New York State Comptroller Thomas P. DiNapoli has released a series of audits examining the operations and financial practices of several state agencies and organizations.
The Metropolitan Transportation Authority’s (MTA) Long Island Rail Road (LIRR) Engineering Department was reviewed for its management of fleet vehicles and on-rail equipment. A previous audit in May 2023 found issues such as the lack of written policies for inventory and maintenance, incomplete preventive maintenance, missed state inspections, and an absence of cost analysis between leasing and purchasing vehicles. One vehicle was found to have cost $81,000 more to lease over 58 months than if it had been purchased. The MTA has since made some progress: three out of thirteen recommendations from the initial report were implemented, four were partially implemented, and six remain unaddressed.
Another audit focused on the MTA’s compliance with a 2019 Public Authorities Law change that required a personnel and reorganization plan by June 30, 2019. The legislation aimed to eliminate redundancies, streamline processes, improve customer service, increase efficiency, and achieve cost savings. Auditors reported that the MTA did not have a functioning transformation plan with clear tasks or timelines. Documentation provided by six departments did not support claims of improved service or reduced costs.
The Department of Corrections and Community Supervision (DOCCS) was audited regarding its contract with Securus and JPay Inc., which provides tablets and kiosks for incarcerated individuals at no direct cost. These devices allow access to educational materials, media purchases, and secure messaging with family members for a fee. A prior audit in May 2023 highlighted DOCCS’ lack of monitoring over program participation numbers, asset security configurations, verification processes for community correspondents using secure messaging, risk management in message screening, and system maintenance standards. DOCCS stated it was not responsible for the tablet program but acknowledged some progress: one recommendation fully implemented out of seven; three partially addressed; three not addressed.
The Empire Plan prescription drug program administered by CVS Caremark under the Department of Civil Service was also reviewed. An earlier audit in June 2023 identified over $10 million in rebates owed to Civil Service from CVS Caremark. Since then, $419,233 has been recovered and remitted to Civil Service. Of two recommendations made previously, one was partially completed while one remains outstanding.
Medicaid enrollment procedures were examined as well. Individuals eligible for Medicare are required to enroll as a condition for Medicaid coverage because Medicare serves as the primary payer when both apply—helping Medicaid avoid unnecessary costs. From July 2016 through June 2021, auditors found that more than 13,000 Medicaid recipients who appeared eligible based on age were not enrolled in Medicare—a situation that could have saved Medicaid nearly $294 million if addressed properly. The Department of Health made little progress since the last review: only one recommendation fully implemented out of three; another partially addressed; one not addressed.
Audits also covered special education providers UCPA of Cayuga County d.b.a E. John Gavras Center (Gavras Center) in Auburn and The Arc Franklin-Hamilton d.b.a The Adirondack Arc (Adirondack) in Tupper Lake—both authorized by the State Education Department (SED). Gavras Center reported about $4.3 million in reimbursable costs from July 2018 through June 2021; auditors identified $625,534 that did not meet requirements. Adirondack reported about $3.9 million during the same period; auditors found $76,812 in non-compliant costs.
Erie County Medical Center Corporation (ECMCC), an academic medical center in Western New York, underwent an IT security review focusing on principles like least privilege access and data classification. Auditors communicated eight recommendations confidentially due to sensitive findings related to unauthorized system access risks; ECMCC officials generally agreed with these findings and indicated plans to address them.
“
