SCO
Office of Statewide Health Planning and Development’s (oshpd) Payroll Process
Read the report at Office of Statewide Health Planning and Development’s (OSHPD) Payroll Process ↗
OFFICE OF STATEWIDE HEALTH
PLANNING AND DEVELOPMENT
Audit Report
PAYROLL AUDIT
March 1, 2016, through February 28, 2019
BETTY T. YEE
California State Controller
November 2020
BETTY T. YEE
California State Controller
November 17, 2020
Marko Mijic, Acting Director
Office of Statewide Health Planning and Development
2020 West El Camino Avenue
Sacramento, CA 95833
Dear Mr. Mijic:
The State Controller’s Office audited the Office of Statewide Health Planning and
Development’s (OSHPD) payroll process and transactions for the period of March 1, 2016,
through February 28, 2019. OSHPD management is responsible for maintaining a system of
internal control over the payroll process within its organization, and for ensuring compliance
with various requirements under state laws and regulations regarding payroll and payroll-related
expenditures.
Our audit determined that OSHPD did not maintain adequate and effective internal controls over
its payroll process. OSHPD lacked adequate segregation of duties and compensating controls
over payroll transactions, resulting in improper regular, overtime, separation lump-sum, and
leave buy-back payments. OSHPD also granted inappropriate keying access to the State’s payroll
system.
In addition, OSHPD did not implement controls to limit the accumulation of vacation and annual
leave credits, resulting in liability for excessive balances. OSHPD also did not promptly collect
salary advances from its employees.
If you have any questions, please contact Andrew Finlayson, Chief, State Agency Audits Bureau,
by telephone at (916) 324-6310, or by email at afinlayson@sco.ca.gov.
Sincerely,
Original signed by
JIM L. SPANO, CPA
Chief, Division of Audits
JLS/as
Marko Mijic, Acting Director -2- November 17, 2020
cc: Eric Reslock, Acting Chief Deputy Director
Office of Statewide Health Planning and Development
Monica Flowers-Erickson, Deputy Director of Administrative Services
Office of Statewide Health Planning and Development
Lynne Cervinka, Chief of Human Resources Services Section
Office of Statewide Health Planning and Development
Brenden Murphy, Chief, Administrative Services Division
California Department of Human Resources
Jil Barraza, Chief, Personnel and Payroll Services Division
State Controller’s Office
Office of Statewide Health Planning and Development Payroll Audit
Contents
Audit Report
Summary ............................................................................................................................ 1
Background ........................................................................................................................ 1
Objectives, Scope, and Methodology ............................................................................... 2
Conclusion .......................................................................................................................... 3
Follow-up on Prior Audit Findings .................................................................................. 4
Views of Responsible Officials .......................................................................................... 4
Restricted Use .................................................................................................................... 5
Schedule—Summary of Audit Results ................................................................................. 6
Findings and Recommendations ........................................................................................... 7
Appendix—Audit Sampling Methodology
Attachment—Office of Statewide Health Planning and Development’s
Response to Draft Audit Report
Office of Statewide Health Planning and Development Payroll Audit
Audit Report
Summary The State Controller’s Office (SCO) audited the Office of Statewide
Health Planning and Development’s (OSHPD) payroll process and
transactions for the period of March 1, 2016, through February 28, 2019.
OSHPD management is responsible for maintaining a system of internal
control over the payroll process within its organization, and for ensuring
compliance with various requirements under state laws and regulations
regarding payroll and payroll-related expenditures. We completed our
audit fieldwork on September 9, 2020.
Our audit determined that OSHPD did not:
Maintain adequate and effective internal controls over its payroll
process. OSHPD lacked adequate segregation of duties and
compensating controls over payroll transactions, resulting in improper
payments for regular, overtime, separation lump-sum, and leave buy-
back payments. OSHPD also granted inappropriate keying access to
the State’s payroll system;
Implement controls to limit the accumulation of vacation and annual
leave credits, resulting in liability for excessive balances; and
Promptly collect salary advances from its employees.
Background In 1979, the State of California adopted collective bargaining for State
employees. This created a significant workload increase for the SCO’s
Personnel and Payroll Services Division (PPSD), as PPSD was the State’s
centralized payroll processing center for all payroll related-transactions.
PPSD decentralized the processing of payroll, allowing state agencies and
departments to process their own payroll-related transactions. Periodic
audits of the decentralized payroll processing at state agencies and
departments ceased due to the budget constraints in the late 1980s.
In 2013, the California State Legislature reinstated these payroll audits to
gain assurance that state agencies and departments maintain adequate
internal control over the payroll function, provide proper oversight of their
decentralized payroll processing, and comply with various state laws and
regulations regarding payroll processing and related transactions.
Audit Authority
Authority for this audit is provided by California Government Code (GC)
section 12476, which states:
The Controller may audit the uniform state pay roll system, the State Pay
Roll Revolving Fund, and related records of state agencies within the
uniform state pay roll system, in such manner as the Controller may
determine.
In addition, GC section 12410 stipulates that:
The Controller shall superintend the fiscal concerns of the state. The
Controller shall audit all claims against the state, and may audit the
disbursement of any state money, for correctness, legality, and for
sufficient provisions of law for payment.
-1-
Office of Statewide Health Planning and Development Payroll Audit
Objectives, Scope, We performed this audit to determine whether OSHPD:
and Methodology
Maintained adequate and effective internal controls over its payroll
process;
Processed payroll and payroll-related disbursements and leave
balances accurately and in accordance with collective bargaining
agreements and state laws, regulations, policies, and procedures; and
Administered salary advances in accordance with collective
bargaining agreements and state laws, regulations, policies, and
procedures.
The audit period was March 1, 2016, through February 28, 2019. The audit
population consisted of payroll transactions totaling $120,575,396, as
quantified in the Schedule.
