California Department of Insurance (cdi), Payroll Process and Transactions

CALIFORNIA DEPARTMENT OF INSURANCE Audit Report PAYROLL AUDIT March 1, 2016, through February 28, 2019 BETTY T. YEE California State Controller September 2020 BETTY T. YEE California State Controller September 21, 2020 Ricardo Lara, Insurance Commissioner California Department of Insurance 300 Capitol Mall, Suite 1700 Sacramento, CA 95814 Dear Mr. Lara: The State Controller’s Office audited the California Department of Insurance’s (CDI) payroll process and transactions for the period of March 1, 2016, through February 28, 2019. Our audit found material weaknesses in internal control over CDI’s payroll process. These weaknesses contributed to CDI employees’ excessive vacation and annual leave balances and improper holiday credit transactions costing the State an estimated net total of $2,096,369. If you have any questions, please contact Andrew Finlayson, Chief, State Agency Audits Bureau, by telephone at (916) 324-6310. Sincerely, Original signed by JIM L. SPANO, CPA Chief, Division of Audits JLS/as cc: Laurie Menchaca, Chief Human Resources Management Division California Department of Insurance Jill Ellwood, Assistant Chief Human Resources Management Division California Department of Insurance Cindy McConnell, Personnel Operations Manager Human Resources Management Division California Department of Insurance California Department of Insurance Payroll Audit Contents Audit Report Summary ............................................................................................................................ 1 Background ........................................................................................................................ 1 Objectives, Scope, and Methodology ............................................................................... 1 Conclusion .......................................................................................................................... 3 Follow-up on Prior Audit Findings .................................................................................. 3 Views of Responsible Officials .......................................................................................... 3 Restricted Use .................................................................................................................... 4 Schedule—Summary of Findings ......................................................................................... 5 Findings and Recommendations ........................................................................................... 6 Attachment—California Department of Insurance’s Response to Draft Audit Report California Department of Insurance Payroll Audit Audit Report Summary The State Controller’s Office (SCO) audited the California Department of Insurance’s (CDI) payroll process and transactions for the period of March 1, 2016, through February 28, 2019. CDI’s management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. We completed our audit fieldwork on March 25, 2020. Our audit determined that CDI did not maintain adequate and effective internal controls over its payroll process. In addition, CDI failed to implement controls to limit the accumulation of vacation and annual leave credits, resulting in liability for excessive balances. Background In 1979, the State of California adopted collective bargaining for state employees. This created a significant workload increase for the SCO’s Personnel and Payroll Services Division (PPSD), as PPSD was the State’s centralized payroll processing center for all payroll related-transactions. PPSD decentralized the processing of payroll, allowing state agencies and departments to process their own payroll-related transactions. Periodic audits of the decentralized payroll processing at state agencies and departments ceased due to the budget constraints in the late 1980s. In 2013, the California State Legislature reinstated these payroll audits to gain assurance that state agencies and departments maintain adequate internal control over the payroll function, provide proper oversight of their decentralized payroll processing, and comply with various state laws and regulations regarding payroll processing and related transactions. Audit Authority Authority for this audit is provided by California Government Code (GC) section 12476, which states, “The Controller may audit the uniform state pay roll system, the State Pay Roll Revolving Fund, and related records of state agencies within the uniform state pay roll system, in such manner as the Controller may determine.” In addition, GC section 12410 stipulates that “The Controller shall superintend the fiscal concerns of the state. The Controller shall audit all claims against the state, and may audit the disbursement of any state money, for correctness, legality, and for sufficient provisions of law for payment.” Objectives, Scope, We performed this audit to determine whether CDI: and Methodology  Maintained adequate and effective internal controls over its payroll process; -1- California Department of Insurance Payroll Audit  Processed payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures; and  Administered salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. The audit covered the period from March 1, 2016, through February 28, 2019. To achieve our audit objectives, we:  Reviewed state and CDI policies and procedures related to the payroll process to understand CDI’s methodology for processing various payroll and payroll-related transactions;  Interviewed CDI payroll personnel to understand CDI’s methodology for processing various payroll and payroll-related transactions, determine their level of knowledge and ability relating to payroll transaction processing, and gain an understanding of existing internal control over the payroll process and systems;  Selected transactions recorded in the State’s payroll database using statistical sampling, as outlined in Attachment A, and targeted selection based on risk factors and other relevant criteria;  Analyzed and tested the selected transactions and reviewed relevant files and records to determine the accuracy of payroll and payroll- related payments, accuracy of leave transactions, adequacy and effectiveness of internal control over the payroll process, and compliance with collective bargaining agreements and state laws, regulations, policies, and procedures; and  Reviewed salary advances to determine whether CDI administered and recorded them in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. -2- California Department of Insurance Payroll Audit Conclusion Our audit determined that CDI:  Did not maintain adequate and effective internal controls over its payroll process.1 We found the following