High Desert State Prison - Payroll Process Review

HIGH DESERT STATE PRISON Review Report PAYROLL PROCESS REVIEW July 1, 2012, through June 30, 2015 BETTY T. YEE California State Controller May 2019 BETTY T. YEE California State Controller May 13, 2019 M. Eliot Spearman, Warden High Desert State Prison P.O. Box 750 Susanville, CA 95127 Dear Mr. Spearman: The State Controller’s Office reviewed High Desert State Prison’s (HDSP) payroll process for the period of July 1, 2012, through June 30, 2015. HDSP management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. Our limited review identified material weaknesses in internal control over the HDSP payroll process that leave HDSP at risk of additional improper payments if not mitigated. Specifically, HDSP lacked adequate segregation of duties and compensating controls over its processing of payroll transactions. The lack of segregation of duties and appropriate compensating controls has a pervasive effect on the HDSP payroll process and impairs the effectiveness of other controls by rendering their design ineffective or by keeping them from operating effectively. In addition, HDSP did not immediately remove keying access to the State’s payroll system for one employee after the employee’s separation from state service. We also found that HDSP lacked sufficient controls over the processing of specific payroll- related transactions to ensure that HDSP complies with collective bargaining agreements and state laws, and that only valid and authorized payments are processed. These control deficiencies contributed to HDSP employees’ excessive vacation and annual leave balances, and improper and questioned payments, costing the State an estimated net total of $189,530. If you have any questions, please contact Andrew Finlayson, Chief, State Agency Audits Bureau, by phone at (916) 324-6310. Sincerely, Original signed by JIM L. SPANO, CPA Chief, Division of Audits JLS/as M. Eliot Spearman, Warden -2- May 13, 2019 cc: Jason Pickett, Chief Deputy Warden High Desert State Prison Anthony Lane, Assistant Warden – Business Services High Desert State Prison Joseph Shelton, Chief Business Manager High Desert State Prison Sasha Campbell, Staff Services Manager I High Desert State Prison Mai Lee Vang, External Audits Manager I Office of Audits and Court Compliance California Department of Corrections and Rehabilitation Keely Percy, External Audits Coordinator Office of Audits and Court Compliance California Department of Corrections and Rehabilitation Jennifer Boehmer, External Audits Coordinator Office of Audits and Court Compliance California Department of Corrections and Rehabilitation Janine Seyler, Staff Services Manager III Office of Personnel Services California Department of Corrections and Rehabilitation Michelle Stephens, Staff Services Manager I Office of Personnel Services California Department of Corrections and Rehabilitation Sherry Knight, Staff Services Manager II Support Services Department California Department of Corrections and Rehabilitation High Desert State Prison Payroll Process Review Contents Review Report Summary ............................................................................................................................ 1 Background ........................................................................................................................ 1 Objectives, Scope, and Methodology ............................................................................... 2 Conclusion .......................................................................................................................... 3 Views of Responsible Officials .......................................................................................... 4 Restricted Use .................................................................................................................... 4 Schedule—Summary of Review Report ............................................................................... 5 Findings and Recommendations ........................................................................................... 6 Attachment—High Desert State Prison’s Response to Draft Review Report High Desert State Prison Payroll Process Review Review Report Summary The State Controller’s Office (SCO) reviewed High Desert State Prison’s (HDSP) payroll process for the period of July 1, 2012, through June 30, 2015. HDSP management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. Our limited review identified material weaknesses in internal control over the HDSP payroll process that leave HDSP at risk of additional improper payments if not mitigated. We found that HDSP has a combination of deficiencies in internal control over its payroll process such that there is reasonable possibility that a material misstatement in financial information or noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. Specifically, HDSP lacked adequate segregation of duties and compensating controls over its processing of payroll transactions; as a result, Payroll Transactions Unit staff performed conflicting duties. Staff members performed multiple steps in processing payroll transactions, including entering data into the State’s payroll system; auditing employee timesheets; reconciling payroll, including reconciling system output to source documentation; and reporting payroll exceptions. This control deficiency was aggravated by the lack of compensating controls, such as management oversight and review, to mitigate