A Financial Mess,   Cluelessness, and Criminal Violations Uncovered in Comptroller’s Audit of Ramapo

How bad was the State Audit of the Town of Ramapo and its Board? The Journal News bannered its publication this way: "Comptroller’s draft audit blasts Ramapo’s ballpark financing, budget planning." But it wasn’t just the ballpark that created the current financial mess. The audit itemized 8 possible violations of State law, pointed out three out of five town budget funds under water in 2010 (who knows where they are now in 2011), it identified scores of worst practices (even absent practices) throughout financial operations, and it found an IT department that seemed dangerously clueless about protecting residents’ private information, locking down banking transactions, and managing user accounts. And of course, as the Journal points out, the audit has a lot to say about the ballpark financing, including this damning assessment:"As a result of the decisions the Board made (St. Lawrence and the four board members), Town taxpayers are now potentially responsible for approximately $35.4 million in expenditures for a property not owned by the Town. Furthermore, the Town has agreed to guarantee an additional $25 million in bonds issued by the RLDC against the voters’ wishes." That’s $35.4 million up until May 18, 2011, before the million dollars a week in cost overruns in June and into the summer.
 

EXECUTIVE SUMMARY
(All text in red is directly quoted from the Audit)

The examination by the State of New York Office of the State Comptroller originally intended to look at financial activities for the period January 1, 2009, to November 17, 2010. But when the examiners saw the vast sums of money slushing between town resources and St. Lawrence’s Local Development Corporation, "[They] expanded the scope of our audit to include January 1, 2008, to May 18, 2011, to review the trends associated with the Town's finances and to include the Town's actions related to the baseball stadium construction project."

The audit addressed the following questions:

• Did Town officials properly oversee and monitor the planning and construction of the baseball stadium to ensure compliance with taxpayer wishes?
• Are internal controls over the Town's finances appropriately designed to safeguard Town assets?
• Are internal controls over the Town's information technology (IT) system appropriately designed to protect electronic data?

The answers to the three questions were unequivocal and disturbing: No, No, and No.

In the first paragraph of the AUDIT RESULTS, the examiners summed up:

But what about that brilliant analysis of the baseball project that St. Lawrence bought from Fishkind & Associates from Florida. Didn’t they project a profitable outcome for the ballpark, enough to pay off the loans?

The examiners say the Fishkind rainbows will not be developing any time soon over the ballpark:

The Town will pay approximately $27.5 million in principal and interest payments on these bonds over the next five years. This is significantly more than the approximately $7 million a feasibility consultant projected the baseball stadium would generate in net revenues available for debt service during the same time frame. (This includes $25 million in principal + $2.5 million in interest.)

St. Lawrence has been promising that the sale of the housing the RLDC is building on Elm Street in Spring Valley will pay for the loans backed by the taxpayers for the ballpark.

The examiners say the math is bogus:

If St. Lawrence’s development company, the RLDC, defaults on the loan payments, it will be the taxpayers who will eat the loss, even though they voted 71% to 29% against funding the ballpark. The audit takes the time to point out that the project is built on the lie that St. Lawrence repeated after the referendum voted down public funding. No public funds will be used to build the ballpark he repeated in one public venue after another.

But where were the Town Board members as this Ponzi Scheme was developing? The record shows Daniel Friedman and Fran Hunter voting for every single dollar that was being taken from Town funds to pay for the ballpark. Itzy Ullman and Pat Withers at first voted against the "inappropriate" transfer of cash out of the Town of Ramapo and into St. Lawrence’s Ramapo Local Development Corp (RLDC), but then they fell in line and voted consistently for the transfers. Their defense when questioned by the state auditors was an astounding, "Who me? I didn’t know what he (St. Lawrence) was doing."

We found that the Board has not exercised effective oversight of the Town. Board members told us that they received no financial reports; such as detailed project cost reports for Town projects (including the baseball stadium), budget versus actual reports, and generally did not receive or review contracts. Additionally, Board members told us that they did not know how much the baseball stadium would cost the taxpayers or how it would be paid for.

He didn’t give us any financial reports and we didn’t know how much this was going to cost the taxpayers, so. . . of course we voted for it. This sounds like an insanity defense. Don’t think that will work when this stuff floats to the surface at other investigative agencies.

