California State Polytechnic University, Pomona Payroll Audit

CALIFORNIA STATE POLYTECHNIC UNIVERSITY, POMONA Audit Report PAYROLL AUDIT March 1, 2017, through February 29, 2020 M M. C ALIA OHEN C ALIFORNIA S TATE C ONTROLLER December 2024 MALIA M. COHEN CALIFORNIA STATE CONTROLLER December 23, 2024 Dr. Soraya Coley, President California State Polytechnic University, Pomona 3801 West Temple Avenue Pomona, CA 91768 Dear Dr. Coley: The State Controller’s Office audited the California State Polytechnic University, Pomona’s payroll process and transactions for the period of March 1, 2017, through February 29, 2020. The audit was conducted pursuant to Government Code sections 12476 and 12410. California State Polytechnic University, Pomona management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. If you have any questions regarding this report, please contact Roochel Espilla, Chief, State Agency Audits Bureau, by telephone at 916-323-5744. Thank you. Sincerely, Original signed by Kimberly A. Tarvin, CPA Chief, Division of Audits KAT/rs MAILING ADDRESS P.O. Box 942850, Sacramento, CA 94250 SACRAMENTO 3301 C Street, Suite 700, Sacramento, CA 95816 | 916.324.8907 LOS ANGELES 901 Corporate Center Drive, Suite 200, Monterey Park, CA 91754 | 323.981.6802 Dr. Soraya Coley December 23, 2024 Page 2 of 2 Copy: Nicole Hawkes, Chief of Staff California State Polytechnic University, Pomona Kimberly Allain, Senior Associate Vice President Employee and Organizational Development and Advancement California State Polytechnic University, Pomona Ysabel Trinidad, Vice President for Administrative Affairs California State Polytechnic University, Pomona Michelle Cardona, Associate Vice President for Financial Services California State Polytechnic University, Pomona Lindsay Roussopulos, Payroll Manager California State Polytechnic University, Pomona Joice Xiong, Director Internal Audit Department California State Polytechnic University, Pomona Mildred García, Ed.D., Chancellor California State University Albert A. Liddicoat, Ph.D., Interim Vice Chancellor Human Resources California State University Vlad Marinescu, Chief Audit Officer California State University Sharon Best, Senior Manager Investigations and Intergovernmental Audits California State University Lisa Dean, Acting Chief Personnel and Payroll Services Division State Controller’s Office Veronica Encinas, Bureau Chief Personnel and Payroll Services Division State Controller’s Office MAILING ADDRESS P.O. Box 942850, Sacramento, CA 94250 SACRAMENTO 3301 C Street, Suite 700, Sacramento, CA 95816 | 916.324.8907 LOS ANGELES 901 Corporate Center Drive, Suite 200, Monterey Park, CA 91754 | 323.981.6802 California State Polytechnic University, Pomona Payroll Audit Contents Audit Report Summary ............................................................................................................................ 1 Background ........................................................................................................................ 1 Audit Authority.................................................................................................................. 1 Objectives, Scope, and Methodology ............................................................................... 1 Conclusion .......................................................................................................................... 3 Follow-up on Prior Audit Findings .................................................................................. 4 Views of Responsible Officials .......................................................................................... 4 Restricted Use .................................................................................................................... 4 Schedule—Summary of Audit Results ................................................................................. 5 Findings and Recommendations ........................................................................................... 6 Appendix—Audit Sampling Methodology ........................................................................... A1 Attachment—California State Polytechnic University, Pomona’s Response to Draft Audit Report California State Polytechnic University, Pomona Payroll Audit Audit Report Summary The State Controller’s Office (SCO) audited the California State Polytechnic University, Pomona’s (Cal Poly Pomona) payroll process and transactions for the period of March 1, 2017, through February 29, 2020. Cal Poly Pomona management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. Our audit determined that Cal Poly Pomona did not: • Maintain adequate and effective internal controls over certain aspects of its payroll process, as described in Findings 1 though 6; • Process payroll and payroll-related disbursements accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures in certain instances, as described in Findings 3, 4, and 6; or • Administer salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures, as described in Finding 5. Background In 1979, the State of California adopted collective bargaining for state employees. This created a significant workload increase for the SCO’s Personnel and Payroll Services Division (PPSD), as PPSD was the State’s centralized payroll processing center for all payroll-related transactions. PPSD decentralized the processing of payroll, allowing state agencies and departments to process their own payroll-related transactions. Periodic audits of the decentralized payroll processing at state agencies and departments ceased due to the budget constraints in the late 1980s. In 2013, the California State Legislature reinstated these payroll audits to gain assurance that state agencies and departments maintain adequate internal control over the payroll function, provide proper oversight of their decentralized payroll processing, and comply with various state laws and regulations regarding payroll processing and related transactions. Audit Authority We conducted this audit in accordance with Government Code (GC) section 12476, which authorizes the SCO to audit the State’s payroll system, the State Pay Roll Revolving Fund, and related records of state agencies within the State’s payroll system. In addition, GC section 12410 provides the SCO with general authority to audit the disbursement of state money for correctness, legality, and sufficient provisions of law for payment. Objectives, Scope, Our audit objectives were to determine whether Cal Poly Pomona: and Methodology • Maintained adequate and effective internal controls over its payroll process; -1- California State Polytechnic University, Pomona Payroll Audit • Processed payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures; and • Administered salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. The audit covered the period from March 1, 2017, through February 29, 2020. The audit population consisted of payroll transactions totaling $512,390,209, as quantified in the Schedule. To achieve our audit objectives, we performed the following procedures: • We reviewed state and Cal Poly Pomona policies and procedures related to the payroll process to understand Cal Poly Pomona’s methodology for processing various payroll and payroll-related transactions. • We interviewed Cal Poly Pomona payroll personnel to understand Cal Poly Pomona’s methodology for processing various payroll and payroll-related transactions, determine the employees’ level of knowledge and ability relating to payroll transaction processing, and gain an understanding of existing internal control over the payroll process and systems. • We selected transactions recorded in the State’s payroll database using statistical sampling, as outlined in the Appendix, and targeted selection based on risk factors and other relevant criteria. • We analyzed and tested the selected transactions and reviewed relevant files and records to determine the accuracy of payroll and payroll-related payments; accuracy of leave transactions; adequacy and effectiveness of internal control over the payroll process; and compliance with collective bargaining agreements and state laws, regulations, policies, and procedures. • We reviewed salary advances to determine whether Cal Poly Pomona administered and recorded them in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. • We assessed the reliability of computer-processed data for payroll and payroll-related transactions by interviewing Cal Poly Pomona officials knowledgeable about the data; reviewing existing information about the data and the system that produced it; and tracing data to source documents, based on statistical sampling and targeted selection. We determined that the data was sufficiently reliable for the purposes of this report. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. -2- California State Polytechnic University, Pomona Payroll Audit Conclusion Our audit determined that Cal Poly Pomona did not maintain adequate and effective internal controls over its payroll process;1 did not process payroll and payroll-related disbursements accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures; and did not administer salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. We found deficiencies in internal control over the payroll process that we consider to be material weaknesses, and instances of noncompliance with the requirements of collective bargaining agreements and state laws, regulations, policies, and procedures. The material weaknesses and instances of noncompliance are as follows: • Cal Poly Pomona had inadequate segregation of duties and a lack of compensating controls over