California Department of Food and Agriculture’s (cdfa) Payroll Process and Transactions

CALIFORNIA DEPARTMENT OF FOOD AND AGRICULTURE Audit Report PAYROLL AUDIT March 1, 2016, through February 28, 2019 BETTY T. YEE California State Controller March 2021 BETTY T. YEE California State Controller March 2, 2021 Karen Ross, Secretary California Department of Food and Agriculture 1220 N Street, Suite 242 Sacramento, CA 95814 Dear Secretary Ross: The State Controller’s Office audited the California Department of Food and Agriculture’s (CDFA) payroll process and transactions for the period of March 1, 2016, through February 28, 2019. Our audit determined that CDFA did not maintain adequate and effective internal controls over its payroll process. CDFA lacked adequate segregation of duties and compensating controls, resulting in improper overtime payments, maintenance of timesheets, and separation lump-sum payments. CDFA also granted inappropriate keying access to the State’s payroll system. In addition, CDFA did not implement controls to limit the accumulation of vacation and annual leave credits, resulting in liability for excessive balances. CDFA also did not have adequate controls over holiday credit transactions. If you have any questions, please contact Andrew Finlayson, Chief, State Agency Audits Bureau, by telephone at (916) 324-6310. Sincerely, Original signed by MICHAEL REEVES, CPA Acting Chief, Division of Audits MR/ac cc: Kari Morrow, Director, Administrative Services Division California Department of Food and Agriculture Gay Faivre, Personnel Officer, Human Resources Branch California Department of Food and Agriculture Brendan Murphy, Chief, Administrative Services Division California Department of Human Resources Jil Barraza, Chief, Personnel and Payroll Services Division State Controller’s Office California Department of Food and Agriculture Payroll Audit Contents Audit Report Summary ............................................................................................................................ 1 Background ........................................................................................................................ 1 Objectives, Scope, and Methodology ............................................................................... 2 Conclusion .......................................................................................................................... 3 Follow-up on Prior Audit Findings .................................................................................. 4 Views of Responsible Officials .......................................................................................... 4 Restricted Use .................................................................................................................... 4 Schedule—Summary of Audit Results ................................................................................. 5 Findings and Recommendations ........................................................................................... 6 Appendix—Audit Sampling Methodology ........................................................................... A1 Attachment—California Department of Food and Agriculture’s Response to Draft Audit Report California Department of Food and Agriculture Payroll Audit Audit Report Summary The State Controller’s Office (SCO) audited the California Department of Food and Agriculture’s (CDFA) payroll process and transactions for the period of March 1, 2016, through February 28, 2019. CDFA management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. We completed our audit fieldwork on January 7, 2020. Our audit determined that CDFA:  Did not maintain adequate and effective internal controls over its payroll process. CDFA lacked adequate segregation of duties and compensating controls over payroll transactions, resulting in improper separation lump-sum and overtime payments, and improper holiday credits. CDFA also granted inappropriate keying access to the State’s payroll system;  Did not implement controls to limit the accumulation of vacation and annual leave credits, resulting in liability for excessive balances; and  Administered salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. Background In 1979, the State of California adopted collective bargaining for state employees. This created a significant workload increase for the SCO’s Personnel and Payroll Services Division (PPSD), as PPSD was the State’s centralized payroll processing center for all payroll related-transactions. PPSD decentralized the processing of payroll, allowing state agencies and departments to process their own payroll-related transactions. Periodic audits of the decentralized payroll processing at state agencies and departments ceased due to the budget constraints in the late 1980s. In 2013, the California State Legislature reinstated these payroll audits to gain assurance that state agencies and departments maintain adequate internal control over the payroll function, provide proper oversight of their decentralized payroll processing, and comply with various state laws and regulations regarding payroll