Pleasant Valley State Prison (pvsp) Payroll Process

PLEASANT VALLEY STATE PRISON Audit Report PAYROLL AUDIT March 1, 2016, through February 28, 2019 BETTY T. YEE California State Controller December 2020 BETTY T. YEE California State Controller December 10, 2020 Ronnie Godwin, Acting Warden Pleasant Valley State Prison P.O. Box 8500 Coalinga, CA 93210 Dear Mr. Godwin: The State Controller’s Office audited the Pleasant Valley State Prison (PVSP) payroll process and transactions for the period of March 1, 2016, through February 28, 2019. PVSP management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. Our audit determined that PVSP did not maintain adequate and effective internal controls over its payroll process. PVSP lacked adequate segregation of duties and compensating controls over payroll transactions, resulting in improper separation lump-sum, overtime, leave buy-back, and holiday payments; and improper holiday credits. PVSP also granted inappropriate keying access to the State’s payroll system. In addition, PVSP did not implement controls to limit the accumulation of vacation and annual leave credits, resulting in liability for excessive balances. PVSP also did not promptly collect salary advances from its employees. If you have any questions, please contact Andrew Finlayson, Chief, State Agency Audits Bureau, by telephone at (916) 324-6310. Sincerely, Original signed by JIM L. SPANO, CPA Chief, Division of Audits JLS/ac Ronnie Godwin, Acting Warden -2- December 10, 2020 cc: Ryan Nicks, Correctional Business Manager Pleasant Valley State Prison Christina Correia, Institution Personnel Officer Pleasant Valley State Prison Kathleen Allison, Secretary California Department of Corrections and Rehabilitation Jennifer Barretto, Undersecretary of Administration California Department of Corrections and Rehabilitation Katherine Minnich, Deputy Director of Human Resources California Department of Corrections and Rehabilitation Mai Lee Vang, External Audits Manager California Department of Corrections and Rehabilitation Brendan Murphy, Chief, Administrative Services Division California Department of Human Resources Jil Barraza, Chief, Personnel and Payroll Services Division State Controller’s Office Pleasant Valley State Prison Payroll Audit Contents Audit Report Summary ............................................................................................................................ 1 Background ........................................................................................................................ 1 Objectives, Scope, and Methodology ............................................................................... 2 Conclusion .......................................................................................................................... 3 Follow-up on Prior Audit Findings .................................................................................. 4 Views of Responsible Officials .......................................................................................... 4 Restricted Use .................................................................................................................... 5 Schedule—Summary of Audit Results ................................................................................. 6 Findings and Recommendations ........................................................................................... 7 Appendix—Audit Sampling Methodology Attachment—Pleasant Valley State Prison’s Response to Draft Audit Report Pleasant Valley State Prison Payroll Audit Audit Report Summary The State Controller’s Office (SCO) audited the Pleasant Valley State Prison (PVSP) payroll process and transactions for the period of March 1, 2016, through February 28, 2019. PVSP management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. We completed our audit fieldwork on October 16, 2020. Our audit determined that PVSP did not:  Maintain adequate and effective internal controls over its payroll process. PVSP lacked adequate segregation of duties and compensating controls over payroll transactions, resulting in improper separation lump-sum, overtime, leave buy-back, and holiday payments and improper holiday credits. We also found that PVSP granted inappropriate keying access to the State’s payroll system;  Implement controls to limit the accumulation of vacation and annual leave credits that resulted in liability for excessive balances; and  Promptly collect salary advances from its employees. Background In 1979, the State of California adopted collective bargaining for state employees. This created a significant workload increase for the SCO’s Personnel and Payroll Services Division (PPSD), as PPSD was the State’s centralized payroll processing center for all payroll related-transactions. PPSD decentralized the processing of payroll, allowing state agencies and departments to process their own payroll-related transactions. Periodic audits of the decentralized payroll processing at state agencies and departments ceased due to the budget constraints in the late 1980s. In 2013, the California State Legislature reinstated these payroll audits to gain assurance that state agencies and departments maintain adequate internal control over the payroll function, provide proper oversight of their decentralized payroll processing, and comply with various state laws and regulations regarding payroll processing and related transactions. Audit Authority Authority for this audit is provided by California Government Code (GC) section 12476, which states: The Controller may audit the uniform state pay roll system, the State Pay Roll Revolving Fund, and related records of state agencies within the uniform state pay roll system, in such manner as the Controller may determine. In addition, GC section 12410 stipulates that: The Controller shall superintend the fiscal concerns of the state. The Controller shall audit all claims against the state, and may audit the disbursement of any state money, for correctness, legality, and for sufficient provisions of law for payment. -1- Pleasant Valley State Prison Payroll Audit Objectives, Scope, We performed this audit to determine whether PVSP: and Methodology  Maintained adequate and effective internal controls over its payroll process;  Processed payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures; and  Administered salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. The audit covered the period from March 1, 2016, through February 28, 2019. The audit population consisted of payroll transactions totaling $353,964,764, as quantified in the Schedule. To achieve our audit objectives, we:  Reviewed state and PVSP policies and procedures related to the payroll process to understand PVSP’s methodology for processing various payroll and payroll-related