California Department of Water Resources - Payroll Audit

CALIFORNIA DEPARTMENT OF WATER RESOURCES Audit Report PAYROLL AUDIT August 1, 2015, through July 31, 2018 BETTY T. YEE California State Controller July 2019 BETTY T. YEE California State Controller July 15, 2019 Karla Nemeth, Director California Department of Water Resources P.O. Box 942836 Sacramento, CA 94236 Dear Ms. Nemeth: The State Controller’s Office audited the California Department of Water Resources’s (DWR) payroll process and transactions for the period of August 1, 2015, through July 31, 2018. Our audit found material weaknesses in internal control over the DWR payroll process. These weaknesses contributed to DWR employees’ excessive vacation and annual leave balances, improper and questioned payments, and improperly issued and long-outstanding salary advances, costing the State an estimated net total of $8,557,291. If you have any questions, please contact Andrew Finlayson, Chief, State Agency Audits Bureau, by telephone at (916) 324-6310. Sincerely, Original signed by JIM L. SPANO, CPA Chief, Division of Audits JLS/ls cc: Katherine S. Kishaba, Deputy Director Business Operations California Department of Water Resources Jennifer Dong Kawate, Chief Human Resources Office California Department of Water Resources David Whitsell, Chief Internal Audits Office California Department of Water Resources Mark Rodriguez, Chief Administrative Services Division California Department of Human Resources Marissa Revelino, Chief Personnel and Payroll Services Division State Controller’s Office California Department of Water Resources Payroll Audit Contents Audit Report Summary ............................................................................................................................ 1 Background ........................................................................................................................ 1 Objectives, Scope, and Methodology ............................................................................... 2 Conclusion .......................................................................................................................... 3 Follow-up on Prior Audit Finding ................................................................................... 4 Views of Responsible Officials .......................................................................................... 4 Restricted Use .................................................................................................................... 4 Schedule—Summary of Findings ......................................................................................... 5 Findings and Recommendations ........................................................................................... 6 Appendix—Audit Sampling Methodology ........................................................................... A1 Attachment—California Department of Water Resources’s Response to Draft Audit Report California Department of Water Resources Payroll Audit Audit Report Summary The State Controller’s Office (SCO) audited the California Department of Water Resources’s (DWR) payroll process and transactions for the period of August 1, 2015, through July 31, 2018. DWR management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. We completed our audit fieldwork on May 23, 2019. Our audit determined that DWR:  Did not maintain adequate and effective internal controls over its payroll process. We found the following deficiencies in internal control over the payroll process that we consider to be material weaknesses: o Lack of adequate segregation of duties and compensating controls over the processing of payroll transactions (see Finding 1); o Inappropriate keying access to the State’s payroll system (see Finding 2); o Lack of sufficient controls over the processing of specific payroll- related transactions to ensure that DWR complied with collective bargaining agreements and state laws, and that only valid and authorized payments were processed (see Findings 3, 4, 5, and 6);  Did not process payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. We found the following instances of noncompliance with the requirements of collective bargaining agreements and state laws, regulations, policies, and procedures: o Failure to adhere to the requirements of collective bargaining agreements and state regulations to limit the accumulation of vacation and annual leave credits, resulting in liability for excessive leave balances with a value of at least $8,137,889 as of July 31, 2018 (see Finding 3); o Improper payments made for overtime pay, leave buy-back, and separation lump-sum pay, costing a net total of $408,903 (see Findings 4, 5, and 6); and  Did not administer salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures (see Finding 7). Background In 1979, the State of California adopted collective bargaining for state employees. This created a significant workload increase for the SCO’s Personnel and Payroll Services Division (PPSD), as PPSD was the State’s centralized payroll processing center for all payroll related-transactions. PPSD decentralized the processing of payroll, allowing state agencies and departments to process their own payroll-related transactions. Periodic audits of the decentralized payroll processing at state agencies and departments ceased due to the budget constraints in the late 1980s. -1- California Department of Water Resources Payroll Audit In 2013, the California State Legislature reinstated these payroll audits to gain assurance that state agencies and departments maintain adequate internal control over the payroll function, provide proper oversight of their decentralized payroll processing, and comply with various state laws and regulations regarding payroll processing and related transactions. Audit Authority Authority for this audit is provided by California Government Code (GC) section 12476, which states, “The Controller may audit the uniform state