Salinas Valley State Prison Psychiatric Inpatient (svsp-pip) Payroll Process

SALINAS VALLEY STATE PRISON PSYCHIATRIC INPATIENT PROGRAM Audit Report PAYROLL AUDIT August 1, 2015, through July 31, 2018 BETTY T. YEE California State Controller December 2020 BETTY T. YEE California State Controller December 10, 2020 Lara Saich, Acting Director Health Care Policy and Administration California Correctional Health Care Services P.O. Box 588500 Elk Grove, CA 95758 Dear Ms. Saich: The State Controller’s Office audited the Salinas Valley State Prison Psychiatric Inpatient Program (SVSP-PIP) payroll process and transactions for the period of August 1, 2015, through July 31, 2018. SVSP-PIP management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. Our audit determined that SVSP-PIP did not maintain adequate and effective internal controls over its payroll process. SVSP-PIP lacked adequate segregation of duties and compensating controls over payroll transactions, resulting in improper overtime and separation lump-sum payments. SVSP-PIP also granted inappropriate keying access to the State’s payroll system. In addition, SVSP-PIP did not implement controls to limit the accumulation of vacation and annual leave credits, resulting in liability for excessive balances. SVSP-PIP also did not collect salary advances from its employees in a timely manner. If you have any questions, please contact Andrew Finlayson, Chief, State Agency Audits Bureau, by telephone at (916) 324-6310, or by email at afinlayson@sco.ca.gov. Sincerely, Original signed by JIM L. SPANO, CPA Chief, Division of Audits JLS/as Lara Saich, Acting Director -2- December 10, 2020 cc: Jasinda Muhammad, Deputy Director Human Resources California Correctional Health Care Services Laura Harvick, Assistant Deputy Director Human Resources California Correctional Health Care Services Olivia Briones, Regional Personnel Administrator – Central Human Resources California Correctional Health Care Services Kathleen Allison, Secretary California Department of Corrections and Rehabilitation Cecilia Rodriguez, Acting Director Human Resources Salinas Valley State Prison Psychiatric Inpatient Program Brendan Murphy, Chief Administrative Services Division California Department of Human Resources Jil Barraza, Chief Personnel and Payroll Services Division State Controller’s Office Salinas Valley State Prison Psychiatric Inpatient Program Payroll Audit Contents Audit Report Summary ............................................................................................................................ 1 Background ........................................................................................................................ 1 Objectives, Scope, and Methodology ............................................................................... 2 Conclusion .......................................................................................................................... 3 Follow-up on Prior Audit Findings .................................................................................. 4 Views of Responsible Officials .......................................................................................... 4 Restricted Use .................................................................................................................... 4 Schedule—Summary of Audit Results ................................................................................. 5 Findings and Recommendations ........................................................................................... 6 Appendix—Audit Sampling Methodology Attachment—Salinas Valley State Prison Psychiatric Inpatient Program’s Response to Draft Audit Report Salinas Valley State Prison Psychiatric Inpatient Program Payroll Audit Audit Report Summary The State Controller’s Office (SCO) audited the Salinas Valley State Prison Psychiatric Inpatient Program’s (SVSP-PIP) payroll process and transactions for the period of August 1, 2015, through July 31, 2018. SVSP-PIP management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. We completed our audit fieldwork on June 24, 2020. Our audit determined that SVSP-PIP did not:  Maintain adequate and effective internal controls over its payroll process. SVSP-PIP lacked adequate segregation of duties and compensating controls over payroll transactions, resulting in improper overtime and separation lump-sum payments. SVSP-PIP also granted inappropriate keying access to the State’s payroll system;  Implement controls to limit the accumulation of vacation and annual leave credits, resulting in liability for excessive balances; and  Collect salary advances from its employees in a timely manner. Background In 1979, the State of California adopted collective bargaining for state employees. This created a significant workload increase for the SCO’s Personnel and Payroll Services Division (PPSD), as PPSD was the State’s centralized payroll processing center for all payroll related-transactions. PPSD decentralized the processing of payroll, allowing state agencies and departments to process their own payroll-related transactions. Periodic audits of the decentralized payroll processing at state agencies and departments ceased due to the budget constraints in the late 1980s. In 2013, the California State Legislature reinstated these payroll audits to gain assurance that state agencies and departments maintain adequate internal control over the payroll function, provide proper oversight of their