transactions;  Interviewed the PVSP payroll personnel to understand PVSP’s methodology for processing various payroll and payroll-related transactions, determine employees’ level of knowledge and ability relating to payroll transaction processing, and gain an understanding of existing internal control over the payroll process and systems;  Selected transactions recorded in the State’s payroll database using statistical sampling, as outlined in the Appendix, random selection, and targeted selection based on risk factors and other relevant criteria;  Analyzed and tested the selected transactions and reviewed relevant files and records to determine the accuracy of payroll and payroll- related payments, accuracy of leave transactions, adequacy and effectiveness of internal control over the payroll process, and compliance with collective bargaining agreements and state laws, regulations, policies, and procedures; and  Reviewed salary advances to determine whether PVSP administered and recorded them in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. -2- Pleasant Valley State Prison Payroll Audit Conclusion Our audit determined that PVSP:  Did not maintain adequate and effective internal controls over its payroll process.1 We found the following deficiencies in internal control over the payroll process that we consider to be material weaknesses: o Inadequate segregation of duties and a lack of compensating controls over payroll transactions (see Finding 1); o Inappropriate keying access to the State’s payroll system (see Finding 2); o Failure to implement controls to ensure that PVSP adhered to the requirements of collective bargaining agreements and state regulations to limit the accumulation of vacation and annual leave credits, resulting in liability for excessive balances (see Finding 3); o Inadequate controls to ensure that separation lump-sum payments were calculated correctly and paid in a timely manner, resulting in improper and late payments (see Finding 4); o Inadequate controls to ensure that overtime payments were calculated correctly and granted for valid overtime hours worked, resulting in improper payments (see Finding 5); o Inadequate controls to ensure that leave buy-back payments were calculated correctly and adjusted only for applicable salary rate changes, and that leave balances were reduced in the leave accounting system for leave buy-back transactions, resulting in improper payments (see Finding 6); o Inadequate controls to ensure that holiday payments were calculated correctly and granted for applicable salary adjustments, and that holiday credits were granted to eligible employees; resulting in overpayments and improper credits (see Finding 7); 1 In planning and performing our audit of compliance, we considered PVSP’s internal control over compliance with collective bargaining agreements and state laws, regulations, policies, and procedures to determine the auditing procedures that were appropriate under the circumstances for the purpose of providing a conclusion on compliance, and to test and report on internal control over compliance. Our consideration of internal control over compliance was for the limited purpose described in the first paragraph of this footnote; it was not designed to identify all deficiencies in internal control over compliance that might be material weaknesses or significant deficiencies. As discussed in this section, we identified certain deficiencies in internal control over compliance that we consider to be material weaknesses. A deficiency in internal control over compliance exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance with provisions of laws, regulations, or contracts on a timely basis. Control deficiencies, either individually or in combination with other control deficiencies, may be evaluated as significant deficiencies or material weaknesses. A material weakness in internal control over compliance is a deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. A significant deficiency over compliance is a deficiency, or a combination of deficiencies, in internal control over compliance with provisions of laws, regulations, or contracts that is less severe than a material weakness, yet important enough to merit attention from those charged with governance. -3- Pleasant Valley State Prison Payroll Audit o Inadequate controls to ensure that salary advances were collected in a timely manner, resulting in failure to recover outstanding amounts (see Finding 8);  Did not process payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. We found the following instances of noncompliance with the requirements of collective bargaining agreements and state laws, regulations, policies, and procedures: o Excessive vacation and annual leave balances with a value of at least $1,683,985 as of February 28, 2019 (see Finding 3). Although an October 20, 2020 directive from the California Department of Human Resources (CalHR) does not affect the dollar value of this finding, we are disclosing this directive because it affects our recommendation. CalHR has directed departments to immediately suspend policies that require leave balances to be reduced below the limit, and that require employees to implement leave-reduction plans. This suspension will be in effect until the 2020 Personal Leave Program (2020 PLP) ends, or July 1, 2022, whichever is sooner; o Improper and late payments for separation lump-sum pay (see Finding 4), improper payments for overtime pay (see Finding 5), improper payments for leave buy-back (see Finding 6), and overpayments for holiday pay and improper holiday credits (see Finding 7); costing an estimated net total of $238,515; and  Did not administer salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. Two salary advances, totaling $678, remained outstanding as of February 28, 2019, due to PVSP’s noncompliance with the State’s collection policies and procedures (see Finding 8). Follow-up on There were no prior payroll audits and, consequently, no prior audit findings. Prior Audit Findings Views of We issued a draft audit report on November 3, 2020. Ronnie Godwin, Acting Warden, responded by letter dated November 18, 2020 Responsible (Attachment), acknowledging the audit results, and indicating that PVSP Officials has taken steps to correct the noted deficiencies. We will follow up during the next payroll audit to verify that these corrective actions were adequate and appropriate. PVSP also provided additional information regarding Finding 3. Our comment on PVSP’s response to Finding 3 is included in the Findings and Recommendations section. This final audit report includes PVSP’s complete response. -4- Pleasant Valley State Prison Payroll Audit Restricted Use This audit report is solely for the information and use of PVSP, the California Department of