To achieve our audit objectives, we:
Reviewed state and OSHPD policies and procedures related to the
payroll process to understand OSHPD’s methodology for processing
various payroll and payroll-related transactions;
Interviewed the OSHPD payroll personnel to understand OSHPD’s
methodology for processing various payroll and payroll-related
transactions, determine the employees’ level of knowledge and ability
relating to payroll transaction processing, and gain an understanding
of existing internal control over the payroll process and systems;
Selected transactions recorded in the State’s payroll database using
statistical sampling, as outlined in the Appendix, and targeted
selection based on risk factors and other relevant criteria;
Analyzed and tested the selected transactions and reviewed relevant
files and records to determine the accuracy of payroll and payroll-
related payments, accuracy of leave transactions, adequacy and
effectiveness of internal control over the payroll process, and
compliance with collective bargaining agreements and state laws,
regulations, policies, and procedures; and
Reviewed salary advances to determine whether OSHPD administered
and recorded them in accordance with collective bargaining
agreements and state laws, regulations, policies, and procedures.
We conducted this performance audit in accordance with generally
accepted government auditing standards. Those standards require that we
plan and perform the audit to obtain sufficient, appropriate evidence to
provide a reasonable basis for our findings and conclusions based on our
audit objectives. We believe that the evidence obtained provides a
reasonable basis for our findings and conclusions based on our audit
objectives.
-2-
Office of Statewide Health Planning and Development Payroll Audit
Conclusion Our audit determined that OSHPD:
Did not maintain adequate and effective internal controls over its
payroll process.1 We found the following deficiencies in internal
control over the payroll process that we consider to be material
weaknesses:
o Inadequate segregation of duties and a lack of compensating
controls over payroll transactions (see Finding 1);
o Inappropriate keying access to the State’s payroll system (see
Finding 2);
o Failure to implement controls to ensure that OSHPD adhered to
the requirements of collective bargaining agreements and state
regulations to limit the accumulation of vacation and annual leave
credits, resulting in liability for excessive balances (see
Finding 3);
o Inadequate controls to ensure that payments for regular pay were
adjusted properly for absences and supported with adequate
documentation, resulting in overpayments and questioned
payments (see Finding 4);
o Inadequate controls to ensure that overtime payments were
calculated correctly, granted for valid overtime hours worked, and
supported with adequate documentation, resulting in improper and
questioned payments (see Finding 5);
o Inadequate controls to ensure that separation lump-sum payments
were calculated correctly and paid in a timely manner, resulting in
improper and late payments (see Finding 6);
o Inadequate controls to ensure that salary advances were collected
in a timely manner, resulting in failure to recover outstanding
amounts (see Finding 7);
1 In planning and performing our audit of compliance, we considered OSHPD’s internal control over compliance with
collective bargaining agreements and state laws, regulations, policies, and procedures to determine the auditing
procedures that were appropriate under the circumstances for the purpose of providing a conclusion on compliance,
and to test and report on internal control over compliance.
Our consideration of internal control over compliance was for the limited purpose described in the first paragraph
of this footnote; it was not designed to identify all deficiencies in internal control over compliance that might be
material weaknesses or significant deficiencies. As discussed in this section, we identified certain deficiencies in
internal control over compliance that we consider to be material weaknesses.
A deficiency in internal control over compliance exists when the design or operation of a control does not allow
management or employees, in the normal course of performing their assigned functions, to prevent, or detect and
correct, noncompliance with provisions of laws, regulations, or contracts on a timely basis. Control deficiencies,
either individually or in combination with other control deficiencies, may be evaluated as significant deficiencies
or material weaknesses. A material weakness in internal control over compliance is a deficiency, or combination of
deficiencies, in internal control over compliance, such that there is a reasonable possibility that material
noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected
on a timely basis. A significant deficiency over compliance is a deficiency, or a combination of deficiencies, in
internal control over compliance with provisions of laws, regulations, or contracts that is less severe than a material
weakness, yet important enough to merit attention from those charged with governance.
-3-
Office of Statewide Health Planning and Development Payroll Audit
o Inadequate controls to ensure that leave balances were reduced in
the leave accounting system for leave buy-back transactions,
resulting in overpayments (see Finding 8);
Did not process payroll and payroll-related disbursements and leave
balances accurately and in accordance with collective bargaining
agreements and state laws, regulations, policies, and procedures. We
found the following instances of noncompliance with the requirements
of collective bargaining agreements and state laws, regulations,
policies, and procedures:
o Excessive vacation and annual leave balances with a value of at
least $380,862 as of February 28, 2019 (see Finding 3).
Although a new directive from California Department of Human
Resources (CalHR) that became effective October 20, 2020, does
not affect the dollar value of this finding, we are disclosing this
directive because it affects our recommendation. CalHR has
directed departments to immediately suspend policies that require
leave balances be reduced below the limit, and that require
employees to implement leave-reduction plans. This suspension
will be in effect until the 2020 Personal Leave Program
(2020 PLP) ends, or July 1, 2022, whichever is sooner;
o Overpayments and questioned payments made for regular pay (see
Finding 4), improper and questioned payments made for overtime
pay (see Finding 5), improper and late payments made for
separation lump-sum pay (see Finding 6), and overpayments
made for leave buy-back (see Finding 8), costing an estimated net
total of $5,518,651; and
Did not administer salary advances in accordance with collective
bargaining agreements and state laws, regulations, policies, and
procedures. Six salary advances, totaling $10,782, remained
outstanding as of February 28, 2019, due to OSHPD’s noncompliance
with the State’s collection policies and procedures (see Finding 7).
There were no prior payroll audits and, consequently, no prior audit
Follow-up on
findings.