There are serious financial failings in a number of other areas in the Town finances, and the information technology fail-safes that are required to protect funds, privacy, and operational security are missing—not lax, missing.

There are five operating funds in the Town of Ramapo. In 2010, three of the five were under water. And remember, this was BP (before the Ballpark and its negative mass).

We also found that the Town had operating deficits of over $5.6 million in 2010 in three major operating funds which caused a deficit fund balance in all three funds. The deficits occurred because of unrealistic revenue estimates and the Board's failure to monitor and adjust the budget when it became clear that the Town would not achieve anticipated results. During 2009 and 2010. the Town advanced approximately $3.3 million and $3.9 million, respectively, among funds with differing tax bases, but failed to pay back those funds by the close of the fiscal year as required by law. The advancing funds lost $17,243 in interest because they were not paid back with a comparable rate of interest.

Note the phrases "unrealistic revenue estimates," "failure to monitor the budget," and "failed to pay back those funds by close of the fiscal year as required by law." If you read the entire 25-page draft report, you will see these words repeated over and over. Fictional numbers, lack of any responsible oversight, and disregard for state law all are part of the corrupt culture at the heart of Ramapo government. There are no less than eight references to problems with the law in the report, and the propensity to dissemble is becoming second nature for a number of the principals.

Although the participants are not mentioned by name, usually just by their position, those directly culpable for the mess unearthed by the audit include: Christopher St. Lawrence, Council members Daniel Friedman, Fran Hunter, Itzy Ullman, and Patrick Withers, the board’s lawyer, Michael Klein, and the new purchasing agent Mona Montal who watches these transactions get processed by financial software that has been intentionally disabled to prevent reporting overruns.

And finally, the executive summary closes with a scathing assessment of the lack of adequate information technology policies that included no breach notification policy, no online banking policy, or policies for assigning or deactivating user accounts, no entity-wide disaster recovery plan to resume mission-critical functions, the auto-complete setting that was enabled on the online banking computer, and the auditors found multiple instances of non-work-related computer usage. Setting IT policies is, as the examiners point out, the responsibility of the Town Board.

The summary ends with requirement of a written corrective action plan (CAP) due back to the Controller’s Office in 90 days as required by State Municipal Law.　

This section of the report defines the obligations of the Ramapo Town Board (Supervisor and the Four Council members):

The Board has a fiduciary responsibility for Town assets and finances, and an obligation to serve the community, protect taxpayers' interests, and exercise good faith and due diligence. As the legislative body, the Board should establish and oversee much of the policy, financial, and ethical framework within which the Town operates.

Ethics, due diligence, fiscal awareness—it’s quite a lot to ask from a group that basically functions as four rubber stamps and a Supervisor who uses their consent to design train wrecks while the home network sits waiting for hackers like a large block of cheese. If that sounds exaggerated, or even snide, consider how the state auditors characterized this group:

The Board has not exercised effective oversight of the Town. The Board neither established policies nor oversaw the Town's financial operations. Board members told us that they received no financial reports; such as detailed project cost reports for Town projects (including the baseball stadium discussed in the next section), budget versus actual reports, and generally did not receive or review contracts. The Board made its decisions based upon representations from the Town Attorney and Supervisor. Additionally, although Board members should ensure they receive all necessary information, for the most part, they have not requested the information or ensured that they received requested information. In fact. Board members told us that they did not know how much the baseball stadium would cost the taxpayers or how it would be paid for. Without proper information, there is a risk that inappropriate decisions may be made which could result in further costs to taxpayers.

The board made its decisions based "upon representations from the Town Attorney and Supervisor." They are then, by their own admissions, rubber stamps. They told the auditors "they received no financial reports, budget versus actual reports, and generally did not receive or review contracts." These are astounding admissions. This certainly begs the question, Then what the hell do we need you four empty vessels for? But then again, there’s the possibility that they do understand the kind of corruption they are sitting in the midst of, and perhaps they think these cries of ignorance will qualify as claims of innocence if these matters ever get to the Attorney General’s Office.

Baseball Stadium Capital Project

Next in the report, there’s a detailed, four-page analysis of the train wreck dubbed Provident Bank Park. Readers of this website have already seen on these pages much of the information and criticism included in the auditor’s report. The state agrees with us on the improper land transfer, the shabby feasibility report from Fishkind, the attempt to hide the payments after the voters resoundingly defeated the call for taxpayer funding of this project, and the danger to any taxpayers who have a Local Development Corp operating in their district.

