California Medical Facility - Payroll Process Review

CALIFORNIA MEDICAL FACILITY Review Report PAYROLL PROCESS REVIEW November 1, 2014, through October 31, 2017 BETTY T. YEE California State Controller July 2019 BETTY T. YEE California State Controller July 26, 2019 Jared D. Lozano, Warden California Medical Facility 1600 California Drive Vacaville, CA 95687 Dear Mr. Lozano: The State Controller’s Office reviewed the California Medical Facility (CMF) payroll process and transactions for the period of November 1, 2014, through October 31, 2017. CMF management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. Our review found material weaknesses in internal control over the CMF payroll process. These weaknesses contributed to CMF employees’ excessive vacation, annual leave, and compensating time off balances, improper and questioned payments, and long-outstanding unrecovered salary advances, costing the State an estimated net total of $5,531,871. If you have any questions, please contact Andrew Finlayson, Chief, State Agency Audits Bureau, by telephone at (916) 324-6310. Sincerely, Original signed by JIM L. SPANO, CPA Chief, Division of Audits JLS/as Jared D. Lozano, Warden -2- July 26, 2019 cc: Dan Cueva, Chief Deputy Warden California Medical Facility Jenny Ruth, Institutional Personnel Officer California Medical Facility Ralph Diaz, Secretary California Department of Corrections and Rehabilitation Kathleen Allison, Undersecretary of Operations California Department of Corrections and Rehabilitation Kenneth Pogue, Undersecretary of Administration & Offender Services California Department of Corrections and Rehabilitation Katherine Minnich, Deputy Director of Human Resources California Department of Corrections and Rehabilitation Mai Lee Vang, External Audits Manager Office of Audits and Court Compliance California Department of Corrections and Rehabilitation Mark Rodriguez, Chief Administrative Services Division California Department of Human Resources Marissa Revelino, Chief Personnel and Payroll Services Division State Controller’s Office California Medical Facility Payroll Process Review Contents Review Report Summary ............................................................................................................................ 1 Background ........................................................................................................................ 1 Objectives, Scope, and Methodology ............................................................................... 2 Conclusion .......................................................................................................................... 3 Views of Responsible Officials .......................................................................................... 4 Restricted Use .................................................................................................................... 4 Schedule—Summary of Findings ......................................................................................... 5 Findings and Recommendations ........................................................................................... 6 Appendix—Sampling Methodology ..................................................................................... A1 Attachment—California Medical Facility’s Response to Draft Review Report California Medical Facility Payroll Process Review Review Report Summary The State Controller’s Office (SCO) reviewed the California Medical Facility (CMF) payroll process and transactions for the period of November 1, 2014, through October 31, 2017. CMF management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. Our limited review identified material weaknesses in internal control over the CMF payroll process that leave CMF at risk of additional improper payments if not mitigated. We found that CMF has a combination of deficiencies in internal control over its payroll process such that there is a reasonable possibility that a material misstatement in financial information or noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. Specifically, CMF lacked adequate segregation of duties and compensating controls over its processing of payroll transactions. In addition, CMF inappropriately granted 16 employees keying access to the State’s payroll system, leaving payroll data at risk of misuse, abuse, and unauthorized use. These deficiencies have a pervasive effect on the CMF payroll process, and impair the effectiveness of other controls by rendering their design ineffective or by keeping them from operating effectively. We also found that CMF lacked sufficient controls over the processing of specific payroll-related transactions to ensure that CMF complied with collective bargaining agreements and state laws, and that only valid and authorized payments were processed. As quantified in the Schedule, these deficiencies contributed to CMF employees’ excessive vacation, annual leave, and compensating time off (CTO) balances; improper and questioned payments for separation lump-sum pay, overtime pay, holiday pay, and leave buy-back; improper holiday credit transactions; and long- outstanding unrecovered salary advances, costing the State an estimated net total of $5,531,871. Background In 1979, the State of California adopted collective bargaining for state employees. This created a significant workload increase for the SCO’s Personnel and Payroll Services Division (PPSD), as PPSD was the State’s centralized payroll processing center for all payroll-related transactions. PPSD decentralized the processing of payroll, allowing state agencies and departments to process their own payroll-related transactions. Periodic reviews of the decentralized payroll processing at state agencies and departments ceased due to the budget constraints in the late 1980s. In 2013, the California State Legislature reinstated these payroll reviews to gain assurance that state agencies and departments maintain adequate internal control over payroll, provide proper oversight over their decentralized payroll processing, and comply with various state laws and regulations regarding payroll processing and related transactions. -1- California Medical Facility Payroll Process Review Review Authority Authority for this review is provided by California Government Code (GC) section 12476, which states, “The Controller may audit the uniform state pay roll system, the State Pay Roll Revolving Fund, and related records of state agencies within the uniform state pay roll system, in such manner as the Controller may determine.” In