San Quentin State Prison - Payroll Process Review

SAN QUENTIN STATE PRISON Review Report PAYROLL PROCESS REVIEW July 1, 2012, through June 30, 2015 BETTY T. YEE California State Controller April 2018 BETTY T. YEE California State Controller April 25, 2018 Ronald Davis, Warden San Quentin State Prison 100 Main Street San Quentin, CA 94964 Dear Mr. Davis: The State Controller’s Office has reviewed the San Quentin State Prison (SQSP) payroll process for the period of July 1, 2012, through June 30, 2015. SQSP management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. Our limited review identified material weaknesses in internal control over the SQSP payroll process that leave SQSP at risk of additional improper payments if not mitigated. Specifically, SQSP lacked adequate segregation of duties and compensating controls over its processing of payroll transactions. These control deficiencies have a pervasive effect on the SQSP payroll process, and impair the effectiveness of other controls by rendering their design ineffective or by keeping them from operating effectively. In addition, SQSP inappropriately granted 16 employees keying access to the State’s payroll system. Specifically, 14 employees’ keying access was not immediately removed after separation from state service, transfer to another agency or unit, or change in classification; a manager was granted inappropriate keying access to the system; and an analyst had keying access to the system without the required written justification. This control deficiency leaves the payroll data at risk of misuse, abuse, and unauthorized use. SQSP also lacked sufficient controls over the processing of specific payroll-related transactions to ensure that SQSP complies with collective bargaining agreements and state laws, and that only valid and authorized payments are processed. The control deficiencies contributed to SQSP employees’ excessive vacation and annual leave balances, improper and questioned payments, improper holiday credit accruals, and uncollected salary advances costing the State an estimated net total of $1,827,125. Our review was performed on a limited number of transactions only; a more extensive review may determine that the amount of improper payments is higher than what we identified. Ronald Davis, Warden -2- April 25, 2018 If you have any questions, please contact Andrew Finlayson, Chief, State Agency Audits Bureau, by telephone at (916) 324-6310. Sincerely, Original signed by JEFFREY V. BROWNFIELD, CPA Chief, Division of Audits JVB/as Ronald Davis, Warden -3- April 25, 2018 cc: Scott Kernan, Secretary California Department of Corrections and Rehabilitation Ralph Diaz, Undersecretary, Operations California Department of Corrections and Rehabilitation Diana Toche, Undersecretary, Health Care Services California Department of Corrections and Rehabilitation Kenneth J. Pogue, Undersecretary, Administration and Offender Services California Department of Corrections and Rehabilitation Jason Lopez, Director, Division of Administrative Services California Department of Corrections and Rehabilitation Guillermo Viera Rosa, Director, Division of Internal Oversight and Research California Department of Corrections and Rehabilitation Kathleen Allison, Director, Division of Adult Institutions California Department of Corrections and Rehabilitation Connie Gipson, Deputy Director, Facility Operations Division of Adult Institutions California Department of Corrections and Rehabilitation Jeff Macomber, Deputy Director, Facility Support Division of Adult Institutions California Department of Corrections and Rehabilitation Katherine Minnich, Deputy Director, Human Resources California Department of Corrections and Rehabilitation Matt Espenshade, Deputy Director, Office of Audits and Court Compliance California Department of Corrections and Rehabilitation Linda Larabee, External Audits Manager Office of Audits and Court Compliance California Department of Corrections and Rehabilitation Yulanda Mynhier, Director Health Care Policy and Administration California Correctional Health Care Services Lara Saich, Chief of Risk Management Branch California Correctional Health Care Services Eureka Daye, Regional Chief Executive Officer California Correctional Health Care Services Ronald Broomfield, Chief Deputy Warden San Quentin State Prison Gary Forncrook, Associate Warden for Business Services San Quentin State Prison Nicole Burgess, Correctional Business Manager I San Quentin State Prison Michele Kruse, Institutional Personnel Officer II San Quentin State Prison Mark Rodriguez, Chief, Administrative Services Division California Department of Human Resources San Quentin State Prison Payroll Process Review Contents Review Report Summary ............................................................................................................................ 1 Background ........................................................................................................................ 2 Objectives, Scope, and Methodology ............................................................................... 3 Conclusion .......................................................................................................................... 4 Views of Responsible Officials .......................................................................................... 5 Restricted Use .................................................................................................................... 5 Findings and Recommendations ........................................................................................... 