Financial Information System for California - Payroll Process Review

FINANCIAL INFORMATION SYSTEM FOR CALIFORNIA Review Report PAYROLL PROCESS REVIEW November 1, 2014, through October 31, 2017 BETTY T. YEE California State Controller July 2019 BETTY T. YEE California State Controller July 15, 2019 Miriam Barcellona Ingenito, Director Financial Information System for California 2000 Evergreen Street, Suite 120 Sacramento, CA 95815 Dear Ms. Ingenito: The State Controller’s Office reviewed the Financial Information System for California’s (FI$Cal) payroll process for the period of November 1, 2014, through October 31, 2017. FI$Cal management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. Our review found material weaknesses in internal control over the FI$Cal payroll process. These weaknesses contributed to FI$Cal employees’ excessive vacation and annual leave balances, excessive compensating time-off balances, improper and questioned payments, and improper leave credits, costing the State an estimated net total of $436,278. If you have any questions, please contact Andrew Finlayson, Chief, State Agency Audits Bureau, by telephone at (916) 324-6310. Sincerely, Original signed by JIM L. SPANO, CPA Chief, Division of Audits JLS/ls cc: Gam Thai, Chief, Human Resources Financial Information System for California Leandrea Fitzgerald, Personnel Officer Financial Information System for California Mark Rodriguez, Chief, Administrative Services Division California Department of Human Resources Marissa Revelino, Chief Personnel and Payroll Services Division State Controller’s Office Financial Information System for California Payroll Process Review Contents Review Report Summary ............................................................................................................................ 1 Background ........................................................................................................................ 1 Objectives, Scope, and Methodology ............................................................................... 2 Conclusion .......................................................................................................................... 3 Views of Responsible Officials .......................................................................................... 4 Restricted Use .................................................................................................................... 4 Schedule—Summary of Findings ......................................................................................... 5 Findings and Recommendations ........................................................................................... 6 Appendix—Sampling Methodology ..................................................................................... A1 Attachment—Financial Information System for California’s Response to Draft Review Report Financial Information System for California Payroll Process Review Review Report Summary The State Controller’s Office (SCO) reviewed the Financial Information System for California (FI$Cal) payroll process and transactions for the period of November 1, 2014, through October 31, 2017. FI$Cal management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. Our limited review identified material weaknesses in internal control over the FI$Cal payroll process that leave FI$Cal at risk of additional improper payments if not mitigated. We found that FI$Cal has a combination of deficiencies in internal control over its payroll process such that there is a reasonable possibility that a material misstatement in financial information or noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. Specifically, FI$Cal lacked adequate segregation of duties and compensating controls over its processing of payroll transactions. In addition, FI$Cal inappropriately allowed three employees keying access to the State’s payroll system, leaving payroll data at risk of misuse, abuse, and unauthorized use. These deficiencies have a pervasive effect on the FI$Cal payroll process, and impair the effectiveness of other controls by rendering their design ineffective or by keeping them from operating effectively. We also found that FI$Cal lacked sufficient controls over the processing of specific payroll-related transactions to ensure that FI$Cal complied with collective bargaining agreements and state laws, and that only valid and authorized payments were processed. As quantified in the Schedule, these deficiencies contributed to FI$Cal employees’ excessive vacation and annual leave balances; excessive compensating time-off (CTO) balances; improper and questioned payments for separation lump-sum pay, overtime pay, regular pay, and leave buy-back; and improper CTO and holiday credits, costing the State an estimated net total of $436,278. Background In 1979, the State of California adopted collective bargaining for state employees. This created a significant workload increase for the SCO’s Personnel and Payroll Services Division (PPSD), as PPSD was the State’s centralized payroll processing center for all payroll-related transactions. PPSD decentralized the processing of payroll, allowing state agencies and departments to process their own payroll-related transactions. Periodic reviews of the decentralized payroll processing at state agencies and departments ceased due to the budget constraints in the late 1980s. In 2013, the California State Legislature reinstated these payroll reviews to gain assurance that state agencies and departments maintain adequate internal control over payroll, provide proper oversight over their decentralized payroll processing, and comply with various state laws and regulations regarding payroll processing and related transactions. -1- Financial Information System for California Payroll Process Review Review Authority Authority for this review is provided by California Government Code (GC) section 12476, which states, “The Controller may audit the uniform state pay roll system, the State Pay Roll Revolving Fund, and related records of state agencies within the uniform state pay roll system, in such