Prior Audit
Findings
Views of We issued a draft audit report on October 6, 2020. Marko Mijic, Acting
Director, responded by letter dated October 19, 2020 (Attachment),
Responsible
agreeing with Findings 1, 2, 4, 5, 6, 7, and 8, and indicating that OSHPD
Officials
has taken steps to correct the noted deficiencies. We will follow up during
the next payroll audit to verify that these corrective actions were adequate
and appropriate. OSHPD also provided additional information regarding
Findings 1, 2, and 3. Our comments on OSHPD’s response to Findings 1,
2, and 3 are included in the Findings and Recommendations section. This
final audit report includes OSHPD’s response.
-4-
Office of Statewide Health Planning and Development Payroll Audit
Restricted Use This audit report is solely for the information and use of OSHPD and the
SCO; it is not intended to be and should not be used by anyone other than
these specified parties. This restriction is not intended to limit distribution
of this audit report, which is a matter of public record and is available on
the SCO website at www.sco.ca.gov.
Original signed by
JIM L. SPANO, CPA
Chief, Division of Audits
November 17, 2020
-5-
Office of Statewide Health Planning and Development Payroll Audit
Schedule—
Summary of Audit Results
March 1, 2016, through February 28, 2019
Net Total
Number of Number of Dollar Amount Dollar Amount
Method of Units of Dollar Amount Selections Selection of Selections of Known and Finding
Audit Area Tested Selection Population of Population Examined Unit Examined Likely Issues Number
Segregation of duties N/A N/A N/A N/A N/A N/A N/A 1
System access Targeted 3 3 N/A 33 Employee N/A N/A 2
Excess vacation and annual leave Targeted 3 3 $ 380,862 33 Employee $ 380,862 $ 380,862 3
Regular pay Statistical 1 6,653 117,143,934 105 Transaction 692,204 5,474,825 4
Overtime pay Statistical 5 84 6 90,982 105 Transaction 105,949 81,495 5
Separation lump-sum pay Statistical 9 8 1,600,332 57 Employee 753,264 ( 55,609) 6
Salary advance Targeted 6 10,782 6 Transaction 10,782 10,782 7
Leave buy-back Statistical 181 7 48,504 60 Transaction 249,899 1 7,940 8
$ 120,575,396 $ 2,192,960 $ 5,910,295
-6-
Office of Statewide Health Planning and Development Payroll Audit
Findings and Recommendations
FINDING 1— OSHPD lacked adequate segregation of duties within its payroll
transactions unit to ensure that only valid and authorized payroll
Inadequate
transactions were processed. OSHPD also failed to implement other
segregation of
controls to compensate for this risk.
duties and lack of
compensating
GC sections 13400 through 13407 require state agencies to establish and
controls over
maintain internal controls, including proper segregation of duties and an
payroll
effective system of internal review. Adequate segregation of duties
transactions reduces the likelihood that fraud or error will remain undetected by
providing for separate processing by different individuals at various stages
of a transaction and for independent reviews of the work performed.
Our audit found that OSHPD payroll transactions unit staff performed
conflicting duties. Staff members performed multiple steps in processing
payroll transactions, including entering data into the State’s payroll
system; auditing employee timesheets; reconciling payroll, including
reconciling system output to source documentation; reporting payroll
exceptions; and processing adjustments. For example, staff members
keyed in regular and overtime pay, and reconciled the master payroll,
overtime, and other supplemental warrants. In addition, as described in
Finding 2, seven managers had keying access to the payroll system while
responsible for approving payroll transactions entered in the system.
OSHPD failed to demonstrate that it had implemented compensating
controls to mitigate the risks associated with such a deficiency. We found
no indication that these functions were subjected to periodic supervisory
review.
The lack of adequate segregation of duties and compensating controls has
a pervasive effect on the OSHPD payroll process, and impairs the
effectiveness of other controls by rendering their design ineffective or by
keeping them from operating effectively. These control deficiencies, in
combination with other deficiencies discussed in Findings 2 through 8,
represent a material weakness in internal control over the payroll process
such that there is a reasonable possibility that a material noncompliance
with provisions of laws, regulations, or contracts will not be prevented, or
detected and corrected, on a timely basis.
Good internal control practices require that the following functional duties
be performed by different work units, or at minimum, by different
employees within the same unit:
Recording transactions – This duty refers to the record-keeping
function, which is accomplished by entering data into a computer
system.
Authorization to execute – This duty belongs to individuals with
authority and responsibility to initiate and execute transactions.
Periodic review and reconciliation of actual payments to recorded
amounts – This duty refers to making comparisons of information at
regular intervals and taking action to resolve differences.
-7-
Office of Statewide Health Planning and Development Payroll Audit
Recommendation
We recommend that OSHPD:
Separate conflicting payroll function duties to the greatest extent
possible. Adequate segregation of duties will provide a stronger
system of internal control whereby the functions of each employee are
subject to the review of another.
If it is not possible to segregate payroll functions fully and
appropriately, OSHPD should implement compensating controls. For
example, if the payroll transactions unit staff member responsible for
recordkeeping also performs a reconciliation process, then the
supervisor should perform and document a detailed review of the
reconciliation to provide additional control over the assignment of
conflicting functions. Compensating controls may also include dual
authorization requirements and documented reviews of payroll system
input and output; and
Develop formal procedures for performing and documenting
compensating controls.
OSHPD’s Response
OSHPD concurs with this finding. However, OSHPD can only segregate
duties to the extent allowed by allocated staffing and ensuing vacancies
and/or turnover. The duties and responsibilities of the Personnel
Specialist consist of processing various personnel/payroll transactions,
including data entry, reconciliation, and processing of adjustments and
corrections. Prior to this audit, OSHPD has implemented controls,
incorporated additional review, and improved compensating controls
over these transactions. These reviews consist of a monthly review by a
senior analyst of the Time and Attendance Report (Form 672) and the
Transactions Manager reviewing all Employee Time Certification
(Form 966), Payroll Exception Report (Form 666) and Absence Without
Pay Report (Form 603). In addition, OSHPD is in the process of drafting
processes and procedures for conducting these monthly reviews that will
be completed by March 2021.
