Indicted former Covington finance director Robert Due had complete control over the city's finances that allowed him to steal at least $793,000 during the past decade, Kentucky Auditor of Public Accounts Adam Edelen announced Thursday.
"The report boils down to this: One individual had unfettered access to millions of taxpayer dollars without a single person looking over his shoulder for well over a decade," Edelen said. "That this could happen for that long in the fifth largest city in Kentucky is astounding and frankly inexcusable."
The city said finance department employees on Aug. 22 told the city administration that they believed Due had misappropriated funds. He was arrested the next day.
"This report reinforces the immediate actions that the city has taken since the discovery of the misappropriation in August," City Administrator Larry Klein said. "We are already addressing these findings and we will not stop until we restore the faith and trust of our citizens."
A Kenton County grand jury has indicted Due on 15 counts, including charges that he stole the city's money for 11 years and forged documents.
State auditors reviewed more than 66,000 checks, unveiling a scheme that allowed the former finance director to write 68 checks to himself, his spouse, his aunt and a vendor under his control totaling $793,127 from 2001 to 2013, the auditor's office said.
Also, the auditor's office said Due created two fake vendor names in the city's finance software.
To write a check, he would enter payment information using one of the two fictitious vendors or one of three legitimate city vendors and change the vendor name in the system to himself, his wife, his aunt or a vendor he controlled.
Auditors said Due would then go into the office after hours, print the checks, delete the check history from the printer to avoid detection, change the name in the system back to the original vendor and deposit the checks into personal accounts he controlled.
The auditor's office said it found that Due had complete control over the city's financial activity without sufficient oversight or governance to prevent or detect fraud.
State auditors said one of the most significant issues identified is that Due had complete access to all accounting system functions. He acted as the information technology administrator which allowed him to process payments using other employee accounts.
Internal controls that are intended to prevent and detect fraud were weak, easily manipulated and in some cases, nonexistent, auditors said.
Auditors also found that a 2012 reorganization of the finance department by Due created the appearance that he had segregated duties. Auditors said in reality, the staff wasn't provided training to familiarize them with the new job functions and they had insufficient knowledge of what constituted good internal controls and sufficiently segregated duties.
"The scheme wasn't particularly elaborate," Edelen said. "But the city's failure to establish checks and balances and provide oversight granted him the opportunity."
Edelen praised city leaders for cooperating with auditors and taking steps to implement stronger financial controls.
The city said since Aug. 23 it has taken steps to overhaul the operations of its finance department.
The city hired a new finance director, created an assistant finance director position (hired someone for that job) and hired an internal auditor.
The city also created an information technology and data management position that will report directly to the city manager.
The city said it has started to ask financial software providers to tighten controls regarding checks to vendors and is working with its bank to provide additional fraud protection. The department is updating policies and procedures regarding purchasing and other functions.
The auditor's investigation into the finances lasted five months. Kenton Commonwealth's Attorney Rob Sanders requested it.
Due's next court date is March 10.
FOX19 reporter Kelly Rippin contributed.