addition, GC section 12410 stipulates that “The Controller shall superintend the fiscal concerns of the state. The Controller shall audit all claims against the state, and may audit the disbursement of any state money, for correctness, legality, and for sufficient provisions of law for payment.” Objectives, Scope, We performed this review to determine whether CMF: and Methodology  Processed payroll and payroll-related disbursements accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures;  Established adequate internal control over payroll to meet the following control objectives: o Payroll and payroll-related transactions are properly approved and certified by authorized personnel; o Only valid and authorized payroll and payroll-related transactions are processed; o Payroll and payroll-related transactions are accurate and properly recorded; o Payroll systems, records, and files are adequately safeguarded; o State laws, regulations, policies, and procedures are complied with regarding payroll and payroll-related transactions;  Complied with existing controls as part of the ongoing management and monitoring of payroll and payroll-related expenditures;  Maintained accurate records of leave balances; and  Administered and recorded salary advances properly and in accordance with state laws, regulations, policies, and procedures. We reviewed the CMF payroll process and transactions for the period of November 1, 2014, through October 31, 2017. To achieve our objectives, we:  Reviewed state and CMF policies and procedures related to the payroll process to understand CMF’s methodology for processing various payroll and payroll-related transactions;  Interviewed CMF payroll personnel to understand CMF’s methodology for processing various payroll and payroll-related transactions, determine their level of knowledge and ability relating to payroll transaction processing, and gain an understanding of existing internal control over the payroll process and systems; -2- California Medical Facility Payroll Process Review  Selected transactions recorded in the State’s payroll database using statistical sampling as outlined in the Appendix, random selection, and targeted selection based on risk factors and other criteria for review;  Analyzed and tested transactions recorded in the State’s payroll database, and reviewed relevant files and records to determine the accuracy of payroll and payroll-related payments, accuracy of leave transactions, propriety of review and approval of transactions, adequacy of internal control over the payroll process and systems, and compliance with collective bargaining agreements and state laws, regulations, policies, and procedures (errors found in statistically- determined samples were projected to the intended population); and  Reviewed salary advances to determine whether CMF administered and recorded them in accordance with state laws, regulations, policies, and procedures. Conclusion Based on the results of our review, we found that CMF:  Did not process payroll and payroll-related disbursements accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures (see Findings 4 through 8);  Lacked adequate internal control over payroll and payroll-related transactions (see Findings 1 through 8);  Did not comply with existing controls as part of the ongoing management and monitoring of payroll and payroll-related expenditures (see Findings 2 and 3);  Did not maintain accurate records of leave balances (see Findings 4 and 6); and  Did not administer salary advances in accordance with state laws, regulations, policies, and procedures (see Finding 7). As quantified in the Schedule and described in the Findings and Recommendations section of this review report, these material weaknesses1 in internal control over the payroll process contributed to CMF employees’ excessive vacation, annual leave, and CTO balances, improper and questioned payments, improper holiday credits, and long- outstanding unrecovered salary advances, costing the State an estimated net total of $5,531,871. 1 An evaluation of an entity’s payroll process may identify deficiencies in its internal control over the process. A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, misstatements in financial information, impairments of effectiveness or efficiency of operations, or noncompliance with provisions of laws, regulations, or contracts on a timely basis. Control deficiencies, either individually or in combination with other control deficiencies, may be evaluated as significant deficiencies or material weaknesses. A material weakness is a deficiency, or a combination of deficiencies, in internal control such that there is a reasonable possibility that a material misstatement in financial information, impairment of effectiveness or efficiency of operations, or noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. A significant deficiency is a deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness, yet important enough to merit attention from those charged with governance. -3- California Medical Facility Payroll Process Review Views of We issued a draft review report on June 11, 2019. Jared D. Lozano, Warden, responded by letter dated June 19, 2019 (Attachment), indicating Responsible CMF’s agreement with the findings, and stating that CMF has taken steps Officials since the review period to correct the deficiencies noted in the findings. We will follow up during the next payroll review to verify that these corrective actions were adequate and appropriate. CMF also provided additional information regarding inappropriate keying access granted to managers, as described in Finding 2. Our comments to CMF’s response to Finding 2 are included in the Findings and Recommendations section. Restricted Use This report is solely for the information and use of CMF and the SCO; it is not intended to be and should not be used by anyone other than these specified parties. This restriction is not intended to limit distribution of this report, which is a matter of public record, and is available on the SCO website at www.sco.ca.gov. Original signed by JIM L. SPANO, CPA Chief, Division of Audits July 26, 2019 -4- California Medical Facility Payroll Process Review Schedule— Summary of Findings November 1, 2014, through October 31, 2017 Issues as a Total Dollar Number of Dollar Amount Number of Percentage of Dollar Dollar Amount of Finding Selections Method of Selection of Selections Selections Selections Amount of Amount of Known and Number Issues Reviewed Selection Unit Reviewed with Issues Reviewed * Known Issues Likely Issues Likely Issues 