Corrections and Rehabilitation, CalHR, and the SCO; it is not intended to be and should not be used by anyone other than these specified parties. This restriction is not intended to limit distribution of this audit report, which is a matter of public record and is available on the SCO website at www.sco.ca.gov. Original signed by JIM L. SPANO, CPA Chief, Division of Audits December 10, 2020 -5- Pleasant Valley State Prison Payroll Audit Schedule— Summary of Audit Results March 1, 2016, through February 28, 2019 Net Total Dollar Amount Dollar Number of Number of of Amount of Method of Units of Dollar Amount Selections Selection Selections Known and Finding Audit Area Tested Selection Population of Population Examined Unit Examined Likely Issues Number Segregation of duties N/A N/A N/A N/A N/A N/A N/A 1 System access Targeted 2 5 N/A 2 5 Employee N/A N/A 2 Regular pay Statistical 4 6,860 $ 300,884,391 8 7 Transaction $ 725,994 $ - and targeted Excess vacation and Targeted 6 4 1,683,985 6 4 Employee 1,683,985 1,683,985 3 annual leave Separation Statistical 2 21 5,521,577 112 Employee 2,846,283 5 8,894 4 lump-sum pay Overtime pay Statistical, 2 4,232 37,922,580 1 35 Transaction 316,818 9 0,812 5 random, and targeted Leave buy-back Statistical 2 30 7 92,253 6 6 Transaction 230,337 4,966 6 Holiday pay and credit Statistical 17,470 7,062,392 1 05 Transaction 1 17,141 8 3,843 7 and targeted Salary advance Targeted 36 97,586 1 3 Transaction 3 1,738 678 8 $ 353,964,764 $ 5 ,952,296 $ 1 ,923,178 -6- Pleasant Valley State Prison Payroll Audit Findings and Recommendations FINDING 1— PVSP lacked adequate segregation of duties within its payroll transactions unit to ensure that only valid and authorized payroll transactions were Inadequate processed. PVSP also failed to implement other controls to compensate segregation of for this risk. duties and lack of compensating GC sections 13400 through 13407 require state agencies to establish and controls over maintain internal controls, including proper segregation of duties and an payroll effective system of internal review. Adequate segregation of duties transactions reduces the likelihood that fraud or error will remain undetected by providing for separate processing by different individuals at various stages of a transaction and for independent reviews of the work performed. Our audit found that PVSP payroll transactions unit staff performed conflicting duties. Staff members performed multiple steps in processing payroll transactions, including entering data into the State’s payroll system; auditing employee timesheets; reconciling payroll, including reconciling system output to source documentation; reporting payroll exceptions; and processing adjustments. For example, staff members keyed in regular and overtime pay, and reconciled the master payroll, overtime, and other supplemental warrants. PVSP failed to demonstrate that it had implemented compensating controls to mitigate the risks associated with such a deficiency. We found no indication that these functions were subjected to periodic supervisory review. The lack of adequate segregation of duties and compensating controls has a pervasive effect on the PVSP payroll process, and impairs the effectiveness of other controls by rendering their design ineffective or by keeping them from operating effectively. These control deficiencies, in combination with other deficiencies discussed in Findings 2 through 8, represent a material weakness in internal control over the payroll process such that there is a reasonable possibility that a material noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. Good internal control practices require that the following functional duties be performed by different work units, or at minimum, by different employees within the same unit:  Recording transactions – This duty refers to the record-keeping function, which is accomplished by entering data into a computer system.  Authorization to execute – This duty belongs to individuals with authority and responsibility to initiate and execute transactions.  Periodic review and reconciliation of actual payments to recorded amounts – This duty refers to making comparisons of information at regular intervals and taking action to resolve differences. -7- Pleasant Valley State Prison Payroll Audit Recommendation We recommend that PVSP:  Separate conflicting payroll function duties to the greatest extent possible. Adequate segregation of duties will provide a stronger system of internal control whereby the functions of each employee are subject to the review of another. If it is not possible to segregate payroll functions fully and appropriately, PVSP should implement compensating controls. For example, if the payroll transactions unit staff member responsible for recordkeeping also performs a reconciliation process, then the supervisor should perform and document a detailed review of the reconciliation to provide additional control over the assignment of conflicting functions. Compensating controls may also include dual authorization requirements and documented reviews of payroll system input and output; and  Develop formal procedures for performing and documenting compensating controls. FINDING 2— PVSP lacked adequate controls to ensure that only appropriate staff had keying access to the State’s payroll system. PVSP inappropriately allowed Inappropriate nine employees keying access to the State’s payroll system. If not keying access to the mitigated, this control deficiency leaves payroll data at risk of misuse, State’s payroll abuse, and unauthorized use. system The SCO maintains the State’s payroll system. The system is decentralized, thereby allowing employees of state agencies to access it. PPSD has established a Decentralized Security Program Manual that all state agencies are required to follow in order to access the payroll system. The program’s objectives are to secure and protect the confidentiality and integrity of payroll data against misuse, abuse, and unauthorized use. We examined the records of 25 PVSP employees who had keying access to the State’s payroll system at various times between March 2016 and February 2019. Of the 25 employees, nine had inappropriate keying access to the State’s payroll system. Specifically, PVSP did not immediately remove or modify keying access for eight employees after the employees’ separation from state service, transfer to another agency, or change in classification. A Personnel Specialist changed to an ineligible classification on September 7, 2016; PVSP did not request to remove the employee’s access until February 5, 2018 (516 days later). In addition, a former Personnel Supervisor and Security Monitor left PVSP on October 23, 2016, and provided her user identification and password to an Office Technician prior to leaving. Between