California State Teachers' Retirement System - Payroll Audit

CALIFORNIA STATE TEACHERS’ RETIREMENT SYSTEM Audit Report PAYROLL AUDIT August 1, 2015, through July 31, 2018 BETTY T. YEE California State Controller July 2019 BETTY T. YEE California State Controller July 31, 2019 Jack Ehnes, Chief Executive Officer California State Teachers’ Retirement System 100 Waterfront Place West Sacramento, CA 95605 Dear Mr. Ehnes: The State Controller’s Office audited the California State Teachers’ Retirement System (CalSTRS) payroll process and transactions for the period of August 1, 2015, through July 31, 2018. Our audit found material weaknesses in internal control over the CalSTRS payroll process. These weaknesses contributed to CalSTRS employees’ excessive vacation and annual leave balances and improper payments, costing the State an estimated net total of $3,259,061. If you have any questions, please contact Andrew Finlayson, Chief, State Agency Audits Bureau, by telephone at (916) 324-6310. Sincerely, Original signed by JIM L. SPANO, CPA Chief, Division of Audits JLS/as cc: Sharon Hendricks, Chair Teachers’ Retirement Board California State Teachers’ Retirement System Harry M. Keiley, Vice Chair Teachers’ Retirement Board California State Teachers’ Retirement System Keely Bosler, Ex-Officio Member Teachers’ Retirement Board California State Teachers’ Retirement System Jack Ehnes, Chief Executive Officer -2- July 31, 2019 Dana Dillon, Member Teachers’ Retirement Board California State Teachers’ Retirement System Joy Higa, Member Teachers’ Retirement Board California State Teachers’ Retirement System Fiona Ma, Ex-Officio Member Teachers’ Retirement Board California State Teachers’ Retirement System William Prezant, Member Teachers’ Retirement Board California State Teachers’ Retirement System Tony Thurmond, Ex-Officio Member Teachers’ Retirement Board California State Teachers’ Retirement System Nora E. Vargas, Member Teachers’ Retirement Board California State Teachers’ Retirement System Karen Yamamoto, Member Teachers’ Retirement Board California State Teachers’ Retirement System Betty T. Yee, Ex-Officio Member Teachers’ Retirement Board California State Teachers’ Retirement System Cassandra Lichnock, Chief Operating Officer California State Teachers’ Retirement System Lisa Blatnick, Chief of Administrative Services California State Teachers’ Retirement System Larry Jensen, Chief Auditor California State Teachers’ Retirement System Melissa Norcia, Director Human Resources Division California State Teachers’ Retirement System Kristel Turko, Assistant Director Human Resources Division California State Teachers’ Retirement System Cheryl Cervantes Dietz, Internal Audit Manager California State Teachers’ Retirement System Leslie Carter-Padilla, Payroll and Benefits Manager Human Resources Division California State Teachers’ Retirement System Mark Rodriguez, Chief Administrative Services Division California Department of Human Resources Marissa Revelino, Chief Personnel and Payroll Services Division State Controller’s Office California State Teachers’ Retirement System Payroll Audit Contents Audit Report Summary ............................................................................................................................ 1 Background ........................................................................................................................ 1 Objectives, Scope, and Methodology ............................................................................... 2 Conclusion .......................................................................................................................... 3 Follow-up on Prior Audit Finding ................................................................................... 4 Views of Responsible Officials .......................................................................................... 4 Restricted Use .................................................................................................................... 4 Schedule—Summary of Findings ......................................................................................... 5 Findings and Recommendations ........................................................................................... 6 Appendix—Audit Sampling Methodology ........................................................................... A1 Attachment—California State Teachers’ Retirement System’s Response to Draft Audit Report California State Teachers’ Retirement System Payroll Audit Audit Report Summary The State Controller’s Office (SCO) audited the California State Teachers’ Retirement System’s (CalSTRS) payroll process and transactions for the period of August 1, 2015, through July 31, 2018. CalSTRS management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. We completed our audit fieldwork on May 30, 2019. Our audit determined that CalSTRS:  Did not maintain adequate and effective internal controls over its payroll process. We found the following deficiencies in internal control over the payroll process that we consider to be material weaknesses: o Lack of adequate segregation of duties and compensating controls over the processing of payroll transactions (see Finding 1); o Inappropriate