6 Attachment—San Quentin State Prison’s Response to Draft Review Report San Quentin State Prison Payroll Process Review Review Report Summary The State Controller’s Office (SCO) reviewed the San Quentin State Prison (SQSP) payroll process for the period of July 1, 2012, through June 30, 2015. SQSP management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. Our limited review identified material weaknesses in internal control over the SQSP payroll process that leave SQSP at risk of improper payments if not mitigated. We found that SQSP has a combination of deficiencies in internal control over its payroll process such that there is a reasonable possibility that a material misstatement in financial information or noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. Specifically, SQSP lacked adequate segregation of duties and compensating controls over its processing of payroll transactions. These control deficiencies have a pervasive effect on the SQSP payroll process, and impair the effectiveness of other controls by rendering their design ineffective or by keeping them from operating effectively. In addition, SQSP inappropriately granted 16 employees keying access to the State’s payroll system. Specifically, 14 employees’ keying access was not immediately removed after separation from state service, transfer to another agency or unit, or change in classification; a manager was granted inappropriate keying access to the system; and an analyst had keying access to the system without the required written justification. This control deficiency leaves the payroll data at risk of misuse, abuse, and unauthorized use. We also found that SQSP lacked sufficient controls over the processing of specific payroll-related transactions to ensure that SQSP complies with collective bargaining agreements and state laws, and that only valid and authorized payments are processed. As summarized in the table on page 2, the control deficiencies contributed to SQSP employees’ excessive vacation and annual leave balances, improper and questioned payments, improper holiday credit accruals, and uncollected salary advances costing the State an estimated net total of $1,827,125. Our review was performed on a limited number of transactions only; a more extensive review may determine that the amount of improper payments is higher than what we identified. -1- San Quentin State Prison Payroll Process Review The following table summarizes our review results: Selections Reviewed Selections with Issues Dollar Amount of Issues as a Issues as a Percentage Dollar Number of Percentage of Dollar Number of Amount of Selections of Approximate Amount of Finding Selections Selection Selections with Selections Dollar Selections Number Issues Reviewed Unit Reviewed Issues Reviewed * Amount Reviewed * 1 Inadequate segregation of duties and N/A N/A N/A N/A N/A N/A N/A compensating controls 2 Inappropriate keying access to the State’s 67 Employee $ - 16 24% $ - - payroll system 3 Inadequate controls over vacation and 65 Employee 956,296 65 100% 956,296 100% annual leave balances, costing the State liability for excessive credits 4 Inadequate controls over employee 122 Employee 4,773,537 120 98% 868,414 18% separation lump-sum pay, resulting in improper and questioned payments 5 Inadequate controls over regular and overtime pay, resulting in improper payments: ● Underpayments in regular pay 76 Payment 524,635 28 37% (19,847) (4%) transaction ● Overpayments in overtime pay, net 55 Payment 309,341 24 44% 1,377 - transaction 6 Inadequate controls over salary 9 Salary 16,144 9 100% 16,144 100% advances, resulting in failure to recover advance outstanding accounts transaction 7 Inadequate controls over uniform 17 Employee 26,130 3 18% 1,365 5% allowance, resulting in overpayments 8 Inadequate controls over holiday pay and 36 Holiday pay 8,638 22 61% 3,376 39% holiday credit, resulting in improper and holiday payments and accruals, net credit transaction Total 447 $ 6,614,721 287 $ 1,827,125 * All percentages are rounded to the nearest full percentage point. Background In 1979, the State of California adopted collective bargaining for state employees. The adoption of collective bargaining created a significant workload increase for the Personnel and Payroll Services Division (PPSD), as PPSD was the State’s centralized payroll processing center for all payroll related-transactions. PPSD decentralized the processing of payroll, allowing state agencies and departments to process their own payroll-related transactions. Periodic reviews of decentralized payroll processing at state agencies and departments ceased due to budget constraints in the late 1980s. In 2013, the California State Legislature reinstated these payroll reviews to gain assurance that state agencies and departments maintain an adequate internal control structure over payroll functions, provide proper oversight over decentralized payroll processing, and comply with various state laws and regulations regarding payroll processing and related transactions. -2- San Quentin State Prison Payroll Process Review Review Authority Authority for this review is provided by California Government Code (GC) section 12476, which states, “The Controller may audit the uniform state pay roll system, the State Pay Roll Revolving Fund, and related records of state agencies within the uniform state pay roll system, in such manner as the Controller may determine.” In addition, GC section 12410 stipulates that “The Controller shall superintend the fiscal concerns of the state. The Controller shall audit all claims against the state, and may audit the disbursement of any state money, for correctness, legality, and for sufficient provisions of law for payment.” Objectives, Scope, Our review objectives were to determine whether: and Methodology  Payroll and payroll-related disbursements were accurate and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures;  SQSP had established adequate internal control over payroll to meet the following control objectives: o Payroll and payroll-related transactions are properly approved and certified by authorized personnel; o Only valid and authorized payroll and payroll-related transactions are processed; o Payroll and payroll-related transactions are accurate and properly recorded; o Payroll systems, records, and files are adequately safeguarded; and o State laws, regulations, policies, and procedures are complied with regarding payroll and payroll-related transactions.  