California State Prison, Corcoran - Payroll Process Review

CALIFORNIA STATE PRISON, CORCORAN Review Report PAYROLL PROCESS REVIEW November 1, 2014, through October 31, 2017 BETTY T. YEE California State Controller July 2019 BETTY T. YEE California State Controller July 9, 2019 Ken Clark, Warden California State Prison, Corcoran P.O. Box 8800 Corcoran, CA 93212 Dear Mr. Clark: The State Controller’s Office has reviewed California State Prison, Corcoran’s (CSP-COR) payroll process and transactions for the period of November 1, 2014, through October 31, 2017. CSP-COR’s management is responsible for maintaining a system of internal control over payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. Our review found material weaknesses in internal control over the CSP-COR’s payroll process. These weaknesses contributed to CSP-COR employees’ excessive vacation and annual leave balances, improper payments, and improper holiday credit transactions, costing the State an estimated net total of $1,615,071. If you have any questions, please contact Andrew Finlayson, Chief, State Agency Audits Bureau, by telephone at (916) 324-6310. Sincerely, Original signed by JIM L. SPANO, CPA Chief, Division of Audits JLS/as Ken Clark, Warden -2- July 9, 2019 cc: Tammy Campbell, Chief Deputy Warden California State Prison, Corcoran Kenneth Pogue, Undersecretary of Administration & Offender Services California Department of Corrections and Rehabilitation Kathleen Allison, Undersecretary of Operations California Department of Corrections and Rehabilitation Katherine Minnich, Deputy Director of Human Resources California Department of Corrections and Rehabilitation Jeanette Bragg, Correctional Business Manager California State Prison, Corcoran Jeanette Lucas, Institutional Personnel Officer California State Prison, Corcoran Mai Lee Vang, External Audits Manager Office of Audits and Court Compliance California Department of Corrections and Rehabilitation Mark Rodriguez, Chief Administrative Services Division California Department of Human Resources Marissa Revelino, Chief Personnel and Payroll Services Division State Controller’s Office California State Prison, Corcoran Payroll Process Review Contents Review Report Summary ............................................................................................................................ 1 Background ........................................................................................................................ 1 Objectives, Scope, and Methodology ............................................................................... 2 Conclusion .......................................................................................................................... 3 Views of Responsible Officials .......................................................................................... 4 Restricted Use .................................................................................................................... 4 Schedule—Summary of Findings ......................................................................................... 5 Findings and Recommendations ........................................................................................... 6 Appendix—Sampling Methodology ..................................................................................... A1 Attachment—California State Prison, Corcoran’s Response to Draft Review Report California State Prison, Corcoran Payroll Process Review Review Report Summary The State Controller’s Office (SCO) reviewed California State Prison, Corcoran (CSP-COR) payroll process for the period of November 1, 2014, through October 31, 2017. CSP-COR’s management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. Our limited review identified material weaknesses in internal control over CSP-COR’s payroll process that leave CSP-COR at risk of additional improper payments if not mitigated. We found that CSP-COR has a combination of deficiencies in internal control over its payroll process such that there is a reasonable possibility that a material misstatement in financial information or noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. Specifically, CSP-COR lacked adequate segregation of duties and compensating controls over its processing of payroll transactions. In addition, CSP-COR inappropriately granted seven employees keying access to the State’s payroll system, leaving payroll data at risk of misuse, abuse, and unauthorized use. In one instance, a Staff Services Manager I inappropriately had keying access to the system, as the employee was in a management classification. These deficiencies have a pervasive effect on CSP-COR’s payroll process, and impair the effectiveness of other controls by rendering their design ineffective or by keeping them from operating effectively. We also found that CSP-COR lacked sufficient controls over the processing of specific payroll-related