California Department of Justice - Payroll Process Review

CALIFORNIA DEPARTMENT OF JUSTICE Review Report PAYROLL PROCESS REVIEW July 1, 2012, through June 30, 2015 BETTY T. YEE California State Controller June 2019 BETTY T. YEE California State Controller June 13, 2019 Xavier Becerra, Attorney General California Department of Justice 1300 I Street Sacramento, CA 95814 Dear Attorney General Becerra: The State Controller’s Office reviewed the California Department of Justice (DOJ) payroll process for the period of July 1, 2012, through June 30, 2015. DOJ management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. Our review found material weaknesses in internal control over the DOJ payroll process. These weaknesses contributed to DOJ employees’ excessive vacation and annual leave balances, improper and questioned payments for employee separation lump-sum pay and leave buy-back, improper holiday compensation, and long-outstanding unrecovered salary advances, costing the State an estimated net total of $10,743,096. If you have any questions, please contact Andrew Finlayson, Chief, State Agency Audits Bureau, by telephone at (916) 324-6310. Sincerely, Original signed by JIM L. SPANO, CPA Chief, Division of Audits JLS/as Xavier Becerra, Attorney General -3- June 13, 2019 cc: Sean McCluskie, Chief Deputy to the Attorney General California Department of Justice Chris Ryan, Chief Division of Operations California Department of Justice Christine Allison, Director Office of Human Resources California Department of Justice Charlain Swenson, Personnel Officer Office of Human Resources California Department of Justice Chris Prasad, Director Office of Program Oversight and Accountability California Department of Justice Wendy Espinoza, Manager Payroll and Benefit Services Unit California Department of Justice Mark Rodriguez, Chief, Administrative Services Division California Department of Human Resources Marissa Revelino, Chief, Personnel and Payroll Services Division State Controller’s Office California Department of Justice Payroll Process Review Contents Review Report Summary ............................................................................................................................ 1 Background ........................................................................................................................ 1 Objectives, Scope, and Methodology ............................................................................... 2 Conclusion .......................................................................................................................... 3 Views of Responsible Officials .......................................................................................... 4 Restricted Use .................................................................................................................... 4 Schedule—Summary of Findings ......................................................................................... 5 Findings and Recommendations ........................................................................................... 6 Appendix—Sampling Methodology ..................................................................................... A1 Attachment—California Department of Justice’s Response to Draft Review Report California Department of Justice Payroll Process Review Review Report Summary The State Controller’s Office (SCO) reviewed the California Department of Justice (DOJ) payroll process for the period of July 1, 2012, through June 30, 2015. DOJ management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. Our limited review identified material weaknesses in internal control over the DOJ payroll process that leave DOJ at risk of additional improper payments if not mitigated. We found that DOJ has a combination of deficiencies in internal control over its payroll process such that there is a reasonable possibility that a material misstatement in financial information or noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. Specifically, DOJ lacked adequate segregation of duties and compensating controls over its processing of payroll transactions. In addition, DOJ inappropriately granted 21 employees keying access to the State’s payroll system. These deficiencies have a pervasive effect on the DOJ payroll process, and impair the effectiveness of other controls by rendering their design ineffective or by keeping them from operating effectively. We also found that DOJ lacked sufficient controls over the processing of specific payroll-related transactions to ensure that it complied with collective bargaining agreements and state laws, and that only valid and authorized payments were processed. As quantified in the Schedule, these deficiencies contributed to DOJ employees’ excessive vacation and annual leave balances, improper and questioned payments for employee separation lump-sum pay and leave buy-back, improper holiday compensation, and long-outstanding unrecovered salary advances, costing the State an estimated net total of $10,743,096. Background In 1979, the State of California adopted collective bargaining for state employees. This created a significant workload increase for the SCO’s Personnel and Payroll Services Division (PPSD), as PPSD was the State’s centralized payroll processing center for all payroll-related