California Correctional Institution - Payroll Process Review

CALIFORNIA CORRECTIONAL INSTITUTION Review Report PAYROLL PROCESS REVIEW July 1, 2012, through June 30, 2015 BETTY T. YEE California State Controller June 2019 BETTY T. YEE California State Controller June 24, 2019 William Sullivan, Warden California Correctional Institution P.O. Box 1031 Tehachapi, CA 93581 Dear Mr. Sullivan: The State Controller’s Office reviewed California Correctional Institution’s (CCI) payroll process for the period of July 1, 2012, through June 30, 2015. CCI management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. Our limited review identified material weaknesses in internal control over the CCI payroll process that leave CCI at risk of additional improper payments if not mitigated. Specifically, CCI lacked adequate segregation of duties and compensating controls over its processing of payroll transactions. The lack of segregation of duties and appropriate compensating controls has a pervasive effect on the CCI payroll process, and impairs the effectiveness of other controls by rendering their design ineffective or by keeping them from operating effectively. In addition, CCI did not immediately remove keying access to the State’s payroll system for seven employees after their separation from state service or classification change to a non- approved position classification. We also found that CCI lacked sufficient controls over the processing of specific payroll-related transactions to ensure that CCI complied with collective bargaining agreements and state laws, and that only valid and authorized payments were processed. These control deficiencies contributed to CCI employees’ excessive vacation and annual leave balances, improper and questioned payments, and long-outstanding salary advances, costing the State an estimated net total of $17,311,935. P.O. Box 942850, Sacramento, CA 94250  (916) 445-2636 3301 C Street, Suite 700, Sacramento, CA 95816  (916) 324-8907 901 Corporate Center Drive, Suite 200, Monterey Park, CA 91754  (323) 981-6802 William Sullivan, Warden 2 June 24, 2019 If you have any questions, please contact Andrew Finlayson, Chief, State Agency Audits Bureau, by telephone at (916) 324-6310. Sincerely, Original signed by JIM L. SPANO, CPA Chief, Division of Audits JLS/as cc: Joseph Gutierrez, Associate Warden Business Services California Correctional Institution Danette Gaulrapp, Correctional Business Manager I California Correctional Institution April Chapman, Institutional Personnel Officer California Correctional Institution Janine Seyler, Staff Services Manager III Office of Personnel Services California Department of Corrections and Rehabilitation Mai Lee Vang, External Audits Manager Office of Audits and Court Compliance California Department of Corrections and Rehabilitation Kenneth Pogue, Undersecretary of Administration & Offender Services California Department of Corrections and Rehabilitation Kathleen Allison, Undersecretary of Operations California Department of Corrections and Rehabilitation Katherine Minnich, Deputy Director of Human Resources California Department of Corrections and Rehabilitation Mark Rodriguez, Chief, Administrative Services Division California Department of Human Resources Marissa Revelino, Chief Personnel and Payroll Services Division State Controller’s Office California Correctional Institution Payroll Process Review Contents Review Report Summary ............................................................................................................................ 1 Background ........................................................................................................................ 1 Objectives, Scope, and Methodology ............................................................................... 2 Conclusion .......................................................................................................................... 3 Views of Responsible Officials .......................................................................................... 4 Restricted Use .................................................................................................................... 4 Schedule—Summary of Findings ......................................................................................... 5 Findings and Recommendations ........................................................................................... 6 Appendix—Sampling Methodology ..................................................................................... A1 Attachment—California Correctional Institution’s Response to Draft Review Report California Correctional Institution Payroll Process Review Review Report Summary The State Controller’s Office reviewed California Correctional Institution’s (CCI) payroll process for the period of July 1, 2012, through June 30, 2015. CCI management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. Our limited review identified material weaknesses in internal control over the CCI payroll process that leave CCI at risk of additional improper payments if not mitigated. We found that CCI has a combination of deficiencies in internal control over its payroll process such that there is a reasonable possibility that a material misstatement in financial information or noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. Specifically, CCI lacked adequate segregation of duties and compensating controls over its processing of payroll transactions; as a result, payroll transactions unit staff performed conflicting duties. Staff members performed multiple steps in processing payroll transactions, including data entry into the State’s payroll system; auditing employee timesheets; reconciling payroll, including reconciling system output to source documentation; and reporting payroll exceptions. This control deficiency was aggravated by the lack of compensating controls, such as management oversight and review, to mitigate the risks associated with such a deficiency. The lack of segregation of duties and appropriate compensating controls has a pervasive effect on the CCI payroll process, and impairs the effectiveness of other controls by rendering their design ineffective or by keeping them from operating effectively. In addition, CCI did not immediately remove keying access to the State’s payroll system for seven employees after their separation from state service or classification change to a non-approved position classification. We also found that CCI lacked sufficient controls over the processing of specific payroll-related transactions to ensure that CCI complied with collective bargaining agreements and state laws, and that only valid and authorized payments were processed. As quantified in the Schedule, these control deficiencies contributed to CCI employees’ excessive vacation and annual leave balances, improper and questioned payments, and