access to the State’s payroll system (see Finding 2); o Lack of sufficient controls over the processing of specific payroll- related transactions to ensure that CalSTRS complied with collective bargaining agreements and state laws, and that only valid and authorized payments were processed (see Findings 3 and 4);  Did not process payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. We found the following instances of noncompliance with the requirements of collective bargaining agreements and state laws, regulations, policies, and procedures: o Failure to adhere to the requirements of collective bargaining agreements and state regulations to limit the accumulation of vacation and annual leave credits, resulting in liability for excessive leave balances with a value of at least $3,252,726 as of July 31, 2018 (see Finding 3); o Improper payments made for overtime pay, costing an estimated net total of $6,335 (see Finding 4); and  Administered salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. Background In 1979, the State of California adopted collective bargaining for state employees. This created a significant workload increase for the SCO’s Personnel and Payroll Services Division (PPSD), as PPSD was the State’s centralized payroll processing center for all payroll related-transactions. PPSD decentralized the processing of payroll, allowing state agencies and departments to process their own payroll-related transactions. Periodic audits of the decentralized payroll processing at state agencies and departments ceased due to the budget constraints in the late 1980s. -1- California State Teachers’ Retirement System Payroll Audit In 2013, the California State Legislature reinstated these payroll audits to gain assurance that state agencies and departments maintain adequate internal control over the payroll function, provide proper oversight of their decentralized payroll processing, and comply with various state laws and regulations regarding payroll processing and related transactions. Audit Authority Authority for this audit is provided by California Government Code (GC) section 12476, which states, “The Controller may audit the uniform state pay roll system, the State Pay Roll Revolving Fund, and related records of state agencies within the uniform state pay roll system, in such manner as the Controller may determine.” In addition, GC section 12410 stipulates that “The Controller shall superintend the fiscal concerns of the state. The Controller shall audit all claims against the state, and may audit the disbursement of any state money, for correctness, legality, and for sufficient provisions of law for payment.” Objectives, Scope, We performed this audit to determine whether CalSTRS: and Methodology  Maintained adequate and effective internal controls over its payroll process;  Processed payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures; and  Administered salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. The audit covered the period from August 1, 2015, through July 31, 2018. To achieve our audit objectives, we:  Reviewed State and CalSTRS policies and procedures related to the payroll process to understand CalSTRS’s methodology for processing various payroll and payroll-related transactions;  Interviewed the CalSTRS payroll personnel to understand CalSTRS’s methodology for processing various payroll and payroll-related transactions, determine their level of knowledge and ability relating to payroll transaction processing, and gain an understanding of existing internal control over the payroll process and systems;  Selected transactions recorded in the State’s payroll database using statistical sampling, as outlined in the Appendix, and targeted selection based on risk factors and other relevant criteria;  Analyzed and tested the selected transactions, and reviewed relevant files and records to determine the accuracy of payroll and payroll- related payments, accuracy of leave transactions, adequacy and effectiveness of internal control over the payroll process, and compliance with collective bargaining agreements and state laws, regulations, policies, and procedures; and -2- California State Teachers’ Retirement System Payroll Audit  Reviewed salary advances to determine whether CalSTRS administered and recorded them in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Conclusion Our audit determined that CalSTRS:  Did not maintain adequate and effective internal controls over its payroll process1. We found the following deficiencies in internal control over the payroll process that we consider to be material weaknesses: o Lack of adequate segregation of duties and compensating controls over the processing of payroll transactions (see Finding 1); o Inappropriate access to the State’s payroll system (see Finding 2); o Lack of sufficient controls over the processing of specific payroll- related transactions to ensure that CalSTRS complied with collective bargaining agreements and state laws, and that only valid and authorized payments were processed (see Findings 3 and 4);  Did not process payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. We found the following instances of noncompliance with the requirements 1 In planning and performing our audit of