the risks associated with such a deficiency. The lack of segregation of duties and appropriate compensating controls has a pervasive effect on the HDSP payroll process and impairs the effectiveness of other controls by rendering their design ineffective or by keeping them from operating effectively. In addition, HDSP did not immediately remove keying access to the State’s payroll system for one employee after the employee’s separation from state service. We also found that HDSP lacked sufficient controls over the processing of specific payroll-related transactions to ensure that HDSP complies with collective bargaining agreements and state laws, and that only valid and authorized payments are processed. As summarized in the schedule, these control deficiencies contributed to HDSP employees’ excessive vacation and annual leave balances, and improper and questioned payments, costing the State an estimated net total of $189,530. Background In 1979, the State of California adopted collective bargaining for state employees. This created a significant workload increase for the SCO’s Personnel and Payroll Services Division (PPSD), as PPSD was the State’s centralized payroll processing center for all payroll-related transactions. PPSD decentralized the processing of payroll, allowing state agencies and departments to process their own payroll-related transactions. Periodic reviews of the decentralized payroll processing at state agencies and departments ceased due to the budget constraints in the late 1980s. -1- High Desert State Prison Payroll Process Review In 2013, the California State Legislature reinstated these payroll reviews to gain assurance that state agencies and departments maintain adequate internal control over the payroll function, provide proper oversight of their decentralized payroll processing, and comply with various state laws and regulations regarding payroll processing and related transactions. Review Authority Authority for this review is provided by California Government Code (GC) section 12476, which states, “The Controller may audit the uniform state pay roll system, the State Pay Roll Revolving Fund, and related records of state agencies within the uniform state pay roll system, in such manner as the Controller may determine.” In addition, GC section 12410 stipulates that “The Controller shall superintend the fiscal concerns of the state. The Controller shall audit all claims against the state, and may audit the disbursement of any state money, for correctness, legality, and for sufficient provisions of law for payment.” Objectives, Scope, We performed this review to determine whether HDSP: and Methodology  Processed payroll and payroll-related disbursements accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures;  Established adequate internal control over payroll to meet the following control objectives: o Payroll and payroll-related transactions are properly approved and certified by authorized personnel; o Only valid and authorized payroll and payroll-related transactions are processed; o Payroll and payroll-related transactions are accurate and properly recorded; o Payroll systems, records, and files are adequately safeguarded; and o State laws, regulations, policies, and procedures are complied with regarding payroll and payroll-related transactions;  Complied with existing controls as part of the ongoing management and monitoring of payroll and payroll-related expenditures;  Maintained accurate records of leave balances; and  Administered and recorded salary advances in accordance with state laws, regulations, policies, and procedures. We reviewed HDSP payroll processes and transactions for the period of July 1, 2012, through June 30, 2015. To achieve our review objectives, we:  Reviewed state and HDSP policies and procedures related to the payroll process to understand HDSP’s methodology for processing various payroll and payroll-related transactions; -2- High Desert State Prison Payroll Process Review  Interviewed HDSP payroll personnel to understand HDSP’s methodology for processing various payroll and payroll-related transactions, determine their level of knowledge and ability relating to the payroll transaction processing, and gain an understanding of existing internal control over the payroll process and systems;  Analyzed and tested transactions recorded in the State’s payroll database and reviewed relevant files and records to determine accuracy of payroll and payroll-related payments, accuracy of leave transactions, propriety of review and approval of transactions, adequacy of internal control over the payroll process and systems, and compliance with collective bargaining agreements and state laws, regulations, policies, and procedures (errors found from statistically- determined samples were projected to the intended population); and  Reviewed salary advances to determine whether HDSP administered and recorded them in accordance with state laws, regulations, policies, and procedures. Conclusion Based on the results of our reivew, we found that HDSP:  Complied with existing controls as part of the ongoing management and monitoring of payroll and payroll-related expenditures; and  Administered and recorded salary advances in accordance with state laws, regulations, policies, and procedures. However, we also found that HDSP:  Lacked adequate internal conrol over payroll and payroll-related transactions (see Findings 1 through 8);  Did not process payroll and payroll-related disbursements accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures (see Findings 3 through 8); and  Did not maintian accurate records of leave balances (see Finding 6). As quantified in the Schedule and described in the Findings and Recommendations section of this reivew report, these material weaknesses1 in internal control over the payroll process contributed to HDSP employees’ excessive vacation and annual leave balances, and improper and questioned payments, costing the State an estimated $189,530. 