Audit Report on the Financial and Operating Practices of the Bryant Park Corporation and Bryant Park Management Corporation

EXECUTIVE SUMMARY

Bryant Park Corporation (BPC) is a not-for-profit organization created to manage and maintain Bryant Park under an exclusive management agreement with the New York City (the City) Department of Parks and Recreation (Parks).  The management agreement with Parks (the Parks Management Agreement) allows BPC to provide public events and use of facilities within Bryant Park, including restaurant and other food services, through concession and other agreements with third parties, and to retain the revenue therefrom to support its work.  BPC’s operations are overseen by a Board of Directors (the Board), which consists of 14 members.

BPC is also responsible for overseeing the operations of the Bryant Park Management Corporation (BPMC), an entity created to manage the Bryant Park Business Improvement District (Bryant Park BID).  While BPMC has its own Board of Directors, some of whom also sit on the BPC Board, BPMC relies entirely on BPC’s staff and management to conduct its operations and maintains common bank accounts with BPC.  BPMC (and so in effect BPC) functions as the District Management Association (DMA) of the Bryant Park BID.  In this capacity, BPC is responsible for ensuring that supplemental services are being provided in accordance with the district plan approved by the Department of Small Business Services (DSBS).  Bryant Park BID operations are funded by property assessments imposed on area property owners and are governed by the requirements of the DSBS contract (the DSBS Contract).  Based on the DSBS Contract, the revenue of the Bryant Park BID may be used for capital improvements, maintenance, public safety, community services and other specified services to improve business conditions and activities within the BID.

The objectives of this audit were to determine whether: (1) BPC accurately reported revenue and expenses and complied with major requirements of the Bryant Park management agreement with Parks; and (2) BPMC used its resources appropriately to promote and support the Bryant Park BID and complied with major requirements of its contract with DSBS.

Although BPC and BPMC are two separate legal entities, their financial statements are consolidated because of their close financial and organizational relationship.  BPC and BPMC do not maintain separate books and records.  In Fiscal Years 2013 and 2014, BPC and BPMC reported combined revenue of $8,841,243 and $14,549,213, respectively.  The majority of this revenue was derived from BPC’s sponsorships and park usage fees.  $1,100,000 of this revenue for each of the Fiscal Years 2013 and 2014 was derived from assessments charged to property owners.  In Fiscal Years 2013 and 2014, BPC and BPMC reported combined expenses of $9,994,253 and $12,881,529, respectively.

Pursuant to a 34th Street BID contract between 34th Street Partnership, Inc., (the designated DMA for the 34th Street BID) and DSBS, BPC also shares certain management and support staff and office space with the 34th Street BID.  Expenses shared by BPC and the 34th Street BID include office space and salaries of the President, Controller/CFO, and other senior management.  The allocation of these common expenses between BPC and the 34th Street BID is based on the amount of time each staff member worked for each entity and the office space is allocated based on use.

Audit Findings and Conclusions

Our audit found that BPC was generally in compliance with the Parks Management Agreement and with the DSBS Contract, which together govern the operations of Bryant Park and the Bryant Park BID.  However, our audit found internal control deficiencies that may affect BPC’s oversight over its operations and the accuracy of its financial reporting.

Specifically, we found that BPC did not implement adequate timekeeping procedures and did not provide sufficient documents to support its cost allocation of joint salary expenses.  In addition, we found deficiencies in BPC’s procurement practices, including that it did not consistently execute purchase orders prior to billing for goods and services; adhere to its own procurement procedures; maintain written contracts; and adhere to the subcontracting procedures required by the DSBS Contract.  Further, BPC did not establish procedures to secure competitive bids received for contracts prior to the submission deadlines.  In addition, BPC failed to obtain the required conflict-of-interest disclosures from its key employees and a majority of the Board members.  BPC also failed to consistently ensure that its concessionaires, subcontractors, and event operators maintained the proper insurance, did not retain essential documents in its personnel files, and failed to follow its own procedures for employee education reimbursements.

Finally, we noted that Parks has not revised its agreement with BPC since it was entered into in 1985.  As a result, the terms of the agreement do not necessarily reflect current conditions in and around Bryant Park and in the City as a whole and so potentially do not maximize benefits to the City.

Audit Recommendations

To address these issues, we make 12 recommendations to BPC, Parks, and DSBS.

