

numbers, drivers license numbers and bank account information

for business purposes; however, the Town neither adopted a formal

breach notification policy, nor classified its data according to risk.


23/62


Disaster Recovery

Auto Complete Setting

The Director indicated that the she was unaware of the requirement

to establish a breach notification policy. Since we made the Director

aware, she has begun to identify what personal, private or sensitive

data is collected and stored by Town departments and is creating

a breach notification policy. Without a formal breach notification

policy, the Town may not be able to fulfill its legal obligation to

notify affected individuals in the event that sensitive information is

compromised.

Town officials are responsible for developing and documenting a

disaster recovery plan. A good disaster recovery plan addresses

a range of potential disruptions. These may include relatively

minor disruptions, such as temporary power failures, as well as

major disasters such as fire or natural disasters that would require

reestablishing operations at a remote location. If controls are

not adequate, even relatively minor disruptions can result in lost

or incorrectly processed data, which can cause financial losses,

expensive recovery efforts, and inaccurate or incomplete financialor management information. Further, the plan should set forth

procedures to ensure Town personnel can either maintain, or quickly

resume, mission-critical functions.

Town officials have not developed and documented a formal disaster

recovery plan. We discussed this issue with the Director, who has

begun to investigate several different approaches to protect the data.

When she determines the most cost-effective plan for the Town, she

will meet with the disaster preparedness committee. If the Town

experiences a major disruption, without a formal disaster recovery

plan, Town personnel have no guidelines or plan to follow to resumemission-critical functions.

The auto complete feature in Internet Explorer can save web

addresses, form data, and login information such as usernames and

passwords. Typically, web browsers and applications store the login

credentials if the auto complete option is enabled. Work stations store

the user names and passwords in locations that are easy to access.

A user name and password provides access to applications that are

solely for that users purpose; this information will be automatically

entered every time the employee visits the website. The employeesinformation also will be automatically entered for anyone else who

uses the employees computer and accesses the same web sites. When

a users name and password can be accessed, there is a risk that

someone other than the user who gains access to the work station can

comprise the login credentials in a matter of seconds.

The auto complete setting was enabled on the Towns online banking

computer. This setting automatically populated the user name and


24/62


User Accounts

password when the first letter of the users name and password was

entered. As a result, the Town is at risk that unauthorized users can

sign on, access banking information, and compromise financial data.

When we notified the Director, she immediately disabled the auto

complete feature.

Good internal controls include policies and procedures designed to

limit access to data. Town employees are assigned user accounts that

enable them to access the network. All changes to user accounts,

including additions, deletions, and modifications, should be

authorized and approved in writing by an appropriate Town official.

It also is important for user accounts to be deactivated as soon as

employees leave Town service.

The Town does not have written policies for deactivating user

accounts. The process used by the Town for terminating access to

the Towns network and financial system is inadequate. The Human

Resources Department does not formally notify the IT Departmentwhen an employee leaves Town service, so the IT Department must

contact Human Resources to confirm the employee has left. An IT

staff member must disable the account on the day the employee is

terminated. In addition, the Director indicated that, once a year, the

Department requests a list of all terminations for the year from

Human Resources and deactivates terminated employees from the

system.

We reviewed the list of 496 network user accounts on the Towns

active directory and 66 user accounts on the Towns financial

software to determine if employees who had left Town service werestill on the list of active users. We found three users on the active

directory and 12 users on the financial software whose accounts had

not been disabled after they left Town service. The duration of time

these employees have remained active on active directory was 30 to

827 days; one employee who left Town service 15 years ago was still

active on the financial software. In addition, we found that two users

out of 12 who had left Town service remained on the financial system

following the Departments year-end review. Therefore, the yearly

review was inadequate, and the Town did not have another procedure

in place to periodically evaluate the user accounts on the activedirectory or the financial system. When we informed the Director of

our findings, she immediately deactivated these users.

Failure to promptly remove the access rights of inactive employees

increases the risk that unauthorized users could inappropriately gain

access to a system and change, destroy, or manipulate confidential

and/or critical data.