1An evaluation of an entity’s payroll process may identify deficiencies in its internal control over such a process. A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, misstatements in financial information, impairments of effectiveness or efficiency of operations, or noncompliance with provisions of laws, regulations, or contracts on a timely basis. Control deficiencies, either individually or in combination with other control deficiencies, may be evaluated as significant deficiencies or material weaknesses. A material weakness is a deficiency, or a combination of deficiencies, in internal control such that there is a reasonable possibility that a material misstatement in financial information, impairment of effectiveness or efficiency of operation, or noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. A significant deficiency is a deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness, yet important enough to merit attention by those charged with governance. -3- High Desert State Prison Payroll Process Review Views of We issued a draft review report on April 3, 2019. M. Eliot Spearman, Responsible Warden, responded by letter dated April 16, 2019 (Attachment). HDSP disagreed with Finding 1, but agreed with Findings 2 through 8 and Officials indicated that it has taken steps to correct the deficiencies noted in the findings. We will follow up during the next payroll engagement to ensure that these corrective actions were adequate and appropriate. Restricted Use This report is solely for the information and use of HDSP and the SCO; it is not intended to be and should not be used by anyone other than these specified parties. This restriction is not intended to limit distribution of this report, which is a matter of public record and is available on the SCO website at www.sco.ca.gov. Original signed by JIM L. SPANO, CPA Chief, Division of Audits May 13, 2019 -4- High Desert State Prison Payroll Process Review Schedule— Summary of Review Report July 1, 2012, through June 30, 2015 Total Dollar Dollar Issues as a Amount of Number of Amount of Number of Percentage of Dollar Dollar Known and Finding Selections Method of Selection Selections Selections Selections Amount of Amount of Likely Number Issues Reviewed Selection Unit Reviewed with Issues Reviewed * Known Issues Likely Issues Issues 1 Inadequate segregation - - - - - - - - - of duties and compensating controls 2 Inappropriate keying 27 Targeted Employee - 1 4% - - - access to the State's payroll system 3 Inadequate controls 60 Targeted Employee $ 586,760 60 100% $ 586,760 $ - $ 586,760 over vacation and annual leave balances, resulting in liability for excessive credits 4 Inadequate controls 51 Statistical Employee 1,090,557 over separation lump- sum pay, resulting in improper payments: Group 1 overpayments -- See above -- 39 76% 49,251 20,288 6 9,539 Group 1 underpayments -- See above -- 1 2% ( 87) (36) ( 123) Group 1 Questioned -- See above -- 3 3% 78,015 32,137 110,152 payments 51 Statistical Employee 5 08,770 Group 2 overpayments -- See above -- 3 6% 1 ,101 2,399 3,500 Group 2 underpayments -- See above -- 6 12% (4,515) ( 9,839) (14,354) 5 Inadequate controls 60 Statistical Overtime 1 56,180 over overtime transaction compensation, resulting in improper payments: Overpayments -- See above -- 2 3% 435 169,404 169,839 Underpayments -- See above -- 1 3% (1,916) (746,155) ( 748,071) 10 Targeted Overtime 93,305 1 10% (358) - ( 358) transaction 6 Inadequate controls 64 Targeted Holiday 13,736 over holiday credits, Credit resulting in improper accruals accruals: Over-accrued -- See above -- 11 17% 2 ,615 - 2,615 Under-accrued -- See above -- 1 2% ( 38) - (38) 7 Inadequate controls 51 Statistical Employee 69,763 8 16% 3 ,685 6,431 1 0,116 over uniform allowance, resulting in improper payments and noncompliance 8 Inadequate controls 23 Targeted Employee 20,865 1 4% ( 47) - (47) over leave buy-back, resulting in an inaccurate payment calculation 397 $ 2,539,936 138 $ 714,901 $ (525,371) $ 189,530 * All percentages are rounded to the nearest full percentage point -5- High Desert State Prison Payroll Process Review Findings and Recommendations FINDING 1— HDSP lacked adequate segregation of duties within its Payroll Transactions Unit to ensure that only valid and authorized payroll Inadequate transactions were processed. HDSP also failed to implement other controls segregation of to compensate for this risk. duties and compensating GC sections 13402 through 13407 require state agencies to establish and controls over maintain internal controls, including proper segregation of duties and an payroll effective system of internal review. Adequate segregation of duties transactions reduces the likelihood that fraud or error will remain undetected by providing for separate processing by different individuals at various stages of a transaction, and for independent reviews of the work performed. Our review found that HDSP Payroll Transactions Unit staff performed conflicting duties. Staff members