State Compensation Insurance Fund - Payroll Process Review

STATE COMPENSATION INSURANCE FUND Review Report PAYROLL PROCESS REVIEW July 1, 2012, through June 30, 2015 BETTY T. YEE California State Controller July 2018 BETTY T. YEE California State Controller July 20, 2018 Vernon Steiner, President and CEO State Compensation Insurance Fund P.O. Box 8192 Pleasanton, CA 94588 Dear Mr. Steiner: The State Controller’s Office has reviewed the State Compensation Insurance Fund (State Fund) payroll process for the period of July 1, 2012, through June 30, 2015. State Fund management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. Our limited review identified material weaknesses in internal control over the State Fund payroll process that leave State Fund at risk of additional improper payments if not mitigated. Specifically, State Fund lacked adequate segregation of duties and compensating controls over its processing of payroll transactions. These deficiencies have a pervasive effect on the State Fund payroll process and impair the effectiveness of other controls by rendering their design ineffective or by keeping them from operating effectively. In addition, State Fund inappropriately granted nine employees keying access to the State’s payroll system. Six employees’ keying access was not immediately removed after their separation from state service, transfer to another agency, or change in classification. Three analysts had keying access to the system without the required written justification. We also found that State Fund lacked sufficient controls over the processing of specific payroll- related transactions to ensure that State Fund complies with collective bargaining agreements and state laws, and that only valid and authorized payments are processed. These control deficiencies contributed to State Fund employees’ excessive vacation and annual leave balances, improper and questioned payments, and unrecovered long-outstanding salary advances, costing the State an estimated net total of $4,623,108. If you have any questions, please contact Andrew Finlayson, Chief, State Agency Audits Bureau, by telephone at (916) 324-6310. Sincerely, Original signed by JEFFREY V. BROWNFIELD, CPA Chief, Division of Audits Vernon Steiner, President and CEO -2- July 20, 2018 JVB/ls cc: Andreas Acker, Executive Vice President and Chief Administrative Officer State Compensation Insurance Fund Eileen Gallagher, Senior Vice President and Deputy Chief Administrative Officer State Compensation Insurance Fund Patrick Gage, Vice President, HR Connect State Compensation Insurance Fund Jennifer Hoyle, Director, HR Connect – Employee Services State Compensation Insurance Fund Patricia Provost, Human Resource Manager State Compensation Insurance Fund Mark Rodriguez, Chief, Administrative Services Division California Department of Human Resources State Compensation Insurance Fund Payroll Process Review Contents Review Report Summary ............................................................................................................................ 1 Background ........................................................................................................................ 2 Objectives, Scope, and Methodology ............................................................................... 3 Conclusion .......................................................................................................................... 4 Views of Responsible Officials .......................................................................................... 5 Restricted Use .................................................................................................................... 5 Findings and Recommendations ........................................................................................... 6 Attachment—State Compensation Insurance Fund’s Response to Draft Review Report State Compensation Insurance Fund Payroll Process Review Review Report Summary The State Controller’s Office (SCO) reviewed the State Compensation Insurance Fund (State Fund) payroll process for the period of July 1, 2012, through June 30, 2015. State Fund management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. Our limited review identified material weaknesses in internal control over the State Fund payroll process that leave State Fund at risk of additional improper payments if not mitigated. We found that State Fund has a combination of deficiencies in internal control over its payroll process such that there is reasonable possibility that a material misstatement in financial information or noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. Specifically, State Fund lacked adequate segregation of duties and compensating controls over its processing of payroll transactions; payroll transactions unit staff performed conflicting duties. Staff members performed multiple steps in processing payroll transactions, including data entry into the State’s payroll system; auditing employee timesheets; reconciling payroll, including reconciling system output to source documentation; and reporting payroll exceptions. This control deficiency was aggravated by the lack of compensating controls, such as management oversight and review, to mitigate the risks associated with such a deficiency. The lack of segregation of duties and appropriate compensating controls has a pervasive effect on the State Fund payroll process, and impairs the effectiveness of other controls by rendering their design ineffective or by keeping them from operating effectively. In addition, State Fund