State audit issues findings against Highland County auditor's office

By Rory Ryan
The Highland County Press

In a letter to the Highland County Board of Commissioners, Ohio Auditor of State Keith Faber reported as of Sept. 18 findings for recovery against the Highland County auditor's office, including County Auditor Alex Butler and former employee Melanie Anderson.

According to the audit, (The state) "audited the cash-basis financial statements of the governmental activities, business-type activities, the aggregate discretely presented component units, each major fund, and the aggregate remaining fund information of the Highland County as of and for the year ended Dec. 31, 2023, and the related notes to the financial statements, which collectively comprise the county’s basic financial statements as listed in the table of contents. We conducted our audit in accordance with auditing standards generally accepted in the United States of America (GAAS) and the standards applicable to financial audits contained in Government Auditing Standards, issued by the Comptroller General of the United States. Our responsibilities under those standards are further described in the Auditor’s Responsibilities for the Audit of the Financial Statements section of our report. We are required to be independent of the County, and to meet our other ethical responsibilities, in accordance with the relevant ethical requirements relating to our audit. We believe that the audit evidence we have obtained is sufficient and appropriate to provide a basis for our audit opinions."

The audit further reports, "The payroll clerk of the county is responsible for ensuring that all withholdings from employees’ wages for taxes and other benefits are properly withheld and remitted timely. This repeated failure to timely remit city income taxes to the City of Hillsboro is considered gross negligence. Late payment fees incurred through gross negligence are illegal expenditures. These charges would have been avoided had the withholdings been remitted by the required due dates by the payroll clerk. The payroll clerk negligently failed to perform her duties.

"In accordance with the foregoing facts and pursuant to Ohio Rev. Code § 117.28, a Finding for Recovery for public monies illegally expended is hereby issued against Melanie Anderson, former payroll clerk, and the county's employee dishonesty coverage carrier, CORSA, jointly and severally, in the amount of $1,100, and in favor of the Highland County Payroll Clearing Fund, in the amount of $1,100.

"The county should draft, approve, and implement policies and procedures over the payroll process to ensure accuracy." 

Under Ohio Rev. Code § 319.41 a county auditor may be held liable for a loss of public funds when the loss results from the county auditor's negligence or other wrongful act.

According to the state audit, "A county employee was contacted by email on Sept. 13, 2024 by a cybercriminal impersonating a vendor of the county requesting to have payments made via ACH (Automated Clearing House)/Wire Transfer. Replying to the same email address, the county employee requested the vendor complete and return an ACH form. The county employee received the completed form from the cybercriminal on Sept. 16, 2024. Due to a lack of internal controls of the updates of vendor payments, the county employee forwarded the fraudulently completed ACH form to an employee in the county auditor’s office. The county auditor then issued a warrant to authorize payment to the cybercriminal via ACH on two occasions totaling $450,120.58. Upon discovery of the re-direct scheme, the county was able to recover $447,620.58 from the county’s bank and the County Risk Sharing Authority (CORSA), leaving $2,500 not recovered.

"Prior to accepting the changes to the payment information, none of the bulletin’s recommended steps were taken to independently verify that the request was legitimate. In addition, the county auditor had not adopted a policy or implemented training for employees in his office and in other county offices to recognize vendor re-direct schemes. Failure to implement policies and training in accordance with the Auditor of State Bulletin is considered negligence under Ohio Rev. Code § 319.41. In accordance with the foregoing facts and pursuant to Ohio Rev. Code §§ 117.24 and 117.28, a Finding for Recovery in the amount of $2,500 for public monies illegally expended is hereby issued against Alex J. Butler, county auditor, and CORSA (as the company issuing the bond/insurance in lieu of a bond covering the County Auditor), jointly and severally. The amount shall be paid in favor of the Highland County General Fund Capital Improvement Fund."

On June 30, 2025, $2,500 was repaid to Highland County’s General Fund Capital Improvement Fund.

While the cybercriminal email correspondence did not originate in the county auditor's office, Butler said he accepts responsibility for the error, and steps have been taken to address any issues moving forward.

* * *

Below is a news release from Ohio Auditor of State Keith Faber 

Ohio Auditor of State

• COLUMBUS — A Highland County employee transferred more than $450,000 to a cybercriminal impersonating a vendor after the county failed to implement safeguards and training to ensure payment redirect requests were legitimate.

The incident led to a finding for recovery Thursday of $2,500 that was repaid under an audit of the county’s finances from Jan. 1, 2023, through Dec. 31, 2023.

Auditors noted the September 2024 incident in which a county employee received a request from someone posing as a legitimate vendor to redirect payments to a different account. Two payments totaling $450,120.58 were issued to the fraudulent account before the scheme was discovered.

The county was able to recover $184,073.73 from the bank involved, and the county’s insurance company paid $263,546.85 of the lost funds. Thursday’s finding for recovery covering the county’s $2,500 deductible was repaid under audit.

The Auditor of State’s Office issued a bulletin in 2024 setting clear standards and expectations for public offices in handling payment redirect requests.

On the Highland County incident, auditors wrote, “Prior to accepting the changes to payment information, none of the bulletin’s recommended steps were taken to independently verify that the request was legitimate. In addition, the county auditor had not adopted a policy or implemented training for employees in his office and in other county offices to recognize vendor redirect schemes.”

Thursday’s report included a second finding for recovery after the county’s payroll clerk failed to remit and file portions of tax payments in fiscal years 2019, 2020, 2021, and 2023, leading to $1,100 in late fees and penalties.

Auditors wrote, “These charges would have been avoided had the withholdings been remitted by the required due dates by the payroll clerk.”

The state audit is available at https://ohioauditor.gov/auditsearch/Reports/2025/Highland_County_23_Hig….