25/62


Inappropriate ComputerUse

Information SecurityAwareness Training

To help protect the Towns computing environment, the Board

adopted an acceptable-use policy governing employees use of Town

computers. This policy restricts the use of the Towns computer

systems to business use only; personal use of the system is

prohibited. Generally, Town-owned resources, such as computers,

must be used primarily for Town purposes. However, as with the

use of a telephone, occasionally it may be necessary for Town

personnel to use computers, e-mail or an Internet connection during

the business day for personal matters. Sound business practice

requires Town personnel to keep the frequency and duration of such

occasional personal use to a minimum to avoid interfering with their

job performance.

The Town owns approximately 220 computers and has Internet

content filters on its network servers to block access to certain

websites. The Towns Internet content filtering software logs

information relating to users and the domains visited. We selected

domains that did not appear to be job-related, which included datingwebsites, porn websites and social media websites from the usage

report. We identified 161 computers that were used to access all or

most of these web sites. We selected six of the 161 computers with the

most activity for additional testing, and found that these computers

were used to access domains such as youtube.com, facebook.com,

ebay.com, match.com, hsn.com, turbo tax.com and craiglist.com

during work hours. Without proper monitoring and control over

Internet content filters, there is an increased risk that Internet usage

will be more than incidental or occasional.

Based upon our finding, in October 2010, the Director made changesto the Internet content filter to deny access to certain websites.

Further, we compared two dates in September 2010 to two dates in

November 2010 and found that the percentage of time that the six

computers tested spent accessing web sites decreased by 46 percent

as a result of the changes implemented by the Director.

Security Awareness Training is designed to educate users on the

appropriate use, protection and security of information, individual

user responsibilities, and ongoing maintenance necessary to protect

the confidentiality, integrity, and availability of information assets,

resources, and systems from unauthorized access, use, misuse,

disclosure, destruction, modification, or disruption.

The Board has not provided employees with information security

awareness training. We interviewed eight of the 13 employees using

online banking to determine if they have been provided with security

awareness training. All eight employees indicated that the Town had

not provided them with training. In addition, users were accessing


26/62


Banking Policy

Recommendations

the online banking with desktop shortcuts and were not cleaning out

their temporary Internet files or web browser cache after completing

an online banking session, which increases the risk of unauthorized

access. By failing to provide security awareness training, there is an

increased risk that employees will not understand their responsibilities

on how to appropriately protect the computer system. As a result, the

data and computer resources they have been entrusted with will be at

greater risk for unauthorized access, misuse or abuse.

Effective internal controls over online banking include policies

and procedures to properly monitor and control online banking

transactions. A comprehensive online banking policy clearly

describes the online banking activities the Town will engage in,

specifies which employees have the authority to process transactions,

establishes a detailed approval process to verify the accuracy and

legitimacy of transfer requests, and requires a monthly report of

all online banking transactions. It is important that someone

independent of the online banking process review this reportand reconcile it with the monthly bank statement to verify that all

transactions were properly approved and appropriate. The Town has

not adopted an online banking policy. Without proper controls over

online banking processes, Town funds will be at increased risk of

being stolen through cyber fraud activities.

10. The Board should develop and adopt a formal breach notification

policy.

11. The Board should implement a formal disaster recovery plan to

address the possible loss of data in the event of a disaster.

12. The Director of Automated Systems should ensure that the auto

complete setting is disabled on all computers.

13. The Board should establish formal policies and procedures for

the addition and deletion of user accounts.

14. The Director of Automated Systems should monitor Internet

usage for inappropriate content.

15. The Board should provide officers and employees with

information security awareness training.

16. The Board should adopt an online banking policy.


27/62


APPENDIX A

RESPONSE FROM TOWN OFFICIALS

The Town officials response to this audit can be found on the following pages.


28/62


See

Note 1

Page 5


29/62


See

Not

Pag

See

Not

Pag

See

Not

Pag


30/62


31/62



32/62


Se

No

Pa

Se

No

Pa

Se

NoPa

Se

No

Pa

Se

No

Pa


33/62


See

Note

Page

See

Note

Page

SeeNote

Page


34/62


Se

No

Pa

Se

No

Pa


35/62


See

Note

Page

See

Note

Page


36/62


Se

No

Pa

Se

No

Pa


37/62


See

Note

Page


38/62


Se

No

Pa

Se

No

Pa


39/62


See

Note

Page

See

Note

Page

See

Note

Page


40/62


Se

No

Pa

See

No

Pag


41/62


See

NotePage

See

Note

Page

See

Note

Page


42/62


Se

No

Pa

Se

No

Pa

Se

No

Pa

Se

No

Pa


43/62


See

Note

Page

See

Note

Page


44/62


Se

No

Pa

Se

NoPa


45/62


See

Note

Page


46/62


See

Note

Page

See

Note

Page


47/62


See

Note 3

Page 5

See

Note 3Page 5

See

Note 3

Page 5


48/62


See

Not

Pag

See

Not

Pag

See

Not

Pag


49/62


See

Note

Page


50/62


See

NotePage


51/62


APPENDIX B

OSC COMMENTS ON THE TOWN OFFICALS RESPONSE

In response to concerns raised and observations made about our audit in the Town officials letter, we

provide the following information.