inappropriately granted nine employees keying access to the State’s payroll system. Six employees’ keying access was not immediately removed after their separation from state service, transfer to another agency, or change in classification. Three analysts had keying access to the system without the required written justification. We also found that State Fund lacked sufficient controls over the processing of specific payroll-related transactions to ensure that State Fund complies with collective bargaining agreements and state laws, and that only valid and authorized payments are processed. As summarized in the table on page 2, these control deficiencies contributed to State Fund employees’ excessive vacation and annual leave balances, improper and questioned payments, and unrecovered long-outstanding salary advances, costing the State an estimated net total of $4,623,108. -1- State Compensation Insurance Fund Payroll Process Review The following table summarizes our review results: Total Dollar Dollar Issues as a Dollar Dollar Amount of Number of Amount of Number of Percentage of Amount of Amount of Known and Finding Selections Method of Selection Selections Selections Selections Known Likely Likely Number Issues Reviewed Selection Unit Reviewed with Issues Reviewed * Issues Issues Issues 1 Inadequate N/A N/A N/A N/A N/A N/A N/A N/A N/A segregation of duties and compensating controls 2 Inappropriate keying 71 Targeted Employee - 9 13% - N/A - access to the State’s payroll system 3 Inadequate controls 662 Targeted Employee $ 4,489,402 6 62 100% $ 4,489,402 N/A $ 4 ,489,402 over vacation and annual leave balances, resulting in liability for excessive credits 4 Inadequate controls over separation lump- sum pay, resulting in improper payments: - Overpayments 25 Judgmental Employee 2,397,256 6 24% 11,657 N/A 1 1,657 - Underpayments -- Same selections above -- 9 36% (10,094) N/A (10,094) 5 Inadequate controls over overtime compensation, resulting in improper and questioned p- aOyvmeerpnatsy:ments 60 Statistical Overtime 38,243 8 13% 340 $ 148,606 1 48,946 1 transaction - Underpayments -- Same selections above -- 8 13% (213) (92,871) (93,084)1 - Questioned payments 6 Targeted Overtime 74,315 6 100% 67,835 N/A 6 7,835 transaction 6 Inadequate controls 6 Judgmental Salary 8,446 6 100% 8,446 N/A 8 ,446 over salary advances, advance resulting in failure to transaction recover outstanding accounts 7 Inadequate controls 9 Targeted Employee 889,407 7 78% - N/A - over uniform allowance and severance pay, resulting in noncompliance Total, net 839 $ 7,897,069 7 21 $ 4 ,567,373 $ 55,735 $ 4 ,623,108 * All percentages are rounded to the nearest full percentage point. 1 Net overpayments are $55,862. Background In 1979, the State of California adopted collective bargaining for state employees. This created a significant workload increase for the SCO’s Personnel and Payroll Services Division (PPSD), as PPSD was the State’s centralized payroll processing center for all payroll related-transactions. PPSD decentralized the processing of payroll, allowing state agencies and departments to process their own payroll-related transactions. Periodic reviews of the decentralized payroll processing at state agencies and departments ceased due to the budget constraints in the late 1980s. In 2013, the California State Legislature reinstated these payroll reviews to gain assurance that state agencies and departments maintain an adequate internal control structure over the payroll function, provide proper oversight over their decentralized payroll processing, and comply with -2- State Compensation Insurance Fund Payroll Process Review various state laws and regulations regarding payroll processing and related transactions. Review Authority Authority for this review is provided by California Government Code (GC) section 12476, which states, “The Controller may audit the uniform state pay roll system, the State Pay Roll Revolving Fund, and related records of state agencies within the uniform state pay roll system, in such manner as the Controller may determine.” In addition, GC section 12410 stipulates that “The Controller shall superintend the fiscal concerns of the state. The Controller shall audit all claims against the state, and may audit the disbursement of any state money, for correctness, legality, and for sufficient provisions of law for payment.” Objectives, Scope, We performed this review to determine whether State Fund: and Methodology  Processed payroll and payroll-related disbursements accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures;  Established adequate internal control over payroll to meet the following control objectives: o Payroll and payroll-related transactions are properly approved and certified by authorized personnel; o Only valid and authorized payroll and payroll-related transactions are processed; o Payroll and payroll-related transactions are accurate and properly recorded; o Payroll systems, records, and files are adequately safeguarded; and o State laws, regulations, policies, and procedures are complied with regarding payroll and payroll-related transactions.  