long- outstanding salary advances, costing the State an estimated net total of $17,311,935. Background In 1979, the State of California adopted collective bargaining for state employees. This created a significant workload increase for the SCO’s Personnel and Payroll Services Division (PPSD), as PPSD was the State’s centralized payroll processing center for all payroll related-transactions. PPSD decentralized the processing of payroll, allowing state agencies and departments to process their own payroll-related transactions. Periodic -1- California Correctional Institution Payroll Process Review reviews of the decentralized payroll processing at state agencies and departments ceased due to the budget constraints in the late 1980s. In 2013, the California State Legislature reinstated these payroll reviews to gain assurance that state agencies and departments maintain an adequate internal control structure over the payroll function, provide proper oversight over their decentralized payroll processing, and comply with various state laws and regulations regarding payroll processing and related transactions. Review Authority Authority for this review is provided by California Government Code (GC) section 12476, which states, “The Controller may audit the uniform state pay roll system, the State Pay Roll Revolving Fund, and related records of state agencies within the uniform state pay roll system, in such manner as the Controller may determine.” In addition, GC section 12410 stipulates that “The Controller shall superintend the fiscal concerns of the state. The Controller shall audit all claims against the state, and may audit the disbursement of any state money, for correctness, legality, and for sufficient provisions of law for payment.” Objectives, Scope, We performed this review to determine whether CCI: and Methodology  Processed payroll and payroll-related disbursements accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures;  Established adequate internal control over payroll to meet the following control objectives: o Payroll and payroll-related transactions are properly approved and certified by authorized personnel; o Only valid and authorized payroll and payroll-related transactions are processed; o Payroll and payroll-related transactions are accurate and properly recorded; o Payroll systems, records, and files are adequately safeguarded; and o State laws, regulations, policies, and procedures are complied with regarding payroll and payroll-related transactions;  Complied with existing controls as part of the ongoing management and monitoring of payroll and payroll-related expenditures;  Maintained accurate records of leave balances; and  Administered and recorded salary advances in accordance with state laws, regulations, policies, and procedures. We reviewed the CCI payroll process and transactions for the period of July 1, 2012, through June 30, 2015. -2- California Correctional Institution Payroll Process Review To achieve our review objectives, we:  Reviewed state and CCI policies and procedures related to the payroll process to understand CCI’s methodology for processing various payroll and payroll-related transactions;  Interviewed CCI payroll personnel to understand CCI’s methodology for processing various payroll and payroll-related transactions, determine their level of knowledge and ability relating to payroll transaction processing, and gain an understanding of existing internal control over the payroll process and systems;  Selected transactions recorded in the State’s payroll database using statistical sampling, as outlined in the Appendix, and targeted selection based on risk factors and other criteria for review;  Analyzed and tested transactions recorded in the State’s payroll database, and reviewed relevant files and records to determine the accuracy of payroll and payroll-related payments; accuracy of leave transactions; propriety of review and approval of transactions, adequacy of internal control over the payroll process and systems; and compliance with collective bargaining agreements and state laws, regulations, policies, and procedures (errors found from statistically- determined samples were projected to the intended population); and  Reviewed salary advances to determine whether CCI administered and recorded them in accordance with state laws, regulations, policies, and procedures. Conclusion Based on the results of our review, we found that CCI:  Did not process payroll and payroll-related disbursements accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures (see Findings 3 through 9);  Lacked adequate internal control over payroll and payroll-related transactions (see Findings 1 through 9);  Did not comply with existing controls as part of the ongoing management and monitoring of payroll and payroll-related expenditures (see Finding 2);  Did not maintain accurate records of leave balances (see Finding 6); and  Did not administer and record salary advances in accordance with state laws, regulations, policies, and procedures (see Finding 8). -3- California Correctional Institution Payroll Process Review As quantified in the Schedule and described in the Findings and Recommendations section of this review report, these material weaknesses1 in internal control over the payroll process contributed to CCI employees’ excessive vacation and annual leave balances, and improper and questioned payments, costing the State an estimated net total of $17,311,935. Views of We issued a draft review report on May 6, 2019. William Sullivan, Warden, responded by letter dated May 21, 2019 (Attachment), Responsible acknowledging that the findings are accurate and indicating that CCI had Officials taken steps to address or remedy the findings. We will follow up during the next payroll review to ensure that the corrective actions were adequate and appropriate. Restricted Use This report is solely for the information and use of CCI and the SCO; it is not intended to be and should not be used by anyone other than these specified parties. This restriction is not intended to limit distribution of this report, which is a matter of public record and is available on the SCO website at www.sco.ca.gov. Original signed by JIM L. SPANO, CPA Chief, Division of Audits June 24, 2019 1 An evaluation of an entity’s payroll process may identify deficiencies in its internal control over the process. A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, misstatements in financial information, impairments of effectiveness or efficiency of operations, or noncompliance with provisions of laws, regulations, or contracts on a timely basis. Control deficiencies, either individually or in combination with other control deficiencies, may be evaluated as significant deficiencies or material weaknesses. A material weakness is a deficiency, or a combination of deficiencies, in internal control such that there is a reasonable possibility