Note 1

Our transmittal letter does not state that the report may be inaccurate or incomplete, as stated in

the Towns response. The transmittal letter states, If you believe anything in the preliminary draft

findings may be inaccurate or incomplete, please feel free to contact me. Further, in accordance with

our policy, the report was disseminated to only Town officials, not to the general public. The report

provides an accurate representation of the Towns financial transactions and condition; it does not

contain faulty conclusions and misrepresentations. Appendix C includes our audit methodology and

standards used in determining our audit findings.

Note 2

We removed from the objective to ensure compliance with taxpayer wishes, as a result of Judge

Linda S. Jamiesons September 22, 2011 decision. The remaining notes to the response provide

evidence that our audit results are accurate and properly summarize the findings cited in the report.

Note 3

The Towns response does not specifically address the Boards knowledge about the baseball stadium.

When we met with Board members, they indicated that they did not know how much the baseballstadium would cost the taxpayers or how it would be paid for. Further, Board members stated that

they did not receive the financial information, including contracts necessary to make sound decisions,

even when requested.

Note 4

Town Board Resolution 2010-149 states the Town has proposed the construction of a ballfield

known as Project Grand Slam. It further states that the RLDC will assist the Town of Ramapo in the

development of Project Grand Slam, indicating that this is clearly a Town project. Further, comments

in the audit report clearly represent statements made by Board members.

Note 5

By using the RLDC to construct the stadium, the Supervisor and Board, in effect, circumvented the

procurement laws that would have applied if the Town directly pursued the project. The report does

not address whether the RLDC acted in accordance with its own procurement policies.


52/62


Note 6

The paragraph does not imply that the Town manipulated the RLDC; it states that, by using the RLDC,

Town officials, in effect, circumvented the procurement laws that would have applied if the Town

directly pursued the project. Moreover, our reference to the Wicks Law was based on statements made

to us by Board members to the effect that the stadium could be built at a lower cost by the RLDC,

which did not have to comply with the Wicks Law. Also, while it is true that the separate specification

requirement of the Wicks Law does not apply to local governments that provide for a project labor

agreement in accordance with the requirements of Labor Law 222, other statutory procurement

requirements would still apply to the local government.

Note 7

Judge Jamiesons statement on the broad powers of LDCs relates to whether the purpose for which

the land was transferred to the RLDC fell within the powers of an LDC under the Not-For-Profit

Corporation Law. It did not relate to the propriety of the procurement process used to construct

the stadium. In fact, the court did not address any such procurement issue. Further, the paragraph

referenced in no way implies that the RLDC acted improperly, but rather is directed at actions of Townofficials.

Note 8

The reference to the State Constitution is merely a generic statement of the general prohibition against

loans of credit by towns. With respect to the exception for urban renewal projects, article 18, 2 of

the State Constitution does not provide a blanket exception for town loans of credit for urban renewal

purposes. Rather, it provides that the State Legislature may authorize towns to guarantee principal

and interest on indebtedness contracted by public corporations for urban renewal purposes. The

State Legislature has implemented this grant of authority by authorizing towns, subject to referendum

requirements, to guarantee loans of municipal urban renewal agencies established pursuant to article15-A of the General Municipal Law, which are public benefit corporations (General Municipal Law

503-a, 553, 559).

Note 9

Board members indicated that the Town Supervisor did not provide them with evidence that other

financing was available. The Town transferred the property in November 2010, after the taxpayers

voted down the proposal for a 30-year guarantee of the RLDC financing. Given that, in February

2011, the Board once again voted to guarantee the financing with a shortened, more risky term. This

action indicates that more favorable terms were not available, as stated.

