California Department of Parks and Recreation Payroll Audit

CALIFORNIA DEPARTMENT OF PARKS AND RECREATION Audit Report PAYROLL AUDIT July 1, 2018, through June 30, 2021 M M. C ALIA OHEN C ALIFORNIA S TATE C ONTROLLER December 2024 MALIA M. COHEN CALIFORNIA STATE CONTROLLER December 24, 2024 Mr. Armando Quintero, Director California Department of Parks and Recreation P.O. Box 942896 Sacramento, CA 94296 Dear Director Quintero: The State Controller’s Office audited the California Department of Parks and Recreation’s payroll process and transactions for the period of July 1, 2018, through June 30, 2021. The audit was conducted pursuant to Government Code sections 12476 and 12410. California Department of Parks and Recreation management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. If you have any questions regarding this report, please contact Roochel Espilla, Chief, State Agency Audits Bureau, by telephone at 916-323-5744. Thank you. Sincerely, Original signed by Kimberly A. Tarvin, CPA Chief, Division of Audits KAT/am MAILING ADDRESS P.O. Box 942850, Sacramento, CA 94250 SACRAMENTO 3301 C Street, Suite 700, Sacramento, CA 95816 | 916.324.8907 LOS ANGELES 901 Corporate Center Drive, Suite 200, Monterey Park, CA 91754 | 323.981.6802 Mr. Armando Quintero December 24, 2024 Page 2 of 2 Copy: Elizabeth McGuirk, Chief Deputy Director California Department of Parks and Recreation Crystal Flores, Acting Deputy Director Administrative Services Division California Department of Parks and Recreation Jennifer Crockett, Assistant Deputy Director Human Resources Section California Department of Parks and Recreation Kathie Sharp-Adema, Staff Services Manager II Human Resources Section California Department of Parks and Recreation Michael Bunt, Personnel Officer Human Resources Section California Department of Parks and Recreation Jasdeep Uppal, Chief Internal Audits California Department of Parks and Recreation Helen Fairchild, Chief Administrative Services Division California Department of Human Resources Lisa Dean, Acting Chief Personnel and Payroll Services Division State Controller’s Office Veronica Encinas, Bureau Chief Personnel and Payroll Services Division State Controller’s Office MAILING ADDRESS P.O. Box 942850, Sacramento, CA 94250 SACRAMENTO 3301 C Street, Suite 700, Sacramento, CA 95816 | 916.324.8907 LOS ANGELES 901 Corporate Center Drive, Suite 200, Monterey Park, CA 91754 | 323.981.6802 California Department of Parks and Recreation Payroll Audit Contents Audit Report Summary ............................................................................................................................ 1 Background ........................................................................................................................ 1 Audit Authority.................................................................................................................. 1 Objectives, Scope, and Methodology ............................................................................... 1 Conclusion .......................................................................................................................... 3 Follow-up on Prior Audit Findings .................................................................................. 5 Views of Responsible Officials .......................................................................................... 5 Restricted Use .................................................................................................................... 5 Schedule—Summary of Audit Results ................................................................................. 6 Findings and Recommendations ........................................................................................... 7 Appendix A—Summary of Prior Audit Findings ............................................................... A1 Appendix B—Audit Sampling Methodology ....................................................................... B1 Attachment—California Department of Parks and Recreation’s Response to Draft Audit Report California Department of Parks and Recreation Payroll Audit Audit Report Summary The State Controller’s Office (SCO) audited the California Department of Parks and Recreation’s (State Parks) payroll process and transactions for the period of July 1, 2018, through June 30, 2021. State Parks management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. Our audit determined that State Parks did not: • Maintain adequate and effective internal controls over certain aspects of its payroll process, as described in Findings 1 through 12; • Process payroll and payroll-related disbursements accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures in certain instances, as described in Findings 3 through 7 and 9 through 12; or • Administer salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures, as described in Finding 8. Background In 1979, the State of California adopted collective bargaining for state employees. This created a significant workload increase for the SCO’s Personnel and Payroll Services Division (PPSD), as PPSD was the State’s centralized payroll processing center for all payroll-related transactions. PPSD decentralized the processing of payroll, allowing state agencies and departments to process their own payroll-related transactions. Periodic audits of the decentralized payroll processing at state agencies and departments ceased due to the budget constraints in the late 1980s. In 2013, the California State Legislature reinstated these payroll audits to gain assurance that state agencies and departments maintain adequate internal control over the payroll function, provide proper oversight of their decentralized payroll processing, and comply with various state laws and regulations regarding payroll processing and related transactions. Audit Authority We conducted this audit in accordance with Government Code (GC) section 12476, which authorizes the SCO to audit the State’s payroll system, the State Pay Roll Revolving Fund, and related records of state agencies within the State’s payroll system. In addition, GC section 12410 provides the SCO with general authority to audit the disbursement of state money for correctness, legality, and sufficient provisions of law for payment. Objectives, Scope, Our audit objectives were to determine whether State Parks: and Methodology • Maintained adequate and effective internal controls over its payroll process; -1- California Department of Parks and Recreation Payroll Audit • Processed payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures; and • Administered salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. The audit covered the period from July 1, 2018, through June 30, 2021. The audit population consisted of payroll transactions totaling $651,397,959, as quantified in the Schedule. To achieve our audit objectives, we performed the following procedures: • We reviewed state and State Parks policies and procedures related to the payroll process to understand State Parks’ methodology for processing various payroll and payroll-related transactions. • We interviewed State Parks payroll personnel to understand State Parks’ methodology for processing various payroll and payroll-related transactions, determine employees’ level of knowledge and ability relating to payroll transaction processing, and gain an understanding of existing internal control over the payroll process and systems. • We selected transactions recorded in the State’s payroll database using statistical sampling, as outlined in Appendix B; judgmental selection; and targeted selection, based on risk factors and other relevant criteria. • We analyzed and tested the selected transactions, and reviewed relevant files and records to determine the accuracy of payroll and payroll-related payments; accuracy of leave transactions; adequacy and effectiveness of internal control over the payroll process; and compliance with collective bargaining agreements and state laws, regulations, policies, and procedures. • We reviewed salary advances to determine whether State Parks administered and recorded them in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. • We assessed the reliability of computer-processed data for payroll and payroll-related transactions by interviewing State Parks officials knowledgeable about the data; reviewing existing information about the data and the system that produced it; and tracing data to source documents, based on statistical sampling and judgmental and targeted selection. We determined that the data was sufficiently reliable for the purposes of this report. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. -2- California Department of Parks and Recreation Payroll Audit Conclusion Our audit determined that State Parks did not maintain adequate and effective internal controls over its payroll process;1 did not process payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures; and did not administer salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. We found deficiencies in internal control over the payroll process that we consider to be material weaknesses; and instances of noncompliance with the requirements of collective bargaining agreements and state laws, and regulations, and policies, and procedures. The material weaknesses and instances of noncompliance are as follows: • State Parks had inadequate segregation of duties and a lack of compensating controls over payroll transactions (see Finding 1). • Fourteen of 53 (26%) employees whose records we examined had inappropriate keying access to the State’s payroll system (see Finding 2). • State Parks did not reduce employees’ balances in the State’s leave accounting system for three of 105 (3%) regular pay transactions that we examined; the identified and projected unreduced leave credits totaled $778 and $1,189,123, respectively. In addition, State Parks overpaid one of the regular pay transactions that we examined by $359 and underpaid 16 of 105 (15%) of the transactions by a total of $1,656. We projected the additional overpayments to be $549,303 and underpayments to be $2,531,829. Furthermore, State Parks did not consistently maintain timesheets for regular pay. Based on our audit testing, we estimated that 10% of the timesheets associated with regular pay during the audit period were not retained. We identified $27,904 and projected an additional $42,665,985 in unsupported regular pay transactions (see Finding 3). • State Parks overpaid two of 119 (2%) overtime transactions that we examined by $2,872 and underpaid four of the 105 (3%) transactions by a total of $5,130. We projected the additional overpayments to be 1 In planning and performing our audit of compliance, we considered State Parks’ internal control over compliance with collective bargaining agreements and state laws, regulations, policies, and procedures to determine the auditing procedures that were appropriate under the circumstances for the purpose of providing a conclusion on compliance, and to test and report on internal control over compliance. Our consideration of internal control over compliance was for the limited purpose described in the first paragraph of this footnote; and it was not designed to identify all deficiencies in internal control over compliance that might be material weaknesses or significant deficiencies. As discussed in this section, we identified certain deficiencies in internal control over compliance that we consider to be material weaknesses. A deficiency in internal control over compliance exists when the design, implementation, or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A material weakness in internal control over compliance is a deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. A significant deficiency in internal control over compliance is a deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention from those charged with governance. -3- California Department of Parks and Recreation Payroll Audit $165,311 and underpayments to be $2,238. In addition, State Parks did not consistently maintain timesheets for overtime pay. Based on our audit testing, we estimated that 55% of the timesheets associated with overtime payments during the audit period were not retained. We identified $110,416 and projected an additional $4,569,424 in unsupported overtime payments (see Finding 4). • State Parks overpaid five of 108 (5%) employees whose separation lump-sum payments we examined and underpaid 37 of 108 (34%) of the employees. We identified $2,070 and projected $12,849 in overpayments; and we identified $4,311 and projected $91,401 in underpayments. In addition, State Parks did not make separation lump-sum payments to 43 of 108 (or 40%) of the employees in a timely manner. Furthermore, State Parks did not consistently maintain supporting documentation for separation lump-sum payments. Based on our audit testing, we estimated that 22% of the supporting documentation associated with separation lump-sum payments during the audit period was not retained; we identified $984,336 and projected an additional $1,430,437 in unsupported separation lump- sum payments (see Finding 5). • State Parks had inadequate controls to ensure that it adhered to requirements limiting the accumulation of vacation and annual leave credits. As of October 1, 2020, State Parks’ leave accounting records show 255 employees whose leave balances exceeded the limit set by collective bargaining agreements and state regulations. The value of State Parks’ excess leave balances was at least $2,740,563 as of October 1, 2020. Based on our audit testing, we determined that for all 255 employees, State Parks had failed to implement controls to ensure that it adhered to the requirements (see Finding 6). • State Parks underpaid two of 105 (2%) leave buy-back transactions that we examined. We identified $586 and projected $3,949 in underpayments. In addition, State Parks did not consistently maintain supporting documentation for leave buy-back transactions. Based on our audit testing, we estimated that 7% of the supporting documentation associated with leave buy-back transactions during the audit period was not retained. We identified $12,368 and projected an additional $83,263 in unsupported leave buy-back transactions (see Finding 7). • State Parks had inadequate controls to ensure that salary advances were administered in accordance with requirements and collected in a timely manner. Twenty-eight salary advances, totaling $69,333, remained outstanding more than 90 days as of June 30, 2021 (see Finding 8). • State Parks had inadequate controls to ensure that holiday credit compensation was calculated correctly and granted to eligible employees. We examined 39 unusual transactions and determined that in 28 transactions, with an estimated net value of $7,435, State Parks had granted improper holiday credit compensation. In addition, State Parks did not consistently maintain timesheets to support the holiday credits granted to employees. Based on our audit testing, we estimated that 26% of the timesheets associated with holiday credit -4- California Department of Parks and Recreation Payroll Audit compensation during the audit period were not retained (see Finding 9). • State Parks lacked adequate controls to ensure that it adhered to requirements limiting the number of hours worked by temporary and permanent intermittent employees and retired annuitants. Of the 60 employees whose records we examined, 41 (68%) exceeded the limits. These employees worked a total of 25,307 hours—with a value of $534,813—in excess of the limits (see Finding 10). • State Parks had inadequate controls to ensure that Non-Industrial Disability Insurance (NDI) leave credits were calculated correctly and granted to eligible employees. State Parks granted improper leave credits, with a value of $4,151, in 12 of 50 (24%) NDI transactions that we examined. In addition, State Parks did not consistently maintain timesheets for NDI transactions. Based on our audit testing, we estimated that 68% of timesheets associated with NDI transactions during the audit period was not retained. We identified $11,992 in unsupported NDI payments (see Finding 11). • State Parks had inadequate controls to ensure that it adhered to its policies regarding out-of-class (OOC) assignments. Two of 10 (20%) employees whose records we examined were paid a total of $457 for OOC work that they completed before their assignments were approved (see Finding 12). Follow-up on State Parks has satisfactorily resolved the findings noted in our prior review report for the period of July 1, 2009, through June 30, 2012, issued Prior Audit on December 18, 2012, with the exception of Findings 2, 10, 11, and 12 Findings of this audit report. The implementation status of corrective actions is described in Appendix A. Views of We issued a draft audit report on October 3, 2024. State Parks’ representative responded by letter dated October 11, 2024, agreeing with Responsible the audit results. This final audit report includes State Parks’ response as Officials an attachment. Restricted Use This audit report is solely for the information and use of State Parks and the SCO; it is not intended to be, and should not be, used by anyone other than these specified parties. This restriction is not intended to limit distribution of this audit report, which is a matter of public record and is available on the SCO website at www.sco.ca.gov. Original signed by Kimberly A. Tarvin, CPA Chief, Division of Audits December 24, 2024 -5- California Department of Parks and Recreation Payroll Audit Schedule Summary of Audit Result July 1, 2018, through June 30, 2021 Net Total Dollar Amount of Projected Improper Net Total Costs and Dollar Amount Identified and Number of Number of Dollar Amount of Identified Projected Method of Units of Dollar Amount Selections of Selections Improper Unsupported Finding Audit Area Tested Selection Population of Population Examined Examined Costs Costs Number Segregation of duties N/A N/A N/A N/A N/A N/A N/A 1 System access Targeted 53 N/A 53 Employees N/A N/A N/A 2 Regular pay Statistical 151,892 $ 4 83,519,737 105 Transactions $ 316,020 $ (519) $ 41,900,486 3 Overtime pay Statistical, 19,514 9 ,063,985 119 Transactions 163,339 (2,258) 4 ,842,913 4 judgmental, and targeted Separation lump-sum Statistical 2,003 8,147,692 108 Employees 3,003,457 (2,241) 2 ,336,221 5 pay and targeted Excess vacation and Targeted 255 2,740,563 255 Employees 2,740,563 2 ,740,563 - 6 annual leave Leave buy-back Statistical 789 2,070,503 105 Transactions 267,781 ( 586) 9 1,682 7 Salary advance Targeted 28 69,333 28 Transactions 6 9,333 6 9,333 - 8 Holiday credit Judgmental 16,564 4,822,422 39 Transactions 2 8,134 7,435 