Internal controls at the Poway Unified School District are lacking and district funds remain vulnerable to fraud, waste and abuse a year after John Collins’ termination as superintendent, a newly released audit reveals.

In a June 27 report made public Monday, accounting firm Moss Adams said hiring an internal auditor and creating a whistleblower hotline could help mitigate some of the problems. The findings also indicate the district lacks consequences for employees who violate policies.

Among the issues flagged: tracking vacation time and improper use of credit cards and the revolving cash fund, generally reserved for small or emergency payments. Collins is accused of exploiting some of the same deficiencies to enrich himself, according to his July 2016 termination documents and the district’s civil lawsuit against him. Leave time and credit cards are also at the center of the criminal case against Collins.

The $50,000 Moss Adams review was commissioned by the board in December after the district’s routine audit noted broad issues with vacation payouts and credit cards, among other things.

The district released the unredacted Moss Adams’ report Monday, nearly eight weeks after its dated completion. Voice of San Diego attempted to view the audit at the district office Aug. 15, but was turned away despite state laws allowing inspection of public records during normal business hours.

The Moss Adams report found 53 internal control deficiencies, six of them with a high likelihood of occurrence, like vacation accrual and revolving cash fund policy violations.

Processes for logging and tracking absences were found to be irregular and in need of improvement. The report mentions a $5.6 million vacation liability included in last year’s district-wide audit, but did not provide an updated figure.

“Although the District’s labor contracts address carryover limits for vacation time, a cap on vacation time is not automated and the carryover limits for vacation have not been consistently enforced. As a result, the District has incurred significant financial liabilities that will continue to increase over time,” Moss Adams wrote.

The firm recommended the district consider training supervisors to encourage use of vacation, enforce carryover caps or allow payouts once per year for all unions, a privilege currently only held by one union, officially.

Moss Adams also found a “backlog of the forms used for tracking absences. These delays make it difficult to determine accurate leave balances,” and “the calculations for vacation payouts are performed by a single individual in Payroll, but a supervisor does not verify the calculation … it is important for a second individual, ideally a supervisor, to sign off on calculations.”

As for the revolving cash fund, despite policies to the contrary, “there are no restrictions preventing accounting technicians or administrative staff from requesting reimbursements from RCFs. Therefore, they can request reimbursement for themselves and sign the checks.”

The firm also urged the district to change its policies to revoke district credit cards, also known as purchase cards or p-cards, for misuse or those repeatedly lacking receipts.

Per existing policy, purchase cards are only supposed to be used for “emergencies, travel, groceries, and office supplies,” but they’re being used for other items and the purchasing department does not review items to identify unauthorized purchases, the report says.

Inefficiencies in billing and collections were also cited as high risk, resulting in possible lost revenues, and teachers often buy materials like ink cartridges and seek reimbursement without checking to see if a purchase order exists with discounted pricing, according to the report.

Staff also reported that employee evaluations have not been prioritized, and 873 evaluations were still outstanding or incomplete at the end of the year, including some “dating back many years,” the report said.

In addition to creating a third-party fraud hotline, the firm recommended Poway Unified add whistleblower protections and retaliation prohibition language to its existing grievance policies.

Though highlighted as lower risk, the district can also improve internal controls “to ensure that donations are used for intended purposes,” Moss Adams wrote.

After 40 years in public education and six years as superintendent, Collins’ termination in July 2016 alleged he took unauthorized vacation cash-outs from the revolving cash fund, as well as longevity overpayments and other monies. The district is now suing him to recover $320,000. Collins also faces four felony charges for allegedly misappropriating public money by abusing vacation and other leave, and misusing district credit cards.

Collins has denied any wrongdoing.

District officials did not immediately respond Monday to requests for comment about the report, or the delay releasing it.

In the wake of Collins’ departure, district documents show some proactive steps are being taken to head off future contract disputes with top administrators over vacation time and sick leave. “Me-too” raises previously granted to those in charge of employee negotiations, like Collins, have also been stripped from new employment contracts and new language has been added to the sections granting longevity pay boosts.

Rather than say the superintendent and assistant superintendents can cash out a maximum amount of unused vacation, “In the event of termination of this Agreement,” newer employment contracts say unused vacation can be cashed out, “In the event of resignation, retirement, termination or other separation of employment from the District.”

“Except as expressly provided herein, the Superintendent shall not be entitled to compensation for unused accrued vacation time,” the March 7 contract for current Poway Superintendent Marian Kim-Phelps says.

Collins’ attorney is arguing his contract allowed him to cash out time while still on the job when his contract was extended and rewritten.

All current superintendent and assistant superintendent contracts now specify they receive 12 days of sick leave per year, whereas Collins’ contract said merely he “shall be provided all leave benefits which are provided the District’s certificated administrative employees.”

Rather than grant automatic “me-too” raises when other managers get raises like before, top administrator raises now require satisfactory annual evaluations and follow a salary schedule and “not any negotiated salary increase for any other group of employees.”

Periodic longevity pay raises rewarding employees with lengthy tenures in the district also now come with this disclaimer: “The increase at each step shall not be calculated on a compounding basis.”

District staff also recently tried to address the backlog of vacation balances for managers and non-teaching employees by proposing new district policy language on Aug. 10, but the changes were pulled from consideration before a board vote without discussion.

Among other things, the new language would have said, prior to July 1, 2017, “employees had been allowed to accumulate vacation days in excess of the number of days authorized” in existing policy. It also would have required managers to take “all additional accrued (excess) vacation days by June 30, 2020.”

It is not clear if staff plans to bring the same language or something different back to the board for a vote. The next board meeting is scheduled for Sept. 14.