California Public Employees' Retirement System - Payroll Process Review

CALIFORNIA PUBLIC EMPLOYEES’ RETIREMENT SYSTEM Review Report PAYROLL PROCESS REVIEW November 1, 2014, through October 31, 2017 BETTY T. YEE California State Controller June 2019 BETTY T. YEE California State Controller June 28, 2019 Board of Administration California Public Employees’ Retirement System 400 Q Street Sacramento, CA 95811 Dear Board Members: The State Controller’s Office has reviewed the California Public Employees’ Retirement System (CalPERS) payroll process for the period of November 1, 2014, through October 31, 2017. CalPERS management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. Our review found material weaknesses in internal control over the CalPERS payroll process. These weaknesses contributed to CalPERS employees’ excessive vacation and annual leave balances, improper and questioned payments, and long-outstanding unrecovered salary advances, costing the State an estimated net total of $4,949,444. If you have any questions, please contact Andrew Finlayson, Chief, State Agency Audits Bureau, by telephone at (916) 324-6310. Sincerely, Original signed by JIM L. SPANO, CPA Chief, Division of Audits JLS/as Board of Administration -2- June 28, 2019 cc: Marcie Frost, Chief Executive Officer California Public Employees’ Retirement System Douglas Hoffner, Deputy Executive Officer Operations & Technology California Public Employees’ Retirement System Tina Campbell, Chief Human Resources Division California Public Employees’ Retirement System Kathleen Chaussee, Assistant Division Chief Personnel Operations Human Resources Division California Public Employees’ Retirement System Mark Rodriquez, Chief Administrative Services Division California Department of Human Resources Marissa Revelino, Chief Personnel and Payroll Services Division State Controller’s Office California Public Employees’ Retirement System Payroll Process Review Contents Review Report Summary ............................................................................................................................ 1 Background ........................................................................................................................ 1 Objectives, Scope, and Methodology ............................................................................... 2 Conclusion .......................................................................................................................... 3 Views of Responsible Officials .......................................................................................... 4 Restricted Use .................................................................................................................... 4 Schedule—Summary of Findings ......................................................................................... 5 Findings and Recommendations ........................................................................................... 6 Appendix—Sampling Methodology ..................................................................................... A1 Attachment—California Public Employees’ Retirement System’s Response to Draft Review Report California Public Employees’ Retirement System Payroll Process Review Review Report Summary The State Controller’s Office (SCO) reviewed the California Public Employees’ Retirement System (CalPERS) payroll process and transactions for the period of November 1, 2014, through October 31, 2017. CalPERS management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. Our limited review identified material weaknesses in internal control over the CalPERS payroll process that leave CalPERS at risk of additional improper payments if not mitigated. We found that CalPERS has a combination of deficiencies in internal control over its payroll process such that there is a reasonable possibility that a material misstatement in financial information or noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. Specifically, CalPERS lacked adequate segregation of duties and compensating controls over its processing of payroll transactions. In addition, CalPERS inappropriately granted 10 employees keying access to the State’s payroll system, which leaves payroll data at risk of misuse, abuse, and unauthorized use. One of the 10 employees entered the employee’s own data to the State’s leave accounting system. These deficiencies have a pervasive effect on the CalPERS payroll process, and impair the effectiveness of other controls by rendering their design ineffective or by keeping them from operating effectively. We also found that CalPERS lacked sufficient controls over the processing of specific payroll-related transactions to ensure that CalPERS complied with collective bargaining agreements and state laws, and that only valid and authorized payments were processed. As quantified in the Schedule, these deficiencies contributed to CalPERS employees’ excessive vacation and annual leave balances; improper and questioned payments for separation lump-sum pay, overtime pay, and Investment Officer performance recognition differential pay; improper holiday credit transactions; and long-outstanding unrecovered salary advances, costing the State an estimated net total of $4,949,444. Background In 1979, the State of California adopted collective bargaining for state employees. This created a significant workload increase for the SCO’s Personnel and Payroll Services Division (PPSD), as PPSD was the State’s centralized payroll processing center for all payroll-related transactions. PPSD decentralized the processing of payroll, allowing state agencies and departments to process their own payroll-related transactions. Periodic reviews of the decentralized payroll processing at state agencies and departments ceased due to the budget constraints in the late 1980s. In 2013, the California State Legislature reinstated these payroll reviews to gain assurance that state agencies and departments maintain adequate internal control