Here are a few highlights of this fiscal horror show that was originally called Project Grand Slam until Preserve Ramapo began tracking payments to inappropriate budget areas and then Mr. Klein and the Board began referring to it in as nondescript a way as possible.

Paying back the ballpark loans by the Town actually takes precedent over salaries and services.

As we are still waiting on Judge Jamieson to rule on most of the counts of the Preserve Ramapo lawsuit, the auditors, fully aware of these issues, point out in the report:

We understand that several issues related to the stadium's financing remain in litigation. Therefore, we have not made findings on underlying legal issues relating to the financing. Nonetheless, we find that the transaction raises significant legal issues, including: 1) The New York State (NYS) Constitution generally prohibits towns from loaning their credit (e.g., guaranteeing loans) to or in aid of any private or public corporation or association; 2) A local government may not submit a proposition to referendum, even upon petition of the voters, unless expressly authorized or required by statute. It is not clear under what statute the resolution was made subject to permissive referendum; 3) The NYS Constitution prohibits towns from making gifts or loans of property to or in aid of private entities. Although characterized by the Town and the RLDC as a "Purchase and Sale," the Town received no cash consideration for transfer of property. The "purchase price" under the transfer agreement was stated as "RLDC's development and construction of the Project... and the resulting community benefits to be derived therefrom..." It is unclear whether the purchase and sale is for adequate consideration so as not to constitute an unconstitutional gift by the Town.

About the Fishkind & Associates feasibility study of the ballpark’s chances of success, the auditors were to the point.

In an effort to determine the feasibility of the baseball stadium, the RLDC contracted with an outside vendor to perform a feasibility analysis. We reviewed this analysis and found that it was inadequate. The analysis did not contain sufficient information to substantiate the decision to build the baseball stadium.

There are two conclusions we can draw from that second comment. I guess Fran Hunter didn’t get the report and didn’t need to see it to vote (he received the report). And whoever did get the report, and can we assume read it, seems to be a dimmer bulb than those who chose to take their usual "see no evil" tack for voting on board issues. Well, only slightly dimmer—there’s never an excuse for public officials who put bags over their own heads at meetings, even if they think it will provide legal cover later.

This section of the report also gets into the Ponzi Scheme workings of St. Lawrence’s RLDC. The RLDC obtained loans of approximately $29.9 million that were guaranteed by the Town (read taxpayers) to build the affordable housing on Elm Street. "These loans must be repaid before any revenues generated from the sale of the units are made available to reimburse the Town for payments related to the $25 million bond [to pay for the stadium]." St. Lawrence has claimed the sale of the housing units will pay back the bond for the ballpark. "As a result," the auditors point out, "the RLDC may be unable to reimburse the Town for the principal and interest payments on the $25 million bonds."

Financial Condition

(Ramapo Budgets that are BS)

　If it were only the ballpark, the taxpayers would be in dire straits. But because the pay-forward kind of fraud is happening throughout Ramapo government finances, the situation is even worse. We are all walking on rotten plywood.

We have already had numerous examples of the Board’s "insufficient monitoring of financial operations," but where do these inaccurate budget estimates originate from? Could it be from the desk of the Chief Financial Officer of Ramapo (aka the Supervisor)?

Town officials adopted an unrealistic budget for 2010 that resulted in $4.5 million in revenue shortfalls. For example, Town officials overestimated mortgage taxes by $1.4 million, overestimated golf fees by $1.8 million and overestimated sales of real property by $900,000. Town officials continued to budget unrealistically when adopting the 2011 budget. We reviewed the 76 budgeted revenue lines in the general fund and found that 34 appeared unreasonable based upon historical trend data.

Town officials indicated that they review historical data when preparing the budget; however, they did not estimate revenues to reasonably respond to a clear and obvious downward trend or adjust estimates in accordance with the revenue shortfalls in prior years. In addition, we found no indication that the Board monitored actual results compared to the budget during the year. Further, the Supervisor could not provide any explanations for the budget estimates for 2011. Without realistic estimates, there is a risk that the Town will experience further revenue shortfalls and therefore, operating deficits.