pay roll system, the State Pay Roll Revolving Fund, and related records of state agencies within the uniform state pay roll system, in such manner as the Controller may determine.” In addition, GC section 12410 stipulates that “The Controller shall superintend the fiscal concerns of the state. The Controller shall audit all claims against the state, and may audit the disbursement of any state money, for correctness, legality, and for sufficient provisions of law for payment.” Objectives, Scope, We performed this audit to determine whether DWR: and Methodology  Maintained adequate and effective internal controls over its payroll process;  Processed payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures; and  Administered salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. The audit covered the period from August 1, 2015, through July 31, 2018. To achieve our audit objectives, we:  Reviewed state and DWR policies and procedures related to the payroll process to understand DWR’s methodology for processing various payroll and payroll-related transactions;  Interviewed DWR payroll personnel to understand DWR’s methodology for processing various payroll and payroll-related transactions, determine their level of knowledge and ability relating to payroll transaction processing, and gain an understanding of existing internal control over the payroll process and systems;  Selected transactions recorded in the State’s payroll database using statistical sampling, as outlined in the Appendix, and targeted selection based on risk factors and other relevant criteria;  Analyzed and tested the selected transactions, and reviewed relevant files and records to determine the accuracy of payroll and payroll- related payments, accuracy of leave transactions, adequacy and effectiveness of internal control over the payroll process, and compliance with collective bargaining agreements and state laws, regulations, policies, and procedures; and  Reviewed salary advances to determine whether DWR administered and recorded them in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. -2- California Department of Water Resources Payroll Audit We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Conclusion Our audit determined that DWR:  Did not maintain adequate and effective internal controls over its payroll process1. We found the following deficiencies in internal control over the payroll process that we consider to be material weaknesses: o Lack of adequate segregation of duties and compensating controls over the processing of payroll transactions (see Finding 1); o Inappropriate keying access to the State’s payroll system (see Finding 2); o Lack of sufficient controls over the processing of specific payroll- related transactions to ensure that DWR complied with collective bargaining agreements and state laws, and that only valid and authorized payments were processed (see Findings 3, 4, 5, and 6);  Did not process payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. We found the following instances of noncompliance with the requirements of collective bargaining agreements and state laws, regulations, policies, and procedures: o Failure to adhere to the requirements of collective bargaining agreements and state regulations to limit the accumulation of vacation and annual leave credits, resulting in liability for excessive leave balances with a value of at least $8,137,889 as of July 31, 2018 (see Finding 3); 1In planning and performing our audit of compliance, we considered DWR’s internal control over compliance with collective bargaining agreements and state laws, regulations, policies, and procedures to determine the auditing procedures that were appropriate under the circumstances for the purpose of providing a conclusion on compliance, and to test and report on internal control over compliance. Our consideration of internal control over compliance was for the limited purpose described in the first paragraph of this footnote and was not designed to identify all deficiencies in internal control over compliance that might be material weaknesses or significant deficiencies. However, as discussed this section, we identified certain deficiencies in internal control over compliance that we consider to be material weaknesses. A deficiency in internal control over compliance exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance with provisions of laws, regulations, or contracts on a timely basis. Control deficiencies, either individually or in combination with other control deficiencies, may be evaluated as significant deficiencies or material weaknesses. A material weakness in internal control over compliance is a deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected on a timely basis. A significant deficiency is a deficiency, or a combination of deficiencies, in internal control over compliance with provisions of laws, regulations, or contracts that is less severe than a material weakness, yet important enough to merit attention from those charged with governance. -3- California Department of Water Resources Payroll Audit o Improper payments made for overtime pay, leave buy-back, and employee separation lump-sum pay, costing a net total of $408,903 (see Findings 4, 5, and 6); and  Did not administer salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures (see Finding 7). The California State Auditor issued an Investigations of Improper Follow-up on Activities by State Agencies and Employees report regarding investigated Prior Audit allegations of improper governmental activities that were between January Finding 2017 and June 2017. The report included a finding and recommendations that were relevant to our audit objectives. Based on the work performed in the current audit, we noted that DWR has taken appropriate corrective actions in response to the California State Auditor’s finding. Views of We issued a draft audit report on June 18, 2019. Katherine S. Kishaba, Deputy Director, Business Operations, responded