California Health Care Facility - Psychiatric Inpatient Program Payroll Process

CALIFORNIA HEALTH CARE FACILITY – PSYCHIATRIC INPATIENT PROGRAM Audit Report PAYROLL AUDIT March 1, 2017, through February 29, 2020 BETTY T. YEE California State Controller March 2022 BETTY T. YEE California State Controller March 4, 2022 Lara Saich, Director Health Care Policy and Administration California Correctional Health Care Services P.O. Box 588500 Elk Grove, CA 95758 Dear Ms. Saich: The State Controller’s Office audited the California Health Care Facility – Psychiatric Inpatient Program’s (CHCF-PIP) payroll process and transactions for the period of March 1, 2017, through February 29, 2020. CHCF-PIP management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. Our audit determined that CHCF-PIP did not maintain adequate and effective internal controls over its payroll process. CHCF-PIP lacked adequate segregation of duties and compensating controls over payroll transactions, resulting in improper overtime and separation lump-sum payments, and improper holiday credits. CHCF-PIP also granted inappropriate keying access to the State’s payroll system. In addition, CHCF-PIP did not implement controls to limit the accumulation of vacation and annual leave credits, resulting in liability for excessive balances. CHCF-PIP also did not promptly collect salary advances from its employees. If you have any questions, please contact Andrew Finlayson, Chief, State Agency Audits Bureau, by telephone at (916) 324-6310, or by email at afinlayson@sco.ca.gov. Sincerely, Original signed by KIMBERLY TARVIN, CPA Chief, Division of Audits KT/as Lara Saich, Director -2- March 4, 2022 cc: Cynthia Krohn-Fisher, Human Resources Director California Health Care Facility–Psychiatric Impatient Program Kathleen Allison, Secretary California Department of Corrections and Rehabilitation Jasinda Muhammad, Deputy Director, Human Resources California Correctional Health Care Services Laura L. Harvick, Assistant Deputy Director Field Operations and Activation Support, Human Resources California Correctional Health Care Services Jenny Ruth, Regional Personnel Administrator California Correctional Health Care Services Brendan Murphy, Chief Administrative Services Division California Department of Human Resources Jil Barraza, Chief Personnel and Payroll Services Division State Controller’s Office Veronica Encinas, Bureau Chief Personnel and Payroll Services Division State Controller’s Office Grant Boyken, Program Chief Personnel and Payroll Services Division State Controller’s Office California Health Care Facility – Psychiatric Inpatient Program Payroll Audit Contents Audit Report Summary ............................................................................................................................ 1 Background ........................................................................................................................ 1 Audit Authority.................................................................................................................. 1 Objectives, Scope, and Methodology ............................................................................... 2 Conclusion .......................................................................................................................... 3 Follow-up on Prior Audit Findings .................................................................................. 4 Views of Responsible Officials .......................................................................................... 4 Restricted Use .................................................................................................................... 4 Schedule—Summary of Audit Results ................................................................................. 5 Findings and Recommendations ........................................................................................... 6 Appendix—Audit Sampling Methodology Attachment—California Correctional Health Care Services’ Response to Draft Audit Report California Health Care Facility – Psychiatric Inpatient Program Payroll Audit Audit Report The State Controller’s Office (SCO) audited the California Health Care Summary Facility – Psychiatric Impatient Program’s (CHCF-PIP) payroll process and transactions for the period of March 1, 2017, through February 29, 2020. CHCF-PIP management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. We completed our audit fieldwork on June 22, 2021. Our audit determined that CHCF-PIP did not:  Maintain adequate and effective internal controls over its payroll process. CHCF-PIP lacked adequate segregation of duties and compensating controls over payroll transactions, resulting in improper overtime and separation lump-sum payments and improper holiday credits. CHCF-PIP also granted inappropriate keying access to the State’s payroll system;  Implement controls to limit the accumulation of vacation and annual leave credits, resulting in liability for excessive balances; and  Promptly collect salary advances from its employees. In 1979, the State of California adopted collective bargaining for state Background employees. This created a significant workload increase for the SCO’s Personnel and Payroll Services Division (PPSD), as PPSD was the State’s centralized payroll processing center for all payroll related-transactions. PPSD decentralized the processing of payroll, allowing state agencies and departments to process their own payroll-related transactions. Periodic audits of the decentralized payroll processing at state agencies and departments ceased due to the budget constraints in the late 1980s. In 2013, the California State Legislature reinstated these payroll audits to gain assurance that state agencies and departments maintain adequate internal control over the payroll function, provide proper oversight of their decentralized payroll processing, and comply with various state laws and regulations regarding payroll processing and related transactions. Authority for this audit is provided by California Government Code (GC) Audit Authority section 12476, which states: The Controller may audit the uniform state