transactions to ensure that CSP-COR complied with collective bargaining agreements and state laws, and that only valid and authorized payments were processed. As quantified in the Schedule, these control deficiencies contributed to CSP-COR employees’ excessive vacation and annual leave balances, improper payments, and improper holiday credit transactions, costing the State an estimated net total of $1,615,071. Background In 1979, the State of California adopted collective bargaining for state employees. This created a significant workload increase for the SCO’s Personnel and Payroll Services Division (PPSD), as PPSD was the State’s centralized payroll processing center for all payroll-related transactions. PPSD decentralized the processing of payroll, allowing state agencies and departments to process their own payroll-related transactions. Periodic reviews of the decentralized payroll processing at state agencies and departments ceased due to budget constraints in the late 1980s. In 2013, the California State Legislature reinstated these payroll reviews to gain assurance that state agencies and departments maintain adequate internal control over payroll, provide proper oversight over their decentralized payroll processing, and comply with various state laws and regulations regarding payroll processing and related transactions. -1- California State Prison, Corcoran Payroll Process Review Review Authority Authority for this review is provided by California Government Code (GC) section 12476, which states, “The Controller may audit the uniform state pay roll system, the State Pay Roll Revolving Fund, and related records of state agencies within the uniform state pay roll system, in such manner as the Controller may determine.” In addition, GC section 12410 stipulates that “The Controller shall superintend the fiscal concerns of the state. The Controller shall audit all claims against the state, and may audit the disbursement of any state money, for correctness, legality, and for sufficient provisions of law for payment.” Objectives, Scope, We performed this review to determine whether CSP-COR: and Methodology  Processed payroll and payroll-related disbursements accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures;  Established adequate internal control over payroll to meet the following control objectives: o Payroll and payroll-related transactions are properly approved and certified by authorized personnel; o Only valid and authorized payroll and payroll-related transactions are processed; o Payroll and payroll-related transactions are accurate and properly recorded; o Payroll systems, records, and files are adequately safeguarded; o State laws, regulations, policies, and procedures are complied with regarding payroll and payroll-related transactions;  Complied with existing controls as part of the ongoing management and monitoring of payroll and payroll-related expenditures;  Maintained accurate records of leave balances; and  Administered and recorded salary advances properly and in accordance with state laws, regulations, policies, and procedures. We reviewed CSP-COR’s payroll process and transactions for the period of November 1, 2014, through October 31, 2017. To achieve our objectives, we:  Reviewed state and CSP-COR policies and procedures related to the payroll process to understand CSP-COR’s methodology for processing various payroll and payroll-related transactions;  Interviewed CSP-COR payroll personnel to understand CSP-COR’s methodology for processing various payroll and payroll-related transactions, determine their level of knowledge and ability relating to payroll transaction processing, and gain an understanding of existing internal control over the payroll process and systems; -2- California State Prison, Corcoran Payroll Process Review  Selected transactions recorded in the State’s payroll database using statistical sampling as outlined in the Appendix, and targeted selection based on risk factors and other criteria for review;  Analyzed and tested transactions recorded in the State’s payroll database, and reviewed relevant files and records to determine the accuracy of payroll and payroll-related payments; accuracy of leave transactions; propriety of review and approval of transactions; adequacy of internal control over the payroll process and systems; and compliance with collective bargaining agreements and state laws, regulations, policies, and procedures (errors found in statistically- determined samples were projected to the intended population); and  Reviewed salary advances to determine whether CSP-COR administered and recorded them in accordance with state laws, regulations, policies, and procedures. Conclusion Based on the results of our review, we found that CSP-COR:  Did not process payroll and payroll-related disbursements accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures (see Findings 3 through 6);  Lacked adequate internal control over payroll and payroll-related transactions (see Findings 1 through 6);  Did not comply with existing controls as part of the ongoing management and monitoring of payroll and payroll-related expenditures (see Findings 2 and 3); and  Did not maintain accurate records of leave balances (see Finding 4). As quantified in the Schedule and described in the Findings and Recommendations section of this review report, these material weaknesses1 in internal control over the payroll process contributed to CSP-COR employees’ excessive vacation and annual leave balances, improper payments, and improper holiday credit transactions, costing the State an estimated net total of $1,615,071. 