A recently released preliminary audit of the Town of Lloyd that was done by the New York State Office of the State Comptroller [NYSOSC] reveals significant discrepancies in record keeping and procedural irregularities in the functioning of town government that the present administration, under Supervisor Paul Hansut, will have to fix to ensure the safe and secure handling of town records, the proper awarding of all contracts, timely payment, auditing and filing of vouchers and that strict banking procedures are followed.

The audit highlights numerous deficiencies and oversights that occurred during the previous town administration. A final report, which is in the process of being compiled, will elaborate in greater detail each the sections in the preliminary report that Hansut has recently received.

The audit pointed out irregularities in a Town bid process that led to the award of the 2010 Property and Casualty Insurance contract worth more than $100,000 to the firm of Marshall and Sterling, that was not the low bidder.

The audit states that “The lowest bidder was selected based on information on a comparison chart [of two company bids]. However, this was not the lowest bidder. One bidder was allowed to submit a revised proposal and the premium proposed for another was recorded as $6,000 higher than what was actually submitted.”

The comparison chart, with its side-by-side breakdown of bids from Marshall and Sterling and W. A. Smith Insurance, was compiled by Wendy Rosinski, secretary to former Supervisor Ray Costantino. Upon analysis Rosinski’s document was shown to contain more than a dozen omissions or errors that ultimately made it appear that Marshall and Sterling was the low bidder when in fact it was W. A. Smith. A town has the option of not choosing the lowest bidder, but they are required to state in writing the reasons why for the public record. That was not done in this case.

The matter was referred to the Town’s Ethics Board late last year. They highlighted the numerous failings in Rosinski’s comparison sheet but concluded that “The spreadsheet was not used by the Town Board in their decision making which makes the issue of the spreadsheet inaccuracies irrelevant.” The NYS audit disproves this claim and casts doubt on the veracity of the advice and information that was provided to the Ethics Board in their investigation of this matter.

In the area of Information Technology [IT] services, the audit reveals that the Town does not have a disaster recovery plan and has no intrusion detection system in place. User access is not monitored and no actions are taken in response to actual or attempted unauthorized or unusual access. In addition, there is no method in place to either grant or revoke access, nor is there written authorization that can add or modify user access to the system.

There are password issues that lack complexity requirements and changes that have not been enforced on any regular basis. In addition, accesses is not revoked upon a set number of failed log-in attempts or because there is no activity in a set time period, both common practices in the field today.

The audit states that the IT controls have not been audited or reviewed by other agencies, nor by a certified public accountant. There has also been no assessment of the risks associated with outsourcing the IT Services.

The audit states that the Town of Lloyd does not have a written IT contract that defines the role and responsibilities of the position. Instead, all that exists is a letter stating the rates to be charged and a 100-hour maintenance contract for small business computer consulting services, which has no details on what the work entails.

In addition, the Town has no remote access policy, nor a log of this kind of access that is maintained or reviewed. The Town also has no breach notification policy in place.

The audit revealed that the Town does not presently classify or identify sensitive data that is collected, transmitted or stored. In addition, a virus scan has not been performed since February of 2011 on one of six computers tested.

The server room at Town Hall has no protection from fire and water damage and backups are not stored off-site, but instead are stored in the safe in the town clerk’s office.

The audit identified that the Town has no formal policy or procedure in place concerning cash receipts and disbursements, except for electronic banking. There is also no pre-approval or phone confirmation needed by the bookkeeper before a transfer goes through. The audit pointed out that voided checks are not stored after a sample testing of 12 of 15 checks.

The audit stated there were typographical mistakes in the minutes of June and July 2010.

The audit also indicted that vouchers were in chronological order in the town clerk’s files but one voucher for $105.16 was missing. In addition, one check for $339.15 could not be traced to a canceled check.

In the area of claims auditing, the state noted that three payments of $4,724.02, $81.24 and $54, were not audited by the Town and that one for $1,597.50 did not have an audit date attached. A voucher for $15 that was paid to Highland Tent Rental was audited by the owner, Town Councilman Kevin Brennie and a voucher for $700 that was mathematically incorrect, resulting in an overpayment of $87.50.

The audit stated that the Town violated General Municipal Law 801 by purchasing more than $750 in a fiscal year [2010] from a council member’s business. The threshold was exceeded by $504.95 and a note has been attached to the voucher acknowledging the violation.

It was also found that the Town of Lloyd failed to have on file worker’s compensation forms for ten vendors selected and had no disability insurance forms for 13 vendors. The record also revealed that although the Town had worker’s compensation forms on file for five of the vendors, two were not the correct ones required under the law. In addition, two of the provided disability insurance forms were also not the correct forms under the Worker’s Compensation Law.

By MARK REYNOLDS
mreynolds@tcnewspapers.com