pay roll system, the State Pay Roll Revolving Fund, and related records of state agencies within the uniform state pay roll system, in such manner as the Controller may determine. In addition, GC section 12410 stipulates that: The Controller shall superintend the fiscal concerns of the state. The Controller shall audit all claims against the state, and may audit the disbursement of any state money, for correctness, legality, and for sufficient provisions of law for payment. -1- California Health Care Facility – Psychiatric Inpatient Program Payroll Audit Objectives, Scope, We performed this audit to determine whether CHCF-PIP: and Methodology  Maintained adequate and effective internal controls over its payroll process;  Processed payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures; and  Administered salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. The audit covered the period from March 1, 2017, through February 29, 2020. The audit population consisted of payroll transactions totaling $246,519,928, as quantified in the Schedule. To achieve our audit objectives, we:  Reviewed state and CHCF-PIP policies and procedures related to the payroll process to understand CHCF-PIP’s methodology for processing various payroll and payroll-related transactions;  Interviewed the CHCF-PIP payroll personnel to understand CHCF-PIP’s methodology for processing various payroll and payroll- related transactions, determine the employees’ level of knowledge and ability relating to payroll transaction processing, and gain an understanding of existing internal control over the payroll process and systems;  Selected transactions recorded in the State’s payroll database using statistical sampling, as outlined in the Appendix, and targeted selection based on risk factors and other relevant criteria;  Analyzed and tested the selected transactions and reviewed relevant files and records to determine the accuracy of payroll and payroll- related payments, accuracy of leave transactions, adequacy and effectiveness of internal control over the payroll process, and compliance with collective bargaining agreements and state laws, regulations, policies, and procedures; and  Reviewed salary advances to determine whether CHCF-PIP administered and recorded them in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. -2- California Health Care Facility – Psychiatric Inpatient Program Payroll Audit Conclusion Our audit determined that CHCF-PIP:  Did not maintain adequate and effective internal controls over its payroll process.1 We found the following deficiencies in internal control over the payroll process that we consider to be material weaknesses: o Inadequate segregation of duties and a lack of compensating controls over payroll transactions (see Finding 1); o Inappropriate keying access to the State’s payroll system (see Finding 2); o Failure to implement controls to ensure that CHCF-PIP adhered to the requirements of collective bargaining agreements and state regulations to limit the accumulation of vacation and annual leave credits, resulting in liability for excessive balances (see Finding 3); o Inadequate controls to ensure that overtime payments were calculated correctly, resulting in improper payments (see Finding 4); o Inadequate controls to ensure that separation lump-sum payments were calculated correctly and paid in a timely manner, resulting in improper and late payments (see Finding 5); o Inadequate controls to ensure that holiday credits were granted to eligible employees, resulting in improper credits (see Finding 6); o Inadequate controls to ensure that salary advances were collected in a timely manner, resulting in failure to recover outstanding amounts (see Finding 7);  Did not process payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. We found the following instances of noncompliance with the requirements 1 In planning and performing our audit of compliance, we considered CHCF-PIP’s internal control over compliance with collective bargaining agreements and state laws, regulations, policies, and procedures to determine the auditing procedures that were appropriate under the circumstances for the purpose of providing a conclusion on compliance, and to test and report on internal control over compliance. Our consideration of internal control over compliance was for the limited purpose described in the first paragraph of this footnote; it was not designed to identify all deficiencies in internal control over compliance that might be material weaknesses or significant deficiencies. As discussed in this section, we identified certain deficiencies in internal control over compliance that we consider to be material weaknesses. A deficiency in internal control over compliance exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance with provisions of laws, regulations, or contracts on a timely basis. Control deficiencies, either individually or in combination with other control deficiencies, may be evaluated as significant deficiencies or material weaknesses. A material weakness in internal control over compliance is a deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected on a timely basis. A significant deficiency over compliance is a deficiency, or a combination of deficiencies, in internal control over compliance with provisions of laws, regulations, or contracts that is less severe than a material weakness, yet important enough to merit attention from those charged with governance. -3- California Health Care Facility – Psychiatric Inpatient Program Payroll Audit of collective bargaining agreements and state laws, regulations, policies, and procedures: o Excessive vacation and annual leave balances with a value of at least $230,241 as of February 29, 2020 (see Finding 3). On October 20, 2020, the California Department of Human Resources (CalHR) directed departments to immediately suspend policies that require leave balances to be reduced below the limit, and that require employees to implement leave-reduction plans. This suspension was in effect until the 2020 Personal Leave Program ended on June 30, 2021; o Improper payments made for overtime pay (see Finding 4), improper and