So, it’s not only the board members muttering I don’t know, I don’t know, for the auditors. Our CFO is also taking the fifth. Thirty-four of 76 revenue lines in the general fund budget are inflated (fake)—so what do we do when these revenues don’t arrive and the Supervisor and Board are still spending money we don’t have? I don’t know, I don’t know.

The examiners tracked these bogus budget projections and actual losses for three years for three funds: The General Fund, The Town-Outside-Village Fund, and the Part-Town Highway Fund. Keep in mind, these are three of five funds, and the General fund is the largest.

The General Fund Balance went from an operating surplus of $45,941 in 2008 to an operating deficit of minus $4,353,201 in 2010. A plus $45 thousand vanishes and becomes a scary minus $4.5 million in three years. The Operating surplus for the Town-Outside-Village Fund was actually a deficit in 2008 of minus $109,385 and that grew eight-fold to a minus $861,607 in 2010. The Part-Town Highway Fund tripled a beginning deficit in 2008 (-$169,168) to -$353,705 in 2010. Again, remember these are PB numbers, and if these budget lines were raided to pay for the ballpark there obviously needs to be a forensic audit of the town’s finances for 2011. Slushing tens of millions of taxpayer dollars absolutely needs to be examined for any criminal activity.

The Town now has negative fund balance in these three operating funds, and has no financial cushion in the event of an emergency. Further, if the Town continues to experience operating deficits, there is a risk that it may need to borrow funds to finance the deficit and to finance day-to-day operations.

The emergency fund of $4.5 million has disappeared and there’s no backup. If there’s a fiscal emergency, the Town will be borrowing even more for the cash flow needed for salaries and keeping the lights on.

Then there’s the question of the law and Ramapo bookkeeping.

The law requires the Town to maintain separate accounts for each appropriation. The law does not permit the Town to overdraw an appropriation or use a fund or appropriation to pay a claim chargeable to another fund or appropriation. Town officials must obtain Board approval before exceeding any appropriation. In fiscal year 2010, the Town over-expended $6.8 million in individual accounts in the Town's five major funds. While total expenditures were within the budget, many individual account lines were exceeded. These over-expenditures occurred for several reasons. First, the finance software used by the Town has settings that would prohibit the creation of requisitions if funds are unavailable; however, these settings are currently disabled, which allows users to create requisitions against funds that are not available. In addition, during the purchasing process, when requisitions become formal purchase orders, there is no control in place to identify requisitions that do not have sufficient funds available. Without proper controls, there is a risk that the Town's already declining financial position may worsen.

And a question about Inter-fund advances:

Towns generally are not authorized to make budgetary transfers between funds that have different tax bases. When Town officials advance monies between funds that have different tax bases, they must repay the advance, with a comparable amount of interest, by the end of the fiscal year in which the advance was made.

As a result of the Town's declining financial position, the Town has depended on inter-fund advances from the other Town operating funds to help finance operations. At fiscal years ended December 31, 2009 and December 31, 2010, the Town advanced approximately $3.3 million and $3.9 million, respectively, between funds with differing tax bases. Town officials did not pay back these funds prior to the end of the fiscal year. Town officials were not aware that the advanced funds were required to be paid back by the end of the fiscal year.

"Were not aware"? Are there any qualified accountants at Town Hall? Is lawyer Michael Klein monitoring these kinds of transactions, or does he also have a bag over his head? Is ignorance of the law an excuse—for any of these players?

Information Technology

The LDC Ponzi Scheme is chugging along and chewing up revenues, and the bogus budgets are digging some pretty deep sinkholes, and then there’s the IT department. The last place you want to hear I don’t know, I don’t know is in the server room.

First, it’s important to note who is responsible for creating policies and procedures for those working in the computer rooms.

Computerized data is a valuable resource that Town officials rely on to make financial decisions. The Town's information technology (IT) system is an essential part of operations used for accessing the Internet, email communication, processing and storing data, and reporting to State and Federal agencies. The Board and Town officials are responsible for establishing, designing, and implementing a comprehensive system of internal controls over the Town's IT system and data to protect these assets against the risk of loss, misuse, or improper disclosure of sensitive data.

The Board. The same board that has shown no inclination to monitor financial operations nor any curiosity about budgeting or planning is the same group responsible for "establishing, designing, and implementing a comprehensive system of internal controls" for the IT system. From what you have read, I think you can guess what the state examiners had to say about the Board’s performance for IT.

