Sierra Conservation Center Payroll Process and Transactions

SIERRA CONSERVATION CENTER Audit Report PAYROLL AUDIT August 1, 2015, through July 31, 2018 BETTY T. YEE California State Controller November 2020 BETTY T. YEE California State Controller November 12, 2020 Patrick Eaton, Warden Sierra Conservation Center 5100 O’Byrnes Ferry Road Jamestown, CA 95327 Dear Mr. Eaton: The State Controller’s Office audited the Sierra Conservation Center’s (SCC) payroll process and transactions for the period of August 1, 2015, through July 31, 2018. SCC management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. Our audit determined that SCC did not maintain adequate and effective internal controls over its payroll process. SCC lacked adequate segregation of duties and compensating controls over payroll transactions that resulted in improper overtime and separation lump-sum payments and improper holiday credits. SCC also granted inappropriate keying access to the State’s payroll system. In addition, SCC failed to implement controls to limit the accumulation of vacation and annual leave credits, resulting in liability for excessive balances. SCC administered salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. If you have any questions, please contact Andrew Finlayson, Chief, State Agency Audits Bureau, by telephone at (916) 324-6310, or by email at afinlayson@sco.ca.gov. Sincerely, Original signed by JIM L. SPANO, CPA Chief, Division of Audits JLS/ac Patrick Eaton, Warden -2- November 12, 2020 cc: Carla Salyers, Institution Personnel Officer Sierra Conservation Center Kathleen Allison, Secretary California Department of Corrections and Rehabilitation Jennifer Barretto, Undersecretary Administration California Department of Corrections and Rehabilitation Katherine Minnich, Deputy Director Human Resources California Department of Corrections and Rehabilitation Mai Lee Vang, External Audits Manager Office of Audits and Court Compliance California Department of Corrections and Rehabilitation Brenden Murphy, Chief Administrative Services Division California Department of Human Resources Jil Barraza, Chief Personnel and Payroll Services Division State Controller’s Office Sierra Conservation Center Payroll Audit Contents Audit Report Summary ............................................................................................................................ 1 Background ........................................................................................................................ 1 Objectives, Scope, and Methodology ............................................................................... 2 Conclusion .......................................................................................................................... 3 Follow-up on Prior Audit Findings .................................................................................. 4 Views of Responsible Officials .......................................................................................... 4 Restricted Use .................................................................................................................... 5 Schedule—Summary of Audit Results ................................................................................. 6 Findings and Recommendations ........................................................................................... 7 Appendix—Audit Sampling Methodology Attachment—Sierra Conservation Center’s Response to Draft Audit Report Sierra Conservation Center Payroll Audit Audit Report Summary The State Controller’s Office (SCO) audited the Sierra Conservation Center’s (SCC) payroll process and transactions for the period of August 1, 2015, through July 31, 2018. SCC management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. We completed our audit fieldwork on June 12, 2020. Our audit determined that SCC:  Did not maintain adequate and effective internal controls over its payroll process. SCC lacked adequate segregation of duties and compensating controls over payroll transactions that resulted in improper overtime and separation lump-sum payments and improper holiday credits. Additionally, SCC granted inappropriate keying access to the State’s payroll system;  Did not implement controls to limit the accumulation of vacation and annual leave credits, resulting in liability for excessive balances; and  Administered salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. Background In 1979, the State of California adopted collective bargaining for state employees. This created a significant workload increase for the SCO’s Personnel and Payroll Services Division (PPSD), as PPSD was the State’s centralized payroll processing center for all payroll related-transactions. PPSD decentralized the processing of payroll, allowing state agencies and departments to process their own payroll-related transactions. Periodic audits of the