manner as the Controller may determine.” In addition, GC section 12410 stipulates that “The Controller shall superintend the fiscal concerns of the state. The Controller shall audit all claims against the state, and may audit the disbursement of any state money, for correctness, legality, and for sufficient provisions of law for payment.” Objectives, Scope, We performed this review to determine whether FI$Cal: and Methodology  Processed payroll and payroll-related disbursements accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures;  Established adequate internal control over payroll to meet the following control objectives: o Payroll and payroll-related transactions are properly approved and certified by authorized personnel; o Only valid and authorized payroll and payroll-related transactions are processed; o Payroll and payroll-related transactions are accurate and properly recorded; o Payroll systems, records, and files are adequately safeguarded; o State laws, regulations, policies, and procedures are complied with regarding payroll and payroll-related transactions;  Complied with existing controls as part of the ongoing management and monitoring of payroll and payroll-related expenditures;  Maintained accurate records of leave balances; and  Administered and recorded salary advances properly and in accordance with state laws, regulations, policies, and procedures. We reviewed the FI$Cal payroll process and transactions for the period of November 1, 2014, through October 31, 2017. To achieve our objectives, we:  Reviewed state and FI$Cal policies and procedures related to the payroll process to understand FI$Cal’s methodology for processing various payroll and payroll-related transactions;  Interviewed FI$Cal payroll personnel to understand FI$Cal’s methodology for processing various payroll and payroll-related transactions, determine their level of knowledge and ability relating to payroll transaction processing, and gain an understanding of existing internal control over the payroll process and systems; -2- Financial Information System for California Payroll Process Review  Selected transactions recorded in the State’s payroll database using statistical sampling as outlined in the Appendix, and targeted selection based on risk factors and other criteria for review;  Analyzed and tested transactions recorded in the State’s payroll database, and reviewed relevant files and records to determine the accuracy of payroll and payroll-related payments, accuracy of leave transactions, propriety of review and approval of transactions, adequacy of internal control over the payroll process and systems, and compliance with collective bargaining agreements and state laws, regulations, policies, and procedures (errors found in statistically- determined samples were projected to the intended population); and  Reviewed salary advances to determine whether FI$Cal administered and recorded them in accordance with state laws, regulations, policies, and procedures. Conclusion Based on the results of our review, we found that FI$Cal administered and recorded salary advances properly and in accordance with state laws, regulations, policies, and procedures. However, we also found that FI$Cal:  Did not process payroll and payroll-related disbursements accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures (see Findings 3 through 8);  Lacked adequate internal control over payroll and payroll-related transactions (see Findings 1 through 8);  Did not comply with existing controls as part of the ongoing management and monitoring of payroll and payroll-related expenditures (see Findings 2 and 3); and  Did not maintain accurate records of leave balances (see Findings 4, 5, and 7). As quantified in the Schedule and described in the Findings and Recommendations section of this review report, these material weaknesses1 in internal control over the payroll process contributed to FI$Cal employees’ excessive vacation and annual leave balances; excessive CTO balances; improper and questioned payments; and improper CTO and holiday credits, costing the State an estimated net total of $436,278. 1An evaluation of an entity’s payroll process may identify deficiencies in its internal control over the process. A deficiency in internal control exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, misstatements in financial information, impairments of effectiveness or efficiency of operations, or noncompliance with provisions of laws, regulations, or contracts on a timely basis. Control deficiencies, either individually or in combination with other control deficiencies, may be evaluated as significant deficiencies or material weaknesses. A material weakness is a deficiency, or a combination of deficiencies, in internal control such that there is a reasonable possibility that a material misstatement in financial information, impairment of effectiveness or efficiency of operations, or noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. A significant deficiency is a deficiency, or a combination of deficiencies, in internal control that is less severe than a material weakness, yet important enough to merit attention from those charged with governance. -3- Financial Information System for California Payroll Process Review Views of We issued a draft review report on June 14, 2019. Gam Thai, Chief, Human Resources, responded by letter dated June 28, 2019 (Attachment), Responsible acknowledging the findings and indicating that FI$Cal has taken steps Officials since the review period to correct the deficiencies noted. We will follow up during the next payroll review to verify that the corrective actions are adequate and appropriate. Restricted Use This report is solely for the information and use of FI$Cal and the SCO; it is not intended to be and should not be used by anyone other than these specified parties. This restriction is not intended to limit distribution of this review report, which is a matter of public record and is available on the SCO website at www.sco.ca.gov. Original signed by JIM L. SPANO, CPA Chief, Division of Audits July 15, 2019 -4- Financial Information System for California