that a material misstatement in financial information, impairment of effectiveness or efficiency of operations, or noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. A significant deficiency is a deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness, yet important enough to merit attention from those charged with governance. -4- California Correctional Institution Payroll Process Review Schedule— Summary of Findings July 1, 2012, through June 30, 2015 Dollar Issues as a Total Dollar Number of Amount of Number of Percentage of Dollar Dollar Amount of Finding Selections Method of Selection Selections Selections Selections Amount of Amount of Known and Number Issues Reviewed Selection Unit Reviewed with Issues Reviewed * Known Issues Likely Issues Likely Issues 1 Inadequate segregation N/A N/A N/A N/A N/A N/A N/A N/A N/A of duties and compensating controls over payroll transactions 2 Inappropriate keying 24 Targeted Employee $ - 7 29% $ - $ - $ - access to the State's payroll system 3 Inadequate controls 51 Targeted Employee 8 03,511 51 100% 803,511 - 803,511 over vacation and annual leave balances, resulting in liability for excessive credits 4 Inadequate controls 57 Statistical Employee 1,706,840 over separation lump- sum pay, resulting in improper payments: Overpayments -- See above -- 43 75% 78,414 112,041 190,455 Questioned payments -- See above -- 6 11% 50,338 71,925 122,263 5 Inadequate controls 60 Statistical Overtime 97,268 over regular and transaction overtime compensation, resulting in improper payment and questioned payments: Overpayments -- See above -- 5 8% 478 194,794 195,272 Questioned payments -- See above -- 4 7% 11,659 4 ,753,195 4 ,764,854 15 Targeted Overtime - 2 13% 202 - 202 transaction Questioned payments 60 Statistical Regular Pay 3 66,897 4 7% 26,314 1 1,131,467 11,157,781 transaction 6 Inadequate controls 60 Statistical Holiday Pay 22,755 1 2% 264 48,887 49,151 over holiday pay and transaction holiday credits, resulting in improper payments and accruals: 7 Targeted Holiday Pay 11,577 1 14% 683 - 683 transaction 34 Targeted Holiday 21,847 12 35% 14,537 - 14,537 Credit transaction 7 Inadequate controls 41 Targeted Uniform 12,505 41 100% 12,505 - 12,505 over uniform allowance, Allowance resulting in improper transaction payments and noncompliance 59 Targeted Uniform 1,820 59 100% - - - Allowance transaction 8 Inadequate controls 2 Targeted Salary 2,925 2 100% 2 ,925 - 2 ,925 over salary advances, Advances resulting in failure to recover outstanding balances in accordance with state law and policies 9 Inadequate controls 43 Targeted Senior 3,409 43 100% (2,204) - (2,204) over Senior Peace Peace Officer Pay, resulting in Officer Pay improper payments transactions $ 3,051,354 $ 999,626 $ 16,312,309 $ 17,311,935 ___________________ *All percentages are rounded to the nearest full percentage point. -5- California Correctional Institution Payroll Process Review Findings and Recommendations FINDING 1— CCI lacked adequate segregation of duties within its Payroll Transactions Unit to ensure that only valid and authorized payroll transactions were Inadequate processed. CCI also failed to implement other controls to compensate for segregation of this risk. duties and compensating GC sections 13402 through 13407 require state agencies to establish and controls over maintain internal controls, including proper segregation of duties and an payroll effective system of internal review. Adequate segregation of duties transactions reduces the likelihood that fraud or error will remain undetected by providing for separate processing by different individuals at various stages of a transaction, and for independent reviews of the work performed. Our review found that CCI Payroll Transactions Unit staff performed conflicting duties. Staff members performed multiple steps in processing payroll transactions, including entering data into the State’s payroll system; auditing employee timesheets; reconciling payroll, including reconciling system output to source documentation; reporting payroll exceptions; and processing adjustments or corrections. For example, Payroll Transactions Unit staff keyed in regular and overtime pay and reconciled the master payroll, overtime, and other supplemental warrants. CCI failed to demonstrate that it had implemented compensating controls to mitigate the risks associated with such a deficiency. We found no indication that these functions were subjected to periodic supervisory review. The lack of adequate segregation of duties and compensating controls has a pervasive effect on the CCI payroll process, and impairs the effectiveness of other controls by rendering their design ineffective or by keeping them from operating effectively. These control deficiencies, in combination with other deficiencies discussed in Findings 2 through 9, represent a material weakness in internal control over the payroll process such that there is a reasonable possibility that a material misstatement in financial information or noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. Good internal control practices require that the following functional duties be performed by different work units, or at a minimum, by different employees within the same unit:  Recording transactions – This duty refers to the record-keeping function, which is accomplished by entering data into a computer system;  Authorization to execute – This duty belongs to individuals with authority and responsibility to initiate and execute transactions; and  Periodic review and reconciliation of actual payments to recorded amounts – This duty refers to making comparisons of information at regular intervals and taking action to resolve differences. -6- California Correctional Institution Payroll Process Review Recommendation We recommend that CCI:  Separate conflicting duties to the greatest extent possible. Adequate segregation of duties will provide a stronger system of internal control whereby the functions of each employee are subject to the review of another; If it is not possible to segregate payroll functions fully and appropriately, implement compensating controls. For example, if the Payroll Transactions Unit staff member responsible for recordkeeping also performs a reconciliation process, the supervisor should perform and document a detailed review of the reconciliation to provide additional control over the assignment of conflicting functions. Compensating controls may also include dual authorization requirements and documented reviews of payroll system input and output; and  Develop formal written procedures for performing and documenting compensating controls. FINDING 2— CCI lacked adequate controls to ensure that only appropriate staff members had keying access to the State’s payroll system. Of the 24 Inappropriate employees whose records we reviewed, seven (29%) had improper keying keying access to the access to the