Central California Women's Facility Payroll Process and Transactions

CENTRAL CALIFORNIA WOMEN’S FACILITY Final Audit Report PAYROLL PROCESS AND TRANSACTIONS July 1, 2018, through June 30, 2021 M ALIA M. C OHEN C S C ALIFORNIA TATE ONTROLLER July 2026 S23-PAR-0002 STATE CONTROLLER’S OFFICE | DIVISION OF AUDITS Post Office Box 942850 | Sacramento, CA 94250 Sacramento Office: 3301 C Street, Suite 700 | Sacramento, CA 95816 | 916-324-8907 Monterey Park Office: 901 Corporate Center Drive, Suite 200 | Monterey Park, CA 91754 | 323-981-6802 www.sco.ca.gov MALIA M. COHEN CALIFORNIA STATE CONTROLLER July 3, 2026 Ms. Anissa De La Cruz, Warden Central California Women’s Facility 23370 Road 22 Chowchilla, CA 93610 Dear Ms. De La Cruz: The State Controller’s Office audited the Central California Women’s Facility’s payroll process and transactions for the period of July 1, 2018, through June 30, 2021. The audit was conducted pursuant to Government Code sections 12476 and 12410. Central California Women’s Facility’s management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll- related expenditures. If you have any questions regarding this report, please contact Roochel Espilla, Chief, State Agency Audits Bureau, by telephone at 916-323-5744. Thank you. Sincerely, Original signed by Kimberly A. Tarvin, CPA Chief, Division of Audits MAILING ADDRESS P.O. Box 942850, Sacramento, CA 94250 SACRAMENTO 3301 C Street, Suite 700, Sacramento, CA 95816 | 916.324.8907 LOS ANGELES 901 Corporate Center Drive, Suite 200, Monterey Park, CA 91754 | 323.981.6802 Ms. Anissa De La Cruz July 3, 2026 Page 2 of 2 Copy: Jessilee Rubalcava, Institutional Personnel Officer Central California Women’s Facility Jeff Macomber, Secretary California Department of Corrections and Rehabilitation Jennifer Barretto, Undersecretary of Administration California Department of Corrections and Rehabilitation Stacy Lopez, Director Division of Administrative Services California Department of Corrections and Rehabilitation Danyal Noel, Deputy Director of Human Resources California Department of Corrections and Rehabilitation Mai Lee Vang, External Audits Manager California Department of Corrections and Rehabilitation Helen Fairchild, Chief Administrative Services Division California Department of Human Resources Lisa Dean, Acting Chief Personnel and Payroll Services Division State Controller’s Office Veronica Encinas, Bureau Chief Personnel and Payroll Services Division State Controller’s Office Jennifer Burkett, Project Director California State Payroll System Project State Controller’s Office MAILING ADDRESS P.O. Box 942850, Sacramento, CA 94250 SACRAMENTO 3301 C Street, Suite 700, Sacramento, CA 95816 | 916.324.8907 LOS ANGELES 901 Corporate Center Drive, Suite 200, Monterey Park, CA 91754 | 323.981.6802 Office of the State Controller | Central California Women’s Facility Payroll Process and Transactions Final Audit Report July 2026 CONTENTS SUMMARY 1 BACKGROUND 1 AUDIT AUTHORITY 2 OBJECTIVES, SCOPE, AND METHODOLOGY 2 CONCLUSION 5 FOLLOW-UP ON PRIOR AUDIT FINDINGS 6 VIEWS OF RESPONSIBLE OFFICIALS 7 RESTRICTED USE 7 SCHEDULE—SUMMARY OF AUDIT RESULTS 8 FINDINGS AND RECOMMENDATIONS 10 APPENDIX—AUDIT SAMPLING METHODOLOGY 30 ATTACHMENT—CENTRAL CALIFORNIA WOMEN’S FACILITY RESPONSE TO DRAFT AUDIT REPORT 32 Office of the State Controller | Central California Women’s Facility Payroll Process and Transactions Final Audit Report July 2026 SUMMARY The State Controller’s Office (SCO) audited the Central California Women’s Facility’s (CCWF) payroll process and transactions for the period of July 1, 2018, through June 30, 2021. CCWF’s management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. Our audit determined that CCWF administered salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. However, we also found that CCWF did not: • Maintain adequate and effective internal controls over certain aspects of its payroll process, as described in Findings 1 through 7; or • Process payroll and payroll-related disbursements accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures in certain instances, as described in Findings 3 through 7. BACKGROUND The SCO maintains the State’s payroll system in accordance with Government Code (GC) section 12470 et seq. The system is decentralized, allowing state agencies and departments to process their own payroll-related transactions. The SCO conducts periodic payroll audits to gain assurance that state agencies and departments maintain adequate internal control over the payroll function, provide proper oversight of their decentralized payroll processing, and comply with various state laws and regulations regarding payroll processing and related transactions. -1- Office of the State Controller | Central California Women’s Facility Payroll Process and Transactions Final Audit Report July 2026 All users of the State’s payroll system must comply with the Decentralized Security Program Manual (DSP Manual), issued by the SCO’s Personnel and Payroll Services Division, in order to access the payroll system. The DSP Manual defines the SCO’s security requirements and describes users’ responsibilities, which include securing, maintaining, and monitoring the confidentiality and integrity of sensitive and confidential data; and protecting data and systems against misuse, abuse, and unauthorized use. AUDIT AUTHORITY We conducted this audit in accordance with GC section 12476, which authorizes the SCO to audit the State’s payroll system, the State Payroll Revolving Fund, and related records of state agencies within the State’s payroll system. In addition, GC section 12410 provides the SCO with general authority to audit the disbursement of state money for correctness, legality, and sufficient provisions of law for payment. OBJECTIVES, SCOPE, AND METHODOLOGY We performed this audit to determine whether CCWF: • Maintained adequate and effective internal controls over its payroll process; • Processed payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures; and • Administered salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. The audit covered the period from July 1, 2018, through June 30, 2021. The audit population consisted of payroll transactions totaling $343,171,592, as quantified in the Schedule. -2- Office of the State Controller | Central California Women’s Facility Payroll Process and Transactions Final Audit Report July 2026 In planning and performing our audit of compliance, we considered CCWF’s internal control over compliance with collective bargaining agreements and state laws, regulations, policies, and procedures to determine the auditing procedures that were appropriate under the circumstances for the purpose of providing a conclusion on compliance, and to test and report on internal control over compliance. Our consideration of internal control over compliance was for the limited purpose described in the