The Board has not established policies and procedures related to breach notification, disaster recovery planning, and online banking. We also found weaknesses in the Town's internal controls relating to the auto complete function, deactivating terminated user accounts, and limiting personal computer use. Further, the Board has not provided Town employees with security awareness training. These control weaknesses increase the risk that the Town's IT system and electronic data may be susceptible to loss, unauthorized use, or improper disclosure.

Well, if nothing else, St. Lawrence and the gang of six is consistent—clueless and incompetent, but consistent.

Here’s another list of failings from the desks of these 5 elected and 2 appointed disappointments:

1. "The law requires local governments to establish an information breach notification policy. The policy should detail how employees would notify residents whose personal, private or sensitive information was, or is reasonably believed to have been acquired by a person without valid authorization." If your Social Security and or credit card numbers were stolen, you would like to be informed in a timely fashion, right.

   Well, tough luck. Not in Christopher St. Lawrence’s Ramapo. Even though town personnel collect social security numbers, driver’s license numbers, and bank account information, "the Town neither adopted a formal breach notification policy, nor classified its data according to risk." In fact, the Director of IT "indicated that she was unaware of the requirement to establish a breach notification policy."

2. "Town officials are responsible for developing and documenting a disaster recovery plan." That’s because even minor interruptions can cause problems like loss or incorrectly processed data, which in turn can cause financial losses, or worse. "Town officials have not developed and documented a disaster recovery plan. If the Town experiences a major disruption, without a formal disaster recovery plan, Town personnel have no guidelines or plan to follow to resume mission-critical functions."
3. "The auto complete feature in Internet Explorer can save web addresses, form data, and login information such as usernames and passwords. [The state examiners found] the auto complete setting was enabled on the Town’s online banking computer. This setting automatically populated (filled out) the user name and password when the first letter of the user’s name and password was entered. As a result, the Town is at risk that unauthorized users can sign on, access banking information, and compromise financial data." Obviously, the examiners immediately notified the Director of IT and she disabled the feature. Problem is, it’s difficult to tell if anyone had gotten in before the switch was turned off. If so, did they take anything or plant anything in the systems?
4. When a person leaves a company, the IT department immediately, sometimes even before the employee is notified of their dismissal, shuts off their access to the company network, email, etc. That’s because, as the audit explains, "Good internal controls include policies and procedures designed to limit access to data." Perhaps our Board and Supervisor have only dim notions of internal controls limited to scheduling bathroom breaks because the report complains, "The Town does not have written policies for deactivating user accounts. The process used by the Town for terminating access to the Town’s network and financial system is inadequate." How inadequate? Well, the examiners "reviewed the list of 496 network user accounts on the Town’s active directory and 66 user accounts on the Town’s financial software to determine if employees who had left Town service were still on the list of active users. [They] found 3 users on the active directory and 12 users on the financial software whose accounts had not been disabled after they left Town service. The duration of time these employees have remained active on the directory was 30 to 827 days." Plenty of time to hack back in and cause some mischief or even try to set up some special bank transfers. "One employee who had left Town service 15 years ago was still active on the financial software." It would only take one disgruntled ex-employee with minimal hacking skills to "inappropriately gain access to a system and change, destroy, or manipulate confidential and/or critical data," and you might then not only have the damage caused by the hack, but also the lawsuits by the residents whose private information was currently being retailed in Eastern Europe.
5. The Town owns 220 computers, and the auditors identified 161 of them that had been used to visit inappropriate websites including dating, porn, and social media websites. The auditors advised the Town how to make changes to the internet content filtering software to get people’s minds back on their work.
6. The audit reports: "The Board has not provided employees with information security awareness training. We interviewed 8 of the 13 employees using online banking to determine if they have been provided with security awareness training. All eight employees indicated that the Town had not provided them with training."
7. Perhaps most disturbing of all the IT failings, there’s no online banking policy at Ramapo Town Hall. From the report: "A comprehensive online banking policy clearly describes the online banking activities the Town will engage in, specifies which employees have the authority to process transactions, establishes a detailed approval process to verify the accuracy and legitimacy of transfer requests, and requires a monthly report of all online banking transactions. The Town has not adopted an online banking policy. Without proper controls over online banking processes, Town funds will be at increased risk of being stolen through cyber fraud activities."