over payroll, provide proper oversight over their decentralized payroll processing, and comply with various state laws and regulations regarding payroll processing and related transactions. -1- California Public Employees’ Retirement System Payroll Process Review Review Authority Authority for this review is provided by California Government Code (GC) section 12476, which states, “The Controller may audit the uniform state pay roll system, the State Pay Roll Revolving Fund, and related records of state agencies within the uniform state pay roll system, in such manner as the Controller may determine.” In addition, GC section 12410 stipulates that “The Controller shall superintend the fiscal concerns of the state. The Controller shall audit all claims against the state, and may audit the disbursement of any state money, for correctness, legality, and for sufficient provisions of law for payment.” Objectives, Scope, We performed this review to determine whether CalPERS: and Methodology  Processed payroll and payroll-related disbursements accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures;  Established adequate internal control over payroll to meet the following control objectives: o Payroll and payroll-related transactions are properly approved and certified by authorized personnel; o Only valid and authorized payroll and payroll-related transactions are processed; o Payroll and payroll-related transactions are accurate and properly recorded; o Payroll systems, records, and files are adequately safeguarded; o State laws, regulations, policies, and procedures are complied with regarding payroll and payroll-related transactions;  Complied with existing controls as part of the ongoing management and monitoring of payroll and payroll-related expenditures;  Maintained accurate records of leave balances; and  Administered and recorded salary advances properly and in accordance with state laws, regulations, policies, and procedures. We reviewed the CalPERS payroll process and transactions for the period of November 1, 2014, through October 31, 2017. For leave balances, we used the most recent and complete balances, which were as of September 30, 2017, at the time of our review. To achieve our objectives, we:  Reviewed state and CalPERS policies and procedures related to the payroll process to understand CalPERS’s methodology for processing various payroll and payroll-related transactions;  Interviewed CalPERS payroll personnel to understand CalPERS’ methodology for processing various payroll and payroll-related transactions, determine their level of knowledge and ability relating to payroll transaction processing, and gain an understanding of existing internal control over the payroll process and systems; -2- California Public Employees’ Retirement System Payroll Process Review  Selected transactions recorded in the State’s payroll database using statistical sampling as outlined in the Appendix, and targeted selection based on risk factors and other criteria for review;  Analyzed and tested transactions recorded in the State’s payroll database, and reviewed relevant files and records to determine the accuracy of payroll and payroll-related payments, accuracy of leave transactions, propriety of review and approval of transactions, adequacy of internal control over the payroll process and systems, and compliance with collective bargaining agreements and state laws, regulations, policies, and procedures (errors found in statistically- determined samples were projected to the intended population); and  Reviewed salary advances to determine whether CalPERS administered and recorded them in accordance with state laws, regulations, policies, and procedures. Conclusion Based on the results of our review, we found that CalPERS:  Did not process payroll and payroll-related disbursements accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures (see Findings 3 through 8);  Lacked adequate internal control over payroll and payroll-related transactions (see Findings 1 through 8);  Did not comply with existing controls as part of the ongoing management and monitoring of payroll and payroll-related expenditures (see Findings 2 and 3);  Did not maintain accurate records of leave balances (see Findings 4 and 7); and  Did not administer salary advances in accordance with state laws, regulations, policies, and procedures (see Finding 6). As quantified in the Schedule and described in the Findings and Recommendations section of this review report, these material weaknesses1 in internal control over the payroll process contributed to CalPERS employees’ excessive vacation and annual leave balances, improper and questioned payments, and long-outstanding unrecovered salary advances, costing the State an estimated net total of $4,949,444. 1An evaluation of an entity’s payroll process may identify deficiencies in its internal control over the process. A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, misstatements in financial information, impairments of effectiveness or efficiency of operations, or noncompliance with provisions of laws, regulations, or contracts on a timely basis. Control deficiencies, either individually or in combination with other control deficiencies, may be evaluated as significant deficiencies or material weaknesses. A material weakness is a deficiency, or a combination of deficiencies, in internal control such that there is a reasonable possibility that a material misstatement in financial information, impairment of effectiveness or efficiency of operations, or noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. A significant deficiency is a deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness, yet important enough to merit attention from those charged with governance. -3- California Public Employees’ Retirement System Payroll Process Review Views of We issued a draft review report on May 24, 2019. Douglas Hoffner, Deputy Executive Officer, Operations & Technology, responded by letter Responsible dated June 14, 2019 (Attachment), agreeing with Finding 1 and Findings 3 Officials through 8, and indicating that CalPERS has taken steps to correct the deficiencies noted in the findings. We will follow up during the next payroll review to verify that these corrective actions were adequate and appropriate. CalPERS disagreed with a portion of Finding 2 regarding inappropriate keying access. Our comments on CalPERS’ response to Finding 2 are included in the Findings and Recommendations section. Restricted Use This report is solely for the information and use of CalPERS and the SCO; it is not intended to be and should not be used by anyone other than these specified parties. This restriction is not intended to limit distribution of this report, which is a matter of public record, and is available on the SCO website at www.sco.ca.gov. Original signed by JIM L. SPANO, CPA Chief, Division of Audits June 28, 2019 -4- California Public Employees’ Retirement System Payroll Process Review Schedule— Summary of Findings November 1, 2014, through October 31, 2017 Issues as a Total Dollar Number of Dollar Amount Number of Percentage of Dollar Dollar Amount of Finding Selections Method of Selection of Selections Selections Selections Amount of Amount of Known and Number Issues Reviewed Selection Unit Reviewed with Issues Reviewed * Known Issues Likely Issues Likely Issues 1 Inadequate segregation of N/A N/A N/A N/A N/A N/A N/A N/A N/A duties and compensating controls over payroll transactions 2 Inappropriate keying access 41 Targeted Employee $ - 1 0 24% $ - $ - $ - to the State’s payroll system 3 Inadequate controls over 270 Targeted Employee 4,478,155 2 70 100% 4,478,155 N/A 4,478,155 vacation and annual leave balances, resulting in liability for excessive balances 4 Inadequate controls over separation lump-sum pay, resulting in improper and questioned payments Overpayments 60 Statistical Employee 564,932 6 10% 19,918 132,088 1 52,006 Underpayments -- Same selections above -- 1 6 27% (6,172) (40,928) ( 47,100) Questioned payments -- Same selections above -- 7 12% 47,505 315,036 3 62,541 Underpayments 10 Targeted Employee 1 ,112,605 3 30% ( 3,223) N/A ( 3,223) 5 Inadequate controls over overtime pay, resulting in improper payments Overpayments 12 Targeted Payment 28,179 6 50% 2,407 N/A 2 ,407 transaction Underpayments 60 Statistical Payment 42,040 1 2% (54) (7,643) ( 7,697) transaction 6 Inadequate controls over 16 Targeted Salary 12,294 1 1 69% 9,404 N/A 9 ,404 salary advances, resulting in advance failure to recover outstanding transaction amounts 7 Inadequate controls over 17 Targeted Holiday 6,069 4 24% 1,714 N/A 1 ,714 holiday credit transactions, credit resulting in improper credits transaction 8 Inadequate controls over Investment Officer performance recognition differential pay, resulting in improper payments Overpayments 21 Targeted Payment 216,419 1 5% 1,377 N/A 1 ,377 transaction Underpayments -- Same selections above -- 1 5% (140) N/A ( 140) Total $ 6,460,693 $ 4,550,891 $ 398,553 $ 4,949,444 _____________________ * All percentages are rounded to the nearest full percentage point. -5- California Public Employees’ Retirement System Payroll Process Review Findings and Recommendations FINDING 1— CalPERS lacked adequate segregation of duties within its payroll transactions unit to ensure that only valid and authorized payroll Inadequate transactions were processed. CalPERS also failed to implement other segregation of controls to compensate for this risk. duties and compensating GC sections 13400 through 13407 require state agencies to establish and controls over maintain internal controls, including proper segregation of duties and an payroll effective system of internal review. Adequate segregation of duties transactions reduces the likelihood that fraud or error will remain undetected by providing for separate processing by different individuals at various stages of a transaction and for independent reviews of the work performed. Our review found that CalPERS payroll transactions unit staff performed conflicting duties. Staff members performed multiple steps in processing payroll transactions, including entering data into the State’s payroll system; auditing employee timesheets; reconciling payroll, including reconciling system output to source documentation; reporting payroll exceptions; and processing adjustments. For example, staff members keyed in regular and overtime pay and reconciled the master payroll, overtime, and other supplemental warrants. CalPERS failed to demonstrate that it implemented compensating controls to mitigate the risks associated with such a deficiency. We found no indication that these functions were subjected to periodic supervisory review. The lack of adequate segregation of duties and compensating controls has a pervasive effect on the CalPERS payroll process, and impairs the effectiveness of other controls by rendering their design ineffective or by keeping them from operating effectively. These control deficiencies, in combination with other deficiencies discussed in Findings 2 through 8, represent a material weakness in internal control over the payroll process such that there is a reasonable possibility that a material misstatement in financial information or noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. Good internal control practices require that the following functional duties be performed by different work units, or at minimum, by different employees within the same unit:  Recording transactions – This duty refers to the record-keeping function, which is accomplished by entering data into a computer system.  Authorization to execute – This duty belongs to individuals with authority and responsibility to initiate and execute transactions.  