processing and related transactions. Audit Authority Authority for this audit is provided by California Government Code (GC) section 12476, which states, “The Controller may audit the uniform state pay roll system, the State Pay Roll Revolving Fund, and related records of state agencies within the uniform state pay roll system, in such manner as the Controller may determine.” In addition, GC section 12410 stipulates that “The Controller shall superintend the fiscal concerns of the state. The Controller shall audit all claims against the state, and may audit the disbursement of any state money, for correctness, legality, and for sufficient provisions of law for payment.” -1- California Department of Food and Agriculture Payroll Audit Objectives, Scope, We performed this audit to determine whether CDFA: and Methodology  Maintained adequate and effective internal controls over its payroll process;  Processed payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures; and  Administered salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. The audit covered the period from March 1, 2016, through February 28, 2019. To achieve our audit objectives, we:  Reviewed state and CDFA policies and procedures related to the payroll process to understand CDFA’s methodology for processing various payroll and payroll-related transactions;  Interviewed CDFA payroll personnel to understand CDFA’s methodology for processing various payroll and payroll-related transactions, determine the employees’ level of knowledge and ability relating to payroll transaction processing, and gain an understanding of existing internal control over the payroll process and systems;  Selected transactions recorded in the State’s payroll database using statistical sampling, as outlined in Appendix, and targeted selection based on risk factors and other relevant criteria;  Analyzed and tested the selected transactions and reviewed relevant files and records to determine the accuracy of payroll and payroll- related payments, accuracy of leave transactions, adequacy and effectiveness of internal control over the payroll process, and compliance with collective bargaining agreements and state laws, regulations, policies, and procedures; and  Reviewed salary advances to determine whether CDFA administered and recorded them in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. -2- California Department of Food and Agriculture Payroll Audit Conclusion Our audit determined that CDFA:  Did not maintain adequate and effective internal controls over its payroll process.1 We found the following deficiencies in internal control over the payroll process that we consider to be material weaknesses: o Inadequate segregation of duties and compensating controls over payroll transactions (see Finding 1); o Inappropriate keying access to the State’s payroll system (see Finding 2);  Did not process payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. We found the following instances of noncompliance with the requirements of collective bargaining agreements and state laws, regulations, policies, and procedures: o Inadequate controls to ensure that accumulated vacation and annual leave balances are not excessive, resulting in accumulated leave balances with an estimated value of $633,630, exceeding the balance allowed by state policy and bargaining unit agreements (see Finding 3). Although an October 20, 2020 directive from California Department of Human Resources (CalHR) does not affect the dollar value of this finding, we are disclosing this directive because it affects our recommendation. CalHR has directed departments to immediately suspend policies that require leave balances be reduced below the limit, and that require employees to implement leave-reduction plans. This suspension will be in effect until the 2020 Personal Leave Program (2020 PLP) ends, or July 1, 2022, whichever is sooner; o Inadequate controls to ensure that separation lump-sum payments are calculated correctly (see Finding 4); 1 In planning and performing our audit of compliance, we considered CDFA’s internal control over compliance with collective bargaining agreements and state laws, regulations, policies, and procedures to determine the auditing procedures that were appropriate in the circumstances for the purpose of providing a conclusion on compliance, and to test and report on internal control over compliance. Our consideration of internal control over compliance was for the limited purpose described in the first paragraph of this footnote, and was not designed to identify all deficiencies in internal control over compliance that might be material weaknesses or significant deficiencies. However, as discussed this section, we identified certain deficiencies in internal control over compliance that we consider to be material weaknesses. A deficiency in internal control over compliance exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance with provisions of laws, regulations, or contracts on a timely basis. Control deficiencies, either individually or in combination with other control deficiencies, may be evaluated as significant deficiencies or material