Complied with existing controls as part of the ongoing management and monitoring of payroll and payroll-related expenditures;  Maintained accurate records of leave balances; and  Administered and recorded salary advances in accordance with state laws, regulations, policies, and procedures. We reviewed the State Fund payroll process and transactions for the period of July 1, 2012, through June 30, 2015. To achieve our review objectives, we:  Reviewed State and State Fund policies and procedures related to payroll process to understand the practice of processing various payroll and payroll-related transactions;  Interviewed the State Fund payroll personnel to understand the practice of processing various payroll and payroll-related transactions, determine their level of knowledge and ability relating to the payroll -3- State Compensation Insurance Fund Payroll Process Review transaction processing, and obtain or confirm our understanding of existing internal control over the payroll process and systems;  Selected transactions recorded in the State’s payroll database using statistical and non-statistical sampling, and targeted selection based on risk factors and other relevant criteria;  Analyzed and tested transactions recorded in the State’s payroll database and reviewed relevant files and records to determine the accuracy of payroll and payroll-related payments, accuracy of leave transactions, proper review and approval of transactions, adequacy of internal control over the payroll process and systems, and compliance with collective bargaining agreements and state laws, regulations, policies, and procedures (errors found from statistically-determined samples were projected to the intended population); and  Reviewed salary advances to determine whether State Fund administered and recorded them in accordance with state laws, regulations, policies, and procedures. Conclusion Our limited review identified material weaknesses1 in internal control over the State Fund payroll process that leave State Fund at risk of additional improper payments if not mitigated. State Fund has a combination of deficiencies in internal control over its payroll process such that there is a reasonable possibility that a material misstatement in financial information or noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. Specifically, State Fund lacked adequate segregation of duties and compensating controls over its processing of payroll transactions; payroll transactions unit staff performed conflicting duties. Staff members performed multiple steps in processing payroll transactions, including data entry into the State’s payroll system; auditing employee timesheets; reconciling payroll, including system output to source documentation; and reporting payroll exceptions. This control deficiency was aggravated by the lack of compensating controls, such as management oversight and review, to mitigate the risks associated with such a deficiency. The lack of segregation of duties and appropriate compensating controls has a pervasive effect on the State Fund payroll process, and impairs the effectiveness of other controls by 1 An evaluation of an entity’s payroll process may identify deficiencies in its internal control over such a process. A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct misstatements in financial information, impairments of effectiveness or efficiency of operations, or noncompliance with provisions of laws, regulations, or contracts on a timely basis. Control deficiencies, either individually or in combination with other control deficiencies, may be evaluated as significant deficiencies or material weaknesses. A significant deficiency is a deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness, yet important enough to merit attention by those charged with governance. A material weakness is a deficiency, or combination of deficiencies, in internal control such that there is a reasonable possibility that a material misstatement in financial information, impairment of effectiveness or efficiency of operations, or noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected on a timely basis. -4- State Compensation Insurance Fund Payroll Process Review rendering their design ineffective or by keeping them from operating effectively. In addition, State Fund inappropriately granted nine employees keying access to the State’s payroll system. Six employees’ keying access was not immediately removed after their separation from state service, transfer to another agency, or change in classification. Three analysts had keying access to the system without the required written justification. We also found that State Fund lacked sufficient controls over the processing of specific payroll-related transactions to ensure that State Fund complies with collective bargaining agreements and state laws, and that only valid and authorized payments are processed. The control deficiencies contributed to State Fund employees’ excessive vacation and annual leave balances, improper payments for employee separation lump- sum pay, improper and questioned overtime compensation, and unrecovered long-outstanding salary advances, costing the State an estimated net total of $4,623,108. Views of We issued a draft review report on March 5, 2018. Patrick Gage, Vice President, HR Connect, responded by letter dated March 19, 2018 Responsible (Attachment), in which State Fund agreed with Findings 1, 2, 6, 7 and 8 Officials and indicated that State Fund has taken steps to correct the deficiencies noted in the findings. We will follow up during the next payroll review to ensure that these corrective actions were adequate and appropriate. State Fund partially agreed with Findings 3, 4 and 5; however, it provided additional information and indicated the existence of controls to address the issues noted in the findings. Our comments to Findings 3, 4 and 5 are included in the Findings and Recommendations section. Restricted Use This report is solely for the information and use of State Fund and the SCO; it is not intended to