California Substance Abuse Treatment Facility and State Prison - Payroll Audit

CALIFORNIA SUBSTANCE ABUSE TREATMENT FACILITY AND STATE PRISON Audit Report PAYROLL AUDIT February 1, 2015, through January 31, 2018 BETTY T. YEE California State Controller July 2019 BETTY T. YEE California State Controller July 31, 2019 Stuart Sherman, Warden California Substance Abuse Treatment Facility and State Prison P. O. Box 7100 Corcoran, CA 93212 Dear Mr. Sherman: The State Controller’s Office audited California Substance Abuse Treatment Facility and State Prison’s (CSATF-CSP) payroll process and transactions for the period of February 1, 2015, through January 31, 2018. Our audit found material weaknesses in internal control over the CSATF-CSP payroll process. These weaknesses contributed to CSATF-CSP employees’ excessive vacation and annual leave balances, improper and questioned payments and leave accruals, and long-outstanding salary advances, costing the State an estimated net total of $2,689,286. If you have any questions, please contact Andrew Finlayson, Chief, State Agency Audits Bureau, by telephone at (916) 324-6310. Sincerely, Original signed by JIM L. SPANO, CPA Chief, Division of Audits JLS/as Stuart Sherman, Warden -2- July 31, 2019 cc: Theresa Cisneros, Chief Deputy Warden California Substance Abuse Treatment Facility and State Prison Jason Collins, Associate Warden of Business Services California Substance Abuse Treatment Facility and State Prison Laura Sherwood, Correctional Business Manager California Substance Abuse Treatment Facility and State Prison Gladys Miranda, Institutional Personnel Officer California Substance Abuse Treatment Facility and State Prison Ralph Diaz, Secretary California Department of Corrections and Rehabilitation Kathleen Allison, Undersecretary of Operations California Department of Corrections and Rehabilitation Kenneth Pogue, Undersecretary of Administration and Offender Services California Department of Corrections and Rehabilitation Katherine Minnich, Deputy Director of Human Resources California Department of Corrections and Rehabilitation Mai Lee Vang, External Audits Manager Office of Audits and Court Compliance California Department of Corrections and Rehabilitation Mark Rodriguez, Chief Administrative Services Division California Department of Human Resources Marissa Revelino, Chief Personnel and Payroll Services Division State Controller’s Office California Substance Abuse Treatment Facility and State Prison Payroll Audit Contents Audit Report Summary ............................................................................................................................ 1 Background ........................................................................................................................ 2 Objectives, Scope, and Methodology ............................................................................... 2 Conclusion .......................................................................................................................... 3 Follow-up on Prior Audit Finding ................................................................................... 4 Views of Responsible Officials .......................................................................................... 4 Restricted Use .................................................................................................................... 5 Schedule—Summary of Findings ......................................................................................... 6 Findings and Recommendations ........................................................................................... 7 Appendix—Audit Sampling Methodology ........................................................................... A1 Attachment—California Substance Abuse Treatment Facility and State Prison’s Response to Draft Audit Report California Substance Abuse Treatment Facility and State Prison Payroll Audit Audit Report Summary The State Controller’s Office (SCO) audited the California Substance Abuse Treatment Facility and State Prison’s (CSATF-CSP) payroll process and transactions for the period of February 1, 2015, through January 31, 2018. CSATF-CSP management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. We completed our audit fieldwork on May 22, 2019. Our audit determined that CSATF-CSP:  Did not maintain adequate and effective internal controls over its payroll process. We found the following deficiencies in internal control over the payroll process that we consider to be material weaknesses: o Lack of adequate segregation of duties and compensating controls over the processing of payroll transactions (see Finding 1); o Inappropriate keying access to the State’s payroll system (see Finding 2); o Lack of sufficient controls over the processing of specific payroll- related transactions to ensure that CSATF-CSP complied with collective bargaining agreements and state laws, and that only valid and authorized payments were processed (see Findings 3, 4, 5, 7, and 8);  Did not process payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. We found the following instances of noncompliance with the requirements of collective bargaining agreements and state laws, regulations, policies, and procedures: o Failure to adhere to the requirements of collective bargaining agreements and state regulations to limit the accumulation of vacation and annual leave credits, resulting in liability for excessive leave balances with a value of at least $2,320,157 as of January 31, 2018 (see Finding 3); o Improper payments made for employee separation lump-sum pay, overtime pay, and uniform allowance and improper holiday credits, costing an estimated net total of $368,410 (see Findings 4, 5, 7, and 8); and  Did not administer salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures (see Finding 