weaknesses. A material weakness in internal control over compliance is a deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. A significant deficiency over compliance is a deficiency, or a combination of deficiencies, in internal control over compliance with provisions of laws, regulations, or contracts that is less severe than a material weakness, yet important enough to merit attention from those charged with governance. -3- California Department of Food and Agriculture Payroll Audit o Inadequate controls to ensure that timesheets are maintained for regular pay (see Finding 5); o Inadequate controls over overtime pay resulting in overpayments, underpayments, missing timesheets, and overtime paid without proper pre-authorization (see Finding 6); and o Inadequate controls over holiday credit transactions (see Finding 7); and  Administered salary advances in accordance with collective bargaining agreements and state laws, regulations, policies and procedures. These improper and questioned payments cost the State an estimated net total of $9,214,856. There were no prior payroll audits and, consequently, no prior audit Follow-up on findings. Prior Audit Findings Views of We issued the draft report on January 5, 2021. Karen Ross, Secretary, responded by letter dated January 13, 2021 (Attachment). CDFA did not Responsible disagree with any of the findings except for the impact of Finding 6. CDFA Officials indicated that it has taken steps and implemented procedures to address and remedy the findings since the audit. CDFA’s entire response has been included as an Attachment to this report. Restricted Use This audit report is solely for the information and use of CDFA and the SCO; it is not intended to be and should not be used by anyone other than these specified parties. This restriction is not intended to limit distribution of this audit report, which is a matter of public record and is available on the SCO website at www.sco.ca.gov. Original signed by MICHAEL REEVES, CPA Acting Chief, Division of Audits March 2, 2021 -4- California Department of Food and Agriculture Payroll Audit Schedule— Summary of Findings March 1, 2016, through February 28, 2019 Number of Dollar Amount Total Dollar Finding Method of Dollar Selections of Selections Selection Amount of Known Number Areas tested Selection Population Population Examined Examined Unit and Likely Issues 1 Inadequate segregation of duties N/A N/A N/A N/A N/A N/A N/A and compensating controls over payroll transactions 2 Inappropriate keying access to Targeted N/A N/A 2 2 $ - Employee $ - the State’s payroll system 3 Inadequate controls to ensure Targeted N/A N/A 119 1 ,329,949 Employee 633,630 that accumulated vacation and annual leave balances are not excessive, resulting in accumulated leave balances exceeding the balance allowed by state policy and bargaining unit agreements 4 Inadequate controls to ensure Statistical 7 40 $ 4 ,251,704 7 7 362,944 Employee that separation lump-sum payments are calculated correctly Overpayments -- See above -- 5 29 Underpayments -- See above -- (26,123) 5 Inadequate controls to ensure Statistical 6 0,667 267,892,296 7 7 250,274 Payment that timesheets are maintained transaction for regular pay Overpayments -- See above -- 8 9,057 Questioned Payments -- See above -- 8,534,041 6 Inadequate controls over Statistical 6 ,336 4 ,574,808 7 7 59,903 Payment overtime pay, resulting in transaction overpayments, underpayments, missing timesheets, and overtime paid without proper pre- authorization Overpayments -- See above -- 3 46 Underpayments -- See above -- (38,849) Questioned Payments -- See above -- 2 0,175 7 Inadequate controls over holiday Targeted N/A N/A 1 5 4,182 Holiday credit 2,050 credit transactions Total 276,718,808 387 $ 2,007,252 $ 9 ,214,856 -5- California Department of Food and Agriculture Payroll Audit Findings and Recommendations FINDING 1— CDFA lacked adequate segregation of duties within its payroll transactions unit to ensure that only valid and authorized payroll Inadequate transactions were processed. CDFA also failed to implement other segregation of controls to compensate for this risk. duties and compensating GC sections 13400 through 13407 require state agencies to establish and controls over maintain internal controls, including proper segregation of duties and an payroll effective system of internal review. Adequate segregation of duties transactions reduces the likelihood that fraud or error will remain undetected by providing for separate processing by different individuals at various stages of a transaction and for independent reviews of the work performed. Our audit found that CDFA payroll transactions unit staff performed conflicting duties. Staff members performed multiple steps in processing payroll transactions, including entering data into the State’s payroll system; auditing employee timesheets; reconciling payroll, including reconciling system output to source documentation; reporting payroll exceptions; and processing adjustments. For example, staff members keyed in regular and overtime pay and reconciled the master payroll, overtime, and other supplemental