SCO Comment
Our finding remains unchanged.
OSHPD concurred with the finding. We appreciate OSHPD’s response
regarding the actions it is planning to take to correct the noted deficiencies.
In its reponse, OSHPD also asserts the existence of compensating controls
to mitigate the risk associated with the lack of adequate segregation of
duties. As discussed in the finding, we found that OSHPD lacked adequate
segregation of duties and compensating controls within its payroll
transactions unit. OSHPD’s response stated that a senior analyst and a
manager perform reviews of payroll forms. These activities, if performed
effectively, provide prudent detective controls to identify errors after they
occurred; however, as discussed in the finding, we found no evidence that
such activities existed during our audit. In its response, OSHPD did not
provide additional documents to support that assertion.
-8-
Office of Statewide Health Planning and Development Payroll Audit
OSHPD lacked adequate controls to ensure that only appropriate staff had
FINDING 2—
keying access to the State’s payroll system. OSHPD inappropriately
Inappropriate
allowed 20 employees keying access to the State’s payroll system. If not
keying access to the
mitigated, this control deficiency leaves payroll data at risk of misuse,
State’s payroll
abuse, and unauthorized use.
system
The SCO maintains the State’s payroll system. The system is
decentralized, thereby allowing employees of state agencies to access it.
PPSD has established a Decentralized Security Program Manual that all
state agencies are required to follow in order to access the payroll system.
The program’s objectives are to secure and protect the confidentiality and
integrity of payroll data against misuse, abuse, and unauthorized use.
We examined the records of 33 OSHPD employees who had keying
access to the State’s payroll system at various times between March 2016
and February 2019. Of the 33 employees, 20 had inappropriate keying
access to the State’s payroll system. Specifically, OSHPD did not
immediately remove or modify keying access for 13 employees after the
employees’ separation from state service, transfer to another agency, or
change in classification. A Senior Personnel Specialist changed to an
ineligible classification on June 1, 2016; OSHPD did not request to
remove the employee’s access until February 14, 2017 (258 days later).
In addition, seven managers had keying access to the payroll system.
Keying access was withdrawn from six of the seven managers during the
audit period; one manager retained keying access during the audit period.
We determined that OSHPD had obtained approval from PPSD to provide
this manager with ongoing keying access. However, we found no evidence
that OSHPD implemented controls to address the risks associated with a
manager who has keying access to the payroll system while also being
responsible for approving payroll transactions entered in the system.
The Decentralized Security Program Manual states, in part:
The PPSD system contains sensitive and confidential information.
Access is restricted to persons with an authorized, legal, and legitimate
business requirement to complete their duties. . . .
Currently, PIMS, HIST, KEYM, PIP, LAS, MPC and/or ACAS
applications are restricted to Personnel Specialists or Personnel
Technician classifications because their need is by definition a function
of their specific job duties and any change in those duties requires a
reevaluation of the need for access.
If the employee’s duties change, such that the need for access no longer
exists, the access privilege MUST be removed or deleted immediately
by a request submitted by the department/campus. . . .
A request to grant access to an individual in a classification other than
in the Personnel Specialist/Payroll Technician series to access PIMS,
HIST, KEYM, PIP, LAS, MPC and/or ACAS requires a written
justification from the Authorizing Manager. The justification must
describe the individual's specific job duties requiring the need to access
system information (i.e., PIMS = Employment History, HIST=Payroll
History, LAS=Leave Accounting System, etc.) as well as level of access
to that application, in order to perform their regular daily duties.
-9-
Office of Statewide Health Planning and Development Payroll Audit
Manager classifications will be granted inquiry access only.
To prevent unauthorized use by a transferred, terminated or resigned
employee's user ID, the Security Monitor must IMMEDIATELY submit
all pages of the PSD125A to delete the user’s system access. Using an
old user ID increases the chances of a security breach which is a serious
security violation. Sharing a user ID is strictly prohibited and a serious
violation.
Recommendation
We recommend that OSHPD:
Update keying access to the State’s payroll system immediately after
employees leave OSHPD, transfer to another unit, or change
classifications; and
Periodically review access to the system to verify that access complies
with the Decentralized Security Program Manual.
OSHPD’s Response
OSHPD concurs with this finding. Since 2018, adequate controls have
been put in place to remove employees’ access in a timely manner. In
addition, the Chief of Human Resources completes a periodic review of
access to the SCO system in compliance with the State Decentralized
Security Program Manual. OSHPD considers this finding resolved.
SCO Comment
Our finding remains unchanged.
OSHPD concurred with the finding. We appreciate OSHPD’s response
regarding the existence of controls over employees’ payroll system access.
OSHPD asserts the existence of adequate controls over the removal of
employees’ access in a timely manner. As discussed in the finding, we
found that OSHPD lacked adequate controls to ensure that only
appropriate staff had keying access to the State’s payroll system. OSHPD
did not immediately remove or modify keying access for 13 employees
after the employees’ separation from state service, transfer to another
agency, or change in classification. OSHPD also granted keying access to
seven managers, in violation of the Decentralized Security Program
Manual.
OSHPD failed to implement controls to ensure that it adhered to the
FINDING 3—
requirements of collective bargaining agreements and state regulations to
Inadequate
limit the accumulation of vacation and annual leave credits. This
controls over
deficiency resulted in liability for excessive leave balances with a value of
vacation and
at least $380,862 as of February 28, 2019. We expect the liability to
annual leave
increase if OSHPD does not take action to address the excessive vacation
balances, resulting and annual leave balances.
in liability for
excessive balances Collective bargaining agreements and state regulations limit the amount
of vacation and annual leave that most state employees may accumulate
to no more than 80 days (640 hours). The limit on leave balances helps
-10-
Office of Statewide Health Planning and Development Payroll Audit
state agencies to manage leave balances and control the State’s liability
for accrued leave credits. State agencies may allow employees to carry a
higher leave balance only under limited circumstances. For example, an
employee may not be able to reduce accrued vacation or annual leave
hours below the limit due to business needs. When an employee’s leave
accumulation exceeds or is projected to exceed the limit, state agencies
should work with the employee to develop a written plan to reduce leave
balances below the applicable limit.