1 Inadequate segregation of duties and N/A N/A N/A N/A N/A N/A N/A N/A N/A compensating controls over payroll transactions 2 Inappropriate keying access to the 4 0 Targeted Employee $ - 1 6 40% $ - $ - $ - State’s payroll system 3 Inadequate controls over vacation, 227 Targeted Employee 4,357,091 226 100% 4,351,329 N/A 4,351,329 annual leave, and CTO balances, resulting in liability for excessive balances 4 Inadequate controls over separation lump-sum pay, resulting in improper and questioned payments Overpayments 5 1 Statistical Employee 2,060,327 3 6 71% 135,221 163,272 2 98,493 (7k employees) Underpayments -- Same selections above -- 7 14% (8,693) (10,497) (19,190) (7k employees) Overpayments 5 1 Statistical Employee 926,846 3 6% 1,836 2,530 4,366 (non-7k employees) Underpayments -- Same selections above -- 7 14% (9,476) (13,061) (22,537) (non-7k employees) Questioned payments -- Same selections above -- 1 2% 2,858 3,940 6,798 (non-7k employees) 5 Inadequate controls over overtime pay, resulting in improper and questioned payments Overpayments 6 0 Statistical Payment 5 8% 323 148,474 1 48,797 transaction Underpayments -- Same selections above -- 5 8% (1,891) (868,318) ( 870,209) Questioned payments -- Same selections above -- 3 5% 3,434 1,577,036 1,580,470 Overpayments 9 Targeted Payment 1 11% 5,126 N/A 5,126 transaction Underpayments 1 0 Random Payment 1 10% (1,126) N/A (1,126) selection transaction 6 Inadequate controls over holiday compensation, resulting in overpayments and improper credits Over-credits 1 8 Targeted Holiday credit 4,356 5 28% 2,601 N/A 2,601 transaction Overpayments 6 0 Statistical Payment 2 0,581 1 2% 246 3 9,872 4 0,118 transaction 7 Inadequate controls over salary 1 2 Targeted Salary advance 19,287 2 17% 4,265 N/A 4,265 advances, resulting in failure to transaction recover outstanding amounts 8 Inadequate controls over leave buy-back, resulting in improper payments Overpayments 5 1 Statistical Payment 133,662 8 16% 1,344 1 ,850 3,194 transaction Underpayments -- Same selections above -- 3 6% (263) (361) ( 624) Total $ 7 ,522,150 $ 4 ,487,134 $ 1 ,044,737 $ 5 ,531,871 ______________ *All percentages are rounded to the nearest full percentage point. -5- California Medical Facility Payroll Process Review Findings and Recommendations FINDING 1— CMF lacked segregation of duties within its payroll transactions unit adequate to ensure that only valid and authorized payroll transactions were Inadequate processed. CMF also failed to implement other controls to compensate for segregation of this risk. duties and compensating GC sections 13400 through 13407 require state agencies to establish and controls over maintain internal controls, including proper segregation of duties and an payroll effective system of internal review. Adequate segregation of duties transactions reduces the likelihood that fraud or error will remain undetected by providing for separate processing by different individuals at various stages of a transaction and for independent reviews of the work performed. Our review found that CMF payroll transactions unit staff performed conflicting duties. Staff members performed multiple steps in processing payroll transactions, including entering data into the State’s payroll system; auditing employee timesheets; reconciling payroll, including reconciling system output to source documentation; reporting payroll exceptions; and processing adjustments. For example, staff members keyed in regular and overtime pay and reconciled the master payroll, overtime, and other supplemental warrants. In addition, as described in Finding 2, two managers had keying access to the State’s payroll system while responsible for approving payroll transactions that had been entered into the system. CMF failed to demonstrate that it implemented compensating controls to mitigate the risks associated with such a deficiency. We found no indication that these functions were subjected to periodic supervisory review. The lack of adequate segregation of duties and compensating controls has a pervasive effect on the CMF payroll process, and impairs the effectiveness of other controls by rendering their design ineffective or by keeping them from operating effectively. These control deficiencies, in combination with other deficiencies discussed in Findings 2 through 8, represent a material weakness in internal control over the payroll process such that there is a reasonable possibility that a material misstatement in financial information or noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. Good internal control practices require that the following functional duties be performed by different work units, or at minimum, by different employees within the same unit:  Recording transactions – This duty refers to the record-keeping function, which is accomplished by entering data into a computer system.  Authorization to execute – This duty belongs to individuals with authority and responsibility to initiate and execute transactions.  Periodic review and reconciliation of actual payments to recorded amounts – This duty refers to making comparisons of information at regular intervals and taking action to resolve differences. -6- California Medical Facility Payroll Process Review Recommendation We recommend that CMF:  Separate conflicting payroll function duties to the greatest extent possible. Adequate segregation of duties will provide a stronger system of internal control whereby the functions of each employee are subject to the review of another. If it is not possible to segregate payroll functions fully and appropriately, CMF should implement compensating controls. For example, if the payroll transactions unit staff member responsible for recordkeeping also performs a reconciliation process, then the supervisor should perform and document a detailed review of the reconciliation to provide additional control over the assignment of conflicting functions. Compensating controls may also include dual authorization requirements and documented reviews of payroll system input and output; and  Develop formal procedures for performing and documenting compensating controls. FINDING 2— CMF lacked adequate controls to ensure that only appropriate staff had keying access to the State’s payroll system. CMF inappropriately allowed Inappropriate 16 employees keying access to the State’s payroll system. If not mitigated, keying access to the this control deficiency leaves payroll data at risk of misuse, abuse, and State’s payroll unauthorized use. system The SCO maintains the State’s payroll system. The system is