payroll transactions (see Finding 1). • Eight of 26 (31%) employees whose records we examined during our audit had inappropriate access to the State’s payroll system (see Finding 2). • Cal Poly Pomona did not consistently maintain timesheets for regular pay. Based on our audit testing, we estimated that 9% of the timesheets associated with regular pay during the audit period were not retained. We identified $3,402 and projected an additional $3,387,164 in unsupported payments (see Finding 3). • Cal Poly Pomona overpaid one of the 105 (1%) overtime pay transactions that we examined by $1,236 and we projected an additional $35,153 in overpayments. In addition, Cal Poly Pomona did not consistently maintain timesheets for overtime pay. Based on our audit testing, we estimated that 15% of the timesheets associated with the audit period were not retained. We identified $6,778 and projected an additional $192,785 in unsupported payments (see Finding 4). • Cal Poly Pomona had inadequate controls to ensure that salary advances were administered in accordance with requirements and 1 In planning and performing our audit of compliance, we considered Cal Poly Pomona’s internal control over compliance with collective bargaining agreements and state laws, regulations, policies, and procedures to determine the auditing procedures that were appropriate under the circumstances for the purpose of providing a conclusion on compliance, and to test and report on internal control over compliance. Our consideration of internal control over compliance was for the limited purpose described in the first paragraph of this footnote; it was not designed to identify all deficiencies in internal control over compliance that might be material weaknesses or significant deficiencies. As discussed in this section, we identified certain deficiencies in internal control over compliance that we consider to be material weaknesses. A deficiency in internal control over compliance exists when the design, implementation, or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A material weakness in internal control over compliance is a deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. A significant deficiency in internal control over compliance is a deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention from those charged with governance. -3- California State Polytechnic University, Pomona Payroll Audit collected in a timely manner. Fifteen salary advances, totaling $9,687, remained outstanding as of February 29, 2020 (see Finding 5). • Cal Poly Pomona did not make timely payments to 15 of the 105 (14%) employees whose separation lump-sum payments we examined (see Finding 6). Follow-up on We have not previously conducted an audit of Cal Poly Pomona’s payroll process and transactions. Prior Audit Findings Views of We issued a draft audit report on September 12, 2024. Cal Poly Pomona’s representative responded by letter dated October 18, 2024, agreeing with Responsible the audit results. This final audit report includes Cal Poly Pomona’s Officials response as an attachment. Restricted Use This audit report is solely for the information and use of Cal Poly Pomona, the California State University, and the SCO; it is not intended to be, and should not be, used by anyone other than these specified parties. This restriction is not intended to limit distribution of this audit report, which is a matter of public record and is available on the SCO website at www.sco.ca.gov. Original signed by Kimberly A. Tarvin, CPA Chief, Division of Audits December 23, 2024 -4- California State Polytechnic University, Pomona Payroll Audit Schedule— Summary of Audit Results March 1, 2017, through February 29, 2020 -5- S S R O S S E S A u d it A r e a T e s e g r e g a tio n o f d u tie y s te m a c c e s s e g u la r p a y v e r tim e p a y a la r y a d v a n c e e p a r a tio n lu m p - s u m m e r g e n c y p a y e ttle m e n t p a y te d s p a y N T S S T S S S M e th o S e le c /A a r g e te ta tis tic ta tis tic a r g e te ta tis tic ta tis tic ta tis tic d o tio n d a l a l d a l a l a l f N u m b e r o f U n its o f P o p u la tio n N /A 2 6 1 0 5 ,0 0 7 3 ,0 7 5 5 9 4 7 4 2 ,9 8 9 2 ,8 2 9 D o lla r A m o u o f P o p u la tio N N $ 4 8 2 ,9 2 2 ,6 2 ,5 8 8 ,3 7 0 ,3 2 ,9 0 5 ,4 1 4 ,7 4 6 ,0 9 ,1 5 7 ,3 $ 5 1 2 ,3 9 0 ,2 n t n /A /A 2 7 2 7 9 9 1 5 8 4 5 7 0 9 N S E N /A 2 6 1 0 5 1 0 5 5 9 1 0 5 1 0 5 1 0 5 u m b e le c x a m E m T r a T r a T r a E m T r a T r a e r o f tio n s in e d p lo y e e s n s a c tio n n s a c tio n n s a c tio n p lo y e e s n s a c tio n n s a c tio n s s s s s D o lla r A m o u n t o f S e le c tio n s E x a m in e d N /A N /A $ 4 8 4 ,5 5 1 8 7 ,9 1 3 7 0 ,3 9 9 5 3 6 ,8 9 1 5 9 7 ,2 8 3 3 4 5 ,9 2 1 $ 2 ,1 2 2 ,9 5 8 D N e t T o ta l o lla r A m o u n t o f I d e n tif ie d I m p r o p e r C