California State University San Marcos Payroll Process and Transactions

CALIFORNIA STATE UNIVERSITY SAN MARCOS Audit Report PAYROLL AUDIT March 1, 2016, through February 28, 2019 BETTY T. YEE California State Controller June 2020 BETTY T. YEE California State Controller June 22, 2020 Ellen Neufeldt, President California State University San Marcos 333 South Twin Oaks Valley Road San Marcos, CA 92096 Dear Ms. Neufeldt: The State Controller’s Office audited the California State University San Marcos’s (CSUSM) payroll process and transactions for the period of March 1, 2016, through February 28, 2019. Our audit found that CSUSM maintained adequate and effective internal controls over its payroll process and administered salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. However, CSUSM processed inaccurate payroll and payroll-related disbursements for lump-sum separation payments with an estimated net total of $6,227, and allowed inappropriate keying access to the State’s payroll system. If you have any questions, please contact Andrew Finlayson, Chief, State Agency Audits Bureau, by telephone at (916) 324-6310. Sincerely, Original signed by JIM L. SPANO, CPA Chief, Division of Audits JLS/as cc: Neal Hoss, Vice President Finance and Administrative Services California State University San Marcos Jane Cross, Director Human Resources Information Systems and Payroll Services California State University San Marcos Gene Howard, Senior Manager Human Resources Data Operations and Payroll Systems California State University, Office of the Chancellor California State University San Marcos Payroll Audit Contents Audit Report Summary ............................................................................................................................ 1 Background ........................................................................................................................ 1 Objectives, Scope, and Methodology ............................................................................... 2 Conclusion .......................................................................................................................... 3 Follow-up on Prior Audit Findings .................................................................................. 3 Views of Responsible Officials .......................................................................................... 4 Restricted Use .................................................................................................................... 4 Schedule—Summary of Audit Results ................................................................................. 5 Findings and Recommendations ........................................................................................... 6 Appendix—Audit Sampling Methodology Attachment—California State University San Marcos’s Response to Draft Audit Report California State University San Marcos Payroll Audit Audit Report Summary The State Controller’s Office (SCO) audited the California State University San Marcos’s (CSUSM) payroll process and transactions for the period of March 1, 2016, through February 28, 2019. CSUSM management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. We completed our audit fieldwork on November 27, 2019. Our audit determined that CSUSM:  Maintained adequate and effective internal controls over its payroll process;  Except for the minor exceptions discussed below, processed payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. We found the following instances of noncompliance with the requirements of collective bargaining agreements and state laws, regulations, policies, and procedures: o Inappropriate keying access to the State’s payroll system (see Finding 1); o Inaccurately calculated and improperly paid separation lump- sum payments (see Finding 2); and  Administered salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. Background In 1979, the State of California adopted collective bargaining for state employees. This created a significant workload increase for the SCO’s Personnel and Payroll Services Division (PPSD), as PPSD was the State’s centralized payroll processing center for all payroll-related transactions. PPSD decentralized the processing of payroll, allowing state agencies and departments to process their own payroll-related transactions. Periodic audits of the decentralized payroll processing at state agencies and departments ceased due to budget constraints in the late 1980s. In 2013, the California State Legislature reinstated these payroll audits to gain assurance that state agencies and departments maintain adequate internal control over the payroll function, provide proper oversight of their decentralized payroll processing, and comply with various state laws and regulations regarding payroll processing and related transactions. Audit Authority Authority for this audit is provided by California Government Code (GC) section 12476, which states, “The Controller may audit the uniform state pay roll system, the State Pay Roll Revolving Fund, and related records of -1- California State University San Marcos Payroll Audit state agencies within the uniform state pay roll system, in such manner as the Controller may determine.” In addition, GC section 12410 stipulates that “The Controller shall superintend the fiscal concerns of the state. The Controller shall audit all claims against the state, and may audit the disbursement of any state money, for correctness, legality, and for sufficient provisions of law for payment.” Objectives, Scope, We performed this audit to determine whether CSUSM: and Methodology  Maintained adequate and effective internal controls over its payroll process;  Processed payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures; and  Administered salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. The audit covered the period from March 1, 2016, through February 28, 2019. To achieve our audit objectives, we:  Reviewed state, California State University Chancellor’s Office, and CSUSM policies and procedures related to the payroll process to understand CSUSM’s methodology for processing various payroll and payroll-related transactions;  Interviewed CSUSM payroll personnel to understand CSUSM’s methodology for processing various payroll and payroll-related transactions, determine their level of knowledge and ability relating to payroll transaction processing, and gain an understanding of existing internal controls over the payroll process and systems;  Selected transactions recorded in the State’s payroll database using statistical sampling, as outlined in the Appendix, and targeted selection based on risk factors and other relevant criteria;  Analyzed and tested the selected transactions and reviewed relevant files and records to determine the accuracy of payroll and payroll- related payments, accuracy of leave transactions, adequacy and effectiveness of internal control over the payroll process, and compliance with collective bargaining agreements and state laws, regulations, policies, and procedures; and  Reviewed salary advances to determine whether CSUSM administered and recorded them in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a -2- California State University San Marcos Payroll Audit reasonable basis for our findings and conclusions based on our audit objectives. Conclusion Our audit determined that CSUSM:  Maintained adequate and effective internal controls over its payroll process;1  Except for the minor exceptions discussed below, processed payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. We found the following instances of noncompliance with the requirements of collective bargaining agreements and state laws, regulations, policies, and procedures: o Inappropriate keying access to the State’s payroll system (see Finding 1); o Inaccurately calculated and improperly paid separation lump- sum payments (see Finding 2); and  Administered salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. There were no prior payroll audits and, consequently, no prior audit Follow-up on findings. Prior Audit Findings 1 In planning and performing our audit of compliance, we considered CSUSM’s internal control over compliance with collective bargaining agreements and state laws, regulations, policies, and procedures to determine the auditing procedures that were appropriate under the circumstances for the purpose of providing a conclusion on compliance, and to test and report on internal control over compliance. Our consideration of internal control over compliance was for the limited purpose described in the first paragraph of this footnote; our audit was not designed to identify all deficiencies in internal control over compliance that might be material weaknesses or significant deficiencies. We did not identify any deficiencies in internal control over compliance that we consider to be material weaknesses. However, material weaknesses may exist that we did not identify. A deficiency in internal control over compliance exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance with provisions of laws, regulations, or contracts on a timely basis. Control deficiencies, either individually or in combination with other control deficiencies, may be evaluated as significant deficiencies or material weaknesses. A material weakness in internal control over compliance is a deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. A significant deficiency over compliance is a deficiency, or a combination of deficiencies, in internal control over compliance with provisions of laws, regulations, or contracts that is less severe than a material weakness, yet important enough to merit attention from those charged with governance. -3- California State University San Marcos Payroll Audit Views of We issued a draft audit report on April 8, 2020. Neal Hoss, Vice President of Finance and Administrative Services, responded by letter dated Responsible April 21, 2020 (Attachment), agreeing with the audit results. This final Officials audit report includes CSUSM’s response. Restricted Use This audit report is solely for the information and use of CSUSM and the SCO; it is not intended to be and should not be used by anyone other than these specified parties. This restriction is not intended to limit distribution of this audit report, which is a matter of public record and is available on the SCO website at www.sco.ca.gov. Original signed by JIM L. SPANO, CPA Chief, Division of Audits June 22, 2020 -4- California State University San Marcos Payroll Audit Schedule— Summary of Audit Results March 1, 2016, through February 28, 2019 Total Number of Dollar Amount Dollar Amount Finding Method of Dollar Selections of Selections Selection of Known and Number Area Tested Selection Population Population Examined Tested Unit Likely Issues 1 Inappropriate keying Targeted N/A N/A 7 N/A Employee N/A access to the Stateʼs payroll system 2 Inaccurately calculated Statistical 367 $ 1,603,690 77 $ 280,432 Employee and improperly paid separation lump-sum payments – Overpayments -- See above -- $ 6,227 – Underpayments -- See above -- - $ 1,603,690 84 $ 280,432 $ 6,227 -5- California State University San Marcos Payroll Audit Findings and Recommendations FINDING 1— CSUSM inappropriately allowed one employee keying access to the State’s payroll system. If not mitigated, this control deficiency leaves Inappropriate payroll data at risk of misuse, abuse, and unauthorized use. keying access to the State’s payroll The SCO maintains the State’s payroll system. The system is system decentralized, allowing employees