Members of the Rockport Select Board, the town's finance director, town manager and auditor met on July 30 to review a proposed internal policy packet. The 45-page document was created to outline the policies and procedures which control all aspects of how the municipality functions — from handling of money to investigating allegations of fraud.

The five members of the select board, Finance Director Megan Brackett, Town Manager Rick Bates and the town's auditor, Ron Smith, reviewed the document, which was developed using a format from the Government Finance Officers Association. At the beginning of the workshop Bates explained the impetus for creating the document.

"This document has been on our radar for several years. It protects people who work with cash transactions and outlines a firm policy for handling money…. It gives policy on how we handle cash, cash receipting, and limits who has control," said Bates, who added that the policy would also help the town avoid instances of fraud.

"As a result of the last audit, we found areas of potential concern, and we will work to apply 'best practices,' " said Bates.

The workshop comes weeks after the town manager and select board held an executive session to discuss a personnel matter. Following the July 12 executive session, the select board voted unanimously to have an outside party investigate the matter. The focus of the investigation has not yet been made public.

A packet for the July 30 workshop posted on the town website included the draft of the internal policy document and a preface by Bates:

"To be perfectly clear, there is no evidence anywhere that points to any fraud or mishandling of funds, in fact I feel like we have taken reasonable steps to ensure good internal controls, however recent cases that have hit municipal governments around the country and as fast as technology is changing, reasonable steps are not enough. As a result of our last audit and backed up by this audit, we have weaknesses in our practices and procedures that need to be addressed."

Section 4.8 of the internal control document addresses information technology and Internet security. In April computers at the Rockport Town Offices were hacked and effected by a virus. The virus was sent on April 13, and initially presented itself by "blacklisting" town employees, a process through which the computer server sent back rejected emails. Additionally, town documents and information were encrypted.

Hackers demanded ransom in the amount of $1000 from the town, to be paid using the cryptocurrency Bitcoin. The town did not pay the ransom, and the problem was resolved by information technicians. The internal control policy recommends that the town maintain a network firewall, implement anti-malware software and develop a "disaster recovery plan" with its contracted IT specialists.

"These policies are designed to protect the innocent. Right now you have a lot of fragmented verbal or written policies. The idea is to make one document going forward which gives us the best chance to understand who you are as a town, what you're doing and what the best practices are that you're applying," said Smith.

The phrase 'best practices' appears numerous times throughout the draft document. Selectman Jeff Hamilton suggested that the language be changed to 'policy and procedures' because he said that "'best practices indicates that you don't have to follow [the practices], there's some ambiguity there."

During the workshop it was agreed that the select board would be responsible for outlining the policies which would govern the municipality and that the town manager would be responsible for enforcing the procedures in instances of wrongdoing.

Section 4.3 of the document states that staff assignments will be rotated and that employees will be required to use their vacation leave. This would be a new procedure for the town and its employees, and Smith explained that a mandatory week vacation would be taken by all employees in order to prevent or discover instances of fraud.

"When fraud is discovered, it's usually when someone is out of the office," said Smith. He said that when someone handles money as part of their job on a daily basis and then takes a period of vacation, in their absence another employee is responsible for the management of money and may discover an accounting error or practice which is questionable.

Additionally, the document recommends that the town conduct unannounced internal audits and states that a separation of duties within a workplace such as the town office can help deter fraud.

"Employees responsible for collecting and recording cash transactions shall be required to take vacation leave periodically. During this leave time away from work, the employee's records and cash accounts shall be reviewed and an internal audit conducted by the management. Also the town manager and/or finance director reserve the right to perform unannounced cash audits of all cash drawers," reads section 4.4 of the document.

An over-assessment of $300,000 dollars was one of the findings auditor Ron Smith shared with the Rockport Select Board and town manager in January when he reported on the town audit for the fiscal year ending June 30, 2017.

At the time Smith advised implementing "best" or new accounting and record-keeping practices with regard to the Rockport Public Library's finances, as well as the way in which payments are taken at the town office. Smith said Brackett was in the process of developing a procedural manual for the town which would address some of the uncertainty surrounding, for example, who is appointed to serve as the library's treasurer — something Smith said would be helpful and is long overdue.

Members of the select board suggested a number of edits or changes to the document during the workshop, which they will compile and create a revised version before a vote is taken on accepting the document at an upcoming meeting.