6). -1- California Substance Abuse Treatment Facility and State Prison Payroll Audit Background In 1979, the State of California adopted collective bargaining for state employees. This created a significant workload increase for the SCO’s Personnel and Payroll Services Division (PPSD), as PPSD was the State’s centralized payroll processing center for all payroll related-transactions. PPSD decentralized the processing of payroll, allowing state agencies and departments to process their own payroll-related transactions. Periodic audits of the decentralized payroll processing at state agencies and departments ceased due to the budget constraints in the late 1980s. In 2013, the California State Legislature reinstated these payroll audits to gain assurance that state agencies and departments maintain adequate internal control over the payroll function, provide proper oversight of their decentralized payroll processing, and comply with various state laws and regulations regarding payroll processing and related transactions. Audit Authority Authority for this audit is provided by California Government Code (GC) section 12476, which states, “The Controller may audit the uniform state pay roll system, the State Pay Roll Revolving Fund, and related records of state agencies within the uniform state pay roll system, in such manner as the Controller may determine.” In addition, GC section 12410 stipulates that “The Controller shall superintend the fiscal concerns of the state. The Controller shall audit all claims against the state, and may audit the disbursement of any state money, for correctness, legality, and for sufficient provisions of law for payment.” Objectives, Scope, We performed this audit to determine whether CSATF-CSP: and Methodology  Maintained adequate and effective internal controls over its payroll process;  Processed payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures; and  Administered salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. The audit covered the period from February 1, 2015, through January 31, 2018. To achieve our audit objectives, we:  Reviewed State and CSATF-CSP policies and procedures related to the payroll process to understand CSATF-CSP’s methodology for processing various payroll and payroll-related transactions;  Interviewed the CSATF-CSP payroll personnel to understand CSATF-CSP’s methodology for processing various payroll and payroll-related transactions, determine their level of knowledge and ability relating to payroll transaction processing, and gain an understanding of existing internal control over the payroll process and systems; -2- California Substance Abuse Treatment Facility and State Prison Payroll Audit  Selected transactions recorded in the State’s payroll database using statistical sampling, as outlined in the Appendix, judgmental selection, and targeted selection based on risk factors and other relevant criteria;  Analyzed and tested the selected transactions, and reviewed relevant files and records to determine the accuracy of payroll and payroll- related payments, accuracy of leave transactions, adequacy and effectiveness of internal control over the payroll process, and compliance with collective bargaining agreements and state laws, regulations, policies, and procedures; and  Reviewed salary advances to determine whether CSATF-CSP administered and recorded them in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Conclusion Our audit determined that CSATF-CSP:  Did not maintain adequate and effective internal controls over its payroll process1. We found the following deficiencies in internal control over the payroll process that we consider to be material weaknesses: o Lack of adequate segregation of duties and compensating controls over the processing of payroll transactions (see Finding 1); o Inappropriate keying access to the State’s payroll system (see Finding 2); 1 In planning and performing our audit of compliance, we considered CSATF-CSP’s internal control over compliance with collective bargaining agreements and state laws, regulations, policies, and procedures to determine the auditing procedures that were appropriate under the circumstances for the purpose of providing a conclusion on compliance, and to test and report on internal control over compliance. Our consideration of internal control over compliance was for the limited purpose described in the first paragraph of this footnote and was not designed to identify all deficiencies in internal control over compliance that might be material weaknesses or significant deficiencies. However, as discussed this section, we identified certain deficiencies in internal control over compliance that we consider to be material weaknesses. A deficiency in internal control over compliance exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance with provisions of laws, regulations, or contracts on a timely basis. Control deficiencies, either individually or in combination with other control deficiencies, may be evaluated as significant deficiencies or material weaknesses. A material weakness in internal control over compliance is a deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected on a timely basis. A significant deficiency is a deficiency, or a combination of deficiencies, in internal control over compliance with provisions of laws, regulations, or contracts that is less severe than a material weakness, yet important enough to merit attention from those charged with governance. -3- California Substance Abuse Treatment Facility and State Prison Payroll Audit o Lack of sufficient controls over the processing of specific payroll- related transactions to ensure that CSATF-CSP complied with collective bargaining agreements and state laws, and that only valid and authorized payments were processed (see Findings 3, 4, 5, 7, and 8).  