by letter dated June 28, Responsible 2019 (Attachment), agreeing with the findings and indicating that DWR Officials will take steps to correct the deficiencies noted. We will follow up during the next payroll audit to verify that the corrective actions are adequate and appropriate. Restricted Use This audit report is solely for the information and use of DWR and the SCO; it is not intended to be and should not be used by anyone other than these specified parties. This restriction is not intended to limit distribution of this audit report, which is a matter of public record and is available on the SCO website at www.sco.ca.gov. Original signed by JIM L. SPANO, CPA Chief, Division of Audits July 15, 2019 -4- California Department of Water Resources Payroll Audit Schedule— Summary of Findings August 1, 2015, through July 31, 2018 Issues as a Total Dollar Number of Dollar Amount Number of Percentage of Dollar Dollar Amount of Finding Selections Method of Selection of Selections Selections with Selections Amount of Amount of Known and Number Issues Audited Selection Unit Audited Issues Audited * Known Issues Likely Issues Likely Issues 1 Inadequate segregation of duties and N/A N/A N/A N/A N/A N/A N/A N/A N/A compensating controls over payroll transactions 2 Inappropriate keying access to the 4 1 Targeted Employee $ - 1 6 39% $ - N/A $ - State’s payroll system 3 Inadequate controls over vacation 4 5 Statistical Employee 650,502 4 5 100% 650,502 $ 7 ,487,387 8 ,137,889 and annual leave balances, resulting in liability for excessive balances 4 Inadequate controls over overtime pay, resulting in improper and questioned payments Overpayments 1 05 Statistical Payment 162,116 3 3% 3 76 1 26,303 126,679 transaction Underpayments 1 0 Random Payment 8,887 1 10% ( 48) N/A (48) selection transaction Overpayments 6 4 Targeted Payment 1 25,820 1 2 19% 6 ,944 N/A 6,944 transaction Questioned payment 1 1 Targeted Payment 1 80,936 1 2% 6 69 N/A 669 transaction 5 Inadequate controls over leave buy- back, resulting in improper and questioned payments Overpayments 1 05 Statistical Payment 397,819 2 2% 4 50 5 ,597 6 ,047 transaction Underpayments --Same selections above-- 4 4% ( 425) ( 5,283) ( 5,708) Questioned payments --Same selections above-- 7 7% 2 3,391 2 90,552 3 13,943 6 Inadequate controls over separation lump-sum pay, resulting in improper payments Overpayments 1 05 Statistical Employee 2,741,744 1 0 10% 1 0,982 4 6,082 5 7,064 Underpayments --Same selections above-- 1 7 16% ( 18,256) ( 76,601) (94,857) Overpayments 1 4 Targeted Employee 2,532,258 1 7% 3 5 N/A 3 5 Underpayments --Same selections above-- 3 21% ( 1,865) N/A (1,865) 7 Inadequate controls over salary 4 Targeted Salary 1 0,499 4 100% 1 0,499 N/A 1 0,499 advances, resulting in failure to advance properly issue and recover transaction outstanding amounts Total $ 6 ,810,581 $ 683,254 $ 7 ,874,037 $ 8 ,557,291 ______________ *All percentages are rounded to the nearest full percentage point. -5- California Department of Water Resources Payroll Audit Findings and Recommendations FINDING 1— DWR lacked adequate segregation of duties within its payroll transactions unit to ensure that only valid and authorized payroll transactions were Inadequate processed. DWR also failed to implement other controls to compensate for segregation of this risk. duties and compensating GC sections 13400 through 13407 require state agencies to establish and controls over maintain internal controls, including proper segregation of duties and an payroll effective system of internal review. Adequate segregation of duties transactions reduces the likelihood that fraud or error will remain undetected by providing for separate processing by different individuals at various stages of a transaction and for independent reviews of the work performed. Our audit found that DWR payroll transactions unit staff performed conflicting duties. Staff members performed multiple steps in processing payroll transactions, including entering data into the State’s payroll system; auditing employee timesheets; reconciling payroll, including reconciling system output to source documentation; reporting payroll exceptions; and processing adjustments. For example, staff members keyed in regular and overtime pay and reconciled the master payroll, overtime, and other supplemental warrants. DWR failed to demonstrate that it had implemented compensating controls to mitigate the risks associated with such a deficiency. We found no indication that these functions were subjected to periodic supervisory review. The lack of adequate segregation of duties and compensating controls has a pervasive effect on the DWR payroll process, and impairs the effectiveness of other controls by rendering their design ineffective or by keeping them from operating effectively. These control deficiencies, in combination with other deficiencies discussed in Findings 2 through 7, represent a material weakness in internal control over the payroll process such that there is a reasonable possibility that material noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. Good internal control practices require that the following functional duties be performed by different work units, or at minimum, by different employees within the same unit:  Recording transactions – This duty refers to the record-keeping function, which is accomplished by entering data into a computer system.  Authorization to execute – This duty belongs to individuals with authority and responsibility to initiate and execute transactions.  