warrants. CDFA failed to demonstrate that it implemented compensating controls to mitigate the risks associated with such a deficiency. We found no indication that these functions were subjected to periodic supervisory review after entries were keyed into the system. The lack of adequate segregation of duties and compensating controls has a pervasive effect on the CDFA payroll process, and impairs the effectiveness of other controls by rendering their design ineffective or by keeping them from operating effectively. These control deficiencies, in combination with other deficiencies discussed in Findings 2 through 7, represent a material weakness in internal control over the payroll process such that there is a reasonable possibility that a material noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. Good internal control practices require that the following functional duties be performed by different work units, or at minimum, by different employees within the same unit:  Recording transactions – This duty refers to the record-keeping function, which is accomplished by entering data into a computer system.  Authorization to execute – This duty belongs to individuals with authority and responsibility to initiate and execute transactions.  Periodic review and reconciliation of actual payments to recorded amounts – This duty refers to making comparisons of information at regular intervals and taking action to resolve differences. -6- California Department of Food and Agriculture Payroll Audit Recommendation We recommend that CDFA:  Separate conflicting payroll function duties to the greatest extent possible. Adequate segregation of duties will provide a stronger system of internal control whereby the functions of each employee are subject to the review of another. If it is not possible to segregate payroll functions fully and appropriately, CDFA should implement compensating controls. For example, if the payroll transactions unit staff member responsible for record-keeping also performs a reconciliation process, then the supervisor should perform and document a detailed review of the reconciliation to provide additional control over the assignment of conflicting functions. Compensating controls may also include dual authorization requirements and documented reviews of payroll system input and output; and  Develop formal procedures for performing and documenting compensating controls. FINDING 2— CDFA lacked adequate controls to ensure that only appropriate staff had keying access to the State’s payroll system. We audited the records of Inappropriate 22 CDFA employees who had keying access to the State’s payroll system keying access to the at various times between March 2016 and February 2019. We found that State’s payroll CDFA did not immediately remove or modify the keying access of four system employees (18 percent of employees tested) after their separation from state service, transfer to another agency or unit, or change in classification. Therefore, CDFA inappropriately, allowed four employees keying access to the State’s payroll system.If not mitigated, this control deficiency leaves payroll data at risk of misuse, abuse, and unauthorized use. The SCO maintains the State’s payroll system. The system is decentralized, allowing employees of state agencies to access it. PPSD has established a Decentralized Security Program Manual that all state agencies are required to follow in order to access the payroll system. Allowing inappropriate access to the payroll system jepordizes the program’s objectives to secure and protect the confidentiality and integrity of payroll data against misuse, abuse, and unauthorized use. The Decentralized Security Program Manual (Revised January 2020) states, in part: Revocation and Deletion of User IDs To prevent unauthorized use by a transferred, terminated or resigned employee's User ID, the Security Monitor must IMMEDIATELY submit all pages of the PSD125A signed by both Security Monitor and Authorizing Manager to delete the user’s system access. Using an old User ID increases the risk of a security breach, which is a serious security violation. Sharing a User ID is strictly prohibited. -7- California Department of Food and Agriculture Payroll Audit Recommendation We recommend that CDFA:  Provide adequate controls to ensure that employees with keying access to the State’s payroll system do not enter their own data into the system;  Update keying access to the State’s payroll system immediately after employees leave CDFA, transfer to another agency or unit, or change classifications; and  Periodically review access to the system to verify that access complies with the Decentralized Security Program Manual. CDFA failed to implement controls to ensure that it adhered to the FINDING 3— requirements of collective bargaining agreements and state regulations to Inadequate limit the accumulation of vacation and annual leave credits. The deficiency controls to ensure resulted in liability for excessive leave balances with a value of at least that accumulated $633,630 as of February 28, 2019.2 We expect the liability to increase if vacation and CDFA does not take