Did not process payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. We found the following instances of noncompliance with the requirements of collective bargaining agreements and state laws, regulations, policies, and procedures: o Failure to adhere to the requirements of collective bargaining agreements and state regulations to limit the accumulation of vacation and annual leave credits, resulting in liability for excessive leave balances with a value of at least $2,320,157 as of January 31, 2018 (see Finding 3); o Improper payments made for employee separation lump-sum pay, overtime pay, and uniform allowance; and improper holiday credits, costing an estimated net total of $368,410 (see Findings 4, 5, 7, and 8); and  Did not administer salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures (see Finding 6). Follow-up on The California Department of Corrections and Rehabilitation Office of Audits and Court Compliance issued a report on January 6, 2016, for its Prior Audit Business Services Review of CSATF-CSP from November 6, 2015, Finding through November 19, 2015. The Business Services Review report included a finding regarding uncollected salary advances. Based on the work performed during our current audit, we noted a similar finding (see Finding 6). Views of We issued a draft audit report on June 17, 2019. Stuart Sherman, Warden, responded by letter dated June 27, 2019 (Attachment), acknowledging the Responsible findings and indicating that CSATF-CSP has taken steps to correct the Officials deficiencies noted. We will follow up during the next payroll audit to verify that these corrective actions were adequate and appropriate. CSATF-CSP also provided additional information regarding Finding 4; based on this information, we modified the finding. -4- California Substance Abuse Treatment Facility and State Prison Payroll Audit Restricted Use This audit report is solely for the information and use of CSATF-CSP and the SCO; it is not intended to be and should not be used by anyone other than these specified parties. This restriction is not intended to limit distribution of this audit report, which is a matter of public record and is available on the SCO website at www.sco.ca.gov. Original signed by JIM L. SPANO, CPA Chief, Division of Audits July 31, 2019 -5- California Substance Abuse Treatment Facility and State Prison Payroll Audit Schedule— Summary of Findings February 1, 2015, through January 31, 2018 Issues as a Total Dollar Number of Dollar Amount Number of Percentage of Dollar Dollar Amount of Finding Selections Method of Selection of Selections Selections Selections Amount of Amount of Known and Number Issues Audited Selection Unit Audited with Issues Audited * Known Issues Likely Issues Likely Issues 1 Inadequate segregation of duties N/A N/A N/A N/A N/A N/A N/A N/A N/A and compensating controls over payroll transactions 2 Inappropriate keying access to 2 7 Targeted Employee $ - 1 0 37% $ - $ - $ - the State's payroll system 3 Inadequate controls over vacation 127 Targeted Employee 2,320,157 127 100% 2 ,320,157 N/A 2,320,157 and annual leave balances, resulting in liability for excessive balances 4 Inadequate controls over separation lump-sum pay, resulting in improper payments Overpayments 101 Statistical Employee 3,086,607 3 3 33% 3 9,467 7,386 4 6,853 (section 7[k] employees) Underpayments -- Same selections above -- 1 5 15% ( 5,495) (1,029) (6,524) (section 7[k] employees) 5 Inadequate controls over overtime pay, resulting in improper payments Overpayments 1 05 Statistical Payment 157,063 7 7% 1 ,518 4 19,949 421,467 transaction Underpayments --Same selections above-- 1 4 13% ( 390) ( 107,848) ( 108,238) Overpayments 4 4 Targeted Payment 1 41,251 5 11% 2 ,917 N/A 2,917 transaction Underpayments -- Same selections above -- 1 2% ( 326) N/A ( 326) 6 Inadequate controls over salary 1 4 Targeted Salary advance 8,983 5 36% 719 N/A 7 19 advances, resulting in failure to transaction recover outstanding amounts 7 Inadequate controls over holiday 3 4 Targeted Holiday credit 13,022 6 18% 1,664 N/A 1,664 credit transactions, resulting in transaction improper credits 8 Inadequate controls over uniform 3 7 Judgmental Payment 20,295 2 2 59% 10,597 N/A 1 0,597 allowance, resulting in transaction overpayments Total $ 5 ,747,378 $ 2,370,828 $ 318,458 $ 2 ,689,286 ________________ *All percentages are rounded to the nearest full percentage point. -6- California Substance Abuse Treatment Facility and State Prison Payroll Audit Findings and Recommendations FINDING 1— CSATF-CSP lacked adequate segregation of duties within its payroll transactions unit to ensure that only valid and authorized payroll Inadequate transactions were processed. CSATF-CSP also failed to implement other segregation of controls to compensate for this risk. duties and compensating GC sections 13400 through 13407 require state agencies to establish and controls over maintain internal controls, including proper segregation of duties and an payroll effective system of internal review. Adequate segregation of duties transactions reduces the likelihood that fraud or error will remain undetected by providing for separate processing by different individuals at various stages of a transaction and for independent reviews of the work performed. Our audit found that CSATF-CSP payroll transactions unit staff performed conflicting duties. Staff members performed multiple steps in processing payroll transactions, including entering data into the State’s payroll system; auditing employee timesheets; reconciling payroll, including reconciling system output to source documentation; reporting payroll exceptions; and processing adjustments. For example, staff members keyed in regular and overtime pay and reconciled the master payroll, overtime, and other supplemental warrants. CSATF-CSP failed to demonstrate that it had implemented compensating controls to mitigate the