Bureau of Audit

Download Full Report (pdf 630kb)  

February 27, 2009

Mayor Bloomberg, Speaker Quinn, and Members of the City Council:

I am pleased to transmit the Charter-mandated report on the New York City Comptroller’s audit operations for Fiscal Year 2008. My audit bureaus issued 80 audits and special reports during the fiscal year that resulted in $16.5 million in actual revenues and savings, $33 million in potential revenues and savings, and called into question another $26.1 million associated with claims filed against the City. This annual report contains the significant findings and recommendations of the Comptroller’s audit activities during Fiscal Year 2008 and the follow-up actions the auditees identified in response to our audit recommendations.

The City Charter requires that audits conducted by the Comptroller’s Office be in accordance with generally accepted government auditing standards promulgated by the Comptroller General of the United States. These standards require that government auditing entities undergo an external peer review every three years. During my tenure as Comptroller, the audit bureaus have undergone two such reviews, the last having been completed in November 2007. It gives me pleasure to report that the Institute of Internal Auditors concluded in both reviews that the Comptroller’s Office complies with generally accepted government auditing standards. In addition, both reviews reported no findings and presented no recommendations for improvement. In fact, the most recent review expressly noted several areas for which the bureaus should be commended.

I took office during the aftermath of the 9/11 disaster and the recession that gripped our City. At that time the City budget faced annual deficits projected to average $5 billion. I entered office determined to be an activist Comptroller by aggressively using the powers of my office to find new, creative ways to save the taxpayer money and to put our resources to work for all New Yorkers. Given the City’s dire fiscal condition at that time, I instructed the staff of the audit bureaus to focus their efforts on examining programs with the greatest potential risk of revenue loss, cost overruns, mismanagement, inefficiency, waste, and abuse.

During Fiscal Years 2002 through 2008 the audit bureaus have achieved great success in following my mandate: they have identified millions of dollars in revenue and savings, and have documented many instances of program inefficiency and mismanagement. The 658 audits and special reports issued during those seven years have generated a total of $260.2 million in actual and potential revenues and savings, and have called into question $119.6 million associated with claims filed against the City.

The audits issued in Fiscal Year 2008 covered a wide range of subjects in program performance, asset management, internal controls, and information technology that involved revenue identification and collection, cost efficiency, and effectiveness. The most significant findings are highlighted below.

Revenue and Cost Savings

Brief descriptions of audits that generated the most actual and potential revenue and savings follow:

• An audit of the Department of Environmental Protection’s (DEP’s) billing and collecting of water and sewer charges from private hospitals determined there were significant internal control weaknesses in DEP’s collection practices that resulted in $10.6 million in outstanding charges. The auditors noted that DEP could not readily identify all hospital accounts, could not aggregate charges common to a single customer, and had no written collection policies and procedures for its staff to follow when billing and pursuing collections from hospitals. As a result of these weaknesses, DEP did not make timely and appropriate collection efforts. As of June 30, 2007, 32 of 58 private hospitals had outstanding charges totaling $12.6 million and had made payments totaling only $2 million by July 31, 2007.
  
• An audit of the United Nations Development Corporation (UNDC) lease agreement with the City disclosed that UNDC should remit to the City a total of $12 million in additional rent. UNDC was established to provide office and residential space and other facilities for United Nations personnel and foreign missions as well as for other members of the international community. The lease requires UNDC to pay three separate rents to the City. One is paid annually, whereas the other two are paid quarterly. The annual payment, termed additional rent, is calculated based on 90 percent of UNDC’s consolidated surplus. The audit found that UNDC owed the City $12 million in additional rent resulting from UNDC’s retention of its consolidated surplus in connection with the suspended UN Consolidation Building Project. After the auditors disclosed their findings to management of UNDC and the City, UNDC promptly paid the City $6 million of the total audit assessment.
  
  
• An audit of the Economic Development Corporation’s (EDC’s) management of the Brooklyn Army Terminal (BAT) concluded that EDC did not comply with certain lease stipulations by not collecting appropriate rents and fees from all of its sub-tenants. The auditors determined that this resulted in the loss of rental fees totaling at least $211,500. Also, EDC did not charge certain sub-tenants rents in accordance with market appraisals, again forgoing potential rental payments totaling almost $300,000. In addition, EDC did not itself pay the City for water and sewer use, nor did it charge sub-tenants for water and sewer use as part of their sub-leases. Furthermore, EDC did not maintain records to properly substantiate more than $37,000 in employee expenses. EDC’s certified financial statements for the year ended June 30, 2007, reported BAT had total operating revenues of $18,777,935, total operating expenses of $11,405,171, and operating income of $7,372,764. As a result of the audit, EDC was billed for water and sewer charges that were in arrears.
  
