Cannon Mountain Audit Reveals Missing Funds, Lax E-Commerce Account Security, and Lack of Financial Oversight
State audit of Cannon Mountain in 2015 was first conducted since 2002.
Thursday, February 11, 2016, NewEnglandSkiIndustry.com
Missing funds, e-commerce credit card account exposures, and a lack of financial oversight were among 26 issues identified in a 2015 state audit of Cannon Mountain. The last audit of the state owned and operated ski area was conducted in 2002.
Missing Funds
The audit identified nearly $50,000 in missing revenue, over half of which could not be recovered.
"Approximately $27,000 of credit card sales went unprocessed during August 2013, as a result of a credit-card system communication problem. Cannon Mountain staff attempted to resolve the problem but did not notify the Departments' Business Office of the issue until November 2013. According to the Department, at that point it was too late to recover the unprocessed sales transactions."
"Prior to the auditor's inquiry on August 19, 2014, the Department did not notice it had not received the concessionaire's April commission payment in the amount of $20,411. Upon discussion with the concessionaire, the Department determined it had no record of receiving a check reported to have been issued on May 14, 2014. A replacement check was subsequently received and deposited by the Department."
E-Commerce Credit Card Account Exposure
In the wake of numerous national high profile credit card breaches, the audit identified lax procedures that resulted in a system controlling $800,000 in sales being accessed by active employees using the account of a former employee.
"Cannon Mountain has not established reasonable controls over an internet payment processing account used for on-line sales of season passes and gift cards. Cannon Mountain sells season passes and gift cards on its website using an internet payment company to process customer payments. During fiscal year 2014, approximately $800,000 of sales were processed through Cannon Mountain's internet account"
"The Department was not aware of who had access to the account, whether the account was regularly reconciled, and whether there were reasonable controls over the operation of the account. According to Cannon Mountain, during fiscal year 2014, three employees shared a single username and password for the account, limiting accountability for account activity. Additionally, the account was not regularly reconciled. Cannon Mountain also reported that, while the account was in the name of a prior employee, it was confident the prior employee had no control or claim over the account."
"Cannon Mountain has not complied with Department policies and procedures for controlling employee access to information systems."
"Cannon Mountain reports that access change requests and authorizations to the Siriusware system are based on verbal communications between the Siriusware Administrator and the Administrative Supervisor. The Department's Business Administrator is not made aware of access changes in the Siriusware system and therefore does not have the opportunity to review and authorize all access change requests to ensure that changes made to roles in the automated control system are appropriate to the individual's job description."
Payroll/Benefits
The audit revealed issues with payroll, including supervisors not overseeing their employees' timecard submissions, paycheck duplication, and not providing employees with earned benefits.
"Weaknesses in the payroll systems used by Cannon Mountain during fiscal year 2014 increased the risk that employee payroll could be based on inaccurate information."
"There is no supervisory review of employee time entered into the timecard-based payroll system. Supervisors are not required to approve the hours entered or provide reporting that would allow them an opportunity to review hours or payroll charged to their areas of responsibility."
"A weakness in the State's payroll system during fiscal year 2014 increased the risk that Cannon Mountain and Department employees could be paid incorrectly without detection."
"Payroll testing identified a $713 duplicate payment made to a Cannon Mountain employee."
"During fiscal year 2014, the Department and Cannon Mountain did not have the ability to monitor hours worked by Cannon Mountain's seasonal employees to ensure that employees who qualified for benefits such as health and dental, retirement, and leave-time benefits were provided those benefits.
"Eight Cannon Mountain seasonal employees appeared to have worked sufficient hours in single seasonal positions to entitle them to certain payroll benefits during fiscal year 2014. Another ten employees have worked sufficient hours in consecutive seasonal positions (primarily summer seasons at the Flume and winter seasons at Cannon Mountain) that could entitle them to benefits. According to the Department's personnel, there are no policies and procedures for monitoring employee work hours to ensure that seasonal employees who earn the opportunity for benefits are properly notified."
Overpayment to Vendors
The audit sampled Cannon's payments to vendors and found that Cannon had not taken advantage of over one third of the discounts to which it was entitled.
"Cannon Mountain's expenditure process did not consistently recognize and take advantage of available purchase discounts during fiscal year 2014."
"Cannon Mountain took advantage of only three of the eight available purchase discounts identified in expenditure samples. In one of the unapplied discounts, the vendor offered a 23% discount if the payment was made by March 5, 2014. Payment was made on January 27, 2014, well before the end of the discount period; however, according to the Department, the preparer, reviewer, and approver of the payment did not notice and failed to apply the $6,600 discount. Subsequent to the auditor's identification of the unapplied discount, Cannon Mountain requested and received credit for its timely payment."
