SCO
Department of Developmental Services
Read the report at Department of Developmental Services ↗
DEPARTMENT OF
DEVELOPMENTAL SERVICES
Audit Report
PAYROLL AUDIT
March 1, 2017, through February 29, 2020
M M. C
ALIA OHEN
C
ALIFORNIA
S
TATE
C
ONTROLLER
December 2024
MALIA M. COHEN
CALIFORNIA STATE CONTROLLER
December 27, 2024
Mr. Pete Cervinka, Acting Director
Department of Development Services
P.O. Box 944202
Sacramento, CA 94244
Dear Mr. Cervinka:
The State Controller’s Office audited the Department of Developmental Services’ payroll
process and transactions for the period of March 1, 2017, through February 29, 2020. The audit
was conducted pursuant to Government Code sections 12476 and 12410.
Department of Developmental Services management is responsible for maintaining a system of
internal control over the payroll process within its organization, and for ensuring compliance
with various requirements under state laws and regulations regarding payroll and payroll-related
expenditures.
If you have any questions regarding this report, please contact Roochel Espilla, Chief, State
Agency Audits Bureau, by telephone at 916-323-5744. Thank you.
Sincerely,
Original signed by
Kimberly A. Tarvin, CPA
Chief, Division of Audits
KAT/rs
MAILING ADDRESS P.O. Box 942850, Sacramento, CA 94250
SACRAMENTO 3301 C Street, Suite 700, Sacramento, CA 95816 | 916.324.8907
LOS ANGELES 901 Corporate Center Drive, Suite 200, Monterey Park, CA 91754 | 323.981.6802
Mr. Pete Cervinka
December 27, 2024
Page 2 of 2
Copy: Carla Castaneda, Chief Deputy Director, Operations
Department of Developmental Services
Jim Knight, Deputy Director
Administration Division
Department of Developmental Services
Courtney Filkill, Manager
Human Resources Branch
Department of Developmental Services
Carlos Mendoza, Personnel Supervisor II
Human Resources Branch
Department of Developmental Services
Helen Fairchild, Chief
Administrative Services Division
California Department of Human Resources
Lisa Dean, Acting Chief
Personnel and Payroll Services Division
State Controller’s Office
Veronica Encinas, Bureau Chief
Personnel and Payroll Services Division
State Controller’s Office
MAILING ADDRESS P.O. Box 942850, Sacramento, CA 94250
SACRAMENTO 3301 C Street, Suite 700, Sacramento, CA 95816 | 916.324.8907
LOS ANGELES 901 Corporate Center Drive, Suite 200, Monterey Park, CA 91754 | 323.981.6802
Department of Developmental Services Payroll Audit
Contents
Audit Report
Summary ............................................................................................................................ 1
Background ........................................................................................................................ 1
Audit Authority.................................................................................................................. 1
Objectives, Scope, and Methodology ............................................................................... 2
Conclusion .......................................................................................................................... 3
Follow-up on Prior Audit Findings .................................................................................. 4
Views of Responsible Officials .......................................................................................... 5
Restricted Use .................................................................................................................... 5
Schedule—Summary of Audit Results ................................................................................. 6
Findings and Recommendations ........................................................................................... 7
Appendix—Audit Sampling Methodology ........................................................................... A1
Attachment—Department of Developmental Services’ Response to
Draft Audit Report
Department of Developmental Services Payroll Audit
Audit Report
Summary The State Controller’s Office (SCO) audited the Department of
Developmental Services’ (DDS) payroll process and transactions for the
period of March 1, 2017, through February 29, 2020.
DDS management is responsible for maintaining a system of internal
control over the payroll process within its organization, and for ensuring
compliance with various requirements under state laws and regulations
regarding payroll and payroll-related expenditures.
Our audit determined that DDS did not:
• Maintain adequate and effective internal controls over certain aspects
of its payroll process, as described in Findings 1 through 8;
• Process payroll and payroll-related disbursements and leave balances
accurately and in accordance with collective bargaining agreements
and state laws, regulations, policies, and procedures in certain
instances, as described in Findings 3, 4, 6, 7 and 8; or
• Administer salary advances in accordance with collective bargaining
agreements and state laws, regulations, policies, and procedures, as
described in Finding 5.
Background In 1979, the State of California adopted collective bargaining for state
employees. This created a significant workload increase for the SCO’s
Personnel and Payroll Services Division (PPSD), as PPSD was the State’s
centralized payroll processing center for all payroll-related transactions.