transactions. PPSD decentralized the processing of payroll, allowing state agencies and departments to process their own payroll-related transactions. Periodic reviews of the decentralized payroll processing at state agencies and departments ceased due to the budget constraints in the late 1980s. In 2013, the California State Legislature reinstated these payroll reviews to gain assurance that state agencies and departments maintain adequate internal control over payroll, provide proper oversight over their decentralized payroll processing, and comply with various state laws and regulations regarding payroll processing and related transactions. Review Authority Authority for this review is provided by California Government Code (GC) section 12476, which states, “The Controller may audit the uniform -1- California Department of Justice Payroll Process Review state pay roll system, the State Pay Roll Revolving Fund, and related records of state agencies within the uniform state pay roll system, in such manner as the Controller may determine.” In addition, GC section 12410 stipulates that “The Controller shall superintend the fiscal concerns of the state. The Controller shall audit all claims against the state, and may audit the disbursement of any state money, for correctness, legality, and for sufficient provisions of law for payment.” Objectives, Scope, We performed this review to determine whether DOJ: and Methodology  Processed payroll and payroll-related disbursements accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures;  Established adequate internal control over payroll to meet the following control objectives: o Payroll and payroll-related transactions are properly approved and certified by authorized personnel; o Only valid and authorized payroll and payroll-related transactions are processed; o Payroll and payroll-related transactions are accurate and properly recorded; o Payroll systems, records, and files are adequately safeguarded; o State laws, regulations, policies, and procedures are complied with regarding payroll and payroll-related transactions;  Complied with existing controls as part of the ongoing management and monitoring of payroll and payroll-related expenditures;  Maintained accurate records of leave balances; and  Administered and recorded salary advances properly and in accordance with state laws, regulations, policies, and procedures. We reviewed the DOJ payroll process and transactions for the period of July 1, 2012, through June 30, 2015. To achieve our objectives, we:  Reviewed state and DOJ policies and procedures related to the payroll process to understand DOJ’s methodology for processing various payroll and payroll-related transactions;  Interviewed the DOJ payroll personnel to understand DOJ’s methodology for processing various payroll and payroll-related transactions, determine their level of knowledge and ability relating to the payroll transaction processing, and gain an understanding of existing internal control over the payroll process and systems; -2- California Department of Justice Payroll Process Review  Selected transactions recorded in the State’s payroll database using statistical sampling as outlined in the Appendix, and targeted selection based on risk factors and other criteria for review;  Analyzed and tested transactions recorded in the State’s payroll database, and reviewed relevant files and records to determine the accuracy of payroll and payroll-related payments; accuracy of leave transactions; propriety of review and approval of transactions; adequacy of internal control over the payroll process and systems; and compliance with collective bargaining agreements and state laws, regulations, policies, and procedures (errors found from statistically- determined samples were projected to the intended population); and  Reviewed salary advances to determine whether DOJ administered and recorded them in accordance with state laws, regulations, policies, and procedures. Conclusion Based on the results of our review, we found that DOJ:  Did not process payroll and payroll-related disbursements accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures (see Findings 3 through 7);  Lacked adequate internal control over payroll and payroll-related transactions (see Findings 1 through 7);  Did not comply with existing controls as part of the ongoing management and monitoring of payroll and payroll-related expenditures (see Findings 2 and 3);  Did not maintain accurate records of leave balances (see Findings 5 and 6); and  Did not administer salary advances in accordance with state laws, regulations, policies, and procedures (see Finding 7). As quantified in the Schedule and described in the Findings and Recommendations section of this review report, these material weaknesses1 in internal control over the payroll process contributed to 1 An evaluation of an entity’s payroll process may identify deficiencies in its internal control over the process. A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, misstatements in financial information, impairments of effectiveness or efficiency of operations, or noncompliance with provisions of laws, regulations, or contracts on a timely basis. Control deficiencies, either individually or in combination with other control deficiencies, may be evaluated as significant deficiencies or material weaknesses. A