SQSP complied with existing controls as part of the ongoing management and monitoring of payroll and payroll-related expenditures;  SQSP maintained accurate records of leave balances; and  Salary advances were properly administered and recorded in accordance with state laws, regulations, policies, and procedures. We reviewed SQSP’s payroll process and transactions for the period of July 1, 2012, through June 30, 2015. We performed our onsite fieldwork in two locations: SQSP in San Quentin, CA and California Correctional Health Care Services (CCHCS) Headquarters in Elk Grove, CA. To achieve our review objectives, we:  Reviewed state and SQSP policies and procedures related to the payroll process to understand the practice of processing various payroll and payroll-related transactions; -3- San Quentin State Prison Payroll Process Review  Interviewed SQSP payroll personnel to understand the practice of processing various payroll and payroll-related transactions, determine their level of knowledge and ability relating to the payroll transaction processing, and obtain or confirm our understanding of existing internal control over the payroll process and systems;  Selected transactions recorded in the State’s payroll database based on risk factors and other criteria for review;  Analyzed and tested transactions recorded in the State’s payroll database and reviewed relevant files and records to determine the accuracy of payroll and payroll-related payments, accuracy of leave transactions, proper review and approval of transactions, adequacy of internal control over the payroll process and systems, and compliance with collective bargaining agreements and state laws, regulations, policies, and procedures (errors found were not projected to the intended population); and  Reviewed salary advances to determine whether they were properly administered and recorded in accordance with state laws, regulations, policies, and procedures. Conclusion Our limited review identified material weaknesses1 in internal control over the SQSP payroll process that leave SQSP at risk of additional improper payments if not mitigated. SQSP has a combination of deficiencies in internal control over its payroll process such that there is a reasonable possibility that a material misstatement in financial information or noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected on a timely basis. Specifically, SQSP lacked adequate segregation of duties and compensating controls over its processing of payroll transactions. The payroll transactions unit staff performed conflicting duties. The staff performs multiple steps in processing payroll transactions, including data entry into the State’s payroll system; auditing employee timesheets; reconciling payroll, including reconciling system output to source documentation; and reporting payroll exceptions. This control deficiency was aggravated by the lack of compensating controls, such as management oversight and review, to mitigate the risks associated with such a deficiency. The lack of segregation of duties and appropriate compensating controls has a pervasive effect on SQSP payroll process, and impairs the effectiveness of other controls by rendering their design ineffective or by keeping them from operating effectively. 1 An evaluation of an entity’s payroll process may identify deficiencies in its internal control over such a process. A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct misstatements in financial information, impairments of effectiveness or efficiency of operations, or noncompliance with provisions of laws, regulations, or contracts on a timely basis. Control deficiencies, either individually or in combination with other control deficiencies, may be evaluated as significant deficiencies or material weaknesses. A significant deficiency is a deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness, yet important enough to merit attention by those charged with governance. A material weakness is a deficiency, or combination of deficiencies, in internal control such that there is a reasonable possibility that a material misstatement in financial information, impairment of effectiveness or efficiency of operations, or noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected on a timely basis. -4- San Quentin State Prison Payroll Process Review In addition, SQSP inappropriately granted 16 employees access to the State’s payroll system. Specifically, 14 employees’ keying access was not immediately removed after separation from state service, transfer to another agency or unit, or change in classification; a manager was granted inappropriate keying access to the system; and an analyst had keying access to the system without the required written justification. This control deficiency leaves the payroll data at risk of misuse, abuse, and unauthorized use. Furthermore, SQSP lacked sufficient controls over the processing of specific payroll-related transactions to ensure that SQSP complies with collective bargaining agreements and state laws, and that only valid and authorized payments are processed. These control deficiencies contributed to SQSP employees’ excessive vacation and annual leave balances; improper and questioned payments for separation lump-sum pay, regular pay, overtime pay, holiday pay and awards; improper holiday credit accruals; and uncollected salary advances costing the State an estimated net total of $1,827,125. Our review was performed on a limited number of transactions only; a more extensive review may determine that the amount of improper payments is higher than what we identified. Views of We issued a draft review report on February 21, 2018. Ron Davis, Warden, responded by letter dated March 8, 2018 (Attachment), in which SQSP did Responsible not dispute the findings. Mr. Davis indicated that SQSP has taken steps to Officials correct the deficiencies noted in the findings. We will follow up during the next payroll review to ensure that the corrective actions were adequate and appropriate. Restricted Use This report is solely for the information and use of SQSP, the California Department of Corrections and Rehabilitation (CDCR), CCHCS, and the SCO; it is not intended to be and should not be used by