Periodic review and reconciliation of actual payments to recorded amounts – This duty refers to making comparisons of information at regular intervals and taking action to resolve differences. -6- California Department of Water Resources Payroll Audit Recommendation We recommend that DWR:  Separate conflicting payroll function duties to the greatest extent possible. Adequate segregation of duties will provide a stronger system of internal control whereby the functions of each employee are subject to the review of another. If it is not possible to segregate payroll functions fully and appropriately, DWR should implement compensating controls. For example, if the payroll transactions unit staff member responsible for recordkeeping also performs a reconciliation process, then the supervisor should perform and document a detailed review of the reconciliation to provide additional control over the assignment of conflicting functions. Compensating controls may also include dual authorization requirements and documented reviews of payroll system input and output; and  Develop formal procedures for performing and documenting compensating controls. DWR lacked adequate controls to ensure that only appropriate staff had FINDING 2— keying access to the State’s payroll system. DWR inappropriately allowed Inappropriate 16 employees keying access to the State’s payroll system. If not mitigated, keying access to the this control deficiency leaves payroll data at risk of misuse, abuse, and State’s payroll unauthorized use. system The SCO maintains the State’s payroll system. The system is decentralized, thereby allowing employees of state agencies to access it. PPSD has established a Decentralized Security Program Manual that all state agencies are required to follow in order to access the payroll system. The program’s objectives are to secure and protect the confidentiality and integrity of payroll data against misuse, abuse, and unauthorized use. We examined the records of 41 DWR employees who had keying access to the State’s payroll system at various times between August 2015 and July 2018. Of the 41 employees, 16 had inappropriate keying access to the State’s payroll system. Specifically, DWR did not immediately remove or modify keying access for 14 employees after the employees’ separation from state service, transfer to another agency, or change in classification. For example, a Personnel Specialist separated from state service on August 7, 2017; DWR did not request to remove the employee’s keying access until November 21, 2017, 106 days later. In addition, two of the 16 employees had keying access to the system while appointed to Associate Government Program Analyst and Associate Personnel Analyst classifications, which are ineligible to have keying access to the payroll system without the required justification; DWR did not provide the justification letter for these employees. The Decentralized Security Program Manual states, in part: The PPSD system contains sensitive and confidential information. Access is restricted to persons with an authorized, legal, and legitimate business requirement to complete their duties. . . . -7- California Department of Water Resources Payroll Audit Currently, PIMS, HIST, KEYM, PIP, LAS, MPC and/or ACAS applications are restricted to Personnel Specialists or Personnel Technician classifications because their need is by definition a function of their specific job duties and any change in those duties requires a reevaluation of the need for access. If the employee’s duties change, such that the need for access no longer exists, the access privilege MUST be removed or deleted immediately by a request submitted by the department/campus. . . . A request to grant access to an individual in a classification other than in the Personnel Specialist/Payroll Technician series to access PIMS, HIST, KEYM, PIP, LAS, MPC and/or ACAS requires a written justification from the Authorizing Manager. The justification must describe the individual's specific job duties requiring the need to access system information (i.e., PIMS = Employment History, HIST=Payroll History, LAS=Leave Accounting System, etc.) as well as level of access to that application, in order to perform their regular daily duties. . . . To prevent unauthorized use by a transferred, terminated or resigned employee's user ID, the Security Monitor must IMMEDIATELY submit all pages of the PSD125A to delete the user’s system access. Using an old user ID increases the chances of a security breach which is a serious security violation. Sharing a user ID is strictly prohibited and a serious violation. Recommendation We recommend that DWR:  Update keying access to the State’s payroll system immediately after employees leave DWR, transfer to another unit, or change classifications; and  Periodically review access to the system to verify that access complies with the Decentralized Security Program Manual. DWR failed to implement controls to ensure that it adheres to the FINDING 3— requirements of collective bargaining agreements and state regulations to Inadequate limit the accumulation of vacation and annual leave credits. These controls over deficiencies resulted in liability for excessive leave balances with a value vacation and of at least $8,137,889 as of July 31, 2018. We expect the liability to annual leave increase if the DWR does not take action to address the excessive vacation balances, resulting and annual leave balances. in liability for excessive balances Collective bargaining agreements and state regulations limit the amount of vacation and annual leave that most state employees may accumulate to no more than 80 days (640 hours). The limit on leave balances helps state agencies manage leave balances and control the State’s liability for accrued leave credits. State agencies may allow employees to carry a higher leave balance only under limited circumstances. For example, an employee may not be able to reduce accrued vacation or annual leave hours below the limit due to business needs. When an employee’s leave accumulation exceeds or is projected to exceed the limit, state agencies should work with the employee to develop a written plan for reducing leave balances below the applicable limit. -8- California Department of Water Resources Payroll Audit Our examination of DWR’s leave accounting records determined that DWR had 3,189 employees with unused vacation or annual leave credits at July 31, 2018. Of those employees, 472 exceeded the limit set by collective bargaining agreements and state regulations. For example, one employee had an accumulated balance of 3,130 hours in annual leave, or 2,490 hours beyond the 640-hour limit. Collectively, the 472 employees accumulated 141,143 hours in excess vacation and annual leave, with a value of at least $8,137,889 as of July 31, 2018. This estimated liability does not adjust for salary rate increases and additional leave credits. 