material weakness is a deficiency, or a combination of deficiencies, in internal control such that there is a reasonable possibility that a material misstatement in financial information, impairment of effectiveness or efficiency of operations, or noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. A significant deficiency is a deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness, yet important enough to merit attention by those charged with governance. -3- California Department of Justice Payroll Process Review DOJ employees’ excessive vacation and annual leave balances, improper and questioned payments, and long-outstanding unrecovered salary advances, costing the State an estimated net total of $10,743,096. Views of We issued a draft review report on April 19, 2019. Christine Allison, Director, Office of Human Resources, responded by letter dated May 15, Responsible 2019 (Attachment), acknowledging the findings and indicating that DOJ Officials has taken steps since the review period to correct the deficiencies noted in the findings. We will follow up during the next payroll review to ensure that the corrective actions were adequate and appropriate. DOJ also provided a response regarding the collection overpayments for holiday compensation, as described in Finding 5. Our comments to DOJ’s response to Finding 5 are included in the Findings and Recommendations section. Restricted Use This report is solely for the information and use of the DOJ and the SCO; it is not intended to be and should not be used by anyone other than these specified parties. This restriction is not intended to limit distribution of this report, which is a matter of public record, and is available on the SCO website at www.sco.ca.gov. Original signed by JIM L. SPANO, CPA Chief, Division of Audits June 13, 2019 -4- California Department of Justice Payroll Process Review Schedule— Summary of Findings July 1, 2012, through June 30, 2015 Issues as a Dollar Number of Percentage Dollar Total Dollar Number of Amount of Selections of Amount of Dollar Amount of Finding Selections Method of Selection Selections with Selections Known Amount of Known and Number Issues Reviewed Selection Unit Reviewed Issues Reviewed * Issues Likely Issues Likely Issues 1 Inadequate segregation of duties N/A N/A N/A N/A N/A N/A N/A N/A N/A and compensating controls over payroll transactions 2 Inappropriate keying access to the 52 Targeted Employee $ - 21 40% $ - $ - $ - State’s payroll system 3 Inadequate controls over vacation 708 Targeted Employee 10,844,519 708 100% 10,844,519 N/A 1 0,844,519 and annual leave balances, resulting in liability for excessive balances 4 Inadequate controls over employee separation lump-sum pay, resulting in underpayments Underpayments 46 Statistical Employee 1,000,745 6 13% (2,945) (43,727) ( 46,672) Underpayments 8 Targeted Employee 630,097 6 75% (65,794) N/A ( 65,794) 5 Inadequate controls over holiday compensation, resulting in improper payments Overpayments 38 Statistical Holiday 11,064 3 8% 981 7,844 8 ,825 pay transaction Underpayments -- Same selections above -- 1 3% (119) (952) ( 1,071) 6 Inadequate controls over leave buy-back, resulting in improper and questioned payments Underpayments 38 Statistical Leave buy- 55,662 1 3% (996) (7,653) ( 8,649) back transaction Questioned payments -- Same selections above -- 1 3% 978 7,514 8 ,492 7 Inadequate controls over salary 4 Targeted Salary 3,446 4 100% 3,446 N/A 3 ,446 advances, resulting in failure to advance recover outstanding amounts transaction Total $ 12,545,533 $ 1 0,780,070 $ ( 36,974) $ 10,743,096 ___________ *All percentages are rounded to the nearest full percentage point. -5- California Department of Justice Payroll Process Review Findings and Recommendations FINDING 1— DOJ lacked adequate segregation of duties within its payroll transactions unit to ensure that only valid and authorized payroll transactions were Inadequate processed. DOJ also failed to implement other controls to compensate for segregation of this risk. duties and compensating GC sections 13400 through 13407 require state agencies to establish and controls over maintain internal controls, including proper segregation of duties and an payroll effective system of internal review. Adequate segregation of duties transactions reduces the likelihood that fraud or error will remain undetected by providing for separate processing by different individuals at various stages of a transaction and for independent reviews of the work performed. Our review found that DOJ payroll transactions unit staff performed conflicting duties. Staff members performed multiple steps in processing payroll transactions, including entering data into the State’s payroll system; auditing employee timesheets; reconciling payroll, including reconciling system output to source documentation; reporting payroll exceptions; and processing adjustments. For example, staff members keyed in regular and overtime pay and reconciled the master payroll, overtime, and other supplemental warrants. DOJ failed to demonstrate that it implemented compensating controls to mitigate the risks associated with such a deficiency. We found no indication that these functions were subjected to periodic supervisory review. The lack of adequate segregation of duties and compensating controls has a pervasive effect on the DOJ payroll process, and impairs the effectiveness of other controls by rendering their design ineffective or by keeping them from operating effectively. These control deficiencies, in combination with other deficiencies discussed in Findings 2 through 8, represent a material weakness in internal control over the payroll process such that there is a reasonable possibility that a material misstatement in financial information or noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. Good internal control practices require that the following functional duties be performed by different work units, or at minimum, by different employees within the same unit:  Recording transactions – This duty refers to the record-keeping function, which is accomplished by entering data into a computer system.  