Payroll Process Review Schedule— Summary of Findings November 1, 2014, through October 31, 2017 Issues as a Dollar Dollar Total Dollar Number of Dollar Amount Number of Percentage of Amount of Amount of Amount of Finding Selections Method of Selection of Selections Selections with Selections Known Likely Known and Number Issues Reviewed Selection Unit Reviewed Issues Reviewed * Issues Issues Likely Issues 1 Inadequate segregation of duties and N/A N/A N/A N/A N/A N/A N/A N/A N/A compensating controls over payroll transactions 2 Inappropriate keying access to the 1 2 Targeted Employee $ - 3 25% $ - $ - $ - State's payroll system 3 Inadequate controls over vacation and 1 4 Targeted Employee 259,725 1 4 100% 259,725 N/A 259,725 annual leave balances, resulting in liability for excessive balances 4 Inadequate controls over CTO, resulting in liability for excessive balances and improper credits Excess balances 4 Targeted Employee 9 1,194 4 100% 9 1,194 N/A 9 1,194 Over-credits 5 1 Statistical CTO 4 8,842 9 18% 2 ,693 7 ,551 1 0,244 transaction Under-credits -- Same selections above -- 1 1 22% ( 3,628) ( 10,174) ( 13,802) Questioned credits -- Same selections above -- 2 4% 9 58 2 ,687 3 ,645 5 Inadequate controls over separation lump-sum pay, resulting in improper payments Overpayments 3 3 Targeted Employee 480,341 7 21% 28,615 N/A 2 8,615 Underpayments -- Same selections above -- 8 24% (2,803) N/A (2,803) 6 Inadequate controls over overtime and regular pay, resulting in improper and questioned payments Overpayments (overtime pay) 6 0 Statistical Payment 195,736 1 0 17% 1,386 6 ,534 7,920 transaction Underpayments (overtime pay) -- Same selections above -- 6 10% (386) (1,824) (2,210) Questioned payments (overtime pay) -- Same selections above -- 1 2% 122 577 6 99 Overpayments (overtime pay) 5 Targeted Payment 3 1,474 3 60% 14,759 N/A 1 4,759 transaction Questioned payments (regular Pay) 6 0 Statistical Payment 313,874 1 2% 4,712 2 3,894 2 8,606 transaction 7 Inadequate controls over holiday credit 5 1 Statistical Holiday credit 14,939 9 18% 2,681 7,338 1 0,019 transactions, resulting in improper transaction credits 8 Inadequate controls over leave buy- 5 1 Statistical Payment 126,606 1 2% (150) (183) ( 333) back, resulting in underpayments transaction Total $ 1 ,562,731 $ 399,878 $ 36,400 $ 436,278 ______________________ *All percentages are rounded to the nearest full percentage point. -5- Financial Information System for California Payroll Process Review Findings and Recommendations FINDING 1— FI$Cal lacked adequate segregation of duties within its payroll transactions unit to ensure that only valid and authorized payroll Inadequate transactions were processed. FI$Cal also failed to implement other segregation of controls to compensate for this risk. duties and compensating GC sections 13400 through 13407 require state agencies to establish and controls over maintain internal controls, including proper segregation of duties and an payroll effective system of internal review. Adequate segregation of duties transactions reduces the likelihood that fraud or error will remain undetected by providing for separate processing by different individuals at various stages of a transaction and for independent reviews of the work performed. Our review found that FI$Cal payroll transactions unit staff performed conflicting duties. Staff members performed multiple steps in processing payroll transactions, including entering data into the State’s payroll system; auditing employee timesheets; reconciling payroll, including reconciling system output to source documentation; reporting payroll exceptions; and processing adjustments. For example, staff members keyed in regular and overtime pay and reconciled the master payroll, overtime, and other supplemental warrants. FI$Cal failed to demonstrate that it implemented compensating controls to mitigate the risks associated with such a deficiency. We found no indication that these functions were subjected to periodic supervisory review. The lack of adequate segregation of duties and compensating controls has a pervasive effect on the FI$Cal payroll process, and impairs the effectiveness of other controls by rendering their design ineffective or by keeping them from operating effectively. These control deficiencies, in combination with other deficiencies discussed in Findings 2 through 8, represent a material weakness in internal control over the payroll process such that there is a reasonable possibility that a material misstatement in financial information or noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. Good internal control practices require that the following functional duties be performed by different work units, or at minimum, by different employees within the same unit:  Recording transactions – This duty refers to the record-keeping function, which is accomplished by entering data into a computer system.  Authorization to execute – This duty belongs to individuals with authority and responsibility to initiate and execute transactions.  Periodic review and reconciliation of actual payments to recorded amounts – This duty refers to making comparisons of information at regular intervals and taking action to resolve differences. -6- Financial Information System for California Payroll Process Review Recommendation We recommend that FI$Cal:  Separate conflicting payroll function duties to the greatest extent possible. Adequate segregation of duties will provide a stronger system of internal control whereby the functions of each employee are subject to the review of another. If it is not possible to segregate payroll functions fully and appropriately, FI$Cal should implement compensating controls. For example, if the payroll transactions unit staff member responsible for recordkeeping also performs a reconciliation process, then the supervisor should perform and document a detailed review of the reconciliation to provide additional control over the assignment of conflicting functions. Compensating controls may also include dual- authorization requirements and documented reviews of payroll system input and output; and  Develop