October 23, 2016, and December 2, 2016, PVSP allowed the Office Technician to use the Personnel Supervisor’s user identification and password to access the State’s payroll system. The Office Technician performed out-of-class duties that included keying payroll and payroll-related transactions. PVSP did not contact PPSD to request access for this Office Technician, or provide the required written justification describing why such access was -8- Pleasant Valley State Prison Payroll Audit necessary and appropriate. PVSP failed to follow guidelines set forth in the Decentralized Security Program Manual. The Decentralized Security Program Manual states, in part: The PPSD system contains sensitive and confidential information. Access is restricted to persons with an authorized, legal, and legitimate business requirement to complete their duties. . . . Currently, PIMS, HIST, KEYM, PIP, LAS, MPC and/or ACAS applications are restricted to Personnel Specialists or Personnel Technician classifications because their need is by definition a function of their specific job duties and any change in those duties requires a reevaluation of the need for access. If the employee’s duties change, such that the need for access no longer exists, the access privilege MUST be removed or deleted immediately by a request submitted by the department/campus. . . . A request to grant access to an individual in a classification other than in the Personnel Specialist/Payroll Technician series to access PIMS, HIST, KEYM, PIP, LAS, MPC and/or ACAS requires a written justification from the Authorizing Manager. The justification must describe the individual's specific job duties requiring the need to access system information (i.e., PIMS = Employment History, HIST=Payroll History, LAS=Leave Accounting System, etc.) as well as level of access to that application, in order to perform their regular daily duties. Manager classifications will be granted inquiry access only. . . . For self-protection, the password owner must . . . Not reveal/share their password to ANYONE. . . . To prevent unauthorized use by a transferred, terminated or resigned employee's user ID, the Security Monitor must IMMEDIATELY submit all pages of the PSD125A to delete the user’s system access. Using an old user ID increases the chances of a security breach which is a serious security violation. Sharing a user ID is strictly prohibited and a serious violation. Recommendation We recommend that PVSP:  Update keying access to the State’s payroll system immediately after employees leave PVSP, transfer to another unit, or change classifications;  Prevent sharing by employees of system access user identifications and passwords; and  Periodically review access to the system to verify that access complies with the Decentralized Security Program Manual. -9- Pleasant Valley State Prison Payroll Audit FINDING 3— PVSP failed to implement controls to ensure that it adheres to the Inadequate requirements of collective bargaining agreements and state regulations to controls over limit the accumulation of vacation and annual leave credits. This deficiency resulted in liability for excessive leave balances with a value of vacation and at least $1,683,985 as of February 28, 2019. We expect the liability to annual leave increase if PVSP does not take action to address the excessive vacation balances, resulting and annual leave balances. in liability for excessive balances Collective bargaining agreements and state regulations limit the amount of vacation and annual leave that most state employees may accumulate to no more than 80 days (640 hours). The limit on leave balances helps state agencies to manage leave balances and control the State’s liability for accrued leave credits. State agencies may allow employees to carry a higher leave balance only under limited circumstances. For example, an employee may not be able to reduce accrued vacation or annual leave hours below the limit due to business needs. When an employee’s leave accumulation exceeds or is projected to exceed the limit, state agencies should work with the employee to develop a written plan to reduce leave balances below the applicable limit. Our examination of PVSP’s leave accounting records determined that PVSP had 1,234 employees with unused vacation or annual leave credits at February 28, 2019. Of the 1,234 employees, 64 exceeded the limit set by collective bargaining agreements and state regulations. For example, one employee had an accumulated balance of 2,090 hours of vacation, or 1,450 hours beyond the 640-hour limit. Collectively, the 64 employees accumulated 13,601 hours of excess vacation and annual leave, with a value of at least $1,683,985 as of February 28, 2019. This estimated liability does not adjust for salary rate increases and additional leave credits.1 Accordingly, we expect that the amount needed to pay for this liability will be higher. For example, a PVSP employee separated from state service with 1,662 hours of leave credits, including 1,206 hours of annual leave. After adjusting for additional leave credits, the employee was paid for 1,929 hours, or 16% more. We further examined the records of the 64 employees to determine whether PVSP complied with collective bargaining agreements and state regulations. We determined that PVSP could not demonstrate that it had complied with collective bargaining agreements and state regulations when allowing these employees to maintain excess vacation or annual leave balances. We also found that PVSP had no plans in place during the audit period to reduce leave balances below the limit. If PVSP does not take action to reduce the excessive leave balances, the liability for accrued vacation and annual leave will likely increase because 1 Most state employees receive pay rate increases every year pursuant to state laws and/or collective bargaining agreements until they reach the top of their pay scale, or promote into a higher-paying position. In addition, when an employee’s accumulated leave balances upon separation are calculated for lump-sum pay, the employee is credited with additional leave credits equal to the amount that the employee would have earned had the employee taken time off and not separated from state service. -10- Pleasant Valley State Prison Payroll Audit most employees will receive salary increases or use other non-compensable leave credits instead of vacation or annual leave, thus increasing their vacation or annual leave balances. The state agency responsible for paying these leave balances may face a cash flow problem if a significant number of employees with excessive vacation or annual leave balances separate from state service. Normally, state agencies are not budgeted to make these separation lump-sum payments. However, the State’s current practice dictates that the