Authorization to execute – This duty belongs to individuals with authority and responsibility to initiate and execute transactions.  Periodic review and reconciliation of actual payments to recorded amounts – This duty refers to making comparisons of information at regular intervals and taking action to resolve differences. -6- California Department of Justice Payroll Process Review Recommendation We recommend that DOJ:  Separate conflicting payroll function duties to the greatest extent possible. Adequate segregation of duties will provide a stronger system of internal control whereby the functions of each employee are subject to the review of another. If it is not possible to segregate payroll functions fully and appropriately, DOJ should implement compensating controls. For example, if the payroll transactions unit staff member responsible for recordkeeping also performs a reconciliation process, then the supervisor should perform and document a detailed review of the reconciliation to provide additional control over the assignment of conflicting functions. Compensating controls may also include dual authorization requirements and documented reviews of payroll system input and output; and  Develop formal procedures for performing and documenting compensating controls. FINDING 2— DOJ lacked adequate controls to ensure that only appropriate staff had keying access to the State’s payroll system. DOJ inappropriately granted Inappropriate 21 employees keying access to the State’s payroll system. If not mitigated, keying access to the this control deficiency leaves payroll data at risk of misuse, abuse, and State’s payroll unauthorized use. system The SCO maintains the State’s payroll information system. The system is decentralized, thereby allowing employees of state agencies to access it. PPSD has established a Decentralized Security Program Manual that all state agencies are required to follow in order to access the payroll system. The program’s objectives are to secure and protect the confidentiality and integrity of payroll data against misuse, abuse, and unauthorized use. We reviewed the records of 52 employees who had keying access to the State’s payroll system at various times between July 2012 and June 2015. Of the 52 employees, 21 had inappropriate keying access to the State’s payroll system. Specifically, DOJ did not immediately remove or modify keying access for 17 employees after the employees’ separation from state service, transfer to another agency or unit, or change in classification. For example, one employee continued to have keying access for 151 days after leaving state service. Of the 17 employees, three also had keying access while appointed to classifications other than those allowed to have keying access. For example, an employee had keying access while appointed as Associate Personnel Analyst—a classification that is not eligible to have keying access without a written justification. DOJ did not provide the required justification. In addition, a manager involved with workers’ compensation had keying access to the system. The employee had been provided keying access before becoming a manager, and DOJ did not modify the employee’s access after the employee became a manager. We also noted that the manager had previously been appointed to ineligible classifications; DOJ did not provide the required justification. -7- California Department of Justice Payroll Process Review Furthermore, three additional employees had keying access while appointed to ineligible classifications without the required justification. The employees’ classifications changed to Staff Services Analyst or Associate Personnel Analyst. However, DOJ did not submit the required justification letters for these employees. The Decentralized Security Program Manual states, in part: The PPSD data base contains sensitive and confidential information. Access is restricted to persons with a legitimate requirement to complete their duties. Currently, PIMS, HIST, KEYM and PIP applications are restricted to Personnel Specialists (PS) or Personnel Technician (PT) classifications because their need is by definition a function of their specific job duties and any change in those duties requires a reevaluation of the need for access. If the employee’s duties change, such that the need for access no longer exists, the access privilege MUST be removed or deleted immediately by a request submitted by the department. A request for an individual in a classification other than in the PS/PT series to access PIMS, HIST, KEYM and/or