be and should not be used by anyone other than these specified parties. This restriction is not intended to limit distribution of this report, which is a matter of public record. Original signed by JEFFREY V. BROWNFIELD, CPA Chief, Division of Audits July 20, 2018 -5- State Compensation Insurance Fund Payroll Process Review Findings and Recommendations FINDING 1— State Fund lacked adequate segregation of duties within its payroll transactions unit necessary to ensure that only valid and authorized payroll Inadequate transactions are processed. State Fund also failed to implement other segregation of controls to compensate for this risk. duties and compensating GC sections 13402 through 13407 require state agencies to establish and controls over maintain internal controls, including proper segregation of duties and an payroll effective system of internal review. Adequate segregation of duties transactions reduces the likelihood that fraud or error will remain undetected by providing for separate processing by different individuals at various stages of a transaction, and for independent reviews of the work performed. Our review found that State Fund payroll transactions unit staff performed conflicting duties. Staff members performed multiple steps in processing payroll transactions, including data entry into the State’s payroll system; auditing employee timesheets; reconciling payroll, including reconciling system output to source documentation; and reporting payroll exceptions. For example, payroll transactions unit staff keyed in regular and overtime pay and reconciled the master payroll, overtime, and other supplemental warrants. State Fund failed to demonstrate that it had implemented compensating controls to mitigate the risks associated with such a deficiency. We found no indication that supervisors conducted periodic reviews of transactions processed by the payroll transactions unit staff. The lack of adequate segregation of duties and compensating controls has a pervasive effect on the State Fund payroll process, and impairs the effectiveness of other controls by rendering their design ineffective or by keeping them from operating effectively. These control deficiencies, in combination with other deficiencies discussed in Findings 2 through 7, represent a material weakness in internal control over the payroll process such that there is a reasonable possibility that a material misstatement in financial information or noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. Good internal control practices require that the following functional duties be performed by different work units, or at minimum, by different employees within the same unit:  Recording transactions—This duty refers to the record-keeping function, which is accomplished by entering data into a computer system.  Authorization to execute—This duty belongs to individuals with authority and responsibility to initiate and execute transactions.  Periodic review and reconciliation of actual payments to recorded amounts—This duty refers to making comparisons of information at regular intervals and taking action to resolve differences. -6- State Compensation Insurance Fund Payroll Process Review Recommendation We recommend that State Fund separate conflicting payroll duties to the extent possible. Adequate segregation of duties will provide a stronger system of internal control whereby the functions of each employee are subject to the review of another. If it is not possible to segregate payroll functions fully and appropriately due to specific circumstances, State Fund should implement compensating controls. For example, if the payroll transactions unit staff member responsible for recordkeeping also performs a reconciliation process, then the supervisor should perform and document a detailed review of the reconciliation to provide additional control over the assignment of conflicting functions. Compensating controls may also include dual authorization requirements and documented reviews of payroll system input and output. We also recommend that State Fund develop formal written procedures for performing and documenting compensating controls. FINDING 2— State Fund lacked adequate controls to ensure that only appropriate staff members have keying access to the State’s payroll system. Of the Inappropriate 71 employees whose records we reviewed, nine (13%) had improper keying access to the keying access to the system. If not mitigated, this deficiency leaves the State’s payroll payroll data at risk of misuse, abuse, and unauthorized use. system The SCO maintains the State’s payroll information system. The system is decentralized, thereby allowing employees of state agencies to access the system. PPSD has established a Decentralization Security Program that all state agencies are required to follow in order to access the State’s payroll system. The program’s objectives are to secure and protect the confidentiality and integrity of payroll data against misuse, abuse, and unauthorized use. State Fund had 71 employees with keying access to the State’s payroll system at various times between July 2012 and June 2015. We reviewed the records of the 71 employees and found that State Fund inappropriately granted nine of them keying access to the State’s payroll system. Specifically, six employees did not have their keying access immediately removed subsequent to separation from state service, transfer to another agency, or change in classification. For example, a payroll transactions unit staff member left State Fund in March 2015; however, that staff member continued to