compliance, we considered CalSTRS’s internal control over compliance with collective bargaining agreements and state laws, regulations, policies, and procedures to determine the auditing procedures that were appropriate under the circumstances for the purpose of providing a conclusion on compliance, and to test and report on internal control over compliance. Our consideration of internal control over compliance was for the limited purpose described in the first paragraph of this footnote and was not designed to identify all deficiencies in internal control over compliance that might be material weaknesses or significant deficiencies. However, as discussed this section, we identified certain deficiencies in internal control over compliance that we consider to be material weaknesses. A deficiency in internal control over compliance exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance with provisions of laws, regulations, or contracts on a timely basis. Control deficiencies, either individually or in combination with other control deficiencies, may be evaluated as significant deficiencies or material weaknesses. A material weakness in internal control over compliance is a deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected on a timely basis. A significant deficiency is a deficiency, or a combination of deficiencies, in internal control over compliance with provisions of laws, regulations, or contracts that is less severe than a material weakness, yet important enough to merit attention from those charged with governance. -3- California State Teachers’ Retirement System Payroll Audit of collective bargaining agreements and state laws, regulations, policies, and procedures: o Failure to adhere to the requirements of collective bargaining agreements and state regulations to limit the accumulation of vacation and annual leave credits, resulting in liability for excessive leave balances with a value of at least $3,252,726 as of July 31, 2018 (see Finding 3); o Improper payments made for overtime pay, costing an estimated net total of $6,335 (see Finding 4); and  Administered salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. Follow-up on The California State Personnel Board issued a report on August 31, 2018 for its Compliance Review of CalSTRS from July 1, 2016, through Prior Audit March 31, 2017. The California State Personnel Board report included a Finding finding regarding the lack of written leave reduction plans. Based on the work performed during our current audit, we noted a similar finding (see Finding 3). Views of We issued a draft audit report on June 14, 2019. Kristel Turko, Assistant Director, Human Resources Division, responded by letter dated June 26, Responsible 2019 (Attachment), disagreeing with the findings; however, CalSTRS Officials indicated that it will take steps to improve its internal controls. Our comments on CalSTRS’ responses to Findings 1 through 4 are included in the Findings and Recommendations section. Restricted Use This audit report is solely for the information and use of CalSTRS and the SCO; it is not intended to be and should not be used by anyone other than these specified parties. This restriction is not intended to limit distribution of this audit report, which is a matter of public record and is available on the SCO website at www.sco.ca.gov. Original signed by JIM L. SPANO, CPA Chief, Division of Audits July 31, 2019 -4- California State Teachers’ Retirement System Payroll Audit Schedule — Summary of Findings August 1, 2015, through July 31, 2018 Issues as a Total Dollar Number of Dollar Amount Number of Percentage of Dollar Dollar Amount of Finding Selections Method of Selection of Selections Selections with Selections Amount of Amount of Known and Number Issues Audited Selection Unit Audited Issues Audited * Known Issues Likely Issues Likely Issues 1 Inadequate segregation of duties N/A N/A N/A N/A N/A N/A N/A N/A N/A and compensating controls over payroll transactions 2 Inappropriate access to the 4 4 Targeted Employee N/A 6 14% N/A N/A N/A State's payroll system 3 Inadequate controls over vacation 108 Targeted Employee $ 3 ,252,726 108 100% $ 3,252,726 N/A $ 3,252,726 and annual leave balances, resulting in liability for excessive balances 4 Inadequate controls over overtime pay, resulting in improper payments Overpayments 1 05 Statistical Payment 684,099 7 7% 9 26 $ 1 5,180 16,106 transaction Underpayments --Same selections above-- 7 7% ( 562) ( 9,209) (9,771) Total $ 3 ,936,825 $ 3,253,090 $ 5 ,971 $ 3,259,061 __________________ *All percentages are rounded to the nearest full percentage point. -5- California State Teachers’ Retirement System Payroll Audit Findings and Recommendations FINDING 1— CalSTRS lacked adequate segregation of duties within its payroll transactions unit to ensure that only valid and authorized payroll Inadequate transactions were processed. CalSTRS also failed to implement other segregation of controls to compensate for this risk. duties and compensating GC sections 13400 through 13407 require state agencies to establish and controls over maintain internal controls, including proper segregation of duties and an payroll effective system of internal review. Adequate segregation of duties transactions