state agency that last employed an employee pays for that employee’s separation lump-sum payment, regardless of where the employee accrued the leave balance. Although an October 20, 2020 directive from CalHR does not affect the dollar value of this finding, we are disclosing this directive because it affects our recommendation. CalHR has directed departments to immediately suspend policies that require leave balances to be reduced below the limit, and that require employees to implement leave-reduction plans. This suspension will be in effect until the 2020 PLP ends, or July 1, 2022, whichever is sooner. Recommendation We recommend that, after the 2020 PLP ends, or July 1, 2022, whichever is sooner, PVSP:  Implement controls, including existing policies and procedures, to ensure that its employees’ vacation and annual leave balances are maintained within levels allowed by collective bargaining agreements and state regulations;  Conduct ongoing monitoring of controls to ensure that they are implemented and operating effectively; and  Participate in leave buy-back programs if the State offers such programs and funds are available. PVSP’s Response In accordance with current leave reduction and Personal Leave Program requirements, PVSP will work with employees to reduce leave when operationally feasible. On June 4, 2019, the Leave Reduction Plan Requirements–Action Due by July 5, 2019 memorandum was distributed to all staff from the CDCR HR Mailbox, which requires the completion and documentation of Leave Reduction Plans for all employees in excess of or approaching leave credit balance limitations. This annual process ensures control over vacation and annual leave balances to avoid future liability for excessive balances. PVSP has implemented these internal controls to ensure the departments future liabilities. Effective October 26, 2020, the California Department of Human Resources suspended leave reduction plan requirements for the duration of the 2020 Personal Leave Program (PLP) or until July 1, 2022 (whichever is later). Although the leave reduction plan requirements are temporarily suspended, PVSP will continue to work with employees to reduce leave balances utilizing PLP and vacation/annual leave. -12- Pleasant Valley State Prison Payroll Audit SCO Comment Our finding remains unchanged. However, we added a disclosure of CalHR’s October 20, 2020 directive regarding the suspension of policies on leave reduction to this finding. We revised our recommendation as a result of this directive. PVSP lacked adequate segregation of duties within its payroll transactions FINDING 4— unit, as noted in Finding 1, and lacked adequate controls over the Inadequate processing of employee separation lump-sum pay. We identified a net total controls over of $58,894 in improper and questioned separation lump-sum payments, separation lump- consisting of $48,116 in overpayments, $26,090 in underpayments, and sum pay, resulting $8,405 in questioned payments based on actual transactions examined in improper and (“known”); and $48,852 in overpayments, and $26,869 in underpayments, late payments and $6,480 in questioned payments based on the results of statistical sampling (“likely”). PVSP also did not make separation lump-sum payments to six employees in a timely manner. If not mitigated, these control deficiencies leave PVSP at risk of making additional improper and late separation lump-sum payments, noncompliance with agreements and laws, and liability for late payments. GC section 19839 allows lump-sum payment for accrued eligible leave credits when an employee separates from state employment. Collective bargaining agreements include similar provisions regarding separation lump-sum pay Payroll records show that PVSP processed separation lump-sum payments, totaling $5,521,577, for 221 employees between March 2016 and February 2019, as follows: Separation Lump-Sum Pay Group Unit Amount Section 7(k) employees (statistically sampled) 110 $3,423,986 Non-section 7(k) employees (statistically sampled) 111 2,097,591 Total population 221 $5,521,577 ________________ * Amounts in this table are rounded to the nearest dollar. Of the 110 employees who were covered by the provisions of Section 7(k) of the Fair Labor Standards Act and granted separation lump-sum pay, totaling $3,423,986, we randomly selected a statistical sample (as described in the Appendix) of 56 employees who received separation lump-sum payments, totaling $1,661,864. Of the 56 employees, 24 were overpaid by approximately $40,628 and 20 were underpaid by approximately $23,344. These payments resulted in a net total of $17,284 in improper payments. -12- Pleasant Valley State Prison Payroll Audit As we used a statistical sampling method to select the Section 7(k) employees whose separation lump-sum payments were examined, we projected the amount of likely overpayments to be $43,079 and likely underpayments to be $24,752. These payments resulted in a net total of $18,327 in improper payments. Therefore, the known and likely net improper payments totaled approximately $35,611, consisting of $83,707 in overpayments and $48,096 in underpayments. The following table summarizes the results of our statistical sampling: Known improper payments, net $ 17,284 Divide by: Sample 1,661,864 Error rate for projection (differences due to rounding) 1.04% Population that was statistically sampled 3,423,986 Multiply by: Error rate for projection 1.04% Known and likely improper payments, net (differences due to rounding) 35,611 Less: Known improper payments, net 17,284 Likely improper payments, net $ 18,327 ________________ * Amounts in this table are rounded to the nearest dollar. Of the 111 employees who were not covered by the provisions of Section 7(k) of the Fair Labor Standards Act and who were granted separation lump sum pay, totaling $2,097,591, we randomly selected a statistical sample (as described in the Appendix) of 56 employees who received separation lump-sum payments, totaling $1,184,420. Of these 56 employees, four were overpaid by approximately $7,488 and nine were underpaid by approximately $2,746. We also questioned the separation lump-sum payments, totaling $8,405, made to one employee due to the lack of supporting documentation. Without the required documentation, there is no record of calculation or approval of payments for separation lump-sum pay. Therefore, we could not determine the validity, accuracy, and propriety of the payments made to this employee. These payments resulted in a net total of $13,147 in improper and questioned payments. As we used a statistical sampling method to select the non-section 7(k) employees whose separation lump-sum payments were examined, we projected the amount of likely overpayments to be $5,773, likely underpayments to be $2,117, and likely questioned payments