late payments made for separation lump-sum pay (see Finding 5) and improper holiday credits (see Finding 6), resulting in an estimated net total underpayments of $230,667; and  Did not administer salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. Nineteen salary advances, totaling $22,956, remained outstanding as of February 29, 2020, as a result of CHCF-PIP’s noncompliance with the State’s collection policies and procedures (see Finding 7). Follow-up on There were no prior payroll audits of CHCF-PIP and, consequently, no prior audit findings. Prior Audit Findings Views of We issued a draft audit report on August 3, 2021. Lara Saich, Director, Health Care Policy and Administration, California Correctional Health Responsible Care Services (CCHCS), responded by letter dated August 13, 2021, Officials (Attachment). Ms. Saich acknowledged the audit results, and indicated that CCHCS and CHCF-PIP have taken steps to correct the noted deficiencies. We included our comments to Ms. Saich’s responses to Findings 1 and 7 in the Findings and Recommendations section. Restricted Use This audit report is solely for the information and use of CHCF-PIP, CCHCS, California Department of Corrections and Rehabilitation, and the SCO; it is not intended to be and should not be used by anyone other than these specified parties. This restriction is not intended to limit distribution of this audit report, which is a matter of public record and is available on the SCO website at www.sco.ca.gov. Original signed by KIMBERLY TARVIN, CPA Chief, Division of Audits March 4, 2022 -4- California Health Care Facility—Psychiatric Inpatient Program Payroll Audit Schedule— Summary of Audit Results March 1, 2017, through February 29, 2020 Net Total Number of Number of Dollar Amount Dollar Amount Method of Units of Dollar Amount Selections Selection of Selections of Known and Finding Audit Area Tested Selection Population of Population Examined Unit Examined Likely Issues Number Segregation of duties N/A N/A N/A N/A N/A N/A N/A 1 System access Targeted 4 9 N/A 4 9 Employee N/A N/A 2 Regular pay Statistical 3 0,294 $ 195,197,572 1 05 Transaction $ 783,917 $ - Excess vacation and Targeted 2 0 2,063,602 2 0 Employee 230,241 230,241 3 annual leave Overtime pay Statistical 1 7,489 44,865,261 1 05 Transaction 284,392 ( 231,950) 4 Separation lump-sum pay Statistical 1 56 1,520,909 6 3 Employee 543,550 ( 651) 5 Holiday credit Targeted 63,308 2,849,628 5 Transaction 1,934 1,934 6 Salary advance Targeted 19 22,956 1 9 Transaction 2 2,956 2 2,956 7 $ 246,519,928 $ 1 ,866,990 $ 22,530 -5- California Health Care Facility—Psychiatric Inpatient Program Payroll Audit Findings and Recommendations FINDING 1— CHCF-PIP lacked adequate segregation of duties within its payroll transactions unit to ensure that only valid and authorized payroll transactions were Inadequate processed. CHCF-PIP also failed to implement other controls to compensate for segregation of this risk. duties and lack of compensating GC sections 13400 through 13407 require state agencies to establish and controls over maintain internal controls, including proper segregation of duties and an payroll effective system of internal review. Adequate segregation of duties reduces the transactions likelihood that fraud or error will remain undetected by providing for separate processing by different individuals at various stages of a transaction and for independent reviews of the work performed. Our audit found that CHCF-PIP payroll transactions unit staff performed conflicting duties. Staff members performed multiple steps in processing payroll transactions, including entering data into the State’s payroll system; auditing employee timesheets; reconciling payroll, including reconciling system output to source documentation; reporting payroll exceptions; and processing adjustments. For example, staff members keyed in regular and overtime pay, and reconciled the master payroll, overtime, and other supplemental warrants. CHCF-PIP failed to demonstrate that it had implemented compensating controls to mitigate the risks associated with such a deficiency. We found no indication that these functions were subjected to periodic supervisory review. The lack of adequate segregation of duties and compensating controls has a pervasive effect on the CHCF-PIP payroll process, and impairs the effectiveness of other controls by rendering their design ineffective or by keeping them from operating effectively. These control deficiencies, in combination with other deficiencies discussed in Findings 2 through 7, represent a material weakness in internal control over the payroll process such that there is a reasonable possibility that a material noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. Good internal control practices require that the following functional duties be performed by different work units, or at minimum, by different employees within the same unit:  Recording transactions – This duty refers to the record-keeping function, which is accomplished by entering data into a computer system.  Authorization to execute – This duty belongs to individuals with authority and responsibility to initiate and execute transactions.  Periodic review and reconciliation of actual payments to recorded amounts – This duty refers to making comparisons of information at regular intervals and taking action to resolve differences. -6- California Health Care Facility—Psychiatric Inpatient Program Payroll Audit Recommendation We recommend that CHCF-PIP:  Separate conflicting payroll function duties to the greatest extent possible. Adequate segregation of duties will provide a stronger system of internal control whereby the functions of each employee are subject to the review of another.  