previous paragraph. Our audit was not designed to identify all deficiencies in internal control over compliance that might be material weaknesses or significant deficiencies. As discussed in the Conclusion section, we identified certain deficiencies in internal control over compliance that we consider to be material weaknesses. A deficiency in internal control over compliance exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance with provisions of laws, regulations, or contracts on a timely basis. Control deficiencies, either individually or in combination with other control deficiencies, may be evaluated as significant deficiencies or material weaknesses. A material weakness in internal control over compliance is a deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected on a timely basis. A significant deficiency in internal control over compliance is a deficiency, or a combination of deficiencies, in internal control over compliance with provisions of laws, regulations, or contracts that is less severe than a material weakness, yet important enough to merit attention from those charged with governance. To achieve our audit objectives, we performed the following procedures: • We reviewed state and CCWF policies and procedures related to the payroll process to understand CCWF’s methodology for processing various payroll and payroll-related transactions. -3- Office of the State Controller | Central California Women’s Facility Payroll Process and Transactions Final Audit Report July 2026 • We interviewed CCWF payroll personnel to understand CCWF’s methodology for processing various payroll and payroll-related transactions, determine the employees’ level of knowledge and ability relating to payroll transaction processing, and gain an understanding of existing internal control over the payroll process and systems. • We selected transactions recorded in the State’s payroll system using statistical sampling, as outlined in the Appendix; judgmental selection; and targeted selection based on risk factors and other relevant criteria. • We analyzed and tested the selected transactions, and reviewed relevant files and records to determine the accuracy of payroll and payroll-related payments; the accuracy of leave transactions; the adequacy and effectiveness of internal control over the payroll process; and compliance with collective bargaining agreements and state laws, regulations, policies, and procedures. • We reviewed salary advances to determine whether CCWF administered and recorded them in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. • We assessed the reliability of computer-processed data on payroll and payroll-related transactions by interviewing CCWF officials knowledgeable about the data; reviewing existing information about the data and the system that produced it; and tracing data to source documents, based on statistical sampling and judgmental and targeted selection. We determined that the data was sufficiently reliable for the purposes of this report. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. -4- Office of the State Controller | Central California Women’s Facility Payroll Process and Transactions Final Audit Report July 2026 CONCLUSION Our audit determined that CCWF administered salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. However, we also found that CCWF did not maintain adequate and effective internal controls over its payroll process; and did not process payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. We found deficiencies in internal control over the payroll process that we consider to be material weaknesses; and instances of noncompliance with the requirements of collective bargaining agreements and state laws, regulations, policies, and procedures. The material weaknesses and instances of noncompliance are as follows: • CCWF had inadequate segregation of duties and compensating controls over payroll transactions (see Finding 1). • Eleven of the 30 (37 percent) employees whose records we examined during the audit had inappropriate access to the State’s payroll system (see Finding 2). • Supporting documentation was not consistently maintained for leave buy-back payments. During our examination of 56 transactions, we noted that supporting documentation for four (seven percent) transactions had not been retained. We identified $14,894 and projected an additional $17,966 in unsupported payments (see Finding 3). • Two of the 109 (two percent) overtime pay transactions that we examined were overpaid by a total of $1,511 and one of the transactions was underpaid by $401. We projected an additional $3,001 in overpayments and $125,169 in underpayments. We also noted that timesheets and calculations were not consistently maintained for overtime pay, as supporting documentation for six (six percent) transactions had not been retained. We -5- Office of the State Controller | Central California Women’s Facility Payroll Process and Transactions Final Audit Report July 2026 identified $41,239 and projected an additional $437,108 in unsupported transactions (see Finding 4). • One of the 88 employees whose separation lump-sum payments we examined was overpaid by $651, and nine (10 percent) employees were underpaid by $25,327. We projected an additional $2,076 in overpayments and $19,648 in underpayments. We also noted that CCWF did not make separation lump-sum payments to 12 (14 percent) employees in a timely manner. Furthermore, documentation was not consistently maintained for separation lump-sum payments, as supporting documentation for payments made to four (five percent) employees had not been retained. We identified $161,547 and projected an additional $183,614 in unsupported payments (see Finding 5). • CCWF had inadequate controls to ensure that it adhered to requirements limiting the accumulation of vacation and annual leave credits. This resulted in liability for excessive vacation and annual leave balances with a value of at least $73,119, as of October 1, 2020 (see Finding 6). • Sixteen of the 109 (15 percent) holiday pay transactions that we examined were overpaid by $3,288 and one transaction was underpaid by $22. We projected an additional $40,836 in overpayments and $1,440 in underpayments. We also noted that timesheets were not consistently maintained for holiday pay, as supporting documentation for one transaction had not been retained. We identified $347 and projected an additional $22,275 in unsupported transactions (see Finding 7). FOLLOW-UP ON PRIOR AUDIT FINDINGS We have not previously conducted an audit of CCWF’s payroll process and transactions. -6- Office of the State Controller | Central California Women’s Facility Payroll Process and Transactions Final Audit Report July 2026 VIEWS OF RESPONSIBLE OFFICIALS We issued a draft audit report on August 1, 2025. A CCWF representative responded by letter dated August 15, 2025, acknowledging