North Kern State Prison - Payroll Audit

NORTH KERN STATE PRISON Audit Report PAYROLL AUDIT August 1, 2015, through July 31, 2018 BETTY T. YEE California State Controller May 2020 BETTY T. YEE California State Controller May 13, 2020 Kelly Santoro, Warden North Kern State Prison 2737 West Cecil Avenue Delano, CA 93215 Dear Ms. Santoro: The State Controller’s Office audited North Kern State Prison’s (NKSP) payroll process and transactions for the period of August 1, 2015, through July 31, 2018. Our audit found material weaknesses in internal control over NKSP’s payroll process. These weaknesses contributed to NKSP employees’ excessive vacation and annual leave balances; improper and questioned payments for separation lump-sum pay, Fair Labor Standards Act overtime pay, and uniform allowances; and improper holiday credit transactions, costing the State an estimated net total of $1,794,109. If you have any questions, please contact Andrew Finlayson, Chief, State Agency Audits Bureau, by telephone at (916) 324-6310. Sincerely, Original signed by JIM L. SPANO, CPA Chief, Division of Audits JLS/as cc: Luz Lujan, Institutional Parole Officer North Kern State Prison Jeff Macomber, Undersecretary California Department of Corrections and Rehabilitation Kathleen Allison, Undersecretary California Department of Corrections and Rehabilitation Jennifer Osborn, Director Division of Administrative Services California Department of Corrections and Rehabilitation Mai Lee Vang, External Audits Manager Office of Audits and Court Compliance North Kern State Prison Payroll Audit Contents Audit Report Summary ............................................................................................................................ 1 Background ........................................................................................................................ 1 Objectives, Scope, and Methodology ............................................................................... 2 Conclusion .......................................................................................................................... 3 Follow-up on Prior Audit Finding ................................................................................... 4 Views of Responsible Officials .......................................................................................... 4 Restricted Use .................................................................................................................... 4 Schedule—Summary of Findings ......................................................................................... 5 Findings and Recommendations ........................................................................................... 6 Appendix—Audit Sampling Methodology ........................................................................... A1 Attachment—North Kern State Prison’s Response to Draft Audit Report North Kern State Prison Payroll Audit Audit Report Summary The State Controller’s Office (SCO) audited North Kern State Prison’s (NKSP) payroll process and transactions for the period of August 1, 2015, through July 31, 2018. NKSP’s management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. We completed our audit fieldwork on September 4, 2019. Our audit determined that administered salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures However, NKSP:  Did not maintain adequate and effective internal controls over its payroll process. We found the following deficiencies in internal control over the payroll process that we consider to be material weaknesses: o Inadequate segregation of duties and compensating controls over payroll transactions (see Finding 1); o Inappropriate keying access to the State’s payroll system (see Finding 2);  Did not process payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. We found the following instances of noncompliance with the requirements of collective bargaining agreements and state laws, regulations, policies, and procedures: o Inadequate controls over vacation and annual leave balances (see Finding 3); o Inadequate controls over separation lump-sum pay (see Finding 4); o Controls over FLSA overtime pay failed to identify errors (see Finding 5); o Inadequate controls over holiday credit transactions (see Finding 6); and o Inadequate controls over uniform allowance pay (see Finding 7). These improper and questioned payments cost the State an estimated net total of $1,794,109. Background In 1979, the State of California adopted collective bargaining for state employees. This created a significant workload increase for the SCO’s Personnel and Payroll Services Division (PPSD), as PPSD was the State’s centralized payroll processing center for all payroll related-transactions. PPSD decentralized the processing of payroll, allowing state agencies and departments to process their own payroll-related transactions. Periodic audits of the decentralized payroll processing at state agencies and departments ceased due to the budget constraints in the late 1980s. -1- North Kern State Prison Payroll Audit In 2013, the California State Legislature reinstated these payroll audits to gain assurance