Specifically, we recommend that the BPC officials should:

• Review and revise its written policies and procedures in specific areas of operations  to strengthen its internal controls as follows:
• Implement a central timekeeping system with features to account for each employee’s time-in/time-out, total hours worked, and a secure interface for data entry, review and approval processes;
• Implement an appropriate methodology for allocating payroll expenses for employees who are shared by the BPC and other entities;
• Execute purchase orders prior to the billing of goods and services to ensure that adequate approval is obtained, sufficient funds are available for potential expenses, and an appropriate receiving report is utilized;
• Maintain all supporting documents relating to BPC’s procurement processes, including bids, required approvals from the Board and City agencies, and signed contracts;
• Ensure that VENDEX background checks are on file for contractors who have contracts exceeding $100,000 within a 12-month period;
• Obtain all required approvals from the construction committee and DSBS and/or Parks, if applicable, for purchases over $20,000;
• Execute written contracts for all independent contractors and vendors conducting business with BPC;
• Establish monitoring procedures to ensure all BPC employees adhere to the policies and procedures, including the employee education reimbursements, governing BPC’s operations;

• Obtain Board and DSBS approvals when less than three bids are obtained;
• Revise its written policies and procedures over the subcontracting of supplemental services to ensure that BPC’s written policies are consistent with the DSBS  Contract;
• Establish policies to properly safeguard submitted bids;
• Obtain the necessary conflict-of-interest disclosure forms from its employees and Board members;
• Ensure sufficient documentation is maintained in personnel files to appropriately reflect BPC’s hiring and staff performance evaluation practices;
• Ensure all outside entities conducting business with the BID maintain insurance coverage that is required by the license agreements.

Parks officials should:

• Ensure BPC implement the recommendations of this report;
• Conduct periodic review of BPC’s operations to ensure compliance with the Parks Management Agreement;
• Consider amending the terms in the management agreement to include the types of internal controls that BPC should establish for its operation and to better optimize the benefits for the City.

DSBS officials should:

• Ensure BPC implement the recommendations of this report;
• Conduct periodic review of BPC’s operations to ensure compliance with the DSBS Contract.

Agency Responses

In its response, BPC stated that, “[t]he organization has well established internal controls, more than adequate for its size and complexity, that have, as demonstrated by the unmodified audit opinions and ‘no material weakness’ reports, issued by KPMG LLP, resulted in financial information being accurately recorded in its books and records.”

In addition, BPC responded that it “is a $13 million company with 130 employees who are all closely supervised.  The definition of ‘adequate timekeeping procedures,’ and what those procedures require, for an entity of our size versus the City of New York, a $82 billion enterprise with 260,000 employees, is very different.  The auditors failed to recognize this distinction.”

BPC’s response does not, however, reflect a complete understanding of the importance of internal controls that govern the accountability and transparency of its operations—two key areas of concern where an entity is performing tasks for and on behalf of the government and the public.  Further, every organization, regardless of size, should implement adequate internal controls that mitigate the risks of misstatements, misappropriation, and other undesirable effects of poor internal controls.  BPC itself acknowledges this audit has identified several internal control deficiencies.  We believe these may affect the organization’s ability to properly oversee its operations.

Further, while we are pleased that BPC has had external audits, we note that the external auditor’s opinion and the engagement upon which that opinion is rendered, does not involve an assessment of the entity’s internal controls.  As the external auditor’s opinion clearly states, in assessing risk of material misstatements, “the auditor considers internal control relevant to the entity’s preparation and fair presentation of the consolidated financial statements in order to design audit procedures that are appropriate in the circumstances, but not for the purpose of expressing an opinion on the effectiveness of the entity’s internal control.  Accordingly, we express no such opinion.”  (Emphasis added.)

Our findings and related recommendations are based on an examination and assessment of the effectiveness of BPC’s internal controls taken as a whole.  Notwithstanding its objections, BPC stated that they “agree with some of the auditors’ findings and related recommendations for improvements.” Of the report’s seven recommendations addressed to BPC, it agreed to implement five recommendations, partially agreed to implement one related to strengthening its internal controls and disagreed with one recommendation related to revising procurement policies to comply with the DSBS subcontracting requirements.

Both Parks and DSBS generally agreed with the remaining recommendations directed at them.