Periodic review and reconciliation of actual payments to recorded amounts – This duty refers to making comparisons of information at regular intervals and taking action to resolve differences. -6- California Public Employees’ Retirement System Payroll Process Review Recommendation We recommend that CalPERS:  Separate conflicting payroll function duties to the greatest extent possible. Adequate segregation of duties will provide a stronger system of internal control whereby the functions of each employee are subject to the review of another. If it is not possible to segregate payroll functions fully and appropriately, CalPERS should implement compensating controls. For example, if the payroll transactions unit staff member responsible for recordkeeping also performs a reconciliation process, then the supervisor should perform and document a detailed review of the reconciliation to provide additional control over the assignment of conflicting functions. Compensating controls may also include dual authorization requirements and documented reviews of payroll system input and output; and  Develop formal procedures for performing and documenting compensating controls. FINDING 2— CalPERS lacked adequate controls to ensure that only appropriate staff members had keying access to the State’s payroll system. CalPERS Inappropriate inappropriately granted 10 employees keying access to the State’s payroll keying access to the system. One of the 10 employees entered the employee’s own data to the State’s payroll State’s leave accounting system. If not mitigated, this control deficiency system leaves payroll data at risk of misuse, abuse, and unauthorized use. The SCO maintains the State’s payroll system. The system is decentralized, thereby allowing employees of state agencies to access it. PPSD has established a Decentralized Security Program Manual that all state agencies are required to follow in order to access the payroll system. The program’s objectives are to secure and protect the confidentiality and integrity of payroll data against misuse, abuse, and unauthorized use. We reviewed the records of 41 CalPERS employees who had keying access to the State’s payroll system at various times between November 2014 and October 2017. Of the 41 employees, 10 had inappropriate keying access to the State’s payroll system. CalPERS did not have the employees’ keying access immediately removed or modified after their separation from state service, transfer to another agency or unit, or change in classification. One employee continued to have keying access for 220 days after that employee changed to a classification that was not eligible for keying access. Based on additional information provided by PPSD, we performed further procedures on one of the 10 employees with inappropriate keying access. Between November 2014 and October 2017, the employee keyed 15 transactions to the State’s leave accounting system to void the employee’s own annual leave usage, totaling 312 hours. In addition, the employee keyed one transaction to record the employee’s annual leave usage of 64 hours. Considering that our review was performed only for the period of November 1, 2014, through October 31, 2017, and that the employee continued to have keying access after our review period, we are -7- California Public Employees’ Retirement System Payroll Process Review concerned that the number of questionable transactions may be even higher. The employee’s classification changed from Senior Personnel Specialist to Associate Personnel Analyst in November 2014. Pursuant to the Decentralized Security Program Manual, the Associate Personnel Analyst classification is not eligible to have access to the State’s payroll system. However, the employee continued to have keying access to the State’s payroll system, including the State’s leave accounting system. In April 2015, CalPERS requested access rights and provided a justification letter for the employee. Although the justification letter specified that the employee’s permissions in the State’s leave accounting system would be limited to “inquire” only, CalPERS did not remove the employee’s ability to update the State’s leave accounting system. The Decentralized Security Program Manual states, in part: The PPSD system contains sensitive and confidential information. Access is restricted to persons with an authorized, legal, and legitimate business requirement to complete their duties. . . . Currently, PIMS, HIST, KEYM, PIP, LAS, MPC and/or ACAS applications are restricted to Personnel Specialists or Personnel Technician classifications because their need is by definition a function of their specific job duties and any change in those duties requires a reevaluation of the need for access. If the employee’s duties change, such that the need for access no longer exists, the access privilege MUST be removed or deleted immediately by a request submitted by the department/campus. . . . To prevent unauthorized use by a transferred, terminated or resigned employee’s user ID, the Security Monitor must IMMEDIATELY submit all pages of the PSD125A to delete the user’s system access. Using an old user ID increases the chances of a security breach which is a serious security violation. Sharing a user ID is strictly prohibited and a serious violation. Recommendation We recommend that CalPERS:  Provide adequate controls to ensure that employees with keying access to the State’s payroll system do not enter their own data into the system;  Update keying access to the State’s payroll system immediately after employees leave CalPERS, transfer to another unit, or change classifications;  Periodically review access to the system to verify that access complies with the Decentralized Security Program Manual; and  Perform a detailed review of all transactions that the Associate Personnel Analyst keyed for himself/herself, correct any improper balances, and recoup any losses incurred. -8- California Public Employees’ Retirement System Payroll Process Review CalPERS’ Response We disagree with the portion of this finding related to keying access vulnerability to the extent it implies that this information was discovered by SCO during the course of the audit. The SCO initiated this audit in December 2017. In February 2019, CalPERS brought to the