c > u ^s r

R ///

10 Empire State Blvd Castleton, New York 12033 June 15. 2011 Board of Education Kingston City School District 61 Crown Street Kingston, New York 12401 We have completed the annual testing of controls for the Kingston City School District. One of the requirements of the 2005 School Financial Oversight and Accountability legislation is ongoing testing and evaluation of the district's internal controls. Our engagement was designed to evaluate the adequacy of internal controls over Security Vendor Payments to ensure they are appropriately designed and operating effectively and efficiently. And, to provide a report with recommended changes for strengthening controls and reducing identified risks. The purpose of the audit was to review the internal controls that the district has in place to prevent errors, detect fraud and ensure that financial reporting is accurate and that the district assets are safeguarded. RELIABILITY OF INFORMATION In performing our engagement, we obtained a sample from the population of transactions to test the accuracy and reliability of information provided by district personnel. As noted, the purpose of our engagement was to assist you in improving the process by which you monitor and manage the risks that face the district. Any findings and recommendations in the attached report are the responsibility of the district to implement, accept the risk as identified, or implement alternative controls that will mitigate the risk to a level that is acceptable by the district. Ultimately, it is your responsibility to assess the adequacy of your risk management system. DISTRIBUTION OF THE REPORT This report Is intended solely for the information and use of the Board of Education and management of the Kingston City School District and should not be used for any other purpose. Sincerely,
. /

Joseph Heroux, Internal Auditor Questar III

REPORT TO THE AUDIT COMMITTEE

ENTITY NAME REPORT DATE PROCESS REVIEWED PERSONNEL INTERVIEWED SCOPE OF AUDIT

Kingston City School District June 15, 2011 Security Vendor Payments Gary Tomczyk, Sr.

The audit tested payments to security vendors from January 1, 2007 through February 15, 2011. We selected a sample of vendors from a population of 39 vendors. The sample consisted solely of individuals paid as independent security vendors. These vendors consist of off-duty police officers, retired police officers and other non-district personnel. The individuals selected for testing were as follows: * * * * > None Thomas Barringer Michael Benjamin Kyle Berardi John Bonse Timothy Bowers James Brodhead Tyrone Brodhead Anthony Cruise Michael Delgaizo John Dickson < * * * * Barry Dunn Robert Farrell James Fischang Aaron Fitzgerald Roderick Gray Junlous Harris Robert Henry Erinn Knox Timothy Matthews

SCOPE RESTRICTIONS OBJECTIVES

Evaluate the internal controls the district has developed for the payment of security vendors to ensure they are operating effectively and efficiently; Determine that payments have been properly reviewed and authorized for payment; Ensure that vendors are paid in accordance with applicable contract agreements; and Determine that security vendors are properly categorized as an independent contractor or employee in accordance with 1RS regulations. Sign in sheets are used to document each individuals hours worked and the location and/or event where the individual provided services; The sign in sheets are approved by the security supervisor who is also responsible for scheduling individuals to provide security; District personnel approve payments prior to disbursement; The district superintendent signs and approves the 1

KEY PROGRAM CONTROLS

OBSERVATIONS AND RECOMMENDATIONS

contracts with each individual security officer; and The district's claim auditor performs approves all claims for payment. 1. During our testing of payments to security vendors (excluding the security director), we noted the following with regards to the documentation supporting claims for payment: 51 instances where the claim form and/or the supporting timesheet were signed prior to the last day covered by the claim form or timesheet (I.e. a claim form covering the period ending December 31. 2010 is signed on December 24,2010); 22 instances where the claim form included hours for security provided at special events, including sporting events, that were not supported by signed timesheets; 29 instances where the sign-in sheets were missing; 45 instances where the sign-In sheets were not complete, i.e. the time-in or time-out was not completed; 24 Instances where the supporting documentation was not properly completed, i.e. claim form not dated, claim for in not signed, or sign-in sheet not signed; 15 instances where the hourly rate of pay did not agree with the contract signed by the superintendent; 11 instances in which the total hours paid did not agree with the time recorded on the sign-in sheets; 4 overpayments as a result of overlapping hours at different events; 1 instance where the location/event security was provided was not noted; 1 instance where an individual's name and signature was redacted and another individual's name and signature was provided; and 2. During our testing of payments to one individual we noted the following: Payment for 96 hours that were noted on the claim forms but not on the sign-in sheets; Several instances where the district appears to have been billed for both night security and athletic event security for the same time frame; Several instances where time paid for security at
2

special events and athletic events was not supported by sign-In sheets detailing the hours worked; Several instances where the sign-in sheets were missing or not properly completed; and Recommendation: To mitigate the risk of unauthorized payments or duplicate payments resulting from error or omission and to ensure that the district is paying for time actually worked in the district has begun implementing a corrective action plan that includes the following: An individual independent of the security department is now responsible for scheduling security personnel for duty. The district should ensure that this individual is aware of the security needs of the district, including security at special events and sporting events, and schedule personnel accordingly. Any deviations from the schedule should be approved in advance by this individual and should be supported by adequate documentation, i.e. overtime request and approval forms; Upon completion, the security schedule is provided to the building administrators for monitoring the attendance of security personnel. The building administrator should be responsible for approving the sign-in sheets of all security personnel. As part of this approval process, the building administrator should compare the sign-in sheets to the schedule and investigate any variances; Security personnel are required to complete a signin sheet detailing the dates, times and locations worked. The detail should not just state the total hours worked but the time-in and the time-out. Any absences should be supported by a request for leave time and approved by the applicable building administrator; Security provided at special events and sporting events is also documented using a sign-in sheet signed by the security personnel and approved by the appropriate building administrator; and Sign-in sheets are reviewed by an appropriate individual for duplicate entries or overlapping hours The district should also consider the following additional recommendations when implementing their final corrective action plan: If deemed employees (see discussion below), the rates of pay should be established in accordance 3

with the applicable bargaining unit or, if security personnel do not fall into a bargaining unit, the district should establish rates of pay and benefits and communicate this to each individual employee using a salary notice. When calculating the hourly rate of pay, the district should consider benefits that the security personnel previously classified as independent contractors were not entitled to receive; If, after review with the district's legal counsel, security personnel are deemed to be independent contractors, the district's claim auditor should review each claim for payment for the appropriate authorizations and approvals as well as each individuals contract to ensure that they are being paid at the correct rate for the period covered by the claim. Each claim form should be accompanied by signed and approved sign-in sheets; and The district should review the employment status of all security vendors to determine if they were or are also employed at another entity while billing the district for time they were scheduled to work but are not actually working at the district. As part of this review, the district should monitor the findings of any regulatory audits conducted of the City of Kingston as it relates to any vendors previously paid by the district. 3. Currently, the district classifies individuals providing security services to the district as independent contractors. Recommendation: The district should consult with legal counsel regarding the proper classification of individuals providing security services to the district. According to the 1RS, " you are not an independent contractor if you perform services that can be controlled by an employer (what will be done and how it will be done). This applies even if you are given freedom of action. What matters is that the employer has the legal right to control the details of how the sen/ices are performed. "
SUBMITTED BY: X

DATED:

Joseph F. Heroux, CPA Internal Auditor June 15,2011