performed multiple steps in processing payroll transactions, including entering data into the State’s payroll system; auditing employee timesheets; reconciling payroll, including reconciling system output to source documentation; and reporting payroll exceptions. For example, Payroll Transactions Unit staff keyed in regular and overtime pay and reconciled the master payroll, overtime, and other supplemental warrants. HDSP failed to demonstrate that it had implemented compensating controls to mitigate the risks associated with such a deficiency. We found no indication that supervisors conducted periodic reviews of transactions processed by the Payroll Transactions Unit staff. The lack of adequate segregation of duties and compensating controls has a pervasive effect on the HDSP payroll process, and impairs the effectiveness of other controls by rendering their design ineffective or by keeping them from operating effectively. These control deficiencies, in combination with other deficiencies discussed in Findings 2 through 8, represent a material weakness in internal control over the payroll process such that there is a reasonable possibility that a material misstatement in financial information or noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. Good internal control practices require that the following functional duties be performed by different work units, or at a minimum, by different employees within the same unit:  Recording transactions – This duty refers to the record-keeping function, which is accomplished by entering data into a computer system.  Authorization to execute – This duty belongs to individuals with authority and responsibility to initiate and execute transactions.  Periodic review and reconciliation of actual payments to recorded amounts – This duty refers to making comparisons of information at regular intervals and taking action to resolve differences. -6- High Desert State Prison Payroll Process Review Recommendation We recommend that HDSP:  Separate conflicting duties to the greatest extent possible. Adequate segregation of duties will provide a stronger system of internal control whereby the functions of each employee are subject to the review of another. If it is not possible to segregate payroll functions fully and appropriately, HDSP should implement compensating controls. For example, if the Payroll Transactions Unit staff member responsible for recordkeeping also performs a reconciliation process, the supervisor should perform and document a detailed review of the reconciliation to provide additional control over the assignment of conflicting functions. Compensating controls may also include dual authorization requirements and documented reviews of payroll system input and output; and  Develop formal written procedures for performing and documenting compensating controls. HDSP’s Response Finding 1 – Inadequate segregation of duties and compensating controls over payroll transaction. SCO review states, “HDSP Payroll Transactions Unit staff performed conflicting duties. Staff members performed multiple steps in processing payroll transactions, including entering data into the State’s payroll system; auditing employee timesheets; reconciling payroll, including reconciling system output to source documentation; and reporting payroll exceptions.” HDSP believes that there are controls in place that ensure timekeeper duties do not overlap with the personnel transaction staff who key in the payroll system. HDSP believes there is sufficient separation of duties within the Personnel Office and has mitigated this risk. SCO Comment Our finding remains unchanged. As discussed in the finding, our review identified conflicting staff tasks. Supervisors from HDSP’s Payroll Transactions Unit indicated during fieldwork that Personnel Specialists’ duties for regular and overtime pay processing included data entry; auditing employee timesheets; reconciling payroll; and identifying and reporting exceptions noted by their own review of payroll system output of the data that they had keyed. In addition, there was no evidence to support that supervisors conducted periodic reviews of transactions processed by Personnel Specialists. Therefore, there is a lack of segregation of duties and compensating controls to mitigate the risk that errors, intentional or not, could occur when Personnel Specialists enter timesheet data into the payroll system, audit attendance that is reported on the timesheets, and review their own work. HDSP lacked adequate controls to ensure that only appropriate staff FINDING 2— members have keying access to the State’s payroll system. Of the 27 Inappropriate employees whose records we reviewed, one (4%) had improper keying keying access to the access to the system. If not mitigated, this deficiency leaves the payroll State’s payroll data at risk of misuse, abuse, and unauthorized use. system -7- High Desert State Prison Payroll Process Review The SCO maintains the State’s payroll information system. The system is decentralized, thereby allowing employees of state agencies to access it. PPSD established a Decentralized Security Program Manual, which all state agencies are required to follow in order to access the State’s payroll systems. The program’s objectives are to secure and protect the confidentiality and integrity of the data against misuse, abuse, and unauthorized use. HDSP had 27 employees with keying access to the State’s payroll system at various times between July 2012 and June 2015. We