Porterville Developmental Center Payroll Process

PORTERVILLE DEVELOPMENTAL CENTER Audit Report PAYROLL AUDIT March 1, 2016, through February 28, 2019 BETTY T. YEE California State Controller August 2021 BETTY T. YEE California State Controller August 20, 2021 Nancy Bargmann, Director California Department of Developmental Services P.O. Box 944202 Sacramento, CA 94244 Dear Ms. Bargmann: The State Controller’s Office audited the Porterville Developmental Center’s (PDC) payroll process and transactions for the period of March 1, 2016, through February 28, 2019. PDC’s management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. Our audit determined that PDC did not maintain adequate and effective internal controls over its payroll process. PDC lacked adequate segregation of duties and compensating controls over payroll transactions, resulting in improper and questioned separation lump-sum, overtime, leave buy-back, and holiday payments. PDC also granted inappropriate keying access to the State’s payroll system. In addition, PDC did not implement controls to limit the accumulation of vacation and annual leave credits, resulting in liability for excessive balances. PDC also did not maintain adequate and periodic records of salary advances. If you have any questions, please contact Andrew Finlayson, Chief, State Agency Audits Bureau, by telephone at (916) 324-6310, or by email at afinlayson@sco.ca.gov. Sincerely, Original signed by KIMBERLY TARVIN, CPA Chief, Division of Audits KT/ls P.O. Box 942850, Sacramento, CA 94250  (916) 445-2636 3301 C Street, Suite 700, Sacramento, CA 95816  (916) 324-8907 901 Corporate Center Drive, Suite 200, Monterey Park, CA 91754  (323) 981-6802 Nancy Bargmann, Director -2- August 20, 2021 cc: Carla Castañeda, Chief Deputy Director, Operations California Department of Developmental Services Jim Knight, Deputy Director, Administration Division California Department of Developmental Services Angie Mejia, Branch Manager, Human Resources California Department of Developmental Services Dawn Percy, Deputy Director, State-Operated Facilities Division California Department of Developmental Services Gabriela Maleszewski, Executive Director Porterville Developmental Center Shawna Gregg, Administrative Services Director Porterville Developmental Center Brendan Murphy, Chief, Administrative Services Division California Department of Human Resources Jil Barraza, Chief Personnel and Payroll Services Division State Controller’s Office Veronica Encinas, Bureau Chief Personnel and Payroll Services Division State Controller’s Office Grant Boyken, Program Chief Personnel and Payroll Services Division State Controller’s Office Porterville Developmental Center Payroll Audit Contents Audit Report Summary ............................................................................................................................ 1 Background ........................................................................................................................ 1 Audit Authority.................................................................................................................. 1 Objectives, Scope, and Methodology ............................................................................... 2 Conclusion .......................................................................................................................... 3 Follow-up on Prior Audit Findings .................................................................................. 4 Views of Responsible Officials .......................................................................................... 4 Restricted Use .................................................................................................................... 5 Schedule—Summary of Audit Results ................................................................................. 6 Findings and Recommendations ........................................................................................... 7 Appendix—Audit Sampling Methodology ........................................................................... A1 Attachment—California Department of Developmental Services’ Response to Draft Audit Report Porterville Developmental Center Payroll Audit Audit Report Summary The State Controller’s Office (SCO) audited the Porterville Developmental Center’s (PDC) payroll process and transactions for the period of March 1, 2016, through February 28, 2019. PDC management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. We completed our audit fieldwork on March 11, 2021. Our audit determined that PDC:  Did not maintain adequate and effective internal controls over its payroll process. PDC lacked adequate segregation of duties and compensating controls over payroll transactions, resulting in improper and questioned separation lump-sum, overtime, leave buy-back, and holiday payments. We also found that PDC granted inappropriate keying access to the State’s payroll system;  Did not implement controls to limit the accumulation of vacation and annual leave credits, resulting in liability for excessive balances; and  Did not maintain adequate and periodic records of salary advances. Background In 1979, the State of California adopted collective bargaining for state employees. This created a significant workload increase for the SCO’s Personnel and Payroll Services Division (PPSD), as PPSD was the State’s centralized payroll processing center for all payroll related-transactions. PPSD decentralized the processing of payroll, allowing state agencies and departments to process their own payroll-related transactions. Periodic audits of the decentralized payroll processing at state agencies and departments ceased due to the budget constraints in the late 1980s. In 2013, the California State Legislature reinstated these payroll audits to gain assurance that state agencies and departments maintain adequate internal control over the payroll function, provide proper oversight of their decentralized payroll processing, and comply with various state laws and regulations regarding payroll processing and related transactions. Audit Authority Authority for this audit is provided by California Government Code (GC) section 12476, which states: The Controller may audit the uniform state pay roll