Cedarhurst strengthens its policies

In response to an audit by the state comptroller’s office, the Village of Cedarhurst revised its policies on purchasing services, claims processing and computer security as the five trustees unanimously approved three resolutions at the March 7 board meeting.

One resolution required all contracts with professional service providers to be in writing, along with adopting standard terms and conditions for obtaining services. Another established a procedure to remote access to village computers to ensure that audit logs used to monitor work done by outside vendors or consultants are reviewed and that review is documented. The third resolution established a computer use policy.

From June 1, 2008 to Aug. 31, 2009, a comptroller’s audit reviewed internal controls on procurement, payments and the village’s information technology system security. For that time period village spending totaled $4.9 million from the general fund and $1.05 million from the sewer fund.

Good and services valued at $150,944 were obtained without seeking competitive bids — as required by general municipal law — and 18 checks totaling $14,023 were cashed by vendors before the bills were approved for payment by the village board.

“Some of the policies have been in effect as we had annual resolutions at the reorganization meeting, but they weren’t in the code book, said Sal Evola, Cedarhurst’s village administrator.

To rectify the purchasing issue, the village codified an emergency purchase documentation form that defines what the emergency condition is, the scope of purchase, who is authorized to procure services and the selection procedure. It also includes 27 defined standard terms and conditions for obtaining services.

The audit called for Cedarhurst to ensure that there is competitive bidding for services and revised language states that “the Village shall use reasonable means to obtain competitive quotations to [e]nsure that the Village receives the best pricing and terms available under emergency conditions.”

The corrective action plan that Cedarhurst had to send to the comptroller’s office for review also included an amended information technology and equipment use policy.

“The village’s information technology resources are subject to increased risk of loss or misuse,” Nicole Hanks, a spokeswoman for the comptroller’s office, said before the code was revised.

In addressing security practices the policy states that the village “reserves the right to limit or deny access to certain Electronic Communications services as a security precaution,” and those granted access to Cedarhurst’s system will be provided with a copy of this policy.

“There was nothing that couldn’t be corrected with policy changes,” said Evola, who added the village was “glad to get the comptroller’s input.”