Our examination of OSHPD’s leave accounting records determined that
OSHPD had 407 employees with unused vacation or annual leave credits
at February 28, 2019. Of those employees, 33 exceeded the limit set by
collective bargaining agreements and state regulations. For example, one
employee had an accumulated balance of 1,806 hours in annual leave, or
1,166 hours beyond the 640-hour limit. Collectively, the 33 employees
accumulated 5,360 hours of excess vacation and annual leave, with a value
of at least $380,862 as of February 28, 2019.
This estimated liability does not adjust for salary rate increases and
additional leave credits.2 Accordingly, we expect that the amount needed
to pay for this liability will be higher. For example, a OSHPD employee
separated from state service with 1,338 hours of leave credits, including
798 hours of annual leave. After adjusting for additional leave credits, the
employee should have been paid for 1,582 hours, or 18% more.
We further examined the records of the 33 employees to determine
whether OSHPD complied with collective bargaining agreements and
state regulations. We determined that OSHPD could not demonstrate that
it had complied with collective bargaining agreements and state
regulations when allowing these employees to maintain excess vacation
or annual leave balances. We also found that, for 19 of the 33 employees,
OSHPD had no plans in place during the audit period to reduce leave
balances below the limit.
If OSHPD does not take action to reduce the excessive leave balances, the
liability for accrued vacation and annual leave will likely increase because
most employees will receive salary increases or use other non-
compensable leave credits instead of vacation or annual leave, thus
increasing their vacation or annual leave balances. The state agency
responsible for paying these leave balances may face a cash flow problem
if a significant number of employees with excessive vacation or annual
leave balances separate from state service. Normally, state agencies are
not budgeted to make these separation lump-sum payments. However, the
State’s current practice dictates that the state agency that last employed an
employee pays for that employee’s separation lump-sum payment,
regardless of where the employee accrued the leave balance.
2 Most state employees receive pay rate increases every year pursuant to state laws and/or collective bargaining
agreements until they reach the top of their pay scale, or promote into a higher-paying position. In addition, when
an employee’s accumulated leave balances upon separation are calculated for lump-sum pay, the employee is
credited with additional leave credits equal to the amount that the employee would have earned had the employee
taken time off and not separated from state service.
-11-
Office of Statewide Health Planning and Development Payroll Audit
Although a new directive from CalHR that became effective
October 20, 2020, does not affect the dollar value of this finding, we are
disclosing this directive because it affects our recommendation. CalHR
has directed departments to immediately suspend policies that require
leave balances be reduced below the limit, and that require employees to
implement leave-reduction plans. This suspension will be in effect until
the 2020 PLP ends, or July 1, 2022, whichever is sooner.
Recommendation
We recommend that, after the 2020 PLP ends, or July 1, 2022, whichever
is sooner, OSHPD:
Implement controls, including existing policies and procedures, to
ensure that its employees’ vacation and annual leave balances are
maintained within levels allowed by collective bargaining agreements
and state regulations;
Conduct ongoing monitoring of controls to ensure that they are
implemented and operating effectively; and
Participate in leave buy-back programs if the State offers such
programs and funds are available.
OSHPD’s Response
Since 2018, OSHPD implemented a process to send memos to both the
employee with excessive leave balances and their supervisors notifying
them of their balances and requesting leave reduction plans be submitted
to the Human Resources Services Section (HRSS) for monitoring.
OSHPD also sends out an annual notification to all employees regarding
the leave balance maximums and suggestions for maintaining leave
balances under the maximum allowed, as well strategies for reducing
leave balances that over the maximum allowed. OSHPD considers this
finding resolved.
SCO Comment
Our finding remains unchanged.
We appreciate OSHPD’s response regarding the actions it has taken to
address the excessive leave balances. As discussed in the finding, we
found that OSHPD failed to implement controls to ensure that it adhered
to the requirements of collective bargaining agreements and state
regulations to limit the accumulation of vacation and annual leave credits.
In its response, OSHPD did not dispute that it could not demonstrate that
it had complied with collective bargaining agreements and state
regulations when allowing these employees to maintain excess vacation
or annual leave balances. The response stated, however, that OSHPD
notified the employees and supervisors of their leave balances and
requested them to submit leave reduction plans. This activity was not
operating effectively. As stated in the finding, 33 employees exceeded the
limit for vacation and annual leave. Nineteen of the 33 employees did not
have leave reduction plans in place during the audit period.
-12-
Office of Statewide Health Planning and Development Payroll Audit
OSHPD lacked adequate segregation of duties within its payroll
FINDING 4—
transactions unit, as noted in Finding 1, and lacked adequate controls over
Inadequate
the processing of regular pay. We identified a total of $5,474,825 in
controls over
overpayments and questioned payments for regular pay, consisting of
regular pay,
$493 in overpayments and $31,858 in questioned payments based on
resulting in
actual transactions examined (“known”); and $82,939 in overpayments
overpayments and and $5,359,535 in questioned payments based on the results of statistical
questioned sampling (“likely”). If not mitigated, these control deficiencies leave
payments OSHPD at risk of making additional improper payments for regular pay.
Collective bargaining agreements, and state laws and policies, contain
specific clauses regarding regular pay. Payroll records show that OSHPD
processed 16,653 regular pay transactions, totaling $117,143,934,
between March 2016 and February 2019. Of the 16,653 regular pay
transactions, we randomly selected a statistical sample (as described in the
Appendix) of 105 transactions, totaling $692,204. Of the 105 transactions,
one was overpaid by $493.