that state agencies and departments maintain adequate internal control over the payroll function, provide proper oversight of their decentralized payroll processing, and comply with various state laws and regulations regarding payroll processing and related transactions. Audit Authority Authority for this audit is provided by California Government Code (GC) section 12476, which states, “The Controller may audit the uniform state pay roll system, the State Pay Roll Revolving Fund, and related records of state agencies within the uniform state pay roll system, in such manner as the Controller may determine.” In addition, GC section 12410 stipulates that “The Controller shall superintend the fiscal concerns of the state. The Controller shall audit all claims against the state, and may audit the disbursement of any state money, for correctness, legality, and for sufficient provisions of law for payment.” Objectives, Scope, We performed this audit to determine whether NKSP: and Methodology  Maintained adequate and effective internal controls over its payroll process;  Processed payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures; and  Administered salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. The audit covered the period from August 1, 2015, through July 31, 2018. To achieve our audit objectives, we:  Reviewed state and NKSP policies and procedures related to the payroll process to understand NKSP’s methodology for processing various payroll and payroll-related transactions;  Interviewed NKSP payroll personnel to understand NKSP’s methodology for processing various payroll and payroll-related transactions, determine their level of knowledge and ability relating to payroll transaction processing, and gain an understanding of existing internal control over the payroll process and systems;  Selected transactions recorded in the State’s payroll database using statistical sampling, as outlined in the Appendix, and targeted selection based on risk factors and other relevant criteria;  Analyzed and tested the selected transactions and reviewed relevant files and records to determine the accuracy of payroll and payroll- related payments, accuracy of leave transactions, adequacy and effectiveness of internal control over the payroll process, and compliance with collective bargaining agreements and state laws, regulations, policies, and procedures; and -2- North Kern State Prison Payroll Audit  Reviewed salary advances to determine whether NKSP administered and recorded them in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Conclusion Our audit determined that NKSP administered salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. However, NKSP:  Did not maintain adequate and effective internal controls over its payroll process1. We found the following deficiencies in internal control over the payroll process that we consider to be material weaknesses: o Inadequate segregation of duties and compensating controls over payroll transactions (see Finding 1); o Inappropriate keying access to the State’s payroll system (see Finding 2);  Did not process payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. We found the following instances of noncompliance with the requirements of collective bargaining agreements and state laws, regulations, policies, and procedures: o Inadequate controls over vacation and annual leave balances (see Finding 3); 1 In planning and performing our audit of compliance, we considered NKSP’s internal control over compliance with collective bargaining agreements and state laws, regulations, policies, and procedures to determine the auditing procedures that were appropriate in the circumstances for the purpose of providing a conclusion on compliance, and to test and report on internal control over compliance. Our consideration of internal control over compliance was for the limited purpose described in the first paragraph of this footnote and was not designed to identify all deficiencies in internal control over compliance that might be material weaknesses or significant deficiencies. However, as discussed this section, we identified certain deficiencies in internal control over compliance that we consider to be material weaknesses. A deficiency in internal control over compliance exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance with provisions of laws, regulations, or contracts on a timely basis. Control deficiencies, either individually or in combination with other control deficiencies, may be evaluated as significant deficiencies or material weaknesses. A material weakness in internal control over compliance is a deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected on a timely basis. A significant deficiency over compliance is a deficiency, or a combination of deficiencies, in internal control over compliance with provisions of laws, regulations, or contracts that is less severe than a material weakness, yet important enough to merit attention from those charged with governance. -3- North Kern State Prison Payroll Audit o Inadequate controls over separation lump-sum pay (see Finding 4); o Controls over FLSA overtime pay failed to identify errors (see Finding 