  
• An audit of the compliance of RCN Telecom Services of New York, Inc., (RCN) with its open video system and franchise agreements disclosed that RCN failed to report $26,431,624 in revenue to the City for the period January 1, 1999, to December 31, 2005. RCN therefore owes the City $1,784,594 in additional fees and interest, of which RCN paid the City $1,286,637. Specifically, RCN did not report to the City any of the revenue generated from its microwave-satellite operations, advertising sales commissions, resale services, and other revenue categories required to be reported to the City under its franchise agreements.
  
  
• An audit of the administration of the sales of surplus City-owned real estate by the Department of Citywide Administrative Services (DCAS) revealed certain inadequacies in the practices of selling surplus real estate properties. DCAS sells surplus properties, primarily vacant lots, at public auctions, thereby returning the properties to productive use and to the tax rolls. The audit determined that these poor practices weakened DCAS’s ability to sell surplus properties at its June 13, 2006 auction resulting in $6.5 million in forgone sales revenue. This is significant when considering DCAS listed 53 properties of which they sold 34 properties, or 36 percent, for a total of $15 million at that auction.
  
  
• An audit of the compliance of New York Skyports, Inc., (Skyports) with its lease agreement found that Skyports violated the terms of several major provisions of its lease and may owe the City approximately $6.1 million. Skyports’s lease permits it the use of property along the East River between East 18th Street and East 23rd Street in Manhattan for a marina, a seaplane base, parking, mooring, fueling, and the servicing of motor vehicles, seaplanes, and watercraft. It also permits the sale of merchandise usually sold in connection with those services. The Department of Small Business Services (DSBS) manages the property on the City’s behalf, and the EDC administers the terms of the agreement on behalf of DSBS.
  
  The auditors determined that the general disregard of Skyports for maintaining the premises endangered public safety and may cost the City in excess of $5.5 million of the $6.1 million the City expended to rectify conditions. The auditors also noted that Skyports owes the City $548,135 resulting from $464,000 for emergency repairs performed by EDC, a minimum of $46,614 for not paying 50 percent of the revenue derived from the sale of goods, merchandise, and advertising on the premises, and $37,521 in water and sewer charges. In addition, EDC did not effectively oversee the operation of the lessee to ensure that Skyports complied with the terms and conditions of the lease.

Service Delivery and Program Performance

Brief descriptions of audits that disclosed the most significant service-delivery and program-performance issues follow:

• An audit of the adherence of the Department of Education (DOE) and the Department of Health and Mental Hygiene (DOHMH) to student vision and hearing screening program regulations disclosed that the agencies did not provide the screenings in accordance with applicable regulations. Chancellor’s Regulation A-701 requires vision and hearing screenings to be conducted for students in pre-kindergarten through grade 3, in grades 5, 7, 10, and for new entrants. The Office of School Health (OSH) is a joint program consisting of DOE and DOHMH employees that provides health services to public school students, including vision and hearing screenings. Regardless of whether DOE or DOHMH conducts the screenings, DOE is ultimately responsible for the vision and hearing screening program and ensuring that all students are screened in compliance with Chancellor’s Regulation A-701.
  
  For the period reviewed, the agencies conducted only 66 percent of the required vision screenings, with 42 percent of the required DOE screenings conducted and 94 percent of the required DOHMH screenings conducted. The agencies conducted only 54 percent of the required hearing screenings, with 20 percent of the required DOE screenings conducted and 94 percent of the required DOHMH screenings conducted. The auditors concluded that the results were attributable to a lack of oversight and monitoring of the vision and hearing screening program by DOE, which had no central unit responsible for reviewing screening data during the audited period.
  
• An audit of the monitoring of the physical conditions of senior centers by the Department for the Aging (DFTA) found that DFTA’s monitoring needs to improve in the follow-up of identified problems and in the provision of assistance to the centers in correcting those problems. DFTA contracts with 329 senior citizen centers throughout the City to provide services to the elderly.
  
