California School for the Deaf – Riverside (csdr) Payroll Process Review –

CALIFORNIA SCHOOL FOR THE DEAF – RIVERSIDE Review Report PAYROLL PROCESS REVIEW March 1, 2015, through February 28, 2018 BETTY T. YEE California State Controller July 2019 BETTY T. YEE California State Controller July 31, 2019 Tony Thurmond, State Superintendent of Public Instruction California Department of Education 1430 N Street Sacramento, CA 95814 Dear Mr. Thurmond: The State Controller’s Office has reviewed the California School for the Deaf – Riverside (CSDR) payroll process for the period of March 1, 2015, through February 28, 2018. CSDR management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. Our review found material weaknesses in internal control over CSDR’s payroll process. These weaknesses included insufficient controls that contributed to CSDR employees’ improper and questioned payments of overtime, separation lump-sum, and final settlement payments, resulting in an estimated net liability of $1,606. If you have any questions, please contact Andrew Finlayson, Chief, State Agency Audits Bureau, by telephone at (916) 324-6310. Sincerely, Original signed by JIM L. SPANO, CPA Chief, Division of Audits JLS/as Tony Thurmond, State Superintendent of -2- July 31, 2019 Public Instruction cc: Nick Schweizer, Deputy Superintendent of Public Instruction California Department of Education Valarie Bliss, Director Personnel Services Division California Department of Education Mark Rodriguez, Chief Administrative Services Division California Department of Human Resources Marissa Revelino, Chief Personnel and Payroll Services Division State Controller’s Office California School for the Deaf – Riverside Payroll Process Review Contents Review Report Summary ............................................................................................................................ 1 Background ........................................................................................................................ 1 Objectives, Scope, and Methodology ............................................................................... 2 Conclusion .......................................................................................................................... 3 Views of Responsible Officials .......................................................................................... 3 Restricted Use .................................................................................................................... 4 Schedule—Summary of Findings ......................................................................................... 5 Findings and Recommendations ........................................................................................... 6 Appendix—Sampling Methodology ..................................................................................... A1 Attachment—California Department of Education’s Response to Draft Review Report California School for the Deaf – Riverside Payroll Process Review Review Report Summary The State Controller’s Office (SCO) reviewed the California School for the Deaf – Riverside (CSDR) payroll process for the period of March 1, 2015, through February 28, 2018. CSDR management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. Our limited review identified material weaknesses in internal control over the CSDR payroll process that leave CSDR at risk of additional improper payments if not mitigated. We found that CSDR has a combination of deficiencies in internal control over its payroll process such that there is a reasonable possibility that a material misstatement in financial information or noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. Specifically, CSDR lacked adequate segregation of duties and compensating controls over its processing of payroll transactions. In addition, CSDR inappropriately granted two employees keying access to the State’s payroll system, leaving payroll data at risk of misuse, abuse, and unauthorized use. Employees who left or transferred did not have their keying access removed timely. These deficiencies have a pervasive effect on the CSDR payroll process, and impair the effectiveness of other controls by rendering their design ineffective or by keeping them operating effectively. We also found that CSDR lacked sufficient controls over the processing of specific payroll related transactions to ensure that CSDR complied with collective bargaining agreements and state laws, and that only valid and authorized payments were processed. As quantified in the Schedule, these deficiencies contributed to CSDR employee’s overtime, separation lump- sum, and final settlement payments, resulting in an estimated net liability of $1,606. Background In 1979, the State of California adopted collective bargaining for state employees. This created a significant workload increase for the SCO’s Personnel and Payroll Services Division (PPSD), as PPSD was the State’s centralized payroll processing center for all payroll-related transactions. PPSD decentralized the processing of payroll, allowing state agencies and departments to process their own payroll-related transactions. Periodic reviews of the decentralized payroll processing at state agencies and departments ceased due to budget constraints in the late 1980s. In 2013, the California State Legislature