the audit results. CCWF also provided additional information regarding excess vacation and annual leave balances, as described in Finding 6. Our comment on CCWF’s response to Finding 6 is included in the Findings and Recommendations section. This final audit report includes CCWF’s response as an attachment. RESTRICTED USE This audit report is solely for the information and use of CCWF, the California Department of Corrections and Rehabilitation, and the SCO; it is not intended to be, and should not be, used by anyone other than these specified parties. This restriction is not intended to limit distribution of this audit report, which is a matter of public record and is available on the SCO website at www.sco.ca.gov. Original signed by Kimberly A. Tarvin, CPA Chief, Division of Audits July 3, 2026 -7- Office of the State Controller | Central California Women’s Facility Payroll Process and Transactions Final Audit Report July 2026 SCHEDULE—SUMMARY OF AUDIT RESULTS July 1, 2018, through June 30, 2021 Legend for Column 2, Method of Selection: FE = 100 percent examined; J = Judgmental; S = Statistical; T = Targeted. Legend for Column 6, Selection Unit: EM = Employee; TR = Transaction. Net Total Dollar Amount of Net Total Projected Dollar Improper Costs Number Dollar Amount of and Identified Audit Method of Units Dollar Number of Amount of Identified and Projected Area of of Amount of Selections Selection Selections Improper Unsupported Tested Selection Population Population Examined Unit Examined Costs Costs Reference Segregation Intentionally left blank Intentionally left blank Intentionally left blank Intentionally left blank Intentionally left blank Intentionally left blank Intentionally left blank Intentionally left blank Finding 1 of duties System FE 30 Intentionally left blank 30 EM Intentionally left blank Intentionally left blank Intentionally left blank Finding 2 access Regular S 42,532 $288,393,380 77 TR $509,482 $0 $0 Intentionally left blank pay Leave S 124 515,178 56 TR 233,517 0 32,860 Finding 3 buy-back Overtime S, J 22,798 38,812,440 109 TR 408,096 1,110 356,179 Finding 4 pay -8- Office of the State Controller | Central California Women’s Facility Payroll Process and Transactions Final Audit Report July 2026 Net Total Dollar Amount of Net Total Projected Dollar Improper Costs Number Dollar Amount of and Identified Audit Method of Units Dollar Number of Amount of Identified and Projected Area of of Amount of Selections Selection Selections Improper Unsupported Tested Selection Population Population Examined Unit Examined Costs Costs Reference Separation S, T 270 7,906,928 88 EM 4,383,607 -24,676 327,589 Finding 5 lump-sum pay Excess T 70 1,853,787 70 EM 1,853,787 73,119 0 Finding 6 vacation and annual leave Holiday pay S, J, T 5,671 2,000,911 109 TR 38,066 3,266 62,018 Finding 7 Holiday J, T 9,203 3,632,878 44 TR 35,265 0 0 Intentionally left blank credit Salary J 18 56,090 9 EM 13,994 0 0 Intentionally left blank advance Total $343,171,592 $7,475,814 $52,819 $778,646 Intentionally left blank Intentionally left blank Intentionally left blank Intentionally left blank Intentionally left blank -9- Office of the State Controller | Central California Women’s Facility Payroll Process and Transactions Final Audit Report July 2026 FINDINGS AND RECOMMENDATIONS Finding 1—Inadequate Segregation of Duties and Compensating Controls over Payroll Transactions CCWF lacked adequate segregation of duties within its payroll transactions unit to ensure that only valid and authorized payroll transactions were processed. CCWF also failed to implement other controls to compensate for this risk. Our audit found that CCWF payroll transactions unit staff performed conflicting duties. Staff members performed multiple steps in processing payroll transactions, including entering data into the State’s payroll system; auditing employee timesheets; reconciling payroll, including reconciling system output to source documentation; reporting payroll exceptions; and processing adjustments. CCWF failed to demonstrate that it implemented compensating controls to mitigate the risks associated with such a deficiency. We found no indication that these functions were subjected to periodic supervisory review. The lack of adequate segregation of duties and compensating controls impairs the effectiveness of other controls by rendering their design ineffective or by keeping them from operating effectively. These control deficiencies, in combination with other deficiencies discussed in Findings 2 through 7, represent a material weakness in internal control over the payroll process such that there is a reasonable possibility that material noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. Internal control best practices require that the following functional duties be performed by different work units, or at minimum, by different employees within the same unit: • Recording transactions – This duty refers to the record-keeping function, which is accomplished by entering data into a computer system. -10- Office of the State Controller | Central California Women’s Facility Payroll Process and Transactions Final Audit Report July 2026 • Authorization to execute – This duty belongs to individuals with authority and responsibility to initiate and execute transactions. • Periodic review and reconciliation of actual payments to recorded amounts – This duty refers to making comparisons of information at regular intervals and taking action to resolve differences. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including proper segregation of duties and an effective system of internal review. Adequate segregation of duties reduces the likelihood that fraud or error will remain undetected by providing for separate processing by different individuals at various stages of a transaction and for independent reviews of the work performed. Recommendation We recommend that CCWF: • Separate conflicting payroll functional duties to the greatest extent possible. Adequate segregation of duties will provide a stronger system of internal control whereby the functions of each employee are subject to the review of another. If it is not possible to segregate payroll functions fully and appropriately, CCWF should implement compensating controls. For example, if the payroll transactions unit staff member responsible for recordkeeping also performs a reconciliation process, then the supervisor should perform and document a detailed review of the reconciliation to provide additional control over the assignment of conflicting functions. Compensating controls may also include dual authorization requirements and documented reviews of payroll system input and output; and • Develop formal procedures for performing and documenting compensating controls. -11- Office of the State Controller | Central California Women’s Facility Payroll Process and Transactions