have keying access until October 2015. Also, three analysts had keying access while appointed to classifications other than those classifications allowed to have keying access; however, State Fund did not provide the required written justification. The Decentralization Security Program Manual states, in part: The privilege to access the PPSD database poses a significant risk to the ability for SCO to function. Therefore, that privilege is restricted to persons with a demonstrated need for such access. Currently, . . . -7- State Compensation Insurance Fund Payroll Process Review applications are restricted to Personnel Services Specialists (PSS), or Payroll Technician (PT) classifications because their need is by definition a function of their specific job duties, and any change in those duties requires a reevaluation of the need for access. If the employee’s duties change, such that the need for access no longer exists, the access privilege MUST be removed or deleted immediately by a request submitted by the department. . . . A request for an individual in a classification other than in the PSS/PT series to access (the payroll system) requires a written justification from the Personnel/Payroll Officer. The justification must describe the individual’s specific job duties that require the need to each type of information . . . as well as the level of access to that application, in order to perform their Statutory and/or Constitutional duties. . . . To prevent unauthorized use of a transferred, terminated or resigned employee’s userid, it is required that the Security Monitor IMMEDIATELY submit a PSD125A to delete their system access. DO NOT WAIT until another employee fills this position; this only increases the chances for breach of security, utilizing and old userid. Recommendation We recommend that State Fund update keying access to the State’s payroll system after employees leave State Fund or change classifications. State Fund’s designated security monitor should periodically review access to the system to determine that access complies with the Decentralized Security Program. FINDING 3— State Fund failed to implement controls to ensure that it adheres to the requirements of collective bargaining agreements and state regulations to Inadequate limit the accumulation of vacation and annual leave credits, resulting in controls over liability for excessive leave credits that could cost the State at least vacation and $4,489,402 as of June 30, 2015. We expect the liability to increase if State annual leave Fund does not take action to address the excessive vacation and annual balances, resulting leave credits. in liability for excessive credits Collective bargaining agreements and state regulations limit the amount of vacation and annual leave that most state employees may accumulate to no more than 80 days (640 hours). The limit on leave balances serves as a tool for state agencies to manage leave balances and control the State’s liability for accrued leave credits. State agencies may allow employees to carry a higher balance only under limited circumstances. For example, an employee may not be able to reduce accrued vacation or annual leave hours below the limit due to business needs. When an employee’s leave accumulation exceeds or is projected to exceed the limit, state agencies should work with the employee to develop a written plan to reduce leave balances below the applicable limit. Our review of the leave accounting records found that State Fund had more than 4,000 employees with unused vacation or annual leave credits at June 30, 2015. Of those employees, 662 exceeded the limit set by collective bargaining agreements and state regulations. For example, one employee had an accumulated balance of 3,129 hours in annual leave, or 2,489 hours beyond the 640-hour limit. Collectively, the 662 employees -8- State Compensation Insurance Fund Payroll Process Review accumulated more than 130,000 hours in excess vacation and annual leave, costing at least $4,489,402 as of June 30, 2015. This estimated liability does not adjust for salary rate increases and additional leave credits.2 Accordingly, we expect that the amount needed to pay for this liability will be higher. For example, a State Fund employee separated from state service with 2,773 hours in leave credits, including 2,648 hours in annual leave credit. After adjusting for additional leave credits, the employee should have been paid for 3,185 hours, or 15% more. We performed an additional review of 10 of 662 employees to determine whether State Fund complied with collective bargaining agreements and state regulations. We found that State Fund could not demonstrate that it allowed the 10 employees to carry vacation or annual leave balances beyond the limit based on exceptions specified in agreements and state regulations. While we found that procedures exist at State Fund regarding excess leave usage, only five of the 10 employees that we reviewed had a plan in place during the review period to reduce leave balances below the limit. If State Fund does not take action to reduce the excessive credits, the liability for accrued vacation and annual leave will most likely increase. This is because most employees will receive salary increases or use other non-compensable leave credits instead of vacation or annual leave, increasing their vacation or annual leave balances. In addition, the state agency responsible for paying these leave balances may also face a cash flow problem if a significant number of employees with excessive vacation or annual leave credits separate from state