PIP requires a written justification from the Authorizing Manager. The justification must describe the individual’s specific job duties that requires the need to each type of information (i.e., PIMS=Employment History, HIST=Payroll History, etc.) as well as level of access to that application, in order to perform their duties. Manager classifications will be granted inquiry access only. To prevent unauthorized use of a transferred, terminated or resigned employee’s user ID, it is required that the Security Monitor IMMEDIATELY submit a PSD125A to delete their system access. DO NOT WAIT until another employee fills this position; this only increases the chances for breach of security, utilizing an old user ID. Recommendation We recommend that DOJ:  Update keying access to the State’s payroll system immediately after employees leave DOJ, transfer to another unit, or change classifications; and  Periodically review access to the system to verify that access complies with the Decentralized Security Program Manual. FINDING 3— DOJ failed to implement controls to ensure that it adheres to the Inadequate requirements of collective bargaining agreements and state regulations to limit the accumulation of vacation and annual leave credits. This controls over deficiency resulted in liability for excessive leave balances that could cost vacation and the State at least $10,844,519 as of June 30, 2015. We expect the liability annual leave to increase if DOJ does not take action to address the excessive vacation balances, resulting and annual leave balances. in liability for excessive balances Collective bargaining agreements and state regulations limit the amount of vacation and annual leave that most state employees may accumulate to no more than 80 days (640 hours). The limit on leave balances helps state -8- California Department of Justice Payroll Process Review agencies manage leave balances and control the State’s liability for accrued leave credits. State agencies may allow employees to carry a higher leave balance only under limited circumstances. For example, an employee may not be able to reduce accrued vacation or annual leave hours below the limit due to business needs. When an employee’s leave accumulation exceeds or is projected to exceed the limit, state agencies should work with the employee to develop a written plan to reduce leave balances below the applicable limit. Our review of DOJ’s leave accounting records determined that DOJ had 4,248 employees with unused vacation or annual leave credits at June 30, 2015. Of those employees, 708 exceeded the limit set by collective bargaining agreements and state regulations. For example, one employee had an accumulated balance of 2,400 hours of vacation, or 1,760 hours beyond the 640-hour limit. Collectively, the 708 employees accumulated 217,785 hours of excess vacation and annual leave, worth at least $10,844,519 as of June 30, 2015. This estimated liability does not adjust for salary rate increases and additional leave credits.2 Accordingly, we expect that the amount needed to pay for this liability will be higher. For example, a DOJ employee separated from state service with 1,928 hours in leave credits, including 1,748 hours in vacation. After adjusting for additional leave credits, the employee was paid for 2,274 hours, or 18% more. We performed an additional review of the records for 20 of 708 employees to determine whether DOJ complied with collective bargaining agreements and state regulations. We determined that DOJ could not demonstrate that it had complied with collective bargaining agreements and state regulations when allowing these 20 employees to maintain excess vacation or annual leave balances. In addition, the 20 employees had no plans in place during the review period to reduce their leave balances below the limit. If DOJ does not take action to reduce the excessive leave balances, the liability for accrued vacation and annual leave will most likely increase, because most employees will receive salary increases or use other non- compensable leave credits instead of vacation or annual leave, increasing their vacation or annual leave balances. The state agency responsible for paying these leave balances may face a cash flow problem if a significant number of employees with excessive vacation or annual leave balances separate from state service. Normally, state agencies are not budgeted to make these separation lump-sum payments. However, the State’s current practice dictates that the state agency that last employed an employee pays for that employee’s separation lump-sum payment, regardless of where the employee accrued the leave balance. 