Insufficient Tracking of Free and Discounted Passes
Despite providing over half a million dollars of free or discounted season passes to employees, volunteers, and family members of Cannon, Centerplate, and Franconia Ski Club, Cannon was unable to provide the list of pass recipients to the auditor. In addition, an unknown number of free day passes were granted on verbal request.
"Cannon Mountain does not accumulate, track, analyze, or report information about special daily and seasonal passes that are issued at no cost."
"During fiscal year 2014, the authority for granting no-cost daily and seasonal passes at Cannon Mountain was delegated by the Director of Parks and Recreation to Cannon Mountain's Mountain Manager and Director of Marketing Services."
"Without tracking and reporting the issuance of no-cost special daily and seasonal passes, there is a lack of accountability and transparency as to their use."
"Complimentary tickets may be issued by supervisors to mollify a customer who had a bad experience at Cannon Mountain. Granting a complementary ticket is either initiated by a supervisor giving the customer a complementary ticket voucher or by a supervisor verbally authorizing a ticket seller to issue a free ticket. Because a verbal authorization may not be documented in the point of sale system, and there is only limited subsequent review in the cash-out process, unauthorized complementary tickets could be issued by a ticket seller citing verbal authorization, with limited risk of disclosure."
"Cannon Mountain does not separately track and report season passes issued to Cannon Mountain team members and their dependents, even though Cannon Mountain's point of sale system has the capacity to account for and report issued season passes by type and client. Cannon Mountain's Team Members consist of employees of Cannon Mountain, the contracted food services vendor, Franconia Ski Club, and Adaptive Sports Partners of the North Country (ASPNC) and certain Cannon Mountain and ASPNC volunteers."
"Cannon Mountain was unable to provide auditors with a listing of its team members, and its system for recording season passes did not identify season passes by type of team member and dependent."
"Cannon Mountain 'team members', consisting of employees of Cannon Mountain and its food services vendor and volunteers of the Adaptive Sports Partner of North Country (ASPNC), Franconia Ski Club, and Cannon Mountain are provided with the opportunity to obtain season passes for themselves and their dependents for as little as a $10 processing fee. The regular price for an adult season pass during the 2013/2014 ski season was $799."
"Employees and volunteers also receive other benefits with monetary value such as free or discounted equipment rentals and ski lessons, and discounts at the retail stores, food concessions, and childcare facility.
- Full-time employees of Cannon Mountain, the food service vendor, Franconia Ski Club, and ASPNC, and their dependents, are eligible for season passes for a $10 processing fee.
- Full-time seasonal employees of Cannon Mountain, the food service vendor, Franconia Ski Club, and ASPNC are eligible for season passes for a $10 processing fee. Their legal dependents are eligible for a season pass for a $25 processing fee.
- Part-time employees of Cannon Mountain, the food service vendor, and Franconia Ski Club and Cannon Mountain and ASPNC volunteers are eligible for season passes for a $10 processing fee. Their first legal dependent is eligible for a season pass for a $25 processing fee, and their other dependents are eligible for a season pass at a 50% discount."
"Total Team Member passes issued during fiscal year 2014 represented at least 18% of fiscal year 2014 season passes sold."
Cannon reported there were 309 peak season employees. The audit reported totals of 478 employee season passes, 2 volunteer season passes, 251 dependent season passes, and "an unknown number of dependent passes issued at the 50% discount."
Accounting
The audit also noted many potential accounting and IRS issues, as well a lack of oversight of assets and inventory.
"The lack of comprehensive financial policies and procedures contributed to Cannon Mountain sales clerks inconsistently processing daily sales activity and Cannon Mountain and Department reviewers inconsistently documenting their review. Examples of inconsistent application of revenue control processes include the following:
- The objective of the control of ticket sellers initialing the Ticket Stock Log forms is unclear. It is unknown whether the initials evidence the receipt of the register starting cash (referred to as banks), the ticket stock, or both. Issuers do not initial the forms.
- Not all ticket sellers enter ticket control numbers into the Siriusware, the point of sale system, which hampers accountability for tickets and transactions.
- Not all ticket sellers record and explain voided transactions on a Void Log.
- Supervisors do not consistently initial the Daily Deposit Sheet to evidence their verification count of the daily deposit.
- Cannon Mountain's Business Office review of the Detail Cash Drawer Report or Summary Closeout Report, including evidence of a review of redeemed complimentary vouchers, is inconsistently documented. Out of 25 sample items, ten selections had no evidence of a Business Office review.
- The Department's review to ensure that all revenue received was input completely and accurately into NHFirst was not consistently performed for eight months of fiscal year 2014."