system. In addition, for one of the seven, CCI did not have State’s payroll documentation verifying that access was justified for a non-approved system position classification. If not mitigated, this control deficiency leaves payroll data at risk of misuse, abuse, and unauthorized use. The SCO maintains the State’s payroll system. The system is decentralized, thereby allowing employees of state agencies to access it. PPSD has established a Decentralized Security Program Manual that all state agencies are required to follow in order to access the State’s payroll system. The program’s objectives are to secure and protect the confidentiality and integrity of the data against misuse, abuse, and unauthorized use. Twenty-four CCI employees had keying access to the State’s payroll system at various times between July 2012 and June 2015. We reviewed the records of the 24 employees and found that CCI inappropriately allowed seven of them keying access to the State’s payroll system. Specifically, the employees’ keying access was not immediately removed subsequent to their separation from state service or classification change to a non-approved position classification. For example, one employee was promoted to a manager classification, which is not an approved classification for system keying access, on February 19, 2014; however, the staff member continued to have keying access until July 29, 2014. These instances of inappropriate keying access to the State’s payroll system resulted from a lack of review and timely keying access removal, and CCI’s failure to retain required documentation in accordance with the PPSD Decentralized Security Program Manual. -7- California Correctional Institution Payroll Process Review The Decentralized Security Program Manual states, in part: The privilege to access the PPSD database poses a significant risk to the ability for SCO to function. Therefore, that privilege is restricted to persons with a demonstrated need for such access. . . . A request for an individual in a classification other than in the PS/PT series to access PIMS, HIST, KEYM and/or PIP requires a written justification from the Authorizing Manager. The justification must describe the individual’s specific job duties that requires the need to each type of information (i.e., PIMS=Employment History, HIST=Payroll History, etc.) as well as level of access to that application, in order to perform their duties. Manager classifications will be granted inquiry access only…. To prevent unauthorized use of a transferred, terminated or resigned employee’s userid, it is required that the Security Monitor IMMEDIATELY submit a PSD125A to delete their system access. DO NOT WAIT until another employee fills this position; this only increases the chances for breach of security, utilizing and old userid. Recommendation We recommend that CCI:  Update keying access to the State’s payroll system after employees leave CCI or move to unapproved position classifications;  Periodically review access to the system to determine that access complies with the Decentralized Security Program Manual; and  Ensure that all required documentation to support system access for non-approved position classifications is retained. CCI failed to implement controls to ensure that it adhered to the FINDING 3— requirement of collective bargaining agreements and state regulations to Inadequate limit the accumulation of vacation and annual leave credits, resulting in controls over liability for excessive leave credits with a value of $803,511 as of June 30, vacation and 2015.2 We expect the liability to increase if CCI does not take action to annual leave address the excessive vacation and annual leave credits. balances, resulting in liability for Collective bargaining agreements and state regulations limit the amount excessive credits of vacation and annual leave that most state employees may accumulate to no more than 80 days (640 hours). The limit on leave balances serves as a tool for state agencies to manage leave balances and control the State’s liability for accrued leave credits. State agencies may allow employees to carry a higher balance only in limited circumstances. For example, an employee may not be able to reduce accrued vacation or annual leave hours below the limit because of business needs. When an employee’s leave accumulation exceeds or is projected to exceed the limit, state agencies should work with the employee to develop a written plan to reduce leave balances below the applicable limit. 2 At the time of our review, we used the most recent and complete vacation and annual leave balances, which were as of June 30, 2015. -8- California Correctional Institution Payroll Process Review Our review of CCI’s leave accounting records found that CCI had 1,535 employees with unused vacation leave or annual leave as of June 30, 2015. Of those employees, 51 exceeded the limits set by collective bargaining agreements and state regulations. For example, one employee had an accumulated balance of 2,183 hours in annual leave, or 1,543 hours beyond the 640-hour limit. Collectively, the 51 employees accumulated 15,664 hours in excess vacation leave or annual leave costing at least $803,511 as of June 30, 2015. This estimated liability does not adjust for salary rate increases and additional leave credits.3 Accordingly, we expect that the amount needed to pay for this liability will be higher. For example, a CCI employee separated from state service with 2,602 hours in leave credits, including 827 hours in annual leave credit. After adjusting for additional leave credits, the employee should have been paid for 3,034 hours, or 17% more. Our discussions with CCI representatives indicated that CCI does not enforce the leave balance requirements of the applicable bargaining contracts. In addition, CCI did not have written plans in place for the employees with excessive leave balances to reduce their balances below the applicable limit. If CCI does not take action to reduce the excessive credits, the liability for accrued vacation leave or annual leave will most likely increase. This is because most employees will receive salary increases or use other non- compensable leave credits instead of vacation leave or annual leave, which will increase their leave balances. In addition, the state agency responsible for paying these leave balances may also face a cash flow problem if a significant number of employees with excessive vacation leave or annual leave credits separate from state service. Normally, state agencies are not budgeted to make these lump-sum payments. However, the State’s current practice dictates that the state agency that last employed an employee pays for that employee’s lump-sum separation payment, regardless of where the employee accrued the leave balance. Recommendation We recommend that CCI:  Implement controls to ensure that its employees’ vacation leave and annual leave balances are maintained within levels allowed by collective bargaining agreements and state regulations;  Monitor controls to ensure that they are implemented and operating effectively; and  Participate in leave buy-back programs when offered by the State and funds are available. 