decentralized payroll processing at state agencies and departments ceased due to the budget constraints in the late 1980s. In 2013, the California State Legislature reinstated these payroll audits to gain assurance that state agencies and departments maintain adequate internal control over the payroll function, provide proper oversight of their decentralized payroll processing, and comply with various state laws and regulations regarding payroll processing and related transactions. Audit Authority Authority for this audit is provided by California Government Code (GC) section 12476, which states: The Controller may audit the uniform state pay roll system, the State Pay Roll Revolving Fund, and related records of state agencies within the uniform state pay roll system, in such manner as the Controller may determine. -1- Sierra Conservation Center Payroll Audit In addition, GC section 12410 stipulates: The Controller shall superintend the fiscal concerns of the state. The Controller shall audit all claims against the state, and may audit the disbursement of any state money, for correctness, legality, and for sufficient provisions of law for payment. Objectives, Scope, We performed this audit to determine whether SCC: and Methodology  Maintained adequate and effective internal controls over its payroll process;  Processed payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures; and  Administered salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. The audit covered the period from August 1, 2015, through July 31, 2018. The audit population consisted of payroll transactions totaling $331,937,497, as quantified in the Schedule. To achieve our audit objectives, we:  Reviewed state and SCC policies and procedures related to the payroll process to understand SCC’s methodology for processing various payroll and payroll-related transactions;  Interviewed SCC payroll personnel to understand SCC’s methodology for processing payroll and payroll-related transactions, determine employees’ level of knowledge and ability relating to payroll transaction processing, and gain an understanding of existing internal control over the payroll process and systems;  Selected transactions recorded in the State’s payroll database using statistical sampling, as outlined in the Appendix, and targeted selection based on risk factors and other relevant criteria;  Analyzed and tested the selected transactions, and reviewed relevant files and records to determine the accuracy of payroll and payroll- related payments, accuracy of leave transactions, adequacy and effectiveness of internal control over the payroll process, and compliance with collective bargaining agreements and state laws, regulations, policies, and procedures; and  Reviewed salary advances to determine whether SCC administered and recorded them in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our -2- Sierra Conservation Center Payroll Audit audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Conclusion Our audit determined that SCC:  Did not maintain adequate and effective internal controls over its payroll process.1 We found the following deficiencies in internal control over the payroll process that we consider to be material weaknesses: o Inadequate segregation of duties and a lack of compensating controls over payroll transactions (see Finding 1); o Inappropriate keying access to the State’s payroll system (see Finding 2); o Inadequate controls to ensure that overtime payments were calculated correctly and granted to eligible employees, resulting in improper payments (see Finding 3); o Failure to implement controls to ensure that SCC adhered to the requirements of collective bargaining agreements and state regulations to limit the accumulation of vacation and annual leave credits, resulting in liability for excessive balances (see Finding 4); o Inadequate controls to ensure that separation lump-sum payments were calculated correctly and paid in a timely manner, resulting in improper and late payments (see Finding 5); o Inadequate controls to ensure that holiday credits were granted to eligible employees, resulting in improper credits (see Finding 6);  Did not process payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. We found the following instances of noncompliance with the requirements 1 In planning and performing our audit of compliance, we considered SCC’s internal control over compliance with collective bargaining agreements and state laws, regulations, policies, and procedures to determine the auditing procedures that were appropriate under the circumstances for the purpose of providing a conclusion on compliance, and to test and report on internal control over compliance. Our consideration of internal control over compliance was for the limited purpose described in the first paragraph of this footnote; it was not designed to identify all deficiencies in internal control over