decentralized payroll processing, and comply with various state laws and regulations regarding payroll processing and related transactions. Audit Authority Authority for this audit is provided by California Government Code (GC) section 12476, which states: The Controller may audit the uniform state pay roll system, the State Pay Roll Revolving Fund, and related records of state agencies within the uniform state pay roll system, in such manner as the Controller may determine. In addition, GC section 12410 stipulates: The Controller shall superintend the fiscal concerns of the state. The Controller shall audit all claims against the state, and may audit the disbursement of any state money, for correctness, legality, and for sufficient provisions of law for payment. -1- Salinas Valley State Prison Psychiatric Inpatient Program Payroll Audit Objectives, Scope, We performed this audit to determine whether SVSP-PIP: and Methodology  Maintained adequate and effective internal controls over its payroll process;  Processed payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures; and  Administered salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. The audit covered the period from August 1, 2015, through July 31, 2018. The audit population consisted of payroll transactions totaling $111,230,954, as quantified in the Schedule. To achieve our audit objectives, we:  Reviewed state and SVSP-PIP policies and procedures related to the payroll process to understand SVSP-PIP’s methodology for processing payroll and payroll-related transactions;  Interviewed SVSP-PIP payroll personnel to understand SVSP-PIP’s methodology for processing payroll and payroll-related transactions, determine employees’ level of knowledge and ability relating to payroll transaction processing, and gain an understanding of existing internal control over the payroll process and systems;  Selected transactions recorded in the State’s payroll database using statistical sampling, as outlined in the Appendix, and targeted selection based on risk factors and other relevant criteria;  Analyzed and tested the selected transactions and reviewed relevant files and records to determine the accuracy of payroll and payroll-related payments, accuracy of leave transactions, adequacy and effectiveness of internal control over the payroll process, and compliance with collective bargaining agreements and state laws, regulations, policies, and procedures; and  Reviewed salary advances to determine whether SVSP-PIP administered and recorded them in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. -2- Salinas Valley State Prison Psychiatric Inpatient Program Payroll Audit Conclusion Our audit determined that SVSP-PIP:  Did not maintain adequate and effective internal controls over its payroll process.1 We found the following deficiencies in internal control over the payroll process that we consider to be material weaknesses: o Inadequate segregation of duties and a lack of compensating controls over payroll transactions (see Finding 1); o Inappropriate keying access to the State’s payroll system (see Finding 2); o Failure to implement controls to ensure that SVSP-PIP adhered to the requirements of collective bargaining agreements and state regulations to limit the accumulation of vacation and annual leave credits, resulting in liability for excessive balances (see Finding 3); o Inadequate controls to ensure that overtime payments were calculated correctly, resulting in improper payments (see Finding 4); o Inadequate controls to ensure that separation lump-sum payments were calculated correctly and paid in a timely manner, resulting in improper and late payments (see Finding 5); o Inadequate controls to ensure that salary advances were collected in a timely manner, resulting in failure to recover outstanding amounts (see Finding 6);  Did not process payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. We found the following instances of noncompliance with the requirements of collective bargaining agreements and state laws, regulations, policies, and procedures: 1 In planning and performing our audit of compliance, we considered SVSP-PIP’s internal control over compliance with collective bargaining agreements and state laws, regulations, policies, and procedures to determine the auditing procedures that were appropriate under the circumstances for the purpose of providing a conclusion on compliance, and to test and report on internal control over compliance. Our consideration of internal control over compliance was for the limited purpose described in the first paragraph of this footnote; it was not designed to identify all deficiencies in internal control over compliance that might be material weaknesses or significant deficiencies. As discussed in this section, we identified certain deficiencies in internal control over compliance that we consider to be material weaknesses. A deficiency in internal control over compliance exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance with provisions of laws, regulations, or contracts on a timely basis. Control deficiencies, either individually or in combination with other control deficiencies, may be evaluated as significant deficiencies or material weaknesses. A material weakness in internal control over compliance is a deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. A significant deficiency over compliance is a deficiency, or a combination of deficiencies, in internal control over compliance with provisions of