deficiency in internal control over the payroll process that we consider to be a material weakness: o Inappropriate keying access to the State’s payroll system (see Finding 1);  Did not process payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. We found the following instance of noncompliance with the requirements of collective bargaining agreements and state laws, regulations, policies, and procedures: o Inadequate controls over vacation and annual leave balances (see Finding 2); and  Administered salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. Follow-up on There were no prior payroll audits and, consequently, no prior audit Prior Audit findings. Findings Views of We issued a draft audit report on June 15, 2020. Julia B. Cross, Deputy Commissioner, responded by letter dated June 26, 2020 (Attachment), Responsible agreeing with the audit results. The letter includes CDI’s response to Officials Finding 3, which was included in the draft report, but was removed from the final report. Upon further review, we determined that the CDI clerical error only granted holiday credits a month early for two employees and was not a systemic problem. The error did not have an impact on paid leave balances and was detected and corrected by CDI in the following month; therefore, the finding has been removed from this final report. This final audit report includes CDI’s response. 1 In planning and performing our audit of compliance, we considered CDI’s internal control over compliance with collective bargaining agreements and state laws, regulations, policies, and procedures to determine the auditing procedures that were appropriate under the circumstances for the purpose of providing a conclusion on compliance, and to test and report on internal control over compliance. Our consideration of internal control over compliance was for the limited purpose described in the first paragraph of this footnote and was not designed to identify all deficiencies in internal control over compliance that might be material weaknesses or significant deficiencies. We did not identify any deficiencies in internal control over compliance that we consider to be material weaknesses. However, material weaknesses may exist that we did not identify. A deficiency in internal control over compliance exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance with provisions of laws, regulations, or contracts on a timely basis. Control deficiencies, either individually or in combination with other control deficiencies, may be evaluated as significant deficiencies or material weaknesses. A material weakness in internal control over compliance is a deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. A significant deficiency over compliance is a deficiency, or a combination of deficiencies, in internal control over compliance with provisions of laws, regulations, or contracts that is less severe than a material weakness, yet important enough to merit attention from those charged with governance. -3- California Department of Insurance Payroll Audit Restricted Use This audit report is solely for the information and use of CDI and SCO; it is not intended to be and should not be used by anyone other than these specified parties. This restriction is not intended to limit distribution of this audit report, which is a matter of public record and is available on the SCO website at www.sco.ca.gov. Original signed by JIM L. SPANO, CPA Chief, Division of Audits September 21, 2020 -4- California Department of Insurance Payroll Audit Schedule— Summary of Findings March 1, 2016, through February 28, 2019 Number of Dollar Amount Finding Method of Selections of Selections Selection Total Dollar Amount of Number Area Tested Selection Population Dollar Population Examined Tested Unit Known and Likely Issues 1 Inappropriate keying Targeted N/A N/A 17 N/A Employee N/A access to the Stateʼs payroll system 2 Inadequate controls Targeted N/A N/A 179 $ 2 ,096,369 Employee $ 2,096,369 over vacation and annual leave balances, resulting in liability for excessive balances 196 $ 2 ,096,369 $ 2,096,369 -5- California Department of Insurance Payroll Audit Findings and Recommendations FINDING 1— CDI lacked adequate controls to ensure that only appropriate staff had keying access to the State’s payroll system. CDI inappropriately allowed Inappropriate three employees keying access to the State’s payroll system. If not keying access to the mitigated, this control deficiency leaves payroll data at risk of misuse, State’s payroll abuse, and unauthorized use. system The SCO maintains the State’s payroll system. The system is decentralized, allowing employees of state agencies access to it. PPSD has established a Decentralized Security Program Manual that all state agencies are required to follow in order to access the payroll system. The program’s objectives are to secure and protect the confidentiality and integrity of payroll data against misuse, abuse, and unauthorized use. We audited the records of 17 CDI employees who had keying access to the State’s payroll system at various times during March 2016 through February 2019. Of the 17 CDI employees, three had inappropriate keying access to the State’s payroll system. Specifically, CDI did not immediately remove or modify keying access for three employees after their separation from state service and transfer to another agency. The Decentralized Security Program Manual states, in part: To prevent unauthorized use by a transferred, terminated or resigned employee’s user ID, the Security Monitor must IMMEDIATELY submit all pages of the PSD125A to delete the user’s system access. Using an old user ID increases the chances of a security breach, which is a serious security violation. Sharing a user ID is strictly prohibited and a serious violation. Recommendation We recommend that CDI:  Provide adequate controls to ensure that employees with keying access to the State’s payroll system do not enter their own data into the system;  Update keying access to the State’s payroll system immediately after employees leave CDI, transfer to another unit, or change classifications; and  Periodically review access to the system to verify that access complies with the Decentralized Security Program Manual. CDI’s Response CDI concurs. CDI believes that adequate controls, including immediate removal of access for transferred, terminated, or resigned employees’ keying access to the State’s payroll system is of vital importance to ensure the integrity of payroll data. During this audit period, CDI had three staff separating within a few weeks of each other and instead of submitting paperwork to SCO to remove payroll system access on each employee’s last day, CDI waited until the third employee’s separation -6- California