reviewed the records of the 27 employees and found that HDSP inappropriately allowed one of them continued keying access to the State’s payroll system. Specifically, the employee’s keying access was not immediately removed subsequent to separation from state service. The Payroll Transactions Unit staff member’s last working day was January 11, 2013, and the separation date was January 15, 2013; however, the staff member continued to have keying access until March 1, 2013. The Decentralized Security Program Manual states, in part: The privilege to access the PPSD database poses a significant risk to the ability for SCO to function. Therefore, that privilege is restricted to persons with a demonstrated need for such access. . . . To prevent unauthorized use of a transferred, terminated or resigned employee’s userid, it is required that the Security Monitor IMMEDIATELY submit a PSD125A to delete their system access. DO NOT WAIT until another employee fills this position; this only increases the chances for breach of security, utilizing and old userid. Recommendation We recommend that HDSP:  Update keying access to the State’s payroll system after employees leave HDSP; and  Periodically review access to the system to verify that access complies with the Decentralized Security Program. HDSP failed to implement controls to ensure that it adheres to the FINDING 3— requirement of collective bargaining agreements and state regulations to Inadequate limit the accumulation of vacation and annual leave credits, resulting in controls over liability for excessive leave credits that could cost the State at least vacation and $586,760 as of June 30, 2015. We expect the liability to increase if HDSP annual leave does not take action to address the excessive vacation and annual leave balances, resulting credits. in liability for excessive credits Collective bargaining agreements and state regulations limit the amount of vacation and annual leave that most state employees may accumulate to no more than 80 days (640 hours), and certified time off (CTO) to no more than 240 hours. The limit on leave balances serves as a tool for managing leave balances and controlling the State’s liability for accrued leave credits. State agencies may allow employees to carry a higher balance only in limited circumstances. For example, an employee may not be able to reduce accrued vacation or annual leave hours below the limit because of -8- High Desert State Prison Payroll Process Review business needs. When an employee’s leave accumulation exceeds or is projected to exceed the limit, state agencies should work with the employee to develop a written plan to reduce leave balances below the applicable limit. Our review of HDSP’s leave accounting records found that HDSP had 1,168 employees with unused vacation leave, annual leave, or CTO credits at June 30, 2015. Of those employees, 60 exceeded the limit set by collective bargaining agreements and state regulations. For example, one employee had an accumulated balance of 1,615 hours in annual leave, or 975 hours beyond the 640-hour limit. Collectively, the 60 employees accumulated more than 14,000 hours in excess vacation leave, annual leave, or CTO costing at least $586,760 as of June 30, 2015. This estimated liability does not adjust for salary rate increases and additional leave credits.2 Accordingly, we expect that the amount needed to pay for this liability will be higher. For example, an HDSP employee separated from state service with 971.75 hours in leave credits, including 966.5 hours in annual leave credit. After adjusting for additional leave credits, the employee should have been paid for 1,093.75 hours, or 13% more. Discussions with HDSP representatives indicated that HDSP does not enforce the leave balance requirements of the applicable bargaining agreements. In addition, HDSP did not have written plans in place for the employees with excessive leave balances to reduce their balances below the applicable limit. If HDSP does not take action to reduce the excessive credits, the liability for accrued vacation leave, annual leave, and CTO will most likely increase. This is because most employees will receive salary increases or use other non-compensable leave credits instead of vacation leave, annual leave, or CTO, which will increase their leave balances. In addition, the state agency responsible for paying these leave balances may also face a cash flow problem if a significant number of employees with excessive vacation leave, annual leave, or CTO credits separate from state service. Normally, state agencies are not budgeted to make these lump-sum payments. However, the State’s current practice dictates that the state agency that last employed an employee pays for that employee’s lump- sum separation payment, regardless of where the employee accrued the leave balance. Recommendation We recommend that HDSP:  Implement controls, including existing policies and procedures, to ensure that its employees’ vacation leave, annual leave, and CTO balances are maintained within levels allowed by collective bargaining agreements and state regulations; 2Most state employees receive pay rate increases every year pursuant to state laws and/or collective bargaining agreements until they reach the top of their pay scale, or promote into a higher-paying position. In addition, when an employee’s accumulated leave balances upon separation from state service are calculated for lump-sum pay, the employee is credited with additional