of various state agencies access to it. PPSD has established a Decentralized Security Program Manual that all state agencies are required to follow in order to access the payroll system. The program’s objectives are to secure and protect the confidentiality and integrity of payroll data against misuse, abuse, and unauthorized use. We examined the records of seven CSUSM employees who had keying access to the State’s payroll system at various times from March 1, 2016, through February 28, 2019. Of the seven CSUSM employees, one had inappropriate keying access to the State’s payroll system. Specifically, CSUSM did not immediately remove or modify the employee’s keying access until 30 days after the employee’s separation from state service. The Decentralized Security Program Manual (Revised January 2020), states, in part: Revocation and Deletion of User IDs To prevent unauthorized use by a transferred, terminated or resigned employee’s User ID, the Security Monitor must IMMEDIATELY submit all pages of the PSD125A signed by both Security Monitor and Authorizing Manager to delete the user’s system access. Using an old User ID increases the risk of a security breach, which is a serious security violation. Sharing a User ID is strictly prohibited. Recommendation We recommend that CSUSM:  Establish adequate controls to ensure that employees with keying access to the State’s payroll system do not enter their own data into the system;  Update keying access to the State’s payroll system immediately after employees change classifications, transfer to another unit, or leave CSUSM; and  Periodically review access to the system to verify that access complies with the Decentralized Security Program Manual. FINDING 2— CSUSM inaccurately calculated and improperly paid some separation lump-sum payments. We identified $6,227 in overpayments for separation Inaccurately lump-sum pay, consisting of $1,086 in overpayments based on actual calculated and transactions audited (“known”); and $5,138 in overpayments based on the improperly paid results of statistical sampling (“likely”). separation lump- sum payments -6- California State University San Marcos Payroll Audit GC section 19839 allows lump-sum payment for accrued eligible leave credits when an employee separates from state employment. Collective bargaining agreements include similar provisions regarding separation lump-sum pay. Payroll records show that CSUSM processed payments for separation lump-sum pay, totaling $1,603,690, for 367 employees for the period of March 1, 2016, through February 28, 2019, as follows: Separation Lump-Sum Pay Group Unit Amount Total population (statistically sampled) 367 $ 1,603,690 * _____________ * Amounts in this table are rounded to the nearest dollar. Of the 367 employees receiving payments for separation lump-sum pay, we randomly selected a statistical sample of 77 employees who received separation lump-sum pay totaling $279,705. Our examination of lump-sum payments made to these 77 employees showed that CSUSM overpaid two employees by approximately $1,086. As we used the statistical sampling methods, we used an error rate based on these two overpayments to project the amount of likely overpayments to the remaining population. We determined likely overpayments to be $5,138. Therefore, the known and likely improper payments total a net of approximately $6,227 in overpayments. The following table summarizes the results of our statistical sampling: Known improper and questioned payments, net $ 1,086 Divide by: Sample 279,705 Error rate for projection (differences due to rounding) 0.39% Population that was statistically sampled 1,603,690 Multiply by: Error rate for projection 0.39% Known and likely improper and questioned payments, net (differences due to rounding) 6,227 Less: Known improper and questioned payments, net 1,086 Likely improper and questioned payments, net $ 5,141 * _____________ * Amounts in this table are rounded to the nearest dollar. Recommendation We recommend that CSUSM:  Establish adequate controls to ensure accurate calculation and payment of separation lump-sum pay;  Conduct a review of all separation lump-sum payments made during the past three years to ensure that the payments were accurate and in compliance with collective bargaining agreements and state law; and  Recover overpayments made to separated employees in accordance with GC section 19838 and State Administrative Manual section 8776.6, and properly compensate those employees who were underpaid. -7- California State University San Marcos Payroll Audit Appendix— Audit Sampling Methodology We used attributes sampling for tests of internal control and tests of compliance. The following table outlines our audit sampling application: Results Expected Projected to Audit Type Population Population Sampling Sample Selection Confidence Tolerable Error Sample Intended Finding Area of Test (Unit) (Dollar) Unit Method Level Error Rate (Rate) ¹ Size Population Number Inapporiate keying access Compliance 7 N/A Employee Deleted users N/A N/A N/A 7 No 1 Separation lump-sum pay Compliance 367 $ 1,603,690 Employee Computer-generated 90% 5% 1.00% 77 Yes 2 sample random ________________ 1 Pursuant to the AICPA’s Audit Guide: Audit Sampling (May 1, 2017 edition), pages 131-133, the expected error is the expected number of errors planned for in the sample. It is derived by multiplying the expected error rate by the sample size. The expected number of errors in the sampling tables on pages 135-136 was rounded upward, e.g., 0.2 errors becomes 1.0 error. California State University San Marcos Payroll Audit Attachment— California State University San Marcos’s Response to Draft Audit Report State Controller’s Office Division of Audits Post Office Box 942850 Sacramento, CA 94250 http://www.sco.ca.gov S19-PAR-0014