o s ts N /A N /A $ - 1 ,2 3 6 9 ,6 8 7 - - - $ 1 0 ,9 2 3 N e t T o ta l D o lla r A m o u n t o f P r o je c te d I m p r o p e r C o s ts a n d I d e n tif ie d a n d P r o je c te d U n s u p p o r te d C o s ts N /A N /A $ 3 ,3 9 0 ,5 6 6 2 3 4 ,7 1 6 - - - - $ 3 ,6 2 5 ,2 8 2 F N in d u m 1 2 3 4 5 6 in b g e r California State Polytechnic University, Pomona Payroll Audit Findings and Recommendations FINDING 1— Cal Poly Pomona lacked adequate segregation of duties within its payroll transactions unit to ensure that only valid and authorized payroll Inadequate transactions were processed. Cal Poly Pomona also failed to implement segregation of other controls to compensate for this risk. duties and lack of compensating Our audit found that Cal Poly Pomona payroll transactions unit staff controls over performed conflicting duties. Staff members performed multiple steps in payroll processing payroll transactions, including entering data into the State’s transactions payroll system; auditing employee timesheets; reconciling payroll, including reconciling system output to source documentation; reporting payroll exceptions; and processing adjustments. For example, staff members keyed in regular and overtime pay, and reconciled the master payroll, overtime, and other supplemental warrants. Cal Poly Pomona failed to demonstrate that it implemented compensating controls to mitigate the risks associated with such a deficiency. We found no indication that these functions were subjected to periodic supervisory review. The lack of adequate segregation of duties and compensating controls has a pervasive effect on Cal Poly Pomona’s payroll process, and impairs the effectiveness of other controls by rendering their design ineffective or by keeping them from operating effectively. These control deficiencies, in combination with other deficiencies discussed in Findings 2 through 6, represent a material weakness in internal control over the payroll process such that there is a reasonable possibility that a material noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. Good internal control practices require that the following functional duties be performed by different work units, or at minimum, by different employees within the same unit: • Recording transactions – This duty refers to the record-keeping function, which is accomplished by entering data into a computer system. • Authorization to execute – This duty belongs to individuals with authority and responsibility to initiate and execute transactions. • Periodic review and reconciliation of actual payments to recorded amounts – This duty refers to making comparisons of information at regular intervals and taking action to resolve differences. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including proper segregation of duties and an effective system of internal review. Adequate segregation of duties reduces the likelihood that fraud or error will remain undetected by providing for separate processing by different individuals at various stages of a transaction and for independent reviews of the work performed. -6- California State Polytechnic University, Pomona Payroll Audit Recommendation We recommend that Cal Poly Pomona: • Separate conflicting payroll function duties to the greatest extent possible. Adequate segregation of duties will provide a stronger system of internal control whereby the functions of each employee are subject to the review of another. If it is not possible to segregate payroll functions fully and appropriately, Cal Poly Pomona should implement compensating controls. For example, if the payroll transactions unit staff member responsible for recordkeeping also performs a reconciliation process, then the supervisor should perform and document a detailed review of the reconciliation to provide additional control over the assignment of conflicting functions. Compensating controls may also include dual authorization requirements and documented reviews of payroll system input and output; and • Develop formal procedures for performing and documenting compensating controls. FINDING 2— Cal Poly Pomona lacked adequate controls to ensure that only appropriate staff members had keying access to the State’s payroll system. Cal Poly Inappropriate Pomona inappropriately allowed eight employees keying access to the keying access to the State’s payroll system because Cal Poly Pomona did not immediately State’s payroll remove or modify keying access for the employees after the employees’ system separation from state service, transfer to another agency, or change in classification. The SCO maintains the State’s payroll system. The system is decentralized, thereby allowing employees of state agencies to access it. All state agencies are required to comply with PPSD’s Decentralized Security Program Manual (DSP Manual) in