Note 10

The statement in the report that Town taxpayers have liability or potential liability for as much as

$35.4 million in costs associated with property the Town no longer owns has nothing to do with

the $25 million of bonds issued by the RLDC and guaranteed by the Town. The $35.4 million is

comprised of the $8.4 million that the Town spent to acquire the stadium property plus the additional

$27 million of Town moneys that were spent to improve the property.


53/62


Note 11

The report states that Town taxpayers have a potential liability associated with property the Town does

not currently own, but we did not address whether Town taxpayers may receive a benefit from the

property transfer. Moreover, Judge Jamiesons decision did not address whether taxpayers, in fact,

are receiving tangible benefits from the stadium project. Rather, the context of her decision addressed

whether the project fell within the powers of an LDC under the Not-For-Profit Corporation Law, and

stated that providing for additional employment is one of things that the stadium project was intended

to do.

Note 12

The word guarantor is a direct quote from the Board resolution itself. The role of a guarantor typically

is to become liable only in the event of a default by the principal. To the extent the use of quotation

marks around the word guarantor could be construed to imply that the Town is the party principally

liable to bondholders, as we understand the Town Guaranty, the Town has agreed to pay debt service

in the first instance. The official bond statement specifies that the interest payment due September 15,

2011 will be paid with interest from the bond proceeds. Therefore, we question whether actual RLDCfunds were used to make the first payment as indicated. With no agreement between the Town and

RLDC outlining how the RLDC will reimburse the Town for the principal and interest payments it

will make on behalf of the RLDC, the short-term nature of the bonds, and questionable revenue stream

slated to make the payments, it seems to us that the Town effectively is principally liable.

Note 13

The report does not make findings on the underlying legal issues relating to the guarantee. However,

the Town has agreed to guarantee $25 million in short-term, five-year bonds issued by the RLDC. We

view this as an apparent attempt to avoid the voters opposition to the guaranteed financing of 30-year

bonds that were to be issued by the RLDC by reconfiguring the transaction as a five-year guarantee,which the Town believed was not subject to voter approval.

Note 14

The footnote merely sets forth several legal issues raised by the transaction. Judge Jamiesons April

4, 2011 and September 22, 2011 decisions addressed specific causes of action brought by petitioners

and, as we read these decisions, they did not address on the merits the issues raised in the footnote,

including whether there was underlying authority for the permissive referendum. In the context of a

post-audit, mentioning that these issues are raised by the transaction is appropriate.

Note 15

As shown in the table below, taken from the Official Statement for the RLDC Bonds (Appendix H,

Anticipated Redemption of the Bonds), none of the revenues from the housing project have been

pledged to the bonds. Further, as shown below, the payment of the $29.9 million in Town-guaranteed

debt will occur during 2012 and 2013. As illustrated, the Town-guaranteed debt is deducted from

revenues to arrive at the net amount available to reimburse the Town for the payments of principal and

interest. Further, the revenues illustrated are estimates and may not be realized as anticipated.


54/62


Note 16

The audit report represents an audit of the Town, not the RLDC. Therefore, there is no guarantee as

to whether the revenues anticipated will be realized. The Town had the opportunity during the audit

and accompanying this response to provide actual documentation of such sales, and failed to do so.

Note 17

The report is factual. If the funds were not being used to pay for the stadium, they would be available

for other RLDC initiatives. Therefore, the commitment of these funds to pay for principal and interest

payments on the bonds issued for the baseball stadium impacts the RLDCs ability to further its

mission. Further, the paragraph properly represents the results of the actions taken by Town officials.

Note 18

The report states that Town taxpayers are potentially responsible for approximately $35.4 million

in expenditures on the stadium property and that Town also guaranteed $25 million in bonds issued

by the RLDC. The $35.4 million is comprised of the $8.4 million that the Town spent to acquirethe stadium property plus an additional $27 million of Town moneys that were spent to improve the

property. By guaranteeing the RLDCs bonds, the Town is as least potentially liable for another

$25 million in stadium costs. Therefore, based just on these facts, Town taxpayers are responsible, or

potentially responsible, for a minimum of $60.4 million in connection with the stadium. Moreover,

whether the RLDC has the intent or the means to pay the debt service on its bonds relates to the

likelihood that the Town will have to honor its guarantee, not to the existence of the Towns

potential liability on those bonds.


55/62


Note 19

Only one of the four Board members stated that he received and reviewed the consultants report;

the remaining members did not receive the report at all. Further, Town officials did not provide us

with any evidence, such as plans, analysis or other documentation that further review or analysis was

performed.