reduces the likelihood that fraud or error will remain undetected by providing for separate processing by different individuals at various stages of a transaction and for independent reviews of the work performed. Our audit found that CalSTRS payroll transactions unit staff performed conflicting duties. Staff members performed multiple steps in processing payroll transactions, including entering data into the State’s payroll system; auditing employee timesheets; reconciling payroll, including reconciling system output to source documentation; reporting payroll exceptions; and processing adjustments. For example, the same staff members who keyed in regular and overtime pay also reconciled the master payroll, overtime, and other supplemental warrants. In addition, as described in Finding 2, a payroll transactions manager had keying access to the payroll system while responsible for approving payroll transactions entered in the system. CalSTRS failed to demonstrate that it had implemented compensating controls to mitigate the risks associated with such a deficiency. We found no indication that these functions were subjected to periodic supervisory review. The lack of adequate segregation of duties and compensating controls has a pervasive effect on the CalSTRS payroll process, and impairs the effectiveness of other controls by rendering their design ineffective or by keeping them from operating effectively. These control deficiencies, in combination with other deficiencies discussed in Findings 2 through 4, represent a material weakness in internal control over the payroll process such that there is a reasonable possibility that material noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. Good internal control practices require that the following functional duties be performed by different work units, or at minimum, by different employees within the same unit:  Recording transactions – This duty refers to the record-keeping function, which is accomplished by entering data into a computer system.  Authorization to execute – This duty belongs to individuals with authority and responsibility to initiate and execute transactions.  Periodic review and reconciliation of actual payments to recorded amounts – This duty refers to making comparisons of information at regular intervals and taking action to resolve differences. -6- California State Teachers’ Retirement System Payroll Audit Recommendation We recommend that CalSTRS:  Separate conflicting payroll function duties to the greatest extent possible. Adequate segregation of duties will provide a stronger system of internal control whereby the functions of each employee are subject to the review of another. If it is not possible to segregate payroll functions fully and appropriately, CalSTRS should implement compensating controls. For example, if the payroll transactions unit staff member responsible for recordkeeping also performs a reconciliation process, then the supervisor should perform and document a detailed review of the reconciliation to provide additional control over the assignment of conflicting functions. Compensating controls may also include dual authorization requirements and documented reviews of payroll system input and output; and  Develop formal procedures for performing and documenting compensating controls. CalSTRS’ Response CalSTRS believes we have established adequate segregation of duties therefore supporting compliance with GC 13400 – 13407. The processing of positive and overtime pay is a shared process beginning with the employee submission of time, followed by review and approval by the supervisor, review by divisional attendance coordinator, review by human resources personnel specialists and managers, and final oversight by financial and budget management. Each participant in this process receives training and guidance on the review and approval of time. Human Resource staff, specifically the Personnel Specialists responsible for payroll transactions, have attended the State Controller’s Office training for processing all payroll transactions, including entering data into the State’s payroll system, auditing employee timesheets and reconciling payroll. Each Personnel Specialist is aware of the requirements to apply State laws, rules, regulations and bargaining unit provisions during the course of their work. However, as recommended, CalSTRS will take steps to incorporate an additional level of review, to improve compensating controls over the processing of payroll transactions, as well as update procedures for performing these periodic reviews. SCO Comment Our finding remains unchanged. We appreciate CalSTRS’ response regarding the existence of controls over the processing of regular and overtime pay. However, our finding described CalSTRS’ lack of adequate segregation of duties and compensating controls related to the processing of payroll transactions by Personnel Specialists. As discussed in the finding, Personnel Specialists performed conflicting duties, including entering data into the State’s payroll system, auditing employee timesheets, reconciling payroll, reporting exceptions, and processing adjustments. We found no indication -7- California State Teachers’ Retirement System Payroll Audit that managers