7 ,990 9 and targeted Regular and overtime pay Judgmental 4,786 140,575,382 60 Employees 6,966,176 5 34,813 - 10 (Temporary and permanent intermittent employees and retired annuitants) Non-Industrial Disability Targeted 50 17,689 50 Transactions 1 7,689 4,151 1 1,992 11 Insurance pay Out-of-class pay Judgmental 91 370,653 10 Employees 128,660 4 57 - 12 $ 6 51,397,959 $ 13,701,152 $ 3 ,351,148 $ 49,191,284 -6- California Department of Parks and Recreation Payroll Audit Findings and Recommendations FINDING 1— State Parks lacked adequate segregation of duties within its payroll transactions unit to ensure that only valid and authorized payroll Inadequate transactions were processed. State Parks also failed to implement other segregation of controls to compensate for this risk. duties and lack of compensating Our audit found that State Parks payroll transactions unit staff performed controls over conflicting duties. Staff members performed multiple steps in processing payroll payroll transactions, including entering data into the State’s payroll transactions system; auditing employee timesheets; reconciling payroll, including reconciling system output to source documentation; reporting payroll exceptions; and processing adjustments. For example, staff members keyed in regular and overtime pay, and reconciled the master payroll, overtime, and other supplemental warrants. State Parks failed to demonstrate that it implemented compensating controls to mitigate the risks associated with such a deficiency. We found no indication that these functions were subjected to periodic supervisory review. The lack of adequate segregation of duties and compensating controls has a pervasive effect on the State Parks payroll process, and impairs the effectiveness of other controls by rendering their design ineffective or by keeping them from operating effectively. These control deficiencies, in combination with other deficiencies discussed in Findings 2 through 12, represent a material weakness in internal control over the payroll process such that there is a reasonable possibility that material noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. Good internal control practices require that the following functional duties be performed by different work units, or at minimum, by different employees within the same unit: • Recording transactions – This duty refers to the record-keeping function, which is accomplished by entering data into a computer system. • Authorization to execute – This duty belongs to individuals with authority and responsibility to initiate and execute transactions. • Periodic review and reconciliation of actual payments to recorded amounts – This duty refers to making comparisons of information at regular intervals and taking action to resolve differences. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including proper segregation of duties and an effective system of internal review. Adequate segregation of duties reduces the likelihood that fraud or error will remain undetected by providing for separate processing by different individuals at various stages of a transaction and for independent reviews of the work performed. -7- California Department of Parks and Recreation Payroll Audit Recommendation We recommend that State Parks: • Separate conflicting payroll functional duties to the greatest extent possible. Adequate segregation of duties will provide a stronger system of internal control whereby the functions of each employee are subject to the review of another. If it is not possible to segregate payroll functions fully and appropriately, State Parks should implement compensating controls. For example, if the payroll transactions unit staff member responsible for recordkeeping also performs a reconciliation process, then the supervisor should perform and document a detailed review of the reconciliation to provide additional control over the assignment of conflicting functions. Compensating controls may also include dual authorization requirements and documented reviews of payroll system input and output; and • Develop formal procedures for performing and documenting compensating controls. FINDING 2— State Parks lacked adequate controls to ensure that only appropriate staff members had keying access to the State’s payroll system. State Parks Inappropriate inappropriately allowed 14 employees keying access to the State’s payroll keying access to the system because State Parks did not immediately remove or modify keying State’s payroll access for the employees after the employees’ separation from state system and missing service, transfer to another agency, change in classification, or extended documentation leave of absence. State Parks also lacked documentation for 15 employees (Repeat Finding) to support that the employees’ access were deleted in a timely manner. The SCO maintains the State’s payroll system. The system is decentralized, thereby allowing employees of state agencies to access it. All state agencies are required to comply with PPSD’s Decentralized Security Program Manual (DSP Manual) in order to access the payroll system. The DSP Manual describes how state agencies can secure and protect the confidentiality and integrity of payroll data against misuse, abuse, and unauthorized use. We examined the records of 53 State Parks employees who had keying access to the State’s payroll system at various times between July 1, 2018, and June 30, 2021. Of the 53 employees, 14 had inappropriate keying access to the State’s payroll system. Specifically, State Parks did not immediately remove or modify keying access for the employees after the employees’ separation from state service, transfer to another agency, change in classification, or extended leave of absence. For example, a Staff Services Analyst left State Parks on March 1, 2019; however, State Parks did not request to remove the employee’s access until October 1, 2020— 580 days later. In addition, State Parks lacked documentation of change in employment status for 15 employees. Two of these employees were not in the Personnel Specialist/Payroll Technician classification and had been granted keying access after their authorizing managers submitted the written justification, as required by the DSP Manual. However, the justification letters were -8- California Department of Parks and Recreation Payroll Audit expired or missing at the time of our fieldwork; and the employees’ access was not removed when their employment status changed. Without the required documentation, we could not determine whether the employees’ keying access had been removed in a timely manner. State Parks lacked periodic review of keying access granted to employees to ensure compliance with the DSP Manual. If not mitigated, this control deficiency leaves payroll data at risk of misuse, abuse, and unauthorized use. The December 2015 DSP Manual (“Access Requirements,” page 13) states, in part: The [State’s payroll system] contains sensitive and confidential information. Access is restricted to persons with an authorized, legal, and legitimate business requirement to complete their duties. . . . Currently, PIMS [Employment History], HIST [Payroll History], KEYM [Keymaster], PIP [Payroll Input Processing], LAS [Leave Accounting System], MPC [Master Payroll Certification] and/or ACAS [Affordable Care Act database] applications are restricted to Personnel Specialists or Personnel Technician classifications because their need is by definition a function of their specific job duties and any change in those duties requires a reevaluation of the need for access. If the employee’s duties change, such that the need for access no longer exists, the access privilege MUST be removed or deleted immediately by a request submitted by the department/campus. The June 2020 DSP Manual (“Access Requirements,” page 6) states, in part: The [State’s payroll system] contains sensitive and confidential information. Access is restricted to persons with an authorized, legal, and legitimate business requirement to complete their regular daily duties. . . . Currently, Mainframe Systems Overview (PIMS, HIST, KEYM, PIP, MIRS, CSP, LAS, MPC, VIEW, IDLS, and/or ACAS applications) are restricted to Personnel Specialists or Personnel Technician classifications because their need is by definition a function of their specific job duties and any change in those duties requires a reevaluation of the need for access. If the employee’s duties change, such that the need for access no longer exists, the access privilege MUST be removed or deleted immediately via a request submitted by the department/campus. The October 2020 DSP Manual (“Access Requirements,” page 5) states, in part: The [State’s payroll system] contains sensitive and confidential information. Access is restricted to persons with an authorized, legal, and legitimate business requirement to complete their regular daily duties. . . . If the employee's duties change, such that the need for access no longer exists, the access privilege MUST be removed or deleted immediately -9- California Department of Parks and Recreation Payroll Audit via a request submitted by the department/campus Security Monitor/Assistant Security Monitor. . . . The December 2015 DSP Manual (“Letter of Justification,” page 14) states, in part: A request to grant access to an individual in a classification other than in the Personnel