compliance that might be material weaknesses or significant deficiencies. A deficiency in internal control over compliance exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance with provisions of laws, regulations, or contracts on a timely basis. Control deficiencies, either individually or in combination with other control deficiencies, may be evaluated as significant deficiencies or material weaknesses. A material weakness in internal control over compliance is a deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. A significant deficiency over compliance is a deficiency, or a combination of deficiencies, in internal control over compliance with provisions of laws, regulations, or contracts that is less severe than a material weakness, yet important enough to merit attention from those charged with governance. -3- Sierra Conservation Center Payroll Audit of collective bargaining agreements and state laws, regulations, policies, and procedures: o Improper payments for overtime pay (see Finding 3), improper and late payments for employee separation lump-sum pay (see Finding 5), and improper holiday credits (see Finding 6), costing an estimated net total of $4,052,600; o Excessive vacation and annual leave balances with a value of at least $460,889 as of July 31, 2018. While a new directive from California Department of Human Resources (CalHR) that became effective October 20, 2020 does not impact the dollar value of this finding, we are disclosing this directive as it impacts the recommendation. CalHR has directed departments to immediately suspend policies that require leave balances be reduced below the limit and not require employees to implement leave-reduction plans until the 2020 Personal Leave Program (2020 PLP) ends or July 1, 2022 whichever is sooner (see Finding 4); and  Administered salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. Follow-up on The California Department of Corrections and Rehabilitation’s Human Prior Audit Resources issued a report on June 24, 2016, for its Peer Review of SCC for the period of July 2013, through May 2015. The Peer Review report Findings included findings regarding improper payments made for overtime and late payments of separation lump-sum pay. Based on the work we performed during the current audit, we noted similar findings (see Findings 3 and 5). The California Department of Corrections and Rehabilitation’s Office of Audits and Court Compliance issued a report on February 22, 2017, for its Business Services Review of SCC from January 9, 2017, through January 12, 2017. The Business Services Review report included findings related to inadequate documentation for separation lump-sum pay and uncollected salary advances. Based on the work we performed during the current audit, SCC has taken appropriate corrective actions in response to these findings. Views of We issued a draft audit report on September 21, 2020. Patrick Eaton, Warden, responded by letter dated September 28, 2020 (Attachment), Responsible agreeing with the audit results. This final audit report includes SCC’s Officials response. -4- Sierra Conservation Center Payroll Audit Restricted Use This audit report is solely for the information and use of SCC and SCO; it is not intended to be and should not be used by anyone other than these specified parties. This restriction is not intended to limit distribution of this audit report, which is a matter of public record and is available on the SCO website at www.sco.ca.gov. Original signed by JIM L. SPANO, CPA Chief, Division of Audits November 12, 2020 -5- Sierra Conservation Center Payroll Audit Schedule— Summary of Audit Results August 1, 2015, through July 31, 2018 Net Total Number of Number of Dollar Amount Dollar Amount Method of Units of Dollar Amount Selections Selection of Selections of Known and Finding Audit Area Tested Selection Population of Population Examined Unit Examined Likely Issues Number Segregation of duties N/A N/A N/A N/A N/A N/A N/A 1 System access Targeted 2 4 N/A 2 4 Employee N/A N/A 2 Overtime pay Statistical and 2 1,008 $ 6 6,675,126 1 15 Transaction $ 281,604 $ 3 ,901,445 3 targeted Excess vacation and Targeted 3 5 4 60,889 3 5 Employee 460,889 460,889 4 annual leave Separation Statistical 2 38 8,457,221 6 7 Employee 2,495,583 1 49,465 5 lump-sum pay Holiday credit Targeted 5,411 2,275,692 3 5 Transaction 24,750 1,690 6 Regular pay Statistical 3 8,985 2 52,265,390 105 Transaction - - Uniform allowance Statistical 2,518 1,624,758 105 Transaction - - Leave buy-back Statistical 1 63 1 74,331 6 0 Transaction - - Salary advance Targeted 7 4,090 7 Transaction - - $ 331,937,497 $ 3 ,262,826 $ 4 ,513,489 -6- Sierra Conservation Center Payroll Audit Findings and Recommendations FINDING 1— SCC lacked adequate segregation of duties within its payroll transactions unit to ensure that only valid and authorized payroll transactions were Inadequate processed. SCC also