conduct periodic review of transactions entered by Personnel Specialists. CalSTRS also indicated that it will take steps to correct the deficiencies noted. We will follow up during the next payroll audit to verify that these corrective actions were adequate and appropriate. CalSTRS lacked adequate controls to ensure that only appropriate staff FINDING 2— had access to the State’s payroll system. CalSTRS inappropriately allowed Inappropriate six employees access to the State’s payroll system. If not mitigated, this access to the control deficiency leaves payroll data at risk of misuse, abuse, and State’s payroll unauthorized use. system The SCO maintains the State’s payroll system. The system is decentralized, thereby allowing employees of state agencies to access it. PPSD has established a Decentralized Security Program Manual that all state agencies are required to follow in order to access the payroll system. The program’s objectives are to secure and protect the confidentiality and integrity of payroll data against misuse, abuse, and unauthorized use. We examined the records of 44 CalSTRS employees who had access to the State’s payroll system at various times between August 2015 and July 2018. Of the 44 employees, CalSTRS did not immediately remove or modify the access for six employees after the employees’ separation from state service, transfer to another agency, or change in classification. For example, a Personnel Specialist separated from state service on January 20, 2017; CalSTRS did not request to remove the employee’s keying access until June 26, 2017, 157 days later. In addition, a payroll transactions manager had keying access to the payroll system. The employee had been provided keying access before becoming a manager, and CalSTRS did not remove or modify the employee’s access after the employee became a manager. Although CalSTRS provided a written justification and requested that keying access be provided to the manager, SCO’s PPSD did not approve the request because manager classifications are not eligible to have keying access. The Decentralized Security Program Manual states, in part: The PPSD system contains sensitive and confidential information. Access is restricted to persons with an authorized, legal, and legitimate business requirement to complete their duties. . . . Currently, PIMS, HIST, KEYM, PIP, LAS, MPC and/or ACAS applications are restricted to Personnel Specialists or Personnel Technician classifications because their need is by definition a function of their specific job duties and any change in those duties requires a reevaluation of the need for access. If the employee’s duties change, such that the need for access no longer exists, the access privilege MUST be removed or deleted immediately by a request submitted by the department/campus. . . . A request to grant access to an individual in a classification other than in the Personnel Specialist/Payroll Technician series to access PIMS, -8- California State Teachers’ Retirement System Payroll Audit HIST, KEYM, PIP, LAS, MPC and/or ACAS requires a written justification from the Authorizing Manager. The justification must describe the individual's specific job duties requiring the need to access system information (i.e., PIMS = Employment History, HIST=Payroll History, LAS=Leave Accounting System, etc.) as well as level of access to that application, in order to perform their regular daily duties. Manager classifications will be granted inquiry access only. To prevent unauthorized use by a transferred, terminated or resigned employee's user ID, the Security Monitor must IMMEDIATELY submit all pages of the PSD125A to delete the user’s system access. Using an old user ID increases the chances of a security breach which is a serious security violation. Sharing a user ID is strictly prohibited and a serious violation. Recommendation We recommend that CalSTRS:  Update access to the State’s payroll system immediately after employees leave CalSTRS, transfer to another unit, or change classifications; and  Periodically review access to the system to verify that access complies with the Decentralized Security Program Manual. CalSTRS’ Response The finding states, “Of the 44 employees, CalSTRS did not immediately remove or modify the keying access for six employees after the employees’ separation from state service, transfer to another agency, or change in classification.” We partially disagree with this finding. Four of the six employees identified in the audit did not have keying access. The four employees had inquiry access only and remained employees in CalSTRS Human Resources. The access was appropriate and justified for each role. One of the six employees had become a manager and while access was not immediately justified, a request was submitted to the SCO to justify the continued need. One employee did not have their access removed in a timely manner upon their separation from state service, and procedures have been updated to ensure this oversight does not reoccur. Specifically, we have revised procedures requiring all access updates be processed within 15 days upon transfer to another unit, change in classification, or separation from CalSTRS Human Resources or CalSTRS. Additionally, CalSTRS Human Resources