2 Accordingly, we expect that the amount needed to pay for the liability will be higher. For example, a DWR employee separated from state service with 2,099 hours in leave credits, including 1,931 hours in annual leave. After adjusting for additional leave credits, the employee was paid for 2,499 hours, or approximately 19% more. Of the 472 employees who exceeded the limit on vacation and annual leave balances, we randomly selected a statistical sample (as described in the Appendix) of 45 employees, with excess vacation and leave balances valued at $650,502, for further examination of DWR’s compliance with collective bargaining agreements and state regulations. DWR could not demonstrate that it had complied with collective bargaining agreements and state regulations when allowing these employees to maintain excess vacation or annual leave balances. In addition, 18 of the 45 employees did not have plans in place during the audit period to reduce leave balances below the limit. As we used a statistical sampling method to select the employees with excess vacation and annual leave that we examined, we projected the value of likely excess vacation and annual leave balances that did not comply with collective bargaining agreements and state regulations to be $7,487,387. Therefore, the known and likely value of likely excess vacation and annual leave balances that did not comply with collective bargaining agreements and state regulations totaled $8,137,889. The following table summarizes the results of our statistical sampling: Known excess vacation and annual leave balances $ 650,502 Divide by: Sample 650,502 Error rate for projection 100.00% Population that was statistically sampled 8,137,889 Multiply by: Error rate for projection 100.00% Known and likely excess vacation and annual leave balances 8,137,889 Less: Known excess vacation and annual leave balances 650,502 Likely excess vacation and annual leave balances $ 7,487,387 _____________ * Amounts in this table are rounded to the nearest dollar. 2Most state employees receive pay rate increases every year pursuant to state laws and/or collective bargaining agreements until they reach the top of their pay scale, or promote into a higher-paying position. In addition, when an employee’s accumulated leave balances upon separation are calculated for lump-sum pay, the employee is credited with additional leave credits equal to the amount that the employee would have earned had the employee taken time off and not separated from state service. -9- California Department of Water Resources Payroll Audit If DWR does not take action to reduce the excess leave balances, the liability for accrued vacation and annual leave will likely increase because most employees will receive salary increases or use other non- compensable leave credits instead of vacation or annual leave, increasing their vacation or annual leave balances. The state agency responsible for paying these leave balances may face a cash flow problem if a significant number of employees with excessive vacation or annual leave balances separate from state service. Normally, state agencies are not budgeted to make these separation lump-sum payments. However, the State’s current practice dictates that the state agency that last employed an employee pays for that employee’s lump-sum separation payment, regardless of where the employee accrued the leave balance. Recommendation We recommend that DWR:  Implement controls, including existing policies and procedures, to ensure that its employees’ vacation and annual leave balances are maintained within levels allowed by collective bargaining agreements and state regulations;  Conduct ongoing monitoring of controls to ensure that they are implemented and operating effectively; and  Participate in leave buy-back programs if the State offers such programs and funds are available. DWR lacked adequate controls over the processing of overtime pay. We FINDING 4— identified $133,623 in overpayments, $48 in underpayments, and $669 in Inadequate questioned payment for overtime, consisting of $7,320 in overpayments, controls over $48 in underpayments, and $669 in questioned payment based on actual overtime pay, transactions examined (“known”); and $126,303 in overpayments based resulting in on the results of statistical sampling (“likely”). If not mitigated, these improper and control deficiencies leave DWR at risk of additional improper payments questioned for overtime. payments Collective bargaining agreements, and state laws and policies, contain specific clauses regarding overtime pay. Payroll records show that DWR processed 32,944 overtime pay transactions, totaling $55,005,985, between August 2015 and July 2018, as follows: Overtime Payment Type by Group Unit Amount Work Week Group E (items examined 100%) 64 $ 125,820 Work Week Group 2 – Overtime pay for July 2018 (randomly selected items for examination) 111 110,816 Work Week Group 2 – Paid for at least 250 hours (items examined 100%) 11 180,936 Work Week Group 2 – Paid for less than 250 hours (statistically sampled) 32,758 54,588,413 Total population 32,944 $ 55,005,985 _____________ * Amounts in this table are rounded to the nearest dollar. We examined all 64 overtime pay transactions, totaling $125,820, for Work Week Group (WWG) E employees, who are not eligible to receive overtime pay under normal circumstances. Of the 64 transactions, DWR overpaid 12 of them by approximately $6,944. The overpayments -10- California Department of Water Resources Payroll