failed to implement other controls to compensate for segregation of this risk. duties and lack of compensating GC sections 13400 through 13407 require state agencies to establish and controls over maintain internal controls, including proper segregation of duties and an payroll effective system of internal review. Adequate segregation of duties transactions reduces the likelihood that fraud or error will remain undetected by providing for separate processing by different individuals at various stages of a transaction and for independent reviews of the work performed. Our audit found that SCC payroll transactions unit staff performed conflicting duties. Staff members performed multiple steps in processing payroll transactions, including entering data into the State’s payroll system; auditing employee timesheets; reconciling payroll, including reconciling system output to source documentation; reporting payroll exceptions; and processing adjustments. For example, staff members keyed in regular and overtime pay and reconciled the master payroll, overtime, and other supplemental warrants. SCC failed to demonstrate that it implemented compensating controls to mitigate the risks associated with such a deficiency. We found no indication that these functions were subjected to periodic supervisory review. The lack of adequate segregation of duties and compensating controls has a pervasive effect on the SCC payroll process, and impairs the effectiveness of other controls by rendering their design ineffective or by keeping them from operating effectively. These control deficiencies, in combination with other deficiencies discussed in Findings 2 through 6, represent a material weakness in internal control over the payroll process such that there is a reasonable possibility that a material noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. Good internal control practices require that the following functional duties be performed by different work units, or at minimum, by different employees within the same unit:  Recording transactions – This duty refers to the record-keeping function, which is accomplished by entering data into a computer system.  Authorization to execute – This duty belongs to individuals with authority and responsibility to initiate and execute transactions.  Periodic review and reconciliation of actual payments to recorded amounts – This duty refers to making comparisons of information at regular intervals and taking action to resolve differences. -7- Sierra Conservation Center Payroll Audit Recommendation We recommend that SCC:  Separate conflicting payroll function duties to the greatest extent possible. Adequate segregation of duties will provide a stronger system of internal control whereby the functions of each employee are subject to the review of another. If it is not possible to segregate payroll functions fully and appropriately, SCC should implement compensating controls. For example, if the payroll transactions unit staff member responsible for recordkeeping also performs a reconciliation process, then the supervisor should perform and document a detailed review of the reconciliation to provide additional control over the assignment of conflicting functions. Compensating controls may also include dual authorization requirements and documented reviews of payroll system input and output; and  Develop formal procedures for performing and documenting compensating controls. SCC lacked adequate controls to ensure that only appropriate staff had FINDING 2— keying access to the State’s payroll system. SCC inappropriately allowed Inappropriate keying six employees keying access to the State’s payroll system. If not mitigated, access to the State’s this control deficiency leaves payroll data at risk of misuse, abuse, and payroll system unauthorized use. The SCO maintains the State’s payroll system. The system is decentralized, thereby allowing employees of state agencies to access it. PPSD has established a Decentralized Security Program Manual that all state agencies are required to follow in order to access the payroll system. The program’s objectives are to secure and protect the confidentiality and integrity of payroll data against misuse, abuse, and unauthorized use. We examined the records of 24 SCC employees who had keying access to the State’s payroll system at various times between August 2015 and July 2018. Of the 24 employees, six had inappropriate keying access to the State’s payroll system. Specifically, SCC did not immediately remove or modify keying access for the six employees after the employees’ separation from state service, transfer to another agency, or change in classification. For example, a Personnel Specialist left SCC on March 2, 2018; SCC did not request to remove the employee’s access until August 2, 2018, five months later. The Decentralized Security Program Manual states, in part: The PPSD system contains