Final Audit Report July 2026 Finding 2—Inappropriate Access to the State’s Payroll System CCWF lacked adequate controls to ensure that only appropriate staff members had access to the State’s payroll system. CCWF inappropriately allowed 11 employees access to the State’s payroll system. If not mitigated, this control deficiency leaves payroll data at risk of misuse, abuse, and unauthorized use. We examined the records of 30 CCWF employees who had access to the State’s payroll system at various times during the audit period. Of the 30 employees, 11 (37 percent) had inappropriate access to the State’s payroll system. Specifically, CCWF did not immediately remove or modify access for the employees after the employees’ separation from state service, transfer to another agency, or change in classification. For example, an Office Technician left CCWF on September 16, 2018, but CCWF did not request to remove the employee’s access until December 17, 2019, a total of 92 days later. CCWF lacked periodic review of access granted to employees to ensure compliance with the DSP Manual. Criteria The December 2015 DSP Manual (“Access Requirements,” page 13) states, in part: The [State’s payroll system] contains sensitive and confidential information. Access is restricted to persons with an authorized, legal, and legitimate business requirement to complete their duties. . . . If the employee’s duties change, such that the need for access no longer exists, the access privilege MUST be removed or deleted immediately by a request submitted by the department/campus. The June 2020 DSP Manual (“Access Requirements,” pages 6–7) states, in part: The [State’s payroll system] contains sensitive and confidential information. Access is restricted to persons with an authorized, legal, and legitimate business requirement to complete their regular daily duties. . . . -12- Office of the State Controller | Central California Women’s Facility Payroll Process and Transactions Final Audit Report July 2026 If the employee’s duties change, such that the need for access no longer exists, the access privilege MUST be removed or deleted immediately via a request submitted by the department/campus. The October 2020 DSP Manual (“Access Requirements,” pages 5–6) states, in part: The [State’s payroll system] contains sensitive and confidential information. Access is restricted to persons with an authorized, legal, and legitimate business requirement to complete their regular daily duties. . . . If the employee’s duties change, such that the need for access no longer exists, the access privilege MUST be removed or deleted immediately via a request submitted by the department/campus Security Monitor/Assistant Security Monitor. . . . The December 2015 DSP Manual (“Revocation and Deletion of User IDs,” page 17) states, in part: To prevent unauthorized use by a transferred, terminated or resigned employee’s user ID, the Security Monitor must IMMEDIATELY submit all pages of the PSD125A [Security Authorization Form] to delete the user’s system access. Using an old user ID increases the chances of a security breach which is a serious security violation. Sharing a user ID is strictly prohibited and a serious violation. . . . The June 2020 DSP Manual (“Revocation and Deletion of User IDs,” page 10) states, in part: To prevent unauthorized use by a transferred, terminated or resigned employee’s User ID, the Security Monitor must IMMEDIATELY submit all pages of the PSD125A [Security Authorization Form] signed by both Security Monitor and Authorizing Manager to delete the user’s system access. Using an old User ID increases the risk of a security breach, which is a serious security violation. Sharing a User ID is strictly prohibited. . . . -13- Office of the State Controller | Central California Women’s Facility Payroll Process and Transactions Final Audit Report July 2026 The October 2020 DSP Manual (“Revocation and Deletion of User IDs,” page 7) states, in part: To prevent unauthorized use by a transferred, terminated or resigned employee’s User ID, the Security Monitor must IMMEDIATELY contact [the Decentralized Security Administrator] by email. The Security Monitor/Assistant Security Monitor must electronically submit all pages of the PSD125A [Security Authorization Form] signed by both Security Monitor/Assistant Security Monitor and Authorizing Official/Assistant Authorizing Official to delete the user’s system access. Using an old User ID increases the risk of a security breach, which is a serious security violation. Sharing a User ID is strictly prohibited. . . . Recommendation We recommend that CCWF: • Update access to the State’s payroll system immediately after employees change classifications, transfer to another unit, or leave CCWF; and • Periodically review access to the system to verify that access complies with the DSP Manual. Finding 3—Missing Documentation for Leave Buy-back Payments CCWF lacked adequate segregation of duties within its payroll transactions unit, as noted in Finding 1. CCWF also lacked adequate controls to ensure that supporting documentation was maintained to support leave buy-back payments. A leave buy-back occurs when an employee receives payment at the regular salary rate in exchange for accrued vacation, annual leave, personal leave, personal holiday, and/or holiday credits. The California Department of Human Resources (CalHR) authorized leave buy-backs for excluded employees in fiscal year 2018-19 and fiscal year 2020-21. It also provided the State’s policies and procedures regarding cash-out of vacation and annual leave. -14- Office of the State Controller | Central California Women’s Facility Payroll Process and Transactions Final Audit Report July 2026 Payroll records show that CCWF processed 124 leave buy-back transactions, totaling $515,178, during the audit period. We randomly selected a statistical sample (as described in the Appendix) of 56 transactions, totaling $233,517. Based on our examination of these transactions, we found that CCWF lacked supporting documentation (leave buy-back forms and calculations) associated with four (seven percent) transactions totaling $14,894. Without the required documentation, we could not determine the validity, accuracy, and propriety of the payments made to the employees or the completeness and accuracy of the leave accounting records. If not mitigated, these control deficiencies leave CCWF at risk of making improper leave buy- back payments. Statistical Sampling Results The identified value of unsupported payments has a net total of $14,894. We used a statistical sampling method to select the leave buy-back transactions that we examined. We projected an additional $17,966 in unsupported payments. Therefore, the identified and projected unsupported payments totaled $32,860. The following table summarizes the results of our statistical sampling (amounts are rounded to