risks associated with such a deficiency. We found no indication that these functions were subjected to periodic supervisory review. The lack of adequate segregation of duties and compensating controls has a pervasive effect on the CSATF-CSP payroll process, and impairs the effectiveness of other controls by rendering their design ineffective or by keeping them from operating effectively. These control deficiencies, in combination with other deficiencies discussed in Findings 2 through 8, represent a material weakness in internal control over the payroll process such that there is a reasonable possibility that material noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. Good internal control practices require that the following functional duties be performed by different work units, or at minimum, by different employees within the same unit:  Recording transactions – This duty refers to the record-keeping function, which is accomplished by entering data into a computer system.  Authorization to execute – This duty belongs to individuals with authority and responsibility to initiate and execute transactions.  Periodic review and reconciliation of actual payments to recorded amounts – This duty refers to making comparisons of information at regular intervals and taking action to resolve differences. -7- California Substance Abuse Treatment Facility and State Prison Payroll Audit Recommendation We recommend that CSATF-CSP:  Separate conflicting payroll function duties to the greatest extent possible. Adequate segregation of duties will provide a stronger system of internal control whereby the functions of each employee are subject to the review of another. If it is not possible to segregate payroll functions fully and appropriately, CSATF-CSP should implement compensating controls. For example, if the payroll transactions unit staff member responsible for recordkeeping also performs a reconciliation process, then the supervisor should perform and document a detailed review of the reconciliation to provide additional control over the assignment of conflicting functions. Compensating controls may also include dual authorization requirements and documented reviews of payroll system input and output; and  Develop formal procedures for performing and documenting compensating controls. CSATF-CSP lacked adequate controls to ensure that only appropriate staff FINDING 2— had keying access to the State’s payroll system. CSATF-CSP Inappropriate inappropriately allowed 10 employees keying access to the State’s payroll keying access to the system. If not mitigated, this control deficiency leaves payroll data at risk State’s payroll of misuse, abuse, and unauthorized use. system The SCO maintains the State’s payroll system. The system is decentralized, thereby allowing employees of state agencies to access it. PPSD has established a Decentralized Security Program Manual that all state agencies are required to follow in order to access the payroll system. The program’s objectives are to secure and protect the confidentiality and integrity of payroll data against misuse, abuse, and unauthorized use. We examined the records of 27 CSATF-CSP employees who had keying access to the State’s payroll system at various times between February 2015 and January 2018. Of the 27 employees, 10 had inappropriate keying access to the State’s payroll system. Specifically, CSATF-CSP did not immediately remove or modify keying access for nine employees after the employees’ separation from state service, transfer to another agency, or change in classification. For example, a Personnel Specialist transferred to another state agency on May 1, 2016; CSATF-CSP did not request to remove the employee’s access until July 21, 2016, 81 days later. In addition, one of the 10 employees had keying access to the system while appointed to the Associate Government Program Analyst classification, which is ineligible to have keying access to the payroll system without the required justification; CSATF-CSP could not provide the justification letter for this employee. The Decentralized Security Program Manual states, in part: The PPSD system contains sensitive and confidential information. Access is restricted to persons with an authorized, legal, and legitimate business requirement to complete their duties. . . . -8- California Substance Abuse Treatment Facility and State Prison Payroll Audit Currently, PIMS, HIST, KEYM, PIP, LAS, MPC and/or ACAS applications are restricted to Personnel Specialists or Personnel Technician classifications because their need is by definition a function of their specific job duties and any change in those duties requires a reevaluation of the need for access. If the employee’s duties change, such that the need for access no longer exists, the access privilege MUST be removed or deleted immediately by a request submitted by the department/campus. . . . A request to grant access to an individual in a classification other than in the Personnel Specialist/Payroll Technician series to access PIMS, HIST, KEYM, PIP, LAS, MPC and/or ACAS requires a written justification from the Authorizing Manager. The justification must describe the individual's specific job duties requiring the need to access system information (i.e., PIMS = Employment History, HIST=Payroll History, LAS=Leave Accounting System, etc.) as well as level of access to that application, in order to perform their regular daily duties. . . . To prevent unauthorized use by a transferred, terminated or resigned employee's user ID, the Security Monitor must IMMEDIATELY submit all pages of the PSD125A to delete the user’s system access. Using an old user ID increases the chances of a security breach which is a serious security violation. Sharing a user ID is strictly prohibited and a serious violation. Recommendation We recommend that CSATF-CSP:  Update keying