2 Most state employees receive pay rate increases every year pursuant to state laws or collective bargaining agreements until they reach the top of their pay scale, or promote into a higher-paying position. In addition, when an employee’s accumulated leave balances upon separation from state service are calculated for lump-sum pay, the employee is credited with additional leave credits equal to the amount that the employee would have earned had the employee taken time off and not separated from state service. -9- California Department of Justice Payroll Process Review Recommendation We recommend that DOJ:  Implement controls, including existing policies and procedures, to ensure that its employees’ vacation and annual leave balances are maintained within levels allowed by collective bargaining agreements and state regulations;  Conduct ongoing monitoring of controls to ensure that they are implemented and operating effectively; and  Participate in leave buy-back programs if the State offers such programs and funds are available. FINDING 4— DOJ lacked adequate controls over the processing of employee separation lump-sum payments. We identified $112,466 in underpayments for Inadequate separation lump-sum pay, consisting of $68,739 based on actual controls over transactions reviewed (“known”); and $43,727 based on the results of employee statistical sampling (“likely”). If not mitigated, the control deficiencies separation lump- leave DOJ at risk of additional improper separation lump sum payments. sum pay, resulting in underpayments GC section 19839 allows lump-sum payment for accrued eligible leave credits when an employee separates from state employment. Collective bargaining agreements include similar provisions regarding separation lump-sum pay. Payroll records show that DOJ processed separation lump-sum payments for 748 employees between July 2012 and June 2015, as follows: Separation Lump-Sum Payment Type Unit Amount Payments that included sick leave (items examined 100%) 8 $ 630,097 Payments that did not include sick leave (statistically sampled) 740 15,858,899 Total population 748 $ 16,488,996 We examined the separation lump-sum pay that included sick leave payments for all eight employees, totaling $630,097. Of the eight employees, DOJ underpaid six of them by an approximate total of $65,794 because it did not project the accumulated sick leave as required. GC section 19991.4 states, in part: ….If an employee is unable to return to work at the time or during the period he or she is entitled to permanent disability compensation under Division 4 or 4.5 of the Labor Code, he or she shall be paid any sick leave balance….The payment shall be computed by projecting the accumulated time on a calendar basis as though the employee was taking time off…. Of the remaining separation lump-sum payments for 740 employees, totaling $15,858,899, we randomly selected a statistical sample (as described in the Appendix) of 46 employees who were paid separation lump-sum pay, totaling $1,000,745. -10- California Department of Justice Payroll Process Review Of the 46 employees, DOJ underpaid six of the employees by an approximate total of $2,945. As we used a statistical sampling method to select the separation lump-sum payments examined, we projected the amount of likely underpayments to be $43,727. Accordingly, the known and likely underpayments totaled an approximate $46,672. The following table summarizes the results of our statistical sampling: Known underpayments $ 2,945 Divide by: Sample 1,000,745 Error rate for projection (differences due to rounding) 0.29% Population that was statistically sampled $ 15,858,899 Multiply by: Error rate for projection 0.29% Known and likely underpayments (differences due to rounding) 46,672 Less: Known underpayments 2,945 Likely underpayments $ 43,727 _______________ *Amounts in this table are rounded to the nearest dollar. The known underpayments occurred because payroll transactions unit staff members miscalculated the employees’ accrued leave balances and incorrectly entered the leave hours for separation lump-sum payments into the State’s payroll system. DOJ also lacked adequate supervisory review to ensure accurate processing of employee separation lump-sum payments. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. Recommendation We recommend that DOJ:  Properly compensate those employees who were underpaid;  Establish adequate controls to ensure accurate calculation and payment of employee separation lump-sum pay; and  Conduct a review of employee separation lump-sum payments made during the past three years to ensure that the payments were accurate and in compliance with collective bargaining agreements and state laws. -11- California Department of Justice Payroll Process Review FINDING 5— DOJ lacked adequate controls over the processing of holiday Inadequate compensation. We identified $8,825 in overpayments and $1,071 in controls over underpayments for holiday compensation, consisting of $981 in holiday overpayments and $119 in underpayments based on actual transactions reviewed (“known”); and $7,844 in overpayments and $952 in compensation, underpayments based on the results of statistical sampling (“likely”). If resulting in not mitigated, this control deficiency leaves DOJ at risk of improper improper holiday compensation payments. payments GC section 19853 specifies the compensation that an eligible employee is entitled to receive when required to work on a qualifying holiday. Collective bargaining agreements between the State and Bargaining Units 1, 4, and 7 include similar provisions regarding holiday compensation for represented employees. We identified holiday pay transactions for 357 employees between July 2012 and June 2015. We stratified a total of $99,570 in holiday pay transactions to these employees and randomly selected a statistical sample (as described in the Appendix) of holiday pay transactions for 38 employees, totaling $11,064. Of the 38 holiday pay transactions, DOJ overpaid three empolyees by $981 and underpaid