If it is not possible to segregate payroll functions fully and appropriately, CHCF-PIP should implement compensating controls. For example, if the payroll transactions unit staff member responsible for recordkeeping also performs a reconciliation process, then the supervisor should perform and document a detailed review of the reconciliation to provide additional control over the assignment of conflicting functions. Compensating controls may also include dual authorization requirements and documented reviews of payroll system input and output; and  Develop formal procedures for performing and documenting compensating controls. CCHCS’s Response The Personnel Specialist (PS) duties and responsibilities consist of processing various personnel/payroll transactions, which includes data entry, reconciliation, and processing adjustments and corrections. Since training can take up to 18 months, newer PSs are under the close supervision of the Personnel Supervisor I and their work is consistently reviewed. On a monthly basis, the Personnel Supervisor I reviews each PS’ Time and Attendance Report Form 672, Employee Time Certification Form 966, Payroll Exceptions Report Form 666 and Absences Without Pay Report Form 603, as audit tools to ensure accurate reconciliation of payroll records. Further, CHCF‐PIP has implemented quarterly reviews of various transactions. With the implementation of the Business Information System (BIS) and Telestaff programs in April 2018, controls are in place ensuring that Timekeeper duties do not overlap with the Personnel transactions staff who key into the payroll system. SCO Comment Our finding remains unchanged. We appreciate that CCHCS implemented corrective actions. CCHCS’s response also states that controls are in place to ensure that timekeeper duties do not overlap with payroll transactions unit staff. These controls, if operating effectively, will ensure that employees record accurate information on their timesheets. However, these controls do not mitigate the risk that errors could occur when the same payroll transactions unit staff member enters data into the system, reconciles payroll, and processes adjustments. FINDING 2— CHCF-PIP lacked adequate controls to ensure that only appropriate staff members had keying access to the State’s payroll system. CHCF-PIP Inappropriate inappropriately allowed 13 employees keying access to the State’s payroll keying access to the system. If not mitigated, this control deficiency leaves payroll data at risk of State’s payroll misuse, abuse, and unauthorized use. system -7- California Health Care Facility—Psychiatric Inpatient Program Payroll Audit The SCO maintains the State’s payroll system. The system is decentralized, thereby allowing employees of state agencies to access it. PPSD has established a Decentralized Security Program Manual that all state agencies are required to follow in order to access the payroll system. The program’s objectives are to secure and protect the confidentiality and integrity of payroll data against misuse, abuse, and unauthorized use. We examined the records of 49 CHCF-PIP employees who had keying access to the State’s payroll system at various times between March 2017, and February 2020. Of the 49 employees, 13 had inappropriate keying access to the State’s payroll system. Specifically, CHCF-PIP did not immediately remove or modify keying access for the employees after the employees’ separation from state service, transfer to another agency, or change in classification. For example, a Personnel Specialist left CHCF-PIP on September 30, 2018; however, CHCF-PIP did not request to remove the employee’s access until March 6, 2019, 157 days later. In addition, CHCF-PIP could not provide adequate supporting documentation for two of the 49 employees; therefore, we could not determine whether keying access were removed timely. The Decentralized Security Program Manual states, in part: The PPSD system contains sensitive and confidential information. Access is restricted to persons with an authorized, legal, and legitimate business requirement to complete their duties. . . . Currently, PIMS, HIST, KEYM, PIP, LAS, MPC and/or ACAS applications are restricted to Personnel Specialists or Personnel Technician classifications because their need is by definition a function of their specific job duties and any change in those duties requires a reevaluation of the need for access. If the employee’s duties change, such that the need for access no longer exists, the access privilege MUST be removed or deleted immediately by a request submitted by the department/campus. A request to grant access to an individual in a classification other than in the Personnel Specialist/Payroll Technician series to access PIMS, HIST, KEYM, PIP, LAS, MPC and/or ACAS requires a written justification from the Authorizing Manager. The justification must describe the individual'’s specific job duties requiring the need to access system information (i.e., PIMS=Employment History, HIST=Payroll History, LAS=Leave Accounting System, etc.) as well as level of access to that application, in order to perform their regular daily duties. To prevent unauthorized use by a transferred, terminated, or resigned employee's user ID, the Security Monitor must IMMEDIATELY submit all pages of the PSD125A to delete the user’s system access. Using an old user ID increases the chances of a security breach which is a serious security violation. Sharing a user ID is strictly prohibited and a serious violation. Recommendation We recommend that CHCF-PIP:  Update keying access to the State’s payroll system immediately after employees leave CHCF-PIP, transfer to another unit, or change classifications; and  Periodically review access to the system to verify that access complies with the Decentralized Security Program Manual. -8- California Health Care Facility—Psychiatric Inpatient Program Payroll Audit CCHCS’s Response SCO identified several employees with keying access not immediately removed after their separation, transfer, or change in classification. Since the review, CHCF‐PIP has added an assistant and alternate security monitor as backups to ensure prompt notification of any changes that occur. Agencies now have the ability to email the Decentralized Security Administrator (DSA) any notifications to remove users and submit required documents via secured email, which vastly improves efficiency. To ensure compliance with the standards and procedures set forth, CHCF‐PIP has developed a process by which a listing of authorized users is validated weekly. In addition, the Personnel