We also questioned five transactions, totaling $31,858, because OSHPD
could not provide the employees’ timesheets to support that the payments
were valid and authorized. Although the State’s payroll system makes all
computations and prepares the “negative” payrolls, timesheets are still
required to substantiate the hours worked for regular pay.3 Without a
timesheet, there is no record of hours worked and supervisory review or
approval. Therefore, we could not determine the validity and authorization
of payment for these regular pay transactions. As a result, we questioned
these payments. These payments resulted in a total of $32,351 in
overpayments and questioned payments.
As we used a statistical sampling method to select the regular pay
transactions examined, we projected the amount of likely overpayments
to be $82,939. We could also estimate that there may have been additional
missing timesheets associated with regular pay, totaling $5,359,535. As
timesheets are required documents to authorize pay, we would also
question these regular pay transactions. These payments resulted in a total
of $5,442,474 in likely overpayments and questioned payments.
Therefore, the known and likely overpayments and questioned payments
totaled $5,474,825, consisting of $83,432 in overpayments and
$5,391,393 in questioned payments.
3 According to SCO’s Payroll Procedures Manual, “These are referred to as ‘negative’ payrolls because attendance
reports have not been submitted and no working payrolls have been cleared with agencies/campuses when the
payrolls are prepared. This payroll writing operation is performed for the majority of state employees during the
period from the cutoff day in each pay period to the 27th and 28th of the month.”
-13-
Office of Statewide Health Planning and Development Payroll Audit
The following table summarizes the results of our statistical sampling:
Known overpayments and questioned payments $ 32,351
Divide by: Sample 692,204
Error rate for projection (differences due to rounding) 4.67%
Population that was statistically sampled 117,143,934
Multiply by: Error rate for projection 4.67%
Known and likely overpayments and questioned payments (differences due to rounding) 5,474,825
Less: Known overpayments and questioned payments 32,351
Likely overpayments and questioned payments $ 5,442,474
_____________
* Amounts in this table are rounded to the nearest dollar.
The known overpayment occurred because payroll transactions unit staff
members failed to reduce leave balances for absences in the leave
accounting system. OSHPD also lacked adequate supervisory review to
ensure accurate processing of regular pay.
GC sections 13400 through 13407 require state agencies to establish and
maintain internal controls, including a system of policies and procedures
adequate to ensure compliance with applicable laws and other
requirements, and an effective system of internal review.
Recommendation
We recommend that OSHPD:
Conduct a review of payments for regular pay made during the past
three years to ensure that the payments complied with collective
bargaining agreements and state laws and policies; and
Recover the overpayment made to employee through an agreed-upon
collection method in accordance with GC section 19838.
We further recommend that, to prevent improper payments for regular pay
from recurring, OSHPD:
Establish adequate internal controls to ensure that payments are
accurate and comply with collective bargaining agreements and state
laws and policies;
Provide adequate oversight to ensure that payroll transactions unit
staff process only valid and authorized payments that comply with
collective bargaining agreements and state laws and policies; and
Maintain supporting documentation for payments pursuant to
retention policies.
OSHPD lacked adequate segregation of duties within its payroll
FINDING 5—
transactions unit, as noted in Finding 1, and lacked adequate controls over
Inadequate
the processing of overtime pay. We identified a net total of $81,495 in
controls over
improper and questioned payments for overtime, consisting of $1,570 in
overtime pay,
known overpayments, $1,412 in known underpayments, and $12,338 in
resulting in
known questioned payments; and $8,672 in likely overpayments, $7,799
improper and in likely underpayments, and $68,126 in likely questioned payments. If
questioned
payments -14-
Office of Statewide Health Planning and Development Payroll Audit
not mitigated, these control deficiencies leave OSHPD at risk of making
additional improper payments for overtime.
Collective bargaining agreements, and state laws and policies, contain
specific clauses regarding overtime pay. Payroll records show that
OSHPD processed 584 overtime pay transactions, totaling $690,982,
between March 2016 and February 2019. All these payments were made
to employees in Work Week Group 2. Of the 584 overtime pay
transactions, we randomly selected a statistical sample (as described in the
Appendix) of 105 transactions, totaling $105,949. Of the 105 transactions,
eight were overpaid by approximately $1,570 and eight were underpaid
by approximately $1,412.
We also questioned 14 transactions, totaling $12,338, because OSHPD
could not provide the employees’ timesheets to support that the payments
were valid and authorized. Without the required documentation, there is
no record of calculation or approval of overtime payments. Therefore, we
could not determine the validity, accuracy, and propriety of these
payments. As a result, we questioned these payments. These payments
resulted in a net total of $12,496 in improper and questioned payments.
As we used a statistical sampling method to select the overtime pay
transactions examined, we projected the amount of likely overpayments
to be $8,672 and likely underpayments to be $7,799. We could also
estimate that there may have been additional missing timesheets
associated with overtime pay, totaling $68,126. As timesheets are required
documents to authorize pay, we would also question these overtime pay
transactions. These payments resulted in a net total of $68,999 in likely
improper and questioned payments. Therefore, the known and likely
improper and questioned payments totaled a net of approximately
$81,495, consisting of $10,242 in overpayments, $9,211 in
underpayments, and $80,464 in questioned payments.
The following table summarizes the results of our statistical sampling:
Known improper and questioned payments, net $ 12,496
Divide by: Sample 105,949
Error rate for projection (differences due to rounding) 11.79%
Population that was statistically sampled 690,982
Multiply by: Error rate for projection 11.79%
Known and likely improper and questioned payments, net (differences due
to rounding) 81,495
Less: Known improper and questioned payments, net 12,496
Likely improper and questioned payments, net $ 68,999
_____________
* Amounts in this table are rounded to the nearest dollar.