laws, regulations, or contracts that is less severe than a material weakness, yet important enough to merit attention from those charged with governance. -3- Salinas Valley State Prison Psychiatric Inpatient Program Payroll Audit o Excessive vacation and annual leave balances with a value of at least $230,717 as of July 31, 2018 (see Finding 3). Although an October 20, 2020 directive from California Department of Human Resources (CalHR) does not affect the dollar value of this finding, we are disclosing this directive because it affects our recommendation. CalHR has directed departments to immediately suspend policies that require leave balances to be reduced below the limit, and that require employees to implement leave-reduction plans. This suspension will be in effect until the 2020 Personal Leave Program (2020 PLP) ends, or July 1, 2022, whichever is sooner; o Improper payments for overtime pay (see Finding 4) and improper and late payments for employee separation lump-sum pay (see Finding 5), costing an estimated net total of $170,746; and  Did not administer salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. Seven salary advances, totaling $3,306, remained outstanding as of July 31, 2018, due to SVSP-PIP’s noncompliance with the State’s collection policies and procedures (see Finding 6). Follow-up on There were no prior payroll audits and, consequently, no prior audit findings. Prior Audit Findings Views of We issued a draft audit report on November 3, 2020. Lara Saich, Acting Director, responded by letter dated November 1, 2020 (Attachment), Responsible acknowledging the audit results, and indicating that SVSP-PIP has taken Officials steps to correct the noted deficiencies. We will follow up during the next payroll audit to verify that these corrective actions were adequate and appropriate. SVSP-PIP also provided additional information regarding Findings 1, 3, and 6. Our comments on SVSP-PIP’s response to Findings 1, 3, and 6 are included in the Findings and Recommendations section. This final audit report includes SVSP-PIP’s complete response. Restricted Use This audit report is solely for the information and use of SVSP-PIP, California Correctional Health Care Services (CCHCS), California Department of Corrections and Rehabilitation (CDCR), CalHR, and the SCO; it is not intended to be and should not be used by anyone other than these specified parties. This restriction is not intended to limit distribution of this audit report, which is a matter of public record and is available on the SCO website at www.sco.ca.gov. Original signed by JIM L. SPANO, CPA Chief, Division of Audits December 10, 2020 -4- Salinas Valley State Prison Psychiatric Inpatient Program Payroll Audit Schedule— Summary of Audit Results August 1, 2015, through July 31, 2018 Net Total Number of Number of Dollar Amount Dollar Amount Method of Units of Dollar Amount Selections Selection of Selections of Known and Finding Audit Area Tested Selection Population of Population Examined Unit Examined Likely Issues Number Segregation of duties N/A N/A N/A N/A N/A N/A N/A 1 System access Targeted 1 4 N/A 14 Employee N/A N/A 2 Excess vacation and Targeted 1 3 $ 230,717 13 Employee $ 230,717 $ 230,717 3 annual leave Overtime pay Statistical 6 ,633 18,359,304 105 Transaction 99,520 111,077 4 Separation lump-sum Statistical 7 6 1,580,637 50 Employee 1,213,203 5 9,669 5 pay Salary advance Targeted 25 1 09,551 11 Transaction 68,280 3 ,306 6 Regular pay Statistical 1 1,936 89,593,408 105 Transaction 419,028 - Holiday credit Targeted 22,465 1,077,262 3 Transaction 888 - Uniform allowance Statistical 601 2 33,187 105 Transaction 45,593 - Leave buy-back Targeted 1 5 46,888 15 Employee 46,888 - $ 111,230,954 $ 2,124,117 $ 404,769 -5- Salinas Valley State Prison Psychiatric Inpatient Program Payroll Audit Findings and Recommendations FINDING 1— SVSP-PIP lacked adequate segregation of duties within its payroll transactions unit to ensure that only valid and authorized payroll Inadequate transactions were processed. SVSP-PIP also failed to implement other segregation of controls to compensate for this risk. duties and lack of compensating GC sections 13400 through 13407 require state agencies to establish and controls over maintain internal controls, including proper segregation of duties and an payroll effective system of internal review. Adequate segregation of duties transactions reduces the likelihood that fraud or error will remain undetected by providing for separate processing by different individuals at various stages of a transaction and for independent reviews of the work performed. Our audit found that SVSP-PIP payroll transactions unit staff performed conflicting duties. Staff members performed multiple steps in processing payroll transactions, including entering data into the State’s payroll system; auditing employee timesheets; reconciling payroll, including reconciling system output to source documentation; reporting payroll exceptions; and processing adjustments. For example, staff members keyed in regular and overtime pay, and reconciled the master payroll, overtime, and other supplemental warrants. SVSP-PIP failed to demonstrate that it implemented compensating controls to mitigate the risks associated with such a deficiency. We found no indication that these functions were subjected to periodic supervisory review. The lack of adequate segregation of duties and compensating controls has a pervasive effect on the SVSP-PIP payroll process, and impairs the effectiveness of other controls by rendering their design ineffective or by keeping them from operating effectively. These control deficiencies, in combination with other deficiencies discussed in Findings 2 through 6, represent a material weakness in internal control over the payroll process such that there is a reasonable possibility that a material noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. Good internal control practices require that the following functional duties be performed by different work units, or at minimum, by different employees within the same unit:  Recording transactions – This duty refers to the record-keeping function, which is accomplished by entering data into a computer system.  