PPSD decentralized the processing of payroll, allowing state agencies and
departments to process their own payroll-related transactions. Periodic
audits of the decentralized payroll processing at state agencies and
departments ceased due to the budget constraints in the late 1980s.
In 2013, the California State Legislature reinstated these payroll audits to
gain assurance that state agencies and departments maintain adequate
internal control over the payroll function, provide proper oversight of their
decentralized payroll processing, and comply with various state laws and
regulations regarding payroll processing and related transactions.
Audit We conducted this audit in accordance with Government Code (GC)
Authority section 12476, which authorizes the SCO to audit the State’s payroll
system, the State Pay Roll Revolving Fund, and related records of state
agencies within the State’s payroll system. In addition, GC section 12410
provides the SCO with general authority to audit the disbursement of state
money for correctness, legality, and sufficient provisions of law for
payment.
-1-
Department of Developmental Services Payroll Audit
Objectives, Scope, Our audit objectives were to determine whether DDS:
and Methodology
• Maintained adequate and effective internal controls over its payroll
process;
• Processed payroll and payroll-related disbursements and leave
balances accurately and in accordance with collective bargaining
agreements and state laws, regulations, policies, and procedures; and
• Administered salary advances in accordance with collective
bargaining agreements and state laws, regulations, policies, and
procedures.
The audit covered the period from March 1, 2017, through February 29,
2020. The audit population consisted of payroll transactions totaling
$118,969,688, as quantified in the Schedule.
To achieve our audit objectives, we performed the following procedures:
• We reviewed state and DDS policies and procedures related to the
payroll process to understand DDS’s methodology for processing
various payroll and payroll-related transactions.
• We interviewed DDS payroll personnel to understand DDS’s
methodology for processing various payroll and payroll-related
transactions, determine the employees’ level of knowledge and ability
relating to payroll transaction processing, and gain an understanding
of existing internal control over the payroll process and systems.
• We selected transactions recorded in the State’s payroll database using
statistical sampling, as outlined in the Appendix, and targeted
selection based on risk factors and other relevant criteria.
• We analyzed and tested the selected transactions, and reviewed
relevant files and records to determine the accuracy of payroll and
payroll-related payments; accuracy of leave transactions; adequacy
and effectiveness of internal control over the payroll process; and
compliance with collective bargaining agreements and state laws,
regulations, policies, and procedures.
• We reviewed salary advances to determine whether DDS administered
and recorded them in accordance with collective bargaining
agreements and state laws, regulations, policies, and procedures.
• We assessed the reliability of computer-processed data for payroll and
payroll-related transactions by interviewing DDS officials
knowledgeable about the data; reviewing existing information about
the data and the system that produced it; and tracing data to source
documents, based on statistical sampling and targeted selection. We
determined that the data was sufficiently reliable for the purposes of
this report.
We conducted this performance audit in accordance with generally
accepted government auditing standards. Those standards require that we
plan and perform the audit to obtain sufficient, appropriate evidence to
provide a reasonable basis for our findings and conclusions based on our
audit objectives. We believe that the evidence obtained provides a
-2-
Department of Developmental Services Payroll Audit
reasonable basis for our findings and conclusions based on our audit
objectives.
Conclusion Our audit determined that DDS did not maintain adequate and effective
internal controls over its payroll process;1 did not process payroll or
payroll-related disbursements and leave balances accurately and in
accordance with collective bargaining agreements and state laws,
regulations, policies, and procedures; and did not administer salary
advances in accordance with collective bargaining agreements and state
laws, regulations, policies, and procedures.
We found deficiencies in internal control over the payroll process that we
consider to be material weaknesses, and instances of noncompliance with
the requirements of collective bargaining agreements and state laws,
regulations, policies, and procedures. The material weaknesses and
instances of noncompliance are as follows:
• DDS had inadequate segregation of duties and a lack of compensating
controls over payroll transactions (see Finding 1).
• Six of 19 (32%) employees whose records were examined during our
audit had inappropriate keying access to the State’s payroll system
(see Finding 2).
• DDS did not reduce employees’ balances in the State’s leave
accounting system after three of 105 (3%) regular-pay transactions
that we examined, and did not record earned credits in the State’s leave
accounting system for two of 105 (or 2%) of the transactions. The
identified and projected unreduced leave credits totaled $196,318, and
the identified and projected unrecorded leave credits totaled $82,787.
In addition, DDS did not consistently maintain timesheets for regular
pay. Based on our audit testing, we estimated that 9% of the timesheets
associated with regular pay during the audit period were not retained.