The known improper payments occurred because payroll transactions unit
staff members miscalculated overtime hours worked, and paid for
overtime hours that were not shown on timesheets. Furthermore, OSHPD
lacked adequate supervisory review to ensure accurate processing of
overtime pay.
-15-
Office of Statewide Health Planning and Development Payroll Audit
GC sections 13400 through 13407 require state agencies to establish and
maintain internal controls, including a system of policies and procedures
adequate to ensure compliance with applicable laws and other
requirements, and an effective system of internal review.
Recommendation
We recommend that OSHPD:
Conduct a review of overtime payments made during the past three
years to ensure that the payments complied with collective bargaining
agreements and state laws and policies; and
Recover overpayments made to employees through an agreed-upon
collection method in accordance with GC section 19838, and properly
compensate those employees who were underpaid.
We further recommend that, to prevent improper overtime payments from
recurring, OSHPD:
Establish adequate internal controls to ensure that payments are
accurate and comply with collective bargaining agreements and state
laws and policies;
Provide adequate oversight to ensure that payroll transactions unit
staff process only valid and authorized payments that comply with
collective bargaining agreements and state laws and policies; and
Maintain supporting documentation for payments pursuant to
retention policies.
OSHPD lacked adequate segregation of duties within its payroll
FINDING 6—
transactions unit, as noted in Finding 1, and lacked adequate controls over
Inadequate
the processing of employee separation lump-sum pay. We identified a net
controls over
total of $55,609 in underpayments for separation lump-sum pay,
separation lump-
consisting of $4,430 in known overpayments and $30,605 in known
sum pay, resulting
underpayments, and $4,982 in likely overpayments and $34,416 in likely
in improper and underpayments. OSHPD also did not make separation lump-sum
late payments payments to 16 employees in a timely manner. If not mitigated, these
control deficiencies leave OSHPD at risk of making additional improper
and late separation lump-sum payments, noncompliance with agreements
and laws, and liability for late payments.
GC section 19839 allows lump-sum payment for accrued eligible leave
credits when an employee separates from state employment. Collective
bargaining agreements include similar provisions regarding separation
lump-sum pay.
Payroll records show that OSHPD processed separation lump-sum
payments, totaling $1,600,332, for 98 employees between March 2016
and February 2019. Of the 98 employees, we randomly selected a
statistical sample (as described in the Appendix) of 57 employees who
received separation lump-sum pay, totaling $753,264. Of the
57 employees, eight were overpaid by approximately $4,430 and nine
were underpaid by approximately $30,605. These payments resulted in a
net total of $26,175 in underpayments.
-16-
Office of Statewide Health Planning and Development Payroll Audit
As we used a statistical sampling method to select the employees whose
separation lump-sum payments were examined, we projected the amount
of likely overpayments to be $4,982 and likely underpayments to be
$34,416. These payments resulted in a net total of $29,434 in
underpayments. Therefore, the known and likely net underpayments
totaled approximately $55,609, consisting of $9,412 in overpayments and
$65,021 in underpayments.
The following table summarizes the results of our statistical sampling:
Known underpayments, net $ 26,175
Divide by: Sample 753,264
Error rate for projection (differences due to rounding) 3.47%
Population that was statistically sampled 1,600,332
Multiply by: Error rate for projection 3.47%
Known and likely underpayments, net (differences due to rounding) 55,609
Less: Known underpayments, net 26,175
Likely underpayments, net $ 29,434
_____________
* Amounts in this table are rounded to the nearest dollar.
The known improper payments were made because payroll transactions
unit staff members miscalculated leave balances paid for separation lump-
sum pay. OSHPD also lacked adequate supervisory review to ensure
accurate and timely processing of separation lump-sum pay.
Of the 57 employees whose separation lump-sum payments we examined,
16 were not paid in a timely manner, in violation of collective bargaining
agreements and state laws as summarized in CalHR’s Human Resources
Manual, section 1703.
GC sections 13400 through 13407 require state agencies to establish and
maintain internal controls, including an effective system of internal
review.
Recommendation
We recommend that OSHPD:
Establish adequate controls to ensure accurate and timely separation
lump-sum payments;
Conduct a review of separation lump-sum payments made during the
past three years to ensure that the payments were accurate and in
compliance with collective bargaining agreements and state law; and
Recover overpayments made to separated employees in accordance
with GC section 19838 and State Administrative Manual (SAM)
section 8776.6, and properly compensate those employees who were
underpaid.
-17-
Office of Statewide Health Planning and Development Payroll Audit
OSHPD lacked adequate segregation of duties within its payroll
FINDING 7—
transactions unit, as noted in Finding 1, and lacked adequate controls over
Inadequate
salary advances to ensure that advances were recovered in accordance
controls over
with state law and policies. Six salary advances, totaling $10,782,
salary advances,
remained outstanding as of February 28, 2019, due to OSHPD’s
resulting in failure
noncompliance with the State’s collection policies and procedures. The
to recover oldest unrecovered salary advance was outstanding for over four years.
outstanding These control deficiencies leave OSHPD at risk of failing to collect further
amounts salary advances if not mitigated.
At February 28, 2019, OSHPD’s accounting records showed six
outstanding salary advances, totaling $10,782, including five balances,
totaling $10,717, which had been outstanding for more than 120 days.
Generally, the prospect of collection diminishes as an account ages. When
an agency does not initiate collection within three years from the date of
overpayment, the possibility of collection is remote.
GC section 19838 and SAM sections 8776 and 8776.7 describe the State’s
collection policies and procedures, which require OSHPD to collect salary
advances in a timely manner and maintain proper records of collection
efforts.
We examined the six outstanding salary advances and noted that OSHPD
did not comply with the State’s collection policies and procedures for any
of them. OSHPD did not send collection notices.
The lack of adequate controls over salary advances reduces the likelihood
of collection, increases the amount of resources expended on collection
efforts, and negatively impacts cash flow.
