KEY TAKEAWAYS: Thibodaux lost $1,596 after a fraudulent email prompted officials to change a vendor’s banking information. The city changed its vendor payment procedures to require independent verification of banking changes. Auditors identified additional weaknesses involving utility accoun t adjustments, employee timekeeping and payroll oversight. Auditors also found deficiencies in documenting and independently reviewing financial reconciliations, some of which were previously identified.   A fraudulent payment that cost taxpayers in one Louisiana city nearly $1,600 exposed one of several weaknesses in the state’s Legislative Audit, prompting changes to how officials handle vendor payments, utility accounts, payroll records and other financial transactions. The city of Thibodaux sent taxpayer money to a fraudulent bank account last year, one of several financial control weaknesses auditors identified involving vendor payments, utility billing, employee timekeeping and account reconciliations. The $1,596 payment was made March 28, 2025, after city personnel received a fraudulent email requesting a change to a vendor’s banking information. The banking information was changed in the city’s electronic payment system without independently verifying the request. Officials did not discover the fraud until June 10, when the legitimate vendor contacted officials about an unpaid invoice. Only a nominal amount of the money was recovered, according to the audit. The incident was reported to the Louisiana Legislative Auditor, local district attorney and police department. Auditors recommended requiring independent verification directly with vendors before banking information is added or changed, along with documented approval by someone not involved in processing the payment. Thibodaux said it changed its Vendor Input Policy after discovering the fraud. Vendors must now complete a form, and the assistant finance director calls the vendor using the phone number already on file to verify the request. The vendor must also confirm previous information before the change is made. The incident was among four issues EisnerAmper outlined in a management letter accompanying Thibodaux’s audit for the year ending Dec. 31, 2025. The auditors described the issues as opportunities to strengthen internal controls or improve operating efficiency. Auditors also found employees responsible for collecting utility payments had access to the city’s billing system that allowed them to adjust customer account balances. That meant employees responsible for collecting payments could also change balances associated with customer accounts, weakening the separation of duties intended to reduce the risk of errors or unauthorized activity. Thibodaux said it cannot fully separate those duties because doing so would prevent collections employees from assisting utility customers and interfere with their job duties. Instead, the finance director will review and sign off on a monthly report identifying employees who made utility adjustments to monitor for unauthorized activity. The management letter also raised concerns about employee timekeeping. In a sample of salaried employees’ records, auditors found several timesheets that did not list the actual number of hours worked and instead indicated only a “W” for “worked.” Auditors also found a general lack of documented supervisory approval before payroll was processed. City officials told auditors supervisory reviews were occurring despite the lack of signatures. Auditors said the lack of documented supervisory review and hours worked could increase the risk of employees being compensated without the city receiving appropriate value. They said the weakness could result in misstated payroll expenses or, in the worst case, fraud or abuse. The city responded that federal law does not require salaried exempt employees to track their hours and said its current procedures require those employees to submit leave reports using codes including “W” for worked, “S” for sick, “V” for vacation and “H” for holiday. However, it will review converting the leave reports into a timesheet system for classified and unclassified exempt directors and develop procedures requiring supervisory approval before the records are submitted to payroll. Payroll employees will also run a report each pay period comparing reported leave with leave recorded in the city’s HR system. Two payroll or administrative employees will review and sign off on the report. Auditors also identified deficiencies in how Thibodaux documents and reviews financial reconciliations. Certain reconciliations were not formally documented, including those involving deposits collected outside City Hall. Reviewer dates were not consistently documented, and several reconciliations lacked evidence of independent review, including those involving debt payments, other post-employment benefit liabilities and debt-service coverage calculations. Some aspects of the reconciliation issue had also been identified in the prior year. The city agreed that some reconciliations were not fully documented, reviewer dates were not always included and some reconciliations lacked evidence of review. Officials said they are working with staff to ensure initials and dates are included to document who reviewed reconciliations and when. The management letter comments did not result in a modified opinion on Thibodaux’s financial statements. ...read more read less