anyone other than these specified parties. This restriction is not intended to limit distribution of this report, which is a matter of public record. Original signed by JEFFREY V. BROWNFIELD, CPA Chief, Division of Audits April 25, 2018 -5- San Quentin State Prison Payroll Process Review Findings and Recommendations FINDING 1— SQSP lacked adequate segregation of duties within its payroll transactions unit to ensure that only valid and authorized payroll transactions are Inadequate processed. SQSP also failed to implement other controls to compensate segregation of for this risk. duties and compensating GC sections 13400 through 13407 require state agencies to establish and controls over maintain internal controls, including proper segregation of duties and an payroll effective system of internal review. Adequate segregation of duties transactions reduces the likelihood that fraud or error will remain undetected by providing for separate processing by different individuals at various stages of a transaction and for independent reviews of the work performed. Our review found that SQSP payroll transactions unit staff performed conflicting duties. The staff performs multiple steps in processing payroll transactions, including data entry into the State’s payroll system; auditing employee timesheets; reconciling payroll, including reconciling system output to source documentation; and reporting payroll exceptions. For example, the payroll transactions unit staff keys in regular and overtime pay and reconciles the master payroll, overtime, and other supplemental warrants. SQSP failed to demonstrate that it implemented compensating controls to mitigate the risks associated with such a deficiency. We found no indication that these functions were subjected to periodic supervisory review. The lack of adequate segregation of duties and compensating controls has a pervasive effect on the SQSP payroll process, and impairs the effectiveness of other controls by rendering their design ineffective or by keeping them from operating effectively. These control deficiencies, in combination with other deficiencies discussed in Findings 2 through 8, represent a material weakness in internal control over the payroll process such that there is a reasonable possibility that a material misstatement in financial information or noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected on a timely basis. Adequate segregation of duties provides a stronger system of internal control whereby the functions of each employee are subject to the review of another. Good internal control practices require that the following functional duties should be performed by different work units, or at minimum, by different employees within the same unit:  Recording transactions. This duty refers to the recordkeeping function, which is accomplished by entering data into a computer system.  Authorization to execute. This duty belongs to individuals with authority and responsibility to initiate and execute transactions.  Periodic reviews and reconciliation of actual payments to recorded amounts. This duty refers to making comparisons of information at regular intervals and taking action to resolve differences. -6- San Quentin State Prison Payroll Process Review Recommendation We recommend that SQSP separate conflicting payroll function duties to the extent possible. If it is not possible to segregate payroll functions fully and appropriately due to specific circumstances, we recommend that SQSP implement compensating controls. For example, if payroll transactions unit staff responsible for recordkeeping also performs a reconciliation process, then the supervisor could perform and document a detailed review of the reconciliation to provide additional control over the assignment of conflicting functions. Compensating controls may also include dual authorization requirements, and documented reviews of payroll system input and output. We also recommend that SQSP develop formal written procedures for performing and documenting compensating controls. FINDING 2— SQSP lacked adequate controls to ensure that only appropriate staff have access to the State’s payroll system. Of the 67 employees whose records Inappropriate we reviewed, 16 (24%) had inappropriate keying access to the State’s keying access to the payroll system. If not mitigated, these control deficiencies leave the State’s payroll payroll data at risk of misuse, abuse, and unauthorized use. system The SCO maintains the State’s payroll information system. The system is decentralized, thereby allowing employees of state agencies to access the system. PPSD has established a Decentralization Security Program that all state agencies are required to follow to access the payroll systems. The program’s objectives are to secure and protect the confidentiality and integrity of payroll data against misuse, abuse, and unauthorized use. SQSP had 67 employees with access to the State’s payroll system at various times between July 2012 and June 2015. We reviewed the records of these 67 employees and found that SQSP inappropriately granted 16 of them keying access to the State’s payroll system. Specifically, 14 employees did not have their keying access immediately removed or modified after separation from state service, transfer to another agency or unit, or change in classification. For example, a Personnel Supervisor separated from state service on October 15, 2013. However, the request to delete that employee’s access was not made until January 30, 2014, or 107 days after the employee’s separation date. Of the 14 employees, the longest inappropriate access was almost two years after the employee changed to an ineligible classification. In addition, a manager had keying access to the system. The manager’s duties included approving certain payroll transactions prior to input into the system. The manager also reviewed the work of her staff. To properly segregate duties, employees charged with approving transactions should not be able to input the transactions that they approve. Furthermore, an employee had keying access while he was appointed to a