SCO’s attention potential misuse of the SCO’s systems and requested SCO’s assistance in reviewing the issue. Subsequently, the SCO requested a report from PPSD to quantify the deleted leave balances. Our internal review of the transactions keyed by the employee resulted in appropriate corrective action and the correction of improper balances. CalPERS agrees that control deficiencies with the systems – both internal and external to SCO – can leave payroll data at risk of misuse, abuse, and unauthorized use. SCO’s Comment Our finding remains as stated. We described the finding based on the evidence we received during the review. As to the potential misuse of keying access, although emails suggest prior communication between PPSD and CalPERS, we did not receive any information directly from CalPERS. We received the relevant information from PPSD and performed additional procedures to support our conclusion. In addition, we agree that control deficiencies—whether in the State’s payroll system or the decentralized payroll process at CalPERS—leave payroll data at risk of misuse, abuse, and unauthorized use. However, we reiterate that the review found that, as described in this finding, CalPERS lacked adequate controls to ensure that only appropriate staff members had keying access to the State’s payroll system. FINDING 3— CalPERS failed to implement controls to ensure that it adheres to the requirements of collective bargaining agreements and state regulations to Inadequate limit the accumulation of vacation and annual leave credits. This controls over deficiency resulted in liability for excessive leave balances with a value of vacation and at least $4,478,155 as of September 30, 20172. We expect the liability to annual leave increase if CalPERS does not take action to address the excessive vacation balances, resulting and annual leave balances. in liability for excessive balances Collective bargaining agreements and state regulations limit the amount of vacation and annual leave that most state employees may accumulate to no more than 80 days (640 hours). The limit on leave balances helps state agencies manage leave balances and control the State’s liability for accrued leave credits. State agencies may allow employees to carry higher leave balances only under limited circumstances. For example, an employee may not be able to reduce accrued vacation or annual leave hours below the limit due to business needs. When an employee’s leave accumulation exceeds or is projected to exceed the limit, state agencies 2At the time of our review, we used the most recent and complete vacation and annual leave balances, which were as of September 30, 2017. -9- California Public Employees’ Retirement System Payroll Process Review should work with the employee to develop a written plan to reduce leave balances below the applicable limit. Our review of CalPERS’s leave accounting records determined that CalPERS had 2,659 employees with unused vacation or annual leave credits at September 30, 2017. Of those employees, 270 exceeded the limit set by collective bargaining agreements and state regulations. For example, one employee had an accumulated balance of 2,639 hours of annual leave, or 1,999 hours beyond the 640-hour limit. Collectively, the 270 employees accumulated 81,723 hours of excess vacation and annual leave, with a value of at least $4,478,155 as of September 30, 2017. This estimated liability does not adjust for salary rate increases and additional leave credits3. Accordingly, we expect that the amount needed to pay for this liability will be higher. For example, a CalPERS employee separated from state service with 2,175 hours in leave credits, including 1,883 hours in annual leave. After adjusting for additional leave credits, the employee was paid for 2,491 hours, or 15% more. We performed an additional review of the records for 20 of 270 employees to determine whether CalPERS complied with collective bargaining agreements and state regulations. We determined that CalPERS could not demonstrate that it had complied with collective bargaining agreements and state regulations when allowing these 20 employees to maintain excessive vacation or annual leave balances. Although we found that CalPERS has procedures regarding excess leave usage, only six of the 20 employees whose records we reviewed had a plan in place during the review period to reduce leave balances below the limit. If CalPERS does not take action to reduce the excessive leave balances, the liability for accrued vacation and annual leave will likely increase. This is because most employees will receive salary increases or use other non- compensable leave credits instead of vacation or annual leave, increasing their vacation or annual leave balances. The state agency responsible for paying these leave balances may face a cash flow problem if a significant number of employees with excessive vacation or annual leave balances separate from state service. Normally, state agencies are not budgeted to make these separation lump-sum payments. However, the State’s current practice dictates that the state agency that last employed an employee pays for that employee’s lump-sum separation payment, regardless of where the employee accrued the leave balance. Recommendation We recommend that CalPERS:  Implement controls, including existing policies and procedures, to ensure that its employees’ vacation and annual leave balances are 3 Most state employees receive pay rate increases every year pursuant to state laws and/or collective bargaining agreements until they reach the top of their pay scale, or promote into a higher-paying position. In addition, when an employee’s accumulated leave balances upon separation are calculated for lump-sum pay, the employee is credited with additional leave credits equal to the amount that the employee would have earned had the employee taken time off and not separated from state service. -10- California Public Employees’ Retirement System Payroll Process Review maintained