1An evaluation of an entity’s payroll process may identify deficiencies in its internal control over the process. A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, misstatements in financial information, impairments of effectiveness or efficiency of operations, or noncompliance with provisions of laws, regulations, or contracts on a timely basis. Control deficiencies, either individually or in combination with other control deficiencies, may be evaluated as significant deficiencies or material weaknesses. A material weakness is a deficiency, or a combination of deficiencies, in internal control such that there is a reasonable possibility that a material misstatement in financial information, impairment of effectiveness or efficiency of operations, or noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. A significant deficiency is a deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness, yet important enough to merit attention from those charged with governance. -3- California State Prison, Corcoran Payroll Process Review Views of We issued a draft review report on June 11, 2019. Ken Clark, Warden, responded by letter dated June 14, 2019 (Attachment). CSP-COR did not Responsible agree with Finding 1. However, CSP-COR indicated that it has taken steps Officials to address the remaining findings subsequent to this review. We will follow up during the next payroll engagement to ensure that these corrective actions were adequate and appropriate. Restricted Use This report is solely for the information and use of CSP-COR and the SCO; it is not intended to be and should not be used by anyone other than these specified parties. This restriction is not intended to limit distribution of this report, which is a matter of public record, and is available on the SCO website at www.sco.ca.gov. Original signed by JIM L. SPANO, CPA Chief, Division of Audits July 9, 2019 -4- California State Prison, Corcoran Payroll Process Review Schedule— Summary of Findings November 1, 2014, through October 31, 2017 Number of Issues as a Total Dollar Number of Dollar Amount Selections Percentage Dollar Dollar Amount of Finding Selections Method of of Selections with of Selections Amount of Amount of Known and Number Issues Reviewed Selection Selection Unit Reviewed Issues Reviewed * Known Issues Likely Issues Likely Issues 1 Inadequate segregation of duties N/A N/A N/A N/A N/A N/A N/A N/A N/A and compensating controls over payroll transactions 2 Inappropriate keying access to the 2 6 Targeted Employee $ - 7 27% $ - N/A $ - State's payroll system 3 Inadequate controls over vacation 1 11 Targeted Employee 1 ,578,828 111 100% 1 ,578,828 N/A 1 ,578,828 and annual leave balances, resulting in liability for excessive balances 4 Inadequate controls over separation lump-sum pay, resulting in improper payments: Overpayments 6 0 Statistical Employee 1 ,332,011 34 57% 7 4,721 $ 1 53,859 228,580 Underpayments --Same selections above-- 4 7% ( 1,310) ( 2,697) ( 4,007) Overpayments 8 Targeted Employee 1 ,473,288 1 13% 1 63 N/A 163 Underpayments --Same selections above-- 2 25% ( 958) N/A ( 958) 5 Inadequate controls over overtime pay, resulting in improper payments: Overpayments 6 0 Statistical Overtime 9 1,278 3 5% 2 44 1 60,298 160,542 Underpayments --Sam tera snesleaccttiioonns above-- 4 7% ( 533) ( 350,160) ( 350,693) Overpayments 1 Targeted Overtime 1 ,440 1 100% 1 ,440 N/A 1,440 transaction 6 Inadequate controls over holiday credits, resulting in improper credits Over-credited 3 6 Targeted Holiday 1 8,040 6 17% 1 ,729 N/A 1,729 credit transactions Under-credited --Same selections above-- 7 19% ( 553) N/A ( 553) Total $ 4 ,494,885 $ 1,653,771 (38,700) $ 1,615,071 _________________ *All percentages are rounded to the nearest percentage point. -5- California State Prison, Corcoran Payroll Process Review Findings and Recommendations FINDING 1— CSP-COR lacked adequate segregation of duties within its payroll transactions unit to ensure that only valid and authorized payroll Inadequate transactions were processed. CSP-COR also failed to implement other segregation of controls to compensate for this risk. duties and compensating GC sections 13400 through 13407 require state agencies to establish and controls over maintain