has requested [that] CalSTRS Information Security Office incorporate reviews of SCO access on a quarterly basis to ensure we are aligned with the SCO [Decentralized Secutiry Program Manual] guidelines. SCO Comment Our finding remains unchanged. The draft audit report, which was issued to CalSTRS on June 14, 2019, specified “keying access” for only two employees. The draft audit report refers to inappropriate access for six employees, which includes the four employees with inquiry access. -9- California State Teachers’ Retirement System Payroll Audit We disagree with CalSTRS’ assertion that this access to the State’s payroll system was appropriate or justified. Employment history records show that the four employees who had inquiry access left CalSTRS either permanently or temporarily during the audit period. The Decentralized Security Program Manual requires that this access be removed when employees leave their positions. In addition, CalSTRS asserted that a request was submitted to PPSD to justify the payroll transactions manager’s continued keying access to the payroll system. As stated in the finding, PPSD did not approve the request because manager classifications are not eligible to have keying access, pursuant to the Decentralized Security Program Manual. CalSTRS failed to implement controls to ensure that it adheres to the FINDING 3— requirements of collective bargaining agreements and state regulations to Inadequate limit the accumulation of vacation and annual leave credits. This controls over deficiency resulted in liability for excessive leave balances with a value of vacation and at least $3,252,726 as of July 31, 2018. We expect the liability to increase annual leave if CalSTRS does not take action to address the excessive vacation and balances, resulting annual leave balances. in liability for excessive balances Collective bargaining agreements and state regulations limit the amount of vacation and annual leave that most state employees may accumulate to no more than 80 days (640 hours). The limit on leave balances helps state agencies manage leave balances and control the State’s liability for accrued leave credits. State agencies may allow employees to carry a higher leave balance only under limited circumstances. For example, an employee may not be able to reduce accrued vacation or annual leave hours below the limit due to business needs. When an employee’s leave accumulation exceeds or is projected to exceed the limit, state agencies should work with the employee to develop a written plan for reducing leave balances below the applicable limit. Our examination of CalSTRS’ leave accounting records determined that CalSTRS had 1,152 employees with unused vacation or annual leave credits at July 31, 2018. Of those employees, 108 exceeded the limit set by collective bargaining agreements and state regulations. For example, one employee had an accumulated balance of 2,298 hours in annual leave, or 1,658 hours beyond the 640-hour limit. Collectively, the 108 employees accumulated 35,471 hours of excess vacation and annual leave, with a value of at least $3,252,726 as of July 31, 2018. This estimated liability does not adjust for salary rate increases and additional leave credits.2 Accordingly, we expect that the amount needed to pay for this liability will be higher. For example, a CalSTRS employee separated from state service with 1,619 hours in leave credits, including 1,387 hours in vacation leave. After adjusting for additional leave credits, the employee was paid for 1,869 hours, or 15% more. 2 Most state employees receive pay rate increases every year pursuant to state laws and/or collective bargaining agreements until they reach the top of their pay scale, or promote into a higher-paying position. In addition, when an employee’s accumulated leave balances upon separation are calculated for lump-sum pay, the employee is credited with additional leave credits equal to the amount that the employee would have earned had the employee taken time off and not separated from state service. -10- California State Teachers’ Retirement System Payroll Audit We further examined the records of the 108 employees to determine their compliance with collective bargaining agreements and state regulations. CalSTRS could not demonstrate that it had complied with collective bargaining agreements and state regulations when allowing these employees to maintain excess vacation or annual leave balances. In addition, 17 of the 108 employees did not have plans in place during the audit period to reduce leave balances below the limit. If CalSTRS does not take action to reduce the excessive leave balances, the liability for accrued vacation and annual leave will likely increase because most employees will receive salary increases or use other non- compensable leave credits instead of vacation or annual leave, increasing their vacation or annual leave balances. The state agency responsible for paying these leave balances may face a cash flow problem if a significant number of employees with excessive vacation or annual leave balances separate from state service. Normally, state agencies are not budgeted to make these separation lump-sum payments. However, the State’s current practice dictates that the