Authorization to execute – This duty belongs to individuals with authority and responsibility to initiate and execute transactions.  Periodic review and reconciliation of actual payments to recorded amounts – This duty refers to making comparisons of information at regular intervals and taking action to resolve differences. -6- Salinas Valley State Prison Psychiatric Inpatient Program Payroll Audit Recommendation We recommend that SVSP-PIP:  Separate conflicting payroll function duties to the greatest extent possible. Adequate segregation of duties will provide a stronger system of internal control whereby the functions of each employee are subject to the review of another. If it is not possible to segregate payroll functions fully and appropriately, SVSP-PIP should implement compensating controls. For example, if the payroll transactions unit staff member responsible for recordkeeping also performs a reconciliation process, then the supervisor should perform and document a detailed review of the reconciliation to provide additional control over the assignment of conflicting functions. Compensating controls may also include dual authorization requirements and documented reviews of payroll system input and output; and  Develop formal procedures for performing and documenting compensating controls. SVSP-PIP’s Response The Personnel Specialist (PS) duties and responsibilities consist of performing all payroll functions such as entering/reviewing transactions, reconcilation, and processing adjustments and corrections. It is not feasible to segregate the duties, since each PS is assigned a specific roster of employees. SVSP-PIP has implemented periodic review of various transactions to be completed by the Personnel Supervisor I (PS I) as a compensating control. With the implementation of the Business Information System (BIS) and Telestaff programs in April 2018, controls are in place ensuring that Timekeeper duties do not overlap with the Personnel transactions staff who key into the payroll system. SCO Comment Our finding remains unchanged. We appreciate SVSP-PIP’s response regarding the actions it has taken to correct the noted deficiencies. In its response, SVSP-PIP asserts the existence of compensating controls to mitigate the risk associated with the lack of adequate segregation of duties. SVSP-PIP’s response also states that controls are in place to ensure that timekeeper duties do not overlap with payroll transactions unit staff. These controls, if operating effectively, will ensure that employees reflect accurate information on their timesheets. However, these controls do not mitigate the risk that errors could occur when the same payroll transactions unit staff member enters data into the system, reconciles payroll, and processes adjustments. SVSP-PIP lacked adequate controls to ensure that only appropriate staff FINDING 2— had keying access to the State’s payroll system. SVSP-PIP inappropriately Inappropriate allowed two employees keying access to the State’s payroll system. If not keying access to the mitigated, this control deficiency leaves payroll data at risk of misuse, State’s payroll abuse, and unauthorized use. system -7- Salinas Valley State Prison Psychiatric Inpatient Program Payroll Audit The SCO maintains the State’s payroll system. The system is decentralized, thereby allowing employees of state agencies to access it. PPSD has established a Decentralized Security Program Manual that all state agencies are required to follow in order to access the payroll system. The program’s objectives are to secure and protect the confidentiality and integrity of payroll data against misuse, abuse, and unauthorized use. We examined the records of 14 SVSP-PIP employees who had keying access to the State’s payroll system at various times between August 2015 and July 2018. Of the 14 employees, two had inappropriate keying access to the State’s payroll system. Specifically, SVSP-PIP did not immediately remove or modify keying access for the two employees after the employees’ separation from state service, transfer to another agency, or change in classification. For example, an Office Technician left SVSP-PIP on October 1, 2015, but SVSP-PIP did not request to remove the employee’s access until December 1, 2015, 61 days later. The Decentralized Security Program Manual states, in part: The PPSD system contains sensitive and confidential information. Access is restricted to persons with an authorized, legal, and legitimate business requirement to complete their duties. . . . Currently, PIMS, HIST, KEYM, PIP, LAS, MPC and/or ACAS applications are restricted to Personnel Specialists or Personnel Technician classifications because their need is by definition a function of their specific job duties and any change in those