Recommendation
We recommend that OSHPD ensure that it recovers salary advances in a
timely manner, pursuant to GC section 19838 and SAM sections 8776 and
8776.7. If all reasonable collection procedures do not result in payment,
OSHPD may request discharge from accountability of uncollectable
amounts.
OSHPD lacked adequate segregation of duties within its payroll
FINDING 8—
transactions unit, as noted in Finding 1, and lacked adequate controls over
Inadequate
the processing of leave buy-back. We identified $17,940 in overpayments
controls over leave
for separation lump-sum pay, consisting of $5,990 in known overpayment
buy-back, resulting
and $11,950 in likely overpayments. If not mitigated, these control
in overpayments
deficiencies leave OSHPD at risk of making additional improper leave
buy-back payments.
GC sections 13400 through 13407 require state agencies to establish and
maintain internal controls, including a system of policies and procedures
adequate to ensure compliance with applicable laws and other
requirements, and an effective system of internal review.
A leave-buy back occurs when an employee receives payment at the
regular salary rate in exchange for accrued vacation, annual leave,
-18-
Office of Statewide Health Planning and Development Payroll Audit
personal leave, personal holiday, and/or holiday credits. Collective
bargaining agreements between the State and Bargaining Units 1, 2, 4, 9,
10, 11, and 12 allow for the annual cash-out of a certain number of hours
of accumulated vacation and annual leave if funds are available.
Title 2, California Code of Regulations, section 599.744 also provides that
CalHR may authorize a leave buy-back program for employees excluded
from collective bargaining. CalHR authorized leave buy-backs for
excluded employees in fiscal year (FY) 2015-16, FY 2016-17, and
FY 2017-18. It also provided the State’s policies and procedures regarding
cash-out of vacation and annual leave.
Payroll records show that OSHPD processed 181 leave buy-back
transactions, totaling $748,504, between March 2016 and February 2019.
Of the 181 leave buy-back transactions, we randomly selected a statistical
sample (as described in the Appendix) of 60 transactions, totaling
$249,899. Of the 60 transactions, one was overpaid by approximately
$5,990. As we used a statistical sampling method to select the leave
buy-back transactions examined, we projected the amount of likely
overpayments to be $11,950. Therefore, the known and likely
overpayments totaled approximately $17,940.
The following table summarizes the results of our statistical sampling:
Known overpayment $ 5,990
Divide by: Sample 249,899
Error rate for projection (differences due to rounding) 2.40%
Population that was statistically sampled 748,504
Multiply by: Error rate for projection 2.40%
Known and likely overpayments (differences due to rounding) 17,940
Less: Known overpayment 5,990
Likely overpayments $ 11,950
_____________
* Amounts in this table are rounded to the nearest dollar.
The known overpayment was made because payroll transactions unit staff
members failed to reduce leave balances in the leave accounting system.
OSHPD also lacked adequate supervisory review to ensure accurate
processing of leave buy-back.
Recommendation
We recommend that OSHPD:
Recover the overpayment made to the employee through an agreed-
upon collection method in accordance with GC section 19838; and
To prevent improper leave buy-back payments from recurring,
establish adequate internal controls, including oversight of payroll
transactions unit staff, to ensure that payments for leave buy-back are
accurate, and comply with collective bargaining agreements and state
laws and policies.
-19-
Office of Statewide Health Planning and Development Payroll Audit
Appendix—
Audit Sampling Methodology
We used attributes sampling for tests of compliance. The sample design was chosen because:
It follows the American Institute of Certified Public Accountants (AICPA) guidelines;
It allows us to achieve our objectives for tests of compliance in an efficient and effective manner; and
Audit areas included both high and low volumes of transactions.
The following table outlines our audit sampling application for all audit areas where statistical sampling was utilized:
Results
Expected Projected to
Audit Type Population Population Sampling Sample Selection Confidence Tolerable Error Sample Intended Finding
Area of Test (Unit) (Dollar) Unit Method Level Error Rate (Rate) ᵃ Size ᵇ Population Number
Regular pay Compliance 1 6,653 $117,143,934 Transaction Computer-generated 90% 5% 2 (1.75%) 105 Yes 4
simple random
Overtime pay Compliance 5 84 6 90,982 Transaction Computer-generated 90% 5% 2 (1.75%) 105 Yes 5
simple random
Separation lump-sum pay Compliance 9 8 1,600,332 Employee Computer-generated 90% 5% 2 (1.75%) 57 Yes 6
simple random
Leave buy-back Compliance 1 81 7 48,504 Transaction Computer-generated 90% 5% 1 (0.50%) 60 Yes 8
simple random
_________________
ᵃ Pursuant to the AICPA’s Audit Guide: Audit Sampling (May 1, 2017 edition), pages 131-133, the expected error is the expected number of errors planned for in the sample. It is
derived by multiplying the expected error rate by the sample size. The expected number of errors in the sampling tables on pages 135-136 was rounded upward, e.g., 0.2 errors
becomes 1.0 error.
ᵇ For populations of fewer than 250 items, we determined the sample size using a calculator that uses a hypergeometric distribution. For populations of 250 items or more, we
determined the sample size using a calculator that uses a binomial distribution. As stated in Technical Notes on the AICPA Audit Guide Audit Sampling (March 1, 2012), page 5,
although the hypergeometric distribution is the exactly correct distribution to use for attributes sample sizes, the distribution becomes unwieldy for large populations unless
suitable software is available. Therefore, more convenient approximations are frequently used instead.
Office of Statewide Health Planning and Development Payroll Audit
Attachment—
Office of Statewide Health Planning and Development’s
Response to Draft Audit Report
State Controller’s Office
Division of Audits
Post Office Box 942850
Sacramento, CA 94250
http://www.sco.ca.gov
S19-PAR-0015