5); o Inadequate controls over holiday credit transactions (see Finding 6); and o Inadequate controls over uniform allowance pay (see Finding 7). These improper and questioned payments cost the State an estimated net total of $1,794,109. The California Department of Corrections and Rehabilitation, Office of Follow-up on Audits and Court Compliance, conducted a Business Services Review of Prior Audit NKSP from January 4, 2016, through January 7, 2016. The review report, Finding issued February 2016, included a finding related to salary advances. On April 4, 2017, the Office of Audits and Court Compliance concluded that NKSP implemented corrective actions to substantially resolve the finding. Based on the work performed in the current audit, we noted that NKSP has taken appropriate corrective actions in response to the prior finding. Views of We issued a draft audit report on March 11, 2020. Kelly Santoro, Warden, NKSP, responded by letter dated March 18, 2020 (Attachment), agreeing Responsible with the findings except for Finding 1, and indicating that the NKSP has Officials taken steps to correct the deficiencies noted. We will follow up during the next payroll audit to verify that these corrective actions were adequate and appropriate. Restricted Use This audit report is solely for the information and use of NKSP and the SCO; it is not intended to be and should not be used by anyone other than these specified parties. This restriction is not intended to limit distribution of this audit report, which is a matter of public record and is available on the SCO website at www.sco.ca.gov. Original signed by JIM L. SPANO, CPA Chief, Division of Audits May 13, 2020 -4- North Kern State Prison Payroll Audit Schedule— Summary of Findings August 1, 2015, through July 31, 2018 Total Number of Dollar Amount Dollar Amount Finding Method of Dollar Selections of Selections Selection of Known and Number Area Tested Selection Population Population Examined Tested Unit Likely Issues 1 Inadequate segregation N/A N/A N/A N/A N/A N/A N/A of duties and compensating controls over payroll transactions 2 Inappropriate keying Targeted N/A N/A 31 N/A Employee N/A access to the State's payroll system 3 Inadequate controls Targeted N/A N/A 74 $ 1 ,701,847 Employee $ 1,701,847 over vacation and annual leave balances, resulting in liability for excessive balances 4 Inadequate controls Statistical 228 $ 6,191,813 54 3,051,801 Employee over separation lump- sum pay, resulting in improper payments – Overpayments -- See above -- 62,561 – Underpayments -- See above -- ( 1,653) 5 Controls over FLSA Statistical 5 3,465 31,820,082 105 FLSA overtime pay failed to Overtime identify errors, resulting in improper payments 219,032 – Overpayments -- See above -- 89,778 – Underpayments -- See above -- (69,524) 6 Inadequate controls Targeted N/A N/A 65 5 1,675 Holiday 7 ,671 over holiday credit Credit transactions, resulting in improper credits 7 Inadequate controls Targeted N/A N/A 104 3 7,476 Uniform 3 ,429 over uniform allowance Allowance pay, resulting in overpayments 433 $ 5 ,061,831 $ 1,794,109 -5- North Kern State Prison Payroll Audit Findings and Recommendations FINDING 1— NKSP lacked adequate segregation of duties within its payroll transactions unit to ensure that only valid and authorized payroll transactions were Inadequate processed. NKSP also failed to implement other controls to compensate segregation of for this risk. duties and compensating GC sections 13400 through 13407 require state agencies to establish and controls over maintain internal controls, including proper segregation of duties and an payroll effective system of internal review. Adequate segregation of duties transactions reduces the likelihood that fraud or error will remain undetected by providing for separate processing by different individuals at various stages of a transaction and for independent reviews of the work performed. Our audit found that NKSP payroll transactions unit staff performed conflicting duties. Staff members performed multiple steps in processing payroll transactions, including entering data into the State’s payroll system; auditing employee timesheets; reconciling payroll, including reconciling system output to source documentation; reporting payroll exceptions; and processing adjustments. For example, staff members keyed in regular and overtime pay, and reconciled the master payroll overtime and other supplemental warrants. NKSP failed to demonstrate that it had implemented compensating controls to mitigate the risks associated with such a deficiency. We found no indication that these functions were subjected to periodic supervisory review after entries were keyed into the system. The lack of adequate segregation of duties and compensating controls has a pervasive effect on the NKSP payroll process, and impairs the effectiveness of other controls by rendering their design ineffective or by keeping them from operating effectively. These control deficiencies, in combination with other deficiencies discussed in Findings 2 through 8, represent a material weakness in internal control over the payroll process such that there is a reasonable possibility that material noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. Good internal control practices require that the following functional duties be performed by different work units, or at minimum by different employees within the same unit:  Recording transactions – This duty refers to the record-keeping function, which is accomplished by entering data into a computer system  Authorization to execute – This duty belongs to individuals with authority and responsibility to initiate and execute transactions.  