access to the State’s payroll system immediately after employees leave CSATF-CSP, transfer to another unit, or change classifications; and  Periodically review access to the system to verify that access complies with the Decentralized Security Program Manual. CSATF-CSP failed to implement controls to ensure that it adheres to the FINDING 3— requirements of collective bargaining agreements and state regulations to Inadequate limit the accumulation of vacation and annual leave credits. This controls over deficiency resulted in liability for excessive leave balances with a value of vacation and at least $2,320,157 as of January 31, 2018. We expect the liability to annual leave increase if CSATF-CSP does not take action to address the excessive balances, resulting vacation and annual leave balances. in liability for excessive balances Collective bargaining agreements and state regulations limit the amount of vacation and annual leave that most state employees may accumulate to no more than 80 days (640 hours). The limit on leave balances helps state agencies manage leave balances and control the State’s liability for accrued leave credits. State agencies may allow employees to carry a higher leave balance only under limited circumstances. For example, an employee may not be able to reduce accrued vacation or annual leave hours below the limit due to business needs. When an employee’s leave accumulation exceeds or is projected to exceed the limit, state agencies should work with the employee to develop a written plan for reducing leave balances below the applicable limit. -9- California Substance Abuse Treatment Facility and State Prison Payroll Audit Our examination of CSATF-CSP’s leave accounting records determined that CSATF-CSP had 1,732 employees with unused vacation or annual leave credits at January 31, 2018. Of those employees, 127 exceeded the limit set by collective bargaining agreements and state regulations. For example, one employee had an accumulated balance of 2,998 hours in annual leave, or 2,358 hours beyond the 640-hour limit. Collectively, the 127 employees accumulated 48,301 hours of excess vacation and annual leave, with a value of at least $2,320,157 as of January 31, 2018. This estimated liability does not adjust for salary rate increases and additional leave credits.2 Accordingly, we expect that the amount needed to pay for this liability will be higher. For example, a CSATF-CSP employee separated from state service with 3,150 hours in leave credits, including 2,285 hours in annual leave. After adjusting for additional leave credits, the employee was paid for 3,730 hours, or 18% more. We judgmentally selected 20 of the 127 employees for examination to determine whether CSATF-CSP complied with collective bargaining agreements and state regulations. When we discussed the records of these employees with the personnel office staff, they indicated that CSATF-CSP had no plans in place during the audit period to reduce leave balances below the limit. CSATF-CSP also could not demonstrate that it had complied with collective bargaining agreements and state regulations when allowing these employees to maintain excess vacation or annual leave balances. If CSATF-CSP does not take action to reduce the excessive leave balances, the liability for accrued vacation and annual leave will likely increase because most employees will receive salary increases or use other non-compensable leave credits instead of vacation or annual leave, increasing their vacation or annual leave balances. The state agency responsible for paying these leave balances may face a cash flow problem if a significant number of employees with excessive vacation or annual leave balances separate from state service. Normally, state agencies are not budgeted to make these separation lump-sum payments. However, the State’s current practice dictates that the state agency that last employed an employee pays for that employee’s lump-sum separation payment, regardless of where the employee accrued the leave balance. Recommendation We recommend that CSATF-CSP:  Implement controls, including existing policies and procedures, to ensure that its employees’ vacation and annual leave balances are maintained within levels allowed by collective bargaining agreements and state regulations;  Conduct ongoing monitoring of controls to ensure that they are implemented and operating effectively; and 2 Most state employees receive pay rate increases every year pursuant to state laws and/or collective bargaining agreements until they reach the top of their pay scale, or promote into a higher-paying position. In addition, when an employee’s accumulated leave balances upon separation are calculated for lump-sum pay, the employee is credited with additional leave credits equal to the amount that the employee would have earned had the employee taken time off and not separated from state service. -10- California Substance Abuse Treatment Facility and State Prison Payroll Audit  Participate in leave buy-back programs if the State offers such programs and funds are available. CSATF-CSP lacked adequate controls over the processing of employee FINDING 4— separation lump-sum pay. We identified $46,853 in overpayments and Inadequate $6,524 in underpayments for separation lump-sum pay, consisting of controls over $39,467 in overpayments and $5,496 in underpayments based on actual separation lump- transactions audited (“known”); and $7,386 in overpayments and $1,028 sum pay, resulting in underpayments based on the results of statistical sampling (“likely”). If in improper not mitigated, these control deficiencies leave CSATF-CSP at risk of payments additional improper separation lump-sum payments. GC section 19839 allows lump-sum payment for accrued eligible leave credits when an employee separates from state employment. Collective bargaining agreements