state agency that last employed an employee pays for that employee’s lump-sum separation payment, regardless of where the employee accrued the leave balance. Recommendation We recommend that CalSTRS:  Implement controls, including existing policies and procedures, to ensure that its employees’ vacation and annual leave balances are maintained within levels allowed by collective bargaining agreements and state regulations, and that CalSTRS complies with collective bargaining agreements and state regulations when allowing employees to carry vacation and annual leave balances in excess of 640 hours;  Conduct ongoing monitoring of controls to ensure that they are implemented and operating effectively; and  Participate in leave buy-back programs if the State offers such programs and funds are available. CalSTRS’ Response CalSTRS disagrees with this finding and has several controls in place to meet the compliance requirement. CalSTRS has developed and implemented both a policy and process to assist staff and leaders in addressing leave balances in excess of 640 hours. The policy covers the notice to employees identified over annual limits and the requirement to develop and complete a plan to reduce their excess leave. CalSTRS Human Resources notifies impacted employees and their leaders that they are anticipated to exceed 640 hours, monitors the development and completion of plans to address excess leave and further provides regular status updates regarding excess leave to CalSTRS Executive staff. CalSTRS leaders receive the leave activity and balances (LAB) report for all their employees monthly. Additionally, CalSTRS participates in the annual leave buy-back program, as authorized by the California Department of Human Resources (CalHR) and is in compliance with the provisions of CalHR Policy 2124, issued in December 2017. At the time of this audit, CalSTRS acknowledges we had not received 17 excess -11- California State Teachers’ Retirement System Payroll Audit leave reduction plans. However, as of draft of this response, CalSTRS is 100% in compliance. Our efforts to monitor and reduce excessive leave has resulted in a cost reduction of over $60,000.00 from 2018 to 2019. Moreover, of the 108 employees identified in the audit sample, 28 employees (or approximately 26%) transferred to CalSTRS with leave balances in excess of 640 hours. SCO Comment We added more details in the first bullet point of our recommendation to provide CalSTRS additional clarity on controls to be implemented. Our finding remains unchanged. Furthermore, although we were able to verify that CalSTRS had plans in place during the audit period to reduce leave balances below the limit, this control activity was not operating effectively. As stated in the finding and confirmed by CalSTRS in its response, 17 of the 108 employees who exceeded the limit did not have plans in place during the audit period. We appreciate CalSTRS’ response stating that, after the audit period, it attained 100% compliance regarding leave reduction plans for the 108 employees. We will follow up during the next payroll audit to verify that these corrective actions were adequate and appropriate. CalSTRS lacked adequate controls over the processing of overtime pay. FINDING 4— We identified $16,106 in overpayments and $9,771 in underpayments for Inadequate overtime pay, consisting of $926 in overpayments and $562 in controls over underpayments based on actual transactions examined (“known”); and overtime pay, $15,180 in overpayments and $9,209 in underpayments based on the resulting in results of statistical sampling (“likely”). If not mitigated, these control improper deficiencies leave CalSTRS at risk of additional improper payments for payments overtime. Collective bargaining agreements, and state laws and policies, contain specific clauses regarding overtime pay. Payroll records show that CalSTRS processed 1,412 overtime pay transactions, totaling $692,451 between August 2015 and July 2018, as follows: Overtime Payment Type by Group Unit Amount Work Week Group 2 – Paid for less than 100 hours (statistically sampled) 1,409 $ 684,099 Work Week Group 2 – Paid for at least 100 hours (items examined 100%) 2 5,991 Work Week Group E (item examined 100%) 1 2,361 Total population 1,412 $ 692,451 _____________ * Amounts in this table are rounded to the nearest dollar. Of the 1,409 overtime pay transactions, totaling $684,099, for Work Week Group (WWG) 2 employees who were paid for less than 100 hours of overtime per transaction, we randomly selected a statistical sample (as described in the Appendix) of 105 transactions, totaling $39,317. Of the 105 transactions, CalSTRS overpaid seven by approximately $926 and underpaid seven by approximately $562. These payments resulted in net total overpayments of $364. -12- California State Teachers’ Retirement System Payroll Audit As we used a statistical sampling method to select the overtime pay transactions examined, we projected the amount of likely net overpayments to be $5,971, consisting of $15,180 in overpayments and $9,209 in underpayments. Accordingly, the known and likely improper payments totaled a net of approximately $6,335, consisting of $16,106 in overpayments and $9,771 in underpayments. The following table