Periodic review and reconciliation of actual payments to recorded amounts – This duty refers to making comparisons of information at regular intervals and taking action to resolve differences. -6- North Kern State Prison Payroll Audit Recommendation We recommend that NKSP:  Separate conflicting payroll function duties to the greatest extent possible. Adequate segregation of duties will provide a stronger system of internal control whereby the functions of each employee are subject to the review of another. If it is not possible to segregate payroll functions fully and appropriately, NKSP should implement compensating controls. For example, if the payroll transactions unit staff member responsible for record-keeping also performs a reconciliation process, then the supervisor should perform and document a detailed review of the reconciliation to provide additional control over the assignment of conflicting functions. Compensating controls may also include dual authorization requirements and documented reviews of payroll system input and output; and  Develop formal procedures for performing and documenting compensating controls. NKSP’s Response The Personnel Specialist duties and responsibilities consist of processing various personnel/payroll transactions, including data entry, reconciliation, and processing of adjustments and corrections. NKSP believes [that] controls are in place [to ensure that] timekeeper duties do not overlap with the personnel transaction staff who key in the payroll system. SCO Comment Our finding and recommendation remain unchanged. During the audit, we were not able to verify that compensating controls were in place. We appreciate NKSP’s dedication to effective payroll processes, as described in NKSP’s response. We will follow up during the next payroll audit to verify that internal controls are present and functioning. FINDING 2— NKSP lacked adequate controls to ensure that only appropriate staff had keying access to the State’s payroll system. NKSP inappropriately allowed Inappropriate 12 employees keying access to the State’s payroll system. If not mitigated, keying access to the this control deficiency leaves payroll data at risk of misuse, abuse, and State’s payroll unauthorized use. system The SCO maintains the State’s payroll system. The system is decentralized, allowing employees of state agencies access to it. PPSD has established a Decentralized Security Program Manual that all state agencies are required to follow in order to access the payroll system. The program’s objectives are to secure and protect the confidentiality and integrity of payroll data against misuse, abuse, and unauthorized use. -7- North Kern State Prison Payroll Audit We audited the records of 31 NKSP employees who had keying access to the State’s payroll system at various times from August 2015 through July 2018. Of the 31 NKSP employees, 12 had inappropriate keying access to the State’s payroll system. NKSP did not immediately remove or modify the employees’ keying access after their separation from state service, transfer to another agency or unit, or change in classification. The keying access of a Personnel Specialist who transferred to another state agency was not removed until March 21, 2018, five days after the transfer. The Decentralized Security Program Manual states, in part: To prevent unauthorized use by a transferred, terminated or resigned employee’s user ID, the Security Monitor must IMMEDIATELY submit all pages of the PSD125A to delete the user’s system access. Using an old user ID increases the chances of a security breach, which is a serious security violation. Sharing a user ID is strictly prohibited and a serious violation. Recommendation We recommend that NKSP:  Provide adequate controls to ensure that employees with keying access to the State’s payroll system do not enter their own data into the system;  Update keying access to the State’s payroll system immediately after employees leave NKSP, transfer to another agency or unit, or change classifications; and  Periodically review access to the system to verify that access complies with the Decentralized Security Program Manual. NKSP failed to implement controls to ensure that it adheres to the FINDING 3— collective bargaining agreements and state regulations to limit the Inadequate accumulation of vacation and annual leave credits. The deficiency resulted controls over in a liability for excess leave balances with a value of at least $1,701,847 vacation and as of July 31, 20182. We expect the liability to increase if NKSP does not annual leave take action to address the excessive vacation and annual leave balances. balances, resulting