3 Most state employees receive pay rate increases every year pursuant to state laws or collective bargaining agreements until they reach the top of their pay scale, or promote into a higher-paying position. In addition, when an employee’s accumulated leave balances upon separation from state service are calculated for lump-sum pay, the employee is credited with additional leave credits equal to the amount that the employee would have earned had the employee taken time off and not separated from state service. -9- California Correctional Institution Payroll Process Review CCI lacked adequate controls over the processing of employee separation FINDING 4— lump-sum payments. We identified $312,718 in net questioned Inadequate overpayments, consisting of $128,752 based on actual transactions controls over reviewed and $183,966 in net questioned overpayments based on the separation lump- results of our statistical sampling. If not mitigated, this control deficiency sum pay, resulting leaves CCI at risk of additional improper payments. in improper payments Pursuant to collective bargaining agreements and state law, employees are entitled to receive cash for accrued eligible leave credits when separating from state employment. Payroll records indicate that CCI had processed separation lump-sum pay for 155 safety employees subject to the 7(k) overtime exemption between July 2012 and June 2015, for a total of $4,145,635. We randomly selected a statistical sample (as described in the Appendix) of 57 separation lump-sum payments, totaling $1,706,840. Of the 57 statistically determined samples, CCI overpaid 43 employees by a combined 2,027 hours, valued at $78,414. Also, six employees were paid 2,018 hours, valued at $50,338; the amounts could not be verified due to a lack of supporting documentation. Therefore, these amounts are questioned costs. These improper payments resulted from the Payroll Transactions Unit staff’s miscalculation of the employees’ accrued leave credits. CCI lacked adequate supervisory review to ensure accurate processing of employee separation lump-sum payments. As we used statistical sampling to select the lump-sum separation payments examined, we projected the amount of likely net improper payments to be $183,966. Accordingly, the known and likely improper and questioned payments total a net approximate $312,718, consisting of $190,455 in overpayments and $122,263 in questioned costs. The following table summarizes the results of our statistical sampling: Total Dollar amount of exceptions, net (rounded to nearest dollar) $ 1 28,752 Divide by: Dollar amount sampled 1 ,706,840 Dollar error rate (rounded to two decimals) 7.54% Population that was statistically sampled 4 ,145,635 Total known and likely dollar exceptions 3 12,718 * Less: Known dollar exceptions 1 28,752 Likely dollar exceptions $ 1 83,966 * ___________________ * Amounts reflect actual calculation. Due to rounding presented in the table, calcuations will not match. GC section 19839 (a) states: Upon separation from service without fault on his or her part, a person is entitled to a lump-sum payment as of the time of separation for any unused or accumulated vacation or annual leave or for any time off to which he or she is entitled by reason of previous overtime work where compensating time off for overtime work is provided for by the -10- California Correctional Institution Payroll Process Review appointing power or by rules of the department. This sum shall be computed by projecting the accumulated time on a calendar basis so that the lump sum will equal the amount which the employee would have been paid had he or she taken the time off but not separated from the service. GC sections 13402 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Recommendation We recommend that CCI:  Establish adequate controls to ensure accurate calculation and payment of employee separation lump-sum pay;  Conduct a review of employee separation lump-sum payments made during the past three years to ensure that the payments were accurate and in compliance with collective bargaining agreements and state law; and  Recover overpayments made to separated employees in accordance with GC section 19838 and State Administrative Manual (SAM) section 8776.6, and properly compensate those employees who were underpaid. CCI lacked adequate controls to ensure that the Payroll Transactions Unit FINDING 5— staff processed only valid and authorized regular and overtime Inadequate compensation that complied with collective bargaining agreements and controls over state laws. We identified $11,157,781 in net questioned regular pay regular and compensation, consisting of $26,314 based on actual transactions overtime reviewed and $11,131,467 based on the results of our statistical sampling. compensation, In addition, we identified $4,960,328 in net questioned compensation of resulting in overtime payments, consisting of $12,339 based on actual transactions improper and reviewed and $4,947,989 based on the results of our statistical sampling. questioned If not mitigated, this control deficiency leaves CCI at risk of additional payments improper regular and overtime compensation. Collective bargaining agreements, and state law and policies, contain specific clauses regarding the retention of documentation to support regular compensation, as well as the calculation of overtime compensation. Payroll records show that CCI processed 25,235 overtime payments between July 2012 and June 2015 that were paid to Work Week Group 2 employees. We stratified the population into two groups: transaction for over 300 hours of overtime in one pay period (15), and transactions for less than 300 hours of overtime in one pay period (25,220). We target-selected all 15 transactions over 300 hours of overtime in one pay period. We found that two of the 15 transactions had been improperly calculated. Specifically, one employee was overcompensated by $218, and one employee was undercompensated by $16. -11- California Correctional Institution Payroll Process Review We randomly selected a statistical sample (as described in the Appendix) of 60 out of 25,220 overtime payments, totaling $97,268 out of $39,751,584. We also tested the regular pay associated with these overtime payments; the regular pay associated with these overtime payments was $366,897. The total regular pay in relation to the overtime payments from which the sample was selected was $155,572,254. Of the 60 statistically-determined samples, we determined that CCI improperly paid five employees, resulting in $478 in overtime over- compensation. In addition, CCI could not