District officials did not maintain appropriate IT asset inventory records or establish adequate IT controls over network user accounts.

The Board did not ensure that goods and services were procured in accordance with the procurement policy and that all claims were approved prior to payment.

District officials did not properly account for leave accruals for 22 of the 49 employees' accrual records that we tested. The District may incur $47,817 in additional payroll costs if the errors are not corrected.

District officials did not submit SSBA allocation claims totaling $1.35 million, related to eligible technology purchases made during fiscal years 2019-20, 2020-21 and 2021-22.

A Town official had a prohibited interest in Town contracts.

District officials did not establish adequate controls over network user accounts. As a result, the District has an increased risk of unauthorized access to and use of its network and potential loss of important data. In addition to finding sensitive information technology (IT) control weaknesses that were confidentially communicated to officials.

The Board and District officials did not ensure goods and services were procured in accordance with applicable statutes and/or District policy and did not ensure claims were properly audited and approved prior to payment.

Two Town officials had prohibited interests in Town contracts.

Although overtime was properly approved, District officials did not monitor overtime to ensure it was accurate. Had officials established adequate controls, the District's overtime costs may have been reduced by at least $167,000. As a result, officials are paying more for overtime than necessary.

The Board did not always seek competition when procuring goods and services or ensure all claims were properly audited and approved. When goods and services are not competitively procured, they may not be procured in a cost-effective manner. Also, when claims are not properly audited, the Board's ability to effectively monitor the Town's financial operations is diminished.

The Clerk did not record, deposit, remit or report collections in a timely and accurate manner. As a result, the Board's ability to effectively monitor financial operations was diminished. Had the Board conducted the required annual audits, it may have recognized these deficiencies and taken corrective action.

District officials did not ensure network user accounts were needed, and they did not adopt an adequate IT contingency plan. In addition to sensitive IT control weaknesses that we communicated confidentially to officials.

The Company Board did not ensure compliance with contracts or enforce the lease agreement's terms and conditions. As a result, there is an increased risk that funds could be subject to loss, theft or misappropriation.

Town officials did not adequately safeguard and account for Department assets.

The Board was not properly auditing claims prior to approving them for payment. As a result, the risk is increased that claims could have been paid for inappropriate purposes.

Town officials did not establish long-term capital and financial plans to address the Town's Highway Department equipment needs.

County officials did not adequately protect the Department's electronic data containing PPSI. In addition to sensitive information technology (IT) control weaknesses communicated confidentially to officials.

The Board did not ensure that claims were adequately supported, for appropriate Village purposes and audited before payment.

In 2017, OSC issued an audit report that included findings that the Town's accounting records and reports were incomplete, inaccurate and could not be relied on to make financial decisions. The Supervisor has continued to not maintain the Town's accounting records and reports in a complete, accurate, up-to-date or timely manner. Without reliable accounting records, the Board cannot make sound financial decisions.

District officials did not establish adequate controls over network user accounts and did not develop a written IT contingency plan. As a result, the District had additional entry points for attackers to access and view personal, private and sensitive information on the network and did not have sufficient documented guidance or plans to follow to resume essential operations if an unexpected IT incident occurred. In addition to finding sensitive IT control weaknesses that were confidentially communicated to officials.