sensitive and confidential information. Access is restricted to persons with an authorized, legal, and legitimate business requirement to complete their duties. . . . Currently, PIMS, HIST, KEYM, PIP, LAS, MPC and/or ACAS applications are restricted to Personnel Specialists or Personnel Technician classifications because their need is by definition a function of their specific job duties and any change in those duties requires a reevaluation of the need for access. -8- Sierra Conservation Center Payroll Audit If the employee’s duties change, such that the need for access no longer exists, the access privilege MUST be removed or deleted immediately by a request submitted by the department/campus. . . . A request to grant access to an individual in a classification other than in the Personnel Specialist/Payroll Technician series to access PIMS, HIST, KEYM, PIP, LAS, MPC and/or ACAS requires a written justification from the Authorizing Manager. The justification must describe the individual’s specific job duties requiring the need to access system information (i.e., PIMS = Employment History, HIST=Payroll History, LAS=Leave Accounting System, etc.) as well as level of access to that application, in order to perform their regular daily duties. . . . To prevent unauthorized use by a transferred, terminated or resigned employee’s user ID, the Security Monitor must IMMEDIATELY submit all pages of the PSD125A to delete the user’s system access. Using an old user ID increases the chances of a security breach which is a serious security violation. Sharing a user ID is strictly prohibited and a serious violation. Recommendation We recommend that SCC:  Update keying access to the State’s payroll system immediately after employees leave SCC, transfer to another unit, or change classifications; and  Periodically review access to the system to verify that access complies with the Decentralized Security Program Manual. SCC lacked adequate segregation of duties within its payroll transactions FINDING 3— unit, as noted in Finding 1, and lacked adequate controls over the Inadequate controls processing of overtime pay. We identified a net total of $3,901,445 in over overtime pay, improper payments for overtime, consisting of $84,528 in overpayments resulting in and $227 in underpayments based on actual transactions examined improper payments (“known”); and $3,890,765 in overpayments and $73,621 in underpayments based on the results of statistical sampling (“likely”). If not mitigated, these control deficiencies leave SCC at risk of making additional improper payments for overtime. Collective bargaining agreements, and state laws and policies, contain specific clauses regarding overtime pay. Payroll records show that SCC processed 21,008 overtime pay transactions, totaling $66,675,126, between August 2015 and July 2018, as follows: Overtime Payment Type by Group Unit Amount Work Week Groups 2 and SE (statistically sampled) 20,998 $ 66,598,240 Work Week Group E (items examined 100%) 10 76,886 Total population 21,008 $ 66,675,126 _____________ * Amounts in this table are rounded to the nearest whole dollar. -9- Sierra Conservation Center Payroll Audit Of the 20,998 overtime pay transactions, totaling $66,598,240, for employees in Work Week Groups 2 and SE, we randomly selected a statistical sample (as described in the Appendix) of 105 transactions, totaling $204,718. Of the 105 transactions, 11 were overpaid by approximately $11,997 and four were underpaid by approximately $227. These payments resulted in a net total of $11,770 in improper payments. As we used a statistical sampling method to select the overtime pay transactions examined, we projected the amount of likely overpayments to be $3,890,765 and likely underpayments to be $73,621. These payments resulted in a net total of $3,817,144 in likely improper payments. Therefore, the known and likely improper payments totaled a net of approximately $3,828,914, consisting of $3,902,762 in overpayments and $73,848 in underpayments The following table summarizes the results of our statistical sampling: Known improper payments, net $ 11,770 Divide by: Sample 204,718 Error rate for projection (differences due to rounding) 5.75% Population that was statistically sampled 66,598,240 Multiply by: Error rate for projection 5.75% Known and likely imrproper payments, net (differences due to rounding) 3,828,914 Less: Known improper payments, net 11,770 Likely improper payments, net $ 3,817,144 _____________ * Amounts in this table are rounded to the nearest whole dollar. We also examined all 10 overtime pay transactions, totaling $76,886, for Work Week Group E employees who are not eligible to receive overtime pay under normal circumstances. Of the 10 transactions, six (with a total of $72,531) were improper because the employees were not eligible to receive overtime pay. Four transactions were proper payments to two employees for on-call assignments. The known improper payments were made because payroll transactions unit staff members miscalculated overtime hours worked; paid for overtime hours worked at the straight-time rate instead of the time-and-a- half rate, or vice-versa; or failed to verify whether employees were eligible for overtime. Furthermore, SCC lacked adequate supervisory review to ensure accurate processing of overtime pay. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. -10- Sierra Conservation Center Payroll Audit Recommendation We recommend that SCC:  Conduct a review of overtime payments made during the past three years to ensure that the payments complied with collective bargaining agreements and state laws and policies; and  Recover overpayments made to employees through an agreed-upon collection method in accordance with GC section 19838, and properly compensate those employees who were underpaid. We further recommend that, to prevent improper overtime payments from recurring, SCC:  Establish adequate internal controls to ensure that payments are accurate, and comply with collective bargaining agreements and state laws and policies; and  Provide adequate oversight to ensure that payroll transactions unit staff process only valid and authorized payments that comply with collective bargaining agreements and state laws and policies. SCC failed to implement controls to ensure that it adheres to the FINDING 4— requirements of collective bargaining agreements and state regulations to Inadequate controls limit the accumulation of vacation and annual leave credits. This over vacation and deficiency resulted in liability for excessive leave balances with a value of annual leave at least $460,889 as of July 31, 2018. We expect the liability to increase if balances, resulting in SCC does not take action to address the excessive vacation and annual liability for excessive leave balances. balances Collective bargaining agreements and state regulations limit the amount of vacation and annual leave that most state employees may accumulate to no more than 80 days (640 hours). The limit on leave balances helps state agencies to manage leave balances and control the State’s liability for accrued leave credits. State agencies may allow employees to carry a higher leave balance only under limited circumstances. For example, an employee may not be able to reduce accrued vacation or annual leave hours below the limit due to business needs. When an employee’s leave accumulation exceeds or is projected to exceed the limit, state agencies should work with the employee to develop a written plan to reduce leave balances below the applicable limit. Our examination of SCC’s leave accounting records determined that SCC had 1,051 employees with unused vacation or annual leave credits at July 31, 2018. Of those employees, 35 exceeded the limit set by collective bargaining agreements and state regulations. For example, one employee had an accumulated balance of 2,428 hours in vacation, or 1,788 hours beyond the 640-hour limit. Collectively, the 35 employees accumulated 10,858 hours of excess vacation and annual leave, with a value of at least $460,889 as of July 31, 2018. -11- Sierra Conservation Center Payroll Audit This estimated liability does not adjust for salary rate increases and additional leave credits.2 Accordingly, we expect that the amount needed to pay for this liability will be higher. For example, an SCC employee separated from state service with 2,930 hours in leave credits, including 1,774 hours in annual leave. After adjusting for additional leave credits, the employee should have been paid for 3,196 hours, or 9% more. We further examined the records of the 35 employees to determine whether SCC complied with collective bargaining agreements and state regulations. We determined that SCC could not demonstrate that it had complied with collective bargaining agreements and state regulations when allowing these employees to maintain excess vacation or annual leave balances. We also found that SCC had no plans in place during the audit period to reduce leave balances below the limit. If SCC does not take action to reduce the excessive leave balances, the liability for accrued vacation and annual leave will likely increase because most employees will receive salary increases or use other non-compensable leave credits instead of vacation or annual leave, thus increasing their vacation or annual leave balances. The state agency responsible for paying these leave balances may experience a cash flow problem if a significant number of employees with excessive vacation or annual leave balances separate from state service. Normally, state agencies are not budgeted to make these separation lump-sum payments. However, the State’s current practice dictates that the state agency that last employed an employee pays for that employee’s lump-sum separation payment, regardless