include similar provisions regarding separation lump-sum pay. Payroll records show that CSATF-CSP processed payments for separation lump-sum pay, totaling $7,091,434, for 314 employees between February 2015 and January 2018, as follows: Separation Lump-Sum Pay Group Unit Amount Employees under Section 7(k) of the Fair Labor Standards Act (statistically sampled) 121 $ 3,664,226 Employees under Section 7(k) of the Fair Labor Standards Act (examined 11 highest payments) 193 3,427,208 Total population 314 $ 7,091,434 _____________ * Amounts in this table are rounded to the nearest dollar. Of the payments for separation lump-sum pay, totaling $3,664,226, for 121 employees who were covered by the provisions of Section 7(k) of the Fair Labor Standards Act, we randomly selected a statistical sample (as described in the Appendix) of 101 employees who received separation lump-sum pay, totaling $3,086,607. Our examination of lump-sum payments made to these 101 employees showed that CSATF-CSP overpaid 33 of them by approximately $39,467 and underpaid 15 of them by approximately $5,495. These payments resulted in net total improper payments of $33,972. As we used a statistical sampling method to select the employees whose payments for separation lump-sum pay were examined, we projected the amount of likely overpayments to be $7,386 and likely underpayments to be $1,029. These payments resulted in a net total exception of $6,357. Therefore, the known and likely improper payments totaled a net of approximately $40,327, consisting of $46,853 in overpayments and $6,524 in underpayments. -11- California Substance Abuse Treatment Facility and State Prison Payroll Audit The following table summarizes the results of our statistical sampling: Known improper payments, net $ 33,972 Divide by: Sample 3,086,607 Error rate for projection (differences due to rounding) 1.10% Population that was statistically sampled 3,664,226 Multiply by: Error rate for projection 1.10% Known and likely improper payments, net (differences due to rounding) 40,329 Less: Known improper payments, net 33,972 Likely improper payments, net $ 6,357 _____________ * Amounts in this table are rounded to the nearest dollar. Of the remaining payments for separation lump-sum pay, totaling $3,427,208, for 193 employees who were not covered by the provisions of Section 7(k) of the Fair Labor Standards Act, we selected 11 employees who were granted the highest payments, totaling $1,744,901. Our examination of the payments for separation lump-sum pay for these employees found no exceptions. The known improper payments were made because payroll transactions unit staff members miscalculated leave balances paid, failed to include the leave credits that employees would have been credited with when their leave balances were calculated for lump-sum pay, and granted holiday credits to ineligible employees. CSATF-CSP also lacked adequate supervisory review to ensure accurate processing of separation lump-sum pay. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. Recommendation We recommend that CSATF-CSP:  Establish adequate controls to ensure accurate calculation and payment of separation lump-sum pay;  Conduct a review of separation lump-sum payments made during the past three years to ensure that the payments were accurate and in compliance with collective bargaining agreements and state law; and  Recover overpayments made to separated employees in accordance with GC section 19838 and State Administrative Manual (SAM) section 8776.6, and properly compensate those employees who were underpaid. CSATF-CSP lacked adequate controls over the processing of overtime FINDING 5— pay. We identified $424,384 in overpayments and $108,564 in Inadequate underpayments for overtime pay, consisting of $4,435 in overpayments controls over and $716 in underpayments based on actual transactions examined overtime pay, (“known”); and $419,949 in overpayments and $107,848 in resulting in underpayments based on the results of statistical sampling (“likely”). If improper not mitigated, these control deficiencies leave CSATF-CSP at risk of payments additional improper payments for overtime. -12- California Substance Abuse Treatment Facility and State Prison Payroll Audit Collective bargaining agreements, and state laws and policies, contain specific clauses regarding overtime pay. Payroll records show that CSATF-CSP processed 29,458 overtime pay transactions, totaling $44,065,657, between February 2015 and January 2018, as follows: Overtime Payment Type by Group Unit Amount Work Week Group 2 – Paid for less than 250 hours (statistically sampled) 29,241 $ 43,625,098 Work Week Group 2 – Paid for at least 250 hours (items examined 100%) 10 121,612 Work Week Group E (items examined 100%) 34 19,639 Work Week Group SE (items not examined) 173 299,308 Total population 29,458 $ 44,065,657 _____________ * Amounts in this table are rounded to the nearest dollar. Of the 29,241 overtime pay transactions, totaling $43,625,098, for Work Week Group (WWG) 2 employees who were paid for less than 250 hours of overtime per transaction, we randomly selected a statistical sample (as described in the Appendix) of 105 transactions, totaling $157,063. Of the 105 transactions, CSATF-CSP overpaid seven by approximately $1,518 and underpaid 14 by approximately $390. These payments resulted in total improper payments of $1,128. As we used a statistical sampling method to select the overtime pay transactions examined, we projected the amount of likely overpayments to be $419,949 and likely underpayments to be $107,848. These payments resulted in total improper payments of $312,101. Therefore, the known and likely improper payments totaled a net of approximately $313,229, consisting of $421,467 in overpayments and $108,238 in underpayments. The following table summarizes the results of our statistical