system, the State Pay Roll Revolving Fund, and related records of state agencies within the uniform state pay roll system, in such manner as the Controller may determine. In addition, GC section 12410 stipulates: The Controller shall superintend the fiscal concerns of the state. The Controller shall audit all claims against the state, and may audit the disbursement of any state money, for correctness, legality, and for sufficient provisions of law for payment. -1- Porterville Developmental Center Payroll Audit Objectives, Scope, We performed this audit to determine whether PDC: and Methodology  Maintained adequate and effective internal controls over its payroll process;  Processed payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures; and  Administered salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. The audit covered the period from March 1, 2016, through February 28, 2019. The audit population consisted of payroll transactions totaling $261,570,563, as quantified in the Schedule. To achieve our audit objectives, we:  Reviewed state and PDC policies and procedures related to the payroll process to understand PDC’s methodology for processing various payroll and payroll-related transactions;  Interviewed the PDC payroll personnel to understand PDC’s methodology for processing various payroll and payroll-related transactions, determine employees’ level of knowledge and ability relating to payroll transaction processing, and gain an understanding of existing internal control over the payroll process and systems;  Selected transactions recorded in the State’s payroll database using statistical sampling, as outlined in the Appendix, and targeted selection based on risk factors and other relevant criteria;  Analyzed and tested the selected transactions and reviewed relevant files and records to determine the accuracy of payroll and payroll- related payments, accuracy of leave transactions, adequacy and effectiveness of internal control over the payroll process, and compliance with collective bargaining agreements and state laws, regulations, policies, and procedures; and  Reviewed salary advances to determine whether PDC administered and recorded them in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. -2- Porterville Developmental Center Payroll Audit Conclusion Our audit determined that PDC:  Did not maintain adequate and effective internal controls over its payroll process.1 We found the following deficiencies in internal control over the payroll process that we consider to be material weaknesses: o Inadequate segregation of duties and a lack of compensating controls over payroll transactions (see Finding 1); o Inappropriate keying access to the State’s payroll system (see Finding 2); o Failure to implement controls to ensure that PDC adhered to the requirements of collective bargaining agreements and state regulations to limit the accumulation of vacation and annual leave credits, resulting in liability for excessive balances (see Finding 3); o Inadequate controls to ensure that separation lump-sum payments were calculated correctly and paid in a timely manner; resulting in improper, questioned and late payments (see Finding 4); o Inadequate controls to ensure that overtime payments were calculated correctly, resulting in improper payments (see Finding 5); o Inadequate controls to ensure that leave buy-back payments were supported with proper documentation, resulting in questioned payments (see Finding 6); o Inadequate controls to ensure that holiday payments were accurate, valid, and authorized, resulting in improper payments (see Finding 7); o Inadequate controls to ensure that salary advance records were maintained adequately and periodically, resulting in deficient records for review and reconciliation (see Finding 8); 1 In planning and performing our audit of compliance, we considered PDC’s internal control over compliance with collective bargaining agreements and state laws, regulations, policies, and procedures to determine the auditing procedures that were appropriate under the circumstances for the purpose of providing a conclusion on compliance, and to test and report on internal control over compliance. Our consideration of internal control over compliance was for the limited purpose described in the first paragraph of this footnote; it was not designed to identify all deficiencies in internal control over compliance that might be material weaknesses or significant deficiencies. As discussed in this section, we identified certain deficiencies in internal control over compliance that we consider to be material weaknesses. A deficiency in internal control over compliance exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance with provisions of laws, regulations, or contracts on a timely basis. Control deficiencies, either individually or in combination with other control deficiencies, may be evaluated as significant deficiencies or material weaknesses. A material weakness in internal control over compliance is a deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected on a timely basis. A significant deficiency over compliance is a deficiency, or a combination of deficiencies, in internal control over compliance with provisions of laws, regulations, or contracts that is less severe than a material weakness, yet important enough to merit attention from those charged with governance. -3- Porterville Developmental Center Payroll Audit  Did not process payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. We found the following instances of noncompliance with the requirements of collective bargaining agreements and state laws, regulations, policies, and procedures: o Excessive vacation and annual leave balances with a value of at least $1,729,379 as of February 28, 2019 (see Finding 3). On October 20, 2020, the California Department of Human Resources directed departments to immediately suspend policies that require leave balances to be reduced below the limit, and that require employees to implement leave-reduction plans. This suspension was in effect until the 2020 Personal Leave Program (2020 PLP) ended on June 30, 2021; o Improper, questioned and late payments for separation lump-sum pay (see Finding 4), improper payments for overtime pay (see Finding 5), questioned payments for