action to address the excessive vacation and annual annual leave leave balances. balances are not excessive, resulting Collective bargaining agreements and state regulations limit the amount in accumulated of vacation and annual leave that most state employees may accumulate to leave balances no more than 80 days (640 hours). The limit on leave balances helps state exceeding the agencies to manage leave balances and control the State’s liability for accrued leave credits. State agencies may allow employees to carry a balance allowed by higher leave balance only under limited circumstances. For example, an state policy and employee may not be able to reduce accrued vacation or annual leave bargaining unit hours below the limit due to business needs. When an employee’s leave agreements accumulation exceeds or is projected to exceed the limit, state agencies should work with the employee to develop a written plan to reduce leave balances below the applicable limit. Our examination of CDFA’s leave accounting records determined that CDFA had 1,581 employees with unused vacation or annual leave credits at March 1, 2016. Of those employees, 119 exceeded the limit set by collective bargaining agreements and state regulations. For example, one employee had an accumulated balance of 1,085 hours of annual leave, or 445 hours beyond the 640-hour limit. Collectively, the 119 employees accumulated 17,206 hours of excess vacation and annual leave, with a value of at least $633,630 as of February 28, 2019. This estimated liability does not adjust for salary rate increases and additional leave credits.3 Accordingly, we expect that the amount needed to pay for this liability will be higher. 2At the time of our review, we used the most recent and complete vacation and annual leave balances, which were as of February 28, 2019. 3Most state employees receive pay rate increases every year pursuant to state laws and/or collective bargaining agreements until they reach the top of their pay scale, or promote into a higher-paying position. In addition, when an employee’s accumulated leave balances upon separation are calculated for lump-sum pay, the employee is credited with additional leave credits equal to the amount that the employee would have earned had the employee taken time off and not separated from state service. -8- California Department of Food and Agriculture Payroll Audit We selected 119 employees for examination to determine whether CDFA complied with collective bargaining agreements and state regulations. We determined that CDFA could not demonstrate its compliance with collective bargaining agreements and state regulations for when allowing these employees to maintain excess vacation or annual leave balances. If CDFA does not take action to reduce the excessive leave balances, the liability for accrued vacation and annual leave will likely increase because most employees will receive salary increases or use other non- compensable leave credits instead of vacation or annual leave, increasing their vacation or annual leave balances. The state agency responsible for paying these leave balances may face a cash-flow problem if a significant number of employees with excessive vacation or annual leave balances separate from state service. Normally, state agencies are not budgeted to make these separation lump-sum payments. However, the State’s current practice dictates that the state agency that last employed an employee pays for that employee’s lump-sum separation payment, regardless of where the employee accrued the leave balance. Although an October 20, 2020 directive from CalHR does not affect the dollar value of this finding, we are disclosing this directive because it affects our recommendation. CalHR has directed departments to immediately suspend policies that require leave balances be reduced below the limit, and that require employees to implement leave-reduction plans. This suspension will be in effect until the 2020 PLP ends, or July 1, 2022, whichever is sooner. Recommendation We recommend that, after the 2020 PLP ends, or July 1, 2022, whichever is sooner, CDFA:  Implement controls, including existing policies and procedures, to ensure that its employees’ vacation and annual leave balances are maintained within levels allowed by collective bargaining agreements and state regulations;  Conduct ongoing monitoring of controls to ensure that they are implemented and operating effectively; and  Participate in leave buy-back programs if the State offers such programs and funds are available. CDFA lacked segregation of duties and compensating controls within its FINDING 4— payroll transactions unit, as noted in Finding 1, and lacked adequate Inadequate controls over the processing of employee separation lump-sum pay. We controls to ensure identified $529 in overpayments and $26,123 in underpayments for that separation separation lump-sum pay, consisting of $45 in overpayments and $2,230 lump-sum in underpayments based on actual transactions audited (known); and $484 payments are in overpayments and $23,893 in underpayments based on the results of calculated statistical sampling (likely). If