formal procedures for performing and documenting compensating controls. FINDING 2— FI$Cal lacked adequate controls to ensure that only appropriate staff had keying access to the State’s payroll system. FI$Cal inappropriately Inappropriate allowed three employees keying access to the State’s payroll system. If not keying access to the mitigated, this control deficiency leaves payroll data at risk of misuse, State’s payroll abuse, and unauthorized use. system The SCO maintains the State’s payroll system. The system is decentralized, thereby allowing employees of state agencies to access it. PPSD has established a Decentralized Security Program Manual that all state agencies are required to follow in order to access the payroll system. The program’s objectives are to secure and protect the confidentiality and integrity of payroll data against misuse, abuse, and unauthorized use. We reviewed the records of 12 FI$Cal employees who had keying access to the State’s payroll system at various times between November 2014 and October 2017. Of the 12 employees, three had inappropriate keying access to the State’s payroll system. FI$Cal did not immediately remove or modify the employees’ keying access after their separation from state service, transfer to another agency or unit, or change in classification. One employee separated on March 29, 2017; the request to delete the employee’s access was not made until May 25, 2017, 57 days later. The Decentralized Security Program Manual states, in part: The PPSD system contains sensitive and confidential information. Access is restricted to persons with an authorized, legal, and legitimate business requirement to complete their duties. . . . Currently, PIMS, HIST, KEYM, PIP, LAS, MPC and/or ACAS applications are restricted to Personnel Specialists or Personnel Technician classifications because their need is by definition a function of their specific job duties and any change in those duties requires a reevaluation of the need for access. -7- Financial Information System for California Payroll Process Review If the employee’s duties change, such that the need for access no longer exists, the access privilege MUST be removed or deleted immediately by a request submitted by the department/campus. . . . To prevent unauthorized use by a transferred, terminated or resigned employee's user ID, the Security Monitor must IMMEDIATELY submit all pages of the PSD125A to delete the user’s system access. Using an old user ID increases the chances of a security breach which is a serious security violation. Sharing a user ID is strictly prohibited and a serious violation. Recommendation We recommend that FI$Cal:  Update keying access to the State’s payroll system immediately after employees leave FI$Cal, transfer to another unit, or change classifications; and  Periodically review access to the system to verify that access complies with the Decentralized Security Program Manual. FI$Cal failed to implement controls to ensure that it adheres to the FINDING 3— requirements of collective bargaining agreements and state regulations to Inadequate limit the accumulation of vacation and annual leave credits. These controls over deficiencies resulted in liability for excessive leave balances with a value vacation and of at least $259,725 as of October 31, 2017. We expect the liability to annual leave increase if FI$Cal does not take action to address the excessive vacation balances, resulting and annual leave balances. in liability for excessive balances Collective bargaining agreements and state regulations limit the amount of vacation and annual leave that most state employees may accumulate to no more than 80 days (640 hours). The limit on leave balances helps state agencies manage leave balances and control the State’s liability for accrued leave credits. State agencies may allow employees to carry a higher leave balance only under limited circumstances. For example, an employee may not be able to reduce accrued vacation or annual leave hours below the limit due to business needs. When an employee’s leave accumulation exceeds or is projected to exceed the limit, state agencies should work with the employee to develop a written plan to reduce leave balances below the applicable limit. Our review of FI$Cal’s leave accounting records determined that FI$Cal had 80 employees with unused vacation or annual leave credits at October 31, 2017. Of those employees, 14 exceeded the limit set by collective bargaining agreements and state regulations. For example, one employee had an accumulated balance of 1,593 hours of annual leave, or 953 hours beyond the 640-hour limit. Collectively, the 14 employees accumulated 4,691 hours of excess vacation and annual leave, with a value of at least $259,725 as of October 31, 2017. This estimated liability does not adjust for salary rate increases and additional leave credits.2 2Most state employees receive pay rate increases every year pursuant to state laws and/or collective bargaining agreements until they reach the top of their pay scale, or promote into a higher-paying position. In addition, when an employee’s accumulated leave balances upon separation are calculated for lump-sum pay, the employee is credited with additional leave credits equal to the amount that the employee would have earned had the employee taken time off and not separated from state service. -8- Financial Information System for California Payroll Process Review Accordingly, we expect that the amount needed to pay for this liability will be higher. For example, a FI$Cal employee separated from state service with 1,057 hours in leave credits, including 910 hours in annual leave. After adjusting for additional leave credits, the employee was paid for 1,219 hours, or 15% more. We performed an additional review of the records for these 14 employees to determine whether FI$Cal complied with collective bargaining agreements and state regulations. We determined that FI$Cal could not demonstrate that it had complied with collective bargaining agreements and state regulations when allowing the 14 employees to maintain excess vacation or annual leave balances. We also