leave buy-back (see Finding 6), and improper payments for holiday pay (see Finding 7), costing an estimated net total of $308,432; and  Did not administer salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. PDC did not maintain adequate and periodic records of salary advances. It was not able to provide a list of outstanding salary advances as of February 28, 2019 (see Finding 8). Follow-up on There were no prior payroll audits and, consequently, no prior audit Prior Audit findings. Findings Views of We issued a draft audit report on May 27, 2021. Carla Castañeda, Chief Deputy Director, Operations, California Department of Developmental Responsible Services (DDS) responded by letter dated June 25, 2021. Ms. Castañeda Officials agreed with Findings 1, 2, 3, 4, 5, 7, and 8; and indicated that DDS and PDC have taken steps to correct the noted deficiencies. Ms. Castañeda disagreed with Finding 6, but agreed with the related recommendation and implemented corrective actions. -4- Porterville Developmental Center Payroll Audit Restricted Use This audit report is solely for the information and use of PDC, DDS, the California Department of Human Resources, and the SCO; it is not intended to be and should not be used by anyone other than these specified parties. This restriction is not intended to limit distribution of this audit report, which is a matter of public record and is available on the SCO website at www.sco.ca.gov. Original signed by KIMBERLY TARVIN, CPA Chief, Division of Audits August 20, 2021 -5- Porterville Developmental Center Payroll Audit Schedule— Summary of Audit Results March 1, 2016, through February 28, 2019 Net Total Number of Number of Dollar Amount Dollar Amount Method of Units of Dollar Amount Selections Selection of Selections of Known and Finding Audit Area Tested Selection Population of Population Examined Unit Examined Likely Issues Number Segregation of duties N/A N/A N/A N/A N/A N/A N/A 1 System access Targeted 1 4 N/A 1 4 Employee N/A N/A 2 Regular pay Statistical 4 9,677 $ 230,068,532 7 7 Transaction $ 327,276 $ - Excess vacation Targeted 9 6 1,729,379 9 6 Employee 1,729,379 1,729,379 3 and annual leave Separation lump-sum Statistical 3 95 4,327,783 111 Employee 1,875,020 7 0,157 4 pay and targeted Overtime pay Statistical 1 6,068 21,326,175 1 27 Transaction 218,883 279,830 5 and targeted Leave buy-back Statistical 2 96 6 39,261 7 7 Transaction 168,242 7,045 6 Holiday pay Statistical 6,140 7 30,084 106 Transaction 1 5,333 (48,600) 7 and targeted Medical Office of Day Statistical 3 23 2,349,934 7 7 Transaction 549,893 - pay Salary advance Targeted 2 74 3 99,415 1 5 Transaction 163,249 - 8 $ 261,570,563 $ 5 ,047,275 $ 2 ,037,811 -6- Porterville Developmental Center Payroll Audit Findings and Recommendations FINDING 1— PDC lacked adequate segregation of duties within its payroll transactions unit to ensure that only valid and authorized payroll transactions were Inadequate processed. PDC also failed to implement other controls to compensate for segregation of this risk. duties and lack of compensating GC sections 13400 through 13407 require state agencies to establish and controls over maintain internal controls, including proper segregation of duties and an payroll effective system of internal review. Adequate segregation of duties transactions reduces the likelihood that fraud or error will remain undetected by providing for separate processing by different individuals at various stages of a transaction and for independent reviews of the work performed. Our audit found that PDC payroll transactions unit staff performed conflicting duties. Staff members performed multiple steps in processing payroll transactions, including entering data into the State’s payroll system; auditing employee timesheets; reconciling payroll, including reconciling system output to source documentation; reporting payroll exceptions; and processing adjustments. For example, staff members keyed in regular and overtime pay, and reconciled the master payroll, overtime, and other supplemental warrants. PDC failed to demonstrate that it had implemented compensating controls to mitigate the risks associated with such a deficiency. We found no indication that these functions were subjected to periodic supervisory review. The lack of adequate segregation of duties and compensating controls has a pervasive effect on the PDC payroll process, and impairs the effectiveness of other controls by rendering their design ineffective or by keeping them from operating effectively. These control deficiencies, in combination with other deficiencies discussed in Findings 2 through 8, represent a material weakness in internal control over the payroll process such that there is a reasonable possibility that a material noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. Good internal control practices require that the following functional duties be performed by different work units, or at minimum, by different employees within the same unit:  Recording transactions – This duty refers to the record-keeping function, which is accomplished by entering data into a computer system.  Authorization to execute – This duty belongs to individuals with authority and responsibility to initiate and execute transactions.  Periodic review and reconciliation of actual payments to recorded amounts – This duty refers to making comparisons of information at regular intervals and taking action to resolve differences. -7- Porterville Developmental Center Payroll Audit Recommendation We recommend that PDC:  Separate conflicting payroll function duties to the greatest extent possible. Adequate segregation of duties will provide a stronger system of internal control whereby the functions of each employee are subject to the review of another. If it is not possible to segregate payroll functions fully and appropriately, PDC should implement compensating controls. For example, if the payroll transactions unit staff member responsible for recordkeeping also performs a reconciliation process, then the supervisor should perform and document a detailed review of the reconciliation to provide additional control over the assignment of conflicting functions. Compensating controls may also include dual authorization requirements and documented reviews of payroll system