within levels allowed by collective bargaining agreements and state regulations;  Conduct ongoing monitoring of controls to ensure that they are implemented and operating effectively; and  Participate in leave buy-back programs if the State offers such programs and funds are available. FINDING 4— CalPERS lacked adequate controls over the processing of employee separation lump-sum pay. We identified $152,006 in overpayments, Inadequate $50,323 in underpayments, and $362,541 in questioned payments for controls over separation lump-sum pay, consisting of $19,918 in overpayments, $9,395 separation lump- in underpayments, and $47,505 in questioned payments based on actual sum pay, resulting transactions reviewed (“known”); and $132,088 in overpayments, $40,928 in improper and in underpayments, and $315,036 in questioned payments based on the questioned results of statistical sampling (“likely”). If not mitigated, the control payments deficiencies leave CalPERS at risk of additional improper separation lump-sum payments. GC section 19839 allows lump-sum payment for accrued eligible leave credits when an employee separates from state employment. Collective bargaining agreements include similar provisions regarding separation lump-sum pay. Payroll records show that CalPERS processed payments for separation lump-sum pay, totaling $5,423,975, for 487 employees between November 2014 and October 2017, as follows: Separation Lump-sum Pay Group Unit Amount Ten highest payments (items examined 100%) 1 0 $ 1,112,605 Remaining payments (statistically sampled) 4 77 4,311,370 Total population 4 87 $ 5,423,975 We examined the separation lump-sum pay for the 10 employees with the highest payments, totaling $1,112,605. Of the 10 employees, CalPERS underpaid three by an approximate total of $3,223 because the payroll transactions unit staff miscalculated the leave balance paid. Of the remaining payments for separation lump-sum pay, totaling $4,311,370 for 477 employees, we randomly selected a statistical sample (as described in the Appendix) of 60 employees who were paid separation lump-sum pay, totaling $564,932. Our review of lump-sum payments made to these 60 employees showed that CalPERS overpaid six by approximately $19,918 and underpaid 16 by $6,172. Our review of lump-sum payments also showed a lack of supporting documentation for payments, totaling $47,505, made to seven employees. Without the required documentation, there is no record of calculation and approval of payments for separation lump-sum pay. Therefore, we could not determine the validity, accuracy, and propriety of the payments made to these seven employees. As a result, we questioned these payments. The known improper and questioned payments have a net total of $61,251. -11- California Public Employees’ Retirement System Payroll Process Review As we used a statistical sampling method to select the employees whose payments for separation lump-sum pay were examined, we projected the amount of likely overpayments to be $132,088 and likely underpayments to be $40,928. We could also estimate that there may have been additional missing documentation associated with separation lump-sum pay, totaling $315,036. Accordingly, as supporting documentation is required to authorize separation lump-sum pay, we also questioned these payments. Therefore, the known and likely improper and questioned payments totaled a net approximate $467,447, consisting of $152,006 in overpayments, $47,100 in underpayments, and $362,541 in questioned payments. The following table summarizes the results of our statistical sampling: Known improper and questioned payments, net $ 6 1,251 Divide by: Sample 5 64,932 Error rate for projection (differences due to rounding) 10.84% Population that was statistically sampled 4,311,370 Multiply by: Error rate for projection 10.84% Known and likely improper and questioned payments, net (differences due to rounding) 4 67,447 Less: Known improper and questioned payments, net 61,251 Likely improper and questioned payments, net $ 406,196 ___________ *Amounts in this table are rounded to the nearest dollar. The known overpayments were made because payroll transactions unit staff members miscalculated leave balances paid. The known underpayments were made because payroll transactions unit staff members miscalculated leave balances paid and failed to include the leave credits that employees would have earned when calculating leave balances for lump-sum pay. CalPERS also lacked adequate supervisory review to ensure accurate processing of separation lump-sum pay. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. Recommendation We recommend that CalPERS:  Establish adequate controls to ensure accurate calculation and payment of separation lump-sum pay;  Conduct a review of payments for separation lump-sum pay made during the past three years to ensure that the payments were accurate and in compliance with collective bargaining agreements and state law;  Recover overpayments made to separated employees in accordance with GC section 19838 and State Administrative Manual (SAM) section 8776.6; and  Properly compensate those employees who were underpaid. -12- California Public Employees’ Retirement System Payroll Process Review FINDING 5— CalPERS lacked adequate controls over the processing of overtime pay. We identified $2,407 in overpayments and $7,697 in underpayments for Inadequate overtime pay, consisting of $2,407 in overpayments and $54 in controls over underpayments based on actual transactions reviewed (“known”); and overtime pay, $7,643 in underpayments based on the results of statistical sampling resulting in (“likely”). If not mitigated, the control deficiencies leave CalPERS at risk improper of additional improper payments for overtime pay. payments Collective bargaining agreements and state laws and policies, contain specific clauses regarding overtime pay. Payroll records show that CalPERS processed 9,773 overtime pay transactions, totaling $6,094,975, between November 2014 and October 