classification other than those allowed to have keying access. The employee’s classification changed from Personnel Supervisor II to Associate Governmental Program Analyst. However, SQSP did not submit the required justification letter. -7- San Quentin State Prison Payroll Process Review The Decentralization Security Program manual states, in part: The privilege to access the PPSD database poses a significant risk to the ability for SCO to function. Therefore that privilege is restricted to persons with a demonstrated need for such access. Currently, …applications are restricted to Personnel Services Specialists (PSS), or Payroll Technician (PT) classifications because their need is by definition a function of their specific job duties, and any change in those duties requires a reevaluation of the need for access. If the employee’s duties change, such that the need for access no longer exists, the access privilege MUST be removed or deleted immediately by a request submitted by the department…. A request for an individual in a classification other than in the PSS/PT series to access (the payroll system) requires a written justification from the Personnel/Payroll Officer. The justification must describe the individual’s specific job duties that require the need to each type of information…as well as the level of access to that application, in order to perform their Statutory and/or Constitutional duties. To prevent unauthorized use of a transferred, terminated or resigned employee’s userid, it is required that the Security Monitor IMMEDIATELY submit a PSD125A to delete their system access. DO NOT WAIT until another employee fills this position; this only increases the chances for breach of security, utilizing and old userid. The manual, as revised in January 2015, restricts manager classifications to inquiry access only. Recommendation We recommend that SQSP update access to the payroll system after employees separate from state service, transfer to another agency or unit, or change classifications. SQSP’s designated security monitor should periodically review access to the system to determine that existing access complies with the Decentralized Security Program. SQSP failed to implement controls to ensure that it adheres to the FINDING 3— requirements of collective bargaining agreements and state regulations to Inadequate limit the accumulation of vacation and annual leave credits. This controls over deficiency resulted in liability for excessive leave credits that could cost vacation and the State at least $956,296 as of June 30, 2015. We expect the liability to annual leave increase if SQSP does not take action to address the excessive vacation balances, resulting and annual leave credits. in liability for excessive credits Collective bargaining agreements and state regulations limit the amount of vacation and annual leave that most state employees may accumulate to no more than 80 days (640 hours). The limit on leave balances serves as a tool for state agencies to manage leave balances and control the State’s liability for accrued leave credits. State agencies may allow employees to carry more than the limit only under certain circumstances. For example, an employee may not be able to reduce accrued vacation or annual leave hours below the limit because of business needs. When an employee’s leave accumulation exceeds or is projected to exceed the limit, state agencies should work with the employee to develop a plan to reduce leave balances below the applicable limit. -8- San Quentin State Prison Payroll Process Review Our review of the leave accounting records found that SQSP had 1,684 employees with unused vacation or annual leave credits at June 30, 2015. Of the 1,684 employees, 65 exceeded the limit set by collective bargaining agreements and state regulations. For example, one employee had an accumulated balance of 3,316 hours in annual leave, or 2,676 hours beyond the 640-hour limit. Collectively, these 65 employees accumulated more than 22,800 hours in excess vacation and annual leave credits, costing at least $956,296 as of June 30, 2015. This estimated liability does not adjust for salary rate increases and additional leave credits2. Accordingly, we expect that the amount needed to pay for this liability will be higher. For example, an SQSP employee separated from state service with 2,606 hours in leave credits, including 2,337 hours in annual leave. After adjusting for additional leave credits, the employee was paid for 3,084 hours, or 18% more. We performed an additional review of the records of 27 of the 65 employees to determine whether SQSP complied with collective bargaining agreements and state regulations. We found that SQSP could not demonstrate that it allowed the 27 employees to carry vacation or annual leave balances beyond the limit based on exceptions specified in agreements and state regulations. SQSP also did not take action to bring leave balances below the limit. According to the payroll transactions unit management, SQSP and its employees had no plans in place to reduce leave balances below the limit. The following table shows the annual change during our review period in the number of employees with vacation and annual leave balances exceeding the 640-hour limit, and the total number of vacation and annual leave hours in excess of the 640-hour limit: Employees with vacation or annual leave balance exceeding Vacation and annual leave hours 640 hours in excess of the 640-hour limit Year-to-year Year-to-year percentage percentage Total number increase Total number increase As of of employees (decrease) of hours (decrease) July 1, 2012 44 N/A 15,140 N/A June 30, 2013 70 59% 23,844 57% June 30, 2014 72 3% 24,608 3% June 30, 2015 65 (10%) 22,891 (7%) If SQSP does not take action to reduce the excessive credits, the liability for accrued vacation and annual leave will likely increase because most employees will receive salary increases, additional leave credits, or have other non-compensable leave credits that they can use instead of vacation or annual leave, increasing their vacation or annual leave balances. In