input and output; and  Develop formal procedures for performing and documenting compensating controls. FINDING 2— PDC lacked adequate controls to ensure that only appropriate staff had keying access to the State’s payroll system. PDC inappropriately allowed Inappropriate three employees keying access to the State’s payroll system. If not keying access to the mitigated, this control deficiency leaves payroll data at risk of misuse, State’s payroll abuse, and unauthorized use. system The SCO maintains the State’s payroll system. The system is decentralized, thereby allowing employees of state agencies to access it. PPSD has established a Decentralized Security Program Manual that all state agencies are required to follow in order to access the payroll system. The program’s objectives are to secure and protect the confidentiality and integrity of payroll data against misuse, abuse, and unauthorized use. We examined the records of 14 PDC employees who had keying access to the State’s payroll system at various times between March 2016 and February 2019. Of the 14 employees, three had inappropriate keying access to the State’s payroll system. Specifically, PDC did not immediately remove or modify keying access for three employees after the employees’ separation from state service, transfer to another agency, or change in classification. For example, a Personnel Specialist left PDC on September 23, 2016; PDC did not request to remove the employee’s access until February 6, 2017 (136 days later). PDC failed to follow guidelines set forth in the Decentralized Security Program Manual (revised December 2015). Page 13, Access Requirements, of the Decentralized Security Program Manual states, in part: The PPSD system contains sensitive and confidential information. Access is restricted to persons with an authorized, legal, and legitimate business requirement to complete their duties. . . . -8- Porterville Developmental Center Payroll Audit Currently, PIMS, HIST, KEYM, PIP, LAS, MPC and/or ACAS applications are restricted to Personnel Specialists or Personnel Technician classifications because their need is by definition a function of their specific job duties and any change in those duties requires a reevaluation of the need for access. If the employee’s duties change, such that the need for access no longer exists, the access privilege MUST be removed or deleted immediately by a request submitted by the department/campus. Page 14, Letter of Justification, of the Decentralized Security Program Manual states, in part: A request to grant access to an individual in a classification other than in the Personnel Specialist/Payroll Technician series to access PIMS, HIST, KEYM, PIP, LAS, MPC and/or ACAS requires a written justification from the Authorizing Manager. The justification must describe the individual’s specific job duties requiring the need to access system information (i.e., PIMS = Employment History, HIST = Payroll History, LAS = Leave Accounting System, etc.) as well as level of access to that application, in order to perform their regular daily duties. . . . Page 17, Revocation and Deletion of User IDs, of the Decentralized Security Program Manual states, in part: To prevent unauthorized use by a transferred, terminated or resigned employee’s user ID, the Security Monitor must IMMEDIATELY submit all pages of the PSD125A to delete the user’s system access. Using an old user ID increases the chances of a security breach which is a serious security violation. Sharing a user ID is strictly prohibited and a serious violation. . . . Recommendation We recommend that PDC:  Update keying access to the State’s payroll system immediately after employees leave PDC, transfer to another unit, or change classifications;  Periodically review access to the system to verify that access complies with the Decentralized Security Program Manual. FINDING 3— PDC failed to implement controls to ensure that it adheres to the Inadequate requirements of collective bargaining agreements and state regulations to controls over limit the accumulation of vacation and annual leave credits. This deficiency resulted in liability for excessive leave balances with a value of vacation and at least $1,729,379 as of February 28, 2019. We expect the liability to annual leave increase if PDC does not take action to address the excessive vacation and balances, resulting annual leave balances. in liability for excessive balances Collective bargaining agreements and state regulations limit the amount of vacation and annual leave that most state employees may accumulate to no more than 80 days (640 hours). The limit on leave balances helps state agencies to manage leave balances and control the State’s liability for accrued leave credits. State agencies may allow employees to carry a higher leave balance only under limited circumstances. For example, an employee may not be able to reduce accrued vacation or annual leave -9- Porterville Developmental Center Payroll Audit hours below the limit due to business needs. When an employee’s leave accumulation exceeds or is projected to exceed the limit, state agencies should work with the employee to develop a written plan to reduce leave balances below the applicable limit. Our examination of PDC’s leave accounting records determined that PDC had 1,768 employees with unused vacation or annual leave credits at February 28, 2019. Of the 1,768 employees, 96 exceeded the limit set by collective bargaining agreements and state regulations. For example, one employee had an accumulated balance of 2,629 hours of annual leave, or 1,989 hours beyond the 640-hour limit. Collectively, the 96 employees accumulated 44,981 hours of excess vacation and annual leave, with a value of at least $1,729,379 as of February 28, 2019. This estimated liability does not adjust for salary rate increases and additional leave credits.2 Accordingly, we expect that the amount needed to pay for this liability will be higher. For example, a PDC employee separated from state service with 3,392 hours of leave credits, including 1,617 hours of vacation leave. After adjusting for additional leave credits, the employee was paid for 3,852 hours, or 14% more. We further examined the records of the 96 employees to determine whether PDC complied with collective bargaining