reinstated these payroll reviews to gain assurance that state agencies and departments maintain adequate internal control over payroll, provide proper oversight over their decentralized payroll processing, and comply with various state laws and regulations regarding payroll processing and related transactions. -1- California School for the Deaf – Riverside Payroll Process Review Review Authority Authority for this review is provided by California Government Code (GC) section 12476, which states, “The Controller may audit the uniform state pay roll system, the State Pay Roll Revolving Fund, and related records of state agencies within the uniform state pay roll system, in such manner as the Controller may determine.” In addition, GC section 12410 stipulates that “The Controller shall superintend the fiscal concerns of the state. The Controller shall audit all claims against the state, and may audit the disbursement of any state money, for correctness, legality, and for sufficient provisions of law for payment.” Objectives, Scope, We performed this review to determine whether CSDR: and Methodology  Processed payroll and payroll-related disbursements accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures;  Established adequate internal control over payroll to meet the following control objectives: o Payroll and payroll-related transactions are properly approved and certified by authorized personnel; o Only valid and authorized payroll and payroll-related transactions are processed; o Payroll and payroll-related transactions are accurate and properly recorded; o Payroll systems, records, and files are adequately safeguarded; o State laws, regulations, policies, and procedures are complied with regarding payroll and payroll-related transactions;  Complied with existing controls as part of the ongoing management and monitoring of payroll and payroll-related expenditures;  Maintained accurate records of leave balances; and  Administered and recorded in accordance with state laws, regulations, policies, and procedures. We reviewed CSDR’s payroll process and transactions for the period of March 1, 2015, through February 28, 2018. To achieve our objectives, we:  Reviewed state and CSDR policies and procedures related to the payroll process to understand CSDR’s methodology for processing various payroll and payroll-related transactions;  Interviewed CSDR payroll personnel to understand CSDR’s methodology for processing various payroll and payroll-related transactions, determine their level of knowledge and ability relating to payroll transaction processing, and gain an understanding of existing internal control over the payroll process and systems; -2- California School for the Deaf – Riverside Payroll Process Review  Selected transactions recorded in the State’s payroll database using statistical sampling as outlined in the Appendix, and targeted selection based on risk factors and other criteria for review;  Analyzed and tested transactions recorded in the State’s payroll database, and reviewed relevant files and records to determine the accuracy of payroll and payroll-related payments, accuracy of leave transactions, propriety of review and approval of transactions; adequacy of internal control over the payroll process and systems; and compliance with collective bargaining agreements and state laws, regulations, policies, and procedures (errors found in statistically- determined samples were projected to the intended population); and  Reviewed salary advances to determine whether CSDR properly administered and recorded them in accordance with state laws, regulations, policies, and procedures. Conclusion Based on the results of our review, we found that CSDR:  Lacked adequate segregation of duties and compensating controls over payroll transactions (see Finding 1);  Granted inappropriate keying access to the State’s payroll system (see Finding 2);  Lacked adequate controls over overtime, resulting in improper payments (see Finding 3); and  Lacked adequate controls over separation lump-sum and final settlement payments (see Finding 4). As quantified in the Schedule and described in the Findings and Recommendations section of this review report, these material weaknesses1 in internal controls over the payroll process contributed to CSDR’s employees’ improper and questioned payments of overtime, separation lump-sum, and final settlement payments, resulting in an estimated net liability of $1,606. Views of We issued a draft audit report on June 28, 2019. Lupita Cortez Alcalá, Chief Deputy Superintendent of Public Instruction of the California Responsible Department of Education, responded by letter dated July 26, 2019 Officials (Attachment), on behalf of CSDR. CSDR stated that it concurs with all of the recommendations of this review report. 