leave credits equal to the amount that the employee would have earned had the employee taken time off and not separated from state service. -9- High Desert State Prison Payroll Process Review  Monitor controls to ensure that they are implemented and operating effectively; and  Participate in leave buy-back programs if the state offers them and adequate funds are available. HDSP lacked adequate controls over the processing of employee FINDING 4— separation lump-sum payments. We identified $168,714 in net questioned Inadequate overpayments consisting of $123,765 based on actual transactions controls over reviewed, and $44,949 in net questioned overpayments based on the separation lump- results of our statistical sampling. If not mitigated, this control deficiency sum pay, resulting leaves HDSP at risk of additional improper payments. in improper payments Pursuant to collective bargaining agreements and state law, employees are entitled to receive cash for accrued eligible leave credits when separating from state employment. Payroll records indicated that HDSP processed separation lump-sum pay for 234 employees—72 safety employees subject to the 7(k) overtime exemption, and 162 non-safety employees not subject to the 7(k) overtime exemption—between July 2012 and June 2015. Based on a 95% confidence level, an expected number of exceptions of zero, and a tolerable exception rate of 5%, we randomly selected a statistical sample of 51 lump-sum payments from both the 7(k) and non- 7(k) stratified populations. Of the 51 statistically-determined samples, valued at $1,090,557, from the 72 safety employees whose records we reviewed, 39 were overpaid for a combined 1,264.34 hours, valued at $49,251. In addition, one employee was underpaid for 2.13 hours, valued at $87. Three employees were paid for 2,317 hours, valued at $78,015; these costs could not be verified due to a lack of supporting documentation. Therefore, these amounts are questioned costs. Of the 51 statistically-determined samples, valued at $508,770, from the 162 non-safety employees whose records we reviewed, three were overpaid for a combined 40.42 hours, valued at $1,101. In addition, six employees were underpaid for a combined 68.6 hours, valued at $4,515. These improper payments resulted from miscalculation of the employees’ accrued leave credits by the Payroll Transactions Unit staff. HDSP lacked adequate supervisory review to ensure accurate processing of employee separation lump-sum payments. As we used statistical sampling to select the lump-sum separation payments examined, we projected the amount of likely net improper payments to be $44,949. Accordingly, the known and likely improper payments total a net approximate $168,714, consisting of $73,039 in overpayments, $14,477 in underpayments, and $110,152 in questioned costs. -10- High Desert State Prison Payroll Process Review The following table summarizes the results of our statistical sampling: Dollar amount of 7(k) exempt exceptions, net (rounded to the nearest dollar) $ 1 27,179 Divide by: Number of samples 5 1 Average dollar exception per sample, net 2 ,494 Population that was statistically sampled 7 2 Total known and likely dollar exceptions, net 1 79,568 Less: Known dollar exceptions, net ( 127,179) Likely dollar exceptions, net $ 5 2,389 Dollar amount of Non-7(k) exempt exceptions, net (rounded to the nearest dollar) $ ( 3,414) Divide by: Number of samples 5 1 Average dollar exception per sample, net ( 67) Population that was statistically sampled 1 62 Total known and likely dollar exceptions, net ( 10,854) Less: Known dollar exceptions, net 3 ,414 Likely dollar exceptions, net $ ( 7,440) Total known dollar exceptions, net $ 1 23,765 Total likely dollar exceptions, net 4 4,949 Total known and likely dollar exceptions, net $ 1 68,714 GC sections 13402 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Recommendation We recommend that HDSP:  Establish adequate controls to ensure accurate calculation and payment of employee separation lump-sum pay;  Conduct a review of employee separation lump-sum payments during the past three years to ensure that the payments are accurate and in compliance with collective bargaining agreements and state law; and  Recover overpayments made to separated employees in accordance with GC section 19838 and State Administrative Manual section 8776.6, and properly compensate those employees who were underpaid. HDSP lacked adequate controls to ensure that the Payroll Transactions FINDING 5— Unit staff processed only valid and authorized overtime compensation that Inadequate complied with collective bargaining agreements and state laws. We controls over identified $578,590 in questioned under-compensation of overtime overtime payments consisting of $1,839 based on actual transactions reviewed, and compensation, $576,751 based on the results of our statistical sampling. If not mitigated, resulting in this control deficiency leaves HDSP at risk of additional improper improper overtime compensation. payments Collective bargaining agreements and state law and policies contain specific clauses regarding the calculation of overtime compensation. Payroll records show that HDSP processed 23,555 overtime payments -11- High Desert State Prison Payroll Process Review between July 2012 and June 2015. We initially target-selected 28 payments for overtime hours that we thought represented overtime payments exceeding 300 hours, which totaled $317,335. However, we found that this was not the case. Of