internal controls, including proper segregation of duties and an payroll effective system of internal review. Adequate segregation of duties transactions reduces the likelihood that fraud or error will remain undetected by providing for separate processing by different individuals at various stages of a transaction and for independent review of the work performed. Our review found that CSP-COR payroll transactions unit staff performed conflicting duties. Staff members performed multiple steps in processing payroll transactions, including entering data into the State’s payroll system; auditing employee timesheets; reconciling payroll, including reconciling system output to source documentation; reporting payroll exceptions; and processing adjustments. For example, staff members keyed in regular and overtime pay and reconciled the master payroll, overtime, and other supplemental warrants. CSP-COR failed to demonstrate that it had implemented compensating controls to mitigate the risks associated with conflicting duties. We found no indication that staff functions were subjected to periodic supervisory review. The lack of adequate segregation of duties and compensating controls has a pervasive effect on the CSP-COR payroll process, and impairs the effectiveness of other controls by rendering their design ineffective or by keeping them from operating effectively. These control deficiencies, in combination with other deficiencies discussed in Findings 2 through 6, represent a material weakness in internal control over the payroll process such that there is a reasonable possibility that a material misstatement in financial information or noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. Good internal control practices require that the following functional duties be performed by different work units, or at minimum, by different employees within the same unit:  Recording transactions – This duty refers to the record-keeping function, which is accomplished by entering data into a computer system.  Authorization to execute – This duty belongs to individuals with authority and responsibility to initiate and execute transactions.  Periodic review and reconciliation of actual payments to recorded amounts – This duty refers to making comparisons of information at regular intervals and taking action to resolve differences. -6- California State Prison, Corcoran Payroll Process Review Recommendation We recommend that CSP-COR:  Separate conflicting payroll function duties to the greatest extent possible. Adequate segregation of duties will provide a stronger system of internal control whereby the functions of each employee are subject to the review of another. If it is not possible to segregate payroll functions fully and appropriately, CSP-COR should implement compensating controls. For example, if the payroll transactions unit staff member responsible for recordkeeping also performs a reconciliation process, then the supervisor should perform and document a detailed review of the reconciliation to provide additional control over the assignment of conflicting functions. Compensating controls may also include dual authorization requirements and documented reviews of payroll system input and output; and  Implement formal procedures for performing and documenting compensating controls. CSP-COR’s Response The Personnel Specialist duties and responsibilities consist of processing various personnel/payroll transactions, including; data entry, reconciliation, and processing of adjustments and corrections. COR believes controls are in place which ensure timekeeper duties do not overlap with the personnel transactions staff who key in the payroll system. SCO Comment Our finding and recommendation remain unchanged. The conflicting duties that we described in our finding do not necessarily involve overlapping duties; however, these conflicting duties did result in control deficiencies. Specifically, staff members reconciled their own transactions. Effective internal controls also included adequate supervisory review to ensure that transactions are properly authorized and reviewed. Findings 2 through 6 were the results of these control deficiencies. FINDING 2— CSP-COR lacked adequate controls to ensure that only appropriate staff had keying access to the State’s payroll system. CSP-COR inappropriately Inappropriate allowed seven employees keying access to the State’s payroll system. If keying access to the not mitigated, this control deficiency leaves payroll data at risk of misuse, State’s payroll abuse, and unauthorized use. system The SCO maintains the State’s payroll system. The system is decentralized, thereby allowing employees of state agencies to access it. PPSD has established a Decentralized Security Program Manual that all state agencies are required to follow in order to access the payroll system. The program’s objectives are to secure and protect the confidentiality and integrity