1 An evaluation of an entity’s payroll process may identify deficiencies in its internal control over the process. A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct misstatements in financial information, impairments of effectiveness or efficiency of operations, or noncompliance with provisions of laws, regulations, or contracts on a timely basis. Control deficiencies, either individually or in combination with other control deficiencies, may be evaluated as significant deficiencies or material weaknesses. A material weakness is a deficiency, or combination of deficiencies, in internal control such that there is a reasonable possibility that a material misstatement in financial information, impairment of effectiveness or efficiency of operations, or noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. A significant deficiency is a deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness, yet important enough to merit attention by those charged with governance. -3- California School for the Deaf – Riverside Payroll Process Review Restricted Use This report is solely for the information and use of CSDR and the SCO; it is not intended to be and should not be used by anyone other than these specified parties. This restriction is not intended to limit distribution of this report, which is a matter of public record, and is available on the SCO website at www.sco.ca.gov. Original signed by JIM L. SPANO, CPA Chief, Division of Audits July 31, 2019 -4- California School for the Deaf – Riverside Payroll Process Review Schedule— Summary of Findings March 1, 2015, through February 28, 2018 Number of Issues as a Total Dollar Number of Dollar Amount Selections Percentage Dollar Dollar Amount of Finding Selections Method of Selection of Selections with of Selections Amount of Amount of Known and Number Issues Reviewed Selection Unit Reviewed Issues Reviewed * Known Issues Likely Issues Likely Issues 1 Inadequate segregation of duties N/A N/A N/A N/A N/A N/A N/A N/A N/A and compensating controls over payroll transactions 2 Inappropriate keying access to the 7 Targeted Employee $ - 2 29% $ - N/A $ - State’s payroll system 3 Inadequate controls over overtime pay, resulting in improper payments: WWG 2 120 Statistical Employee/ 4 9,031 22 18% ( 104) $ ( 753) ( 857) Pay Period OT hours > 100 hours 14 Targeted Employee/ 4 3,737 4 29% 6 8 N/A 68 Pay Period 4 Inadequate controls over separation lump-sum pay and final settlement pay, resulting in improper payments: Lump-sum pay 47 Targeted Employee/ 2 24,069 9 19% 1 ,491 N/A 1,491 Pay Period Final settlement pay 62 Targeted Employee/ 3 31,105 8 13% ( 2,308) N/A ( 2,308) Pay Period Total $ 6 47,942 $ ( 853) $ (753) $ ( 1,606) _______________ *All percentages are rounded to the nearest full percentage point. -5- California School for the Deaf – Riverside Payroll Process Review Findings and Recommendations FINDING 1— CSDR lacked adequate segregation of duties within its payroll transactions unit necessary to ensure that only valid and authorized payroll transactions Inadequate were processed. CSDR also failed to implement other controls to segregation of compensate for this risk. duties and compensating GC sections 13402 through 13407 require state agencies to establish and controls over maintain internal controls, including proper segregation of duties and an payroll effective system of internal review. Adequate segregation of duties transactions reduces the likelihood that fraud or error will remain undetected by providing for separate processing by different individuals at various stages of a transaction and for independent reviews of the work performed. Our review found CSDR payroll transactions unit staff performed conflicting duties. Staff members performed multiple steps in processing payroll transactions, including entering data entry into the State’s payroll system; reconciling payroll, including reconciling system output to source documentation; and reporting payroll exceptions. For example staff members keyed in regular and overtime pay and reconciled the master payroll, overtime, and other supplemental warrants. CSDR failed to demonstrate that it implemented compensating controls to mitigate the risks associated with such a deficiency. We found no indication that these functions were subjected to periodic supervisory review. The lack of adequate segregation of duties and compensating controls has a pervasive effect on the CSDR payroll process, and impairs the effectiveness of other controls by rendering their design ineffective or by keeping them from operating effectively. These control deficiencies, in combination with other deficiencies discussed in Findings 2 through 4, represent a material weakness in internal control over the payroll process such that there is a reasonable possibility that a material misstatement in financial information or noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. Good internal control practices require that the following functional duties be performed by different work units, or at a minimum, by different employees within the same unit:  Recording transactions—This duty refers to the record-keeping function, which is accomplished by entering data into a computer system.  Authorization to execute—This duty belongs to individuals with authority and responsibility to initiate and execute transactions.  