Note 20

As stated in the Official Statement on the RLDC bonds, none of the revenues from the housing

project have been pledged to the bonds. In addition, there is no agreement between the Town and

RLDC outlining how the RLDC will reimburse the Town. Further, revenues may not be realized as

anticipated. Appendix H of the Official Statement, which sets forth the anticipated redemption of the

bonds, expressly states that [t]here is no assurance that the schedule of Anticipated Redemption will

occur as expected and, in fact, shows a shortfall in RLDC revenues to reimburse the Town for 2016.

Therefore, it does appear that the RLDC has placed a financial burden or, at the very least, a potential

financial burden, on the Town and taxpayers, greater than that initially envisioned in the feasibility

study.

Note 21

As stated in the report, the Town has experienced a series of unplanned operating deficits in its

general, town-outside-village, and part-town highway funds over the last several years. An operating

deficit results when expenditures exceed revenues during the fiscal year, and is different than a fund

balance deficit. Fund balance is the difference between revenues and expenditures accumulated over

a period of time. When an operating deficit exceeds available fund balance, a fund balance deficit

occurs. Further, inter-fund transfers were not repaid at a comparable interest rate. For example, as

stated in the report, in 2009, the police fund lost $17,243 in interest because it was not paid back with

a comparable rate of interest for its inter-fund transfer to the general fund.

Note 22

The Towns required pension contributions are a factor of the national economic recession and

individual Town decisions, such as salary levels, staffing levels, and specific pension options it has

chosen.

Note 23

The 2010 amounts referred to in the draft report were based on unaudited amounts obtained from the

Towns financial system. These amounts represented the most current information available to us andTown officials at the time of our fieldwork, and were the information that Town officials had available

to them upon which they based decisions. The independent audit of the Town'sfinancial statements for

the year ended December 31, 2010 referred to in the Town's response were not received by the Town

until after we had completed our fieldwork. Town officials subsequently provided us with the audited

financial statements that they referred to in their response. The financial statements report that the

Town depleted its fund balance in 2010, resulting in a net change of ($15,544,380) in fund balance.

We reviewed the statements and included the audited numbers in the final report. Following is our

response to the Towns comments:


56/62


Town Comments 2 and 3 in the Financial Condition Section:

The audited financial statements (page 60) report a shortfall of $3,527,037, not $1,226,687. We

changed the report to reflect the audited numbers.

Town Comment 3 in the Financial Condition Section:The draft report indicated that $1.85 million was budgeted for golf revenues and only $1.5 million was

received. We revised the report to reflect the difference of $342,207.

The audited financial statements indicate a sale of real property of $314,000; therefore, we changed the

$900,000 reported in the draft report to $586,000.

Town Comment 5 in the Financial Condition Section:The Town incurred operating deficits in these three funds. Page 19 of the audited financial statements

reports that the general and town-outside village funds had operating deficits in 2010, and page 73

reports the part-town highway fund had a deficit. Prior year fund balance was applied to render

positive fund balance in these funds in 2010. We deleted the statement that these funds now have

deficit fund balances from the report.

Town Comments 6 and 7 in the Financial Condition Section:Page 60 of the audited financial statements reports revenues, not fund balance. Page 16 of thefinancial

statements reports a negative change in fund balance of $2,103,899. Therefore, the fund balance was

reduced from over $4 million to $2 million in 2010. The report is changed to reflect the $2 million

fund balance amount.

Town Comment 8 in the Financial Condition Section:Page 19 of the audited financial statements reports a deficit of $107,606, not a surplus. The deficit of

$107,606 was applied to the $173,624 fund balance. Therefore, the fund balance was reduced to only

$66,018 in 2010. These numbers are incorporated into the report.

Town Comment 9 in the Financial Condition Section:We revised the building permit figures in the final report to reflect the figures reported in the audited

financial statements. We also deleted our discussion of the sales tax figures from the final report.

However, while the audited financial statements report that the sales tax figures exceeded the budget,

the Town had a revenue shortfall for departmental revenue totaling $316,374. We included this

departmental revenue shortfall in the final report.

Town Comment 10 in the Financial Condition Section:Page 73 of the audited financial statements reports a net negative change in fund balance of $215,068,

not $251,068. Therefore, the fund balance was decreased from $261,103 in 2009 to only $46,035 in2010. We revised the report to reflect these numbers.