decentralized, thereby allowing employees of state agencies to access it. PPSD has established a Decentralized Security Program Manual that all state agencies are required to follow in order to access the payroll system. The program’s objectives are to secure and protect the confidentiality and integrity of payroll data against misuse, abuse, and unauthorized use. We reviewed the records of 40 CMF employees who had keying access to the State’s payroll system at various times between November 2014 and October 2017. Of the 40 employees, 16 had inappropriate keying access to the State’s payroll system. Specifically, CMF did not immediately remove or modify the keying access of 14 employees after their separation from state service, transfer to another agency or unit, or change in classification. Of the 14 employees, we also noted the following:  One employee continued to have keying access for 142 days after that employee transferred to another state agency;  Two managers had keying access to the State’s payroll system. The managers’ duties included approving certain payroll transactions prior to input into the system. The managers also reviewed the work of their staff. To properly segregate duties, employees charged with approving transactions should not be able to enter the transactions that they approve; and  One employee had keying access while appointed to the Associate Personnel Analyst classification—a position that is not eligible to have keying access to the system without the required justification. -7- California Medical Facility Payroll Process Review Also, two additional employees had keying access to the payroll system while appointed to Associate Government Program Analyst or Staff Services Analyst classifications. These positions were ineligible to have keying access to the system without the required justification; CMF did not submit the justification letters for these employees. The Decentralized Security Program Manual states, in part: The PPSD system contains sensitive and confidential information. Access is restricted to persons with an authorized, legal, and legitimate business requirement to complete their duties. . . . Currently, PIMS, HIST, KEYM, PIP, LAS, MPC and/or ACAS applications are restricted to Personnel Specialists or Personnel Technician classifications because their need is by definition a function of their specific job duties and any change in those duties requires a reevaluation of the need for access. If the employee’s duties change, such that the need for access no longer exists, the access privilege MUST be removed or deleted immediately by a request submitted by the department/campus. . . . A request to grant access to an individual in a classification other than in the Personnel Specialist/Payroll Technician series to access PIMS, HIST, KEYM, PIP, LAS, MPC and/or ACAS requires a written justification from the Authorizing Manager. The justification must describe the individual's specific job duties requiring the need to access system information (i.e., PIMS = Employment History, HIST=Payroll History, LAS=Leave Accounting System, etc.) as well as level of access to that application, in order to perform their regular daily duties. Manager classifications will be granted inquiry access only. . . . To prevent unauthorized use by a transferred, terminated or resigned employee's user ID, the Security Monitor must IMMEDIATELY submit all pages of the PSD125A to delete the user’s system access. Using an old user ID increases the chances of a security breach which is a serious security violation. Sharing a user ID is strictly prohibited and a serious violation. Recommendation We recommend that CMF:  Update keying access to the State’s payroll system immediately after employees leave CMF, transfer to another unit, or change classifications; and  Periodically review access to the payroll system to verify that access complies with the Decentralized Security Program Manual. CMF’s Response . . . . In July 2017, as part of the Department of State Hospitals “Lift and Shift”, Decentralized Security contacts were transitioned (from “HG”) to “MF” using the SCO two character agency identification process. Prior to that transition, it appears that SCO granted temporary keying access for a Staff Services Manager II (SSM II); however, justification -8- California Medical Facility Payroll Process Review for such access was not provided to CMF as part of the transition. By late 2017, the SSM II’s access was changed to “Inquiry Only.” See Attachment for CMF’s full response. SCO Comment Based on additional information provided by CMF, we modified our statements in Findings 1 and 2 to clarify that two managers had inappropriate keying access. CMF also referred to SCO granting temporary keying access for an SSM II without providing CMF with the justification letter for such access. Although the SCO processes requests for access, CMF is responsible for authorizing access and compliance with requirements, including providing a written justification and reporting any variances from established procedures to PPSD. We appreciate CMF’s willingness to take action to correct the deficiencies noted in this finding. We will follow up during the next payroll review to verify that these corrective actions were adequate and appropriate. FINDING 3— CMF failed to implement controls to ensure that it adheres to the Inadequate requirements of collective bargaining agreements and state regulations to controls over limit the accumulation of vacation, annual leave, and CTO credits. This vacation, annual deficiency resulted in liability for excessive leave balances with a value of at least $4,351,329 as of October 31, 2017. We expect the liability to leave, and CTO increase if CMF does not take action to address the excessive vacation, balances, resulting annual leave, and CTO balances. in liability for excessive balances Vacation and Annual Leave Collective bargaining agreements and state regulations limit the amount of vacation and annual leave that most state employees may accumulate to no more than 80 days (640 hours). The limit on leave balances helps state agencies manage leave balances and control the State’s liability for accrued leave credits. State agencies may allow employees to carry a higher leave balance only under limited circumstances. For example, an employee may not be able to reduce accrued vacation or annual leave hours below the limit due to business needs. When an employee’s leave accumulation exceeds or is projected to exceed the limit, state agencies should work with the employee to develop a written