Supervisor I and/or manager conducts periodic reviews to ensure compliance. FINDING 3— CHCF-PIP failed to implement controls to ensure that it adheres to the requirements of collective bargaining agreements and state regulations to limit Inadequate the accumulation of vacation and annual leave credits. This deficiency resulted controls over in liability for excessive leave balances with a value of at least $230,241 as of vacation and February 29, 2020. We expect the liability to increase if CHCF-PIP does not annual leave take action to address the excessive vacation and annual leave balances. balances, resulting in liability for Collective bargaining agreements and state regulations limit the amount of excessive balances vacation and annual leave that most state employees may accumulate to no more than 80 days (640 hours). The limit on leave balances helps state agencies to manage leave balances and control the State’s liability for accrued leave credits. State agencies may allow employees to carry a higher leave balance only under limited circumstances. For example, an employee may not be able to reduce accrued vacation or annual leave hours below the limit due to business needs. When an employee’s leave accumulation exceeds or is projected to exceed the limit, state agencies should work with the employee to develop a written plan to reduce leave balances below the applicable limit. Our examination of CHCF-PIP’s leave accounting records determined that CHCF-PIP had 684 employees with unused vacation or annual leave credits at February 29, 2020. Of the 684 employees, 20 exceeded the limit set by collective bargaining agreements and state regulations. For example, one employee had an accumulated balance of 1,348 hours of annual leave, or 708 hours beyond the 640-hour limit. Collectively, the 20 employees accumulated 2,939 hours of excess vacation and annual leave, with a value of at least $230,241 as of February 29, 2020. This estimated liability does not adjust for salary rate increases and additional leave credits.2 Accordingly, we expect that the amount needed to pay for this liability will be higher. For example, a CHCF-PIP employee separated from state service with 1,506 hours in annual leave. After adjusting for additional leave credits, the employee was paid for 1,786 hours, or 19% more. 2 Most state employees receive pay rate increases every year pursuant to state laws and/or collective bargaining agreements until they reach the top of their pay scale, or promote into a higher-paying position. In addition, when an employee’s accumulated leave balances upon separation are calculated for lump-sum pay, the employee is credited with additional leave credits equal to the amount that the employee would have earned had the employee taken time off and not separated from state service. -9- California Health Care Facility—Psychiatric Inpatient Program Payroll Audit We further examined the records of the 20 employees to determine whether CHCF-PIP complied with collective bargaining agreements and state regulations. We determined that CHCF-PIP could not demonstrate that it had complied with collective bargaining agreements and state regulations when allowing these employees to maintain excess vacation or annual leave balances. We also found that CHCF-PIP had no plans in place during the audit period to reduce leave balances below the limit. If CHCF-PIP does not take action to reduce the excessive leave balances, the liability for accrued vacation and annual leave will likely increase because most employees will receive salary increases or use other non-compensable leave credits instead of vacation or annual leave, thus increasing their vacation or annual leave balances. The state agency responsible for paying these leave balances may face a cash flow problem if a significant number of employees with excessive vacation or annual leave balances separate from state service. Normally, state agencies are not budgeted to make these separation lump-sum payments. However, the State’s current practice dictates that the state agency that last employed an employee pays for that employee’s separation lump-sum payment, regardless of where the employee accrued the leave balance. On October 20, 2020, CalHR directed departments to immediately suspend policies that require leave balances to be reduced below the limit, and that require employees to implement leave-reduction plans. This suspension was in effect until the 2020 Personal Leave Program ended on June 30, 2021. Recommendation We recommend that CHCF-PIP:  Implement controls, including existing policies and procedures, to ensure that its employees’ vacation and annual leave balances are maintained within levels allowed by collective bargaining agreements and state regulations;  Conduct ongoing monitoring of controls to ensure that they are implemented and operating effectively; and  Participate in leave buy-back programs if the State offers such programs and funds are available. CCHCS’s Response CCHCS agrees to the audit findings and in July 2019 implemented annual leave reduction plan requirement to comply with applicable leave reduction efforts policies. The annual plan will require employees with leave balances over the cap to have leave reduction plans approved by their respective supervisors. This annual process will assist in reducing vacation and annual leave balances in order to avoid future liability. It should be noted, however, effective October 26, 2020, the California Department of Human Resources suspended the leave reduction plan requirements for the duration of the 2020 Personal Leave Program (PLP) or July 1, 2022. Although the leave reduction plan requirements are temporarily suspended, when operationally feasible, managers and supervisors are -10- California Health Care Facility—Psychiatric Inpatient Program Payroll Audit encouraged to work with employees to reduce leave balances utilizing PLP and vacation/annual leave for scheduled time off. Once suspension is lifted, CHCF‐PIP will resume following existing policies and procedures to ensure its employees’ vacation and annual leave balances are maintained within levels allowed by collective bargaining agreements and state regulations, as well as conducting ongoing monitoring of controls to ensure they are implemented and operating effectively. FINDING 4— CHCF-PIP lacked adequate segregation of duties within its payroll transactions unit, as noted in Finding 1, and lacked adequate controls over the processing of Inadequate overtime pay. We identified a net total of $231,950 in underpayments for controls over overtime pay, consisting of $70 in overpayments and $1,540 in underpayments overtime pay, based on actual transactions examined (“known”); and $10,943 in resulting in overpayments and $241,423 in underpayments based on the results of statistical improper sampling (“likely”). If not mitigated, these control deficiencies leave CHCF- payments PIP at risk of making additional improper overtime payments. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Collective bargaining agreements, and state laws and policies, contain specific clauses regarding overtime pay. Payroll records show that CHCF-PIP processed 17,489 overtime pay transactions, totaling $44,865,261, between March 2017, and February 2020. Of the 17,489 overtime pay transactions, we randomly selected a statistical sample (as described in the Appendix) of 105 transactions, totaling $284,392. Of the 105 transactions, one was overpaid by approximately $70 and four were underpaid by approximately $1,540. The improper payments represent a net total underpayments of $1,470. As we used a statistical sampling method to select the overtime pay transactions examined, we projected the amount of likely overpayments to be $10,943 and likely underpayments to be $241,423. The likely improper payments represent a net total underpayments of $230,480. Therefore, the known and likely underpayments totaled a net of approximately $231,950, consisting of $11,013 in overpayments and $242,963 in underpayments. The following table summarizes the results of our statistical sampling: Known underpayments, net $ 1,470 Divide by: Sample 284,392 Error rate for projection (differences due to rounding) 0.52% Population that was statistically sampled 44,865,261 Multiply by: Error rate for projection 0.52% Known and likely underpayments, net (differences due to rounding) 231,950 Less: Known underpayments, net 1,470 Likely underpayments, net $ 230,480 _____________ * Amounts in this table are rounded to the nearest dollar. The known improper payments were made because payroll transactions unit -11- California Health Care Facility—Psychiatric Inpatient Program Payroll Audit staff members miscalculated overtime hours worked; and paid for overtime hours worked at the straight-time rate instead of the time-and-a-half rate, or vice-versa. Furthermore, CHCF-PIP lacked adequate supervisory review to ensure accurate processing of overtime pay. Recommendation We recommend that CHCF-PIP:  Conduct a review of overtime payments made during the past three years to ensure that the payments complied with collective bargaining agreements and state laws and policies; and  Recover overpayments made to employees through an agreed-upon collection method in accordance with GC section 19838, and properly compensate those employees who were underpaid. We further recommend that, to prevent improper overtime payments from recurring, CHCF-PIP:  Establish adequate internal controls to ensure that payments are accurate and comply with collective bargaining agreements and state laws and policies; and  Provide adequate oversight to ensure that payroll transactions unit staff process only valid and authorized payments that comply with collective bargaining agreements and state laws and policies. CCHCS’s Response CHCF‐PIP has implemented oversight controls to prevent improper overtime payments. The Personnel Supervisor I provides daily monitoring of pay issued in the state payroll system and on a monthly basis analyzes and reviews a sampling of timesheets to ensure compliance. Also, overtime rates are calculated through the BIS, which is responsible for the calculation and downloading of overtime electronically to the SCO system. CHCF‐PIP continues to focus on training, which is provided on a continual basis in an effort to reduce errors. FINDING 5— CHCF-PIP lacked adequate segregation of duties within its payroll transactions unit, as noted in Finding 1, and lacked adequate controls over the processing of Inadequate employee separation lump-sum pay. CHCF-PIP lacked adequate supervisory controls over review to ensure accurate and timely processing of separation lump-sum pay. If separation lump not mitigated, these control deficiencies leave CHCF-PIP at risk of making sum pay, resulting additional improper and late separation lump-sum payments, noncompliance in improper and with agreements and laws, and liability for late payments. late payments GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. GC section 19839 allows lump-sum payment for accrued eligible leave credits when an employee separates from state employment. Collective bargaining agreements include similar provisions regarding separation lump-sum pay Our examination of separation lump-sum pay determined that CHCF-PIP made improper payments. Although we deemed the improper payments to be -12- California Health Care Facility—Psychiatric Inpatient Program Payroll Audit insignificant, the existence of control deficiencies over the processing of separation lump-sum pay presents the risk that CHCF-PIP will not prevent, or detect and correct, improper payments in a timely manner. Payroll records show that CHCF-PIP processed separation lump-sum payments, totaling $1,520,909, for 156 employees between March 2017 and February 2020. Of the 156 employees, we randomly selected a statistical sample (as described in the Appendix) of 63 employees who received separation lump-sum payments, totaling $543,550. Of the 63 employees, one was overpaid by approximately $113 and one was underpaid by approximately $346. The improper payments represent a net total underpayments of $233. As we used a statistical sampling method to select the employees whose separation lump-sum payments were examined, we projected the amount of likely overpayments