not mitigated, these control deficiencies correctly leave CDFA at risk of making additional improper separation lump-sum payments. -9- California Department of Food and Agriculture Payroll Audit GC section 19839 allows lump-sum payment for accrued eligible leave credits when an employee separates from state employment. Collective bargaining agreements include similar provisions regarding separation lump-sum pay. Payroll records show that CDFA processed payments for separation lump- sum pay, totaling $4,251,704, for 740 employees between March 1, 2016, and February 28, 2019. We randomly selected a statistical sample (as described in the Appendix) of 77 employees who received payments totaling $362,944. Our examination of lump-sum payments made to these 77 employees showed that CDFA overpaid one of them by approximately $45, and underpaid three of them by approximately $2,230. These payments resulted in an exception totaling ($2,185). As we used a statistical sampling method to select the employees whose payments for separation lump-sum pay we examined, we projected the amount of likely overpayments to be $484 and the likely underpayments to be $23,893. These payments resulted in a net total exception of ($23,410). Therefore, the known and likely improper payments totaled a net of approximately $25,594, consisting of $529 in overpayments and $26,123 in underpayments. The following table summarizes the results of our statistical sampling: Known improper payments, net $ (2,185) Divide by: Sample 362,944 Error rate for projection (differences due to rounding) -0.60% Population that was statistically sampled 4,251,704 Multiply by: Error rate for projection -0.60% Known and likely improper payments, net (differences due to rounding) (25,594) Less: Known improper payments, net (2,185) Likely improper payments, net $ (23,410) _____________ Note: Amounts in this table are rounded to the nearest dollar. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Recommendation We recommend that CDFA:  Establish segregation of duties or compensation controls controls to ensure accurate calculation and payment of separation lump-sum pay; Conduct a review of separation lump-sum payments made during the  past three years to ensure that the payments were accurate and in compliance with collective bargaining agreements and state law; and -10- California Department of Food and Agriculture Payroll Audit  Recover overpayments made to separated employees in accordance with GC section 19838 and State Administrative Manual section 8776.6, and properly compensate those employees who were underpaid. FINDING 5— CDFA lacked segregation of duties and compensating controls within its payroll transactions unit, as noted in Finding 1, and lacked adequate Inadequate controls over the processing of regular pay. We identified $89,057 in controls to ensure overpayments and $8,534,041 in questioned payments, consisting of $83 that timesheets are in overpayments and $7,973 in questioned payments based on actual maintained for transactions audited (known); and $88,974 in overpayments and regular pay $8,526,068 in questioned payments based on the results of statistical sampling (likely). If not mitigated, the control deficiencies leave CDFA at risk of making additional improper payments for regular pay. Payroll records show that CDFA processed 60,667 regular pay transactions, totaling $267,892,296, between March 1, 2016, and February 28, 2019. We randomly selected a statistical sample (as described in the Appendix) of 77 transactions, totaling $250,274. Of the 77 transactions, CDFA overpaid one by approximately $83; we questioned an additional four payments with an approximate value of $7,973. As we used a statistical sampling method to select the regular pay transactions examined, we projected the amount of likely overpayments to be $88,974 and likely questioned payments to be $8,526,068. These payments resulted in a net total exception of $8,615,042. Therefore, the known and likely improper payments totaled a net of approximately $8,623,098, consisting of $89,057 in overpayments and $8,534,041 in questioned payments. The following table summarizes the results of our statistical sampling: Known improper and questioned payments, net $ 8,056 Divide by: Sample 250,274 Error rate for projection (differences due to rounding) 3.22% Population that was statistically sampled 267,892,296 Multiply by: Error rate for projection 3.22% Known and likely improper and questioned payments, net (differences due to rounding) 8,623,098 Less: Known improper and questioned payments, net 8,056 Likely improper and questioned payments, net $ 8,615,042 _____________ Note: Amounts in this table are rounded to the nearest dollar. The known improper payment was made because payroll transaction unit staff members inaccurately recorded an authorized absence. The questioned payments resulted from a lack of supporting documentation associated with regular pay. Without the required documentation, there is no record of calculation and approval of payments for regular pay. Therefore, we could not determine the validity, accuracy, and propriety of the payments