El Camino Real Charter High School Management Letter

May 20, 2019 David Hussey, Executive Director El Camino Real Charter High School 5440 Valley Circle Boulevard Woodland Hills, CA 91367 Dear Executive Director Hussey: In July 2017, the El Camino Real Charter High School and the Fiscal Crisis and Management Assistance Team (FCMAT) entered into an agreement for FCMAT to review the charter school’s operations and procedures. Specifically, the study agreement stated that FCMAT would complete the following: 1. Conduct on-site visits to meet with staff and review internal controls, processes and procedures for the business office. The on-site assistance will include, but not be limited to providing recommendations for improvement, if any, in the following areas: • Purchasing, including travel and conference • Accounts payable • Accounts receivable • Payroll • Student store The FCMAT study team visited the charter high school on three separate occasions to conduct interviews review documentation and to provide findings and recommendations. At the request of the charter high school, two subsequent visits were made by FCMAT to review progress towards implementing the recommendations. During FCMAT’s initial evaluation of the charter high school’s systems and practices, the team noted that the charter high school did not have a fully-integrated financial system and did not use an automated position control and payroll system. The charter high school subsequently migrated to the NetSuite financial system, which integrated the finance module including systems for accounts payable, accounts receivable and financial reporting. However, as of FCMAT’s July 2018 visit, no action had been taken towards implementing integrated position control and payroll systems. At the request of the charter high school, FCMAT returned on February 21-22, 2019 to review progress made towards implementing recommendations relative to the human resources and payroll processes and systems. This letter reports the results of the team’s observations. The charter high school contracts with an external party (EdTec) for financial support services, which includes recording payroll and general ledger transactions and preparation of budget and financial reports. EdTec also independently contracts with Paylocity, a third-party payroll service provider. Paylocity does not integrate with the NetSuite financial system. During FCMAT’s recent visit, the charter high school was in the initial stages of phasing out EdTec from payroll services by outsourcing payroll processing directly with Paycom, a third-party payroll service provider. HR & Payroll Systems The largest operating expenditures for any school agency, including charter schools, are for salaries and benefits. Typically, these account for more than 80% of budgeted expenditures. Many complexities are involved in managing the costs associated with collecting and retaining personnel data, procedures related to employee timekeeping and processing an accurate and timely payroll in accordance with state and federal laws, rules and regulations. Accurate processing of employees’ wages involves complex computations that include various salary schedules, hourly rates, stipends, types of paid and unpaid leave and deductions for employee benefits. In addition, the charter school is required to comply with the Fair Labor Standards Act in providing compensatory time and overtime pay. It is difficult to overstate the importance of internal controls over all human resources and payroll activities. For these reasons, human capital management is essential to any organization. The charter high school uses an enterprise resource planning (ERP) system to maintain data from multiple systems. Employee data entered into and maintained in the ERP system includes address, phone numbers, and other reporting criteria such as ethnicity, marital status, number of dependents, etc. The system also contains an employee’s Department of Justice clearance date and tuberculosis screening expi- ration dates, credentialing information, transcripts and salary points. Stratustime is the employee time and attendance accounting system used to record daily attendance of employees. The school’s back office financial accounting service provider, EdTec, uses Paylocity as the external payroll processing system. The NetSuite, ERP, Stratustime and Paylocity systems are not integrated with one another. As a result, employee data is entered into multiple systems by multiple people creating organizational inefficiencies and opportunity for errors and omissions in financial transactions and data. An effective position control system establishes checks and balances among personnel decisions, budgeted appropriations, and accounting tasks and entries. When properly managed, an effective position control system tracks all board-authorized positions, ensures that only authorized positions are filled, makes certain that positions are appropriated in the budget and that appropriate personnel are receiving a payroll check. Placing all tasks involved in maintaining the position control system entirely in the Business Department is not a best practice. However, it is a best practice to ensure that all personnel actions related to a position are processed first through the Business Department to verify the availability of resources required for the position and ensure they are designated in the budget. The charter high school is continuing to work toward the goal of integrating systems and has engaged directly with Paycom for personnel data management and payroll processing. Greater efficiencies and improved internal control can be achieved through the use of fully integrated position control and payroll systems. Interviews with the charter high school’s administration indicate that the Paycom system(s) fully-integrates with the NetSuite financial system. FCMAT has not reviewed or evaluated the Paycom system(s) and makes no determination about this integration. 