plan to reduce leave balances below the applicable limit. Our review of CMF’s leave accounting records determined that CMF had 219 employees who exceeded the limit set by collective bargaining agreements and state regulations at October 31, 2017. For example, one employee had an accumulated balance of 2,704 hours of annual leave, or 2,064 hours beyond the 640-hour limit. Collectively, the 219 employees accumulated 94,134 hours of excess vacation and annual leave, with a value of at least $4,221,765 as of October 31, 2017. This estimated liability -9- California Medical Facility Payroll Process Review does not adjust for salary rate increases and additional leave credits.2 Accordingly, we expect that the amount needed to pay for this liability will be higher. For example, a CMF employee separated from state service with 4,199 hours in leave credits, including 2,251 hours in annual leave. After adjusting for additional leave credits, the employee should have been paid for 4,982 hours, or 19% more. When we discussed this issue with personnel office staff members, they indicated that CMF did not have plans in place during the review period to address excessive vacation and annual leave balances in accordance with collective bargaining agreements and state regulations. CMF also could not demonstrate that it had complied with collective bargaining agreements and state regulations when allowing these employees to maintain excess vacation or annual leave balances. Compensating Time Off Collective bargaining agreements allow employees to accrue up to 240 CTO hours. State agencies should compensate employees in cash for all CTO hours in excess of 240 hours. Leave accounting records showed that seven CMF employees exceeded the 240-hour limit for CTO by 2,424 hours, with an estimated value of at least $129,564 at October 31, 2017. One employee had 1,375 CTO hours, or 1,135 hours beyond the 240-hour limit. This estimated liability does not adjust for salary rate increases.3 Accordingly, we expect that the amount needed to pay for this liability will be higher than it would have been if the excess CTO balances had been paid for at the time the employees earned them, as required. If CMF does not take action to reduce the excessive leave balances, the liability for accrued vacation, annual leave, and CTO will likely increase because most employees will receive salary increases or use other non- compensable leave credits instead of vacation, annual leave, or CTO, increasing their vacation or annual leave balances. The state agency responsible for paying these leave balances may face a cash flow problem if a significant number of employees with excessive vacation, annual leave, or CTO balances separate from state service. Normally, state agencies are not budgeted to make these separation lump-sum payments. However, the State’s current practice dictates that the state agency that last employed an employee pays for that employee’s lump-sum separation payment, regardless of where the employee accrued the leave balance. Recommendation We recommend that CMF:  Implement controls, including existing policies and procedures, to ensure that its employees’ vacation, annual leave, and CTO balances 2 Most state employees receive pay rate increases every year pursuant to state laws and/or collective bargaining agreements until they reach the top of their pay scale, or promote into a higher-paying position. In addition, when an employee’s accumulated leave balances upon separation are calculated for lump-sum pay, the employee is credited with additional leave credits equal to the amount that the employee would have earned had the employee taken time off and not separated from state service. 3 See footnote 2. -10- California Medical Facility Payroll Process Review are maintained within levels allowed by collective bargaining agreements and state regulations;  Conduct ongoing monitoring of controls to ensure that they are implemented and operating effectively;  Compensate employees in cash for CTO hours in excess of the 240- hour limit; and  Participate in leave buy-back programs if the State offers such programs and funds are available. CMF lacked adequate controls over the processing of employee separation FINDING 4— lump-sum pay. We identified $302,859 in overpayments, $41,727 in Inadequate underpayments, and $6,798 in questioned payments for separation lump- controls over sum pay, consisting of $137,057 in overpayments, $18,169 in separation lump- underpayments, and $2,858 in questioned payments based on actual sum pay, resulting transactions reviewed (“known”); and $165,802 in overpayments, $23,558 in improper and in underpayments, and $3,940 in questioned payments based on the results questioned of statistical sampling (“likely”). If not mitigated, these control payments deficiencies leave CMF at risk of additional improper separation lump- sum payments. GC section 19839 allows lump-sum payment for accrued eligible leave credits when an employee separates from state employment. Collective bargaining agreements include similar provisions regarding separation lump-sum pay. Payroll records show that CMF processed payments for separation lump- sum pay, totaling $6,752,514, for 253 employees between November 2014 and October 2017, as follows: Separation Lump-sum Pay Group Unit Amount Section 7(k) employees (statistically sampled) 113 $ 4,548,053 Non-section 7(k) employees (statistically sampled) 140 2,204,461 Total population 253 $ 6,752,514 _____________ * Amounts in this table are rounded to the nearest dollar. Of the payments for separation lump-sum pay, totaling $4,548,053, for 113 employees who were covered by the provisions of Section 7(k) of the Fair Labor Standards Act (FLSA), we randomly selected a statistical sample (as described in the Appendix) of 51 employees who were paid separation lump-sum pay, totaling $2,060,327. Our review of lump-sum payments made to these 51 employees showed that CMF overpaid 36 of them by approximately $135,221 and underpaid seven of them by approximately $8,693. These payments resulted in a net total improper payments of $126,528. As we used a statistical sampling method to select the employees whose payments for separation lump-sum pay were examined, we projected the amount of likely overpayments to be $163,272 and likely underpayments to be $10,497. Therefore, the known and likely improper payments totaled a net approximate $279,303, consisting of $298,493 in overpayments and $19,190 in underpayments. -11- California Medical Facility Payroll Process Review The following table summarizes the