duties requires a reevaluation of the need for access. If the employee’s duties change, such that the need for access no longer exists, the access privilege MUST be removed or deleted immediately by a request submitted by the department/campus. . . . A request to grant access to an individual in a classification other than in the Personnel Specialist/Payroll Technician series to access PIMS, HIST, KEYM, PIP, LAS, MPC and/or ACAS requires a written justification from the Authorizing Manager. The justification must describe the individual's specific job duties requiring the need to access system information (i.e., PIMS = Employment History, HIST=Payroll History, LAS=Leave Accounting System, etc.) as well as level of access to that application, in order to perform their regular daily duties. . . . To prevent unauthorized use by a transferred, terminated or resigned employee's user ID, the Security Monitor must IMMEDIATELY submit all pages of the PSD125A to delete the user’s system access. Using an old user ID increases the chances of a security breach which is a serious security violation. Sharing a user ID is strictly prohibited and a serious violation. Recommendation We recommend that SVSP-PIP:  Update keying access to the State’s payroll system immediately after employees leave SVSP-PIP, transfer to another unit, or change classifications; and  Periodically review access to the system to verify that access complies with the Decentralized Security Program Manual. -8- Salinas Valley State Prison Psychiatric Inpatient Program Payroll Audit SVSP-PIP failed to implement controls to ensure that it adheres to the FINDING 3— requirements of collective bargaining agreements and state regulations to Inadequate limit the accumulation of vacation and annual leave credits. This controls over deficiency resulted in liability for excessive leave balances with a value of vacation and at least $230,717 as of July 31, 2018. We expect the liability to increase if annual leave SVSP-PIP does not take action to address the excessive vacation and balances, resulting annual leave balances. in liability for excessive balances Collective bargaining agreements and state regulations limit the amount of vacation and annual leave that most state employees may accumulate to no more than 80 days (640 hours). The limit on leave balances helps state agencies to manage leave balances and control the State’s liability for accrued leave credits. State agencies may allow employees to carry a higher leave balance only under limited circumstances. For example, an employee may not be able to reduce accrued vacation or annual leave hours below the limit due to business needs. When an employee’s leave accumulation exceeds or is projected to exceed the limit, state agencies should work with the employee to develop a written plan to reduce leave balances below the applicable limit. Our examination of SVSP-PIP’s leave accounting records determined that SVSP-PIP had 284 employees with unused vacation or annual leave credits at July 31, 2018. Of those employees, 13 exceeded the limit set by collective bargaining agreements and state regulations. For example, one employee had an accumulated balance of 2,195 hours in annual leave, or 1,555 hours beyond the 640-hour limit. Collectively, the 13 employees accumulated 4,457 hours of excess vacation and annual leave, with a value of at least $230,717 as of July 31, 2018. This estimated liability does not adjust for salary rate increases and additional leave credits.2 Accordingly, we expect that the amount needed to pay for this liability will be higher. For example, a SVSP-PIP employee separated from state service with 2,779 hours in leave credits, including 1,440 hours in vacation. After adjusting for additional leave credits, the employee should have been paid for 2,974 hours, or 7% more. We further examined the records of the 13 employees to determine whether SVSP-PIP complied with collective bargaining agreements and state regulations. We determined that SVSP-PIP could not demonstrate that it had complied with collective bargaining agreements and state regulations when allowing these employees to maintain excess vacation or annual leave balances. We also found that SVSP-PIP had no plans in place during the audit period to reduce leave balances below the limit. If SVSP-PIP does not take action to reduce the excessive leave balances, the liability for accrued vacation and annual leave will likely increase because most employees will receive salary increases or use other non- compensable leave credits instead of vacation or annual leave, thus 2 Most state employees receive pay rate increases every year pursuant to state laws and/or collective bargaining agreements until they reach the top of their pay scale, or promote into a higher-paying position. In addition, when an employee’s accumulated leave balances upon separation are calculated for lump-sum pay, the employee is credited with additional leave credits equal to the amount that the employee would have earned had the employee taken time off and not separated from state service. -9- Salinas Valley State Prison Psychiatric Inpatient Program Payroll Audit increasing their vacation or annual leave balances. The state agency responsible for paying these leave balances may face a cash flow problem if a significant number of employees with excessive vacation or annual leave balances separate from state service. Normally, state agencies are not budgeted to make these separation