of payroll data against misuse, abuse, and unauthorized use. -7- California State Prison, Corcoran Payroll Process Review We reviewed the records of 26 CSP-COR employees who had keying access to the State’s payroll system at various times between November 2014 and October 2017. Of the 26 employees, seven had inappropriate keying access to the system. CSP-COR did not immediately remove or modify the employees’ keying access after their separation from state service, transfer to another agency or unit, or change in classification. For example, a Personnel Supervisor II separated from state service in December 30, 2014. However, the request to delete the employee’s access was not made until June 4, 2015, 156 days later. In addition, a Staff Services Manager I was given keying access in 2010 and maintained access until separation from state service. The Decentralized Security Program Manual states, in part: The PPSD system contains sensitive and confidential information. Access is restricted to persons with an authorized, legal, and legitimate business requirement to complete their duties. . . . Currently, PIMS, HIST, KEYM, PIP, LAS, MPC and/or ACAS applications are restricted to Personnel Specialists or Personnel Technician classifications because their need is by definition a function of their specific job duties and any change in those duties requires a reevaluation of the need for access. If the employee's duties change, such that the need for access no longer exists, the access privilege MUST be removed or deleted immediately by a request submitted by the department/campus. . . . A request to grant access to an individual in a classification other than in the Personnel Specialist/Payroll Technician series to access PIMS, HIST, KEYM, PIP, LAS, MPC and/or ACAS requires a written justification from the Authorizing Manager. The justification must describe the individual's specific job duties requiring the need to access system information (i.e., PIMS = Employment History, HIST=Payroll History, LAS=Leave Accounting System, etc.) as well as level of access to that application, in order to perform their regular daily duties. Manager classifications will be granted inquiry access only. To prevent unauthorized use by a transferred, terminated or resigned employee’s user ID, the Security Monitor must IMMEDIATELY submit all pages of the PSD125A to delete the user’s system access. Using an old user ID increases the chances of a security breach which is a serious security violation. Sharing a user ID is strictly prohibited and a serious violation. Recommendation We recommend that CSP-COR:  Update keying access to the State’s payroll system immediately after employees leave CSP-COR, transfer to another unit, or change classifications; and  Periodically review access to the system to verify that access complies with the Decentralized Security Program Manual. -8- California State Prison, Corcoran Payroll Process Review FINDING 3— CSP-COR failed to implement controls to ensure that it adheres to the requirements of collective bargaining agreements and state regulations to Inadequate limit the accumulation of vacation and annual leave credits. This controls over deficiency resulted in liability for excessive leave balances with a value of vacation and at least $1,578,828 as of October 30, 2017. We expect the liability to annual leave increase if CSP-COR does not take action to address the excessive balances, resulting vacation and annual leave balances. in liability for excessive balances Collective bargaining agreements and state regulations limit the amount of vacation and annual leave that most state employees may accumulate to no more than 80 days (640 hours). The limit on leave balances helps state agencies to manage leave balances and control the State’s liability for accrued leave credits. State agencies may allow employees to carry a higher leave balance only under limited circumstances. For example, an employee may not be able to reduce accrued vacation or annual leave hours below the limit due to business needs. When an employee’s leave accumulation exceeds or is projected to exceed the limit, state agencies should work with the employee to develop a written plan to reduce leave balances below the applicable limit. Our review of CSP-COR’s leave accounting records determined that CSP-COR had 1,808 employees with unused vacation or annual leave credits as of October 31, 2017. Of those employees, 111 exceeded the limit set by collective bargaining agreements and state regulations. For example, one employee had an accumulated balance of 2,390 hours of annual leave, or 1,750 hours beyond the 640-hour limit. Collectively, the 111 employees accumulated 40,814 hours of excess vacation and annual leave, with a value of at least $1,578,828 as of October 31, 2017. This estimated liability does not adjust for salary rate increases and additional leave credits2. Accordingly, we expect that the