provide the four employees’ timesheets to support that the payments for overtime hours were valid. Although the State’s payroll system makes all computations and prepares the “negative4” payrolls, timesheets are still required to substantiate the hours worked for regular pay and overtime pay. Without timesheets, there is no record of hours worked and supervisory review and approval. Therefore, we could not determine the validity and authorization of payments for regular pay, totaling $26,314, and associated overtime pay, totaling $11,659, for the four employees whose timesheets could not be located. As a result, we questioned these payments. Because we used a statistical sampling method to select the payments examined, we could also estimate that there may have been additional missing timesheets associated with regular pay, totaling $11,131,467. In addition, we could also estimate that there may have been additional missing timesheets and improper payments associated with overtime pay, totaling $4,947,989. Accordingly, as timesheets are required documents for authorizing pay, we questioned these payments for regular pay and overtime pay. The following table summarizes the results of our statistical sampling: Regular Compensation Total Dollar amount of exceptions, net (rounded to nearest dollar) $ 2 6,314 Divide by: Dollar amount sampled 3 66,897 Dollar error rate (rounded to two decimals) 7.17% Population that was statistically sampled 1 55,572,254 Total known and likely dollar exceptions 11,157,781 * Less: Known dollar exceptions 26,314 Likely dollar exceptions 11,131,467 * Overtime Compensation Total Dollar amount of exceptions, net (rounded to nearest dollar) $ 1 2,137 Divide by: Dollar amount sampled 97,268 Dollar error rate (rounded to two decimals) 12.48% Population that was statistically sampled 39,751,584 Total known and likely dollar exceptions 4,960,126 * Less: Known dollar exceptions 12,137 Likely dollar exceptions $ 4,947,989 * * Amounts reflect actual calculation. Due to rounding presented in the table, calcuations will not match. 4 According to the SCO’s Payroll Procedures Manual, “These are referred to as ‘Negative’ payrolls because attendance reports have not been submitted and no working payrolls have been cleared with agencies/campuses when the payrolls are prepared. This payroll writing operation is performed for the majority of state employees during the period from the cutoff day in each pay period to the 27th and 28th of the month.” -12- California Correctional Institution Payroll Process Review The improper payments resulted from the Payroll Transactions Unit staff’s miscalculation of the employees’ overtime hours, and because CCI did not maintain timesheets to support regular and overtime hours worked. CCI lacked adequate supervisory review to ensure accurate processing of overtime compensation and document retention. GC sections 13402 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Recommendation We recommend that CCI:  Conduct a review of overtime payments made during the past three years to ensure that the payments complied with collective bargaining agreements and state laws;  Recover overpayments made to employees through an agreed-upon collection method in accordance with GC section 19838; and  Properly compensate those employees who were underpaid. We further recommend that, to prevent improper overtime payments from recurring, CCI:  Establish adequate internal controls to ensure that payments for overtime compensation are accurate and comply with collective bargaining agreements and state law;  Provide adequate oversight to ensure that Payroll Transactions Unit staff members process only valid and authorized overtime payments that comply with collective bargaining agreements and state law;  Provide training to Payroll Transactions Unit staff members who process overtime payment transactions to ensure that they understand the requirements under collective bargaining agreements and state law; and  Establish controls to ensure that all records to support employees’ hours worked are maintained in accordance with bargaining unit agreements and state laws and policies. CCI lacked adequate controls over holiday pay and holiday credit accruals FINDING 6— to ensure that the Payroll Transactions Unit staff members processed only Inadequate valid and authorized holiday pay and holiday credits that complied with controls over collective bargaining agreements and state laws. We identified $49,834 in holiday pay and net questioned overpayments of holiday pay, consisting of $947 based on holiday credits, actual transactions reviewed and $48,887 based on the results of our resulting in statistical sampling. In addition, we found that CCI improperly processed improper 12 of 34 holiday credit transactions that we selected for review, resulting payments and in a net over-accrual of 604 holiday credit hours at a cost of approximately accruals $14,537. We questioned one of the 44 holiday credit transactions for eight hours of holiday credit at a cost of approximately $158 due to lack of supporting documentation. If not mitigated, this control deficiency leaves -13- California Correctional Institution Payroll Process Review CCI at risk of additional improper holiday pay compensation and holiday credit accruals. GC section 19853 specifies the number of hours of holiday credit that an employee is eligible to receive per qualifying holiday. Collective bargaining agreements include similar provisions regarding holiday credits and holiday pay. Holiday Pay Payroll records show 11,128 holiday pay transactions at a cost of $4,255,718. We stratified this population into two groups: transactions in which employees were compensated 48 hours of holiday pay in one pay period (seven transactions at a cost of $11,577), and transactions for less than 48 hours of holiday pay in one pay period (11,121 transactions at a cost of $4,244,141). We reviewed all seven transactions in which employees were compensated for 48 hours of holiday pay. We found that in one of the seven transactions, an employee was over-compensated by 24 hours at a cost of approximately $683. We randomly selected a statistical sample of 60 of the 11,121 holiday pay transactions (as described in the Appendix) at a cost of $22,755. We found that in one of the 60 transactions, an employee was over-compensated by eight hours at a cost of approximately $264. As we used statistical sampling to select the 60 holiday pay transaction reviewed, we projected the amount of likely improper payments to be $48,887. Accordingly, the known and likely improper payments total approximately $49,151. The following table summarizes the results of our statistical sampling: Total Dollar amount of exceptions, net (rounded to nearest dollar) $ 2 64 Divide by: Dollar amount sampled 22,755 Dollar error rate (rounded to two decimals) 1.16% Population that was statistically sampled 4,244,141 