summarizes the results of our statistical sampling: Known improper payments, net $ 364 Divide by: Sample 39,317 Error rate for projection (differences due to rounding) 0.93% Population that was statistically sampled 684,099 Multiply by: Error rate for projection 0.93% Known and likely improper payments, net (differences due to rounding) 6,335 Less: Known improper payments, net 364 Likely improper payments, net $ 5,971 _____________ * Amounts in this table are rounded to the nearest dollar. We also examined the two overtime payment transactions, totaling $5,991, for WWG 2 employees who were paid for at least 100 hours of overtime per transaction; and the one overtime transaction, totaling $2,361, for a WWG E employee. Our examination of the transactions found no exceptions. The known improper payments were made because the payroll transactions unit staff members miscalculated overtime hours worked, and paid for overtime hours worked at the straight-time rate instead of the time-and-a-half rate, or vice-versa. Furthermore, CalSTRS lacked adequate supervisory review to ensure accurate processing of overtime pay. GC sections 13402 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Recommendation We recommend that CalSTRS:  Conduct a review of payments for overtime pay made during the past three years to ensure that the payments complied with collective bargaining agreements and state laws and policies; and  Recover overpayments made to employees through an agreed-upon collection method in accordance with GC section 19838, and properly compensate those employees who were underpaid. We further recommend that, to prevent improper payments for overtime pay from recurring, CalSTRS:  Establish adequate internal controls to ensure that payments are accurate and comply with collective bargaining agreements and state laws and policies; and -13- California State Teachers’ Retirement System Payroll Audit  Provide adequate oversight to ensure that payroll transactions unit staff process only valid and authorized payments that comply with collective bargaining agreements and state laws and policies. CalSTRS’ Response CalSTRS follows all SCO guidelines relating to processing payroll procedures. CalSTRS employees are required to complete and submit a timesheet documenting all time worked during the pay period, including any approved overtime worked, to their manager for review and approval. Each division’s attendance coordinator reviews the timesheets for accuracy prior to submitting to Human Resources. The individual keying errors that resulted in employee overpayments or under payments, did not occur due to inadequate controls. They are a result of human error and lack of automation. CalSTRS provided additional information about two employees identified [as] over or underpaid, because we disagree with the calculations and findings of the SCO Auditors. For the other thirteen employees, CalSTRS has corrected pay for those underpaid, or initiated accounts receivable for those overpaid, in order to recoup the identified net overpayment of $275.00. Also, as recommended, CalSTRS will take steps to incorporate an additional level of review, to improve compensating controls over the processing of payroll transactions, as well as update procedures for performing these periodic reviews. SCO Comment We modified this finding based on additional information, which was provided by CalSTRS after we issued the draft audit report, regarding the calculation of the two employees’ overtime payments. Furthermore, CalSTRS asserts that improper payments did not occur as a result of inadequate controls. We disagree. Our report recommends that CalSTRS properly segregate duties among CalSTRS payroll transactions unit staff members and implement periodic supervisory reviews. Our internal control recommendations would assist CalSTRS in detecting and ultimately preventing errors from occurring. -14- California State Teachers’ Retirement System Payroll Audit Appendix— Audit Sampling Methodology August 1, 2015, through July 31, 2018 We used attributes sampling for tests of compliance. The following table outlines our audit sampling application for the audit area that included errors: Results Expected Projected to Audit Type Population Population Sampling Sample Selection Confidence Tolerable Error Sample Intended Finding Area of Test (Unit) (Dollar) Unit Method Level Error Rate (Rate) ᵃ Size Population Number Overtime pay Compliance 1,409 $ 6 84,099 Payment Computer-generated 90% 5% 2 105 Yes 4 (Work Week Group 2 – transactions simple random (1.50%) Paid for less than 100 hours) __________________ a Pursuant to the AICPA’s Audit Guide: Audit Sampling (May 1, 2017 edition), pages 131-133, the expected error is the expected number of errors planned for in the sample. It is derived by multiplying the expected error rate by the sample size. The expected number of errors in the sampling tables on pages 135-136 was rounded upward, e.g., 0.2 errors becomes 1 error. -A1- California State Teachers’ Retirement System Payroll Audit Attachment— California State Teachers’ Retirement System’s Response to Draft Audit Report State Controller’s Office Division of Audits Post Office Box 942850 Sacramento, CA 94250 http://www.sco.ca.gov S19-PAR-0005