lump-sum payments. However, the State’s current practice dictates that the state agency that last employed an employee pays for that employee’s separation lump-sum payment, regardless of where the employee accrued the leave balance. Although an October 20, 2020 directive from CalHR does not affect the dollar value of this finding, we are disclosing this directive because it affects our recommendation. CalHR has directed departments to immediately suspend policies that require leave balances to be reduced below the limit, and that require employees to implement leave-reduction plans. This suspension will be in effect until the 2020 PLP ends, or July 1, 2022, whichever is sooner. Recommendation We recommend that, after the 2020 PLP ends, or July 1, 2022, whichever is sooner, SVSP-PIP:  Implement controls, including existing policies and procedures, to ensure that its employees’ vacation and annual leave balances are maintained within levels allowed by collective bargaining agreements and state regulations;  Conduct ongoing monitoring of controls to ensure that they are implemented and operating effectively; and  Participate in leave buy-back programs if the State offers such programs and funds are available. SVSP-PIP’s Response Furloughs and Personal Leave Program have contributed to the accumulation of annual leave and vacation credits. Staffing shortages coupled with an increase in workload do not allow for the approval of extended amounts of time off. Since transitioning to CDCR/CCHCS, SVSP-PIP has implemented a procedure for management to review annual reports and work with staff to develop a written leave balance reduction plan. It should be noted, however, [that] effective October 26, 2020, the California Department of Human Resources suspended the leave reduction plan requirements for the duration of the 2020 Personal Leave Program (PLP) or July 1, 2022. Once suspension is lifted, SVSP-PIP will resume following existing policies and procedures to ensure its employees’ vacation and annual leave balances are maintained within levels allowed by collective bargaining agreements and state regulations, as well as conducting ongoing monitoring of controls to ensure they are implemented and operating effectively. -10- Salinas Valley State Prison Psychiatric Inpatient Program Payroll Audit SCO Comment Our finding remains unchanged. However, we added a disclosure of CalHR’s October 20, 2020 directive regarding the suspension of policies regarding leave reduction. We revised our recommendation as a result of this directive. SVSP-PIP lacked adequate segregation of duties within its payroll FINDING 4— transactions unit, as noted in Finding 1, and lacked adequate controls over Inadequate the processing of overtime pay. We identified a net total of $111,077 in controls over improper overtime payments, consisting of $913 in overpayments and overtime pay, $311 in underpayments based on actual transactions examined (“known”); resulting in and $167,552 in overpayments and $57,077 in underpayments based on improper the results of statistical sampling (“likely”). If not mitigated, these control payments deficiencies leave SVSP-PIP at risk of making additional improper overtime payments. Collective bargaining agreements, and state laws and policies, contain specific clauses regarding overtime pay. Payroll records show that SVSP- PIP processed 6,633 overtime pay transactions, totaling $18,359,304, between August 2015 and July 2018. Of the 6,633 overtime pay transactions, we randomly selected a statistical sample (as described in the Appendix) of 105 transactions, totaling $99,520. Of the 105 transactions, six were overpaid by approximately $913 and four were underpaid by approximately $311. These payments resulted in a net total of $602 in improper payments. As we used a statistical sampling method to select the overtime pay transactions examined, we projected the amount of likely overpayments to be $167,552 and likely underpayments to be $57,077. These payments resulted in a net total of $110,475 in likely improper payments. Therefore, the known and likely improper payments totaled a net of approximately $111,077, consisting of $168,465 in overpayments and $57,388 in underpayments. The following table summarizes the results of our statistical sampling: Known improper payments, net $ 6 02 Divide by: Sample 9 9,520 Error rate for projection (differences due to rounding) 0.61% Population that was statistically sampled 1 8,359,304 Multiply by: Error rate for projection 0.61% Known and likely improper payments, net (differences due to rounding) 1 11,077 Less: Known improper payments, net 6 02 Likely improper payments, net $ 1 10,475 _____________ * Amounts in this table are rounded to the nearest whole dollar. -11- Salinas Valley State Prison Psychiatric Inpatient Program Payroll Audit The known improper payments occurred because payroll transactions unit staff members miscalculated overtime hours worked, or paid for overtime hours worked at the straight-time rate instead of the time-and-a-half rate, or vice-versa. Furthermore, SVSP-PIP lacked adequate supervisory review to ensure accurate processing of overtime pay. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Recommendation We recommend that SVSP-PIP:  Conduct a review of payments for overtime pay made during the past three years to ensure that the payments complied with collective bargaining agreements and state laws and policies; and  Recover overpayments made to employees through an agreed-upon collection method in accordance with GC section 19838, and properly compensate those employees who were underpaid. We further recommend that, to prevent improper payments for overtime pay from recurring, SVSP-PIP:  Establish adequate internal controls to ensure that payments are accurate and comply with collective bargaining agreements and state laws and policies; and  Provide adequate oversight to ensure that payroll transactions unit staff process only valid and authorized payments that comply with collective bargaining agreements and state laws and policies. SVSP-PIP lacked adequate segregation of duties within its payroll FINDING 5— transactions unit, as noted in Finding 1, and lacked adequate controls over Inadequate the processing of employee separation lump-sum pay. We identified a net controls over total of $59,669 in improper separation lump-sum payments, consisting of separation lump- $50,869 in known overpayments and $5,071 in known underpayments; sum pay, resulting and $15,406 in likely overpayments and $1,535 in likely underpayments. in improper and SVSP-PIP also did not pay the separation lump-sum payments for late payments 45 employees in a timely manner. If not mitigated, these control deficiencies leave SVSP-PIP at risk of making additional improper and late separation lump-sum payments, noncompliance with agreements and laws, and liability for late payments. GC section 19839 allows lump-sum payment for accrued eligible leave credits when an employee separates from state employment. Collective bargaining agreements include similar provisions regarding separation lump-sum pay. Payroll records show that SVSP-PIP processed separation lump-sum payments, totaling $1,580,637, for 76 employees between August 2015 and July 2018. Of the 76 employees, we randomly selected a statistical sample (as described in the Appendix) of 50 employees who received -12- Salinas Valley State Prison Psychiatric Inpatient Program Payroll Audit separation lump-sum pay, totaling $1,213,203. Of the 50 employees, 16 were overpaid by approximately $50,869 and seven were underpaid by approximately $5,071. These payments resulted in a net total of $45,798 in improper payments. As we used a statistical sampling method to select the employees whose payments for separation lump-sum pay were examined, we projected the amount of likely overpayments to be $15,406 and likely underpayments to be $1,535. These payments resulted in a net total of $13,871 in improper payments. Therefore, the known and likely improper payments totaled a net of approximately $59,669, consisting of $66,275 in overpayments and $6,606 in underpayments. The following table summarizes the results of our statistical sampling: Known improper payments, net $ 4 5,798 Divide by: Sample 1 ,213,203 Error rate for projection (differences due to rounding) 3.77% Population that was statistically sampled 1 ,580,637 Multiply by: Error rate for projection 3.77% Known and likely imrproper payments, net (differences due to rounding) 5 9,669 Less: Known improper payments, net 4 5,798 Likely improper payments, net $ 1 3,871 _____________ * Amounts in this table are rounded to the nearest whole dollar. Of the 50 employees whose separation lump-sum payments we examined, 45 were not paid in a timely manner, in violation of collective bargaining agreements and state laws as summarized in the CalHR’s Human Resources Manual, section 1703. The known improper payments were made because payroll transactions unit staff members miscalculated leave balances paid. SVSP-PIP also lacked adequate supervisory review to ensure accurate and timely processing of separation lump-sum pay. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. Recommendation We recommend that SVSP-PIP:  Establish adequate controls to ensure accurate calculation and timely payment of separation lump-sum pay;  Conduct a review of separation lump-sum payments made during the past three years to ensure that the payments were accurate and in compliance with collective bargaining agreements and state law; and  Recover overpayments made to separated employees in accordance -13- Salinas Valley State Prison Psychiatric Inpatient Program Payroll Audit with GC section 19838 and State Administrative Manual (SAM) section 8776.6, and properly compensate those employees who were underpaid. SVSP-PIP lacked adequate segregation of duties within its payroll FINDING 6— transactions unit, as noted in Finding 1, and lacked adequate controls over Inadequate salary advances to ensure that advances were recovered in accordance with controls over state law and policies. Seven salary advances, totaling $3,306, remained salary advances, outstanding as of July 31, 2018, due to SVSP-PIP’s noncompliance with resulting in failure the State’s collection policies and procedures. The oldest unrecovered to recover salary advance was outstanding for over 10 years. These control outstanding deficiencies leave SVSP-PIP at risk of failing to collect further salary amounts advances if not mitigated. At July 31, 2018, SVSP-PIP’s accounting records showed 25 outstanding salary advances, totaling $109,551, including 11 balances, totaling $68,280, which had been outstanding for more than 60 days. Generally, the prospect of collection diminishes as an account ages. When an agency does not initiate collection within three years from the date of overpayment, the possibility of collection is remote. GC section 19838 and SAM sections 8776 and 8776.7 describe the State’s collection