sampling: Known improper payments, net $ 1,128 Divide by: Sample 157,063 Error rate for projection (differences due to rounding) 0.72% Population that was statistically sampled 43,625,098 Multiply by: Error rate for projection 0.72% Known and likely improper payments, net (differences due to rounding) 313,229 Less: Known improper payments, net 1,128 Likely improper payments, net $ 312,101 _____________ * Amounts in this table are rounded to the nearest dollar. We also examined all 10 overtime pay transactions, totaling $121,612, for WWG 2 employees who were paid for at least 250 hours of overtime per transaction. Of the 10 transactions, CSATF-CSP overpaid two by approximately $739. Furthermore, we examined all 34 overtime pay transactions, totaling $19,639, for WWG E employees who are not eligible to receive overtime pay under normal circumstances. Of the 34 transactions, CSATF-CSP improperly paid three, totaling $2,178, to an employee who was not eligible to receive overtime pay; and underpaid one transaction by $326. -13- California Substance Abuse Treatment Facility and State Prison Payroll Audit The California Department of Human Resources’ California State Civil Service Pay Scales, section 10 states, in part: Work Week Group “E” includes classes that are exempted from coverage under the FAIR LABOR STANDARDS ACT because of the “white-collar” (administrative, executive, professional) exemptions. To be eligible for this exemption a position must meet both the “salary basis” and the “duties” test. Exempt (WWG E) employees are paid on a “salaried” basis and the regular rate of pay is full compensation for all hours worked to perform assigned duties. However, these employees shall receive up to 8 hours holiday credit when authorized to work on a holiday. Work Week Group E employees shall not receive any form of additional compensation, whether formal or informal, unless otherwise provided by the provisions of this work week group. . . . The known improper payments were made because the payroll transactions unit staff members miscalculated overtime hours worked; paid for overtime hours worked at the straight-time rate instead of the time-and-a-half rate, or vice-versa; failed to verify that the employee was eligible for overtime pay; or incorrectly entered the overtime hours worked into the payroll system. We also noted that the CSATF-CSP timekeeping system improperly rounded overtime hours worked. Furthermore, CSATF-CSP lacked adequate supervisory review to ensure accurate processing of overtime pay. GC sections 13402 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Recommendation We recommend that CSATF-CSP:  Conduct a review of payments for overtime pay made during the past three years to ensure that the payments complied with collective bargaining agreements and state laws and policies; and  Recover overpayments made to employees through an agreed-upon collection method in accordance with GC section 19838, and properly compensate those employees who were underpaid. We further recommend that, to prevent improper payments for overtime pay from recurring, CSATF-CSP:  Establish adequate internal controls to ensure that payments are accurate and comply with collective bargaining agreements and state laws and policies;  Conduct a review of the timekeeping system and ensure that it is not improperly rounding overtime hours worked; and  Provide adequate oversight to ensure that payroll transactions unit staff process only valid and authorized payments that comply with collective bargaining agreements and state laws and policies. -14- California Substance Abuse Treatment Facility and State Prison Payroll Audit CSATF-CSP lacked adequate controls over salary advances to ensure that FINDING 6— advances were recovered in accordance with state law and policies. Five Inadequate salary advances, totaling $719, remained outstanding as of January 31, controls over 2018, due to CSATF-CSP’s noncompliance with the State’s collection salary advances, policies and procedures. The oldest unrecovered salary advance was resulting in failure outstanding for over six years. This control deficiency leaves CSATF-CSP to recover at risk of further failures to collect salary advances if not mitigated. outstanding amounts At January 31, 2018, CSATF-CSP’s accounting records showed 45 outstanding salary advances totaling $74,405, including 14 balances, totaling $8,983, that had been outstanding for more than 120 days. Generally, the prospect of collection diminishes as an account ages. When an agency does not initiate collection within three years from the date of overpayment, the possibility of collection is remote. GC section 19838 and SAM sections 8776 and 8776.7 describe the State’s collection policies and procedures, which require CSATF-CSP to collect salary advances in a timely manner and maintain proper records of collection efforts. We examined the 14 salary advances that had been outstanding for more than 120 days. Based on this examination, we noted that CSATF-CSP did not comply with the State’s collection policies and procedures for five of them, totaling $719. CSATF-CSP did not send collection notices promptly, or did not send the notices at all. For example, a salary advance was issued to a separating employee in September 2016; CSATF-CSP sent the first collection letter in March 2017, five months later. In addition, CSATF-CSP could not provide supporting documentation for two of the five salary advances. SAM section 8776 requires state agencies to maintain proper records of their collection efforts, if any. The lack of adequate controls over salary advances reduces the likelihood of collection, increases the amount of resources expended on collection efforts, and negatively impacts cash flow. Recommendation We recommend that CSATF-CSP:  Ensure that it recovers salary advances in a timely manner pursuant to