Specialist/Payroll Technician series to access PIMS, HIST, KEYM, PIP, LAS, MPC and/or ACAS requires a written justification from the Authorizing Manager. The justification must describe the individual’s specific job duties requiring the need to access system information . . . as well as level of access to that application, in order to perform their regular daily duties. . . . The June 2020 DSP Manual (“Letter of Justification,” page 7) states, in part: A request to grant access to an individual in a classification other than in the Personnel Specialist/Payroll Technician series to access Mainframe Systems Overview (PIMS, HIST, KEYM, PIP, MIRS, CSP, LAS, MPC, VIEW, IDLS and/or ACAS) requires a written justification from the Authorizing Manager. The justification must describe the individual's specific job duties requiring the need to access system information . . . as well as level of access to that application, in order to perform their regular daily duties. . . . The December 2015 DSP Manual (“Revocation and Deletion of User IDs,” page 17) states, in part: To prevent unauthorized use by a transferred, terminated or resigned employee's user ID, the Security Monitor must IMMEDIATELY submit all pages of the PSD125A [Security Authorization Form] to delete the user’s system access. Using an old user ID increases the chances of a security breach, which is a serious security violation. Sharing a user ID is strictly prohibited and a serious violation. . . . The June 2020 DSP Manual (“Revocation and Deletion of User IDs,” page 10) states, in part: To prevent unauthorized use by a transferred, terminated or resigned employee's User ID, the Security Monitor must IMMEDIATELY submit all pages of the PSD125A signed by both Security Monitor and Authorizing Manager to delete the user’s system access. Using an old User ID increases the risk of a security breach, which is a serious security violation. Sharing a User ID is strictly prohibited. . . . The October 2020 DSP Manual (“Revocation and Deletion of User IDs,” page 7) states, in part: To prevent unauthorized use by a transferred, terminated or resigned employee's User ID, the Security Monitor must IMMEDIATELY contact DSA by email. The Security Monitor/Assistant Security Monitor must submit all pages of the PSD125A signed by both Security Monitor Assistant Security Monitor and Authorizing Official/Assistant Authorizing Official to delete the user’s system access. Using an old User ID increases the risk of a security breach, which is a serious security violation. Sharing a User ID is strictly prohibited. . . . -10- California Department of Parks and Recreation Payroll Audit State Parks’ General Retention Schedule for Payroll/Personnel Records specifies a four-year retention period for documentation related to keying access. Recommendation We recommend that State Parks: • Update keying access to the State’s payroll system immediately after employees leave State Parks, transfer to another unit, change classifications, or take extended leaves of absence; • Periodically review access to the system to verify that access complies with the DSP Manual; and • Maintain supporting documentation for keying access to the State’s payroll system pursuant to its retention policies. FINDING 3— State Parks lacked segregation of duties and compensating controls within Inaccurate leave its payroll transactions unit, as noted in Finding 1. It also lacked adequate controls to ensure that paid credits were reduced in the State’s leave accounting, accounting system; adequate controls over the processing of regular pay; improper and adequate controls to ensure that timesheets were maintained to support payments, and regular pay. missing timesheets for regular pay Payroll records show that State Parks processed 151,892 regular pay transactions, totaling $483,519,737, between July 2018 and June 2021. Of the 151,892 transactions, we randomly selected a statistical sample (as described in Appendix B) of 105 transactions, totaling $316,020. Based on our examination of these transactions, we found the following errors: • State Parks did not appropriately reduce employees’ balances in the State’s leave accounting system for three of 105 (3%) transactions to reflect the number of leave credits—with a value of $778—that had been used and paid. Unreduced leave balances pose a risk to the State because they overstate the State’s liabilities for leave balances and allow the possibility of improper and duplicative payments for leave credits. We projected additional unreduced leave credits with a value of $1,189,123. • State Parks overpaid one of 105 (1%) transaction by $359 and underpaid 16 of 105 (15%) by a total of $1,656 because the payroll transactions unit staff members paid for more hours than the employee worked, failed to compensate employees for earned holiday credits, and miscalculated regular hours worked. We projected the additional overpayments to be $549,303 and underpayments to be $2,531,829. • State Parks lacked timesheets associated with 11 of 105 (10%) transactions totaling $27,904. Without the required documentation, we could not determine the validity, accuracy, and propriety of the payments made to the employees; or the completeness and accuracy of the leave accounting records. We projected the additional unsupported payments to be $42,665,985. -11- California Department of Parks and Recreation Payroll Audit If not mitigated, the control deficiencies leave State Parks at risk of making additional improper and unsupported payments for regular pay. Statistical sampling results The net total identified value of unreduced leave credits, improper payments, and unsupported payments is $27,385. We used a statistical sampling method to select the regular pay transactions that we examined. We projected an additional $1,189,123 in unreduced leave credits. We also projected additional overpayments of $549,303, additional underpayments of $2,531,829, and additional unsupported payments of $42,665,985. The projected net value of unreduced leave credits, improper costs, and unsupported costs is $41,872,582. Therefore, the net value of identified and projected unreduced leave credits, improper costs, and unsupported costs is $41,899,967, consisting of $1,189,901 in unreduced leave credits, $549,662 in overpayments, $2,533,485 in underpayments, and $42,693,889 in unsupported payments. The following table summarizes the results of our statistical sampling (amounts are rounded to the nearest dollar). Identified unreduced leave credits, improper payments, and unsupported payments, net $ 27,385 Divide by: Sample 316,020 Error rate for projection (differences due to rounding) 8.67% Population that was statistically sampled 483,519,737 Multiply by: Error rate for projection 8.67% Identified and projected unreduced leave credits, improper payments, and unsupported payments, net (differences due to rounding) 41,899,967 Less: Identified unreduced leave credits, improper payments, and unsupported payments, net 27,385 Projected improper and unsupported payments, net $ 41,872,582 Criteria GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Collective bargaining agreements, and state laws and policies, contain specific clauses regarding regular pay. State Parks’ General Retention Schedule for Payroll/Personnel Records specifies a four-year retention period for timesheets. -12- California Department of Parks and Recreation Payroll Audit Recommendation We recommend that State Parks: • Establish adequate controls to ensure that employee leave balances are reduced in a timely manner after payments for regular pay are made; • Establish adequate controls to ensure that employees were paid for hours actually worked; and • Maintain supporting documentation for regular pay pursuant to its retention policies. FINDING 4— State Parks lacked adequate segregation of duties within its payroll transactions unit, as noted in Finding 1. It also lacked adequate controls Improper over the processing of overtime pay, adequate supervisory review to payments and ensure accurate processing of overtime pay, and adequate controls to missing timesheets ensure that timesheets were maintained to support overtime payments. for overtime pay Payroll records show that State Parks processed 19,514 overtime pay transactions, totaling $9,063,985, between July 2018 and June 2021, as follows: Overtime Payment Type by Group Unit Amount Work Week Group 2, less than 100 hours per transaction (statistically sampled) 19,409 $8,636,938 Work Week Group 2, at least 100 hours per transaction (judgmentally selected 16 payments) 79 402,626 Work Week Group E and SE (items examined 100%) 26 24,421 Total population 19,514 $9,063,985 Of the 19,409 transactions, totaling $8,636,938, for Work Week Group (WWG) 2 employees who were paid for less than 100 hours of overtime per transactions, we randomly selected a statistical sample (as described in Appendix B) of 77 transactions, totaling $37,034. Of the 79 transactions, totaling $402,626, for WWG 2 employees who were paid for at least 100 hours of overtime per transactions, we judgmentally selected 16 transactions totaling $101,884. In addition, we examined all 26 overtime pay transactions, totaling $24,421, for WWG E and SE employees who are not eligible to receive overtime pay under normal circumstances. Based on our examination of the 119 selected overtime pay transactions, we found