service. Normally, state agencies are not budgeted to make these lump-sum payments. However, the State’s current practice dictates that the state agency that last employed an employee pays for that employee’s lump-sum separation payment, regardless of where the employee accrued the leave balance. Recommendation We recommend that, to help the State reduce the liability for excessive leave balances, State Fund implement controls, including existing policies and procedures, to ensure that its employees’ vacation and annual leave balances are maintained within levels allowed by collective bargaining agreements and state regulations. State Fund should conduct ongoing monitoring of controls to ensure they are implemented and operating effectively. We further recommend that when the State offers leave buy-back programs, State Fund participate in such programs if funds are available. State Fund’s Response While we agree it is critical that every state agency monitor and implement a procedure to ensure leave balances are not excessive, I feel 2 Most state employees receive pay rate increases every year pursuant to state laws or collective bargaining agreements. In addition, when projecting accumulated leave balances upon separation, an employee earns additional leave credits equal to the amount that the employee would have earned had the employee taken time off but not separated from state service. -9- State Compensation Insurance Fund Payroll Process Review State Fund has been proactive in managing this issue. We began monitoring excessive leave balances in 2007, at which time we had 831 employees whose leave balances were in excess of 640 hours, for a total of 318,119 hours over the cap. As of December 31, 2017, those numbers were reduced to 398 employees over the cap, for a total of 85,777. Attached is a chart showing our progress in this area since 2007. The only time we did not reduce the number year over year was in 2009, when leave balances were impacted by furloughs. SCO Comment Our finding remains as stated. As stated in the finding, our review for the three fiscal years ended June 30, 2015, found that State Fund failed to implement controls to ensure that it adheres to the requirements of collective bargaining agreements and state regulations to limit the accumulation of vacation and annual leave credits, resulting in liability for excessive leave credits. State Fund agreed that it is critical for every state agency to monitor and implement procedures to ensure that leave balances are not excessive. It also provided additional information and indicated that it implemented monitoring and reduction of excessive leave balances from 2007 to December 31, 2017. We have not reviewed and cannot comment on the validity of the additional information provided by State Fund, as it does not directly relate to the review period. We also cannot comment on the validity of State Fund’s suggestion that monitoring activities resulted in reduction of excessive leave balances, as State Fund did not provide additional documentation or information to support this assertion. The reduction in excessive leave balances could have resulted from other factors, such as employee separations. We will follow up during the next payroll review to ensure that the corrective actions were adequate and appropriate. FINDING 4— State Fund lacked adequate controls over the processing of employee separation lump-sum payments. Of the 25 employees whose records we Inadequate reviewed, six were overpaid by $11,657 and nine were underpaid by controls over $10,094. If not mitigated, this control deficiency leaves State Fund at risk employee of additional improper payments. separation lump- sum pay, resulting Pursuant to collective bargaining agreements and state law, employees are in improper entitled to receive cash for accrued eligible leave credits when separating payments from state employment. Payroll records indicated that State Fund had processed separation lump-sum pay for 841 employees between July 2012 and June 2015. We reviewed the records of 25 selected employees and found that 15 (60%) were improperly paid. Of the 15 employees, six were paid 260 hours more than they should have been paid for accrued leave credits, resulting in a total overpayment of approximately $11,657; and nine employees were paid 232 hours less than they should have been paid for accrued leave credits, resulting in a total underpayment of approximately $10,094. These improper payments resulted from miscalculation of the employees’ accrued leave credits by the payroll transactions unit staff. -10- State Compensation Insurance Fund Payroll Process Review State Fund lacked adequate supervisory review to ensure accurate processing of employee separation lump-sum payments. GC sections 13402 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. Recommendation We recommend that State Fund:  Establish adequate controls to ensure accurate calculation and payment of employee separation lump-sum pay;  Conduct a review of employee separation lump-sum payments during the past three years to ensure that the payments are accurate and in compliance with collective bargaining agreements and state law; and  Recover overpayments made to separated employees in accordance with GC section 19838 and State Administrative Manual (SAM) section 8776.6, and properly compensate those employees who were underpaid. State Fund’s Response We agree with the findings regarding lump sum pay, but feel we have controls in place which will prevent similar miscalculations. State Fund has implemented changes in the process for