the nearest dollar): Calculation of Projected Errors Amount Identified unsupported payments $14,894 Divide by: Sample 233,517 Error rate for projection (differences due to rounding) 6.38% Population that was statistically sampled 515,178 Multiply by: Error rate for projection 6.38% Identified and projected unsupported payments (differences due to rounding) 32,860 Less: Identified unsupported payments 14,894 Projected unsupported payments $17,966 -15- Office of the State Controller | Central California Women’s Facility Payroll Process and Transactions Final Audit Report July 2026 Criteria GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Title 2, California Code of Regulations, section 599.744 provides that CalHR may also authorize a leave buy-back program for employees excluded from collective bargaining. Collective bargaining agreements between the State and various bargaining units allow for the annual cash-out of a certain number of hours of accumulated vacation and annual leave if funds are available. CCWF’s General Retention Schedule for Payroll/Personnel Records specifies a four-year retention period for leave buy-back supporting documentation. Recommendation We recommend that CCWF maintain supporting documentation for leave buy-back payments pursuant to its retention policies. Finding 4—Improper Payments and Missing Timesheets for Overtime Pay CCWF lacked adequate segregation of duties within its payroll transactions unit, as noted in Finding 1. CCWF also lacked adequate controls over the processing of overtime pay, and adequate controls to ensure that timesheets were maintained to support overtime payments. -16- Office of the State Controller | Central California Women’s Facility Payroll Process and Transactions Final Audit Report July 2026 Payroll records show that CCWF processed 22,798 overtime pay transactions, totaling $38,812,440, during the audit period as follows: Overtime Payment Type by Group Unit Amount Work Week Group 2, less than 150 hours per transaction (statistically sampled) 22,385 $37,196,027 Work Week Group 2, at least 200 hours per transaction (judgmentally selected eight payments) 79 704,802 Work Week Group SE (judgmentally selected 24 payments) 334 911,611 Total population 22,798 $38,812,440 Work Week Group 2 – Paid for less than 150 hours (statistically sampled) Of the 22,385 overtime pay transactions, totaling $37,196,027, for Work Week Group (WWG) 2 employees who were paid for less than 150 hours of overtime per transaction, we randomly selected a statistical sample (as described in the Appendix) of 77 transactions, totaling $118,863. Of the 79 overtime pay transactions, totaling $704,802, for WWG 2 employees who were paid for at least 150 hours of overtime per transaction, we judgmentally selected eight transactions, totaling $87,340. Of the 334 overtime pay transactions, totaling $911,611, for WWG SE employees who are eligible to receive overtime pay under special circumstances, we judgmentally selected 24 transactions, totaling $201,893. Based on our examination of these selected transactions, we found the following errors: • CCWF overpaid the employees in two (two percent) transactions by a total of $1,511 and underpaid the employee in one transaction by $401 because payroll transactions unit staff members miscalculated overtime hours worked, failed to verify that the employee was eligible for overtime pay, and incorrectly entered the overtime hours worked into the payroll system. -17- Office of the State Controller | Central California Women’s Facility Payroll Process and Transactions Final Audit Report July 2026 • CCWF lacked timesheets and calculations associated with six (six percent) transactions with a value of $41,239. Without the required documentation, we could not determine the validity, accuracy, and propriety of the payments made to the employees; or the completeness and accuracy of the leave accounting records. If not mitigated, these control deficiencies leave CCWF at risk of making additional improper overtime payments. Statistical Sampling Results For projection purposes, the identified improper and unsupported payments have a net total value of $1,010. We used a statistical sampling method to select the overtime pay transactions for WWG 2 employees who were paid for less than 150 hours of overtime per transaction that we examined. We projected an additional $3,001 in overpayments and $125,169 in underpayments; we also projected an additional $437,108 in unsupported payments. The projected improper and unsupported payments have a net total of $314,940. The identified and projected improper and unsupported payments totaled a net of $315,950, consisting of $3,011 in overpayments, $125,570 in underpayments, and $438,509 in unsupported payments. The following table summarizes the results of our statistical sampling (amounts are rounded to the nearest dollar): Calculation of Projected Errors Amount Identified improper and unsupported payments, net $1,010 Divide by: Sample 118,863 Error rate for projection (differences due to rounding) 0.85% Population that was statistically sampled 37,196,027 Multiply by: Error rate for projection 0.85% Identified and projected improper and unsupported payments, net (differences due to rounding) 315,950 Less: Identified improper and unsupported payments, net 1,010 Projected improper and unsupported payments, net $314,940 -18- Office of the State Controller | Central California Women’s Facility Payroll Process and Transactions Final Audit Report July 2026 Criteria GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Collective bargaining agreements between the State and various bargaining units, and state laws and policies, contain specific clauses regarding overtime pay. CCWF’s General Retention Schedule for Payroll/Personnel Records specifies a four-year retention period for timesheets and calculations. Recommendation We recommend that CCWF: • Conduct a review of overtime payments made during the past three years to ensure that the payments complied with collective bargaining agreements and state laws and policies; • Recover any overpayments made to employees through an agreed-upon collection method in accordance with GC section 19838 and State Administrative Manual (SAM) sections 8291, 8291.1, and 8293; and • Properly compensate those employees who were underpaid. We further recommend that, to prevent improper overtime payments from recurring, CCWF: • Establish adequate internal controls to ensure that accurate calculations of payments are properly supported and maintained; • Provide adequate oversight to ensure that payroll transactions unit staff members process only valid and authorized payments that comply with collective bargaining agreements and state laws and policies; and • Maintain supporting documentation for payments pursuant to its retention policies. -19- Office of the State Controller | Central