2 The charter high school’s payroll process is currently managed by staff from four separate entities; charter high school employees, an independent contractor/consultant, EdTec and Paylocity. FCMAT obtained an understanding of the charter high school’s payroll processes during interviews with charter high school staff. The workday and absences of most charter high school employees are tracked using an electronic time keeping system, Stratustime. Each morning around 10:00 a.m. an external payroll consultant runs a time card report from Stratustime and forwards it to the administrative assistant. The administrative assistant reviews each employee’s scan “in” for the current workday and scans for the remainder of the preceding day including scans recording time “out” and “in” for lunch where applicable, and scans “out” at the end of the workday. When a missed scan is identified the office assistant initiates a missed scan form; unless the employee has already initiated one, which is most common with certificated staff who requires a substitute. A missed scans log is maintained in Excel to track the routing of the forms to ensure they are completed and returned for processing. The office assistant forwards the hard copy of the missed scan form to two payroll clerks. The payroll technicians enter the absence data in a separate Excel spreadsheet created from a Stratustime download that is saved in Google Docs by the external payroll consultant. Once the information is entered into the spreadsheet, the missed scan forms are returned to the office assistant who places them into the interoffice mailboxes of the teacher or the supervisor of the classified employee for signature and authorization. As the missed scan forms are signed, authorized and returned, the payroll technicians update the payroll worksheet then they scan and save the completed forms in Google Docs. The spreadsheet is used by the external payroll consultant who enters the missing information into the Stratustime application. The external payroll consultant downloads the updated payroll information from Stratustime into a second export payroll worksheet used to prepare the data in a format that is accessed by the payroll specialist and EdTec from Dropbox. EdTec then uses this workbook to prepare and submit payroll to Paylocity for processing. Before submission to Paylocity, EdTech submits the final workbook to the charter high school Business Department for review and approval. Once processed, EdTec enters the transactions into its financial system, which is used to prepare financial reports for the charter high school. During interviews staff reported that the Paycom system provides for the automation of preparing, authorizing and submitting absence authorization and verification forms. Each time an employee fails to scan in and out at the start and end of his or her workday, and if required during lunch break, the time recorded in the system is over- or understated. Additionally, if the appropriate corrections are not made before processing payroll, corrections on subsequent pay periods become necessary since an employee will have been either over- or underpaid for hours actually worked. The office assistant and payroll technicians initiate, route and track a significant number of absences and/or missed-scan forms each pay period. The number of systems and people involved in the process of maintaining employee data and payroll information is excessive, inefficient and highly susceptible to error. The benefit of migrating to a fully integrated system is that it eliminates the need for duplicate data entry of individual transactions into multiple systems, reducing the risk of errors and omissions in financial data. The number of staff members with duties directed towards payroll and absence tracking activities is sufficient to perform all payroll functions in-house. The charter high school’s back office financial 3 service provider, EdTec, outsources the payroll processing to Paylocity, but also plays a role in manip- ulating employee data before each payroll. Paylocity does not integrate with NetSuite. Relying on staff from multiple entities and using multiple systems to complete HR and payroll tasks is inefficient and subjects the charter high school to the risk of errors and omissions in financial information, this risk is compounded by the lack of systems integration. By contracting directly with a payroll service provider, the charter high school has likely reduced the cost of these services. A best practice is to thoroughly evaluate a service provider and integration capabilities before engage- ment. The charter high school should ensure that the payroll processing application functions fully to meet the unique requirements of K-12 public education, including retirement collections and remit- tances. Interviews with staff indicate that a peripheral demonstration of the Paycom system was provided by the vendor prior to the charter school entering into a contract. The charter high school administration also reported that they inquired with other charter schools that also outsource their payroll to Paycom to obtain feedback on system capabilities and their experience with the provider. At the time of FCMAT’s fieldwork, the charter high school had begun frontloading human resources and payroll information to Paycom with the intention of going live with full transition beginning July 1, 2019. The impact on day-to-day activities of staff is not yet known, but greater efficiencies and accuracy are expected. Interviews with staff indicate that with the transition to Paycom, employees will be able to log directly into a time-accounting system in the Paycom application through their respective computer instead of scanning in and out using the Stratustime system. This eliminates the use of a secondary time accounting system and external spreadsheets used by multiple people to modify payroll data prior to entry into an external payroll processing system. The charter high school should ensure all staff receive training on the system before full transition. Interviews with the administration indicate that a representative from Paycom will be on site to assist with the implementation and training during the month of implementation. Internal Control The accounting industry defines the term “internal control” as it applies to organizations, including school agencies. Internal control is “a process, effected by an entity’s board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives relating to operations, reporting and compliance.” [The Committee of Sponsoring Organizations of the Treadway Commission – May 2013] The reference to achievement of objectives fundamentally refers to an organization’s work of planning, organizing, directing, and performing routine tasks relative to opera- tions, and monitoring performance. An organization establishes control over its operations by setting