to be $205 and likely underpayments to be $623. The likely improper payments represent a net total underpayments of $418. Therefore, the known and likely underpayments totaled a net of approximately $651, consisting of $318 in overpayments and $969 in underpayments. The following table summarizes the results of our statistical sampling: Known underpayments, net $ 233 Divide by: Sample 543,550 Error rate for projection (differences due to rounding) 0.04% Population that was statistically sampled 1,520,909 Multiply by: Error rate for projection 0.04% Known and likely underpayments, net (differences due to rounding) 651 Less: Known underpayments, net 233 Likely underpayments, net $ 418 _____________ * Amounts in this table are rounded to the nearest dollar. The known improper payments were made because payroll transactions unit staff members miscalculated leave balances paid for separation lump-sum pay. CHCF-PIP also lacked adequate supervisory review to ensure accurate and timely processing of separation lump-sum pay. Of the 63 employees whose separation lump-sum payments we examined, six were not paid in a timely manner, in violation of collective bargaining agreements and state laws as summarized in CalHR’s Human Resources Manual, section 1703. Recommendation We recommend that CHCF-PIP:  Establish adequate controls to ensure accurate and timely separation lump- sum payments;  Conduct a review of separation lump-sum payments made during the past three years to ensure that the payments were accurate and in compliance with collective bargaining agreements and state law; and  Recover overpayments made to separated employees in accordance with -13- California Health Care Facility—Psychiatric Inpatient Program Payroll Audit GC section 19838 and State Administrative Manual (SAM) section 8776.6, and properly compensate those employees who were underpaid. CCHCS’s Response With CCHCS HR oversight and the training and implementation of established policies and procedures, CHCF‐PIP has implemented oversight controls, which require review and approval of all lump‐sum calculations by the Personnel Supervisor I prior to an employee separation. CCHCS HR will also continue to provide regular training to transactions staff to maintain the integrity of the state payroll system, comply with all federal and state laws, and ensure employees receive accurate and timely separation pay. FINDING 6— CHCF-PIP lacked adequate segregation of duties within its payroll transactions unit, as noted in Finding 1, and lacked adequate controls over the processing of Inadequate holiday credit transactions. We identified approximately $1,934 in improper controls over holiday credits. If not mitigated, these control deficiencies leave CHCF-PIP at holiday credit risk of granting additional improper holiday credits. transactions, resulting in GC section 19853 specifies the compensation that an eligible employee is improper credits entitled to receive when required to work on a qualifying holiday. Collective bargaining agreements between the State and Bargaining Units 17, 18, and 19, include similar provisions regarding holiday credit for represented employees. Leave accounting records show that CHCF-PIP processed 63,308 accrual transactions of holiday credit, with an estimated value of $2,849,628. We examined five of these transactions, with an estimated value of $1,934, because they involved unusual credits. Our examination found that all five transactions involved improper credits. As we tested only a targeted selection, there could be additional improper credits. The improper holiday credit transactions were made because payroll transactions unit staff members granted holiday credits to employees during pay periods with no holidays. CHCF-PIP also lacked adequate supervisory review to ensure proper and accurate processing of holiday credits. Recommendation We recommend that CHCF-PIP:  Conduct a review of holiday credits granted during the past three years to ensure that credits are properly supported with documentation, and complied with collective bargaining agreements and state law;  Correct any improper holiday credits in the State’s leave accounting system; and  Establish adequate controls to ensure that holiday credits granted are valid and comply with collective bargaining agreements and state law. CCHCS’s Response Due to the transition from DSH to CCHCS, CHCF‐PIP lost keying access to make any corrections to payroll and/or leave prior to July 1, 2017. In order to make any corrections, CHCF‐PIP was directed by SCO California Leave -14- California Health Care Facility—Psychiatric Inpatient Program Payroll Audit Accounting System (CLAS) Unit Manager to post transactions in the current pay period to correct any prior mistakes/inconsistencies (Attachment A). CHCF‐PIP has seen a reduction in errors, since the July 2017 implementation of BIS TimePay$ CLAS interface, in which leave is electronically sent to SCO, as it relates to holiday credit accruals. Since the review, CHCF‐PIP has provided training to staff and implemented controls to prevent improper holiday compensation. The Personnel Supervisor I utilizes various audit tools to ensure accurate reconciliation of attendance records and will continue to provide training to transactions staff. FINDING 7— CHCF-PIP lacked adequate segregation of duties within its payroll transactions unit, as noted in Finding 1, and lacked adequate controls over salary advances Inadequate to ensure that advances were recovered in accordance with state law and controls over policies. Nineteen salary advances, totaling $22,956, remained outstanding as salary advances, of February 29, 2020, due to CHCF-PIP’s noncompliance with the State’s resulting in failure collection policies and procedures. The oldest unrecovered salary advance was to recover outstanding for over seven years. These control deficiencies leave CHCF-PIP outstanding at risk of failing to collect further salary advances if not mitigated. amounts At February 29, 2020, CHCF-PIP’s accounting records showed 19 outstanding salary advances, totaling $22,956, which had been outstanding for more than 120 days. Generally, the prospect of collection