We identified $48,665 and projected an additional $8,143,645 in
unsupported regular pay transactions (see Finding 3).
1 In planning and performing our audit of compliance, we considered DDS’s internal control over compliance with
collective bargaining agreements and state laws, regulations, policies, and procedures to determine the auditing
procedures that were appropriate under the circumstances for the purpose of providing a conclusion on compliance,
and to test and report on internal control over compliance.
Our consideration of internal control over compliance was for the limited purpose described in the first paragraph
of this footnote; it was not designed to identify all deficiencies in internal control over compliance that might be
material weaknesses or significant deficiencies. As discussed in this section, we identified certain deficiencies in
internal control over compliance that we consider to be material weaknesses.
A deficiency in internal control over compliance exists when the design, implementation, or operation of a control
does not allow management or employees, in the normal course of performing their assigned functions, to prevent,
or detect and correct, noncompliance on a timely basis. A material weakness in internal control over compliance is
a deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable
possibility that material noncompliance with a compliance requirement will not be prevented, or detected and
corrected, on a timely basis. A significant deficiency in internal control over compliance is a deficiency, or a
combination of deficiencies, in internal control over compliance that is less severe than a material weakness in
internal control over compliance, yet important enough to merit attention from those charged with governance.
-3-
Department of Developmental Services Payroll Audit
• DDS had inadequate controls to ensure that it adhered to requirements
limiting the accumulation of vacation and annual leave credits. As of
February 29, 2020, DDS’s leave accounting records show
77 employees whose balances exceed the limits set by collective
bargaining agreements and state regulations. The value of DDS’s
excess leave balances was at least $2,003,753 as of February 29, 2020.
Based on our audit testing, we determined that for all 77 employees,
DDS had failed to implement controls to ensure that it adhered to the
requirements (see Finding 4).
• DDS had inadequate controls to ensure that salary advances were
properly issued, administered in accordance with requirements, and
collected in a timely manner. Specifically, DDS was unable to provide
supporting documentation for 15 salary advances totaling $326,959
(see Finding 5).
• DDS overpaid 10 of 105 (10%) overtime transactions that we
examined and underpaid four of 105 (4%) transactions. The identified
and projected overpayments and underpayments total $27,106 and
$13,138, respectively. In addition, DDS did not consistently maintain
timesheets for overtime pay. Based on our audit testing, we estimated
that 14% of the timesheets associated with overtime payments during
the audit period were not retained; we identified $11,061 and projected
an additional $175,477 in unsupported overtime payments (see
Finding 6).
• DDS did not reduce employees’ balances in the State’s leave
accounting system for seven of 64 (11%) leave buy-back transactions
that we examined; the unreduced leave credits had a value of $21,627.
In addition, DDS did not consistently maintain supporting
documentation for 10 of the 64 (16%) leave buy-back transactions that
we examined; we identified $34,612 in unsupported leave buy-back
transactions (see Finding 7).
• DDS overpaid seven of 58 (12%) employees whose separation lump-
sum payments we examined and underpaid 14 of 58 (24%) of the
employees. The identified and projected overpayments and
underpayments totaled $7,017 and $48,750, respectively. In addition,
DDS did not make separation lump-sum payments to 18 of 58 (31%)
of the employees in a timely manner. Furthermore, DDS did not
consistently maintain supporting documentation for separation lump-
sum pay. Based on our audit testing, we estimated that 10% of the
supporting documentation associated with separation lump-sum
payments during the audit period was not retained; we identified
$14,059 and projected an additional $19,377 in unsupported payments
(see Finding 8).
Follow-up on We have not previously conducted an audit of DDS’s payroll process and
transactions.
Prior Audit
Findings
-4-
Department of Developmental Services Payroll Audit
Views of We issued a draft audit report on September 12, 2024. A representative
from DDS responded by letter dated September 23, 2024, agreeing with
Responsible
the audit results. This final audit report includes DDS’s response as an
Officials
attachment.
Restricted Use This audit report is solely for the information and use of DDS and the
SCO; it is not intended to be, and should not be, used by anyone other than
these specified parties. This restriction is not intended to limit distribution
of this audit report, which is a matter of public record and is available on
the SCO website at www.sco.ca.gov.