goals, objectives, budgets and performance expectations. Several factors influence the effectiveness of internal control, including the social environment and how it affects employees’ behavior, the availability and quality of information used to monitor the organization’s operations, and the policies and procedures that guide the organization. Internal control helps an organization obtain timely feedback on its progress in meeting operational goals and guiding principles, producing reliable financial reports, and ensuring compliance with applicable laws and regulations. Internal control is the principal mechanism for preventing and/or deterring fraud or illegal acts. Illegal acts, misappropriation of assets or other fraudulent activities can include an assortment of irregularities characterized by intentional deception and misrepresentation of material facts. Effective internal control provides reasonable assurance that operations are effective and efficient, that the financial information produced is reliable, and that the organization complies with all applicable laws and regulations. 4 Internal control provides the framework for an effective fraud prevention program. An effective internal control structure includes the board policy and administrative regulations established by the board and operational procedures used by staff, adequate accounting and information systems, the work environ- ment, and the professionalism of employees. The five integrated components of internal control and their summarized characteristics are included in the table below. Internal Control Characteristics Component The set of standards, processes and structures providing the basis for carrying out internal control across an organization. Comprises the integrity and ethical values of the organization. Commonly referred to as the moral tone of the organization, Control Environment the control environment includes a code of ethical conduct; policies for ethics, hiring and promotion guidelines; proper as- signment of authority and responsibility; oversight by management, the board or an audit committee; investigation of report- ed concerns; and effective disciplinary action for violations. Identification and assessment of potential events that adversely affect the achievement of the organization’s objectives and Risk Assessment the development of strategies to react in a timely manner. Actions established by policies and procedures to enforce the governing board’s directives. These include actions by manage- Control Activities ment to prevent and identify misuse of the district’s assets, including preventing employees from overriding controls in the system. Ensures that employees receive information regarding policies and procedures and understand their responsibility for internal Information and control. Provides opportunity to discuss ethical dilemmas. Establishes clear means of communication within an organization Communication to report suspected violations. Ongoing monitoring to ascertain that all components of internal control are present and functioning; ensures deficiencies are Monitoring Activities evaluated and corrective actions are implemented. The five components of internal control are supported by 17 underlying principles that help ensure an entity achieves effective internal control. Each of the five components listed above and their relative principles must be present and functioning in an integrated manner to be effective. An effective system of internal control can provide reasonable but not absolute assurance that the organization will achieve its objectives. The internal control environment establishes the moral tone of the organization. Though intangible, it begins with the leadership and consists of employees’ perception of the ethical conduct displayed by the governing board and executive management. The control environment is a prerequisite that enables other components of internal control to be effective in achieving the goals and objectives to prevent and/ or deter fraud or illegal acts. It sets the tone for the organization, provides discipline and control, and includes factors such as integrity, ethical values and competence of employees. The control environment can be weakened significantly by a lack of experience in financial management and internal control. While the board and all employees in the district have some responsibility for internal control, the execu- tive director, governing board and other key management personnel have a higher ethical standard, fidu- ciary duty and responsibility to institute the highest standard of care in their work and to safeguard the assets of the district. Several components relative to fiduciary duties are described by Cornell law source (https://www.law.cornell.edu/wex/fiduciary_duty), which FCMAT summarizes and applies as follows: • Duty of Care: Before making a decision, collect all evidence and information available. Exercise due diligence and review all the information and evidence available, don’t just accept the information as it is presented. Assess information with a critical eye and ask the questions: who, what, when and where. A fiduciary’s responsibility is to protect the assets of the organization or agency. • Duty of Loyalty: Do not use your position in the organization to further your private interests. • Duty of Good Faith: Advance the interests of the organization. Do not violate the law. Fulfill your duties and responsibilities. 5 • Duty of Confidentiality: Keep confidential matters private, and never disclose confidential information to avoid personal liability. • Duty of Prudence: Be trustworthy to a degree of care and skill that a prudent board member, member of management, or fiduciary would exercise. Prudent means acting with wisdom and care, including exercising good judgment. • Duty of Disclosure: Act with complete candor. Be open, sincere, honest and transparent. Disclose all financial interests on Form 700, Statement of Economic Interests. As the charter high school’s leader, the executive director sets the organizational tone, influencing all activities and decisions, developing the internal control mindset of its employees. The chief business official is responsible for integrating all five internal control components into the charter high school’s administrative and operational systems. The administrative team provides leadership and direction to managers. Administrators and managers are responsible for