in liability for Collective bargaining agreements and state regulations limit the amount excessive balances of vacation and annual leave that most state employees may accumulate to no more than 80 days (640 hours). The limit on leave balances helps state agencies manage leave balances and control the State’s liability for accrued leave credits. State agencies may allow employees to carry a higher leave balance only under limited circumstances. For example, an employee may not be able to reduce accrued vacation or annual leave hours below the limit due to business needs. When an employee’s leave accumulation exceeds or is projected to exceed the limit, state agencies would work with the employee to develop a written plan for reducing leave balances below the applicable limit. 2At the time of our audit, we used the most recent and complete vacation and annual leave balances, which were as of July 31, 2018. -8- North Kern State Prison Payroll Audit Our examination of NKSP’s leave accounting records determined that NKSP had 1,327 employees with unused vacation or annual leave credits at July 31, 2018. Of those employees, 74 exceeded the limit set by collective bargaining agreements and state regulations. For example, one employee had an accumulated balance of 2,655 hours in annual leave, or 2,015 hours beyond the 640-hour limit. Collectively, the 74 employees accumulated 26,915 hours of excess vacation and annual leave, with a value of at least $1,701,847 as of July 31, 2018. This estimated liability does not adjust for salary rate increases and additional leave credits3. Accordingly, we expect that the amount needed to pay for this liability will be higher. We selected 71 employees for examination to determine whether NKSP complied with collective bargaining agreements and state regulations. When we discussed the records of these employees with the personnel office staff, they indicated that NKSP had no plans in place during the review period for reducing leave balances below the limit. NKSP also could not demonstrate that it had complied with collective bargaining agreements and state regulations when allowing these employees to maintain excess vacation or annual leave balances. If NKSP does not take action to reduce the excessive leave balances, the liability for accrued vacation and annual leave will likely increase because most employees will receive salary increases or use other non- compensable leave credits instead of vacation or annual leave, increasing their vacation or annual leave balances. The state agency responsible for paying these leave balances may face a cash flow problem if a significant number of employees with excessive vacation or annual leave balances separate from state service. Normally, state agencies are not budgeted to make these separation lump-sum payments. However, the State’s current practice dictates that the state agency that last employed an employee pays for that employee’s lump sum separation payment regardless of where the employee accrued the leave balance. Recommendation We recommend that NKSP:  Implement controls, including existing policies and procedures, to ensure that its employees’ vacation and annual leave balances are maintained within levels allowed by collective bargaining agreements and state regulations;  Conduct ongoing monitoring of controls to ensure that they are implemented and operating effectively; and  Participate in leave buy-back programs if the State offers such programs and funds are available. 3Most state employees receive pay rate increases every year pursuant to state laws and/or collective bargaining agreements until they reach the top of their pay scale, or promote into a higher-paying position. In addition, when an employee’s accumulated leave balances upon separation are calculated for lump-sum pay, the employee is credited with additional leave credits equal to the amount that the employee would have earned had the employee taken time off and not separated from state service. -9- North Kern State Prison Payroll Audit NKSP lacked adequate controls over the processing of employee FINDING 4— separation lump-sum pay. We identified $62,561 in overpayments and Inadequate $1,653 in underpayments for separation lump-sum pay, likely of $43,185 controls over in overpayments and $1,141 in underpayments based on actual separation lump- transactions audited (“known”); and $19,376 and $512 in underpayments sum pay, resulting based on the results of statistical sampling (“likely”). If not mitigated, in improper these control deficiencies leave NKSP at risk of additional improper payments separation lump-sum payments. GC section 19839 allows lump-sum payments for accrued eligible leave credits when employees separate from state employment. Collective bargaining agreements include similar provisions regarding separation lump-sum pay. Bargaining Unit (BU) 6 Contract, section 10.11 Holidays, (A): There are holiday pay differences between posted and non-posted positions. When non-posted positions take a day off because of a holiday, they receive eight (8) hours of holiday pay as part of their warrant. When a posted position takes the day off because of a