the following errors: • State Parks overpaid two of 119 (2%) transactions by approximately $2,872 and underpaid four of 119 (3%) transactions by approximately $5,130 because payroll transactions unit staff members miscalculated overtime hours worked and incorrectly entered overtime hours worked into the payroll system. State Parks also lacked adequate supervisory review to ensure accurate processing of overtime pay. We projected -13- California Department of Parks and Recreation Payroll Audit the additional overpayments to be $165,311 and underpayments to be $2,238. • State Parks lacked timesheets associated with 65 of 119 (55%) transactions with a value of $110,416. Without the required documentation, we could not determine the validity, accuracy, and propriety of the payments made to the employees; or the completeness and accuracy of the leave accounting records. We projected the additional unsupported payments to be $4,569,424. If not mitigated, these control deficiencies leave State Parks at risk of making additional improper overtime payments. Statistical sampling results The identified improper and unsupported payments have a net total of $20,380. We used a statistical sampling method to select the overtime pay transactions that we examined. We projected an additional $165,311 in overpayments and $2,238 in underpayments; we also projected an additional $4,569,424 in unsupported payments. The projected improper and unsupported payments have a net total of $4,732,497. Therefore, the identified and projected improper and unsupported payments totaled a net of approximately $4,752,877, consisting of $166,023 in overpayments, $2,248 in underpayments, and $4,589,102 in unsupported payments. The following table summarizes the results of our statistical sampling (amounts are rounded to the nearest dollar): -14- I D E P M I L P d e n t if ie d im p r o p e r a n d u n s u iv id e d b y : S a m p le r r o r r a t e f o r p r o j e c t io n ( d if f o p u la t io n t h a t w a s s t a t is t ic a u lt ip ly b y : E r r o r r a t e f o r p r d e n t if ie d a n d p r o j e c t e d im p r ( d if f e r e n c e s d u e t o r o u n d in e s s : I d e n t if ie d im p r o p e r a n d r o j e c t e d im p r o p e r a n d u n s u p p o r t e d p e r e n c e s d lly s a m p le o j e c t io n o p e r a n d g ) u n s u p p o p p o r t e d p a y u e d u n r t e a y m e n t s , n t o r o u n d s u p p o r t e d p a y m e m e n t s , n e t in g d p n t s e t ) a y , n m e t e n t s , n e t $ 8 4 $ 4 2 3 5 5 , 6 3 5 5 , 7 5 2 , 7 3 0 7 . 6 . 2 0 2 , 3 , 0 0 3 , 9 0 3 , 8 , 3 , 4 8 3 % 3 % 7 8 9 0 4 8 7 0 7 Criteria GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Collective bargaining agreements, and state laws and policies, contain specific clauses regarding overtime pay. State Parks’ General Retention Schedule for Payroll/Personnel Records specifies a four-year retention period for timesheets. California Department of Parks and Recreation Payroll Audit Recommendation We recommend that State Parks: • Conduct a review of overtime payments made during the past three years to ensure that the payments complied with collective bargaining agreements and state laws and policies; • Recover overpayments made to employees through an agreed-upon collection method in accordance with GC section 19838; and • Properly compensate those employees who were underpaid. We further recommend that, to prevent improper payments for overtime pay from recurring, State Parks: • Establish adequate internal controls to ensure that payments are accurate and comply with collective bargaining agreements and state laws and policies; • Provide adequate oversight to ensure that payroll transactions unit staff process only valid and authorized payments that comply with collective bargaining agreements and state laws and policies; and • Maintain supporting documentation for overtime payments pursuant to its retention policies. FINDING 5— State Parks lacked adequate segregation of duties within its payroll Improper and late transactions unit, as noted in Finding 1. It also lacked adequate controls payments, and over the processing of employee separation lump-sum pay, adequate supervisory review to ensure accurate and timely processing of separation missing lump-sum pay, and adequate controls to ensure that documentation was documentation for maintained to support separation lump-sum payments. separation lump- sum pay Payroll records show that State Parks processed separation lump-sum payments, totaling $8,147,692, for 2,003 employees between July 2018 and June 2021, as follows: Separation Lump-Sum Payment Type by Group Unit Amount Employees who were paid less than $50,000 (statistically sampled) 1,972 $5,321,442 Employees who were paid at least $50,000 (items examined 100%) 31 2,826,250 Total population 2,003 $8,147,692 Of the 1,972 employees who were paid less than $50,000 per employee, we randomly selected a statistical sample (as described in Appendix B) of 77 employees who received separation lump-sum payments, totaling $177,207. We also selected and examined the records of all 31 employees who were paid at least $50,000 per employee. Based on our examination of the records of these 108 employees, we found the following errors: • State Parks overpaid five of 108 (5%) employees by a total of $2,070 and underpaid 37 of 108 (34%) employees by a total of $4,311 because payroll transactions unit staff members miscalculated leave credits paid. In addition, State Parks lacked adequate supervisory review to -15- California Department of Parks and Recreation Payroll Audit ensure accurate processing of separation lump-sum pay. We projected the additional overpayments to be $12,849 and underpayments to be $91,401. • State Parks did not make separation lump-sum payments to 43 of 108 (40%) employees in a timely manner. • State Parks could not locate supporting documents (lump-sum calculation worksheets, leave balance statements, state calendars, and timesheets) for payments, totaling $984,336, made to 24 of 108 (22%) employees. We could not determine the validity, accuracy, and propriety of the payments made to these employees; or the completeness and accuracy of the leave accounting records. We projected the additional unsupported payments to be $1,430,437. If not mitigated, these control deficiencies leave State Parks at risk of making additional improper and late separation lump-sum payments, noncompliance with agreements and laws, and liability for late payments. Statistical sampling results The identified improper and unsupported payments have a net total of $46,569. We used a statistical sampling method to select the employees whose separation lump-sum payments we examined. We projected an additional $12,849 in overpayments and $91,400 in underpayments; we also projected an additional $1,430,437 in unsupported payments. The projected improper and unsupported payments totaled a net of approximately $1,351,886. Therefore, the identified and projected improper and unsupported payments totaled a net of approximately $1,398,455, consisting of $13,292 in overpayments, $94,549 in underpayments, and $1,479,712 in unsupported payments. The following table summarizes the results of our statistical sampling (amounts are rounded to the nearest dollar): -16- I D E P M I L P d e n t if ie d im p r o p e r a n d u n s u iv id e b y : S a m p le r r o r r a t e f o r p r o j e c t io n ( d if f o p u la t io n t h a t w a s s t a t is t ic a u lt ip ly b y : E r r o r r a t e f o r p r d e n t if ie d a n d p r o j e c t e d im p r ( d if f e r e n c e s d u e t o r o u n d in e s s : I d e n t if ie d im p r o p e r a n d r o j e c t e d im p r o p e r a n d u n s u p p o r t e d p e r e n c e s d lly s a m p le o j e c t io n o p e r a n d g ) u n s u p p o p p o r t e d p a y u e d u n r t e a y m e n t s , n t o r o u n d s u p p o r t e d p a y m e m e n t s , n e t in g d p n t s e t ) a y , n m e t e n t s , n e t $ 4 1 7 2 6 5 , 3 2 2 6 1 , 3 9 4 $ 1 , 3 5 6 7 . 1 . 