2017, as follows: Overtime Payment Type by Group Unit Amount Work Week Group E (items examined 100%) 12 $ 28,179 Work Week Group 2 – paid for at least 100 hours (items examined 100%) 11 6 9,851 Work Week Group 2 – paid for less than 100 hours (statistically sampled) 9,750 5,996,945 Total population 9,773 $ 6 ,094,975 We examined all 12 overtime pay transactions, totaling $28,179, for Work Week Group (WWG) E employees, who are not eligible to receive overtime pay under normal circumstances. Of the 12 transactions, CalPERS processed six, totaling $2,407. The overpayments were made because CalPERS had incorrectly designated the employee as WWG 2 in the system. The California Department of Human Resources’ (CalHR) California State Civil Service Pay Scales, section 10, states, in part: Work Week Group “E” includes classes that are exempted from coverage under the FLSA because of the “white-collar” (administrative, executive, professional) exemptions. To be eligible for this exemption a position must meet both the “salary basis” and the “duties” test. Exempt (WWG E) employees are paid on a “salaried” basis and the regular rate of pay is full compensation for all hours worked to perform assigned duties. However, these employees shall receive up to 8 hours holiday credit when authorized to work on a holiday. Work Week Group E employees shall not receive any form of additional compensation, whether formal or informal, unless otherwise provided by the provisions of this work week group. . . . We also examined all 11 overtime pay transactions, totaling $69,851, for WWG 2 employees who were paid for at least 100 hours. Our examination of the transactions found no exceptions. Of the 9,750 overtime pay transactions, totaling $5,996,945, for WWG 2 employees who were paid for less than 100 hours of overtime per transaction, we randomly selected a statistical sample (as described in the Appendix) of 60 transactions, totaling $42,040. Of the 60 transactions, CalPERS underpaid one by $54. As we used a statistical sampling method to select the overtime pay transactions examined, we projected the amount of likely underpayments to be $7,643. Accordingly, the known and likely underpayments totaled $7,697. -13- California Public Employees’ Retirement System Payroll Process Review The following table summarizes the results of our statistical sampling: Known underpayment $ 5 4 Divide by: Sample 4 2,040 Error rate for projection (differences due to rounding) 0.13% Population that was statistically sampled 5 ,996,945 Multiply by: Error rate for projection 0.13% Known and likely underpayments (differences due to rounding) 7 ,697 Less: Known underpayment 5 4 Likely underpayments $ 7 ,643 __________ *Amounts in this table are rounded to the nearest dollar. The known underpayment were made because the CalPERS timekeeping system allowed the employee to enter overtime hours worked at the straight-time rate instead of the time-and-a-half rate. CalPERS also lacked adequate supervisory review to ensure accurate processing of overtime pay. CalPERS could not explain why the system allowed such errors. After the review period, CalPERS demonstrated that the system was able to identify these errors and prevent the processing of erroneous transactions unless they are corrected. GC sections 13402 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Recommendation We recommend that CalPERS:  Conduct a review of payments for overtime pay made during the past three years to ensure that the payments complied with collective bargaining agreements and state laws and policies;  Recover overpayments made to employees through an agreed-upon collection method in accordance with GC section 19838; and  Properly compensate those employees who were underpaid. We further recommend that, to prevent improper payments for overtime pay from recurring, CalPERS:  Establish adequate internal controls to ensure that payments are accurate and comply with collective bargaining agreements and state laws and policies; and  Provide adequate oversight to ensure that payroll transactions unit staff process only valid and authorized payments that comply with collective bargaining agreements and state laws and policies. -14- California Public Employees’ Retirement System Payroll Process Review FINDING 6— CalPERS lacked adequate controls over salary advances to ensure that they were recovered in accordance with state law and policies. Eleven Inadequate salary advances, totaling $9,404, remained outstanding as of October 31, controls over 2017, due to CalPERS’ noncompliance with the State’s collection policies salary advances, and procedures. The oldest unrecovered salary advance was outstanding resulting in failure for over six years. This control deficiency leaves CalPERS at risk of to recover further failures to collect salary advances if not mitigated. outstanding amounts At October 31, 2017, CalPERS’ accounting records showed 22 outstanding salary advances totaling $19,247, including 16 balances totaling $12,294 that had been outstanding for more than 120 days. Generally, the prospect of collection diminishes as an account ages. When an agency is unable to collect after three years, the possibility of collection is remote. GC section 19838 and SAM sections 8776 and 8776.7 describe the State’s collection policies and procedures, which require CalPERS to collect salary advances in a timely manner and maintain proper records of collection efforts. In our review of the 16 salary advances that were over 120 days old, we noted that CalPERS did not comply with the State’s collection policies and procedures for 11 of them, totaling $9,404. CalPERS did not send collection notices promptly, or did not send the notices at all. For example, a salary advance was issued to a separating employee in May 2011; however, the first collection letter was not sent until October 2014, over three years later. In addition, although two of the 16 salary advances issued to one employee were promptly collected, the collections were not