California Women’s Facility Payroll Process and Transactions Final Audit Report July 2026 Finding 5—Improper and Late Payments, and Missing Documentation for Separation Lump-sum Pay CCWF lacked adequate segregation of duties within its payroll transactions unit, as noted in Finding 1. CCWF also lacked adequate supervisory review to ensure accurate and timely processing of separation lump-sum pay, and adequate controls to ensure that documentation was maintained to support separation lump-sum payments. Payroll records show that CCWF processed separation lump-sum payments, totaling $7,906,928, for 270 employees during the audit period, as follows: Separation Lump-Sum Payment Type by Group Unit Amount Employees who were paid at least $100,000 (items examined 100%) 22 $3,279,919 Employees who were paid less than $100,000 (statistically sampled) 248 4,627,009 Total population 270 $7,906,928 We selected and examined the records of all 22 employees who were paid at least $100,000. These employees received a total of $3,279,919 in separation lump-sum payments. Of the 248 employees who were paid less than $100,000 in separation lump-sum pay, we randomly selected a statistical sample (as described in the Appendix) of 66 employees who received separation lump-sum payments, totaling $1,103,688. Based on our examination of the records of the 88 selected employees, we found the following errors: • CCWF overpaid one of the employees by $651 and underpaid nine (10 percent) employees by a total of $25,327 because payroll transactions unit staff members miscalculated leave credits paid. -20- Office of the State Controller | Central California Women’s Facility Payroll Process and Transactions Final Audit Report July 2026 • CCWF did not make separation lump-sum payments to 12 (14 percent) employees in a timely manner. • CCWF could not locate supporting documents (lump-sum calculation worksheets, leave balance statements, state calendars, and timesheets) for payments, totaling $161,547, made to four (five percent) employees. We could not determine the validity, accuracy, and propriety of the payments made to these employees; or the completeness and accuracy of the leave accounting records. If not mitigated, these control deficiencies leave CCWF at risk of making additional improper and late separation lump-sum payments, noncompliance with agreements and laws, and liability for late payments. Statistical Sampling Results For projection purposes, the identified improper and unsupported payments have a net total value of $52,013. We used a statistical sampling method to select the employees who were paid less than $100,000 in separation lump-sum pay whose payments we examined. We projected an additional $2,076 in overpayments and $19,648 in underpayments; we also projected an additional $183,614 in unsupported payments. The projected improper and unsupported payments totaled a net of approximately $166,042. The identified and projected improper and unsupported payments totaled a net of approximately $218,055, consisting of $2,727 in overpayments, $25,803 in underpayments, and $241,131 in unsupported payments. The following table summarizes the results of our statistical sampling (amounts are rounded to the nearest dollar): Calculation of Projected Errors Amount Identified improper payments and unsupported payments, net $52,013 Divide by: Sample 1,103,688 Error rate for projection (differences due to rounding) 4.71% -21- Office of the State Controller | Central California Women’s Facility Payroll Process and Transactions Final Audit Report July 2026 Calculation of Projected Errors Amount Population that was statistically sampled 4,627,009 Multiply by: Error rate for projection 4.71% Identified and projected improper and unsupported payments, net (differences due to rounding) 218,055 Less: Identified improper and unsupported payments, net 52,013 Projected improper and unsupported payments, net $166,042 Criteria GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. GC section 19839 allows lump-sum payment for accrued eligible leave credits when an employee separates from state employment. Collective bargaining agreements between the State and various bargaining units include similar provisions regarding separation lump-sum pay. Collective bargaining agreements and state laws summarized in section 1703 of CalHR’s Human Resources Manual establish separation lump-sum pay requirements. Recommendation We recommend that CCWF: • Conduct a review of separation lump-sum payments made during the past three years to ensure that the payments were accurate and in compliance with collective bargaining agreements and state law; • Recover overpayments made to separated employees in accordance with GC section 19838 and SAM sections 8291, 8291.1, and 8293; and • Properly compensate those employees who were underpaid. -22- Office of the State Controller | Central California Women’s Facility Payroll Process and Transactions Final Audit Report July 2026 We further recommend that, to prevent inaccurate and untimely processing of separation lump- sum payments from recurring, CCWF: • Establish adequate controls to ensure that payments are calculated accurately; • Establish adequate controls to ensure that payments are made in a timely manner; and • Maintain supporting documentation for payments pursuant to its retention policies. Finding 6—Excess Vacation and Annual Leave Balances CCWF’s leave accounting records indicate that 70 of the 1,591 (four percent) employees with unused vacation or annual leave credits exceeded the limit set by collective bargaining agreements and state regulations as of October 1, 2020. These 70 employees accumulated 29,853 hours of excess vacation and annual leave, with a value of at least $1,853,787 as of October 1, 2020. This estimated liability does not adjust for salary rate increases and additional leave credits. Most state employees receive pay rate increases every year pursuant to state laws and/or collective bargaining agreements until they reach the top of their pay scale, or promote into a higher-paying position. In addition, when an employee’s accumulated leave balances upon separation are calculated for lump-sum pay, the employee is credited with additional leave credits equal to the amount that the employee would have earned had the employee taken time off and not separated from state service. Accordingly, we expect that the amount needed to pay for this liability will be higher. Collective bargaining agreements and state regulations limit the amount of vacation and annual leave that state employees may accumulate. The limit on leave balances helps state agencies manage leave balances and control the State’s liability for accrued leave credits. State agencies may allow employees to carry a higher leave balance only under limited circumstances. For example, an employee may not be able to reduce accrued vacation