8 6 1 , 5 , 2 2 8 , 4 2 8 , 4 , 5 , 8 6 0 % 4 % 5 6 8 9 7 2 5 9 6 Criteria GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. California Department of Parks and Recreation Payroll Audit GC section 19839 allows lump-sum payment for accrued eligible leave credits when an employee separates from state employment. Collective bargaining agreements include similar provisions regarding separation lump-sum pay. Collective bargaining agreements and state laws summarized in section 1703 of the California Department of Human Resources’ (CalHR) Human Resources Manual establish separation lump-sum pay requirements. State Parks’ General Retention Schedule for Payroll/Personnel Records specifies a four-year retention period for separation lump-sum pay supporting documentation. Recommendation We recommend that State Parks: • Conduct a review of separation lump-sum payments made during the past three years to ensure that the payments were accurate and in compliance with collective bargaining agreements and state law; • Recover overpayments made to separated employees in accordance with GC section 19838 and State Administrative Manual (SAM) sections 8291, 8291.1, and 8293; and • Properly compensate those employees who were underpaid. We further recommend that, to prevent inaccurate and untimely processing of separation lump-sum pay from recurring, State Parks: • Establish adequate controls to ensure that employee leave balances are reduced in a timely manner after separation lump-sum payments are made; • Establish adequate controls to ensure that separation lump-sum payments are calculated accurately; • Establish adequate controls to ensure that separation lump-sum payments are made in a timely manner; and • Maintain supporting documentation for separation lump-sum payments pursuant to its retention policies. FINDING 6— State Parks’ leave accounting records show 3,235 employees with unused Excessive vacation vacation or annual leave credits at October 1, 2020. Of those employees, 255 exceeded the limit set by collective bargaining agreements and state and annual leave regulations. These employees accumulated 65,283 hours of excess balances vacation and annual leave, with a value of at least $2,740,563 as of October 1, 2020. State Parks failed to implement controls to ensure that it adhered to the requirements. This estimated liability does not adjust for -17- California Department of Parks and Recreation Payroll Audit salary rate increases and additional leave credits.2 Accordingly, we expect that the amount needed to pay for this liability will be higher. Collective bargaining agreements and state regulations limit the amount of vacation and annual leave that state employees may accumulate. The limit on leave balances helps state agencies to manage leave balances and control the State’s liability for accrued leave credits. State agencies may allow employees to carry a higher leave balance only under limited circumstances. For example, an employee may not be able to reduce accrued vacation or annual leave hours below the limit due to business needs. When an employee’s leave accumulation exceeds or is projected to exceed the limit, state agencies should work with the employee to develop a written plan to reduce leave balances below the applicable limit. On October 20, 2020, CalHR directed departments to immediately suspend policies that require leave balances to be reduced below the limit, and that require employees to implement leave-reduction plans. This suspension was in effect until the 2020 Personal Leave Program ended on June 30, 2021. Therefore, we examined employees’ vacation and annual leave balances as of October 1, 2020. We examined the records of the 255 employees with excess vacation or annual leave to determine whether State Parks had complied with collective bargaining agreements and state regulations. We found the following errors: • State Parks could not demonstrate that, if the employees were unable to reduce their vacation and annual leave balances, it had allowed the employees to maintain excess balances because of the extenuating circumstances specified in the agreements and regulations. • State Parks had no plans in place during the audit period for the employees to reduce leave balances below the limit. The 255 employees accumulated 65,283 hours of excess vacation and annual leave balances, with a value of at least $2,740,563. If State Parks does not take action to reduce the excessive leave balances, the liability for accrued vacation and annual leave will likely increase because most employees will receive salary increases or use other non- compensable leave credits instead of vacation or annual leave, thus increasing their vacation or annual leave balances. The state agency responsible for paying these leave balances may face a cash flow problem if a significant number of employees with excessive vacation or annual leave balances separate from state service. Normally, state agencies are not budgeted to make these separation lump-sum payments. However, the State’s current practice dictates that the state agency that last employed an employee pays for that employee’s 2 Most state employees receive pay rate increases every year pursuant to state laws and/or collective bargaining agreements until they reach the top of their pay scale, or promote into a higher-paying position. In addition, when an employee’s accumulated leave balances upon separation are calculated for lump-sum pay, the employee is credited with additional leave credits equal to the amount that the employee would have earned had the employee taken time off and not separated from state service. -18- California Department of Parks and Recreation Payroll Audit separation lump-sum payment, regardless of where the employee accrued the leave balance. Collective bargaining agreements and state regulations limit the amount of vacation and annual leave that most state employees may accumulate to no more than 80 days (640 hours). Recommendation We recommend that State Parks: • Implement controls, including existing policies and procedures, to ensure that its employees’ vacation and annual leave balances are maintained within levels allowed by collective bargaining agreements and state regulations; • Conduct ongoing monitoring of controls to ensure that they are implemented and operating effectively; and • Participate in leave buy-back programs if the State offers such programs and funds are available. State Parks lacked adequate segregation of duties within its payroll FINDING 7— transactions unit, as noted in Finding 1. It also lacked adequate controls Improper over the processing of leave buy-back pay, and to ensure that supporting payments and documentation was maintained to support leave buy-back payments. missing documentation A leave-buy back occurs when an employee receives payment at the for leave buy- regular salary rate in exchange for accrued vacation, annual leave, back personal leave, personal holiday, and/or holiday credits. CalHR authorized leave buy-backs for excluded employees in fiscal year 2017-18 and fiscal year 2018-19. It also provided the State’s policies and procedures regarding cash-out of vacation and annual leave. Payroll records show that State Parks processed 789 leave buy-back transactions, totaling $2,070,503, between July 2018 and June 2021. We randomly selected a statistical sample (as described in Appendix B) of 105 transactions, totaling $267,781. Based on our examination of these transactions, we found the following errors: • State Parks underpaid two of 105 (2%) transactions by $586 because payroll transactions unit staff members used incorrect pay rates. State Parks also lacked adequate supervisory review to ensure accurate processing of leave buy-back. We projected the additional underpayments to be $3,949. • State Parks lacked supporting documentation (leave buy-back forms and calculations) associated with seven of 105 (7%) transactions totaling $12,368. Without the required documentation, we could not determine the validity, accuracy, and propriety of the payments made to the employees or the completeness and accuracy of the leave accounting records. We projected the additional unsupported payments to be $83,263. If not mitigated, these control deficiencies leave State Parks at risk of making additional improper leave buy-back payments. -19- California Department of Parks and Recreation Payroll Audit Statistical sampling results The identified improper and unsupported payments have a net total of $11,782. We used a statistical sampling method to select the leave buy-back transactions that we examined. We projected an additional $3,949 in underpayments and $83,263 in unsupported payments. The projected improper and unsupported payments totaled a net of approximately $79,314. Therefore, the identified and projected improper and unsupported payments totaled a net of approximately $91,096, consisting of $4,535 in underpayments and $95,631 in unsupported payments. The following table summarizes the results of our statistical sampling (amounts are rounded to the nearest dollar): -20- I D E P M I p L P d e n t if ie d im p r o p e r a n d u n s u p p o r t e d p iv id e d b y : S a m p le r r o r r a t e f o r p r o j e c t io n ( d if f e r e n c e s d o p u la t io n t h a t w a s s t a t is t ic a lly s a m p le u lt ip ly b y : E r r o r r a t e f o r p r o j e c t io n d e n t if ie d a n d p r o j e c t e d im p r o p e r a n d a y m e n t s , n e t ( d if f e r e n c e s d u e t o r o u n e s s : I d e n t if ie d im p r o p e r a n d u n s u p p o r o j e c t e d im p r o p e r a n d u n s u p p o r t e d p a y m e n t s , n u e t o r o u n d d u n s u p p o r t e d in g ) r t e d p a y m e a y m e n t s , n e t in d n t e t g s ) , n e t $ 1 2 6 4 2 , 0 7 4 9 1 $ 7 1 7 . 0 . 