  Certain conditions at the centers noted by the auditors were also cited by DFTA in its own 2007 and its 2008 assessments. However, there was limited evidence that DFTA followed up on its findings or worked with senior citizen center officials to ensure that conditions were corrected. Some of these conditions still existed at the time the auditors visited the centers. There were fire and personal safety problems at many of those centers as well as improper conditions related to cleanliness and physical concerns in the bathrooms, kitchens, and throughout the centers.
  
  
• An audit of the Department of Sanitation’s (DSNY) Vacant Lot Clean-up Program reported that the program had inadequate internal controls over the way it identified vacant lots for cleaning, processed complaints and work orders, and managed the cleaning of the lots. Under the Vacant Lot Clean-up Program, DSNY’s Lot Cleaning Division (LCD) cuts weeds and removes debris and bulky items from City- and privately-owned vacant lots throughout the City. For Fiscal Year 2007, DSNY reported that it cleaned 6,191 vacant lots. Of these, 4,941 were City-owned and 1,250 were privately-owned.
  
  In terms of identifying lots for cleaning and managing cleaning operations, the audit found there was a lack of segregation of duties and a lack of proper supervision. Field supervisors had near-total control in determining whether a lot was clean or dirty and, if dirty, the resources to be used to clean it. The auditors concluded that as a result, LCD resources appeared to have been used inefficiently. In addition, the inadequate internal controls increased the possibility that LCD resources could have been used for purposes contrary to their intended use. Regarding LCD’s processing of complaints and work orders for vacant lots, the review found 1,800 cases that had been opened prior to July 1, 2007, and were still open as of November 2, 2007. These cases had been open for an average of more than three years.
  
  
• An audit of DOE’s reporting of violent, disruptive, and other incidents at New York City public high schools found that DOE did not have effective controls to ensure that incidents were reported in accordance with the requirements of State Education Department (SED). All school districts, including New York City, are required to report annually to SED violent and disruptive incidents, as defined by SED, that occur in their schools. SED then posts the data on its Web site in its annual “Violent and Disruptive Incident Report” (VADIR). DOE developed and implemented a computer system, the On-line Occurrence Reporting System (OORS), to record incidents reported by the schools. DOE reports to SED only those incidents that are recorded in OORS.
  
  For the 10 schools sampled by the auditors for the 2004-2005 school year, 414 (21%) of the 1,996 sampled incidents identified by the auditors were not entered in OORS. Of the 1,996 incidents, 1,247 (62%) were serious, and therefore were required by SED regulations to be included in VADIR. Of these serious incidents, 174 (14%) were not entered in OORS. The auditors concluded that without more effective central controls, DOE could not ensure that incidents were in fact entered in OORS by its schools. The ineffective controls also prevented DOE from ensuring that those incidents determined to be violent and disruptive were reported consistently among schools, so that DOE could report them in accordance with SED requirements.
  
• An audit of the effectiveness of DOE in following up and resolving school-bus-related complaints disclosed that DOE did not effectively record, follow up, resolve, and close school-bus-related complaints. DOE’s Office of Pupil Transportation (OPT) is responsible for ensuring that clean, safe, and reliable bus service is provided to and from school for students who are New York City residents. OPT maintains a Customer Service Unit (CSU) to address transportation concerns raised by callers and to assist in the resolution of complaints. A total of 376,257 school-age complaints were recorded during the period July 1, 2006, through January 15, 2008, and a total of 815 pre-k complaints were recorded during the period July 1, 2007, through January 15, 2008.
  
  The auditors concluded that there was limited assurance that complaints brought to the attention of DOE regarding unreliable and or unsafe transportation of children were properly identified, determined to be valid, and resolved in a timely and appropriate manner. The auditors identified several areas of concern, including inadequate procedures for following up, resolving, and closing complaints. Further, the auditors noted that the inconsistent handling of complaints by CSU agents resulted in complaint descriptions not always being complete and clear, and assigned complaint numbers not always being provided to callers.
  
  
• An audit on the follow-up of violations issued by the Department of Buildings (DOB) concluded that DOB’s efforts were inadequate as a result of deficiencies in DOB’s execution of the programs and the lack of DOB authority to require access to buildings. As a consequence of DOB’s inability to require access to buildings for re-inspections or to take additional actions to compel property owners to remedy violations on their property, outstanding violations may remain uncorrected for extended periods of time.
  