diminishes as an account ages. When an agency does not initiate collection within three years from the date of overpayment, the possibility of collection is remote. We examined the 19 outstanding salary advances and noted that CHCF-PIP did not comply with the State’s collection policies and procedures for all of them. CHCF-PIP did not send collection notices promptly, or did not send collection notices at all. For example, CHCF-PIP issued a salary advance to an employee in July 2019, but CHCF-PIP has not issued any collection notice as of the audit period. The lack of adequate controls over salary advances reduces the likelihood of collection, increases the amount of resources expended on collection efforts, and negatively impacts cash flow. GC section 19838 and SAM sections 8776 and 8776.7 describe the State’s collection policies and procedures, which require CHCF-PIP to collect salary advances in a timely manner and maintain proper records of collection efforts. Recommendation We recommend that CHCF-PIP ensure that it recovers salary advances in a timely manner, pursuant to GC section 19838 and SAM sections 8776 and 8776.7. CCHCS’s Response CHCF‐PIP makes a concerted effort to clear all salary advances in a timely manner. Since the implementation of BIS in April 2018, all salary advances are tracked in the BIS system and overseen by the Salary Advance/Aging Report (SA/AR) Unit and the Accounting Services Branch. The SA/AR Unit distributes a monthly report that is reviewed and monitored by CHCF‐PIP -15- California Health Care Facility—Psychiatric Inpatient Program Payroll Audit Personnel Supervisors on a monthly basis. While CHCF‐PIP strives to expeditiously and diligently clear salary advances, staffing turnover periodically impacts the effectiveness of our efforts, causing unplanned delays in notification and/or recovery of outstanding accounts. With regard to the 19 outstanding salary advances identified in the findings, seven have since been cleared, and seven of the lump sums were issued to employees that separated from state civil service prior to this audit period. Once an employee separates from state service, the responsibility to collect shifts from the local Personnel Office to the departmental Accounting Office. SCO Comment Our finding remains unchanged. We appreciate that CCHCS implemented corrective actions. CCHCS’s response also states that seven of the lump-sum payments were issued to employees who had separated prior to our audit period. On December 16, 2021, CCHCS provided additional information to clarify that the seven employees separated during the audit period and prior to the start of our audit engagement. This clarification is consistent with our finding. CCHCS also asserts that the responsibility to collect salary advances from employees who have separated from state service shifts from the personnel office to the departmental accounting office. This assertion contradicts CCHCS’s own policies regarding salary advances. Section 711 of CDCR’s Personnel Operations Manual states, in part, that “It is the Personnel Specialist’s responsibility to monitor pending pay and to clear all outstanding salary advances in a timely manner.” Section 718 of CDCR’s Personnel Operations Manual, which cited GC section 19838, allows CHCF-PIP to withhold “from any money owing the employee upon separation an amount sufficient to provide full payment.” Section 719 of CDCR’s Personnel Operations Manual further states the responsibilities of Personnel Specialists and Senior Personnel Specialists to track and clear accounts receivable from separated employees. -16- California Health Care Facility—Psychiatric Inpatient Program Payroll Audit Appendix— Audit Sampling Methodology The sample design was chosen because:  It follows the American Institute of Certified Public Accountants (AICPA) guidelines;  It allows us to achieve our objectives for tests of compliance in an efficient and effective manner;  Audit areas included both high and low volumes of transactions;  We intend to project the results to the intended population; and  We have the collective knowledge and skills to plan and perform the sampling plan and design. The following table outlines our audit sampling application for all audit areas where statistical sampling was used: Results Expected Projected to Audit Type Population Population Sampling Sample Selection Confidence Tolerable Error Sample Intended Finding Area of Test (Unit) (Dollar) Unit Method Level Error Rate (Rate) ᵃ Size ᵇ Population Number Regular pay Compliance 30,294 $ 1 95,197,572 Transaction Computer-generated 90% 5% 2 (1.75%) 105 Yes simple random Overtime pay Compliance 17,489 44,865,261 Transaction Computer-generated 90% 5% 2 (1.75%) 105 Yes 4 simple random Separation lump-sum pay Compliance 1 56 1 ,520,909 Employee Computer-generated 90% 5% 2 (1.25%) 63 Yes 5 simple random _________________________ ᵃ Pursuant to the AICPA’s Audit Guide: Audit Sampling (May 1, 2017 edition), pages 131-133, the expected error is the expected number of errors planned for in the sample. It is derived by multiplying the expected error rate by the sample size. The expected number of errors in the sampling tables on pages 135-136 was rounded upward, e.g., 0.2 errors becomes 1.0 error. ᵇ For populations of fewer than 250 items, we determined the sample size using a calculator that uses a hypergeometric distribution. For populations of 250 items or more, we determined the sample size using a calculator that uses a binomial distribution. As stated in Technical Notes on the AICPA Audit Guide: Audit Sampling (March 1, 2012), page 5, although the hypergeometric distribution is the exactly correct distribution to use for attributes sample sizes, the distribution becomes unwieldy for large populations unless suitable software is available. Therefore, more convenient approximations are frequently used instead. California Health Care Facility—Psychiatric Inpatient Program Payroll Audit Attachment— California Correctional Health Care Services’ Response to Draft Audit Report State Controller’s Office Division of Audits Post Office Box 942850 Sacramento, CA 94250 http://www.sco.ca.gov S20-PAR-0005