policies and procedures, which require SVSP-PIP to collect salary advances in a timely manner and maintain proper records of collection efforts. We examined the 11 salary advances that had been outstanding for more than 60 days. Based on this examination, we noted that SVSP-PIP did not comply with the State’s collection policies and procedures for seven of them, totaling $3,306. SVSP-PIP did not send collection notices promptly, or did not send the notices at all. For example, SVSP-PIP issued a salary advance to an employee in November 2013 and sent the first collection letter in August 2014, about eight months later. The lack of adequate controls over salary advances reduces the likelihood of collection, increases the amount of resources expended on collection efforts, and negatively impacts cash flow. Recommendation We recommend that SVSP-PIP ensure that it recovers salary advances in a timely manner, pursuant to GC section 19838 and SAM sections 8776 and 8776.7. If all reasonable collection procedures do not result in payment, SVSP-PIP may request discharge from accountability of uncollectable amounts. SVSP-PIP’s Response SVSP-PIP makes a concerted effort to clear all salary advances in a timely manner. Since the implementation of BIS in April 2018, all salary advances are tracked in the BIS system and overseen by the Salary Advance/Aging Report (SA/AR) Unit, as well the Accounting Services Branch. The SA/AR Unit distributes a monthly report that is reviewed and monitored by SVSP-PIP Personnel Supervisors on a monthly basis. -14- Salinas Valley State Prison Psychiatric Inpatient Program Payroll Audit While SVSP-PIP strives to expeditiously and diligently clear salary advances, staffing turnover periodically impacts the effectiveness of our efforts, causing unplanned delays in notification and/or recovery of outstanding accounts. With regards to the seven outstanding salary advances identified in the findings, five of the lump sums were issued to employees that separated from state civil service prior to this audit period. Once an employee separates from state service, the responsibility to collect shifts from the local Personnel Office to the departmental Accounting Office, which would have been DSH Administrative Services/Accounting in this case. SCO Comment Our finding remains unchanged. We appreciate SVSP-PIP’s response regarding the actions it has taken to correct the noted deficiencies. In its response, SVSP-PIP asserts that the responsibility to collect salary advances from employees who separated from state service shifts from the personnel office to the departmental accounting office. This assertion contradicts SVSP-PIP’s own policy regarding salary advances. Section 711 of CDCR’s Personnel Operations Manual states that “It is the Personnel Specialist’s responsibility to monitor pending pay and to clear all outstanding salary advances in a timely manner.” -15- Salinas Valley State Prison Psychiatric Inpatient Program Payroll Audit Appendix— Audit Sampling Methodology We used attributes sampling for tests of compliance. The sample design was chosen because:  It follows the American Institute of Certified Public Accountants (AICPA) guidelines;  It allows us to achieve our objectives for tests of compliance in an efficient and effective manner; and  Audit areas included both high and low volumes of transactions. The following table outlines our audit sampling application for all audit areas where statistical sampling was utilized: Expected Audit Type Population Population Sampling Sample Selection Confidence Tolerable Error Sample Results Projected to Finding Area of Test (Unit) (Dollar) Unit Method Level Error Rate (Rate) ᵃ Size ᵇ Intended Population Number Regular pay Compliance 11,936 $89,593,408 Transaction Computer-generated 90% 5.0% 2 (1.75%) 105 Yes simple random Overtime pay Compliance 6,633 1 8,359,304 Transaction Computer-generated 90% 5.0% 2 (1.75%) 105 Yes 4 simple random Separation Compliance 76 1 ,580,637 Employee Computer-generated 95% 5.5% 2 (2.00%) 50 Yes 5 lump-sum pay simple random Uniform allowance Compliance 6 01 2 33,187 Transaction Computer-generated 90% 5.0% 2 (1.75%) 105 Yes simple random ________________________ ᵃ Pursuant to the AICPA’s Audit Guide: Audit Sampling (May 1, 2017 edition), pages 131-133, the expected error is the expected number of errors planned for in the sample. It is derived by multiplying the expected error rate by the sample size. The expected number of errors in the sampling tables on pages 135-136 was rounded upward, e.g., 0.2 errors becomes 1.0 error. ᵇ For populations of less than 250 items, we determined the sample size using a calculator that utilizes a hypergeometric distribution. For populations of 250 items and above, we determined the sample size using a calculator that utilizes a binomial distribution. As stated in Technical Notes on the AICPA Audit Guide Audit Sampling (March 1, 2012), page 5, although the hypergeometric distribution is the exactly correct distribution to use for attributes sample sizes, the distribution becomes unwieldy for large populations unless suitable software is available. Therefore, more convenient approximations are frequently used instead. Salinas Valley State Prison Psychiatric Inpatient Program Payroll Audit Attachment— Salinas Valley State Prison Psychiatric Inpatient Program’s Response to Draft Audit Report State Controller’s Office Division of Audits Post Office Box 942850 Sacramento, CA 94250 http://www.sco.ca.gov S19-PAR-0012