amount needed to pay for this liability will be higher. For example, a CSP-COR employee separated from state service with 2,680 hours in leave credits, including 1,865 hours in annual leave. After adjusting for additional leave credits, the employee should have been paid for 3,220 hours, or 20% more. We performed an additional review of the records for 20 of 111 employees to determine whether CSP-COR complied with collective bargaining agreements and state regulations. CSP-COR could not demonstrate that it had complied with the exceptions specified in collective bargaining agreements and state regulations in allowing these 20 employees to maintain excess vacation or annual leave balances. We found that no procedures exist at CSP-COR regarding the maintenance and reduction of excess leave balances. If CSP-COR does not take action to reduce the excessive leave balances, the liability for accrued vacation and annual leave will likely increase, as most employees will receive salary increases or use other non- compensable leave credits instead of vacation or annual leave, increasing 2Most state employees receive pay rate increases every year pursuant to state laws or collective bargaining agreements until they reach the top of their pay scale, or promote into a higher-paying position. In addition, when an employee’s accumulated leave balances upon separation from state service are calculated for lump-sum pay, the employee is credited with additional leave credits equal to the amount that the employee would have earned had the employee taken time off and not separated from state service. -9- California State Prison, Corcoran Payroll Process Review their vacation or annual leave balances. The state agency responsible for paying these leave balances may face a cash flow problem if a significant number of employees with excessive vacation or annual leave balances separate from state service. Normally, state agencies are not budgeted to make these separation lump-sum payments. However, the State’s current practice dictates that the state agency that last employed an employee pays for that employee’s lump-sum separation payment, regardless of where the employee accrued the leave balance. Recommendation We recommend that CSP-COR:  Implement controls, including existing policies and procedures, to ensure that its employees’ vacation and annual leave balances are maintained within levels allowed by collective bargaining agreements and state regulations;  Conduct ongoing monitoring of controls to ensure that they are implemented and operating effectively; and  Participate in leave buy-back programs if the State offers such programs and funds are available. FINDING 4— CSP-COR lacked adequate controls over the processing of employee separation lump-sum pay. We identified $228,743 in overpayments and Inadequate $4,965 in underpayments for separation lump-sum pay, consisting of controls over $74,884 in overpayments and $2,268 in underpayments based on actual separation lump- transactions reviewed (“known”); and $153,859 in overpayments and sum pay, resulting $2,697 in underpayments based on the results of statistical sampling in improper (“likely”). If not mitigated, the control deficiencies leave CSP-COR at risk payments of additional improper separation lump-sum payments. GC section 19839 allows lump-sum payment for accrued eligible leave credits when an employee separates from state employment. Collective bargaining agreements include similar provisions regarding separation lump-sum pay. Payroll records show that CSP-COR processed payments for separation lump-sum pay, totaling $7,966,846, for 328 employees between November 2014 and October 2017, as follows: Separation Lump-Sum Pay Group Unit Amount Bargaining Unit R06 Employees (statistically sampled) 141 $ 4,074,773 Eight payments to non-R06 employees over $100,000 (items examined 100%) 8 1,473,288 Remaining payments to non-R06 employees (not tested) 179 2,418,785 Total population 328 $ 7,966,846 ______________ * Amounts in this table are rounded to the nearest dollar. We examined the separation lump-sum pay for eight non-Bargaining Unit R06 employees who received over $100,000 in lump-sum payments, totaling $1,473,288. Of the eight employees, CSP-COR overpaid one -10- California State Prison, Corcoran Payroll Process Review employee by $163 and underpaid two by approximately $958 because the payroll transactions unit staff miscalculated the leave balance paid. Of the payments to 141 Bargaining Unit R06 employees for separation lump-sum pay, totaling $4,074,773, we randomly selected a statistical sample (as described in the Appendix) of 60 employees who were paid separation lump-sum pay, totaling $1,332,011. Of the 60 statistically-determined samples, CSP-COR overpaid 34 employees by approximately $74,721 and underpaid four employees by approximately $1,310. The known improper payments resulted in a net total of $73,411. As we used a