Periodic reviews and reconciliation of actual payments to recorded amounts—This duty refers to making comparisons at regular intervals and taking action to resolve differences. -6- California School for the Deaf – Riverside Payroll Process Review Recommendation We recommend CSDR:  Separate conflicting payroll duties to the greatest extent possible. Adequate segregation of duties will provide a stronger system of internal control whereby the functions of each employee are subject to the review of another. If it is not possible to segregate payroll functions fully and appropriately due to specific circumstances, CSDR should implement compensating controls. For example, if the payroll transactions unit staff member responsible for recordkeeping also performs a reconciliation process, then the supervisor should perform and document a detailed review of the reconciliation to provide additional control over the assignment of conflicting functions. Compensating controls may also include dual authorization requirements and documented reviews of payroll system input and output; and  Develop formal written procedures for performing and documenting compensating controls. FINDING 2— CSDR lacked adequate controls to ensure that only appropriate staff have keying access to the State’s payroll system. Of the seven employees who Inappropriate had keying access during the review period, two (28%) had improper keying access to the keying access to the system. If not mitigated, this control deficiency leaves State’s payroll the payroll data at risk of misuse, abuse, and unauthorized use. system The SCO maintains the State’s payroll information system. The system is decentralized, thereby allowing employees of state agencies to access it. The SCO’s PPSD has established a Decentralized Security Program Manual that all state agencies are required to follow in order to access the payroll systems. The program’s objectives are to secure and protect the confidentiality and integrity of payroll data against misuse, abuse, and unauthorized use. CSDR had seven employees with keying access to the State’s payroll system at various times between March 1, 2015 and February 28, 2018. We reviewed the records of the seven employees and found that two had inappropriate keying access to the State’s payroll system. CSDR did not immediately remove or modify the employees’ keying access after their separation from state service, transfer to another agency or unit, or change in classification. In one instance, an employee was promoted to a classification that is not eligible for keying access to the payroll system on October 1, 2015, but the employee’s keying access was not removed until January 12, 2016, 103 days later. The Decentralized Security Program Manual states, in part: The privilege to access the PPSD database poses a significant risk to the ability for SCO to function. Therefore that privilege is restricted to persons with a demonstrated need for such access. Currently, applications are restricted to Personnel Services Specialists (PSS), or Payroll Technician (PT) classifications because their need is by definition a function of their specific job duties, and any change in those -7- California School for the Deaf – Riverside Payroll Process Review duties requires a reevaluation of the need for access. If the employee’s duties change, such that the need for access no longer exists, the access privilege MUST be removed or deleted immediately by a request submitted by the department…. A request for an individual in a classification other than in the PSS/PT series to access (the payroll system) requires a written justification from the Personnel/Payroll Officer. The justification must describe the individual’s specific job duties that require the need to each type of information…as well as the level of access to that application, in order to perform their Statutory and/or Constitutional duties…. To prevent unauthorized use of a transferred, terminated or resigned employee’s userID, it is required that the Security Monitor IMMEDIATELY submit a PSD125A to delete their system access. DO NOT WAIT until another employee fills this position; this only increases the chances for breach of security, utilizing and old userid. Recommendation We recommend CSDR:  Update keying access to the State’s payroll system immediately after employees leave CSDR, transfer to another unit, or change classifications; and  Periodically review access to the system to verify that access complies with the Decentralized Security Program Manual. CSDR lacked adequate controls over overtime compensation. We FINDING 3— identified known and likely overpayments totaling $2,161; and known and Inadequate likely underpayments totaling $2,950. If not corrected, the control controls over deficiency leaves CSDR at risk of granting additional improper payments. overtime pay, resulting in Payroll records showed that CSDR processed 823 overtime payments improper between March 2015 and February 2018. We tested as follows: payments Overtime paid to Work Week Group (WWG) 2 of 100 hours or more 14 (Items examined 100%) Overtime paid to WWG 2 (Population that was statistically sampled) 8 2 3 Total 837 We selected 14 payments for overtime hours exceeding 100 hours, which totaled $43,737. We found one error resulting in a net overpayment of $68. Of the remaining 823 overtime payments, we selected random samples using a statistical sampling method. Based on a 95% confidence level, an expected number of exceptions of two, and a tolerable exception rate of 5%, we randomly selected a statistical sample of 120 overtime payments, totaling $49,031. Of the 120 statistically-determined random samples, 10 transactions were found to be personnel specialist errors which resulted in monetary findings. In addition to personnel specialist errors resulting in monetary findings, there were also 12 overtime related control findings. These 22 exceptions -8- California School for the Deaf – Riverside Payroll Process Review were produced by various personnel specialist mistakes, such as; ineligible Compensating Time-off (CTO) cash outs, incorrect application of overtime carry overs, payment type misclassifications, incomplete/or partial documentation processing, and erroneous calculations during overtime processing. Because a statistical sampling method was used to select the random payments examined, we estimate the amount of likely underpayments to be $753. The following table summarizes our calculation for total and likely underpayments: Known underpayments, net $ (104) Divide by: Sample 49,031 Error rate for projection (differences due to rounding) -0.21% Population that was statistically sampled $ 404,022 Multiply by: Error rate for projection -0.21% Known and likely underpayments (differences due to rounding) $ (857) Less: Known underpayments, net (104) Likely underpayments, net $ (753) GC sections 13402 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to provide compliance with applicable laws and other requirements, and an effective system of internal review. Recommendation We recommend CSDR:  Conduct a review of overtime payments made during the past three years to ensure that the payments comply with collective bargaining agreements and state law; and  Recover overpayments from employees through an agreed-upon collection method in accordance with GC section 19838, and properly compensate those employees who were underpaid. To prevent improper overtime payments from recurring, CSDR should:  Establish adequate internal controls to ensure payments for overtime compensation comply with collective bargaining agreements and state law; and  Provide adequate oversight to ensure that payroll transactions unit staff members process only valid and authorized payments that comply with collective bargaining agreements and state law. -9- California School for the Deaf – Riverside Payroll Process Review FINDING 4— CSDR lacked adequate controls over processing of payments for Inadequate separation lump-sum pay and final settlement pay. We identified three controls over overpayments totaling $2,202 and six underpayments totaling $711 for separation lump- lump-sum pay. We also identified three overpayments totaling $306 and five underpayments totaling $2,614 for settlement payments. If not sum pay and final mitigated this control deficiency leaves CSDR at risk of additional settlement pay, improper separation lump-sum and settlement payments. resulting in improper We tested all 47 lump-sum payments, totaling $224,069 and determined payments that 37 out 47 payments were not properly reviewed by the Personnel Specialist/Personnel Supervisor. The Lump-sum worksheet was not used to document calculation prior to August 2017; therefore, all transactions were entered were not properly reviewed by management for approval before and after keying into the State’s payroll system. We tested all 62 settlement payments during the period, totaling $331,105. CSDR had:  No adequate controls in place to detect errors;  Personnel Specialists are not filling out forms and omitting steps while processing payments; and  Lack of monitoring review. Other causes included leave balances not being added correctly and/or personnel specialists copying information to and from the personnel action request incorrectly. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including a system of authorization and recordkeeping procedures over expenditures, and an effective system of internal review. Recommendation We recommend CSDR:  Ensure that there is a clear separation of duties such that one person is not performing all key duties of processing, reviewing, recording and keying data into the State’s payroll system for payment; and  Conduct ongoing monitoring and review controls to ensure that policies and procedures are being followed accurately, minimize the possibility of errors occurring, and to ensure that payments are accurate and in compliance with collective bargaining unit agreements and state law. -10- California School for the Deaf – Riverside Payroll Process Review Appendix— Sampling Methodology March 1, 2015, through February 28, 2018 We used attributes sampling for test of compliance. The following table outlines our sampling application for the review area that included errors: Results Expected Projected to Review Type Population Population Sampling Sample Selection Confidence Tolerable Error Sample Intended Finding Area of Test (Unit) (Dollar) Unit Method Level Error Rate (Rate) ¹ Size Population Number Overtime Pay Compliance 8 23 $404,022 Payment Computer-generated 95% 5% 1.50 (2%) 120 Yes 3 transactions simple random ______________ 1Pursuant to the AICPA’s Audit Guide: Audit Sampling (May 1, 2017 edition), pages 131-133, the expected error is the expected number of errors planned for in the sample. It is derived by multiplying the expected error rate by the sample size. The expected number of errors in the sampling tables on pages 135-136 was rounded upward, e.g., 0.2 errors becomes 1 error. -A1- California School for the Deaf – Riverside Payroll Process Review Attachment— California Department of Education’s Response to Draft Review Report State Controller’s Office Division of Audits Post Office Box 942850 Sacramento, CA 94250 http://www.sco.ca.gov S18-PAR-9008