of where the employee accrued the leave balance. While a new directive from CalHR that became effective October 20, 2020 does not impact the dollar value of this finding, we are disclosing this directive as it impacts the recommendation. CalHR has directed departments to immediately suspend policies that require leave balances be reduced below the limit and not require employees to implement leave- reduction plans until the 2020 PLP program ends or July 1, 2022 whichever is sooner. Recommendation We recommend that, after the 2020 PLP program ends or July 1, 2022 whichever is sooner, SCC:  Implement controls, including existing policies and procedures, to ensure that its employees’ vacation and annual leave balances are maintained within levels allowed by collective bargaining agreements and state regulations;  Conduct ongoing monitoring of controls to ensure that they are implemented and operating effectively; and 2 Most state employees receive pay rate increases every year pursuant to state laws and/or collective bargaining agreements until they reach the top of their pay scale, or promote into a higher-paying position. In addition, when an employee’s accumulated leave balances upon separation are calculated for lump-sum pay, the employee is credited with additional leave credits equal to the amount that the employee would have earned had the employee taken time off and not separated from state service. -12- Sierra Conservation Center Payroll Audit  Participate in leave buy-back programs if the State offers such programs and funds are available. FINDING 5— SCC lacked adequate segregation of duties within its payroll transactions Inadequate controls unit, as noted in Finding 1, and lacked adequate controls over the over separation processing of employee separation lump-sum pay. We identified a net total lump-sum pay, of $149,465 in improper payments for separation lump-sum pay, resulting in consisting of $45,629 in known overpayments and $1,524 in known improper and late underpayments; and $109,001 in likely overpayments and $3,641 in likely payments underpayments. We also found that SCC did not make separation lump- sum payments to 16 employees in a timely manner. If not mitigated, this control deficiency leaves SCC at risk of making additional improper and late separation lump-sum payments, noncompliance with agreements and laws, and liability for late payments. GC section 19839 allows lump-sum payment for accrued eligible leave credits when an employee separates from state employment. Collective bargaining agreements include similar provisions regarding separation lump-sum pay. Payroll records show that SCC processed separation lump-sum payments, totaling $8,457,221, for 238 employees between August 2015 and July 2018. We randomly selected a statistical sample (as described in the Appendix) of payments, totaling $2,495,583, for 67 employees. Of the 67 employees, 23 were overpaid by approximately $45,629 and four were underpaid by an approximate total of $1,524. These payments resulted in a net total of $44,105 in improper payments. As we used a statistical sampling method to select the employees whose payments for separation lump-sum pay were examined, we projected the amount of likely overpayments to be $109,001 and likely underpayments to be $3,641. These payments resulted in a net total of $105,360 in improper payments. Therefore, the known and likely improper payments totaled a net of approximately $149,465, consisting of $154,630 in overpayments and $5,165 in underpayments. The following table summarizes the results of our statistical sampling: Known improper payments, net $ 44,105 Divide by: Sample 2,495,583 Error rate for projection (differences due to rounding) 1.77% Population that was statistically sampled 8,457,221 Multiply by: Error rate for projection 1.77% Known and likely improper payments, net (differences due to rounding) 149,465 Less: Known improper payments, net 44,105 Likely improper payments, net $ 105,360 _____________ * Amounts in this table are rounded to the nearest whole dollar. -13- Sierra Conservation Center Payroll Audit Of the 67 employees whose separation lump-sum payments we examined, 16 were not paid in a timely manner, in violation of collective bargaining agreements and state laws, as summarized in the California Department of Human Resources’ Human Resources Manual, section 1703. The known improper payments were made because payroll transactions unit staff members miscalculated leave balances paid. SCC also lacked adequate supervisory review to ensure accurate and timely processing of separation lump-sum pay. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. Recommendation We recommend that SCC:  Establish adequate controls to ensure accurate calculation and timely payment of separation lump-sum pay;  Conduct a review of separation lump-sum payments made during the past three years to ensure that the payments were accurate and in compliance with collective bargaining agreements and state law; and  Recover overpayments made to separated employees in accordance with GC section 19838 and State Administrative Manual section 8776.6, and properly compensate those employees who were underpaid. SCC lacked adequate segregation of duties within its payroll transactions FINDING 6— unit, as noted in Finding 1, and lacked adequate controls over the Inadequate controls processing of holiday credit transactions. We identified approximately over holiday credit $1,690 in improper holiday credits. If not mitigated, this control deficiency transactions, leaves SCC at risk of granting additional improper holiday credits. resulting in improper credits GC section 19853 specifies the compensation that an eligible employee is entitled to receive when required to work on a qualifying holiday. Collective bargaining agreements between the State and Bargaining Units 6 and 17 include similar provisions regarding holiday credit and holiday pay for represented employees. Leave accounting records show that SCC processed 5,411 holiday credit accrual transactions. We examined 35 of these transactions, with an estimated value of $24,750, because they involved unusual credits. Of the 35 transactions, six involved improper credits, with an estimated value of $1,690. As we tested only a targeted selection, there could be additional improper credits. The improper holiday credit transactions occurred because payroll transactions unit staff members granted holiday credits to employees during pay periods with no holidays. SCC also lacked adequate supervisory review to ensure proper and accurate processing of holiday credits. -14- Sierra Conservation Center Payroll Audit GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. Recommendation We recommend that SCC:  Conduct a review of holiday credits granted during the past three years to ensure that credits are properly supported with documentation, and complied with collective bargaining agreements and state law;  Correct any improper holiday credits in the State’s leave accounting system; and  Establish adequate controls to ensure that holiday credits granted are valid, and comply with collective bargaining agreements and state law. -15- Sierra Conservation Center Payroll Audit Appendix— Audit Sampling Methodology We used attributes sampling for tests of compliance. The sample design was chosen because:  It follows the American Institute of Certified Public Accountants (AICPA) guidelines;  It allows us to achieve our objectives for tests of compliance in an efficient and effective manner; and  Audit areas included both high and low volumes of transactions. The following table outlines our audit sampling application for all audit areas where statistical sampling was utilized: Results Expected Projected to Audit Type Population Population Sampling Sample Selection Confidence Tolerable Error Sample Intended Finding Area of Test (Unit) (Dollar) Unit Method Level Error Rate (Rate) ᵃ Size ᵇ Population Number Regular pay Compliance 38,985 $252,265,390 Transaction Computer-generated 90% 5% 2 (1.75%) 105 Yes simple random Overtime pay Compliance 20,998 6 6,598,240 Transaction Computer-generated 90% 5% 2 (1.75%) 105 Yes 3 (Work Week Groups simple random 2 and SE) Separation Compliance 2 38 8 ,457,221 Employee Computer-generated 90% 5% 2 (0.75%) 67 Yes 5 lump-sum pay simple random Uniform allowance Compliance 2,518 1 ,624,758 Transaction Computer-generated 90% 5% 2 (1.75%) 105 Yes simple random Leave buy-back Compliance 1 63 1 74,331 Transaction Computer-generated 90% 5% 2 (1.00%) 60 Yes simple random ______________________ ᵃ Pursuant to the AICPA’s Audit Guide: Audit Sampling (May 1, 2017 edition), pages 131-133, the expected error is the expected number of errors planned for in the sample. It is derived by multiplying the expected error rate by the sample size. The expected number of errors in the sampling tables on pages 135-136 was rounded upward, e.g., 0.2 errors becomes 1.0 error. ᵇ For populations of less than 250 items, we determined the sample size using a calculator that utilizes a hypergeometric distribution. For populations of 250 items and above, we determined the sample size using a calculator that utilizes a binomial distribution. As stated in Technical Notes on the AICPA Audit Guide: Audit Sampling (March 1, 2012), page 5, although the hypergeometric distribution is the exactly correct distribution to use for attributes sample sizes, the distribution becomes unwieldy for large populations unless suitable software is available. Therefore, more convenient approximations are frequently used instead. Sierra Conservation Center Payroll Audit Attachment— Sierra Conservation Center’s Response to Draft Audit Report State Controller’s Office Division of Audits Post Office Box 942850 Sacramento, CA 94250 http://www.sco.ca.gov S19-PAR-0010