made to the employees. As a result, we questioned these payments. -11- California Department of Food and Agriculture Payroll Audit GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Recommendation We recommend that CDFA:  Establish adequate internal controls to ensure that payments are accurate and comply with collective bargaining agreements and state laws and policies;  Maintain documentation supporting payments pursuant to retention policies; and  Provide adequate oversight to ensure that payroll transactions unit staff process only valid and authorized payments that comply with collective bargaining agreements and state laws and policies. CDFA lacked segregation of duties and compensating controls within its FINDING 6— payroll transactions unit, as noted in Finding 1, and lacked adequate Inadequate controls over the processing of overtime pay. We identified $346 in controls over overpayments, $38,849 in underpayments, and $20,175 in questioned overtime pay, payments for overtime, consisting of $5 in overpayments, $509 in resulting in underpayments, and $264 in questioned payments based on actual overpayments, transactions audited (known); and $341 in overpayments, $38,341 in underpayments, underpayments, and $19,991 in questioned payments based on the results missing timesheets, of statistical sampling (likely). We also identified two instances of missing and overtime paid supervisor signatures on the timesheet for authorized overtime. If not without proper mitigated, the control deficiencies leave CDFA at risk of making additional improper payments for overtime. pre-authorization Collective bargaining agreements and state laws and policies contain specific clauses regarding the calculation of overtime compensation. Payroll records show that CDFA processed 6,336 overtime pay transactions, totaling $4,574,808, between March 1, 2016 and February 28, 2019. We randomly selected a statistical sample (as described in the Appendix) of 77 transactions, totaling $59,903. In the 77 transactions, we found:  Four instances of overpayments and underpayments (one employee overpaid by $5 and three employees underpaid by a total of $509);  Four questioned payments, totaling $264, without timesheets to substantiate the amounts paid; and  Two instances of missing supervisor signatures for authorized overtime. -12- California Department of Food and Agriculture Payroll Audit The following table summarizes the results of our statistical sampling: Known improper and questioned payments, net $ (240) Divide by: Sample 59,903 Error rate for projection (differences due to rounding) -0.40% Population that was statistically sampled 4,574,808 Multiply by: Error rate for projection -0.40% Known and likely improper and questioned payments, net (differences due to rounding) (18,328) Less: Known improper and questioned payments, net (240) Likely improper and questioned payments, net $ (18,088) _____________ Note: Amounts in this table are rounded to the nearest dollar. The overpayments and underpayments occurred because payroll transaction unit staff members miscalculated overtime hours worked, or inaccurately entered overtime hours worked into the payroll system. The questioned payments resulted from a lack of supporting documentation associated with overtime pay. Without the required documentation, there is no record of calculation and approval of payments for overtime. Therefore, we could not determine the validity, accuracy, and propriety of the payments made to the employees. As a result, we questioned these payments. CDFA also lacked adequate supervisory review to ensure accurate processing of overtime compensation. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Recommendation We recommend that CDFA:  Conduct a review of payments for overtime pay made during the past three years to ensure that the payments complied with collective bargaining agreements and state laws and policies;  Recover overpayments made to employees through an agreed-upon collection method in accordance with GC section 19838;  Establish adequate internal controls to ensure that payments are accurate and comply with collective bargaining agreements and state laws and policies; and  Provide adequate oversight to ensure that payroll transactions unit staff process only valid and authorized payments that comply with collective bargaining agreements and state laws and policies. CDFA’s Response: CDFA believes we have segregated duties to the greatest extent possible. CDFA has corrected the identified underpayments…has initiated accounts receivables for the identified overpayments and will make every effort to collect. The four questioned payments could not be reconciled by the SCO auditors as the timesheets could not be located. CDFA disagrees that missing timesheets suggest questionable payments. -13- California Department of Food and Agriculture Payroll Audit The [Program Specialists] have received one-on-one training from their supervisors and attended SCO’s training specific to processing payroll transactions, including Fundamentals of Payroll, Fundamentals of Personnel, Payroll Input Process, and Lump Sum Training. They are