one by $119, or a net total exception of $862. As we used a statistical sampling method to select the holiday pay examined, we projected the amount of likely net improper payments to be $6,892, consisting of $7,844 in overpayments and $952 in underpayments. Accordingly, the known and likely improper payments totaled a net $7,754, consisting of $8,825 in overpayments and $1,071 in underpayments. The following table summarizes the results of our statistical sampling: Known improper payments, net $ 862 Divide by: Sample 11,064 Error rate for projections (differences due to rounding) 7.79% Population that was statistically sampled $ 99,570 MKnuoltwipnly a bnyd: Elikrerolyr irmatper ofopre rp rpoajyemcteionnts, net (differences due to 7.79% rounding) 7,754 Less: Known improper payments, net 862 Likely improper payments, net $ 6,892 __________________ *Amounts in this table are rounded to the nearest dollar. The overpayments occurred because payroll transactions unit staff members overstated the total number of compensated hours. The underpayment occurred because payroll transactions unit staff members paid the employees at the straight-time rate instead of the time-and-a-half rate for each hour worked. DOJ also lacked adequate supervisory review to ensure accurate processing of holiday compensation. -12- California Department of Justice Payroll Process Review GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. Recommendation We recommend that DOJ:  Conduct a review of holiday compensation granted during the past three years to ensure that compensation complied with collective bargaining agreements and state laws; and  Recover overpayments made to employees pursuant to GC section 19838 and State Administrative Manual (SAM) sections 8776 and 8776.7, and properly compensate those employees who were underpaid; and correct any improper holiday credits in the State’s leave accounting system. DOJ’s Response DOJ has no authority to collect overpayments as recommended in the draft report. Government Code section 19838 sets forth a three-year statute of limitations from the date of overpayment, and the period under review is beyond the three years. SCO’s Comment Our finding remains unchanged. We communicated this finding to DOJ on several occasions during the course of our fieldwork in 2017 and before issuing this report. Specifically, in September 2017, we communicated this finding to payroll transactions unit management. We believe that these communications, which were made within three years from the date of some, if not all, of the overpayments noted in this finding, provided DOJ with the required information with which to promptly initiate collection efforts. DOJ lacked adequate controls over the processing of leave buy-back FINDING 6— payments. We identified $8,649 in underpayments and $8,492 in Inadequate questioned payments for leave buy-back, consisting of $996 in controls over leave underpayments and $978 in questioned payments based on actual buy-back, resulting transactions reviewed (“known”); and $7,653 in underpayments and in improper and $7,514 in questioned payments based on the results of statistical sampling questioned (“likely”). If not mitigated, the control deficiencies leave DOJ at risk of payments additional improper and questioned leave buy-back payments. A leave-buy back occurs when an employee receives payment at the regular salary rate in exchange for accrued vacation, annual leave, personal leave, personal holiday, and/or holiday credits. The collective bargaining agreement between the State and Bargaining Unit 7 allows for the annual cash-out of a certain number of hours of accumulated vacation and annual leave if funds are available. The California Department of Human Resources (CalHR) Policy Memos 2014-008 and 2015–011 provide the State’s policies and -13- California Department of Justice Payroll Process Review procedures regarding cash-out of vacation and annual leave for Bargaining Unit 7 employees for fiscal year (FY) 2013-14 and FY 2014-15. Title 2, California Code of Regulations, section 599.744 provides that CalHR may authorize a leave buy-back program for employees excluded from collective bargaining. Pursuant to Policy Memos 2014-009 and 2015–012, CalHR authorized leave buy-backs for excluded employees in FY 2013-14 and FY 2014-15. Payroll records show that DOJ processed 350 leave buy-back payment transactions, totaling $483,829, between July 2012 and June 2015. Of the 350 payments, we randomly selected a statistical sample (as described in the Appendix) of 38 leave buy-back payment transactions, totaling $55,662. Of the 38 transactions, DOJ underpaid one leave buy-back payment by $996, and we questioned another payment of $978 due to lack of supporting documentation. These payments resulted in a net total exception of $18. As we used a statistical sampling method to select the leave buy-back payments examined, we projected the amount of likely net improper and questioned payments to be $139, consisting of $7,653 in underpayments and $7,514 in questioned payments. Accordingly, the known and likely improper and questioned payments totaled a net $157, consisting of $8,649 in underpayments and $8,492 in questioned payments. The following table summarizes the results of our statistical sampling: Known improper payments, net $ (18) Divide by: Sample 55,662 Error rate for projection (difference due to rounding) (0.03%) Population that was statistically sampled $ 483,289 Multiply by: Error rate for projection (0.03%) Known and likely improper payments, net (difference due to rounding) (145) Less: Known improper payments, net (18) Likely improper payments, net $ (127) _____________ *Amounts in this table are rounded to the nearest dollar. The underpayment occurred because DOJ paid the employee for fewer leave hours than were actually reduced. DOJ lacked adequate supervisory review to ensure accurate processing of leave buy-back payments. In addition, DOJ could not provide documentation to support at least one payment; therefore, we were unable to verify that the payment complied with the requirements. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. -14- California Department of Justice Payroll Process Review Recommendation We recommend that DOJ:  Provide adequate supervisory review to ensure that payroll transactions unit staff members process leave buy-back payments accurately; and  Maintain documentation to support payment transactions. FINDING 7— DOJ lacked adequate controls over salary advances to ensure that they were recovered in accordance with state law and policies. The four salary Inadequate advances that we reviewed, totaling $3,446, remained outstanding as of controls over June 30, 2015, due to DOJ’s noncompliance with the State’s collection salary advances, policies and procedures. The oldest unrecovered salary advance was resulting in failure outstanding for over eight years. This control deficiency leaves DOJ at risk to recover of further failures to collect salary advances if not mitigated. outstanding amounts At June 30, 2015, DOJ’s accounting records showed 31 outstanding salary advances totaling $80,139, including four salary advances totaling $3,446 that had been outstanding for more than 60 days. Generally, the prospect of collection diminishes as an account ages. When an agency is unable to collect after three years, the possibility of collection is remote. GC section 19838 and SAM sections 8776 and 8776.7 describe the State’s collection policies and procedures, which require DOJ to collect salary advances in a timely manner and maintain proper records of collection efforts. In our review of the four salary advances that were over 60 days old, DOJ did not comply with State’s collection policies and procedures. DOJ could not provide required documentation to support its collection efforts for two salary advances. For the other two salary advances, DOJ did not send collection notices promptly. We also found that in at least one instance, an employee separated from state employment after receiving a salary advance. Salary advances made to employees who later separate can be collected by withholding amounts from their final separation pay, pursuant to GC section 19838, if proper verification shows that the advances were paid. If the former employee has unpaid salary advances, DOJ is responsible for pursuing collections as described in SAM section 8776.6. The lack of adequate controls over salary advances reduces the likelihood of collection, increases the amount of resources expended on collection efforts, and negatively impacts cash flow. Recommendation We recommend that DOJ:  Ensure that it recovers salary advances in a timely manner and maintains documentation of its collection efforts and payment of -15- California Department of Justice Payroll Process Review salary advances, if any, pursuant to GC section 19838 and SAM sections 8776 and 8776.7; and  Pursue collections as described in SAM section 8776.6 if former employees have unpaid salary advances. If reasonable collection procedures do not result in payment, DOJ may request discharge from accountability of uncollectible amounts. -16- California Department of Justice Payroll Process Review Appendix— Sampling Methodology July 1, 2012, through June 30, 2015 We used attributes sampling for test of compliance. The following table outlines our sampling application for review areas that included errors: Results Projected Sample Tolerable to Type of Population Population Sampling Selection Confidence Error Expected Error Sample Intended Finding Review Area Test (Units) (Dollars) Unit Method Level Rate (Rate)1 Size Population Number Computer- generated Separation lump-sum pay Compliance 740 $ 1 5,858,899 Employee 95% 10% 1 (0.25% - 2%) 46 Yes 4 simple random Computer- Holiday pay generated Holiday compensation Compliance 357 $ 9 9,570 90% 10% 1 (0.25% - 2.5%) 38 Yes 5 transaction simple random Computer- Payment generated Leave buy-back Compliance 350 $ 4 83,829 90% 10% 1 (0.25% - 2.5%) 38 Yes 6 transaction simple random ___________________________ 1Pursuant to the AICPA’s Audit Guide: Audit Sampling (May 1, 2017 edition, pages 131-133), the expected error is the expected number of errors planned for in the sample. It is derived by multiplying the expected error rate by the sample size. The expected number of errors in the sampling tables on pages 135-136 was rounded upward, e.g., 0.2 errors becomes 1 error. -A1- California Department of Justice Payroll Process Review Attachment— California Department of Justice’s Response to Draft Review Report State Controller’s Office Division of Audits Post Office Box 942850 Sacramento, CA 94250 http://www.sco.ca.gov S17-PAR-9002