  DOB’s Enforcement Division runs various re-inspection programs, among them the Hazardous Re-inspection Program and the Certificate of Correction Audit Program. The auditors noted that DOB failed to re-inspect 20 percent of the properties targeted for re-inspection in September 2007 as part of its Hazardous Re-inspection Program because DOB could not gain access to the property. Moreover, of these properties, DOB’s database contained requests for re-inspection notices for only 34 percent of the targeted properties. Additionally, DOB did not assess compliance for 33 percent of the Certificate of Correction violations that were randomly selected for the Certificate of Correction Audit Program for January through June 2007. Moreover, of the cases whose violations DOB determined were not in fact corrected, DOB took no further action against more than half of them.

Asset Management and Internal Controls

The following are brief descriptions of audits of a number of agencies or public entities that identified significant deficiencies in internal controls and asset management:

• An audit of Department of Parks and Recreation (Parks) oversight of capital improvements made by Ferry Point Partners, LLC (Ferry Point) to develop, operate, and manage the Ferry Point Golf Course in the Bronx found that Parks did not effectively oversee the improvement and remediation work of Ferry Point. As a result, the City overpaid Ferry Point almost $6 million in remediation costs and lost more than $3 million in forgone license fees. The terms of a May 31, 2000 license agreement required Ferry Point to complete by January 1, 2003, at least $22,470,000 in capital improvements and pay the City the greater of a $1.25 million annual fee or a percentage of gross receipts. After excessive levels of methane gas—a hazardous substance—were detected in 1999, Ferry Point undertook remediation of the site.
  
  The auditors concluded that because of ineffective oversight and poor controls by Parks over remediation work, $6 million in costs submitted by Ferry Point and paid by Parks could not be substantiated and were not reasonable or necessary. Parks also permitted Ferry Point’s contractor to collect fees that could have been remitted to the City, thereby defraying the cost of the remediation. Moreover, the lack of oversight by Parks led to scheduled capital improvement work either being substantially delayed or not being completed in accordance with the license agreement and modification, resulting in $3 million in forgone license fees.
  
• An audit of the compliance with Comptroller’s Directive #7 by the Engineering Audit Office (EAO) of DSNY found instances of noncompliance with provisions regarding change-order work. In Fiscal Year 2007, the year covered by the audit, DSNY’s EAO approved for payment $114,733,866 in vouchers for capital projects. Directive #7 provides City agency EAOs with guidelines for independently pre-auditing payment requests for a variety of construction and related consultant services contracts. EAOs have the important responsibility of insuring, prior to payment, that the City has received appropriate value under these contracts.
  
  The auditors concluded that the DSNY EAO authorized for payment $1,678,491 in vouchers associated with change orders that had not been registered with the Comptroller’s Office, as required by Directive #7. Also, the EAO authorized questionable and excessive payments totaling $370,466 for vouchers that lacked substantiating documentation and whose amounts exceeded estimated costs.
  
  
• An audit of travel expenses of DOE’s Central Office found that DOE had inadequate internal controls over such expenses. DOE spent a total of $16.3 million for travel expenditures during Fiscal Year 2007, the period covered by the audit. Of this amount, approximately $4.8 million was spent by the Central Office. Central Office travel expenses are primarily for teacher training, meetings, conferences, retreats, and transportation. The audit found that the Central Office did not always adhere to DOE’s own written procedures for the purchase and approval of travel expenses or to applicable sections of Comptroller’s Directives #6 and #24, which promulgate procedures for City agencies to follow when processing vouchers for payment. While sampled expenditures were adequately supported by invoices, in general, their lack of underlying supporting documentation prevented the auditors from determining whether all purchases were reasonable.
  
  
• An audit of the cash and firearm custody controls of the Manhattan Property Clerk Division (PCD) of the Police Department (NYPD) disclosed that the controls over the custody, return, and disposition of firearms were inadequate. The PCD accepts, catalogs, and safeguards all property brought into its custody. The types of property accepted by PCD include cash, narcotics, rifles, handguns, and general property of varying description. The property is categorized as arrest evidence, investigatory, safekeeping, or decedent’s property.
  
  As a result of the weaknesses over controls of firearms, the Manhattan PCD officials could not immediately account for or retrieve from their designated storage 94 (29%) of the 324 sampled firearms brought in for safekeeping. The Manhattan PCD also failed to record pertinent information in its documents that would permit it to readily track and account for the firearms in its custody. Furthermore, rifles were stored in a disheveled manner, with some of the rifles lacking identifying tags, and firearms were kept by the Manhattan PCD office longer than required by NYPD regulations.
  