aware [that] they are required to apply state laws, rules, regulations, and MOU provisions in the course of their work. CDFA acknowledges there is a need for additional internal controls and will perform and document regular, random payroll audits of overtime. Additionally, CDFA will make a formal request to its Audit Office to audit the past three years of overtime pay as recommended. SCO Comment Our finding and recommendation remain unchanged. Although CDFA “disagrees that missing timesheets suggest questionable payments,” questionable means that source documentation was unavailable for review during the audit. The terminology does not mean that payments were incorrect, only that source documentation could not be located. The audit finding was derived from the missing timesheets. CDFA lacked segregation of duties and compensating controls within its FINDING 7— payroll transactions unit, as noted in Finding 1, and lacked adequate Inadequate controls over the processing of holiday credit transactions. We identified controls over approximately $2,050 in improper holiday credits. If not mitigated, this holiday credit control deficiency leaves CDFA at risk of granting additional improper transactions holiday credits. GC section 19853 specifies the compensation that an eligible employee is entitled to receive when required to work on a qualifying holiday. Collective bargaining agreements between the State and Bargaining Units 1, 2, 4, 7, 10, 11, 12 include similar provisions regarding holiday compensation for represented employees. We examined all 15 holiday credit transactions that exceeded the maximum allowed, with an estimated value of $4,182, because they involved unusual credits. Of the 15 transactions, nine involved improper credits, with an estimated value of $2,050. As we tested only a targeted selection, there could be additional improper credits. The improper holiday credit transactions occurred because payroll transactions unit staff members granted holiday credits to employees during pay periods with no holidays and improperly calculated holiday credit hours. CDFA also lacked adequate supervisory review to ensure accurate processing of holiday credits. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. -14- California Department of Food and Agriculture Payroll Audit Recommendation We recommend that CDFA:  Conduct a review of holiday credits granted during the past three years to ensure that credits complied with collective bargaining agreements and state law;  Correct any improper holiday credits in the State’s leave accounting system; and  Establish adequate controls to ensure that holiday credits granted are valid and comply with collective bargaining agreements and state law. -15- California Department of Food and Agriculture Payroll Audit Appendix— Audit Sampling Methodology We used attributes sampling for tests of compliance. The sample design was chosen because:  It follows the American Institute of Certified Public Accountants (AICPA) guidelines;  It allows us to achieve our objectives for tests of compliance in an efficient and effective manner; and  Audit areas included high volumes of transactions. The following table outlines our audit sampling application for all audit areas where statistical sampling was utilized: Results Expected Projected to Error Sample Audit Type of Population Population Sampling Sample Selection Confidence Tolerable Intended Finding a b Area Test (Unit) (Dollar) Unit Method Level Error Rate (Rate) Size Population Number Separation lump-sum pay Compliance 7 40 $4,251,704 Employee Computer-generated 90% 5% 1 (1%) 77 Yes 4 simple random Regular pay Compliance 6 0,667 $267,892,296 Transaction Computer-generated 90% 5% 1 (1%) 77 Yes 5 simple random Overtime pay Compliance 6,336 $4,574,808 Transaction Computer-generated 90% 5% 1 (1%) 77 Yes 6 simple random ______________________ a Pursuant to the AICPA’s Audit Guide: Audit Sampling (May 1, 2017 edition), pages 131-133, the expected error is the expected number of errors planned for in the sample. It is derived by multiplying the expected error rate by the sample size. The expected number of errors in the sampling tables on pages 135-136 was rounded upward, e.g., 0.2 errors becomes 1.0 error. b For populations of less than 250 items, we determined the sample size using a calculator that utilizes a hypergeometric distribution. For populations of 250 items and above, we determined the sample size using a calculator that utilizes a binomial distribution. As stated in Technical Notes on the AICPA Audit Guide Audit Sampling (March 1, 2012), page 5, although the hypergeometric distribution is the exactly correct distribution to use for attributes sample sizes, the distribution becomes unwieldy for large populations unless suitable software is available. Therefore, more convenient approximations are frequently used instead. -A1- California Department of Food and Agriculture Payroll Audit Attachment— California Department of Food and Agriculture’s Response to Draft Audit Report State Controller’s Office Division of Audits Post Office Box 942850 Sacramento, CA 94250 http://www.sco.ca.gov S19-PAR-0019