found that FI$Cal and the employees had no plans in place to reduce leave balances below the limit. Furthermore, we found that FI$Cal did not have any policies and procedures regarding reduction of excess leave. If FI$Cal does not take action to reduce the excessive leave balances, the liability for accrued vacation and annual leave will likely increase because most employees will receive salary increases or use other non- compensable leave credits instead of vacation or annual leave, increasing their vacation or annual leave balances. The state agency responsible for paying these leave balances may face a cash flow problem if a significant number of employees with excessive vacation or annual leave balances separate from state service. Normally, state agencies are not budgeted to make these separation lump-sum payments. However, the State’s current practice dictates that the state agency that last employed an employee pays for that employee’s lump-sum separation payment, regardless of where the employee accrued the leave balance. Recommendation We recommend that FI$Cal:  Implement controls, including existing state policies and procedures, to ensure that its employees’ vacation and annual leave balances are maintained within levels allowed by collective bargaining agreements and state regulations;  Conduct ongoing monitoring of controls to ensure that they are implemented and operating effectively; and  Participate in leave buy-back programs if the State offers such programs and funds are available. FI$Cal lacked adequate controls to ensure that it adheres to the FINDING 4— requirements of collective bargaining agreements to limit the Inadequate accumulation of CTO, and to ensure that the processing of CTO credits is controls over CTO, proper. We identified a liability for excessive CTO balances with a value resulting in liability of at least $91,194 as of October 31, 2017. We also identified $10,244 in for excessive over-credits, $13,802 in under-credits, and $3,645 in questioned credits for balances and CTO, consisting of $2,693 in over-credits, $3,628 in under-credits, and improper credits $958 in questioned credits based on actual transactions reviewed (“known”); and $7,551 in over-credits, $10,174 in under-credits, and $2,687 in questioned credits based on the results of statistical sampling -9- Financial Information System for California Payroll Process Review (“likely”). If not mitigated, these control deficiencies leaves FI$Cal at risk of additional liability for excessive CTO balances and improper CTO credits. The collective bargaining agreement between the State and Bargaining Unit 1 allows employees to accrue up to 240 CTO hours. State agencies should compensate employees in cash for all hours in excess of 240 hours. The limit on leave balances helps state agencies manage leave balances and control the State’s liability for accrued leave credits. The collective bargaining agreement also contains specific clauses regarding granting of CTO in lieu of cash for overtime worked. Leave accounting records showed that four FI$Cal employees exceeded the 240-hour limit for CTO by 2,006 hours, with an estimated value of at least $91,194, at October 31, 2017. One employee had 1,017 CTO hours, or 777 hours beyond the 240-hour limit. This estimated liability does not adjust for salary rate increases. 3 Accordingly, we expect that the amount needed to pay for this liability will be higher than it would have been if the excess CTO balances had been paid for at the time the employees earned them, as required. We also determined that FI$Cal processed 231 transactions, with an estimated value of $185,781, to accrue CTO between November 2014 and October 2017. Of these transactions, we randomly selected a statistical sample (as described in the Appendix) of 51 transactions, totaling $48,842. Our review of the 51 transactions determined that FI$Cal granted more CTO hours than employees were entitled to receive in nine (“over- credits”) transactions, worth approximately $2,693. In addition, FI$Cal did not grant all earned CTO hours to other employees (“under-credits”) in 11 transactions, worth approximately $3,628. Our review of CTO transactions also showed a lack of supporting documentation for two transactions, approximately $958. Without timesheets, there is no record of hours worked or supervisory review and approval. We could not determine the validity and authorization for these CTO transactions. As a result, we questioned these two CTO transactions. As we used a statistical sampling method to select the CTO transactions examined, we projected the amount of likely over-credits to be $7,551 and under-credits to be $10,174. We could also estimate that additional missing timesheets may have been associated with CTO credits, worth at least $2,687. As timesheets are required documents to authorize compensation in CTO hours, we would also question these CTO credits. Therefore, the known and likely improper and questioned CTO credits totaled a net approximate $87, consisting of $10,244 in over-credits, $13,802 in under-credits, and $3,645 in questioned credits. 3See footnote 2. -10- Financial Information System for California Payroll Process Review The following table summarizes the results of our statistical sampling: Known improper and questioned CTO credits, net $ 23 Divide by: Sample 48,842 Error rate for projection (differences due to rounding) 0.05% Population that was statistically sampled 185,781 Multiply by: Error rate for projection 0.05% Known and likely improper and questioned CTO credits, net (differences due to rounding) 87 Less: Known improper and questioned CTO credit, net 23 Likely improper and questioned CTO credits, net $ 64 _____________ * Amounts in this table are rounded to the nearest dollar. The known improper CTO credits were made because the payroll transactions unit staff members miscalculated overtime hours worked. FI$Cal also lacked adequate supervisory review to ensure accurate processing of CTO credits. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. Recommendation We recommend that FI$Cal:  Implement controls, including existing policies and procedures, to ensure that its employees’ CTO balances are maintained within levels allowed by collective bargaining agreements;  Establish adequate controls to ensure that CTO credits granted are valid and comply with collective bargaining agreements;  Conduct ongoing monitoring of controls to ensure that they are implemented and operating effectively;  Compensate employees in cash for CTO hours in excess of the 240- hours limit;  Conduct a review of CTO credits granted during the past three years to ensure that credits complied with collective bargaining agreements; and  Correct any improper CTO credits in the State’s leave accounting system. FI$Cal lacked adequate controls over the processing of employee FINDING 5— separation lump-sum pay. We identified $28,615 in overpayments and Inadequate $2,803 in underpayments for separation lump-sum pay. If not mitigated, controls over the control deficiency leaves FI$Cal at risk of additional improper separation lump- payments for separation lump-sum pay. sum pay, resulting in improper GC section 19839 allows lump-sum payment for accrued eligible leave payments credits when an employee separates from state employment. Collective bargaining agreements include similar provisions regarding separation lump-sum pay. -11- Financial Information System for California Payroll Process Review Payroll records show that FI$Cal processed payments for separation lump- sum pay, totaling $480,341, for 33 employees between November 2014 and October 2017. We examined the separation lump-sum pay for all 33 employees and determined that FI$Cal overpaid seven of them by approximately $28,615 and underpaid eight of them by approximately $2,803. For one of the seven overpayments, the overpayment was made because the employee rescinded his separation from state service after the separation lump-sum pay was granted. The overpayment included leave credits that the employee was credited with when the employee’s leave balances were calculated for lump-sum pay. The remaining overpayments and underpayments were made because payroll transactions unit staff members miscalculated leave balances paid and keyed incorrect leave hours for separation lump-sum pay into the State’s payroll system. FI$Cal also lacked adequate supervisory review to ensure accurate processing of separation lump-sum pay. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. Recommendation We recommend that FI$Cal:  Establish adequate controls to ensure accurate calculation and proper payment of separation lump-sum pay;  Conduct a review of payments for separation lump-sum pay made after the review period to ensure that the payments were accurate and in compliance with collective bargaining agreements and state law; and  Recover overpayments made to separated employees in accordance with GC section 19838 and State Administrative Manual section 8776.6, and properly compensate those employees who were underpaid. FI$Cal lacked adequate controls over the processing of overtime and FINDING 6— regular pay. We identified $22,679 in overpayments, $2,210 in Inadequate underpayments, and $699 in questioned payments for overtime pay, controls over consisting of $16,145 in overpayments, $386 in underpayments, and $122 overtime and in questioned payments based on actual transactions reviewed (“known”); regular pay, and $6,534 in overpayments, $1,824 in underpayments, and $577 in resulting in questioned payments based on the results of statistical sampling (“likely”). improper and In addition, we identified $28,606 in questioned payments for regular pay, questioned consisting of $4,712 based on actual transactions reviewed (“known”); and payments $23,894 based on the results of statistical sampling (“likely”). If not mitigated, these control deficiencies leave FI$Cal at risk of additional improper payments for overtime and regular pay. -12- Financial Information System for California Payroll Process Review Collective bargaining agreements, and state laws and policies, contain specific clauses regarding overtime and regular pay. Payroll records show that FI$Cal processed 392 overtime pay transactions, totaling $234,684 between November 2014 and October 2017, as follows: Overtime Payment Type by Group Unit Amount Work Week Group E (items examined 100%) 6 $ 7,473 Work Week Group 2 – Paid for at least 100 hours (items examined 100%) 5 31,474 Work Week Group 2 – Paid for less than 100 hours (statistically sampled) 381 195,736 Total population 392 $ 234,683 _____________ * Amounts in this table are rounded to the nearest dollar. We examined all six overtime pay transactions, totaling $7,473, for Work Week Group (WWG) E employees. Our examination of the transactions found no exceptions. We also examined all five overtime pay transactions, totaling $31,474, for WWG 2 employees who were paid for at least 100 hours of overtime per transaction. Of the five transactions, FI$Cal overpaid three of them by approximately $14,759. The overpayments were made because the payroll transactions unit staff members granted the employees more overtime hours than were shown on supporting documentation. Of the 381 overtime pay transactions, totaling $195,736, for WWG 2 employees who were paid for less than 100 hours of overtime per transaction, we randomly selected a statistical sample (as described in the Appendix) of 60 transactions, totaling $34,253. Of the 60 transactions, FI$Cal overpaid 10 by approximately $1,386 and underpaid six by approximately $386. We also questioned one transaction, totaling $122, because FI$Cal could not provide the employee’s timesheet to support that the payment was valid and authorized. Without the timesheet, there is no record of hours worked and supervisory review and approval. Therefore, we could not determine the validity and propriety of payments for this overtime pay transaction. The known improper and questioned payments totaled a net of approximately $1,122. As we used a statistical sampling method to select the overtime pay transactions examined, we projected the amount of likely overpayments to be $6,534 and likely underpayments to be $1,824. We could also estimate that there may