"Cannon Mountain does not routinely reconcile financial information recorded in its three primary accounting systems: the State accounting system, NHFirst, and two commercial accounting packages, Siriusware and QuickBooks."
"An unaddressed weakness in the Department's revenue reconciliation process results from the Department not fully reconciling its credit card clearing account and allowing the 'float' in the account to mask certain credit card processing fees."
"During fiscal year 2014, the Department did not recognize approximately $28,000 of credit card processing fees related to Cannon Mountain transactions processed through this clearing account."
"The Department does not have a policy and procedure for allocating credit card fees to Cannon Mountain and other Franconia State Park accounts. The Department's practice of allocating fees by season was not consistently applied during fiscal year 2014 resulting in a minor overstatement of fees to Cannon Mountain and an understatement of fees to the State Park accounts. The Department has a single merchant credit card account that is used for processing revenues at all Franconia State Park facilities including Cannon Mountain, the Flume, and Lafayette Campground."
"Making adjustments to financial accounts should be subject to formal policies and procedures, and suitable controls, to ensure adjustments do not intentionally or unintentionally obfuscate errors or frauds."
"Certain unreported benefits provided to Cannon Mountain employees, volunteers, and affiliates may require Federal tax reporting by Cannon Mountain. Cannon Mountain 'team members', consisting of employees of Cannon Mountain and its food services vendor and volunteers of the Adaptive Sports Partner of North Country (ASPNC), Franconia Ski Club, and Cannon Mountain are provided with the opportunity to obtain season passes for themselves and their dependents for as little as a $10 processing fee."
"It would appear that Federal tax reporting regulations require Cannon Mountain to report certain of these benefits to the Federal Internal Revenue Service as additional wages to employees, or as miscellaneous income to non-employees."
"Cannon Mountain needs to address weaknesses in its retail store operations. Cannon Mountain's Retail Manager has been given a wide range of responsibilities that are not subject to control activities expected in a State-owned retail sales operation. The weak control structure increases the risk that errors or fraud could occur and not be detected and corrected in a timely period."
"There is no independent check or verification to ensure that all purchased inventory is received and accurately input into the inventory system, and no independent review of inventory discrepancies and adjustments to inventory balances."
"During fiscal year 2014, Cannon Mountain did not fully communicate changes in equipment and other property assets to the Department, or consistently tag or otherwise identify purchased equipment as State owned.
1) An expenditure test sample identified two purchased equipment items, a utility vehicle and a steel-edge snow pusher, that did not have State plates or identification tags applied. Cannon Mountain reported it had not received the State equipment inventory tags from the Department for the purchased equipment.
2) All-Terrain Vehicles (ATVs) purchased by the Department during fiscal year 2014 having a cost of $10,000 or greater, including the utility vehicle mentioned above, were erroneously excluded from equipment reported on the Department's year-end Exhibit E, Long-Term Asset Rollforward form.
3) Cannon Mountain reported it was unsure whether all of its departments performed physical equipment inventory inspections during fiscal year 2014. Additionally, the results of those inspections that were performed were not reported to the Department for inclusion on the Department's Equipment (P-16) Inventory Listing. It was unclear whether discrepancies identified by the counts were appropriately resolved.
4) Cannon Mountain did not report its real property additions and improvements to the Department for fiscal year 2014."
"The lack of policies and procedures to control the rental shop equipment inventory increases the risk that not all purchased equipment is recorded in the inventory and that any equipment missing from inventory will not be detected in the normal course of business."
"Cannon Mountain has not reviewed copies of the Franconia Ski Club's audited financial statements to ensure the Club is operating in accordance with its contract agreement with Cannon Mountain."
"By utilizing a revolving account, ski school and concession expenditures are not subject to the State's budgetary control procedures.'
"To increase transparency, accountability, and controls, Cannon Mountain should include its school and concession operations in its budget submissions."
"Reports issued by Cannon Mountain of season passes sold at reduced rates during fiscal year 2014 did not include information required by RSA 227:14."
"The reports submitted by Cannon Mountain during fiscal year 2014 summarized season passes issued but did not identify passes issued at a discount to New Hampshire residents. Subsequent to filing the reports, the Department's Internal Auditor determined the reports submitted for the first, second, and third quarters of fiscal year 2014 were inaccurate. Reportedly due to oversight, the Department did not submit corrected reports, and did not submit a report for the fourth quarter."
In its Cannon Mountain Statement of Revenues and Expenditures, which counted $615,399 in Mount Sunapee Lease Revenue as Cannon Mountain Revenue, the audit found a $543,844 deficiency in fiscal year 2014.
The 2002 audit reported that 78% of the 1994 audit issues were 'Fully Resolved.' The 2015 audit reported that only 43% of the 2001 issues were 'Fully Resolved.'