order to access the payroll system. The DSP Manual describes how state agencies can secure and protect the confidentiality and integrity of payroll data against misuse, abuse, and unauthorized use. We examined the records of 26 Cal Poly Pomona employees who had keying access to the State’s payroll system at various times between March 2017 and February 2020. Of the 26 employees, eight had inappropriate keying access to the State’s payroll system. Specifically, Cal Poly Pomona did not immediately remove or modify keying access for the eight employees after the employees’ separation from state service, transfer to another agency, or change in classification. For example, a Personnel Technician II left Cal Poly Pomona on November 16, 2019, but Cal Poly Pomona did not request to remove the employee’s access until January 3, 2020—48 days later. Cal Poly Pomona lacked periodic review of keying access granted to employees to ensure compliance with the DSP Manual. -7- California State Polytechnic University, Pomona Payroll Audit If not mitigated, this control deficiency leaves payroll data at risk of misuse, abuse, and unauthorized use. The December 2015 DSP Manual (“Access Requirements,” page 13) states, in part: The [State’s payroll system] contains sensitive and confidential information. Access is restricted to persons with an authorized, legal, and legitimate business requirement to complete their duties. . . . If the employee’s duties change, such that the need for access no longer exists, the access privilege MUST be removed or deleted immediately by a request submitted by the department/campus. The December 2015 DSP Manual (“Revocation and Deletion of User IDs,” page 17) states, in part: To prevent unauthorized use by a transferred, terminated or resigned employee's user ID, the Security Monitor must IMMEDIATELY submit all pages of the PSD125A [Security Authorization Form] to delete the user’s system access. Using an old user ID increases the chances of a security breach, which is a serious security violation. Sharing a user ID is strictly prohibited and a serious violation. . . . Recommendation We recommend that Cal Poly Pomona: • Update keying access to the State’s payroll system immediately after employees leave Cal Poly Pomona, transfer to another unit, or change classifications; and • Periodically review access to the system to verify that access complies with the DSP Manual. FINDING 3— Cal Poly Pomona lacked segregation of duties and compensating controls Missing timesheets within its payroll transactions unit, as noted in Finding 1, and lacked for regular pay adequate controls to ensure that timesheets were maintained to support regular pay. Payroll records show that Cal Poly Pomona processed 105,007 regular pay transactions, totaling $482,922,627 between March 2017 and February 2020. We randomly selected a statistical sample (as described in the Appendix) of 105 transactions, totaling $484,551. Based on our examination of these transactions, we found that Cal Poly Pomona lacked timesheets associated with nine of 105 (9%) transactions, totaling $3,402. Without the required documentation, we could not determine the validity, accuracy, and propriety of the payments made to the employees; or the completeness and accuracy of the leave accounting records. We projected the additional unsupported payments to be $3,387,164. If not mitigated, the control deficiencies leave Cal Poly Pomona at risk of making improper payments for regular pay. -8- California State Polytechnic University, Pomona Payroll Audit Statistical sampling results The identified regular pay with missing timesheets totaled $3,402. We used a statistical sampling method to select the regular pay transactions examined. We projected an additional $3,387,164 in unsupported payments. Therefore, the identified and projected unsupported payments totaled approximately $3,390,566. The following table summarizes the results of our statistical sampling (amounts are rounded to the nearest dollar): Identified unsupported payments $ 3,402 Divide by: Sample 484,551 Error rate for projection (differences due to rounding) 0.70% Population that was statistically sampled 482,922,627 Multiply by: Error rate for projection 0.70% Identified and projected unsupported payments (differences due to rounding) 3,390,566 Less: Identified unsupported payments 3,402 Projected unsupported payments $ 3,387,164 Criteria GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Collective bargaining agreements and Education Code section 89502 contain specific clauses regarding regular pay. Cal Poly Pomona’s General Retention Schedule for Payroll/Personnel Records specifies a four-year retention period for timesheets. Recommendation We recommend that Cal Poly Pomona maintain documentation supporting payments for regular pay, pursuant to its retention