addition, the state agency responsible for paying these leave balances could also face a cash flow problem if a significant number of employees 2 Most state employees receive pay rate increases every year pursuant to state laws or collective bargaining agreements. Also, when projecting accumulated leave balances upon separation, an employee earns additional leave credits equal to the amount that the employee would have earned had the employee taken time off but not separated from state service. -9- San Quentin State Prison Payroll Process Review with excessive vacation or annual leave credits separate from state service. State agencies are not normally budgeted to make these lump-sum payments. However, the State’s current practice dictates that the state agency that last employed an employee pays for that employee’s separation lump-sum payment, regardless of where the employee accrued the leave balance. Recommendation We recommend that SQSP:  Implement controls, including existing policies and procedures, to ensure that its employees’ vacation and annual leave balances are maintained within levels allowed by collective bargaining agreements and state regulations; and  Conduct ongoing monitoring of controls to ensure that the controls are implemented and operating effectively. We also recommend that, when the State offers leave buy-back programs, SQSP participate in such programs if funds are available. SQSP lacked adequate controls over the processing of employee FINDING 4— separation lump-sum pay. Of the 70 employees whose records we Inadequate reviewed, 68 were improperly paid, resulting in a net total estimated controls over overpayment of $296,993. Due to the systemic nature of improper employee payments, we also questioned the accuracy of the lump-sum payments, separation lump- totaling $571,421, made to the other 52 Bargaining Unit 6 employees. If sum pay, resulting not mitigated, this control deficiency leaves SQSP at risk of additional in improper and improper payments. questioned payments Pursuant to collective bargaining agreements and state law, employees are entitled to receive cash for accrued eligible leave credits when separating from state employment. Payroll records indicated that SQSP had processed separation lump-sum pay for 338 employees between July 2012 and June 2015. We reviewed the records for 70 selected employees and found that 68 were improperly paid. Of the 68 employees, 61 were paid 7,741 hours more than they should have been paid for accrued leave credits, resulting in a total overpayment of approximately $309,801; and seven were paid 344 hours less than their accrued leave credits, resulting in a total underpayment of approximately $12,808. These improper payments resulted from miscalculation of the employees’ accrued leave credits by the payroll transactions unit staff. We noted that the staff lacked adequate understanding of the procedures for proper calculation of separation lump-sum payments. We also found no indication that the processing of these lump-sum payments was reviewed by an unauthorized individual. In addition, improper payments to five of the 68 employees also resulted from SQSP not complying with policies and procedures for calculating separation lump-sum pay for employees working under the provisions of Section 7k of the Fair Labor Standards Act (FLSA). According to the CDCR 7k Manual, the FLSA hourly pay rates for 7k employees differ -10- San Quentin State Prison Payroll Process Review from the SCO pay rates due to the difference in the number of hours required in the same time frame. SQSP did not convert the 7k employees’ projected leave credit hours to reflect the correct monetary amount when reported to SCO. The 7k Manual instructs institutional personnel offices to convert the total hours of leave credits projected in the final month. We also noted two cases of inconsistencies regarding the calculation of separation lump-sum payments. In the first case, the 7k Manual states that the total lump-sum hours to be paid should be determined by adding the hours from the complete pay periods to the converted hours of the final pay period of projection. However, the manual’s examples of the conversion process also indicate that the total lump-sum hours to be paid equal the converted hours from the entire projection period. In the second case, the 7k Manual states that holidays should be paid based on eight hours during the projection period. However, our review of documentation from CDCR headquarters indicated that holidays are not included in the projection of lump-sum hours for posted employees. When we inquired with CDCR’s Office of Personnel Services, we also received conflicting information on how the holidays should be treated for lump-sum pay calculation. According to the Office of Personnel Services, the 7k Manual has not been updated since 2006; therefore, any changes in the collective bargaining agreement since then between the State and Bargaining Unit 6 that may affect employee separation lump-sum payments are not reflected in the manual. Recommendation We recommend that SQSP:  Establish adequate controls to ensure accurate calculation and payment of employee separation lump-sum pay;  Provide adequate training to responsible staff members involved in employee separation lump-sum pay transactions to ensure that they understand the requirements under collective bargaining agreements, state laws, and policies regarding separation lump-sum payments;  Conduct a review of employee separation lump-sum payments during the past three years to ensure that these payments are accurate and in compliance with collective bargaining agreements and state law; and  Recover overpayments made to separated employees in accordance with GC section 19838 and State Administrative Manual (SAM) section 8776.6, and properly compensate those employees who were underpaid. In addition, we recommend that CDCR update the 7k Manual to reflect the most recent requirements for calculating employee separation lump-sum pay. These changes should be properly communicated to the institutions. -11- San Quentin State Prison