the remaining 23,527 overtime payments, we stratified the population into two groups: 23,426 overtime payments to employees in Work Week Group (WWG) 2, and 101 overtime payments to exempt and supervisory employees in WWG E and WWG SE. We target-selected 10 of the 101 WWG E/SE overtime payments totaling $93,305. We found that one was undercompensated by $358. Based on a 95% confidence level, an expected number of exceptions of zero, and a tolerable exception rate of 5%, we randomly selected a statistical sample of 60 overtime payments, totaling $156,180, out of $45,424,312. Of the 60 statistically-determined sample payments, we determined that HDSP improperly paid three of them, costing a net approximate under- compensation of $1,482. Of the three improper payments, two resulted in over-compensation, totaling approximately $435; and one resulted in under-compensation, totaling approximately $1,916. As we used statistical sampling to select the payments examined, we projected the amount of likely over-compensation to be $169,404 and likely under-compensation to be $746,155. The following table summarizes the results of our statistical sampling: Dollar amount of exceptions, net (rounded to the nearest dollar) $ ( 1,481) Divide by: Number of samples 6 0 Average dollar exception per sample, net ( 24.68) Population that was statistically sampled 2 3,426 Total known and likely dollar exceptions, net ( 578,232) * Less: Known dollar exceptions, net 1 ,481 Likely dollar exceptions, net $ ( 576,751) _____________ *Variance due to rounding. The improper payments resulted from miscalculation of the employees’ overtime hours by the Payroll Transactions Unit staff. HDSP lacked adequate supervisory review to ensure accurate processing of overtime compensation. GC sections 13402 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. -12- High Desert State Prison Payroll Process Review Recommendation We recommend that HDSP:  Conduct a review of overtime payments made during the past three years to ensure that the payments comply with collective bargaining agreements and state laws;  Recover overpayments made to employees through an agreed-upon collection method in accordance with GC section 19838; and  Properly compensate those employees who were underpaid. We further recommend that, to prevent improper overtime payments from recurring, HDSP:  Establish adequate internal controls to ensure that payments for overtime compensation are accurate and comply with collective bargaining agreements and state laws;  Provide adequate oversight to ensure that Payroll Transactions Unit staff process only valid and authorized payments that comply with collective bargaining agreements and state laws; and  Provide training to Payroll Transactions Unit staff members who process overtime payment transactions to ensure that they understand the requirements under collective bargaining agreements and state laws. HDSP lacked adequate controls to ensure that the Payroll Transactions FINDING 6— Unit staff processed only valid and authorized holiday credits that Inadequate complied with collective bargaining agreements and state laws. HDSP controls over improperly processed 12 of 64 holiday credit transactions that we selected holiday credits, for review, resulting in a net over-accrual of 91.25 holiday credit hours at resulting in a cost of approximately $2,577. improper accruals Collective bargaining agreements and state laws and policies identify specific compensable holidays for which holiday credits may be accrued. Leave accounting records showed a total of 64 transactions with a total of 515.25 hours of holiday credit, valued at $13,736, that were accrued during months that have no holidays. We reviewed all 64 transactions and determined that the majority were accruals of personal holidays. Eleven of the 64 transactions were over- accruals in the amount of 92 hours, which resulted in an overpayment of approximately $2,615. One of the 64 transactions was an under-accrual of 0.75 hours, at a value of approximately $38. These improper accruals resulted from improper processing of the employees’ holiday credit by the Payroll Transactions Unit staff. HDSP lacked adequate supervisory review to ensure accurate processing of employee holiday credit accruals. GC sections 13402 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. -13- High Desert State Prison Payroll Process Review Recommendation We recommend that HDSP:  Conduct a review of holiday credit accruals made during the past three years to ensure that the holiday credits accrued comply with collective bargaining agreements and state laws; and  Make appropriate adjustments to holiday credit leave balances of improper accruals identified. We further recommend that, to prevent improper holiday credit accruals from recurring, HDSP:  Establish adequate internal controls to ensure that holiday credit accruals are accurate and comply with collective bargaining agreements and state laws;  Provide adequate oversight to ensure that Payroll Transactions Unit staff process only holiday credits that are earned; and  Provide training to Payroll Transactions Unit staff members who process holiday credits to ensure that they understand the requirements under collective bargaining agreements and state laws. HDSP lacked adequate controls to ensure that the Payroll Transactions FINDING 7— Unit staff processed only valid and authorized uniform allowance Inadequate compensation that complied with collective bargaining agreements and