1 1 9 , 7 , 7 4 0 , 5 4 0 , 0 , 7 , 3 8 8 % 0 % 9 8 1 2 1 3 6 2 4 Criteria GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Title 2, California Code of Regulations, section 599.744 provides that CalHR may also authorize a leave buy-back program for employees excluded from collective bargaining. Collective bargaining agreements between the State and various bargaining units allow for the annual cash-out of a certain number of hours of accumulated vacation and annual leave if funds are available. State Parks’ General Retention Schedule for Payroll/Personnel Records specifies a four-year retention period for leave buy-back documentation. Recommendation We recommend that State Parks: • Establish adequate internal controls to ensure that leave buy-back payments are accurate; and California Department of Parks and Recreation Payroll Audit • Maintain supporting documentation for payments pursuant to its retention policies. FINDING 8— State Parks lacked adequate segregation of duties within its payroll Failure to collect transactions unit, as noted in Finding 1. It also lacked adequate controls outstanding salary over salary advances to ensure that advances were recovered in a timely advances manner in accordance with state law and policies. Twenty-eight salary advances, totaling $69,333 remained outstanding as of June 30, 2021. At June 30, 2021, State Parks’ accounting records show 28 outstanding salary advances, totaling $69,333. We examined these salary advances and found that all 28 had been outstanding for more than 90 days. The oldest uncollected salary advance was outstanding for over three years. We noted that State Parks had not initiated timely collection efforts for any of the salary advances that we examined. Salary advances are more difficult to collect after an employee leaves state service, and they may become uncollectable if not collected within three years. If not mitigated, these control deficiencies leave State Parks at risk of failing to collect further salary advances. GC section 19838 and SAM sections 8291, 8291.1, 8293, and 8293.2 describe the State’s collection policies and procedures, which require the collection of salary advances in a timely manner and maintenance of proper records of collection efforts. Specifically, GC section 19838(d) and SAM section 8293.2 require that actions to recover overpayments begin within three years of the date of overpayment. Recommendation We recommend that State Parks ensure that it collects salary advances in a timely manner, pursuant to GC section 19838 and SAM sections 8291, 8291.1, 8293, and 8293.2. FINDING 9— State Parks lacked adequate segregation of duties within its payroll Improper transactions unit, as noted in Finding 1. It also lacked adequate controls transactions and over the processing of holiday credit transactions, and adequate controls to ensure that supporting documentation was maintained to support missing holiday credit payments. We identified approximately $27,407 in documentation for improper and unsupported holiday credit transactions. holiday credit Leave accounting records show that State Parks processed 16,564 accrual transactions of holiday credit. Of those transactions, 286—with an estimated value of $124,298—involved unusual credits. Of the 286 transactions, we judgmentally selected and examined four transactions, with an estimated value of $727, because they involved holiday credits granted to employees during months with no holidays. We found that in all four transactions, the holiday credits had been improperly granted to employees. Of the remaining 282 transactions—with an estimated value of $123,571—that involved unusual credits, we judgmentally selected -21- California Department of Parks and Recreation Payroll Audit 35 transactions, with an estimated value of $27,407. Based on our examination of these transactions, we found the following errors: • State Parks granted improper holiday credits in 24 transactions, with an estimated value of $6,708, because payroll transactions unit staff members granted the employees with holiday credits that exceeded the actual earned credits. • State Parks lacked supporting documentation for 10 transactions with an estimated value of $7,990. We could not determine the validity, accuracy, and propriety of the holiday credits granted to the employees; or the completeness and accuracy of the leave accounting records. If not mitigated, this control deficiency leaves State Parks at risk of granting additional improper holiday credits. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. GC section 19853 specifies the compensation that eligible employees are entitled to receive when required to work on a qualifying holiday. The collective bargaining agreement between the State and Bargaining Unit 1 includes similar provisions regarding holiday credit and holiday pay for represented employees. State Parks’ General Retention Schedule for Payroll/Personnel Records specifies a four-year retention period for timesheets. Recommendation We recommend that State Parks: • Conduct a review of holiday credits granted during the past three years to ensure that credits are properly supported with documentation, and complied with collective bargaining agreements and state law; and • Correct any improper holiday credits in the State’s leave accounting system. FINDING 10— State Parks lacked adequate segregation of duties within its payroll transactions unit, as noted in Finding 1. It also lacked adequate controls to Maximum number of ensure that temporary intermittent employees, permanent intermittent work hours for employees, and retired annuitants did not exceed statutory and regulatory intermittent limits on hours worked per year. Forty-one employees were paid for employees and 25,307 hours in excess of the statutory and regulatory limits; these “extra retired annuitants time” hours had a value of $534,813. exceeded (Repeat Finding) Payroll records show that State Parks processed regular and overtime payments for temporary intermittent employees, permanent intermittent -22- California Department of Parks and Recreation Payroll Audit employees, and retired annuitants between July 1, 2018, and June 30, 2021, as follows: Regular and Overtime Payment by Employment Basis Unit Amount Temporary intermittent employees (judgmentally selected 20 employees) 4,309 $102,388,477 Permanent intermittent employees (judgmentally selected 20 employees) 386 32,821,234 Retired annuitants (judgmentally selected 20 employees) 91 5,365,671 Total population 4,786 $140,575,382 Temporary intermittent employees Of the 4,309 temporary intermittent employees, we judgmentally selected and examined the records of 20 employees who completed the highest number of work hours, with a value of $1,895,544, during the audit period. Based on our examination, we found that all 20 employees exceeded the limit of nine months in 12 consecutive months for temporary assignments, or exceeded the 1,500-hour limit per year. The 20 employees were paid for a total of 17,142 “extra time” hours, with value of $304,074. Permanent intermittent employees We also judgmentally selected and examined the records of 20 of the 386 permanent intermittent employees who completed the highest number of work hours, with a value of $3,269,594, during the audit period. Based on our examination, we found that 16 employees exceeded the 1,500-hour limit per year or the approved extension of up to 2,040 hours per year. The 16 employees were paid for a total of 6,194 “extra time” hours, with a value of $143,514. Retired annuitants In addition, we judgmentally selected and examined the records for 20 of the 91 retired annuitants who completed the highest number of work hours, with a value of $1,801,038, during the audit period. Based on our examination, we found that five employees exceeded the 960-hour limit per fiscal year. The five employees were paid for a total of 1,971 “extra time” hours, with a value of $87,225. If not mitigated, these control deficiencies leave State Parks at risk of making additional improper regular and overtime payments to temporary intermittent employees, permanent intermittent employees, and retired annuitants. Criteria GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. -23- California Department of Parks and Recreation Payroll Audit Title 2, California Code of Regulations, section 265.1 states, in part: . . . (b) Except as provided in subdivision (d), the 9-month in 12-consecutive months working limit on temporary appointments, as set forth in Article VII, section 5, of the California Constitution, shall be counted on a daily basis with every 21 days worked counting as one month or 189 days equaling 9 months. When counting 189 days, every day worked, including partial days worked and paid absences, is counted. The hours worked in one day is not limited by this rule. The 12-consecutive month timeframe begins by counting the first pay period worked as the first month of the 12-consecutive month timeframe. The employee shall serve no longer than 189 days in a 12 consecutive month period. A new 189-days working limit in a 12-consecutive month timeframe may begin in the month immediately following the month that marks the end of the previous 12-consecutive month timeframe or any subsequent month. (c) The 189-days working limit set forth in subdivision (b) shall be calculated per-employee, not per-agency. (d) For student, youth, and seasonal classifications, a maximum work- time limit of 1500 hours within 12 consecutive months may be used rather than the 189-day calculation set forth in subdivision (b). . . . The “Statement” section of Policy Number 1212, “Temporary Appointments (TAU),” in CalHR’s Human Resources Manual states, in part: . . . . The following are limitations, restrictions, or requirements to be considered for using the TAU process: • Departments are required to develop a corresponding examination for the TAU classification within nine months of making the temporary appointment. • The TAU incumbent is required to examine for the classification. If his/her score is too low to be in a reachable rank or if he/she fails the test, the incumbent’s temporary appointment must be terminated immediately. • The time a person can serve in a temporary appointment must not exceed 9 months in 12-consecutive months or 189 days of work. • When serving in a TAU