Department of Insurance Payroll Audit date and submitted the access removal paperwork for all three at the same time. This resulted in a brief delay in removal of access. CDI has since implemented internal procedures to ensure adequate controls over employees with keying access to the system to prevent unauthorized use of the system, immediate submission to the Decentralized Security Administrator for immediate removal of system access upon staff changes, and periodic review of access to the system in compliance with the state’s Decentralized Security Program Manual. FINDING 2— CDI failed to implement controls to ensure that it adheres to the collective bargaining agreements and state regulations to limit the accumulation of Inadequate vacation and annual leave credits. The deficiency resulted in a liability for controls over excess leave balances with a value of at least $2,096,369 as of vacation and February 28, 2019.2 We expect the liability to increase if CDI does not annual leave take action to address the excessive vacation and annual leave balances. balance, resulting in liability for Collective bargaining agreements and state regulations limit the amount excessive balances of vacation and annual leave that most state employees may accumulate to no more than 80 days (640 hours). The limit on leave balances helps state agencies manage leave balances and control the State’s liability for accrued leave credits. State agencies may allow employees to carry a higher leave balance only under limited circumstances. For example, an employee may not be able to reduce accrued vacation or annual leave hours below the limit due to business needs. When an employee’s leave accumulation exceeds or is projected to exceed the limit, state agencies should work with the employee to develop a written plan for reducing leave balances below the applicable limit. Our examination of CDI’s leave accounting records determined that CDI had 1,219 employees with unused vacation or annual leave credits as of February 28, 2019. Of those employees, 179 exceeded the limit set by collective bargaining agreements and state regulations. For example, one employee had an accumulated balance of 2,215 hours in annual leave, or 1,575 hours beyond the 640-hour limit. Collectively, the 179 employees accumulated 38,775 hours of excess vacation and annual leave, with a value of at least $2,096,369 as of February 28, 2019. This estimated liability does not adjust for salary rate increases and additional leave credits.3 Accordingly, we expect that the amount needed to pay for this liability will be higher. We selected 179 employees for examination to determine whether CDI complied with collective bargaining agreements and state regulations. When we discussed the records of these employees with the personnel office staff, they indicated that CDI had no plans in place during the review period to reduce leave balances to be below the limit. CDI also could not demonstrate that it had complied with collective bargaining agreements 2 At the time of our audit, we used the most recent and complete vacation and annual leave balances, which were as of February 28, 2019 3 Most state employees receive pay rate increases every year pursuant to state laws and/or collective bargaining agreements until they reach the top of their pay scale, or promote into a higher-paying position. In addition, when an employee’s accumulated leave balances upon separation are calculated for lump-sum pay, the employee is credited with additional leave credits equal to the amount that the employee would have earned had the employee taken time off and not separated from state service. -7- California Department of Insurance Payroll Audit and state regulations when allowing these employees to maintain excess vacation or annual leave balances. If CDI does not take action to reduce thee excessive leave balances, the liability for accrued vacation and annual leave will likely increase because most employees will receive salary increases or use other non- compensable leave credits instead of vacation or annual leave, increasing their vacation or annual leave balances. The state agency responsible for paying these leave balances may face a cash flow problem if a significant number of employees with excessive vacation or annual leave balances separate from state service. Normally, state agencies are not budgeted to make these separation lump-sum payments. However, the State’s current practice dictates that the state agency that last employed an employee pays for that employee’s lump sum separation payment regardless of where the employee accrued the leave balance. Recommendation We recommend that CDI:  Implement controls, including existing policies and procedures, to ensure that its employees’ vacation and annual leave balances are maintained within levels allowed by collective bargaining agreements and state regulations;  Conduct ongoing monitoring of controls to ensure that they are implemented and operating effectively; and  Participate in leave buy-back programs if the State offers such programs and funds are available. CDI’s Response CDI concurs. CDI believes that it is critical that every state department and agency implement procedures and monitor processes to ensure compliance with existing leave statutes, regulations, policies, and Memoranda of Understanding pertaining to annual leave/vacation balances. As such, in August 2019, CDI implemented an Employee Leave Management Policy and an Excess Leave Reduction Policy to align with the California Department of Human Resources’ Employee Leave Management Policy. These policies include CDI’s participation in leave cash-out programs when funds are available, and require all CDI employees with balances in excess of what is allowable by collective bargaining agreements and state regulations to submit a leave reduction plan annually. For Fiscal Year 2019-20, consistent with the California Department of Finance’s Budget Letter 20-11 and budgetary constraints, CDI did not participate in the annual leave buy-back program for accumulated vacation or annual leave [; instead, CDI cancelled] annual leave buy-back for the year. Additionally, CDI provides ongoing reports to executive staff who are responsible for monitoring balances of their branch’s employees and direct reports, and also ensures ongoing monitoring of controls by CDI’s Human Resources team. In 2019, all CDI employees with vacation/annual leave balances exceeding the allowable limits submitted leave plans. -8- California Department of Insurance Payroll Audit Attachment— California Department of Insurance’s Response to Draft Audit Report State Controller’s Office Division of Audits Post Office Box 942850 Sacramento, CA 94250 http://www.sco.ca.gov S19-PAR-0018