results of our statistical sampling: Known improper payments, net $ 126,528 Divide by: Sample 2,060,327 Error rate for projection (differences due to rounding) 6.14% Population that was statistically sampled 4,548,053 Multiply by: Error rate for projection 6.14% Known and likely improper payments, net (differences due to rounding) 279,303 Less: Known improper payments, net 126,528 Likely improper payments, net $ 152,775 _____________ * Amounts in this table are rounded to the nearest dollar. Of the remaining payments for separation lump-sum pay, totaling $2,204,461, for 140 employees who were not covered by the provisions of Section 7(k) of the FLSA, we randomly selected a statistical sample (as described in the Appendix) of 51 employees who were paid separation lump-sum pay, totaling $926,846. Our review of lump-sum payments made to these 51 employees showed that CMF overpaid three of them by approximately $1,836 and underpaid seven of them by approximately $9,476. Our review of lump-sum payments also showed a lack of supporting documentation for a payment, totaling $2,858, made to one employee. Without the required documentation, there is no record of calculation and approval of payments for separation lump-sum pay. Therefore, we could not determine the validity, accuracy, and propriety of the payment made to the employee. As a result, we questioned this payment. The known improper and questioned payments totaled a net of $4,782. As we used a statistical sampling method to select the employees whose payments for separation lump-sum pay were examined, we projected the amount of likely improper and questioned payments to be a net of approximately $6,591, consisting of $2,530 in overpayments, $13,061 in underpayments, and $3,940 in questioned payments. Therefore, the known and likely improper and questioned payments totaled a net of approximately $11,373, consisting of $4,366 in overpayments, $22,537 in underpayments, and $6,798 in questioned payments. The following table summarizes the results of our statistical sampling: Known improper and questioned payments, net $ (4,782) Divide by: Sample 926,846 Error rate for projection (differences due to rounding) (0.52%) Population that was statistically sampled 2,204,461 Multiply by: Error rate for projection (0.52%) Known and likely improper and questioned payments, net (differences due to rounding) (11,373) Less: Known improper and questioned payments, net (4,782) Likely improper and questioned payments, net $ (6,591) _____________ * Amounts in this table are rounded to the nearest dollar. -12- California Medical Facility Payroll Process Review The known improper payments were made because payroll transactions unit staff members miscalculated leave balances paid, failed to include the leave credits that employees were credited with when their leave balances were calculated for lump-sum pay, and incorrectly entered the leave hours for lump-sum payment into the State’s payroll system. CMF also lacked adequate supervisory review to ensure accurate processing of separation lump-sum pay. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. Recommendation We recommend that CMF:  Establish adequate controls to ensure accurate calculation and payment of separation lump-sum pay;  Conduct a review of payments for separation lump-sum pay made during the past three years to ensure that the payments were accurate and in compliance with collective bargaining agreements and state law;  Recover overpayments made to separated employees in accordance with GC section 19838 and State Administrative Manual (SAM) section 8776.6, and properly compensate those employees who were underpaid; and  Maintain documentation supporting the processing of payments for separation lump-sum pay. CMF lacked adequate controls over the processing of overtime pay. We FINDING 5— identified $153,923 in overpayments, $871,335 in underpayments, and Inadequate $1,580,470 in questioned payments for overtime pay, consisting of $5,449 controls over in overpayments, $3,017 in underpayments, and $3,434 in questioned overtime pay, payments based on actual transactions reviewed (“known”); and $148,474 resulting in in overpayments, $868,318 in underpayments, and $1,577,036 in improper and questioned payments based on the results of statistical sampling (“likely”). questioned If not mitigated, the control deficiencies leave CMF at risk of additional payments improper payments for overtime pay. Collective bargaining agreements, and state laws and policies, contain specific clauses regarding overtime pay. Payroll records show that CMF processed 25,029 overtime pay transactions, totaling $38,065,108, between November 2014 and October 2017, as follows: Overtime Payment Type by Group Unit Amount Work Week Group 2 – Paid for less than 300 hours (statistically sampled) 24,721 $ 37,444,519 Work Week Group 2 – Paid for at least 300 hours (items examined 100%) 9 128,711 Work Week Group E (randomly selected items for examination) 299 491,878 Total population 25,029 $ 38,065,108 _____________ * Amounts in this table are rounded to the nearest dollar. -13- California Medical Facility Payroll Process Review Of the 24,721 overtime pay transactions, totaling $37,444,519, for Work Week Group (WWG) 2 employees who were paid for less than 300 hours of overtime per transaction, we randomly selected a statistical sample (as described in the Appendix) of 60 transactions, totaling $81,352. Of the 60 transactions, CMF overpaid five by approximately $323 and underpaid five by approximately $1,891. We also questioned three transactions, totaling $3,434, because CMF could not provide the employees’ timesheets to support that the payments were valid and authorized. Without the timesheets, there is no record of hours worked and supervisory review and approval. Therefore, we could not determine the validity and propriety of payments for these three overtime pay transactions. The known improper and questioned payments totaled a net approximate $1,866. As we used a statistical sampling method to select the overtime pay transactions examined, we projected the amount of likely overpayments to be $148,474 and likely underpayments to be $868,318. We could also estimate that there may have been additional missing timesheets associated with overtime pay, totaling $1,577,036. As timesheets are required documents to authorize pay, we would also question these payments for overtime pay. The likely improper and questioned payments totaled a net approximate $857,192. Therefore, the known and likely improper and questioned payments totaled a net approximate $859,058, consisting of $148,797 in overpayments, $870,209 in underpayments, and $1,580,470 in questioned payments. The following table summarizes the results of our statistical sampling: Known improper and questioned payments, net $ 1,866 Divide by: Sample 81,352 Error rate for projection (differences due to rounding) 2.29% Population that was statistically sampled 37,444,519 Multiply by: Error rate for projection 2.29% Known and likely improper and questioned payments, net (differences due to rounding) 859,058 Less: Known improper and questioned payments, net 1,866 Likely improper and questioned payments, net $ 857,192 _____________ * Amounts in this table are rounded to the nearest dollar. The known improper payments were made because the payroll transactions unit staff members miscalculated overtime hours worked and paid for overtime hours worked at the straight-time rate instead of the one- and-a-half-time rate, or vice-versa. CMF also lacked adequate supervisory review to ensure accurate processing of overtime pay. CMF could not explain why the system allowed such errors. We also examined all nine overtime pay transactions, totaling $128,711, for WWG 2 employees who were paid for at least 300 hours of overtime. Of the nine transactions, CMF overpaid one transaction by approximately $5,126 because the overtime hours worked had been miscalculated. Of the 299 overtime pay transactions, totaling $491,878, for WWG E employees, we randomly selected 10 transactions, totaling $16,187. Of the 10 transactions, CMF underpaid one transaction by $1,126 because the -14- California Medical Facility Payroll Process Review overtime hours were paid for at the straight-time rate instead of the one- and-a-half-time rate. GC sections 13402 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Recommendation We recommend that CMF:  Conduct a review of payments for overtime pay made during the past three years to ensure that the payments complied with collective bargaining agreements and state laws and policies; and  Recover overpayments made to employees through an agreed-upon collection method in accordance with GC section 19838, and properly compensate those employees who were underpaid. We further recommend that, to prevent improper payments for overtime pay from recurring, CMF:  Establish adequate internal controls to ensure that payments are accurate and comply with collective bargaining agreements and state laws and policies; and  Provide adequate oversight to ensure that payroll transactions unit staff process only valid and authorized payments that comply with collective bargaining agreements and state laws and policies. CMF lacked adequate controls over the processing of holiday credit FINDING 6— transactions. We identified $40,118 in overpayments for holiday Inadequate compensation, consisting of $246 based on actual transactions reviewed controls over (“known”) and $39,872 based on the results of statistical sampling holiday (“likely”). We also identified approximately $2,601 in improper holiday compensation, credits. If not mitigated, this control deficiency leaves CMF at risk of resulting in additional improper holiday credits. overpayments and improper credits GC section 19853 specifies the compensation that an eligible employee is entitled to receive when required to work on a qualifying holiday. Collective bargaining agreements between the State and Bargaining Units 6, 15, 17, 18, and 20 include similar provisions regarding holiday compensation for represented employees. Holiday Pay Leave accounting records showed that CMF processed 10,700 holiday pay transactions, totaling $3,356,374 between November 2014 and October 2017. Of the 10,700 holiday pay transactions, we randomly selected a statistical sample (as described in the Appendix) of 60 transactions, totaling $20,581. -15- California Medical Facility Payroll Process Review Our review of these 60 transactions showed that CMF overpaid one of them by $246. A payroll transactions unit staff member incorrectly granted the employee holiday pay at premium rate instead of regular rate. As we used a statistical sampling method to select the transactions examined, we projected the amount of likely overpayments to be $39,872. Therefore, the known and likely overpayments totaled $40,118. The following table summarizes the results of our statistical sampling: Known overpayment $ 246 Divide by: Sample 20,581 Error rate for projection (differences due to rounding) 1.20% Population that was statistically sampled 3,356,374 Multiply by: Error rate for projection 1.20% Known and likely overpayments (differences due to rounding) 40,118 Less: Known overpayments 246 Likely overpayments $ 39,872 _____________ * Amounts in this table are rounded to the nearest dollar. Holiday Credit We also examined 18 holiday credit transactions, with an estimated value of $4,356. These transactions were selected due to unusual credits. Of the 18 transactions, five involved improper credits, costing an estimated $2,601. The improper holiday credit transactions were made because the payroll transactions unit staff members granted holiday credits to employees during pay periods with no holidays. They also granted holiday credit hours rather than reducing holiday credit balances by the number of credits used. CMF also lacked adequate supervisory review to ensure accurate processing of holiday credits. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. Recommendation We recommend that CMF:  Conduct a review of holiday credits granted during the past three years to ensure that credits complied with collective bargaining agreements and state law;  Correct any improper holiday credits in the State’s leave accounting system; and  Establish adequate controls to ensure that holiday credits granted are valid and comply with collective bargaining agreements and state law. -16- California Medical Facility Payroll Process Review CMF lacked adequate controls over salary advances to ensure that FINDING 7— advances were recovered in accordance with state law and policies. Two Inadequate salary advances, totaling $4,265, remained outstanding as of October 31, controls over 2017, as a result of CMF’s noncompliance with the State’s collection salary advances, policies and procedures. The oldest unrecovered salary advance was resulting in failure outstanding for over one year. This control deficiency leaves CMF at risk to recover of further failures to collect salary advances if not mitigated. outstanding amounts At October 31, 2017, CMF’s accounting records showed 35 outstanding salary advances totaling $108,377, including 12 balances totaling $19,287 that had been outstanding for more than 120 days. Generally, the prospect of collection diminishes as an account ages. When an agency is unable to collect after three years, the possibility of collection is remote. GC section 19838 and SAM sections 8776 and 8776.7 describe the State’s collection policies and procedures, which require CMF to collect salary advances in a timely manner and maintain proper records of collection efforts. In our review of the 12 salary advances that were over 120 days old, we noted that CMF did not comply with the State’s collection policies and procedures for two of them, totaling $4,265. CMF did not send collection notices promptly, and in some cases did not send the notices at all. These two salary advances remained outstanding during our review. One salary advance has been outstanding for over one year. The lack of adequate controls over salary advances reduces the likelihood of collection, increases the amount of resources expended on collection efforts, and negatively impacts cash flow. Recommendation We recommend that CMF ensure that it recovers salary advances in a timely manner pursuant to GC section 19838 and SAM sections 8776 and 8776.7. FINDING 8— CMF lacked adequate controls over the processing of payments for leave Inadequate buy-back. We identified $3,194 in overpayments and $624 in underpayments for leave buy-back, consisting of $1,344 in overpayments controls over leave and $263 in underpayments based on actual transactions reviewed buy-back, resulting (“known”); and $1,850 in overpayments and $361 in underpayments based in improper on the results of statistical sampling (“likely”). If not mitigated, the control payments deficiencies leave CMF at risk of additional improper leave buy-back payments. A leave-buy back occurs when an employee receives payment at the regular salary rate in exchange for accrued vacation, annual leave, personal leave, personal holiday, and/or holiday credits. Collective bargaining agreements between the State and Collective Bargaining Units 12 and 13 allow for the annual cash-out of a certain number of hours of accumulated vacation and annual leave if funds are available. Title 2, California Code of Regulations, section 599.744 also provides that the California Department of Human Resources may authorize a leave buy- -17- California Medical Facility Payroll Process Review back program for employees excluded from collective bargaining. The California Department of Human Resources authorized leave buy-backs for excluded employees in fiscal year (FY) 2014-15, FY 2015-16, and FY 2016-17. It also provided the State’s policies and procedures regarding cash-out of vacation and annual leave. Payroll records showed that CMF processed 200 leave buy-back transactions, totaling $317,689, between November 2014 and October 2017. Of the 200 transactions, we randomly selected a statistical sample (as described in the Appendix) of 51, totaling $133,662. Our review of 51 transactions determined that CMF overpaid eight transactions by $1,344 underpaid three transactions by $263. These payments resulted in net total overpayments of $1,081. As we used a statistical sampling method to select the leave buy-back transactions examined, we projected the amount of likely net overpayments to be $1,489, consisting of $1,850 in overpayments and $361 in underpayments. Accordingly, the known and likely overpayments totaled a net approximate $2,570, consisting of $3,194 in overpayments and $624 in underpayments. The following table summarizes the results of our statistical sampling: Known improper payments, net $ 1,081 Divide by: Sample 133,662 Error rate for projection (differences due to rounding) 0.81% Population that was statistically sampled 317,689 Multiply by: Error rate for projection 0.81% Known and likely improper payments, net (differences due to rounding) 2,570 Less: Known improper payments, net 1,081 Likely improper payments, net $ 1,489 _____________ * Amounts in this table are rounded to the nearest dollar. The known improper payments were made because payroll transactions unit staff members miscalculated the salary rate used to pay for the leave buy-back. CMF also lacked adequate supervisory review to ensure accurate processing of payments for leave buy-back. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. Recommendation We recommend that CMF:  Provide adequate supervisory review to ensure that payroll transactions unit staff members process leave buy-back payments accurately; and  Recover overpayments made to separated employees in accordance with GC section 19838 and SAM section 8776.6, and properly compensate those employees who were underpaid. -18- California Medical Facility Payroll Process Review Appendix— Sampling Methodology November 1, 2014, through October 31, 2017 We used attributes sampling for test of compliance. The following table outlines our sampling application for review areas that included errors: Results Expected Projected to Review Type Population Population Sampling Sample Selection Confidence Tolerable Error Sample Intended Finding Area of Test (Unit) (Dollar) Unit Method Level Error Rate (Rate) ¹ Size Population Number Separation lump-sum pay Compliance 1 13 $ 4 ,548,053 Employee Computer-generated 95% 5% 0 (0%) 51 Yes 4 (employees under simple random Section 7k of the FLSA) Separation lump-sum pay Compliance 1 40 $ 2 ,204,461 Employee Computer-generated 95% 5% 0 (0%) 51 Yes 4 (employees not under simple random Section 7k of the FLSA) Overtime pay (WWG 2 Compliance 2 4,721 $ 3 7,444,519 Payment Computer-generated 95% 5% 0 (0%) 60 Yes 5 employees who were transactions simple random paid for less than 300 hours) Holiday pay Compliance 1 0,700 $ 3 ,356,374 Payment Computer-generated 95% 5% 0 (0%) 60 Yes 6 transactions simple random Leave buy-back Compliance 2 00 $ 3 17,689 Payment Computer-generated 95% 5% 0 (0%) 51 Yes 8 transactions simple random ______________ 1 Pursuant to the AICPA’s Audit Guide: Audit Sampling (May 1, 2017 edition), pages 131-133, the expected error is the expected number of errors planned for in the sample. It is derived by multiplying the expected error rate by the sample size. The expected number of errors in the sampling tables on pages 135-136 was rounded upward, e.g., 0.2 errors becomes 1 error. -A1- California Medical Facility Payroll Process Review Attachment— California Medical Facility’s Response to Draft Review Report State Controller’s Office Division of Audits Post Office Box 942850 Sacramento, CA 94250 http://www.sco.ca.gov S18-PAR-9003