holiday, they must burn leave to receive compensation for that holiday (except where the employee has Holidays off as their normal work schedule.) Payroll records show that NKSP processed payments for separation lump- sum pay, totaling $6,191,813, for 228 employees between August 1, 2015, and July 31, 2018, as follows: Separation Lump-Sum Pay Group Unit Amount Employees under Section 7k of the FLSA (statically sampled) 121 $ 4,421,037 Employees not under Section 7k of the FLSA (examined 10 haphazardly) 107 1,770,776 Total Population 228 $ 6,191,813 Of the payments for separation lump-sum pay, totaling $4,421,037, for the 121 employees who were covered by the provisions of Section 7k of the FLSA, we randomly selected a statistical sample of 54 employees who received separation lump-sum pay, totaling $3,051,801. Our examination of lump-sum payments made to these 54 employees showed that NKSP overpaid 24 of them by approximately $43,185, and underpaid seven of them by approximately $1,141. These payments resulted in an exception totaling $42,044. As we used a statistical sampling method to select the employees whose payments for separation lump-sum pay we examined, we projected the amount of likely overpayments to be $19,376 and likely underpayments to be $512. These payments resulted in a net total exception of $18,864. Therefore, the known and likely improper payments totaled a net approximate of $60,908, consisting of $62,561 in overpayments and $1,653 in underpayments. -10- North Kern State Prison Payroll Audit The following table summarizes the results of our statistical sampling: Known improper payments, net $ 42,044 Divide by: Samples 3,051,801 Error rate 1.38% Population that was statistically sampled 4,421,037 Multiply by: Error rate 1.38% Known and likely improper payments, net 60,908 Less: Known improper payments, net 42,044 Likely improper payments, net $ 18,864 _____________ * Amounts in this table are rounded to the nearest dollar. Recommendation We recommend that NKSP:  Establish adequate controls to ensure accurate calculation and payment of separation lump-sum pay;  Conduct a review of separation lump-sum payments made during the past three years to ensure that the payments were accurate and in compliance with collective bargaining agreements and state law; and  Recover overpayments made to separated employees in accordance with GC section 19838 and State Administrative Manual (SAM) Chapter 8776.6, and properly compensate those employees who were underpaid. NKSP controls over the processing of FLSA overtime pay failed to FINDING 5— identify errors. We identified $89,778 in overpayments and $69,524 in Controls over underpayments for FLSA overtime, consisting of $617 in overpayments FLSA overtime pay and $478 in underpayments based on actual transactions audited failed to identify (“known”); and $89,161 in overpayments and $69,046 in underpayments errors, resulting in based on the results of statistical sampling (“likely”). If not mitigated, improper these control deficiencies leave NKSP at risk of additional improper payments payments for FLSA overtime. Collective bargaining agreements and state laws and policies contain specific clauses regarding overtime pay. Payroll records show that NKSP processed 53,465 FLSA overtime pay transactions, totaling $31,820,082, between August 1, 2015, and July 31, 2018. Of the 53,465 FLSA overtime pay transactions, totaling $31,820,082, we randomly selected a statistical sample (as described in the Appendix) of 105 transactions, totaling $219,032. Of the 105 transactions, NKSP overpaid two by approximately $617 and underpaid two by $478. We used a statistical sampling method to select the FLSA overtime pay transactions examined, we projected the amount of likely overpayments to be $89,161 and likely underpayments to be $69,046. These payments resulted in a net total exception of $20,115. Therefore, the known and likely improper payments totaled a net of approximately $20,254, consisting of $89,778 in overpayments and $69,524 in underpayments. -11- North Kern State Prison Payroll Audit The known improper payments were made because the payroll transactions unit staff members miscalculated FLSA overtime hours worked, or incorrectly entered the FLSA overtime hours worked into the payroll system. Furthermore, NKSP lacked adequate supervisory review to ensure accurate processing of FLSA overtime pay. GC sections 13402 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Recommendation We recommend that NKSP:  Conduct a review of payments for overtime pay made during the past three years to ensure that the payments complied with collective bargaining agreements and state laws and policies; and  Recover overpayments made to employees through an agreed-upon collection method in accordance with GC section 19838. We further recommend that, to prevent improper and questioned payments for overtime pay from recurring, NKSP:  Establish adequate internal controls to ensure that payments are accurate and comply with collective bargaining agreements and state laws and policies; and  Provide adequate oversight to ensure that payroll transactions unit staff process only valid and authorized