controls over state laws. We identified $10,116 in questioned costs of uniform uniform allowance, allowance payments consisting of $3,685 based on actual transactions resulting in reviewed, and $6,431 based on the results of our statistical sampling. If improper not mitigated, this control deficiency leaves HDSP at risk of additional payments and improper uniform allowance compensation. noncompliance Collective bargaining agreements indicate the amount of uniform allowance allowed to an eligible recipient. We stratified the population of all uniform allowance payments totaling approximately $1.2 million to individuals that received uniform allowance payments in excess of the maximum allowed by their respective bargaining units per fiscal year. This stratified population consisted of 140 employees with uniform allowances totaling $196,310. Based on a 95% confidence level, an expected number of exceptions of zero, and a tolerable exception rate of 5%, we randomly selected a statistical sample of 51 employees who received uniform allowance payments in excess of the maximum allowed by their respective bargaining units per fiscal year, totaling $69,763 out of the $196,310. We tested all payments made during the three-year review period for each of the 51 sampled individuals. Of the 51 statistically-determined sample payments, we determined that HDSP improperly paid six of them, costing $3,685 over the three-year period under review. In addition, two of the 51 sampled individuals did not receive their uniform allowance payments in a timely manner. -14- High Desert State Prison Payroll Process Review As we used statistical sampling to select the payments examined, we porjected the amount of likely over-compensation to be $6,431. The following table summarizes the results of our statistical sampling: Dollar amount of exceptions, net (rounded to the nearest dollar) $ 3 ,685 Divide by: Number of samples 5 1 Average dollar exception per sample, net 7 2.25 Population that was statistically sampled 1 40 Total known and likely dollar exceptions, net 1 0,116 * Less: Known dollar exceptions, net ( 3,685) Likely dollar exceptions, net $ 6 ,431 ______________ *Variance due to rounding. The improper payments resulted from an unallowable additional uniform allowance allotment made to individuals who were members of the “Crisis Response Team.” HDSP lacked adequate supervisory review to ensure that only allowable uniform allowance payments were made. GC sections 13402 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Recommendation We recommend that, to prevent improper and untimely uniform allowance payments from recurring, HDSP:  Establish adequate internal controls to ensure that uniform allowance payments are allowable and comply with collective bargaining agreements;  Provide adequate oversight to ensure that Payroll Transactions Unit staff only process allowable uniform allowance payments, and process them in a timely manner in accordance with collective bargaining agreements; and  Provide training to Payroll Transactions Unit staff members who process uniform allowance payments to ensure that they understand the requirements under collective bargaining agreements and state laws. HDSP lacked adequate controls to ensure that Payroll Transactions Unit FINDING 8— staff members properly and accurately processed leave buy-back Inadequate compensation. We identified one incorrectly calculated leave buy-back controls over leave transaction that resulted in an underpayment of $47. If not mitigated, this buy-back, resulting control deficiency leaves HDSP at risk of additional inaccurate leave buy- in an inaccurate back payment calculations. payment calculation Agreements reached with collective bargaining units 7 and 9 in 2013 allowed for the annual cash-out of up to 20 hours of accumulated vacation -15- High Desert State Prison Payroll Process Review or annual leave for employees in these bargaining units who worked in departments with available funds. Vacation or annual leave cash-out means that eligible employees in participating departments may receive payment at their regular salary rate in exchange for accrued vacation or annual leave. We identified 23 leave buy-back payments, valued at $20,865. We reviewed the calculations for all 23 payments and found that one of the 23 payments was inaccurately calculated, resulting in an underpayment of $47. The underpayment occurred because HDSP Payroll Transactions Unit staff members used an incorrect salary rate when calculating the payment. HDSP lacked adequate supervisory review to ensure accurate processing of leave buy-back payments. GC sections 13402 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Recommendation We recommend that, to prevent inaccurate leave buy-back payments from recurring, HDSP:  Establish adequate internal controls to ensure that leave buy-back payments are accurate and comply with collective bargaining agreements;  Provide adequate oversight to ensure that Payroll Transactions Unit staff accurately calculate leave buy-back payments; and  Provide training to Payroll Transactions Unit staff members who process leave buy-back payments to ensure that they understand the requirements under collective bargaining agreements and state laws. -16- High Desert State Prison Payroll Process Review Attachment— High Desert State Prison’s Response to Draft Review Report -17- State Controller’s Office Division of Audits Post Office Box 942850 Sacramento, CA 94250 http://www.sco.ca.gov S18-PAR-9000