promptly recorded on the report of outstanding salary advances. CalPERS received payment in August 2017 but did not record the payment until November 2017. SAM section 8776 requires agencies to maintain proper records of collection efforts and payment of salary advances. The lack of adequate controls over salary advances reduces the likelihood of collection, increases the amount of resources expended on collection efforts, and negatively impacts cash flow. Recommendation We recommend that CalPERS:  Ensure that it recovers salary advances in a timely manner pursuant to GC section 19838 and SAM sections 8776 and 8776.7; and  Maintain documentation of its collection efforts and payment of salary advances. -15- California Public Employees’ Retirement System Payroll Process Review FINDING 7— CalPERS lacked adequate controls over the processing of holiday credit transactions. We identified approximately $1,714 in improper holiday Inadequate credits. If not mitigated, this control deficiency leaves CalPERS at risk of controls over additional improper holiday credits. holiday credit transactions, GC section 19853 specifies the compensation that an eligible employee is resulting in entitled to receive when required to work on a qualifying holiday. The improper credits collective bargaining agreement between the State and Bargaining Unit 1 includes similar provisions regarding holiday compensation for represented employees. We examined 17 holiday credit transactions, totaling approximately $6,069. These transactions include random selections and transactions selected because they involved unusual credits. Of the 17 transactions, four involved improper credits, costing an estimated $1,714. The improper holiday credit transactions occurred because the CalPERS timekeeping system allowed employees to enter improper holiday credit hours. CalPERS also lacked adequate supervisory review to ensure accurate processing of holiday credits. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. Recommendation We recommend that CalPERS:  Conduct a review of holiday credits granted during the past three years to ensure that credits complied with collective bargaining agreements and state law;  Correct any improper holiday credits in the State’s leave accounting system; and  Establish adequate controls to ensure that holiday credits granted are valid and comply with collective bargaining agreements and state law. FINDING 8— CalPERS lacked adequate controls over the processing of payments for Investment Officer performance recognition differential pay. We Inadequate identified $1,377 in overpayments and $140 in underpayments for controls over Investment Officer performance recognition differential pay. If not Investment Officer mitigated, this control deficiency leaves CalPERS at risk of additional performance improper payments for Investment Officer performance recognition recognition differential pay. differential pay, resulting in Pursuant to CalHR’s California State Civil Service Pay Scales, section 14, improper Pay Differential 361, eligible Bargaining Unit 1 employees are entitled to payments an annual lump-sum award, ranging from 0-15% of the employee’s base salary at the time of the award. Payroll records show that CalPERS processed 281 payments for Investment Officer performance recognition differential pay, totaling $3,681,597, between November 2014 and October 2017. We examined 21 -16- California Public Employees’ Retirement System Payroll Process Review randomly-selected payments, totaling $216,419. Of the 21 payments, one was overpaid by $1,377 and another was underpaid by $140. The improper payments were made because Executive and Investment Compensation Unit staff members used an incorrect base salary to calculate the Investment Officer performance recognition differential pay. CalPERS also lacked adequate supervisory review to ensure the accurate calculation and processing of differential pay. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. Recommendation We recommend that CalPERS:  Establish adequate controls to ensure that the Investment Officer performance recognition differential pay is calculated and processed accurately and in compliance with state policy;  Conduct a review of payments for Investment Officer performance recognition differential pay made during the past three years to ensure that the payments were accurate and in compliance with state policy;  Recover overpayments made to employees pursuant to GC section 19838 and SAM sections 8776 and 8776.7; and  Properly compensate those employees who were underpaid. -17- California Public Employees’ Retirement System Payroll Process Review Appendix— Sampling Methodology November 1, 2014, through October 31, 2017 We used attributes sampling for test of compliance. The following table outlines our sampling application for review areas that included errors: Results Projected to Review Population Population Sampling Sample Selection Confidence Tolerable Expected Sample Intended Finding Area Type of Test (Unit) (Dollar) Unit Method Level Error Rate Error (Rate)¹ Size Population Number Separation lump-sum pay Compliance 477 $4,311,370 Employee Computer- 95% 5% 0 (0%) 60 Yes 4 generated simple random Overtime pay Compliance 9,750 $5,996,945 Payment Computer- 95% 5% 0 (0%) 60 Yes 5 transactions generated simple random ___________________________ 1Pursuant to the AICPA’s Audit Guide: Audit Sampling (May 1, 2017 edition), pages 131-133, the expected error is the expected number of errors planned for in the sample. It is derived by multiplying the expected error rate by the sample size. The expected number of errors in the sampling tables on pages 135-136 was rounded upward, e.g., 0.2 errors becomes 1 error. -A1- California Public Employees’ Retirement System Payroll Process Review Attachment— California Public Employees’ Retirement System’s Response to Draft Review Report State Controller’s Office Division of Audits Post Office Box 942850 Sacramento, CA 94250 http://www.sco.ca.gov S18-PAR-9002