lump sum pay. Since late 2016, every lump sum calculation is reviewed by the Transactions Supervisors. In 2017, we assigned dedicated staff to processing separations from state service to ensure consistency with the process. SCO Comment Our finding remains as stated. As stated in the finding, our review for the three fiscal years ended June 30, 2015, found improper employee separation lump-sum pay that resulted from miscalculation of accrued leave credits by the payroll transactions unit staff. State Fund lacked adequate supervisory review to ensure accurate processing of employee separation lump-sum payments. State Fund agreed with the finding; however, its response suggests that it has implemented controls since 2016 to prevent miscalculations. We have not reviewed and cannot comment on the validity of asserted actions implemented after June 30, 2015, as they were implemented subsequent to the review period. We will follow up during the next payroll review to ensure that the corrective actions were adequate and appropriate. -11- State Compensation Insurance Fund Payroll Process Review FINDING 5— State Fund lacked adequate controls to ensure that the payroll transactions unit staff processed only valid and authorized overtime compensation that Inadequate complies with collective bargaining agreements and state laws. We controls over identified $123,697 in questioned overtime payments consisting of overtime $67,835 based on actual transactions reviewed, and $55,862 based on the compensation, results of our statistical sampling. If not mitigated, this control deficiency resulting in leaves State Fund at risk of additional improper overtime compensation. improper payments Collective bargaining agreements and state law and policies contain specific clauses regarding the calculation of overtime compensation. Payroll records show that State Fund processed 26,272 overtime payments between July 2012 and June 2015, as follows: Overtime exceeding 200 hours (Items examined 100%) 6 Overtime of 200 hours or less (Population that was statistically sampled) 26,266 Total population 26,272 We examined all six payments for overtime hours exceeding 200 hours, which totaled $74,315. Of the six payments, State Fund could not provide documentation to support the payments totaling $67,835. Therefore, we questioned these payments. Of the remaining 26,266 overtime payments, we selected samples using a statistical sampling method. Based on a 95% confidence level, an expected number of exceptions of zero, and a tolerable exception rate of 5%, we randomly selected a statistical sample of 60 overtime payments, totaling $38,243. Of the 60 statistically-determined samples, State Fund improperly paid 16 of them, costing a net approximate total of $127. As we used a statistical sampling method to select the overtime payments examined, we projected the amount of likely net improper payments to be $55,735. Accordingly, the known and likely improper payments totaled a net approximate $55,862, consisting of $148,946 in overpayments and $93,084 in underpayments. The following table summarizes the results of our statistical sampling: Dollar amount of exceptions, net (rounded to the nearest dollar) $ (127) Divide by: Number of samples 60 Average dollar exception per sample, net $ (2.126795) Population that was statistically sampled 26,266 Total known and likely dollar exceptions, net $ (55,862) Less: Known dollar exceptions, net (127) Likely dollar exceptions, net $ (55,735) -12- State Compensation Insurance Fund Payroll Process Review The improper payments resulted from miscalculation of the employees’ overtime hours by the payroll transactions unit staff. State Fund lacked adequate supervisory review to ensure accurate processing of overtime compensation. GC sections 13402 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Recommendation We recommend that State Fund conduct a review of overtime payments made during the past three years to ensure that the payments comply with collective bargaining agreements and state law. State Fund should recover overpayments made to employees through an agreed-upon collection method in accordance with GC section 19838, and properly compensate those employees who were underpaid. We further recommend that, to prevent improper overtime payments from recurring, State Fund:  Establish adequate internal controls to ensure that payments for overtime compensation are accurate and comply with collective bargaining agreements and state law;  Provide adequate oversight to ensure that payroll transactions unit staff process only valid and authorized payments that comply with collective bargaining agreements and state law;  Provide training to payroll transactions unit staff members who process overtime payment transactions to ensure that they understand the requirements under collective bargaining agreements and state law; and  Maintain documentation supporting payments pursuant to retention policies. State Fund’s Response We agree with the findings regarding overtime calculations, but feel we have implemented controls since 2015 to prevent similar errors. We have automated the overtime process so that the calculations are completed by our time keeping system, and the Specialist only has to key the hours. We feel that this change has mitigated much of the potential for calculation errors. SCO Comment Our finding remains as stated. As stated in the finding, our review for the three fiscal years ended June 30, 2015, found improper overtime payments that resulted from miscalculation of overtime hours by the payroll transactions unit