Audit occurred because the payroll transactions unit staff members made payments to employees who were not eligible to receive overtime pay. The California Department of Human Resources’ (CalHR) California State Civil Service Pay Scales, section 10 states, in part: Work Week Group “E” includes classes that are exempted from coverage under the FLSA because of the “white-collar” (administrative, executive, professional) exemptions. To be eligible for this exemption a position must meet both the “salary basis” and the “duties” test. Exempt (WWG E) employees are paid on a “salaried” basis and the regular rate of pay is full compensation for all hours worked to perform assigned duties. However, these employees shall receive up to 8 hours holiday credit when authorized to work on a holiday. Work Week Group E employees shall not receive any form of additional compensation, whether formal or informal, unless otherwise provided by the provisions of this work week group. . . . We also examined all 11 overtime pay transactions, totaling $180,936, for WWG 2 employees who were paid for at least 250 hours of overtime. Of the 11 transactions, we questioned one of them, totaling $669, because DWR could not provide the employee’s timesheet to support that the payment was valid and authorized. Of the 111 overtime pay transactions, totaling $110,816, for overtime worked in July 2018, we randomly selected 10 transactions, totaling $8,887. Of the 10 overtime pay transactions, one was underpaid by $48 because the payroll transactions staff miscalculated the salary rate used to pay for overtime. Of the 32,758 overtime pay transactions, totaling $54,588,413, for WWG 2 employees who were paid for less than 250 hours of overtime, we randomly selected a statistical sample (as described in the Appendix) of 105 transactions, totaling $162,116. Of the 105 transactions, DWR overpaid three of them by approximately $376. As we used a statistical sampling method to select the overtime pay transactions examined, we projected the amount of likely overpayments to be $126,303. Accordingly, the known and likely overpayments totaled $126,679. The following table summarizes the results of our statistical sampling: Known overpayments $ 376 Divide by: Sample 162,116 Error rate for projection (differences due to rounding) 0.23% Population that was statistically sampled 54,588,413 Multiply by: Error rate for projection 0.23% Known and likely overpayments (differences due to rounding) 126,679 Less: Known overpayments 376 Likely overpayments $ 126,303 _____________ * Amounts in this table are rounded to the nearest dollar. -11- California Department of Water Resources Payroll Audit The known overpayments were made because payroll transactions unit staff members miscalculated overtime hours worked, incorrectly paid hours worked at the time-and-a-half rate instead of the straight-time rate, and incorrectly entered overtime pay into the payroll system. DWR also lacked adequate supervisory review to ensure accurate processing of overtime pay. GC sections 13402 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Recommendation We recommend that DWR:  Conduct a review of payments for overtime pay made during the past three years to ensure that the payments complied with collective bargaining agreements and state laws and policies; and  Recover overpayments made to employees through an agreed-upon collection method in accordance with GC section 19838, and properly compensate those employees who were underpaid. We further recommend that, to prevent improper and questioned payments for overtime pay from recurring, DWR:  Establish adequate internal controls to ensure that payments are accurate and comply with collective bargaining agreements and state laws and policies;  Provide adequate oversight to ensure that payroll transactions unit staff process only valid and authorized payments that comply with collective bargaining agreements and state laws and policies; and  Maintain documentation supporting payments pursuant to retention policies. DWR lacked adequate controls over the processing of payments for leave FINDING 5— buy-back. We identified $6,047 in overpayments, $5,708 in Inadequate underpayments, and $313,943 in questioned payments for leave buy-back, controls over leave consisting of $450 in overpayments, $425 in underpayments, and $23,391 buy-back, resulting in questioned payments based on actual transactions reviewed (“known”); in improper and and $5,597 in overpayments, $5,283 in underpayments, and $290,552 in questioned questioned payments based on the results of statistical sampling (“likely”). payments If not mitigated, these control deficiencies leave DWR at risk of additional imIproper leave buy-back payments. n Aa leave-buy back occurs when an employee receives payment at the redgular salary rate in exchange for accrued vacation, annual leave, peersonal leave, personal holiday, and/or holiday credits. Collective baqrgaining agreements between the State and the Collective Bargaining Uunits 1, 2, 4, 9, 10, 11, and 12 allow for the annual cash-out of a certain nuamber of hours of accumulated vacation and annual leave if funds are avtailable. Title 2, California Code of Regulations, section 599.744 also e c -12- o n California Department of Water Resources Payroll Audit provides that CalHR may authorize a leave buy-back program for employees excluded from collective bargaining. CalHR authorized leave buy-backs for excluded employees in fiscal year (FY) 2015-16, FY 2016-17, and FY 2017-18. It also provided the State’s policies and procedures regarding cash-out of vacation and annual leave. Payroll records show that DWR processed 1,407 leave buy-back transactions, totaling $5,339,295, between August 2015 and July 2018. Of these transactions, we randomly selected a statistical sample (as described in the Appendix) of 105, totaling $397,819. Our examination of the 105 transactions determined that DWR overpaid two of them by $450 and underpaid four of them by $425. We