COVINGTON, Ky. – Kentucky State Auditor Adam Edelen pointed his finger squarely at the city of Covington in a scathing report released Thursday tied to a special investigation into the city’s finances under Robert Due’s leadership.
Edelen said that the city “failed to segregate financial duties” allowing Due to have complete access and control over all financial software and systems within the city, “allowing him to allegedly steal at least $793,000 over the past decade.”
“The report boils down to this: One individual had unfettered access to millions of taxpayer dollars without a single person looking over his shoulder for well over a decade,” the auditor wrote. “That this could happen for that long in the fifth largest city in Kentucky is astounding, and frankly inexcusable.”
The 59-page report details how Due is alleged to have taken $200,000 more in taxpayer money than originally suspected over a 13-year period, in what the auditor called a "not very elaborate scheme.''
Due, 63, was fired in August 2013 after an employee blew the whistle on him. He faces criminal charges of theft, unlawful access to a computer, criminal possession of a forged instrument and official misconduct in the case. He has pleaded not guilty to the charge against him.
Due held his position as the city's sole finance director over the course of the alleged theft. Edelen's office spent more than five months investigating the case.
Overall, the findings in the auditor’s report indicated “serious weaknesses impacting the financial management of the city.”
“Controls were so lax that the risk of fraud was increased, which ultimately led to a misappropriation of assets for more than a decade,” Edelen addressed to Covington Mayor Sherry Carran and City Manager Larry Klein, in a letter to the city preceding the report.
In all, auditors reviewed more than 66,000 checks, uncovering a tightly woven scam.
In those thousands of checks, auditors in Edelen’s office found that Due, who was the finance director for Covington since 1999, wrote 68 checks to himself, his wife Janet Patterson, his late aunt Virginia Molique, who died in 2012, and a vendor under his control totaling $793,127 between 2001-2013.
According to the report, Due created two fake vendor names in the city’s finance software. To write a check, he would enter payment information using one of the two fictitious vendors or one of three legitimate city vendors and change the vendor name in the system to himself, his wife, his late aunt or a vendor he controlled.
He would then go into the office after hours, print the checks, delete the check history from the printer to avoid detection, change the name in the system back to the original vendor and deposit the checks into personal accounts he controlled, Edelen explained.
“The scheme wasn’t particularly elaborate,” Edelen said. “But the city’s failure to establish checks and balances and provide oversight granted him the opportunity.”
The state auditor’s exam uncovered that Due not only had complete control over the city’s finances without monitoring, but that he also had complete access to all accounting system functions, including acting as the IT administrator. The auditor said this role allowed him to easily process fraudulent payments through other employees’ accounts.
"There was too much trust and not enough verification," Edelen said. "Mr. Due thought he was above the law."
Internal controls intended to prevent and detect fraud were weak, and easily manipulated, even nonexistent, the report said.
“He built a system of designed incompetence for his graft,” Edelen said.
In addition to internal checks and balances, cities are responsible for hiring an independent, external certified public accountant to audit its finances annually, in an effort to prevent what happened with Due.
For Covington, that was Cincinnati-based accounting firm Decosimo in fiscal year 2012. Prior to that, the city used Von Lehman and Company in Fort Mitchell, Ky.
That audit, however, is only a snapshot of the fiscal year’s finances, not a thorough look at every transaction for the year.
In 2012, the city spent $400,000 to replace outdated financial software, giving them “more sophisticated controls” over the financial department and director, Klein, the city manager, said.
But auditors found that a 2012 reorganization of the finance department, which was implemented by Due, created the appearance that he had segregated duties. But the staff wasn’t provided training to familiarize themselves with the new job functions and they had insufficient knowledge of what constituted good internal controls.
The audit's recommendations include implementing a new credit card policy that tracks spending as well as those who are spending; maintaining an accurate list of bank accounts; and develop policies and procedures to address all significant functions within the finance department like, segregating duties, creating job descriptions, adequately training employees on software, while structuring the finance department so that the director serves as a supervisory review of other staff.
“These are findings and recommendations,” Stephenie Hoelscher, spokeswoman for the auditor said. “Because they are recommendations, we cannot dictate to the city what it does from here, but we certainly hope it implements the recommendations.”
"When we first learned of the review we were a little worried, but quickly it became very reassuring to have another set of eyes on where things went wrong," Mayor Sherry Carran said. "It was a like a security blanket having them here."
The report, Carran said, will be the city's guide to best practices for running its administration.
"This is the end of a 13-year debacle," Klein said. "It happened on our watch. It was caught on our watch. We will fix it on our watch... we want our money back. Citizens want their money back and we will work non-stop to get our money back."
The report has been referred to the Kenton County Commonwealth’s Attorney for the 16th Judicial Circuit Rob Sanders, who said it's unlikely that the city will get full restitution on what was stolen.
The state's audit report will aid in determining how much restitution the city might recover.
Due, who was arrested in September 2013, could face 20 years in prison if convicted of the charges.
The City of Covington filed a lawsuit against Due, which also makes claims against auditing firms and banks that failed to detect his alleged scheme as well as companies that provided the city with theft-prevention software and employee-theft insurance.
The city has taken steps to regain the public's trust, by replacing Due in December when they hired Lisa A. Goetz, who previously worked as comptroller at a Covington legal services corporation.
Klein created a seven-member, all-volunteer financial task force in August in an effort to obtain restitution for the city and its taxpayers—focusing on how to strengthen internal checks and balances in the city’s finance department, hold the city accountable and promote reorganization.
The city has also recruited Clark Schaefer Hackett, a Cincinnati-based CPA firm, as its new external auditor to examine its finances.
“We recognize since identifying the alleged embezzlement, the City has taken actions to improve internal controls,” Edelen wrote in the letter to the city. “It should take the findings in this report seriously, and continue to make improvements in its internal controls aimed at deterring and detecting waste, fraud, and abuse.”
“History demonstrates that cities that have been victimized like this can not only recover much of the stolen money but also move forward in a positive way,” he said. "What happened here in Covington could happen in almost any community in Kentucky."