staff. State Fund lacked adequate supervisory review to ensure accurate processing of overtime payments. -13- State Compensation Insurance Fund Payroll Process Review State Fund agreed with the finding; however, its response suggests that it has implemented controls since 2015 to prevent errors in overtime calculation. State Fund did not specify whether the asserted controls were implemented during or after our review period. It also did not provide additional documentation to support this assertion. We cannot comment on the validity of asserted actions implemented after June 30, 2015, as they were implemented subsequent to the review period. We will follow up during the next payroll review to ensure that the corrective actions were adequate and appropriate. FINDING 6— State Fund lacked adequate controls over salary advances to ensure that they are recovered in accordance with state law and policies. The six salary Inadequate advances that we reviewed, totaling $8,446, remained outstanding as of controls over June 30, 2015 due to State Fund’s lack of collection efforts. The longest salary advances, outstanding was over one year. This control deficiency leaves State Fund resulting in failure at risk of further failures to collect salary advances if not mitigated. to recover outstanding GC section 19838 and SAM section 8776.7 allow State Fund to collect accounts salary advances in a timely manner. At June 30, 2015, State Fund’s accounting records showed 38 outstanding salary advances totaling $53,398, including six balances totaling $8,446 that had been outstanding for more than 90 days. Generally, the prospect of collection diminishes as an account ages. When an agency is unable to collect after three years, the possibility of collection is remote. In our review of the six salary advances that were over 90 days old, State Fund failed to demonstrate adequate collection efforts in all of them. In four salary advances, State Fund failed to clear the salary advances with the payroll warrant because the employees remained on direct deposit. In two salary advances, State Fund did not send collection notices promptly. One salary advance was issued in November 2014, and the collection notice was not sent until May 2015. Another salary advance was issued in June 2014; the first collection letter was not sent until September 2014, and the second collection letter was not sent until April 2015. The lack of adequate controls over salary advances increases the risk of financial loss due to unauthorized salary advances, reduces the likelihood of collection, increases the amount of resources expended on collection efforts, and negatively impacts cash flow. Recommendation We recommend that State Fund ensure that it recovers salary advances in a timely manner pursuant to GC section 19838 and SAM section 8776.7. If reasonable collection procedures do not result in payment, State Fund may request discharge from accountability of uncollectable amounts. -14- State Compensation Insurance Fund Payroll Process Review FINDING 7— State Fund lacked adequate controls to ensure that payroll transactions unit staff processed uniform allowance and severance pay in accordance with Inadequate contracts and policies. Staff members improperly keyed out-of-class controls over payments as uniform allowance into the State payroll system. State Fund uniform allowance also did not comply with the contract for one employee’s severance pay. and severance pay, These control deficiencies leave State Fund at risk of additional resulting in noncompliance if not mitigated. noncompliance Payroll records showed that State Fund paid $6,637 in uniform allowance to six employees between June 2012 and July 2015. Our review found that the payroll transactions unit staff keyed these payments into the system incorrectly as uniform allowance. Supporting documentation showed that these payments were for out-of-class compensation. SCO’s Payroll Procedures Manual provides specific coding that state agencies should use when processing leave buy-back transactions. Payroll records also showed that State Fund paid severance pay, totaling $882,770, to three employees. Our review of these payments found that, for one employee, State Fund did not comply with the contract. The contract states that the severance payment will be made in equal payments over 12 months. State Fund paid the full amount during the second month. State Fund could not provide documentation to support this exception to the contract. GC sections 13402 and 13407 require state agencies to establish and maintain internal controls, including a system of authorization and recordkeeping procedures over expenditures, and an effective system of internal review. Recommendation We recommend that State Fund:  Conduct a review of premium, award, and special payments issued during the past three years to ensure that the payments comply with contracts and state policies;  Establish adequate internal controls to ensure that payments for premiums, awards, and special compensation comply with contracts and state policies, including oversight to ensure that payroll transactions unit staff process only valid and authorized payments; and  Provide training to payroll transactions unit staff members to ensure that they understand the requirements under contracts and state policies. -15- State Compensation Insurance Fund Payroll Process Review Attachment— State Compensation Insurance Fund’s Response to Draft Review Report State Controller’s Office Division of Audits Post Office Box 942850 Sacramento, CA 94250-5874 http://www.sco.ca.gov S17-PAR-9001