agreements and state regulations. We determined that PDC could not demonstrate that it had complied with collective bargaining agreements and state regulations when allowing these employees to maintain excess vacation or annual leave balances. We also found that PDC had no plans in place during the audit period to reduce leave balances below the limit. If PDC does not take action to reduce the excessive leave balances, the liability for accrued vacation and annual leave will likely increase because most employees will receive salary increases or use other non- compensable leave credits instead of vacation or annual leave, thus increasing their vacation or annual leave balances. The state agency responsible for paying these leave balances may face a cash flow problem if a significant number of employees with excessive vacation or annual leave balances separate from state service. Normally, state agencies are not budgeted to make these separation lump-sum payments. However, the State’s current practice dictates that the state agency that last employed an employee pays for that employee’s separation lump-sum payment, regardless of where the employee accrued the leave balance. On October 20, 2020, CalHR directed departments to immediately suspend policies that require leave balances to be reduced below the limit, and that require employees to implement leave-reduction plans. This suspension was in effect until the 2020 PLP ended on June 30, 2021. 2 Most state employees receive pay rate increases every year pursuant to state laws and/or collective bargaining agreements until they reach the top of their pay scale, or promote into a higher-paying position. In addition, when an employee’s accumulated leave balances upon separation are calculated for lump-sum pay, the employee is credited with additional leave credits equal to the amount that the employee would have earned had the employee taken time off and not separated from state service. -10- Porterville Developmental Center Payroll Audit Recommendation We recommend that PDC:  Implement controls, including existing policies and procedures, to ensure that its employees’ vacation and annual leave balances are maintained within levels allowed by collective bargaining agreements and state regulations;  Conduct ongoing monitoring of controls to ensure that they are implemented and operating effectively; and  Participate in leave buy-back programs if the State offers such programs and funds are available. PDC lacked adequate segregation of duties within its payroll transactions FINDING 4— unit, as noted in Finding 1, and lacked adequate controls over the Inadequate processing of employee separation lump-sum pay. We identified a net total controls over of $70,157 in improper and questioned separation lump-sum payments, separation lump- consisting of $17,795 in overpayments, $31,375 in underpayments, and sum pay, resulting $38,085 in questioned payments based on actual transactions examined in improper, (“known”); and $12,182 in overpayments, $76,241 in underpayments, and questioned, and $109,711 in questioned payments based on the results of statistical late payments sampling (“likely”). PDC also did not make separation lump-sum payments to 28 employees in a timely manner. If not mitigated, these control deficiencies leave PDC at risk of making additional improper and late separation lump-sum payments, noncompliance with agreements and laws, and liability for late payments. GC section 19839 allows lump-sum payment for accrued eligible leave credits when an employee separates from state employment. Collective bargaining agreements include similar provisions regarding separation lump-sum pay Payroll records show that PDC processed separation lump-sum payments, totaling $4,327,783, for 395 employees between March 2016 and February 2019, as follows: Separation Lump-Sum Pay Group Unit Amount Employees who were paid at least $100,000 (items examined 100%) 6 $ 1,023,574 Employees who were paid less than $100,000 (statistically sampled) 389 3,304,209 Total population 395 $ 4,327,783 _____________ * Amounts in this table are rounded to the nearest dollar. We examined the payments, totaling $1,023,574, for all six employees who were paid at least $100,000 each in separation lump-sum payments. Of the six employees, two were overpaid by approximately $13,566 and three were underpaid by approximately $4,909. Of the remaining 389 employees who were paid less than $100,000 each in separation lump-sum payments, totaling $3,304,209, we randomly selected a statistical sample (as described in the Appendix) of 105 employees who received separation lump-sum payments, totaling $851,446. Of the 105 employees, five were overpaid by approximately $4,229 and 28 were underpaid by approximately $26,466, for a net total -11- Porterville Developmental Center Payroll Audit underpayment of $22,237. We also questioned separation lump-sum payments, totaling $38,085, made to six employees due to the lack of supporting documentation. Without the required documentation, there is no record of calculation or approval of payments for separation lump-sum pay. Therefore, we could not determine the validity, accuracy, and propriety of the payments made to these employees. These payments resulted in a net total of $15,848 in known improper and questioned payments. As we used a statistical sampling method to select the employees whose separation lump-sum payments were examined, we projected the amount of likely overpayments to be $12,182, likely underpayments to be $76,241, and likely questioned payments to be $109,711. These payments resulted in a net total of $45,652 in likely improper and questioned payments. Therefore, the known and likely net improper and questioned payments totaled approximately $61,500, consisting of $16,411 in overpayments, $102,707 in underpayments, and $147,796 in questioned payments. The following table summarizes the results of our statistical sampling: Known improper and questioned payments, net $ 15,848 Divide by: Sample 851,446 Error rate for projection (differences due to rounding) 1.86% Population that was statistically sampled 3,304,209 Multiply by: Error rate for projection 1.86% Known and likely improper and questioned payments, net (differences due to rounding) 61,500 Less: Known improper and questioned payments, net 15,848 Likely improper and questioned payments, net $ 45,652 _____________ * Amounts in this table are rounded to the nearest dollar. The known improper payments were made because payroll transactions unit staff members miscalculated leave balances paid for separation lump- sum pay. PDC also lacked adequate supervisory review to ensure accurate and timely processing of separation lump-sum pay. Of the 111 employees whose separation lump-sum payments we examined, 28 were not paid in a timely manner, in violation of collective bargaining agreements and state laws summarized in CalHR’s Human Resources Manual, section 1703. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. Recommendation We recommend that PDC:  Establish adequate controls to ensure accurate and timely separation lump-sum payments;  Conduct a review of separation lump-sum payments made during the past three years to ensure that the payments were accurate and in compliance with collective bargaining agreements and state law; -12- Porterville Developmental Center Payroll Audit  Recover overpayments made to separated employees in accordance with GC section 19838 and State Administrative Manual section 8776.6, and properly compensate those employees who were underpaid; and  Maintain supporting documentation for payments pursuant to retention policies. PDC lacked adequate segregation of duties within its payroll transactions FINDING 5— unit, as noted in Finding 1, and lacked adequate controls over the Inadequate processing of overtime pay. We identified a net total of $279,830 in controls over improper overtime payments, consisting of $7,960 in known overtime pay, overpayments and $81 in known underpayments, and $282,050 in likely resulting in overpayments and $10,099 in likely underpayments. If not mitigated, these improper control deficiencies leave PDC at risk of making additional improper payments overtime payments. Collective bargaining agreements, and state laws and policies, contain specific clauses regarding overtime pay. Payroll records show that PDC processed 16,068 overtime pay transactions, totaling $21,326,175, between March 2016 and February 2019, as follows: Overtime Payment Type by Group Unit Amount Work Week Group 2 (statistically sampled) 16,046 $ 21,277,434 Work Week Group E and SE (items examined 100%) 22 48,741 Total population 16,068 $ 21,326,175 _____________ * Amounts in this table are rounded to the nearest dollar. Of the 16,046 overtime pay transactions, totaling $21,277,434, for Work Week Group (WWG) 2 employees, we randomly selected a statistical sample (as described in the Appendix) of 105 transactions, totaling $170,142. Of the 105 transactions, seven were overpaid by approximately $2,273 and two were underpaid by approximately $81. These payments resulted in a net total of $2,192 in known improper payments. As we used a statistical sampling method to select the overtime pay transactions examined, we projected the amount of likely overpayments to be $282,050 and likely underpayments to be $10,099. These payments resulted in a net total of $271,951 in likely improper payments. Therefore, the known and likely improper payments totaled a net of approximately $274,143, consisting of $284,323 in overpayments and $10,180 in underpayments. -13- Porterville Developmental Center Payroll Audit The following table summarizes the results of our statistical sampling: Known improper payments, net $ 2,192 Divide by: Sample 170,142 Error rate for projection (differences due to rounding) 1.29% Population that was statistically sampled 21,277,434 Multiply by: Error rate for projection 1.29% Known and likely improper payments, net (differences due to rounding) 274,143 Less: Known improper payments, net 2,192 Likely improper payments, net $ 271,951 _____________ * Amounts in this table are rounded to the nearest dollar. We also examined all 22 overtime pay transactions, totaling $48,741, for WWG E and WWG SE employees who normally do not receive overtime pay unless they perform Medical Officer of the Day or on-call duties. Of the 22 payments, five were overpaid by approximately $5,687. The known improper payments were made because payroll transactions unit staff members miscalculated overtime hours worked and paid for overtime hours worked at the straight-time rate instead of the time-and-a- half rate, or vice-versa. Furthermore, PDC lacked adequate supervisory review to ensure accurate processing of overtime pay. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Recommendation We recommend that PDC:  Conduct a review of overtime payments made during the past three years to ensure that the payments complied with collective bargaining agreements and state laws and policies; and  Recover overpayments made to employees through an agreed-upon collection method in accordance with GC section 19838, and properly compensate those employees who were underpaid. We further recommend that, to prevent improper overtime payments from recurring, PDC:  Establish adequate internal controls to ensure that payments are accurate and comply with collective bargaining agreements and state laws and policies; and  Provide adequate oversight to ensure that payroll transactions unit staff process only valid and authorized payments that comply with collective bargaining agreements and state laws and policies. -14- Porterville Developmental Center Payroll Audit FINDING 6— PDC lacked adequate segregation of duties within its payroll transactions Inadequate unit, as noted in Finding 1, and lacked adequate controls over the processing of leave buy-back. We identified a total of $7,045 in questioned controls over leave leave buy-back payments, consisting of $1,854 in known questioned buy-back, resulting payments and $5,191 in likely questioned payments. If not mitigated, these in questioned control deficiencies leave PDC at risk of making improper leave buy-back payments payments. A leave-buy back occurs when an employee receives payment at the regular salary rate in exchange for accrued vacation, annual leave, personal leave, personal holiday, and/or holiday credits. Collective bargaining agreements between the State and Bargaining Units allow for the annual cash-out of a certain number of hours of accumulated vacation and annual leave if funds