appointment, the incumbent does not acquire probationary or permanent status or rights. The “1,500-Hour Limitation” section of Policy Number 1202, “Intermittent Employees,” in CalHR’s Human Resources Manual states, in part: Intermittent appointments are not to be used to fill full-time or part-time positions. Such use would constitute illegal circumvention of these eligible lists. To help ensure intermittent appointments are not made on a full-time basis, a maximum of 1,500 hours has been placed on the number of hours which an intermittent employee may work in 12 months. An intermittent employee may work up to 1,500 hours in any calendar year. The number of hours and schedule of work shall be determined based upon the operational needs of each department. Hours worked by intermittent employees must be tracked carefully. . . . -24- California Department of Parks and Recreation Payroll Audit The “Statement” section of Policy Number 1206, “Retired Annuitants” in CalHR’s Human Resources Manual states, “Appointments shall not exceed a maximum of 960 hours in any fiscal year (July–June) without reinstatement, loss or interruption of benefits.” GC section 21224(a), states, in part: . . . A retired annuitant appointed pursuant to this section shall not work more than 960 hours each fiscal year regardless of whether he or she works for one or more employers. Recommendation We recommend that State Parks: • Establish adequate internal controls to monitor the number of hours worked by temporary and permanent intermittent employees, and retired annuitants; and • Ensure that these employees do not exceed the statutory and regulatory limits on hours worked per year. FINDING 11— State Parks lacked adequate segregation of duties within its payroll Improper transactions unit, as noted in Finding 1. It also lacked adequate controls transactions and over the processing of NDI leave credits, and adequate controls to ensure that documentation was maintained to support NDI leave credit missing transactions. documentation for Non-Industrial Payroll records show that State Parks processed 50 NDI pay transactions, Disability totaling $17,689, between July 1, 2018 and June 30, 2021. We examined Insurance leave all 50 NDI pay transactions and found the following errors: credits (Repeat • State Parks granted improper leave credits in 12 of 50 (24%) Finding) transactions, with an estimated value of $4,151, because payroll transactions unit staff members granted leave credits to ineligible employees. • State Parks lacked timesheets associated with 34 of 50 (68%) transactions with an estimated value of $11,992. Without the required documentation, we could not determine the validity, accuracy, and propriety of the credits granted made to the employees; or the completeness and accuracy of the leave accounting records. If not mitigated, these control deficiencies leave State Parks at risk of granting additional improper leave credits. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. GC section 19883(a)(3) states: An employee shall not accrue sick leave or vacation credit or service credit for any other purpose during the period of receipt of disability benefits under this article, except, when provided by a rule or regulation adopted by the department, an employee receiving those benefits -25- California Department of Parks and Recreation Payroll Audit pursuant to Section 19879.1 may accrue these credits to the extent that annual leave or sick leave credits are used to supplement those benefits. State Parks’ General Retention Schedule for Payroll/Personnel Records specifies a four-year retention period for timesheets. Recommendation We recommend that State Parks: • Establish adequate internal controls to ensure that leave credits are only granted to eligible employees; • Make necessary corrections for improper leave credits in the State’s leave accounting system; and • Maintain supporting documentation for NDI transactions pursuant to its retention policies. FINDING 12— State Parks lacked adequate segregation of duties within its payroll Improper transactions unit, as noted in Finding 1, and lacked adequate controls over the processing of payments for OOC work. payments for out- of-class work Payroll records show that State Parks processed 586 payments, totaling (Repeat Finding) $370,653, for 91 employees’ OOC work for the period of July 1, 2018, through June 30, 2021. We judgmentally selected 10 employees, who were paid a total of $128,660, based on the amounts that they received for OOC work. The 10 employees include four employees who received the highest payments, three who received mid-range payments, and three who received low-range payments. Based on our examination of the employees’ records, we found that State Parks had paid two of the 10 (20%) employees a total of $457 for hours worked before seeking approval for the OOC assignments. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. The “Out-of-Class Procedures” section of State Parks’ “Out-of-Class (OOC) Assignment Procedural Guide,” state, in part: . . . Requests must be approved in advance by the District Superintendent (or his/her designee), Division Chief, and the Personnel Services Section. No employee should begin working in an OOC assignment without this prior approval. Requests cannot be backdated. . . . Again, all OOC assignments must be approved by the Personnel Officer prior to the effective date of the OOC assignment. No employee may begin working in an OOC assignment until the approval memo from Personnel is released. Backdating is not permitted. . . . Recommendation We recommend that State Parks implement controls, including existing procedures, to ensure that its employees only begin OOC work after their assignments are approved. -26- California Department of Parks and Recreation Payroll Audit Appendix A— Summary of Prior Audit Findings The following table shows the implementation status of the California Department of Parks and Recreation’s corrective actions related to the findings contained in our review report dated December 18, 2012. Prior Review Prior Review Implementation Finding Finding Title Status Number 1 Weaknesses in internal and accounting controls for out-of-class pay Not implemented; see assignment, and violations of DPR [Department of Parks and Finding 12 Recreation] and State policies 2 Inappropriate employee input access to the State’s payroll system Not implemented; see Finding 2 3 Personal Leave Program (furlough) hours were inappropriately Not implemented; see given to individuals on Non-Industrial Disability Leave status Finding 11 4 Retired annuitants, temporary appointment intermittent employees, Not implemented; see and permanent intermittent employees exceeded the maximum Finding 10 number of hours per year allowed by CalPERS [California Public Employees’ Retirement System] and the Personnel Management Policy and Procedures Manual -A1- California Department of Parks and Recreation Payroll Audit Appendix B— Audit Sampling Methodology This Appendix outlines our audit sampling application for all audit areas where statistical sampling was used. We used attributes sampling for tests of compliance. We chose this sample design because: • It follows the American Institute of Certified Public Accountants (AICPA) guidelines; • It allowed us to achieve our objectives for tests of compliance in an efficient and effective manner; • Audit areas included high volumes of transactions; • We planned to project the results to the intended population; and • We had the collective knowledge and skills to plan and perform the sampling plan and design. We conducted compliance testing on samples chosen by computer-generated simple random selection. For populations of 250 items or more, we determined the sample size using a calculator with a binomial distribution. As stated in Technical Notes on the AICPA Audit Guide: Audit Sampling (March 1, 2012), page 5, although the hypergeometric distribution is the correct distribution to use for attributes sample sizes, the distribution becomes unwieldy for large populations unless suitable software is available. Therefore, more convenient approximations are frequently used instead. The confidence level was 90.00%; the tolerable error rate was 5.00%; and the expected error rates were 2.00 (1.75%) for regular pay and leave buy-back, and 1.00 (1.25%) for overtime pay and separation lump- sum pay. Pursuant to the AICPA’s Audit Guide: Audit Sampling (December 1, 2019 edition), pages 131– 132, the expected error rate is the expected number of errors planned for in the sample. It is derived by multiplying the expected error rate by the sample size. The expected number of errors in the sampling tables on pages 135–136 was rounded upward, e.g., 0.2 errors become 1.0 error. Results were projected to the intended (total) population. Audit Population Population Sampling Finding Area (Unit) (Dollar) Unit Sample Size Number Regular pay 151,892 $483,519,737 Transaction 105 3 Overtime pay 19,409 8 ,636,938 Transaction 77 4 Separation lump-sum pay 1,972 5,321,442 Employee 77 5 Leave buy-back 789 2,070,503 Transaction 105 7 -B1- California Department of Parks and Recreation Payroll Audit Attachment— California Department of Parks and Recreation’s Response to Draft Audit Report -B1- State Controller’s Office Division of Audits Post Office Box 942850 Sacramento, CA 94250 www.sco.ca.gov S22-PAR-0005