to be $6,480. These payments resulted in a net total of $10,136 in likely improper and questioned payments. Therefore, the known and likely net improper and questioned payments totaled approximately $23,283, consisting of $13,261 in overpayments, $4,863 in underpayments, and $14,885 in questioned payments. -13- Pleasant Valley State Prison Payroll Audit The following table summarizes the results of our statistical sampling: Known improper and questioned payments, net $ 13,147 Divide by: Sample 1,184,420 Error rate for projection (differences due to rounding) 1.11% Population that was statistically sampled 2,097,591 Multiply by: Error rate for projection 1.11% Known and likely improper and questioned payments, net (differences due to rounding) 23,283 Less: Known improper and questioned payments, net 13,147 Likely improper and questioned payments, net $ 10,136 ________________ * Amounts in this table are rounded to the nearest dollar. The known improper payments were made because payroll transactions unit staff members miscalculated leave balances paid for separation lump- sum pay, and improperly included holiday credits when calculating employees’ leave balances for lump-sum pay. PVSP also lacked adequate supervisory review to ensure accurate and timely processing of separation lump-sum pay. Of the 112 employees whose separation lump-sum payments we examined, six were not paid in a timely manner, in violation of collective bargaining agreements and state laws as summarized in CalHR’s Human Resources Manual, section 1703. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. Recommendation We recommend that PVSP:  Establish adequate controls to ensure accurate and timely separation lump-sum payments;  Conduct a review of separation lump-sum payments made during the past three years to ensure that the payments were accurate and in compliance with collective bargaining agreements and state law;  Recover overpayments made to separated employees in accordance with GC section 19838 and State Administrative Manual (SAM) section 8776.6, and properly compensate those employees who were underpaid; and  Maintain supporting documentation for payments pursuant to retention policies. -14- Pleasant Valley State Prison Payroll Audit FINDING 5— PVSP lacked adequate segregation of duties within its payroll transactions Inadequate unit, as noted in Finding 1, and lacked adequate controls over the controls over processing of overtime pay. We identified a net total of $90,812 in overtime pay, improper overtime payments, consisting of $1,092 in known overpayments and $193 in known underpayments, and $131,840 in likely resulting in overpayments and $41,927 in likely underpayments. If not mitigated, these improper control deficiencies leave PVSP at risk of making additional improper payments overtime payments. Collective bargaining agreements, and state laws and policies, contain specific clauses regarding overtime pay. Payroll records show that PVSP processed 24,232 overtime pay transactions, totaling $37,922,580, between March 2016 and February 2019, as follows: Overtime Payment Type by Group Unit Amount Work Week Group 2, < 200 hours per transaction (statistically sampled) 24,059 $ 37,646,956 Work Week Group 2, ≥ 200 hours per transaction (items examined 100%) 10 126,543 Work Week Group SE (randomly selected 10 payments) 35 97,186 Work Week Group E (randomly selected 10 payments) 128 51,895 Total population 24,232 $ 37,922,580 ________________ * Amounts in this table are rounded to the nearest dollar. Of the 24,059 overtime pay transactions, totaling $37,646,956, for Work Week Group (WWG) 2 employees who were paid for less than 200 hours of overtime per transaction, we randomly selected a statistical sample (as described in the Appendix) of 105 transactions, totaling $172,864. Of the 105 transactions, two were overpaid by approximately $608 and three were underpaid by approximately $193. These payments resulted in a net total of $415 in improper payments. As we used a statistical sampling method to select the overtime pay transactions examined, we projected the amount of likely overpayments to be $131,840 and likely underpayments to be $41,927. These payments resulted in a net total of $89,913 in likely improper payments. Therefore, the known and likely improper payments totaled a net of approximately $90,328, consisting of $132,448 in overpayments and $42,120 in underpayments. -15- Pleasant Valley State Prison Payroll Audit The following table summarizes the results of our statistical sampling: Known improper payments, net $ 415 Divide by: Sample 172,864 Error rate for projection (differences due to rounding) 0.24% Population that was statistically sampled 37,646,956 Multiply by: Error rate for projection 0.24% Known and likely improper payments, net (differences due to rounding) 90,328 Less: Known improper payments, net 415 Likely improper payments, net $ 89,913 ________________ * Amounts in this table are rounded to the nearest dollar. We also examined all 10 overtime pay transactions, totaling $126,543, for WWG 2 employees who were paid for at least 200 hours of overtime per transaction. Of the 10 transactions, two were overpaid by approximately $484. Of the 35 overtime pay transactions, totaling $97,186, for WWG SE employees who are eligible to receive pay for on-call assignments, we randomly selected 10 transactions, totaling $13,666. Our examination of these transactions found no errors. Of the 128 overtime pay transactions, totaling $51,895, for WWG E employees who are not eligible to receive overtime pay under normal circumstances, we randomly selected 10 transactions, totaling $3,745. Our examination of these transactions found no errors. The known improper payments were made because payroll transactions unit staff members miscalculated overtime hours worked; paid for overtime hours worked at the straight-time rate instead of the time-and-a- half rate, or vice-versa; and paid for overtime hours that were not shown on timesheets. Furthermore, PVSP lacked adequate supervisory review to ensure accurate processing of overtime pay. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Recommendation We recommend that PVSP:  Conduct a review of overtime payments made during the past three years to ensure that the payments complied with collective bargaining agreements and state laws and policies; and  Recover overpayments made to employees through an agreed-upon collection method in accordance with GC section 19838, and properly compensate those employees who were underpaid. -16- Pleasant Valley State Prison Payroll Audit We further recommend that, to prevent improper overtime payments from recurring, PVSP:  Establish adequate internal controls to ensure that payments are accurate and comply with collective bargaining agreements and state laws and policies; and  Provide adequate oversight to ensure that payroll transactions unit staff process only valid and authorized payments that comply with collective bargaining agreements and state laws and policies. FINDING 6— PVSP lacked adequate segregation of duties within its payroll transactions Inadequate unit, as noted in Finding 1, and lacked adequate controls over the controls over leave processing of leave buy-back. We identified a net total of $4,966 in improper payments for leave buy-back, consisting of $1,484 in known buy-back, resulting overpayments and $40 in known underpayments, and $3,619 in likely in improper overpayments and $97 in likely underpayments. If not mitigated, these payments control deficiencies leave PVSP at risk of making additional improper leave buy-back payments. A leave-buy back occurs when an employee receives payment at the regular salary rate in exchange for accrued vacation, annual leave, personal leave, personal holiday, and/or holiday credits. Collective bargaining agreements between the State and Bargaining Units 1, 6, and 12 allow for the annual cash-out of a certain number of hours of accumulated vacation and annual leave if funds are available. Title 2, California Code of Regulations, section 599.744 also provides that CalHR may authorize a leave buy-back program for employees excluded from collective bargaining. CalHR authorized leave buy-backs for excluded employees in fiscal year (FY) 2015-16, FY 2016-17, and FY 2017-18. It also provided the State’s policies and procedures regarding cash-out of vacation and annual leave. Payroll records show that PVSP processed 230 leave buy-back transactions, totaling $792,253, between March 2016 and February 2019. Of the 230 leave buy-back transactions, we randomly selected a statistical sample (as described in the Appendix) of 66 transactions, totaling $230,337. Of the 66 transactions, eight were overpaid by approximately $1,484 and one was underpaid by approximately $40. These payments resulted in a net total of $1,444 in improper payments. As we used a statistical sampling method to select the leave buy-back transactions examined, we projected the amount of likely overpayments to be $3,619 and likely underpayments to be $97. These payments resulted in a net total of $3,522 in improper payments. Therefore, the known and likely improper payments totaled a net of approximately $4,966, consisting of $5,103 in overpayments and $137 in underpayments. -17- Pleasant Valley State Prison Payroll Audit The following table summarizes the results of our statistical sampling: Known improper payments, net $ 1,444 Divide by: Sample 230,337 Error rate for projection (differences due to rounding) 0.63% Population that was statistically sampled 792,253 Multiply by: Error rate for projection 0.63% Known and likely improper payments, net (differences due to rounding) 4,966 Less: Known improper payments, net 1,444 Likely improper payments, net $ 3,522 ________________ * Amounts in this table are rounded to the nearest dollar. The known improper payments were made because payroll transactions unit staff members miscalculated the amounts paid, improperly made additional payments after salary rate adjustments, or failed to reduce leave balances in the leave accounting system. PVSP also lacked adequate supervisory review to ensure accurate processing of leave buy-back. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Recommendation We recommend that PVSP:  Recover the overpayments made to the employee through an agreed- upon collection method in accordance with GC section 19838, and properly compensate the employee who was underpaid; and  To prevent improper leave buy-back payments from recurring, establish adequate internal controls, including oversight of payroll transactions unit staff, to ensure that payments for leave buy-back are accurate, and comply with collective bargaining agreements and state laws and policies. FINDING 7— PVSP lacked adequate segregation of duties within its payroll transactions Inadequate unit, as noted in Finding 1, and lacked adequate controls over the controls over processing of holiday credit transactions. We identified $28,237 in overpayments for holiday pay, consisting of $290 in known overpayments holiday pay, and $27,947 in likely overpayments. We also identified approximately resulting in $55,606 in improper holiday credits. If not mitigated, these control overpayments and deficiencies leave PVSP at risk of making additional improper holiday improper credits payments and granting additional improper holiday credits. GC section 19853 specifies the compensation that an eligible employee is entitled to receive when required to work on a qualifying holiday. Collective bargaining agreements between the State and Bargaining Units 6, 13, 15, 17, and 18 include similar provisions regarding holiday pay and holiday credit. -18- Pleasant Valley State Prison Payroll Audit Holiday Pay Payroll records show that PVSP processed 9,451 holiday pay transactions, totaling $3,713,730 between March 2016 and February 2019. Of the 9,451 holiday pay transactions, we randomly selected a statistical sample (as described in the Appendix) of 105 transactions, totaling $38,124. Of the 105 transactions, three were overpaid by $290. As we used a statistical sampling method to select the holiday pay transactions examined, we projected the amount of likely overpayments to be $27,947. Therefore, the known and likely overpayments totaled $28,237. The following table summarizes the results of our statistical sampling: Known overpayments $ 290 Divide by: Sample 38,124 Error rate for projection (differences due to rounding) 0.76% Population that was statistically sampled 3,713,730 Multiply by: Error rate for projection 0.76% Known and likely overpayments (differences due to rounding) 28,237 Less: Known overpayments 290 Likely overpayments $ 27,947 ________________ * Amounts in this table are rounded to the nearest dollar. The known improper payments occurred because payroll transactions unit staff members paid for holiday hours at the time-and-a-half rate instead of the straight-time rate, or made the payments after the employees had already been granted holiday credits. PVSP also lacked adequate supervisory review to ensure accurate processing of holiday pay. Holiday Credit Leave accounting records show that PVSP processed 8,019 accrual transactions of holiday credit, with an estimated value of $3,348,662. We examined 249 of these transactions, with an estimated value of $79,017, because they involved unusual credits. Of the 249 transactions, 178 involved improper credits, with an estimated value of $55,606. As we tested only a targeted selection, there could be additional improper credits. The improper holiday credit transactions occurred because payroll transactions unit staff members granted holiday credits to employees during pay periods with no holidays, or granted holiday credits to ineligible employees. PVSP also lacked adequate supervisory review to ensure proper and accurate processing of holiday credits. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. -19- Pleasant Valley State Prison Payroll Audit Recommendation We recommend that PVSP:  Conduct a review of holiday payments made and holiday credits granted during the past three years to ensure that payments and credits complied with collective bargaining agreements and state law;  Recover overpayments made to employees through an agreed-upon collection method in accordance with GC section 19838;  Correct any improper holiday credits in the State’s leave accounting system; and  Establish adequate controls to ensure that holiday payments and credits are accurate, valid, and comply with collective bargaining agreements and state law. FINDING 8— PVSP lacked adequate segregation of duties within its payroll transactions Inadequate unit, as noted in Finding 1, and lacked adequate controls over salary controls over advances to ensure that advances were recovered in accordance with state salary advances, law and policies. Two salary advances, totaling $678, remained outstanding as of February 28, 2019, due to PVSP’s noncompliance with resulting in failure the State’s collection policies and procedures. The oldest unrecovered to recover salary advance was outstanding for over two years. These control outstanding deficiencies leave PVSP at risk of failing to collect further salary advances amounts if not mitigated. At February 28, 2019, PVSP’s accounting records showed 36 outstanding salary advances, totaling $97,586, including 13 balances, totaling $31,738, which had been outstanding for more than 60 days. Generally, the prospect of collection diminishes as an account ages. When an agency does not initiate collection within three years from the date of overpayment, the possibility of collection is remote. We examined the 13 salary advances that had been outstanding for more than 60 days. We noted that PVSP did not comply with the State’s collection policies and procedures for two salary advances, totaling $678. PVSP did not send collection notices promptly. For example, PVSP issued a salary advance to a separating employee in January 2015. PVSP sent the first collection letter in October 2017, approximately two years and nine months later. The lack of adequate controls over salary advances reduces the likelihood of collection, increases the amount of resources expended on collection efforts, and negatively impacts cash flow. GC section 19838 and SAM sections 8776 and 8776.7 describe the State’s collection policies and procedures, which require PVSP to collect salary advances in a timely manner and maintain proper records of collection efforts. -20- Pleasant Valley State Prison Payroll Audit Recommendation We recommend that PVSP ensure that it recovers salary advances in a timely manner, pursuant to GC section 19838 and SAM sections 8776 and 8776.7. If all reasonable collection procedures do not result in payment, PVSP may request discharge from accountability of uncollectable amounts. -21- Pleasant Valley State Prison Payroll Audit Appendix— Audit Sampling Methodology We used attributes sampling for tests of compliance. The sample design was chosen because:  It follows the American Institute of Certified Public Accountants (AICPA) guidelines;  It allows us to achieve our objectives for tests of compliance in an efficient and effective manner; and  Audit areas included both high and low volumes of transactions. The following table outlines our audit sampling application for all audit areas where statistical sampling was utilized: Results Expected Projected Audit Type Population Population Sampling Sample Selection Confidence Tolerable Error Sample to Intended Finding Area of Test (Unit) (Dollar) Unit Method Level Error Rate (Rate) ᵃ Size ᵇ Population Number Regular pay Compliance 46,850 $ 300,686,607 Transaction Computer-generated 90% 5% 1 (1.25%) 77 Yes simple random Separation lump-sum Compliance 1 10 3,423,986 Employee Computer-generated 90% 5% 2 (1.00%) 56 Yes 4 pay – Section 7(k) simple random Separation lump-sum Compliance 1 11 2,097,591 Employee Computer-generated 90% 5% 2 (1.00%) 56 Yes 4 pay – Non-section 7(k) simple random Overtime pay Compliance 24,059 3 7,646,956 Transaction Computer-generated 90% 5% 2 (1.75%) 105 Yes 5 simple random Leave buy-back Compliance 2 30 7 92,253 Transaction Computer-generated 90% 5% 2 (0.75%) 66 Yes 6 simple random Holiday pay Compliance 9,451 3,713,730 Transaction Computer-generated 90% 5% 2 (1.75%) 105 Yes 7 simple random _________________ a Pursuant to the AICPA’s Audit Guide: Audit Sampling (May 1, 2017 edition), pages 131-133, the expected error is the expected number of errors planned for in the sample. It is derived by multiplying the expected error rate by the sample size. The expected number of errors in the sampling tables on pages 135-136 was rounded upward, e.g., 0.2 errors becomes 1.0 error. b For populations of fewer than 250 items, we determined the sample size using a calculator that uses a hypergeometric distribution. For populations of 250 items or more, we deᵃtePurrmsuainntetodt htehAeIC sPaAm’sApuldeit Gsiuzidee: uAusdiintSga map lcinaglc(Mualya1t,o20r1 7thedaittio un)s,peasg eas 1b31i-n13o3,mthieaelx pdecitsedtreirbrouritsitohene.x pAecste dstnaumtebedr oifne rrTorescphlannniecdafolr Nintohetessam oplne. Itthised eArivIeCdbPyAm uAltipulydinigt tGheuexipdecete:d Aerruodrriatte Sbyatmhepsalminplge s(izMe.Tahrecehxp e1ct,e d2n0u1mb2e)r,o fpage 5, earrlotrhs ion uthge hsa mtphlieng h tayblpese orng peaogems 1e35t-r1i3c6 wdasi sroturnibdeud tuipownar di,s e .gt.h, 0e.2 eerxroarsc btelcyom ceso 1r.0r eercrotr .distribution to use for attributes sample sizes, the distribution becomes unwieldy for large populations unless suiᵇtFaobrpleop usloatfiotnwsoafrfeew iesr tahavna2i5l0aitbemles,. wTehdeeterremfinoedreth,e msamoprlee scizoenusvinegnaicealncutl aatoprpthraotuxsiemsaahtyipoerngeso maerteric fdriestqribuuetionnt.lFyor upospeudla tiionnsstoefa25d0.it e msormore,wedeterminedthesamplesizeusingacalculatorthatusesabinomialdistribution.Asstatedin TechnicalNotesontheAICPAAuditGuideAuditSampling(March1,2012),page5,althoughthehypergeometricdistributionistheexactlycorrectdistributiontouseforattributessamplesizes,thedistributionbecomesunwieldyforlargepopulationsunlesssuitable software is available. Therefore, more convenient approximations are frequently used instead. -22- Pleasant Valley State Prison Payroll Audit Attachment— Pleasant Valley State Prison’s Response to Draft Audit Report State Controller’s Office Division of Audits Post Office Box 942850 Sacramento, CA 94250 http://www.sco.ca.gov S20-PAR-0001