Payroll Process Review FINDING 5— SQSP lacked adequate controls to ensure that payroll transactions unit Inadequate staff processes only valid and authorized regular and overtime controls over compensation that complies with collective bargaining agreements and regular and state laws. SQSP made a net total underpayment of approximately $18,470 overtime pay, in regular and overtime compensation. If not mitigated, these control resulting in deficiencies also leave SQSP at risk of additional improper regular and overtime compensation. improper payments Payroll records showed that SQSP paid overtime compensation to 1,767 employees between July 2012 and June 2015. We reviewed 55 selected overtime payments, totaling $309,341, to 36 employees. Of the 55 payments, 24 resulted in improper overtime compensation as follows:  Fourteen overpayments totaling approximately $4,089 due to payments to ineligible employees and miscalculation of overtime hours; and  Ten underpayments totaling approximately $2,712 due to miscalculation of overtime hours. We also reviewed 76 regular pay transactions and found that 28 of them were underpaid by a total of $19,847. When we inquired with payroll transactions unit management and staff, they stated that SQSP discovered the underpayments in September 2014 and found that the underpayments started in November 2007. They also stated that SQSP had been working with PPSD to correct the errors. The errors were corrected after our review period. Recommendation We recommend that SQSP:  Conduct a review of regular and overtime payments made during the past three years to ensure that these payments comply with collective bargaining agreements and state law; and  Recover overpayments made to employees through an agreed-upon collection method in accordance with GC section 19838, and properly compensate those employees who were underpaid. To prevent improper payments from recurring, SQSP should:  Establish adequate internal controls to ensure that payments for regular and overtime compensation are accurate and comply with collective bargaining agreements and state law. These controls should require payroll transactions unit staff to verify that payment does not exceed the amount allowed by collective bargaining agreements and state law;  Provide adequate oversight to ensure that payroll transactions unit staff processes only valid and authorized regular and overtime payments that comply with collective bargaining agreements and state law; and -12- San Quentin State Prison Payroll Process Review  Provide training to payroll transactions unit staff who process regular and overtime payment transactions to ensure that they understand the requirements under collective bargaining agreements and state law. FINDING 6— SQSP lacked adequate controls over salary advances to ensure that they Inadequate are recovered in accordance with state law and policies. The nine salary controls over advances that we reviewed, totaling $16,144, remained outstanding as of salary advances, June 30, 2015, due to SQSP’s lack of collection efforts. The longest resulting in failure outstanding was over 10 years. After our review period, SQSP collected an outstanding balance, totaling $14,684, from six employees. This control to recover deficiency leaves SQSP at risk of further failures to collect salary advances outstanding if not mitigated. accounts GC section 19838 and SAM section 8776.7 allow SQSP to collect salary advances in a timely manner. At June 30, 2015, SQSP’s accounting records showed 21 outstanding salary advances totaling $23,169, including nine balances totaling $16,144 that have been outstanding for more than 120 days. The longest outstanding salary advance was over 10 years. Generally, the prospect of collection diminishes as an account ages. When an agency is unable to collect after three years, the possibility of collection is remote. For all nine selected salary advances that we reviewed (which were over 120 days old, and totaled $16,144) we noted that SQSP failed to demonstrate timely collection efforts. We found that:  One salary advance with an outstanding balance of $838 as of June 30, 2015, was issued in May 2003. The first collection notice was issued in September 2004, more than a year after the salary advance was issued. The second collection notice was issued in May 2011, five years after the salary advance was issued. The balance was written off after our review period;  One salary advance with an outstanding balance of $574 as of June 30, 2015, was issued in June 2009. The employee separated from state service in May 2015. The first notification letter was sent in October 2015, more than six years after the salary advance was issued. Subsequently, SQSP submitted this account to the Franchise Tax Board for offset;  One salary advance with an outstanding balance of $48 as of June 30, 2015, was issued in September 2013. The balance was written off after our review period; and  Six salary advances with a total outstanding balance of $14,684 as of June 30, 2015, were issued between September 2011 and February 2015. The balances were collected after our review period, or between five months and more than three years after the salary advance was issued. The lack of adequate controls over salary advances increases the risk of financial loss, reduces the likelihood of collection, increases the amount of resources expended on collection efforts, and negatively impacts cash flow. -13- San Quentin State Prison Payroll Process Review Recommendation We recommend that SQSP ensure that salary advances are recovered in a timely manner pursuant to GC section 19838 and SAM section 8776.7. If all reasonable collection procedures do not result in payment, SQSP may request discharge from accountability of uncollectable amounts. We also recommend that SQSP maintain documentation of its collection efforts and payment of salary advances, if any. FINDING 7— SQSP lacked adequate controls to ensure that payroll transactions unit Inadequate staff processes only valid and authorized uniform allowance payments that controls over comply with collective