policies. Cal Poly Pomona lacked adequate segregation of duties within its payroll FINDING 4— transactions unit, as noted in Finding 1. It also lacked adequate controls Improper over the processing of overtime pay; adequate supervisory review to payments and ensure accurate processing of overtime pay; and adequate controls to missing timesheets ensure that timesheets were maintained to support overtime payments. for overtime pay Payroll records show that Cal Poly Pomona processed 3,075 overtime pay transactions, totaling $2,588,327, between March 2017 and February 2020. We randomly selected a statistical sample (as described in -9- California State Polytechnic University, Pomona Payroll Audit the Appendix) of 105 transactions, totaling $87,913. Based on our examination of these transactions, we found the following errors: • Cal Poly Pomona overpaid one transaction by $1,236 because the payroll transactions unit staff member incorrectly entered the overtime hours worked into the payroll system. In addition, Cal Poly Pomona lacked adequate supervisory review to ensure accurate processing of overtime pay. We projected an additional $35,153 in overpayments. • Cal Poly Pomona could not locate timesheets and supporting calculations for 16 of 105 (15%) overtime pay transactions, totaling $6,778. Without the required documentation, we could not determine the validity, accuracy, and propriety of the payments made to the employees; or the completeness and accuracy of leave accounting records. We projected an additional $192,785 in unsupported payments. If not mitigated, these control deficiencies leave Cal Poly Pomona at risk of making additional improper payments for overtime pay. Statistical sampling results The identified improper and unsupported overtime payments totaled $8,014. We used a statistical sampling method to select the overtime pay transactions that we examined. We projected an additional $35,153 in overpayments and $192,785 in unsupported payments. The projected improper and unsupported payments totaled $227,938. Therefore, the identified and projected improper and unsupported payments totaled approximately $235,952, consisting of $36,389 in overpayments and $199,563 in unsupported payments. The following table summarizes the results of our statistical sampling (amounts are rounded to the nearest dollar): Identified improper and unsupported payments $ 8,014 Divide by: Sample 87,913 Error rate for projection (differences due to rounding) 9.12% Population that was statistically sampled $ 2,588,327 Multiply by: Error rate for projection 9.12% Identified and projected improper and unsupported payments (differences due to rounding) 235,952 Less: Identified improper and unsupported payments 8,014 Projected improper and unsupported payments $ 227,938 Criteria GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. -10- California State Polytechnic University, Pomona Payroll Audit Collective bargaining agreements and Education Code section 89502 contain specific clauses regarding overtime pay. Cal Poly Pomona’s General Retention Schedule for Payroll/Personnel Records specifies a four-year retention period for timesheets. Recommendation We recommend that Cal Poly Pomona: • Conduct a review of overtime payments made during the past three years to ensure that the payments complied with collective bargaining agreements and state laws and policies; and • Recover any overpayments made to employees through an agreed- upon collection method in accordance with Chapter 28, “Accounts Receivable,” of the California State University (CSU) Legal Manual. We further recommend that, to prevent improper payments for overtime pay from recurring, Cal Poly Pomona: • Establish adequate internal controls to ensure that payments are accurate and comply with collective bargaining agreements and state laws; • Provide adequate oversight to ensure that payroll transactions unit staff process only valid and authorized payments that comply with collective bargaining agreements and state laws; and • Maintain supporting documentation for regular pay pursuant to its retention policies. FINDING 5— Cal Poly Pomona lacked adequate segregation of duties within its payroll Failure to collect transactions unit, as noted in Finding 1. It also lacked adequate controls outstanding salary over salary advances to ensure that advances were collected in a timely manner, in accordance with state law and policies. Fifteen salary advances, advances totaling $9,687, remained outstanding for more than 90 days as of February 29, 2020. At February 29, 2020, Cal Poly Pomona’s accounting records show 59 outstanding salary advances, totaling $70,399. We examined the 15 salary advances, totaling $9,687, that had been outstanding for more than 90 days. The 15 advances had been outstanding for an average of 483 days, and the oldest