have been additional missing timesheets associated with overtime pay, totaling $577. As timesheets are required documents to authorize any kind of pay, we would also question these payments. The likely improper and questioned payments totaled a net approximate $5,287. Therefore, the known and likely improper and questioned payments totaled a net of approximately $6,409, consisting of $7,920 in overpayments, $2,210 in underpayments, and $699 in questioned payments. -13- Financial Information System for California Payroll Process Review The following table summarizes the results of our statistical sampling: Known improper and questioned payments, net $ 1,122 Divide by: Sample 34,253 Error rate for projection (differences due to rounding) 3.27% Population that was statistically sampled 195,736 Multiply by: Error rate for projection 3.27% Known and likely improper and questioned payments, net (differences due to rounding) 6,409 Less: Known improper and questioned payments, net 1,122 Likely improper and questioned payments, net $ 5,287 _____________ * Amounts in this table are rounded to the nearest dollar. The known improper payments were made because the payroll transactions unit staff members miscalculated overtime hours and incorrectly paid overtime hours at the straight-time rate instead of the one- and-a-half-time rate, or vice-versa. FI$Cal also lacked adequate supervisory review to ensure accurate processing of overtime pay. For the 60 statistically-determined overtime pay transactions, we also reviewed associated regular pay, totaling $313,874. Of the 60 transactions, we questioned one transaction, totaling $4,712, because FI$Cal could not provide the employee’s timesheets to support that the payment was valid and authorized. Although the State’s payroll system makes all computations and prepares the “negative”4 payrolls, timesheets are still required to substantiate the hours worked for regular pay. Without a timesheet, there is no record of hours worked and supervisory review and approval. Therefore, we could not determine the validity and authorization of payment for this regular pay transaction. As a result, we questioned this payment. Because we used a statistical sampling method to select the payments examined, we could also estimate that there may have been additional missing timesheets associated with regular pay, totaling $23,894. As timesheets are required documents to authorize pay, we would also question these regular pay transactions. Therefore, the known and likely questioned regular pay transactions totaled $28,606. The following table summarizes the results of our statistical sampling: Known questioned payment $ 4,712 Divide by: Sample 313,874 Error rate for projection (differences due to rounding) 1.50% Population that was statistically sampled 1,905,515 Multiply by: Error rate for projection 1.50% Known and likely questioned payments (differences due to rounding) 28,606 Less: Known questioned payment 4,712 Likely questioned payments $ 23,894 _____________ * Amounts in this table are rounded to the nearest dollar. 4According to SCO’s Payroll Procedures Manual, “These are referred to as ‘negative’ payrolls because attendance reports have not been submitted and no working payrolls have been cleared with agencies/campuses when the payrolls are prepared. This payroll writing operation is performed for the majority of state employees during the period from the cutoff day in each pay period to the 27th and 28th of the month.” -14- Financial Information System for California Payroll Process Review GC sections 13402 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Recommendation We recommend that FI$Cal:  Conduct a review of overtime pay transactions made during the past three years to ensure that the payments complied with collective bargaining agreements and state laws and policies; and  Recover overpayments made to employees through an agreed-upon collection method in accordance with GC section 19838, and properly compensate those employees who were underpaid. We further recommend that, to prevent improper and questioned payments for overtime and regular pay from recurring, FI$Cal:  Establish adequate internal controls to ensure that payments are accurate and comply with collective bargaining agreements and state laws and policies;  Provide adequate oversight to ensure that payroll transactions unit staff process only valid and authorized payments that comply with collective bargaining agreements and state laws and policies; and  Maintain supporting documentation for payments pursuant to retention policies. FI$Cal lacked adequate controls over the processing of holiday credit FINDING 7— transactions. We identified $10,019 in improper holiday credits, consisting Inadequate of $2,681 based on actual transactions reviewed (“known”) and $7,338 controls over based on the results of statistical sampling (“likely”). If not mitigated, holiday credit these control deficiencies leave FI$Cal at risk of additional improper transactions, holiday credits. resulting in improper credits GC section 19853 specifies the compensation that an eligible employee is entitled to receive when required to work on a qualifying holiday. The collective bargaining agreements between the State and Bargaining Units 1 and 4 include similar provisions regarding holiday compensation for represented employees. Leave accounting system records showed that FI$Cal processed 168 accrual transactions of holiday credits, totaling approximately $55,823, between November 2014 and October 2017. Of the 168 transactions, we randomly selected a statistical sample (as described in the Appendix) of 51 transactions, totaling approximately $14,939. Of the 51 transactions, nine involved improper credits, costing an estimated $2,681. As we used a statistical sampling method to select the transactions we examined, we projected the amount of likely improper credits to be $7,338. Therefore, the known and likely improper credits total an estimated $10,019. -15- Financial Information System for California Payroll Process Review The following table summarizes the results of our statistical sampling: Known improper holiday credits $ 2,681 Divide by: Sample 14,939 Error rate for projection (differences due to rounding) 17.95% Population that was statistically sampled 55,823 Multiply by: Error rate for projection 17.95% Known and likely improper holiday credits (differences due to rounding) 10,019 Less: Known improper holiday credits 2,681 Likely improper holiday credits $ 7,338 _____________ * Amounts in this table are rounded to the nearest dollar. The improper holiday credits were granted because the payroll transactions unit staff members did not follow the provisions of collective bargaining agreements and state law regarding holiday compensation. FI$Cal also lacked adequate supervisory review to ensure accurate processing of holiday credits. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. Recommendation We recommend that FI$Cal:  Conduct a review of holiday credits granted during the past three years to ensure that credits complied with collective bargaining agreements and state law;  Correct any improper holiday credits in the State’s leave accounting system; and  Establish adequate controls to ensure that holiday credits granted are valid and comply with collective bargaining agreements and state law. FI$Cal lacked adequate controls over the processing of payments for leave FINDING 8— buy-back. We identified $333 in underpayments, consisting of $150 based Inadequate on actual transactions reviewed (“known”) and $183 based on the results controls over leave of statistical sampling (“likely”). If not mitigated, the control deficiencies buy-back, resulting leave FI$Cal at risk of additional improper payments for leave buy-back. in underpayments A leave buy-back occurs when an employee receives payment at the regular salary rate in exchange for accrued vacation, annual leave, personal leave, personal holiday, and/or holiday credits. The collective bargaining agreements between the State and Bargaining Unit 1 and 2 allow for the annual cash-out of a certain number of hours of accumulated vacation and annual leave for represented employees if funds are available. Title 2, California Code of Regulations, section 599.744 also provides that the California Department of Human Resources may authorize a leave buy-back program for employees excluded from collective bargaining. -16- Financial Information System for California Payroll Process Review California Department of Human Resources authorized leave buy-backs for excluded employees in fiscal year (FY) 2014-15, FY 2015-16, and FY 2016-17. It also provided the State’s policies and procedures regarding cash-out of vacation and annual leave. Payroll records showed that FI$Cal processed 114 leave buy-back payment transactions, totaling $280,499, between November 2014 and October 2017. Of the 114 transactions, we randomly selected a statistical sample (as described in the Appendix) of 51 transactions, totaling $126,606. Our review of the 51 transactions determined that FI$Cal underpaid one of them by $150. As we used a statistical sampling method to select the transactions examined, we projected the amount of likely underpayments to be $183. Accordingly, the known and likely underpayments totaled $333. The following table summarizes the results of our statistical sampling: Known underpayment $ 150 Divide by: Sample 126,606 Error rate for projection (differences due to rounding) 0.12% Population that was statistically sampled 280,499 Multiply by: Error rate for projection 0.12% Known and likely underpayments (differences due to rounding) 333 Less: Known underpayment 150 Likely underpayments $ 183 _____________ * Amounts in this table are rounded to the nearest dollar. The known underpayment was made because the payroll transactions staff miscalculated the salary rate used to pay for the leave buy-back. FI$Cal also lacked adequate supervisory review to ensure accurate processing of payments for leave buy-back. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. Recommendation We recommend that FI$Cal:  Establish adequate controls to ensure accurate calculation and payment for leave buy-back;  Conduct a review of payments for leave buy-back made during the past three years to ensure that the payments were accurate and in compliance with collective bargaining agreements and state regulations; and  Properly compensate those employees who were underpaid. -17- Financial Information System for California Payroll Process Review Appendix— Sampling Methodology November 1, 2014, through October 31, 2017 We used attributes sampling for test of compliance. The following table outlines our sampling application for review areas that included errors: Results Expected Projected to Review Type Population Population Sampling Sample Selection Confidence Tolerable Error Sample Intended Finding Area of Test (Unit) (Dollar) Unit Method Level Error Rate (Rate) * Size Population Number Compensating time off Compliance 2 31 $ 1 85,781 Compensating Computer-generated 95% 5% 0 (0%) 51 Yes 4 time off simple random transactions Overtime pay Compliance 3 81 $ 1 95,736 Payment Computer-generated 95% 5% 0 (0%) 60 Yes 6 transactions simple random Regular pay Compliance 3 66 $ 1 ,905,515 Payment Computer-generated 95% 5% 0 (0%) 60 Yes 6 transactions simple random Holiday credits Compliance 1 68 $ 5 5,823 Holiday credit Computer-generated 95% 5% 0 (0%) 51 Yes 7 transactions simple random Leave buy-back Compliance 1 14 $ 2 80,499 Payment Computer-generated 95% 5% 0 (0%) 51 Yes 8 transactions simple random ______________ * Pursuant to the AICPA’s Audit Guide: Audit Sampling (May 1, 2017 edition), pages 131-133, the expected error is the expected number of errors planned for in the sample. It is derived by multiplying the expected error rate by the sample size. The expected number of errors in the sampling tables on pages 135-136 was rounded upward, e.g., 0.2 errors becomes 1 error. -A1- Financial Information System for California Payroll Process Review Attachment— Financial Information System for California’s Response to Draft Review Report State Controller’s Office Division of Audits Post Office Box 942850 Sacramento, CA 94250 http://www.sco.ca.gov S18-PAR-9004