Town Comment 12 in the Financial Condition Section:The Town has depleted its fund balance, as illustrated in the audited financial statement. The word

negative is removed from the report.


57/62


Note 24

We emailed the Supervisor on April 19, 2011 and requested that he provide explanations for the

2011 budget estimates in question. Neither the Supervisor nor the Finance Department provided any

explanations.

Note 25

The numbers in the report were not changed, as this number was not supported by the audited financial

statements. In addition, the $97,674 in revenue that was not realized is listed in the Towns financial

system as account 2221003, transportation services to other governments, specifically the Village of

Monsey.

Note 26

The significance of the budget lines being over budget is that the law does not permit the Town to

overdraw an appropriation or use a fund or appropriation to pay a claim chargeable to another fund

or appropriation. Town officials must obtain Board approval before exceeding any appropriation.

This demonstrates the Supervisors failure to obtain Board approval prior to overspending individualbudget appropriations.

Note 27

There is no effective review process in place, as depicted in the report. In addition, the fact that

the Town over-expended $6.8 million in 935 individual accounts in the Town's five major funds

demonstrates a lack of controls over the Towns finances.

Note 28

When Town officials advance monies between funds that have different tax bases, they must repay theadvance, with a comparable amount of interest, by the end of the fiscal year in which the advance was

made. Repayments of advances were made in February of the following year, which is not within the

fiscal year the advances were made. With regard to the interest, the funds were taken from a CD to be

made available for use by the other funds; therefore, the advancing fund should have been repaid with

the rate of interest of the CD.

Note 29

Town officials did not comply with the law and pay back the funds prior to the end of the fiscal year

with a comparable amount of interest.

Note 30

Town officials have not developed and documented a formal disaster recovery plan pertaining to

information technology. The plan mentioned in the Towns response does not address information

technology.


58/62


Note 31

During the audit, we observed that the room where the designated computer was located was left open

and unlocked. Further, while observing the wire transfers being performed, we observed that the

online banking password automatically populated; therefore, there is a risk that unauthorized users can

sign on, access banking information and compromise financial data.

Note 32

The Town does not have written policies for deactivating user accounts, and the process used by

the Town for terminating access is inadequate, as evidenced by the excessive number of active user

accounts left remaining after Town officials year-end review. Further, failure to promptly remove the

access rights of inactive employees increases the risk that unauthorized users could inappropriately

gain access to a system and change, destroy, or manipulate confidential and/or critical data.

Note 33

During the audit, we obtained the Towns user activity report, which listed all the websites visited byTown employees. We advised Town officials of inappropriate computer use by Town employees and

recommended that the web content filter be further restricted. After Town officials implemented our

recommendation, we found a decrease in the employees visits to these sites. We acknowledge that web

filters can exaggerate time spent on sites; therefore, we did not report the total time spent visiting these

sites. In addition, the pornographic sites visited were not limited to Town police; Town employees also

visited these sites.

Note 34

Town employees were not provided security awareness training; therefore, the data and computer

resources they have been entrusted with will be at greater risk for unauthorized access, misuse orabuse.

Note 35

The Town should adopt policies and procedures to guide staff in areas of operations (such as online

banking) where there is high inherent risk of fraud, waste or abuse, or where staff would benefit from

specific guidance to perform their duties. This helps to ensure that public funds are used prudently and

in the best interest of the taxpayers.


59/62


APPENDIX C

AUDIT METHODOLOGY AND STANDARDS

Our overall goal was to assess the adequacy of the internal controls put in place by officials to

safeguard Town assets and monitor financial activities. To accomplish this, we performed an initial

assessment of the internal controls so that we could design our audit to focus on those areas most at

risk.

During the initial assessment, we interviewed Town officials, performed limited tests of transactions,

and reviewed pertinent documents such as Town policies, Board minutes, and financial records and

reports. After reviewing the information gathered during our initial risk assessment, we determined

where weaknesses existed, and evaluated those weaknesses for the risk of potential fraud, theft and/or

professional misconduct. We focused our audit testing on those areas most at risk, which included the

ball stadium, financial condition and information technology.

To accomplish our audit objective and obtain relevant audit evidence, our procedures included thefollowing:

We reviewed Board minut

Documents

Audit on town of Ramapo