developing and implementing specific internal control activities, communicating and monitoring those activities to ensure they are imple- mented in practice and making appropriate modifications to ensure they are effective. The governing board works as a group to provide governance, guidance and oversight. Individual board members can improve the control environment when they are inquisitive, free from bias, informed, and conduct themselves in an ethical manner. Independent auditors assess the adequacy of the internal control system in conjunction with the annual audit to determine the extent of substantive testing necessary to provide an opinion as to whether the financial statements are free of material misstatement. They also make recommendations for improve- ment where weaknesses are identified; however, this should never be the only method of monitoring internal controls. Control activities are a fundamental component of internal control and are a direct result of policies and procedures designed to prevent and detect misuse of a district’s assets, including preventing any employee from overriding system controls. Examples of control and transaction activities include the following: 1. Performance reviews, which compare actual data with expectations. In accounting and business offices, this most often occurs when budgeted amounts are compared with actual expenditures to identify variances and followed up with budget transfers to prevent overspending. 2. Information processing, which includes the approvals, authorizations, verifications and reconciliations necessary to ensure that transactions are valid, complete and accurate. 3. Physical controls, which are the processes and procedures designed to safeguard and secure assets and records. 4. Supervisory controls, which assess whether the transaction control activities performed are accurate and in accordance with established policies and procedures. 5. Segregation of duties, which consists of processes and procedures that ensure that no employee or group is placed in a position to be able to commit and conceal errors or fraud in the normal course of duties. In general, segregation of duties includes separating the custody of assets, the authorization or approval of transactions affecting those assets, the recording or reporting of related transactions, and the execution of 6 the transactions. Adequate segregation of duties reduces the likelihood that errors will remain undetected by providing for separate processing by different individuals at various stages of a transaction, and for independent review of the work. Segregation of Duties A best practice is to ensure that Human Resources (HR) personnel do not have access to process or make changes within the payroll system, and that payroll personnel do not have access to enter or make changes to employee data in the HR system. Additional layers of access control should be applied to specific personnel in the Human Resources office and the Payroll office, according to their respective roles and responsibilities. For example, the following division of functions is the industry best practice for maintaining strong internal controls: • Human Resources m Processing employee status, compensation, and benefit records m Processing employee status change documents m Preparing and updating employee master files • Payroll m Payroll calculations m Preparation of payroll disbursement records m Preparation of payroll disbursements Some control activities fall outside of the scope of work assigned to the HR and Payroll departments. For example, additional control activities include: • Review and approval of time sheets (e.g., by applicable supervisors) • Review and approval of payroll reconciliations prior to distribution of each payroll • Distribution of check stubs to employees (if online access is not provided), or of paychecks to employees who do not choose direct deposit During the July 2018 review, FCMAT noted that the charter high school had authorized and filled a new position of human resource assistant. This position is responsible for processing and orienting new employees, updating personnel data in the ERP and entering new employee data into an Excel worksheet used as the master file for personnel. The Excel worksheet is housed in Dropbox, providing centralized access to a limited number of personnel. All information for individual personnel is verified by the human resource assistant, the fiscal specialist, and executive director before it is finalized in the master file. The separation of personnel duties from other business and payroll functions strengthens the organi- zation’s internal control system. While the proper segregation of duties is essential to a strong internal control system, departments should not operate in silos. Routine communication between parties responsible for tasks assigned to Human Resources, Payroll and budget are essential not only to an agency’s system of internal control but to the organization’s fiscal health by ensuring that actual expenditures for salaries and benefits align with the budget. 7 Continued efforts should be directed towards migrating all financial functions that integrate with the current NetSuite financial solution. Once implemented, the charter high school should assess the distribution of duties for all positions within the Business Department including those related to Human Resources. Processes and procedures should be streamlined, while considering appropriate segregation of duties, eliminating manual and redundant tasks. All employees should be held accountable for their responsibilities for time accounting and completing absence requests in a timely manner. Professional Development Employees should be regularly trained not only in the areas relative to their immediate assigned duties, but also in aspects of internal control and relationships between their duties and the duties of all other positions. Knowing why an assigned task is performed in a certain way is just as important as under- standing how to complete the assigned task. Employees should also be trained in what constitutes fraud, how it damages the organization and how they may report abnormalities and/or concerns. FCMAT appreciates the opportunity to serve the El Camino Real Charter High School and extends thanks to all the staff for their cooperation and assistance during fieldwork. Sincerely, Marisa A. Ploog, CPA, CFE, CICA, CGMA Intervention Specialist 8