Total known and likely dollar exceptions 49,151 * Less: Known dollar exceptions 264 Likely dollar exceptions $ 48,887 * * Amounts reflect actual calculation. Due to rounding presented in the table, calcuations will not match. Holiday Credit Leave accounting records show a total of 33 transactions with 312 hours of holiday credit that were accrued during months without holidays. In addition, one transaction was for 524 hours of holiday credit accrued in a single pay period. We reviewed all 34 transactions and determined that 12 of the 34 transactions were improper accruals, totaling 604 hours at a cost of -14- California Correctional Institution Payroll Process Review approximately $14,537. We also determined that one of the 34 transactions for eight hours accrued had no documentation to support the accrual. Consequently, we questioned the eight hours, valued at $158. These improper and questioned holiday payments and holiday credit accruals resulted from the Payroll Transactions Unit staff’s improper processing of the employees’ holiday pay and holiday credit, and CCI’s failure to retain adequate documentation. CCI lacked adequate supervisory review to ensure accurate processing of employee holiday pay and holiday credit accruals. GC sections 13402 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Recommendation We recommend that CCI:  Conduct a review of holiday credit accruals and holiday pay made during the past three years to ensure that the accrued holiday credits and issued holiday pay complied with collective bargaining agreements and state law;  Make appropriate adjustments to holiday credit leave balances of improper accruals identified, and recover overpayments made to employees through agreed-upon collection method in accordance with GC section 19838; and  Ensure that all documentation to support holiday credit accruals is maintained. We further recommend that, to prevent improper holiday credit accruals and holiday pay compensation from recurring, CCI:  Establish adequate internal controls to ensure that holiday pay and holiday credit accruals are accurate and comply with collective bargaining agreements and state law;  Provide adequate oversight to ensure that Payroll Transactions Unit staff members process only holiday credits and holiday pay that are earned; and  Provide training to Payroll Transactions Unit staff members who process holiday credits and holiday pay to ensure they understand the requirements under collective bargaining agreements and state law. CCI lacked adequate controls to ensure that the Payroll Transactions Unit FINDING 7— staff members processed only valid and authorized uniform allowance Inadequate compensation that complied with collective bargaining agreements and controls over state laws. We identified 41 transactions, at a cost of $12,505, that were in uniform allowance, excess of uniform allowance limitations. In addition, we found 59 meal resulting in allowance transactions, at a cost of $1,820, that were erroneously charged improper to the uniform allowance payment code. If not mitigated, this control payments and noncompliance -15- California Correctional Institution Payroll Process Review deficiency leaves CCI at risk of additional improper uniform allowance compensation and incorrect coding of other allowable expenditures. Collective bargaining agreements limit the amount of uniform allowance allowed to an eligible recipient. There were 3,591 transactions, totaling $1,836,253 in uniform allowance payments, during the review period. We analyzed the transactions and noted that 41 transactions exceeded the maximum by $305 each, totaling $12,505. The improper payments resulted from an unallowable additional uniform allowance allotment made to individuals who were part of a group called the “Crisis Response Team.” Because the uniform allowance is pro- rated for any employee who does not work an entire year, whether due to separation from service or other reasons, it is possible that there are additional unallowable allotments for the “Crisis Response Team” that were also pro-rated and not identified within the population. We found 59 transactions for meal allowance payments, totaling $1,820, within the population of uniform allowance transactions. Although the expenditures are allowable and the recipients were entitled to the payments, the expenditures were erroneously charged to an incorrect payment code. CCI lacked adequate supervisory review to ensure that only allowable uniform allowance payments were made, and that expenditures were charged to the proper codes within the payroll system. GC sections 13402 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Recommendation We recommend that CCI:  Conduct a review of uniform allowance compensation made during the past three years to ensure that uniform allowance compensation complied with collective bargaining agreements and state law; and  Make appropriate adjustments for improper payments identified, and recover overpayments made to employees through agreed-upon collection method in accordance with GC section19838 We further recommend that, to prevent improper uniform allowance payments from recurring, CCI:  Establish adequate internal controls to ensure that uniform allowance payments are allowable and comply with collective bargaining agreements;  Provide adequate oversight to ensure that Payroll Transactions Unit staff members only process allowable uniform allowance payments; and -16- California Correctional Institution Payroll Process Review  Provide training to Payroll Transactions Unit staff members who process uniform allowance compensation to ensure they understand the requirements under collective bargaining agreements and state law. CCI lacked adequate controls over salary advances to ensure that they FINDING 8— were recovered in accordance with state law and policies. Two salary Inadequate advances reviewed, totaling $2,925, remained outstanding due to CCI’s controls over lack of collection efforts. The oldest outstanding salary advance was seven salary advances, months old as of June 30, 2015. After our review period, CCI collected resulting in failure and cleared one salary advance for $2,900 in August 2016, 20 months after to recover the salary advance was issued. This control deficiency leaves CCI at risk outstanding of additional failures to collect salary advances in a timely manner if not balances in mitigated. accordance with CCI had 23 outstanding salary advances at a cost of $15,789 as of June 30, state law and 2015. We reviewed two of the 23 salary advances, which were both over policies 120 days old as of June 30, 2015. One of the two salary advances reviewed was issued November 25, 2014, for an employee who applied for Non-Industrial Disability (NDI). The NDI was for the month of November 2014. The salary advance should have been cleared upon approval for NDI. However, the salary advance was not