uncollected salary advance was outstanding for over four years. We noted that Cal Poly Pomona had not initiated timely collection efforts for any of the salary advances that we sampled. Salary advances are more difficult to collect after the employee leaves state service, and they may become uncollectable if not collected within three years. If not mitigated, these control deficiencies leave Cal Poly Pomona at risk of failing to collect further salary advances. -11- California State Polytechnic University, Pomona Payroll Audit Chapter 28, “Accounts Receivable,” of the CSU Legal Manual, and State Administrative Manual sections 8291, 8291.1, and 8293 describe the state and Cal Poly Pomona’s collection policies and procedures, which require the collection of salary advances in a timely manner, and maintenance of proper records of collection efforts. Recommendation We recommend that Cal Poly Pomona ensure that it collects salary advances in a timely manner, pursuant to Chapter 28, “Accounts Receivable,” of the CSU Legal Manual and State Administrative Manual sections 8291, 8291.1, and 8293. Cal Poly Pomona lacked adequate segregation of duties within its payroll FINDING 6— transactions unit, as noted in Finding 1, and lacked adequate controls to Late separation ensure timely separation lump-sum payments to employees. lump-sum payments Payroll records show that Cal Poly Pomona processed separation lump- sum payments, totaling $2,905,415, for 474 employees between March 2017 and February 2020. We randomly selected a statistical sample (as described in the Appendix) of 105 employees who received separation lump-sum payments, totaling $536,891. Based on our examination of the employees’ records, we found that 15 of the 105 (14%) employees were not paid in a timely manner. If not mitigated, these control deficiencies leave Cal Poly Pomona at risk of making additional late separation lump-sum payments, noncompliance with agreements and laws, and liability for late payments. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. Education Code section 89504 allows lump-sum payment for accrued eligible leave credits when an employee separates from state employment. Collective bargaining agreements include similar provisions regarding separation lump-sum pay. Recommendation We recommend that Cal Poly Pomona establish adequate controls to ensure timely separation lump-sum payments. -12- California State Polytechnic University, Pomona Payroll Audit Appendix— Audit Sampling Methodology This Appendix outlines our audit sampling application for all audit areas where statistical sampling was used. We used attributes sampling for tests of compliance. We chose this sample design because: • It follows the American Institute of Certified Public Accountants (AICPA) guidelines; • It allowed us to achieve our objectives for tests of compliance in an efficient and effective manner; • Audit areas included high volumes of transactions; • We planned to project the results to the intended population; and • We had the collective knowledge and skills to plan and perform the sampling plan and design. We conducted compliance testing on samples chosen by computer-generated simple random selection. For populations of 250 items or more, we determined the sample size using a calculator with a binomial distribution. As stated in Technical Notes on the AICPA Audit Guide: Audit Sampling (March 1, 2012), page 5, although the hypergeometric distribution is the correct distribution to use for attributes sample sizes, the distribution becomes unwieldy for large populations unless suitable software is available. Therefore, more convenient approximations are frequently used instead. The confidence level was 90.00%, the tolerable error rate was 5.00%, and the expected error rate was 2.00 (1.75%). Pursuant to the AICPA’s Audit Guide: Audit Sampling (December 1, 2019 edition), pages 131–132, the expected error rate is the expected number of errors planned for in the sample. It is derived by multiplying the expected error rate by the sample size. The expected number of errors in the sampling tables on pages 135–136 was rounded upward, e.g., 0.2 errors become 1.0 error. Results were projected to the intended (total) population. Audit Population Population Sampling Sample Finding Area (Unit) (Dollar) Unit Size Number Regular pay 1 05,007 $482,922,627 Transaction 105 3 Overtime pay 3,075 2 ,588,327 Transaction 105 4 Separation lump-sum pay 4 74 2 ,905,415 Employee 105 6 Emergency pay 2,989 14,746,084 Transaction 105 Settlement pay 2,829 9 ,157,357 Transaction 105 -A1- California State Polytechnic University, Pomona Payroll Audit Attachment— California State Polytechnic University, Pomona’s Response to Draft Audit Report State Controller’s Office Division of Audits Post Office Box 942850 Sacramento, CA 94250 www.sco.ca.gov S22-PAR-0001