GC section 19838 and SAM sections 8776 and 8776.7; and  Maintain documentation of its collection efforts, if any. CSATF-CSP lacked adequate controls over the processing of holiday FINDING 7— credit transactions. We identified approximately $1,664 in improper Inadequate holiday credits. If not mitigated, this control deficiency leaves CSATF- controls over CSP at risk of additional improper holiday credits. holiday credit transactions, GC section 19853 specifies the compensation that an eligible employee is resulting in entitled to receive when required to work on a qualifying holiday. improper credits Collective bargaining agreements between the State and Bargaining Units 3, 4, 12, 15, 18, 19, and 20 include similar provisions regarding holiday compensation for represented employees. -15- California Substance Abuse Treatment Facility and State Prison Payroll Audit Leave accounting records showed that CSATF-CSP processed 9,394 accrual transactions of holiday credit. We examined 34 of these transactions, with an estimated value of $13,022, because they involved unusual credits. Of the 34 transactions, six involved improper credits, with an estimated value of $1,664. The improper holiday credit transactions were made because the payroll transactions unit staff members granted holiday credits to employees during pay periods with no holidays, and improperly calculated holiday credit hours. CSATF-CSP also lacked adequate supervisory review to ensure accurate processing of holiday credits. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. Recommendation We recommend that CSATF-CSP:  Conduct a review of holiday credits granted during the past three years to ensure that credits complied with collective bargaining agreements and state law;  Correct any improper holiday credits in the State’s leave accounting system; and  Establish adequate controls to ensure that holiday credits granted are valid and comply with collective bargaining agreements and state law. CSATF-CSP lacked adequate controls over the processing of payments FINDING 8— for uniform allowances. We identified $10,597 in overpayments for Inadequate controls uniform allowance. If not mitigated, these control deficiencies leave over uniform CSATF-CSP at risk of additional improper payments. allowance, resulting in overpayments Pursuant to the collective bargaining agreement between the State and Bargaining Unit 6, certain employees required to wear a uniform and uniform accessories receive a maximum uniform allowance of $950 per year, to be paid annually. If an employee leaves the classification entitled to the uniform allowance, the employee receives a prorated share of the annual uniform allowance. Payroll records showed that CSATF-CSP processed 3,283 transactions, totaling $2,357,550, for uniform allowance between February 2015 and January 2018. We judgmentally selected and examined 37 transactions, and found that CSATF-CSP overpaid 22 of them, totaling $10,597. Specifically, for five transactions, the employees received the uniform allowance twice in one year; and for 17 transactions, the employees received more than the amount allowed by the collective bargaining agreement. CSATF-CSP lacked adequate supervisory review to ensure accurate processing of uniform allowance payments. -16- California Substance Abuse Treatment Facility and State Prison Payroll Audit Recommendation We recommend that CSATF-CSP:  Conduct a review of payments for uniform allowance made during the past three years to ensure that the payments complied with collective bargaining agreements; and  Recover overpayments made to employees through an agreed-upon collection method in accordance with GC section 19838. We further recommend that, to prevent improper payments for uniform allowance from recurring, CSATF-CSP:  Establish adequate internal controls to ensure that payments are accurate and comply with collective bargaining agreements; and  Provide adequate oversight to ensure that payroll transactions unit staff members process only valid and authorized payments that comply with collective bargaining agreements. -17- California Substance Abuse Treatment Facility and State Prison Payroll Audit Appendix— Audit Sampling Methodology February 1, 2015, through January 31, 2018 We used attributes sampling for tests of compliance. The following table outlines our audit sampling application for audit areas that included errors: Results Expected Projected to Review Type Population Population Sampling Sample Selection Confidence Tolerable Error Sample Intended Finding Area of Test (Unit) (Dollar) Unit Method Level Error Rate (Rate) ᵃ Size Population Number Separation lump-sum pay Compliance 1 21 $3,664,226 Employee Computer-generated 90% 5% 2 (1.75%) 101 ᵇ Yes 4 (Section 7[k] employees) simple random Overtime pay Compliance 2 9,241 $43,625,098 Payment Computer-generated 90% 5% 2 (1.75%) 105 Yes 5 (Work Week Group 2 – transactions simple random Paid for less than 250 hours) _____________ a Pursuant to the AICPA’s Audit Guide: Audit Sampling (May 1, 2017 edition), pages 131-133, the expected error is the expected number of errors planned for in the sample. It is derived by multiplying the expected error rate by the sample size. The expected number of errors in the sampling tables on pages 135-136 was rounded upward, e.g., 0.2 errors becomes 1 error. b For population of less than 250 items, we used the sample size suggested in the Test of Compliance – Sampling Plan and Evaluation found in Practitioner’s Publishing Company’s Guide to Single Audits (July 2017 edition). -A1- California Substance Abuse Treatment Facility and State Prison Payroll Audit Attachment— California Substance Abuse Treatment Facility and State Prison’s Response to Draft Audit Report State Controller’s Office Division of Audits Post Office Box 942850 Sacramento, CA 94250 http://www.sco.ca.gov S19-PAR-0002