cleared until August 2016. The delay occurred because CCI did not complete and submit the appropriate forms to the SCO to make the adjustment and issue a payroll warrant clearing the salary advance. The second salary advance was issued December 24, 2014, for an employee who separated from state service. The amount outstanding at June 30, 2015, was $25. CCI did not initiate the process of collecting the outstanding salary advance until February 3, 2016, when it mailed a collection letter. CCI made no additional attempts to collect the outstanding balance, and the balance remained outstanding as of November 2018. CCI could have written off the amount, pursuant to GC section 16582. These untimely attempts to clear salary advances were due to CCI’s lack of oversight of outstanding salary advances. GC section 16582 states: Within the uniform state payroll system, the Controller may, for each participant, disregard errors of twenty-five dollars ($25) or less in individual accounts receivable, if he or she has determined that time and expense will be saved in doing so. SAM section 8776 states, in part: An accounts receivable (AR) is defined as a claim against a debtor, such as a person, business, or governmental entity for money owed to the state. An invoice or other document requesting payment will be prepared. The invoice shall be sent to the debtor as soon as practical and within 30 days after the event giving rise to the AR… Departments must ensure prompt and ongoing action is taken for the collection of ARs. -17- California Correctional Institution Payroll Process Review SAM section 8776.6 states, in part: Departments are advised to use collection practices that are cost effective and consistent with their programs goals and legal authority. Three documented letters should be made to collect on nonemployee delinquent accounts. However, departments have the option of making one documented letter before proceeding to the discharge of accountability process for nonemployee accounts receivable of $25 and under. This threshold applies to the total amount owed by the debtor, not to each invoice. Recommendation We recommend that CCI establish adequate controls to ensure that it monitors, recovers, and clears salary advances in a timely manner pursuant to Government Code and State Administrative Manual guidelines. FINDING 9— CCI lacked adequate controls to ensure that Payroll Transactions Unit staff Inadequate members processed only valid and authorized Senior Peace Officer Pay compensation that complied with collective bargaining agreements and controls over state laws. We identified 43 transactions, totaling approximately $3,409, Senior Peace in which Senior Peace Officer Pay was calculated with an incorrect pay Officer Pay, differential code. Sixteen of the transactions resulted in employees being resulting in under-compensated by $2,204. This control deficiency leaves CCI at risk improper of additional improper Senior Peace Officer Pay transactions if not payments mitigated. Pay Differential 164 – Senior Officer Pay – Bargaining Unit 06 (Pay Differential 164) is for rank and file Bargaining Unit 6 employees who are entitled to additional pay based on the number of years of service, their specific position classification, and the institution for which they work. Pay Differential 165 – Senior Officer Pay Differential S06 and Excluded (Pay Differential 165) is for Bargaining Unit 06 supervisors and excluded employees who are entitled to additional pay based on the number of years of service, their specific position classification, and the institution for which they work. We found that 43 transactions were incurred for rank and file Bargaining Unit 06 employees who were improperly coded to Pay Differential 165 instead of Pay Differential 164. In addition, 16 of the 43 transactions reviewed were for an incorrect number of years of service, resulting in a total of $2,204 in under-compensation. These improper payments resulted from improper processing of Senior Peace Officer Pay by the Payroll Transactions Unit staff. CCI lacked adequate supervisory review to ensure accurate processing of Senior Peace Officer Pay. GC sections 13402 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. -18- California Correctional Institution Payroll Process Review Recommendation We recommend that CCI:  Conduct a review of Senior Peace Officer Pay compensation made during the past three years to ensure that the compensation complied with collective bargaining agreements and state law; and  Make appropriate adjustments to improper payments identified, and recover overpayments made to employees through an agreed-upon collection method in accordance with GC section 19838. We further recommend that, to prevent improper Senior Peace Officer Pay compensation from recurring, CCI:  Establish adequate internal controls to ensure that Senior Peace Officer Pay compensation is accurate and complies with collective bargaining agreements and state law;  Provide adequate oversight to ensure that Payroll Transactions Unit staff members process proper Senior Peace Officer Pay transactions; and  Provide training to Payroll Transactions Unit staff members who process Senior Peace Officer Pay compensation to ensure that they understand the requirements under collective bargaining agreements and state law. -19- California Correctional Institution Payroll Process Review Appendix— Sampling Methodology July 1, 2012, through June 30, 2015 We used attributes sampling for test of compliance. The following table outlines our sampling application: Results Sample Projected to Population Population Selection Confidence Tolerable Expected Intended Finding Review Area Type of Test (Unit) (Dollar) Sampling Unit Method Level Error Rate Error (Rate) ¹ Sample Size Population Number Separation Compliance 155 $4,145,635 Employee Computer- 95% 5% 0 57 Yes 4 lump-sum pay generated simple random Regular pay Compliance 25,220 $155,572,254 Regular pay Computer- 95% 5% 0 60 Yes 5 transaction generated simple random Overtime pay Compliance 25,220 $39,751,584 Overtime pay Computer- 95% 5% 0 60 Yes 5 transaction generated simple random Holiday pay Compliance 11,121 $4,244,141 Holiday pay Computer- 95% 5% 0 60 Yes 6 transaction generated simple random ________________ 1 Pursuant to the AICPA’s Audit Guide: Audit Sampling (May 1, 2017 edition, pages 131-133), the expected error is the expected number of errors planned for in the sample. It is derived by multiplying the expected error rate by the sample size. The expected number of errors in the sampling tables on pages 135-136 was rounded upward, e.g., 0.2 errors becomes 1 error. -A1- California Correctional Institution Payroll Process Review Attachment— California Correctional Institution’s Response to Draft Review Report -A1- State Controller’s Office Division of Audits Post Office Box 942850 Sacramento, CA 94250 http://www.sco.ca.gov S18-PAR-9001