are available. Title 2, California Code of Regulations, section 599.744 also provides that CalHR may authorize a leave buy-back program for employees excluded from collective bargaining. CalHR authorized leave buy-backs for excluded employees in fiscal year (FY) 2015-16, FY 2016-17, and FY 2017-18. It also provided the State’s policies and procedures regarding cash-out of vacation and annual leave. Payroll records show that PDC processed 296 leave buy-back transactions, totaling $639,261, between March 2016 and February 2019. Of the 296 leave buy-back transactions, we randomly selected a statistical sample (as described in the Appendix) of 77 transactions, totaling $168,242. Of the 77 transactions, we questioned two, totaling $1,854, due to the lack of supporting documentation. Without the required documentation, there is no record of calculation or approval of leave buy-back payments. Therefore, we could not determine the validity, accuracy, and propriety of the payments made to the employees. As we used a statistical sampling method to select the leave buy-back transactions examined, we projected the amount of likely questioned payments to be $5,191. Therefore, the known and likely questioned payments totaled approximately $7,045. The following table summarizes the results of our statistical sampling: Known questioned payments $ 1,854 Divide by: Sample 168,242 Error rate for projection (differences due to rounding) 1.10% Population that was statistically sampled 639,261 Multiply by: Error rate for projection 1.10% Known and likely questioned payments (differences due to rounding) 7,045 Less: Known questioned payments 1,854 Likely questioned payments $ 5,191 _____________ * Amounts in this table are rounded to the nearest dollar. -15- Porterville Developmental Center Payroll Audit GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Recommendation We recommend that PDC maintain supporting documentation for payments pursuant to retention policies. DDS’s Response DDS concurs with the recommendation that PDC maintain supporting documentation for payments pursuant to retention policies. However, we don’t agree that 2 out of 77 sampled documents that lacked supporting documentation result in known questioned payments considering that the 75 out of 77 payments that were reviewed were found to be accurate payments. In response to the finding, DDS has implemented the following corrective actions:  DDS Personnel Supervisor II will provide training to the Senior Personnel Specialist and all Personnel Specialists on the appropriate maintenance and retention of payroll supporting documents including leave buy-back supporting documents.  PDC will utilize the established Document Management System (DMS) to scan and electronically store records for future access.  DDS HQ will require all leave buy back participants to be tracked and submitted to HQ on an annual basis. SCO Comment Our finding remains unchanged. We appreciate that DDS concurred with the recommendation and implemented corrective actions. However, DDS disagrees that the two unsupported transactions could result in known questioned payments “considering that the 75 out of 77 payments that were reviewed were found to be accurate payments.” As we could not verify the accuracy of DDS’s assumption due to the lack of supporting documentation, the two transactions remain as questioned payments. FINDING 7— PDC lacked adequate segregation of duties within its payroll transactions Inadequate unit, as noted in Finding 1, and lacked adequate controls over the processing of holiday pay transactions. We identified a net total of $48,600 controls over in underpayments for holiday pay, consisting of $3,418 in known holiday pay, overpayments and $934 in known underpayments, and $4,584 in likely resulting in overpayments and $55,668 in likely underpayments. If not mitigated, these improper control deficiencies leave PDC at risk of making additional improper payments holiday payments. GC section 19853 specifies the compensation that an eligible employee is entitled to receive when required to work on a qualifying holiday. Collective bargaining agreements between the State and Bargaining Units include similar provisions regarding holiday pay. -16- Porterville Developmental Center Payroll Audit Payroll records show that PDC processed 6,140 holiday pay transactions, totaling $730,084 between March 2016 and February 2019, as follows: Holiday Payment Type by Group Unit Amount Paid for 24 hours or less (statistically sampled) 6,139 $ 726,743 Paid for more than 24 hours (items examined 100%) 1 3,341 Total population 6,140 $ 730,084 _____________ * Amounts in this table are rounded to the nearest dollar. We examined one holiday pay transaction, totaling $3,341, because the number of hours paid for was higher than the number of holiday hours that could be granted to an employee in any given month. Our examination determined that PDC improperly bought back 112 hours of holiday credits from an employee who transferred to another state agency, without authorization from CalHR. However, the employee’s holiday credit balance was correctly adjusted during the audit period to reflect the number of leave credits that were bought back. Of the remaining 6,139 holiday pay transactions, totaling $726,743, we randomly selected a statistical sample (as described in the Appendix) of 105 transactions, totaling $11,992. Of the 105 transactions, one was overpaid by $77 and four were underpaid $934. These payments resulted in a net total of $857 in known underpayments. As we used a statistical sampling method to select the holiday pay transactions examined, we projected the amount of likely overpayments to be $4,584 and likely underpayments to be $55,668. These payments resulted in a net total of $51,084 in likely underpayments. Therefore, the known and likely underpayments totaled a net of approximately $51,941, consisting of $4,661 in overpayments and $56,602 in underpayments. The following table summarizes the results of our statistical sampling: Known underpayments, net $ 857 Divide by: Sample 11,992 Error rate for projection (differences due to rounding) 7.15% Population that was statistically sampled 726,743 Multiply by: Error rate for projection 7.15% Known and likely underpayments, net (differences due to