or annual leave hours below the limit due to business needs. When an employee’s leave -23- Office of the State Controller | Central California Women’s Facility Payroll Process and Transactions Final Audit Report July 2026 accumulation exceeds or is projected to exceed the limit, state agencies should work with the employee to develop a written plan for reducing leave balances below the applicable limit. On October 20, 2020, CalHR directed departments to immediately suspend policies that require leave balances to be reduced below the limit, and that require employees to implement leave-reduction plans. This suspension was in effect until the 2020 Personal Leave Program ended on June 30, 2021. Therefore, we examined employees’ vacation and annual leave balances as of October 1, 2020. We examined the records of all 70 employees with excess vacation or annual leave to determine whether CCWF complied with collective bargaining agreements and state regulations. Of the 70 employees whose records we examined, six did not comply with collective bargaining agreements and state regulations for the following reasons: • CCWF had no plans in place during the audit period for the employees to reduce leave balances below the limit. • CCWF could not demonstrate that, if the employees were unable to reduce their vacation and leave balances, it had allowed the employees to maintain excess balances because of the extenuating circumstances specified in the agreements and regulations. These six employees accumulated 969 hours of excess vacation and annual leave balances, with a value of at least $73,119 as of October 1, 2020. If CCWF does not take action to reduce the excessive leave balances, the liability for accrued vacation and annual leave will likely increase because most employees will receive salary increases or use other non-compensable leave credits instead of vacation or annual leave, thus increasing their vacation or annual leave balances. The state agency responsible for paying these leave balances may face a cash flow problem if a significant number of employees with excessive vacation or annual leave balances separate from state service. Normally, state agencies are not budgeted to make these separation lump- -24- Office of the State Controller | Central California Women’s Facility Payroll Process and Transactions Final Audit Report July 2026 sum payments. However, the State’s current practice dictates that the state agency that last employed an employee pays for that employee’s separation lump-sum payment, regardless of where the employee accrued the leave balance. Collective bargaining agreements between the State and various bargaining units and state regulations limit the amount of vacation and annual leave that most state employees may accumulate to no more than 80 days (640 hours). Current collective bargaining agreements between the State and Bargaining Units 1, 3, 4, 15, 17, and 19 temporarily increased the limit by 120 hours. Recommendation We recommend that CCWF: • Implement controls, including existing policies and procedures, to ensure that its employees’ vacation and annual leave balances are maintained within levels allowed by collective bargaining agreements and state regulations; • Conduct ongoing monitoring of controls to ensure that they are implemented and operating effectively; and • Participate in leave buy-back programs if the State offers such programs and funds are available. CCWF’s Response CCWF has implemented the leave reduction plan requirements beginning July 2019 to comply with the applicable leave reduction effort policies. Employees with leave balances over the cap are required to have leave reduction plans that are approved by their respective supervisors on file. Each year, [the California Department of Corrections and Rehabilitation headquarters Human Resources] sends out an email to all staff requiring the completion and documentation of leave reduction plans for all employees in excess or approaching leave credit balance limitations. [The California Department of -25- Office of the State Controller | Central California Women’s Facility Payroll Process and Transactions Final Audit Report July 2026 Corrections and Rehabilitation headquarters Human Resources] provides a list of those who are at the max or approaching the maximum hours allowed per the respective [Memorandum of Understanding]. Utilizing the list provided, the [Institutional Personnel Officer] tracks and ensures a Leave Reduction Form is received for those identified. This annual process assists in reducing vacation and annual leave balances to avoid future liability for excessive leave balances. CCWF has implemented these internal controls to minimize the Department’s future liabilities. SCO Comment Our finding and recommendation remain unchanged. We appreciate the additional clarification and willingness of CCWF to implement corrective actions to improve its internal controls over excessive leave balances. However, as stated in this report, CCWF had no plans in place during the audit period for the six employees who accumulated excess vacation and annual leave balances. Finding 7—Improper and Unsupported Holiday Payments CCWF lacked adequate segregation of duties within its payroll transactions unit, as noted in Finding 1. CCWF also lacked adequate supervisory review to ensure accurate processing of holiday pay, and adequate controls to ensure that timesheets were maintained to support holiday payments. -26- Office of the State Controller | Central California Women’s Facility Payroll Process and Transactions Final Audit Report July 2026 Payroll records show that CCWF processed 5,671 holiday pay transactions, totaling $2,000,911, during the audit period: Holiday Payment Type by Group Unit Amount Employees paid for more than 24 hours 13 $1,817 (items examined 100%) Employees paid for 24 hours or less 5,470 1,934,179 (statistically sampled) Correction Officers paid for a Saturday holiday 188 64,915 (judgmentally selected 19 payments) Total population 5,671 $2,000,911 We examined all 13 holiday pay transactions, totaling $1,817, for employees who were paid for more than 24 hours. Of the 5,470 holiday pay transactions—totaling $1,934,179—for employees who were paid for 24 hours or less, we randomly selected a statistical sample (as described in the Appendix) of 77 transactions, totaling $29,683. Of the 188 holiday pay transactions—totaling $64,915—that also included holiday credits of eight hours or more for Correctional Officers in a month with a Saturday holiday, we judgmentally selected 19 transactions, with a value of at least $6,566. Based on our examination of the records of these 109 holiday pay transactions, we found the following errors: • CCWF overpaid the employees in 16 (15 percent) transactions by a total of $3,288 and underpaid the employee in one of the transactions by $22 because payroll