Norwalk city audit: unmodified opinions; auditors flag segregation-of-duties and procurement lapses

Independent auditors on behalf of CLA delivered an unmodified opinion on Norwalk City’s fiscal 2024 financial statements and issued unmodified opinions on compliance for both federal and state single-audit programs, while also reporting three significant deficiencies and several management recommendations.

The opinion, presented to the Norwalk City ad hoc audit committee, means the auditors determined the financial statements were “presented in accordance with GAAP,” and CLA principal David Flint said an “unmodified opinion is the best opinion that can be received.” Gabriel Epstein, director at CLA, told the committee the firm found three significant deficiencies in internal control related to journal-entry processes and procurement compliance for federal programs; the same journal-entry deficiency appeared on the state report.

Why it matters: an unmodified opinion indicates the city’s financial statements can be relied upon by readers, including bondholders and grantors, but the significant deficiencies are governance matters the city must address to reduce fraud and compliance risk, auditors said.

Audit results and major findings CLA reported unmodified opinions for: the city’s basic financial statements; the schedule of expenditures of federal awards; and the schedule of state financial assistance. On the federal side, total federal awards expended were $39.7 million for the year, down from $52.2 million the prior year; auditors said the decline was driven largely by spending down ESSER (Elementary and Secondary School Emergency Relief) COVID-era grants.

Auditors identified three significant deficiencies: 1) journal-entry segregation of duties, where Munis user permissions allowed the same person to prepare and post journal entries; 2) a procurement-policy deficiency that left required federal procurement language out of the city’s policy for part of the year (the policy has since been updated); and 3) a procurement noncompliance item tied to the child nutrition cluster, where a vendor arrangement exceeded the $10,000 threshold for competitive quotations but had not been re-solicited after the scope and costs increased. Epstein described the journal-entry issue this way: “the city's financial system, Munis, is set up in a manner where it allows entries journal entries to be both prepared and posted by the same person.”

City response and remediation Jared Schmidt, the city’s chief financial officer, told the committee the practice allowing a single user to both prepare and post entries “doesn't happen anymore. We're not doing that anymore. We don't have the same person preparing and and posting. So that's been stopped.” CLA recommended configuring Munis to prevent the same user from both preparing and posting entries and asked for remediation preferably by the end of the current fiscal year (June 30, 2025).

On procurement, CLA said a revised procurement policy that complies with federal guidance was adopted late in fiscal 2024; because the updated policy was implemented after the fiscal year end, the finding remains in the 2024 audit but auditors expect it to be cleared for fiscal 2025. For the child nutrition procurement, CLA called the instance “immaterial noncompliance” but stressed the need to review longstanding vendor arrangements when scopes or costs change so competitive quotations or bids are solicited when thresholds are exceeded.

State grants and reporting On the state side, total state awards expended were about $73.7 million. CLA identified two significant deficiencies on the state audit: the journal-entry segregation issue (the same finding noted on the federal side) and a late-filing issue for required semiannual project reports for a Community Conservation Development grant administered by the Connecticut Department of Energy and Environmental Protection (DEEP). Epstein said the two semiannual reports (for August 2023 and February 2024) were prepared by Parks and Recreation but were not filed with DEEP until August 2024, after auditors inquired; auditors reported no known penalties stemming from the late filing.

Management-letter recommendations CLA also issued a management letter with best-practice recommendations: improve timeliness of departmental reporting to the comptroller so revenue is posted to the correct accounts; formalize IT controls in Munis to enforce segregation of duties; strengthen year-end cutoff practices; create a formal accounting policies and procedures manual to support business continuity; adopt an anonymous fraud tip line and perform a fraud-risk assessment; and continue monthly bank reconciliations and oversight for decentralized student activity funds.

Board of education student activity funds Board of education leadership said the student activity accounts have been consolidated at M&T Bank and that monthly reconciliations were started after a previous effort to centralize those accounts. A board finance official said the person responsible for reconciling had moved to the city side and the board is working to assign a replacement to continue monthly reconciliations.

Committee discussion and next steps Committee members commended the finance and comptroller staff for the overall results. Councilmember Greg Burnett thanked the finance team and noted that the findings had already prompted corrective steps. Several members urged the city to prioritize hiring or contracting for cybersecurity expertise (a chief information security officer) and to consider periodic internal-audit engagements—either a staff internal auditor or contracted CPA firms—to perform targeted reviews.

CLA reiterated the unmodified opinions and emphasized that no material weaknesses were identified. The auditors said they are available to the city for follow-up questions and recommended remediation of the journal-entry configuration by June 30, 2025. The committee concluded the presentation and invited follow-up communication by email for any remaining questions.