bargaining agreements. SQSP improperly paid uniform allowance, three employees a total of $1,365 in uniform allowance. These control resulting in deficiencies leave SQSP at risk of additional improper payments if not improper mitigated. payments Pursuant to the collective bargaining agreement between the State and Bargaining Unit 6, employees required to wear a uniform and uniform accessories receive a maximum uniform allowance of $530 per year, to be paid annually. Pursuant to the collective bargaining agreement between the State and Bargaining Unit 15, when the State requires a uniform to be worn as a condition of employment and does not provide such a uniform, the State shall authorize a uniform replacement allowance of $450 per year. Between July 2012 and June 2015, SQSP paid 1,200 employees uniform allowances. We reviewed the uniform allowance payments, totaling $26,130, made to 17 selected employees. Of the 17 employees, two employees received two payments in the same year, exceeding the maximum annual allowance by a total of $1,060; and one employee received $305 in uniform allowance, but the employee was not eligible for the payment. Recommendation We recommend that SQSP:  Conduct a review of uniform allowance payments made during the past three years to ensure that these payments comply with collective bargaining agreements; and  Recover overpayments made to employees through an agreed-upon collection method in accordance with GC section 19838. To prevent improper uniform allowance payments from recurring, SQSP should:  Establish adequate internal controls to ensure that payments are accurate and comply with collective bargaining agreements. These controls should require payroll transactions unit staff to verify that -14- San Quentin State Prison Payroll Process Review payment does not exceed the amount allowed by collective bargaining agreements;  Provide adequate oversight to ensure that payroll transactions unit staff processes only valid and authorized payments that comply with collective bargaining agreements; and  Provide training to payroll transactions unit staff who process payment transactions to ensure that they understand the requirements under collective bargaining agreements. SQSP lacked adequate controls over the payment of holiday pay and FINDING 8— accrual of holiday credits. SQSP improperly granted holiday pay Inadequate compensation and holiday credits in 22 of the 36 transactions that we controls over reviewed, costing the State approximately $3,376. If not mitigated, this holiday pay and control deficiency leaves SQSP at risk of recording additional improper holiday credit, payments of holiday pay and improper accruals of holiday credit. resulting in improper GC section 19853 specifies the number of hours of holiday credit that an payments and employee is eligible to receive per qualifying holiday. Collective accruals bargaining agreements include similar provisions regarding holiday credit and holiday pay. Leave accounting records showed that more than 1,462 SQSP employees received holiday credits between July 2012 and June 2015. We reviewed 12 selected holiday credit transactions, costing approximately $3,453, for 11 of these employees; we found that eight transactions involved improper accruals totaling 82 holiday credit hours, costing an estimated total of $2,501. Of the eight transactions, seven were granted on pay periods that had no holidays and one involved holiday credits that exceeded the limit set by the collective bargaining agreement. During our review, SQSP Personnel Office management and staff disclosed to us that improper payments for holiday pay had resulted from miscalculations by a payroll transactions unit staff. We reviewed and determined that SQSP recalculated the payments to determine the correct amounts. We also reviewed an additional selection of 24 holiday pay transactions totaling $5,185 to determine whether SQSP granted proper holiday pay and/or holiday credits. Of the 24 transactions, we found that 14 were improper, as follows:  Six involved both overpayments in holiday pay totaling $1,424 and over-accrual of holiday credits costing approximately $1,424;  Two involved overpayments in holiday pay totaling $338;  Five involved under-accruals of holiday credits costing approximately $2,117; and  One involved overpayment in holiday pay by $195 and under-accrual of holiday credits costing approximately $389. We found no indication that the holiday pay and holiday credit transactions were reviewed by an individual other than the payroll transactions unit staff responsible for keying these transactions in the system. -15- San Quentin State Prison Payroll Process Review Recommendation We recommend that SQSP:  Conduct a review of holiday pay compensation granted during the past three years to ensure that compensation complied with collective bargaining agreements and state law; and  Recover overpayments made to employees through an agreed-upon collection method in accordance with GC section 19838, and properly compensate those employees who were underpaid. We also recommend that SQSP:  Conduct a review of the leave accounting system to ensure that the accrual of holiday credits complies with collective bargaining agreements and state law; and  Correct any improper holiday credits in the leave accounting system. To prevent improper holiday pay compensation and recording of holiday credits in the leave accounting system from recurring, SQSP should:  Provide adequate oversight to ensure that payroll transactions unit staff accurately processes holiday pay compensation and records leave transactions; and  Provide training to payroll transactions unit staff who key transactions into the state payroll system to ensure that they understand the requirements under collective bargaining agreements and state law regarding holiday pay and holiday credit. -16- San Quentin State Prison Payroll Process Review Attachment— San Quentin State Prison’s Response to Draft Review Report State Controller’s Office Division of Audits Post Office Box 942850 Sacramento, CA 94250-5874 http://www.sco.ca.gov S16-PAR-9002