  
• An audit of the DEP job order contracting program (JOC) found weaknesses with the administration of the program. JOC is a procurement method for expediting maintenance, repairs, and small- or medium-sized construction projects. Under this program, DEP can instruct a contractor to perform individual tasks when necessary rather than awarding individual contracts for each small project. The cost of JOC work is based on previously established unit prices for specific items such as electrical, plumbing, and roofing. For Fiscal Years 2005 through 2007, the period covered by the audit, DEP issued 1,174 job orders and supplemental job orders totaling $46.4 million.
  
  The auditors concluded that internal controls governing the timeliness of JOC work were inadequate, which hindered the effectiveness of the JOC program and resulted in most job order projects not being developed or completed on time. In addition, when JOC work was delayed, DEP did not impose more than $800,000 in liquidated damages on contractors. Also, there were problems with JOC work whose costs were not based on pre-established prices contained in the construction task catalogs. In some of these cases, the auditors concluded that DEP should not have used the JOC program as the procurement method to carry out the work.
  
  
• An audit of the monitoring of the award, transfer, and succession of Mitchell-Lama apartments by the Department of Housing Preservation and Development (HPD) revealed that HPD’s oversight activities did not provide sufficient assurance that housing companies consistently complied with the City’s Mitchell-Lama Rules. HPD is responsible for monitoring and overseeing financial and property management, waiting lists, and admission applications for City-sponsored Mitchell-Lama developments.
  
  As the result of weaknesses in HPD’s monitoring, there was no assurance that housing companies consistently complied with Mitchell-Lama Rules in the award, transfer, and succession of Mitchell-Lama apartments. Specifically, documentation was not retained to verify that only qualified applicants were approved and awarded apartments. In addition, HPD did not ensure that available vacancy reports, rent rolls, and waiting lists were compared or reviewed regularly as a means to detect potential irregularities or other questionable circumstances that may have required follow-up.

Information Technology

All City agencies rely on information technology to help perform the tasks necessary to maintain mission-critical operations. Over the past decade, the City has spent a significant amount of taxpayer dollars on information technology. That being the case, I have continued to dedicate a portion of the bureaus’ resources to audits of system-development projects. Many of these audits identified computer systems that were developed with excessive cost overruns and missed deadlines, or that simply did not meet agency needs. Brief descriptions of some of these audits follow:

• An audit of the development and implementation of the Medical Assistance Tracking Information System (MATIS) by the Human Resources Administration (HRA) could not ascertain whether MATIS met the overall goals as stated in its original system justification. The objective of the MATIS system was to fully automate the business processes carried out by the Home Care Service Program (HCSP) of the HRA Medical Assistance Program, responsible for Medicaid-funded, non-institutional, long-term care programs.
  
  The auditors found issues when performing sample testing and creating test cases to review and analyze the data stored in MATIS. Based on the test results, they concluded that MATIS contained inaccurate, outdated, and unreliable data. They also noted security weaknesses in MATIS, such as it did not require that users change their passwords on regular basis, and it was not equipped with an automatic lockout feature. Moreover, HRA did not have procedures in place to ensure that security violations are recorded, documented, and reviewed. Also, HRA did not incorporate MATIS into its agency-wide disaster recovery plan.
  
  
• An audit of the development and implementation of the Notice of Violation Administration System (NOVAS) by the DSNY determined that DSNY needed to address specific issues to improve the reliability of the system. Previous to the development of NOVAS, the summons-issuance process was performed manually, from the issuance of paper summonses to the creation of management reports. In 2004, DSNY contracted with ICICI InfoTech, Inc., to develop NOVAS, a computerized system that would automate and streamline the entire process. The contract with ICICI InfoTech, Inc. was valued at approximately $4.5 million. In 2006 NOVAS became operational.
  
  The results of the auditors’ user surveys indicated that the users had problems or concerns that DSNY must resolve to improve the system’s functionality and productivity. In addition, audit data-integrity testing indicated that NOVAS had problems in data reliability, such as the presence of inaccurate dates, an indicator of weak edit checks, and some security weaknesses.
  
  DSNY did not require that users regularly change their passwords for access to both the NOVAS handheld devices and the system itself. Also, the NOVAS did not restrict or control log-in access of inactive users. A review of DSNY’s disaster-recovery plan revealed that DSNY had not fully developed and tested the disaster-recovery plan of NOVAS.

For the remainder of my tenure as Comptroller, I will continue to deliver on my commitment to maximize revenue while reducing costs and improving the quality of City programs and services.

Very truly yours,

William C. Thompson, Jr.