transactions unit staff members improperly granted holiday credits in addition to holiday pay, granted an incorrect number of holiday hours, and improperly calculated holiday credit hours. • CCWF lacked timesheets associated with one of the transactions with a value of $347. Without the required documentation, we could not determine the validity, accuracy, and -27- Office of the State Controller | Central California Women’s Facility Payroll Process and Transactions Final Audit Report July 2026 propriety of the payments made to the employees; or the completeness and accuracy of the leave accounting records. If not mitigated, these control deficiencies leave CCWF at risk of making additional improper holiday payments. Statistical Sampling Results For projection purposes, the identified improper and unsupported payments have a net total value of $961. We used a statistical sampling method to select the holiday pay transactions for employees who were paid for 24 hours or less that we examined. We projected an additional $40,836 in overpayments, $1,440 in underpayments, and $22,275 in unsupported payments. The projected improper and unsupported payments have a net total of $61,671. The identified and projected improper and unsupported payments totaled a net of $62,632, consisting of $41,472 in overpayments, $1,462 in underpayments, and $22,622 in unsupported payments. The following table summarizes the results of our statistical sampling (amounts are rounded to the nearest dollar): Calculation of Projected Errors Amount Identified improper and unsupported payments, net $961 Divide by: Sample 29,683 Error rate for projection (differences due to rounding) 3.24% Population that was statistically sampled 1,934,179 Multiply by: Error rate for projection 3.24% Identified and projected improper and unsupported payments, net (differences due to rounding) 62,632 Less: Identified improper and unsupported payments, net 961 Projected improper and unsupported payments, net $61,671 -28- Office of the State Controller | Central California Women’s Facility Payroll Process and Transactions Final Audit Report July 2026 Criteria GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. GC section 19853 specifies the compensation that eligible employees are entitled to receive when required to work on a qualifying holiday. Collective bargaining agreements between the State and various bargaining units include similar provisions regarding holiday pay for represented employees. CCWF’s General Retention Schedule for Payroll/Personnel Records specifies a four-year retention period for timesheets. Recommendation We recommend that CCWF: • Conduct a review of holiday payments made during the past three years to ensure that the payments were accurate and in compliance with collective bargaining agreements and state law; • Recover overpayments made to employees through an agreed-upon collection method in accordance with GC section 19838 and SAM sections 8291, 8291.1, and 8293; and • Properly compensate those employees who were underpaid. We further recommend that, to prevent inaccurate processing of holiday payments from recurring, CCWF: • Establish adequate controls to ensure that payments are calculated accurately; and • Maintain supporting documentation for payments pursuant to its retention policies. -29- Office of the State Controller | Central California Women’s Facility Payroll Process and Transactions Final Audit Report July 2026 APPENDIX—AUDIT SAMPLING METHODOLOGY This Appendix outlines our audit sampling application for all audit areas where statistical sampling was used. We used attributes sampling for tests of compliance. We chose this sample design because: • It follows the American Institute of Certified Public Accountants (AICPA) guidelines; • It allowed us to achieve our objectives for tests of compliance in an efficient and effective manner; • Audit areas included high and low volumes of transactions; • We planned to project the results to the intended population; and • We had the collective knowledge and skills to plan and perform the sampling plan and design. We conducted compliance testing on samples chosen by computer-generated simple random selection. For populations of fewer than 250 items, we determined the sample size using a calculator with a hypergeometric distribution. For populations of 250 items or more, we determined the sample size using a calculator with a binomial distribution. As stated in Technical Notes on the AICPA Audit Guide: Audit Sampling (March 1, 2012), page 5, although the hypergeometric distribution is the correct distribution to use for attributes sample sizes, the distribution becomes unwieldy for large populations unless suitable software is available. Therefore, more convenient approximations are frequently used instead. The confidence level was 90.00 percent, and the tolerable error rate was 5.00 percent. The expected numbers of errors were 1.0 for regular pay, overtime pay, and holiday pay; 2.0 for leave buy-back; and 3.0 for separation lump-sum pay. Pursuant to the AICPA’s Audit Guide: Audit Sampling (December 1, 2019 edition), pages 131–132, the expected number of errors planned for in the sample is derived by multiplying the expected error rate by the sample size. -30- Office of the State Controller | Central California Women’s Facility Payroll Process and Transactions Final Audit Report July 2026 The expected error rates were 1.25 percent for regular pay, overtime pay, and holiday pay; and 1.00 percent for leave buy-back and separation lump-sum pay. The expected number of errors in the sampling tables on pages 135–136 of Audit Guide: Audit Sampling is rounded upward, e.g., 0.2 errors become 1.0 error. Results were projected to the intended (total) population. The following table summarizes the population details and sample sizes for all audit areas where statistical sampling was used: Audit Population Population Sampling Sample Area (Unit) (Dollar) Unit Size Reference Regular pay 42,532 $288,393,380 Transaction 77 Intentionally left blank Leave buy-back 124 515,178 Transaction 56 Finding 3 Overtime pay 22,385 37,196,027 Transaction 77 Finding 4 Separation 248 4,627,009 Employee 66 Finding 5 lump-sum pay Holiday pay 5,470 1,934,179 Transaction 77 Finding 7 -31- Office of the State Controller | Central California Women’s Facility Payroll Process and Transactions Final Audit Report July 2026 ATTACHMENT—CENTRAL CALIFORNIA WOMEN’S FACILITY RESPONSE TO DRAFT AUDIT REPORT -32- Office of the State Controller | Central California Women’s Facility Payroll Process and Transactions Final Audit Report July 2026 -33- Office of the State Controller | Central California Women’s Facility Payroll Process and Transactions Final Audit Report July 2026 -34- Office of the State Controller | Central California Women’s Facility Payroll Process and Transactions Final Audit Report July 2026 End of report -35-