payments that comply with collective bargaining agreements and state laws and policies. NKSP lacked adequate controls over the processing of holiday credit FINDING 6— transactions. We identified approximately $7,671 in improper holiday Inadequate credits. If not mitigated, this control deficiency leaves NKSP at risk of controls over additional improper holiday credits. holiday credit transactions, GC section 19853 specifies the compensation that an eligible employee is resulting in entitled to receive when required to work on a qualifying improper credits holiday. Collective bargaining agreements between the State and BUs 6, 15, 17, 19 and 20 include similar provisions regarding holiday compensation for represented employees. Leave accounting records showed that NKSP processed 12,907 accrual transactions of holiday credit. We examined 65 of these transactions, with an estimated value of $51,675, because they involved unusual credits. Of the 65 transactions, 14 involved improper credits, with an estimated value of $7,671. The improper holiday credit transactions occurred because payroll transactions unit staff members granted holiday credits to employees during pay periods with no holidays and improperly calculated holiday credit hours. The NKSP also lacked adequate supervisory review to ensure accurate processing of holiday credits. -12- North Kern State Prison Payroll Audit GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. Recommendation We recommend that NKSP:  Conduct a review of holiday credits granted during the past three years to ensure that credits complied with collective bargaining agreements and state laws;  Correct any improper holiday credits in the State’ leave accounting system; and  Establish adequate controls to ensure that holiday credits granted are valid and comply with collective bargaining agreements and state laws. NKSP lacked adequate controls over the processing of payments for FINDING 7— uniform allowances. We identified $3,429 in overpayments for uniform Inadequate allowance. If not mitigated, this control deficiency leave NKSP at risk of controls over additional improper payments. uniform allowance pay, resulting in Pursuant to the collective bargaining agreement between the State and overpayments BU 6, certain employees required to wear a uniform and uniform accessories receive a maximum uniform allowance of $950 per year, to be paid annually. If an employee leaves the classification entitled to the uniform allowance, the employee receives a prorated share of the annual uniform allowance. Payroll records showed that NKSP processed 2,442 transactions, totaling $1,817,930, for uniform allowance between August 1, 2015, and July 31, 2018. We judgmentally selected and examined 104 transactions, and found that NKSP overpaid 17 of them, totaling $3,429. For the 17 transactions, the employees received more than the amount allowed by the collective bargaining agreement. NKSP lacked adequate supervisory review to ensure accurate processing of uniform allowance pay. Recommendation We recommend that NKSP:  Conduct a review of payments for uniform allowance made during the past three years to ensure that the payments complied with collective bargaining agreements; and  Recover overpayments made to employees through an agreed-upon collection method in accordance with GC section 19838. We further recommend that, to prevent improper payments for uniform allowance from recurring, NKSP:  Establish adequate internal controls to ensure that payments are accurate and comply with collective bargaining agreements; and -13- North Kern State Prison Payroll Audit  Provide adequate oversight to ensure that payroll transactions unit staff members process only valid and authorized payments that comply with collective bargaining agreements. -14- North Kern State Prison Payroll Audit Appendix— Audit Sampling Methodology August 1, 2015, through July 31, 2018 We used attributes sampling for tests of internal control and tests of compliance. The following table outlines our audit sampling application for audit areas that included errors: Results Expected Projected to Review Type Population Population Sampling Sample Selection Confidence Tolerable Error Sample Intended Finding Area of Test (Unit) (Dollar) Unit Method Level Error Rate (Rate) ¹ Size Population Number Computer-generated Separation lump-sum pay Compliance 228 $ 6,191,813 Employee 90% 5% 1.50% 65 Yes 4 sample random Computer-generated Overtime pay Compliance 5 3,465 $ 31,820,082 Employee 90% 5% 1.50% 105 Yes 5 sample random _______________________ 1 Pursuant to the AICPA’s Audit Guide: Audit Sampling (May 1, 2017 edition), pages 131-133, the expected error is the expected number of errors planned for in the sample. It is derived by multiplying the expected error rate by the sample size. The expected number of errors in the sampling tables on pages 135-136 was rounded upward, e.g., 0.2 errors becomes 1.0 error. -A1- North Kern State Prison Payroll Audit Attachment— North Kern State Prison’s Response to Draft Audit Report -A1- State Controller’s Office Division of Audits Post Office Box 942850 Sacramento, CA 94250 http://www.sco.ca.gov S19-PAR-0011