rounding) 51,941 Less: Known underpayments, net 857 Likely underpayments, net $ 51,084 _____________ * Amounts in this table are rounded to the nearest dollar. The known improper payments occurred because payroll transactions unit staff members granted an incorrect number of holiday hours and paid for holiday hours at the time-and-a-half rate instead of the straight-time rate. PDC also lacked adequate supervisory review to ensure that processing of holiday pay is accurate, and complies with collective bargaining agreements and state laws and policy. -17- Porterville Developmental Center Payroll Audit GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Recommendation We recommend that PDC:  Conduct a review of holiday payments made during the past three years to ensure that payments complied with collective bargaining agreements and state law;  Recover overpayments made to employees through an agreed-upon collection method in accordance with GC section 19838, and properly compensate those employees who were underpaid. We further recommend that, to prevent improper holiday pay, PDC:  Establish adequate controls to ensure that holiday payments are accurate, valid, and comply with collective bargaining agreements and state laws and policies.  Provide adequate oversight to ensure that payroll transactions unit staff process only authorized holiday pay transactions; and  Provide training to payroll transactions unit staff involved in keying transactions to ensure that they understand the requirements under collective bargaining agreements and state law regarding holiday pay. FINDING 8— PDC lacked adequate segregation of duties within its payroll transactions Inadequate unit, as noted in Finding 1, and lacked adequate controls to ensure that salary advance records were maintained adequately and timely. If not controls over mitigated, these control deficiencies leave PDC at risk of failing to collect salary advances, future salary advances. resulting in failure to maintain Our audit found the following deficiencies: adequate records  PDC did not maintain a record of salary advance issued or collected. Instead, PDC mailed the salary advance documents to DDS headquarters for recording in the financial information system. Our examination indicated that in some instances a month passed before PDC mailed the documents to DDS headquarters.  PDC and DDS headquarters were not able to provide a list of outstanding salary advances as of February 28, 2019, or as of any given time during the audit period. This was because DDC headquarters recorded salary advances only after receiving the supporting documentation from PDC. State Administrative Manual section 8776 requires monthly review and reconciliation of salary advances. For our audit purposes, we used the DDS headquarters’ list of salary advances issued, totaling $339,415, between July 2018 and February 2019, as an alternative. The list lacked the necessary information, including issuance dates or age of salary advances. We examined the 15 largest salary advances, totaling $163,249, and found that they had been properly issued and collected. -18- Porterville Developmental Center Payroll Audit The lack of adequate records, such as monthly reports, for salary advances prevents the PDC from performing adequate review and reconciliation of salary advances. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Recommendation We recommend that PDC:  Coordinate with DDS headquarters;  Ensure that it maintains adequate records of salary advances; and  Conduct monthly review and reconciliation of salary advances. -19- Porterville Developmental Center Payroll Audit Appendix— Audit Sampling Methodology We used attributes sampling for tests of compliance. The sample design was chosen because:  It follows the American Institute of Certified Public Accountants (AICPA) guidelines;  It allows us to achieve our objectives for tests of compliance in an efficient and effective manner; and  Audit areas included high volumes of transactions. The following table outlines our audit sampling application for all audit areas where statistical sampling was utilized: Results Sample Tolerable Expected Projected to Audit Type Population Population Sampling Selection Confidence Error Error Sample Intended Finding Area of Test (Unit) (Dollar) Unit Method Level Rate (Rate) ᵃ Size ᵇ Population Number Regular pay Compliance 4 9,677 $ 230,068,532 Transaction Computer-generated 90% 5% 1 (1.25%) 77 Yes simple random Separation Compliance 3 89 3,304,209 Employee Computer-generated 90% 5% 2 (1.75%) 105 Yes 4 lump-sum pay simple random Overtime pay Compliance 1 6,046 2 1,277,434 Transaction Computer-generated 90% 5% 2 (1.75%) 105 Yes 5 simple random Leave buy-back Compliance 2 96 6 39,261 Transaction Computer-generated 90% 5% 1 (1.25%) 77 Yes 6 simple random Holiday pay Compliance 6,139 7 26,743 Transaction Computer-generated 90% 5% 2 (1.75%) 105 Yes 7 simple random Medical Office Compliance 323 2,349,934 Transaction Computer-generated 90% 5% 1 (1.25%) 77 Yes of Day pay simple random ᵃ Pursuant to the AICPA’s Audit Guide: Audit Sampling (May 1, 2017 edition), pages 131-133, the expected error is the expected number of errors planned for in the sample. It is derived by multiplying the expected error rate by the sample size. The expected number of errors in the sampling tables on pages 135-136 was rounded upward, e.g., 0.2 errors becomes 1.0 error. ᵇ For populations of fewer than 250 items, we determined the sample size using a calculator that uses a hypergeometric distribution. For populations of 250 items or more, we determined the sample size using a calculator that uses a binomial distribution. As stated in Technical Notes on the AICPA Audit Guide: Audit Sampling (March 1, 2012), page 5, although the hypergeometric distribution is the exactly correct distribution to use for attributes sample sizes, the distribution becomes unwieldy for large populations unless suitable software is available. Therefore, more convenient approximations are frequently used instead. -A1- Porterville Developmental Center Payroll Audit Attachment— California Department of Developmental Services’ Response to Draft Audit Report State Controller’s Office Division of Audits Post Office Box 942850 Sacramento, CA 94250 http://www.sco.ca.gov S20-PAR-0002