also questioned seven transactions, totaling $23,391, because DWR could not provide the required documentation to support that the payments were valid and authorized. Without the supporting documentation, there is no record of employees’ election for leave buy-back, and the required review and approval of the payment. Therefore, we could not determine the validity and propriety of payments for these seven leave buy-back transactions. The known improper and questioned payments totaled a net of approximately $23,416. As we used a statistical sampling method to select the leave buy-back transactions examined, we projected the amount of likely overpayments to be $5,597 and likely underpayments to be $5,283. We could also estimate that there may have been additional missing supporting documentation associated with leave buy-back, totaling $290,552. As supporting documentation is necessary to authorize pay, we would also question these payments for leave buy-back. The likely improper and questioned payments totaled a net of approximately $290,866. Therefore, the known and likely improper and questioned payments totaled a net of approximately $314,282, consisting of $6,047 in overpayments, $5,708 in underpayments, and $313,943 in questioned payments. The following table summarizes the results of our statistical sampling: Known improper and questioned payments, net $ 23,416 Divide by: Sample 397,819 Error rate for projection (differences due to rounding) 5.89% Population that was statistically sampled 5,339,295 Multiply by: Error rate for projection 5.89% Known and likely improper and questioned payments, net (differences due to rounding) 314,282 Less: Known improper and questioned payments, net 23,416 Likely improper and questioned payments, net $ 290,866 _____________ * Amounts in this table are rounded to the nearest dollar. The known improper payments were made because payroll transactions unit staff members miscalculated leave buy-back payments and incorrectly entered payments into the payroll system. DWR also lacked adequate supervisory review to ensure accurate processing of leave buy-back transactions. -13- California Department of Water Resources Payroll Audit GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. Recommendation We recommend that DWR:  Conduct a review of payments for leave buy-back made during the past three years to ensure that the payments complied with collective bargaining agreements and state laws and policies; and  Recover overpayments made to employees through an agreed-upon collection method in accordance with GC section 19838, and properly compensate those employees who were underpaid. We further recommend that, to prevent improper and questioned leave buy-back payments from recurring, DWR:  Establish adequate internal controls to ensure that payments for leave buy-back are accurate, and comply with collective bargaining agreements and state laws and policies;  Provide adequate oversight to ensure that payroll transactions unit staff process only valid and authorized payments that comply with collective bargaining agreements and state laws and policies; and  Maintain documentation supporting payments pursuant to retention policies. DWR lacked adequate controls over the processing of employee FINDING 6— separation lump-sum pay. We identified $57,099 in overpayments and Inadequate $96,722 in underpayments for separation lump-sum pay, consisting of controls over $11,017 in overpayments and $20,121 in underpayments based on actual separation lump- transactions examined (“known”); and $46,082 in overpayments and sum pay, resulting $76,601 in underpayments based on the results of statistical sampling in improper (“likely”). If not mitigated, the control deficiencies leave DWR at risk of payments additional improper separation lump-sum payments. I GnC section 19839 allows lump-sum payment for accrued eligible leave craedits when an employee separates from state employment. Collective badrgaining agreements include similar provisions regarding separation luemp-sum pay. q Pauyroll records show that DWR processed payments for separation lump- suam pay, totaling $16,778,108, for 642 employees between August 2015 antd July 2018, as follows: e Separaticon Lump-sum Pay Group Unit Amount Employees who were paid aot least $150,000 (items examined 100%) 14 $ 2,532,258 Employees who were paid lenss than $150,000 (statistically sampled) 628 14,245,850 Total population t 642 $ 16,778,108 r _____________ o * Amounts in this table are rounded to the nearest dollar. l s o v -14- e r California Department of Water Resources Payroll Audit We examined the separation lump-sum pay for the 14 employees with the highest payments, totaling $2,532,258. Of the 14 employees, DWR overpaid one of them by approximately $35 and underpaid three of them by approximately $1,865. Of the remaining 628 payments to employees, totaling $14,245,850, we randomly selected a statistical sample (as described in the Appendix) of 105 employees who received separation lump-sum pay, totaling $2,741,744. Our examination of lump-sum payments made to these 105 employees showed that DWR overpaid 10 of them by approximately $10,982 and underpaid 17 of them by approximately $18,256. These payments resulted in net total improper payments of $7,274. As we used a statistical sampling method to select the employees whose payments for separation lump-sum pay were examined, we projected the amount of likely overpayments to be $46,082 and likely underpayments to be $76,601. These payments resulted in net total improper payments of $30,519. Therefore, the known and likely improper payments totaled a net of approximately $37,793, consisting of $57,064 in overpayments and $94,857 in underpayments. The following table summarizes the results of our statistical sampling: Known improper payments, net $ (7,274) Divide by: Sample 2,741,744 Error rate for projection (differences due to rounding) (0.27%) Population that was statistically sampled 14,245,850 Multiply by: Error rate for projection (0.27%) Known and likely improper payments, net (differences due to rounding) (37,793) Less: Known improper payments, net (7,274) Likely improper payments, net $ (30,519) _____________ * Amounts in this table are rounded to the nearest dollar. The known improper payments were made because payroll transactions unit staff members miscalculated leave balances paid. DWR also lacked adequate supervisory review to ensure accurate processing of separation lump-sum pay. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. Recommendation We recommend that DWR:  Establish adequate controls to ensure accurate calculation and payment of separation lump-sum pay;  Conduct a review of separation lump-sum payments made during the past three years to ensure that the payments were accurate and in compliance with collective bargaining agreements and state law; and -15- California Department of Water Resources Payroll Audit  Recover overpayments made to separated employees in accordance with GC section 19838 and State Administrative Manual (SAM) section 8776.6, and properly compensate those employees who were underpaid. DWR lacked adequate controls over salary advances to ensure that FINDING 7— advances were issued and recovered in accordance with state law and Inadequate policies. Three salary advances, totaling $10,246, were issued without controls over proper review and approval. One unrecovered salary advance, with a salary advances, balance of $253, was outstanding for over 12 years. This control resulting in failure deficiency leaves DWR at risk of further failures to properly issue and to properly issue collect salary advances if not mitigated. and recover outstanding At July 31, 2018, DWR’s accounting records showed eight outstanding amounts salary advances, totaling $27,292, including one balance of $253 that was ouItstanding for more than 120 days. Generally, the prospect of collection dinminishes as an account ages. When an agency is unable to collect after three years, the possibility of collection is remote. a d GC section 19838 and SAM sections 8776 and 8776.7 describe the State’s e collection policies and procedures, which require DWR to collect salary q advances in a timely manner and maintain proper records of collection u efforts. a Wte examined four of the eight outstanding salary advances, totaling $1e0 ,499. Three of the four salary advances, totaling $10,246, had not been recviewed and approved by an authorized individual. DWR’s Enterprise Proocess Guide - Accounts Payable 1: Requesting a Salary Advance states, inn part: t Chief, Payroll, Benefits and SAP Administration...Reviews and r approves the request by signing and dating page two of the DWR 408, o and returns the request to the Personnel Supervisor for processing of the l salary advance. . . . s Ino addition, DWR could not provide supporting documentation for one of thve four salary advances, with a balance of $253. This salary advance has been outstanding for over 12 years. SAM section 8776 requires agencies e to maintain proper records of collection efforts and payment of salary r advances. s a We also noted that that DWR’s policies do not require the cancellation of l direct deposit before an employee receives a salary advance. This creates a arisk of overpayment because employees could receive salary advances anrd their regular pay at the same time. y SCaO’s Payroll Procedures Manual, section J 008 states, in part: d v Agencies/campuses should not issue a salary advance to an employee who has an active Direct Deposit. An agency/campus should first submit a a STD. 699 to cancel the employee’s Direct Deposit before an advance n is issued. . . . c e s , -16- r e California Department of Water Resources Payroll Audit The lack of adequate controls over salary advances reduces the likelihood of collection, increases the amount of resources expended on collection efforts, and negatively impacts cash flow. Recommendation We recommend that DWR:  Issue salary advances in accordance with existing policies and procedures;  Ensure that it recovers salary advances in a timely manner pursuant to GC section 19838 and SAM sections 8776 and 8776.7; and  Maintain documentation of its collection efforts and payment of salary advances. -17- California Department of Water Resources Payroll Audit Appendix— Audit Sampling Methodology August 1, 2015, through July 31, 2018 We used attributes sampling for tests of compliance. The following table outlines our audit sampling application for audit areas that included errors: Results Expected Projected to Audit Type Population Population Sampling Sample Selection Confidence Tolerable Error Sample Intended Finding Area of Test (Unit) (Dollar) Unit Method Level Error Rate (Rate) ¹ Size Population Number Excess vacation and Compliance 4 72 $ 8 ,137,889 Employee Computer-generated 90% 5% 0 45 Yes 3 annual leave balances simple random (0%) Overtime pay Compliance 3 2,758 $ 5 4,588,413 Payment Computer-generated 90% 5% 2 105 Yes 4 (Work Week Group 2 – transactions simple random (1.75%) Paid for less than 250 hours) Leave buy-back Compliance 1,407 $ 5 ,339,295 Payment Computer-generated 90% 5% 2 105 Yes 5 transactions simple random (1.75%) Separation lump-sum pay Compliance 6 28 $ 1 4,245,850 Employee Computer-generated 90% 5% 2 105 Yes 6 simple random (1.75%) ______________________ 1 Pursuant to the AICPA’s Audit Guide: Audit Sampling (May 1, 2017 edition), pages 131-133, the expected error is the expected number of errors planned for in the sample. It is derived by multiplying the expected error rate by the sample size. The expected number of errors in the sampling tables on pages 135-136 was rounded upward, e.g., 0.2 errors becomes 1 error. -A1- California Department of Water Resources Payroll Audit Attachment— California Department of Water Resources’s Response to Draft Audit Report State Controller’s Office Division of Audits Post Office Box 942850 Sacramento, CA 94250 http://www.sco.ca.gov S19-PAR-0004