statistical sampling method to select the employees whose payments for separation lump-sum pay were examined, we projected the amount of likely overpayments to be $153,859 and likely underpayments to be $2,697. Therefore, the known and likely improper payments totaled a net approximate $224,573, consisting of $228,580 in overpayments and $4,007 in underpayments. The following table summarizes the results of our statistical sampling: Known improper payments, net $ 73,411 Divide by: Sample 1,332,011 Error rate for projection (differences due to rounding) 5.51% Population that was statistically sampled 4,074,773 Multiply by: Error rate for projection 5.51% Known and likely improper payments, net (differences due to rounding) 224,573 Less: Known improper payments, net 73,411 Likely improper payments, net $ 151,162 _________________ * Amounts in this table are rounded to the nearest dollar. The known overpayments and underpayments were made because payroll transactions unit staff members miscalculated the leave balance paid. CSP-COR also lacked adequate supervisory review to ensure accurate processing of separation lump-sum pay. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. Recommendation We recommend that CSP-COR:  Establish adequate controls to ensure accurate calculation and payment of separation lump-sum pay;  Conduct a review of payments for separation lump-sum pay made during the past three years to ensure that the payments were accurate and complied with collective bargaining agreements and state law; and -11- California State Prison, Corcoran Payroll Process Review  Recover overpayments made to separated employees in accordance with GC section 19838 and State Administrative Manual section 8776.6, and properly compensate those employees who were underpaid. FINDING 5— CSP-COR lacked adequate controls over the processing of overtime pay. We identified $161,982 in overpayments and $350,693 in underpayments Inadequate for overtime pay, consisting of $1,684 in overpayments and $533 in controls over underpayments based on actual transactions reviewed (“known”); and overtime pay, $160,298 in overpayments and $350,160 in underpayments based on the resulting in results of statistical sampling (“likely”). If not mitigated, these control improper deficiencies leave CSP-COR at risk of additional improper payments for payments overtime pay. Collective bargaining agreements and state laws and policies contain specific clauses regarding overtime pay. Payroll records show that CSP-COR processed 39,083 overtime pay transactions, totaling $60,214,231, between November 2014 and October 2017, as follows: Overtime Payment Type By Group Unit Amount Work Week Group 2 – Paid for less than 300 hours (statistically sampled) 39,070 $ 60,057,352 Work Week Group 2 – Paid for more than 300 hours (items examined 100%) 12 155,439 Work Week Group E (items examined 100%) 1 1,440 Total population 39,083 $ 60,214,231 _______________ * Amounts in this table are rounded to the nearest dollar. We examined all 12 overtime pay transactions for Work Week Group (WWG) 2 employees who were paid for more than 300 hours, totaling $155,439. Our examination of the transactions found no exceptions. We also examined one overtime payment to a WWG E employee. CSP-COR improperly paid approximately $1,440, for an employee who was not eligible to receive overtime pay. The California Department of Human Resources’ (CalHR) California State Civil Service Pay Scales, section 10 states, in part: Work Week Group “E” includes classes that are exempted from coverage under the FLSA because of the “white-collar” (administrative, executive, professional) exemptions. To be eligible for this exemption a position must meet both the “salary basis” and the “duties” test. Exempt (WWG E) employees are paid on a “salaried” basis and the regular rate of pay is full compensation for all hours worked to perform assigned duties. However, these employees shall receive up to 8 hours holiday credit when authorized to work on a holiday. Work Week Group E employees shall not receive any form of additional compensation, whether formal or informal, unless otherwise provided by the provisions of this work week group. . . . Of the 39,070 overtime pay transactions, totaling $60,057,352, for WWG 2 employees who were paid for less than 300 hours of overtime per transaction, we randomly selected a statistical sample (as described in the -12- California State Prison, Corcoran Payroll Process Review Appendix) of 60 transactions, totaling $91,278. Of the 60 transactions, CSP-COR overpaid three by approximately $244, and underpaid four by approximately $533. As we used a statistical sampling method to select the overtime pay transactions examined, we projected the amount of likely overpayments to be $160,298, and likely underpayments to be $350,160. Accordingly, the known and likely net approximate underpayment totaled $190,151. The following table summarizes the results of our statistical sampling: Known underpayments, net $ 289 Divide by: Sample 9 1,278 Error rate for projection (differences due to rounding) 0.32% Population that was statistically sampled 6 0,057,352 Multiply by: Error rate for projection 0.32% Known and likely underpayments, net (differences due to rounding) 190,151 Less: Known underpayments, net 289 Likely underpayments, net $ 189,862 _______________ * Amounts in this table are rounded to the nearest dollar. The known improper payments were made because payroll transactions unit staff members miscalculated overtime hours. Improper payments also occurred because CDCR’s Business Information System incorrectly rounded down fractional overtime hours. CSP-COR also lacked adequate supervisory review to ensure accurate processing of overtime pay. GC sections 13402 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Recommendation We recommend that CSP-COR:  Conduct a review of payments made for overtime pay during the past three years to ensure that the payments complied with collective bargaining agreements and state laws and policies; and  Recover overpayments made to employees through an agreed-upon collection method in accordance with GC section 19838, and properly compensate those employees who were underpaid. We further recommend that, to prevent improper payments for overtime pay from recurring, CSP-COR:  Establish adequate internal controls to ensure that payments are accurate and comply with collective bargaining agreements and state laws and policies; and  Provide adequate oversight to ensure that payroll transactions unit staff process only valid and authorized payments that comply with collective bargaining agreements and state laws and policies. -13- California State Prison, Corcoran Payroll Process Review FINDING 6— CSP-COR lacked adequate controls over the processing of holiday credit transactions. We identified a net approximate $1,176 in improper holiday Inadequate credits. If not mitigated, this control deficiency leaves CSP-COR at risk of controls over additional improper holiday credits. holiday credits, resulting in GC section 19853 specifies the compensation that an eligible employee is improper credits entitled to receive when required to work on a qualifying holiday. Collective bargaining agreements between the State and various Bargaining Units include similar provisions regarding holiday compensation for represented employees. We examined 36 holiday credit transactions, totaling approximately $18,040. These transactions were selected because the employees received unusual credits in a given month. Of the 36 transactions, 13 involved improper credits, costing an estimated net total of $1,176. Specifically, six were over-credited 38 hours, totaling $1,729, and seven were under- credited by 22 hours, totaling $553. The improper holiday credit transactions occurred because the payroll transaction unit staff members miscalculated holiday credit hours. CSP-COR also lacked adequate supervisory review to ensure accurate processing of holiday credits. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. Recommendation We recommend that CSP-COR:  Conduct a review of holiday credits granted during the past three years to ensure that credits complied with collective bargaining agreements and state law;  Correct any improper holiday credits in the state leave accounting system; and  Establish adequate controls to ensure that holiday credits granted are valid and comply with collective bargaining agreements and state law. -14- California State Prison, Corcoran Payroll Process Review Appendix— Sampling Methodology November 1, 2014, through October 31, 2017 We used attributes sampling for test of compliance. The following table outlines our sampling application for review areas that included errors: Results Sample Projected to Review Type of Population Population Sampling Selection Confidence Tolerable Expected Sample Intended Finding Area Test (Unit) (Dollar) Unit Method Level Error Rate Error (Rate)¹ Size Population Number Separation Compliance 141 $ 4 ,074,773 Employee Computer- 95% 5% 0 (0%) 60 Yes 4 lump-sum pay generated simple random Overtime pay Compliance 39,070 $ 6 0,057,352 Payment Computer- 95% 5% 0 (0%) 60 Yes 5 transactions generated simple random ________________ 1Pursuant to the AICPA’s Audit Guide: Audit Sampling (May 1, 2017 edition, pages 131-133), the expected error is the expected number of errors planned for in the sample. It is derived by multiplying the expected error rate by the sample size. The expected number of errors in the sampling tables on pages 135-136 was rounded upward, e.g., 0.2 errors becomes 1 error. -A1- California State Prison, Corcoran Payroll Process Review Attachment— California State Prison, Corcoran’s Response to Draft Review Report State Controller’s Office Division of Audits Post Office Box 942850 Sacramento, CA 94250 http://www.sco.ca.gov S18-PAR-9005