Original signed by
Kimberly A. Tarvin, CPA
Chief, Division of Audits
December 27, 2024
-5-
Department of Developmental Services Payroll Audit
Schedule—
Summary of Audit Results
March 1, 2017, through February 29, 2020
-6-
S
S
R
ES
O
L
S
A u d it A r e a T e s te d
e g r e g a tio n o f d u tie s
y s te m a c c e s s
e g u la r p a y
x c e s s v a c a tio n a n d a n n u
a la r y a d v a n c e
v e r tim e p a y
e a v e b u y - b a c k
e p a r a tio n lu m p - s u m p a y
a l le a v e
N
T
S
TT
S
T
S
a
M e th o d o
S e le c tio n
/A
a r g e te d
ta tis tic a l
a r g e te d
a r g e te d
ta tis tic a l
a r g e te d
ta tis tic a l
n d ta r g e te
f
d
N
P
u
U
o
m
n
p
b e r o f
its o f
u la tio n
N /A
1 9
1 8 ,4 0 3
7 7
2 3 3
1 ,6 9 8
6 4
9 7
D o lla r A
o f P o p u
$ 1 1 2 ,8
2 ,0
5
1 ,6
1
1 ,7
$ 1 1 8 ,9
m o u
la tio
N
N
2 8 ,4
0 3 ,7
7 0 ,6
0 6 ,8
8 7 ,0
7 2 ,9
6 9 ,6
n t
n
/A
/A
8 2
5 3
2 8
1 9
3 7
6 9
8 8
N
1
1
N
S
E
/A
1 9
0 5
7 7
1 5
0 5
6 4
5 8
u m b
e le c
x a m
E m
T r a
E m
T r a
T r a
T r a
E m
e r o f
tio n s
in e d
p lo y e e s
n s a c tio n
p lo y e e s
n s a c tio n
n s a c tio n
n s a c tio n
p lo y e e s
s
s
s
s
D o lla r
A m o u n t o f
S e le c tio n s
E x a m in e d
N /A
N /A
$ 6 7 0 ,2 3 7
2 ,0 0 3 ,7 5 3
3 2 6 ,9 5 9
9 5 ,2 7 3
1 8 7 ,0 3 7
9 4 9 ,4 1 0
$ 4 ,2 3 2 ,6 6 9
D
N e t T o ta l
o lla r A m o u n t
o f I d e n tif ie d
I m p r o p e r
C o s ts
N /A
N /A
$ 6 7 4
2 ,0 0 3 ,7 5 3
-
8 2 8
2 1 ,6 2 7
( 1 7 ,8 3 9 )
$ 2 ,0 0 9 ,0 4 3
N e t T o ta l D o lla r
A m o u n t o f
P r o je c te d
I m p r o p e r C o s ts
a n d I d e n tif ie d
a n d P r o je c te d
U n s u p p o r te d
C o s ts
N /A
N /A
$ 8 ,3 0 5 ,1 6 7
-
3 2 6 ,9 5 9
1 9 9 ,6 7 8
3 4 ,6 1 2
9 ,2 9 2
$ 8 ,8 7 5 ,7 0 8
F
N
in d
u m
1
2
3
45
6
7
8
in
b
g
e r
Department of Developmental Services Payroll Audit
Findings and Recommendations
FINDING 1— DDS lacked adequate segregation of duties within its payroll transactions
unit to ensure that only valid and authorized payroll transactions were
Inadequate
processed. DDS also failed to implement other controls to compensate for
segregation of
this risk.
duties and lack of
compensating
Our audit found that DDS payroll transactions unit staff performed
controls over
conflicting duties. Staff members performed multiple steps in processing
payroll
payroll transactions, including entering data into the State’s payroll
transactions system; auditing employee timesheets; reconciling payroll, including
reconciling system output to source documentation; reporting payroll
exceptions; and processing adjustments. For example, staff members
keyed in regular and overtime pay, and reconciled the master payroll,
overtime, and other supplemental warrants. DDS failed to demonstrate
that it implemented compensating controls to mitigate the risks associated
with such a deficiency. We found no indication that these functions were
subjected to periodic supervisory review.
The lack of adequate segregation of duties and compensating controls has
a pervasive effect on the DDS payroll process, and impairs the
effectiveness of other controls by rendering their design ineffective or by
preventing them from operating effectively. These control deficiencies, in
combination with other deficiencies discussed in Findings 2 through 8,
represent a material weakness in internal control over the payroll process
such that there is a reasonable possibility that material noncompliance with
provisions of laws, regulations, or contracts will not be prevented, or
detected and corrected, on a timely basis.
Good internal control practices require that the following functional duties
be performed by different work units or, at minimum, by different
employees within the same unit:
• Recording transactions – This duty refers to the record-keeping
function, which is accomplished by entering data into a computer
system.
• Authorization to execute – This duty belongs to individuals with
authority and responsibility to initiate and execute transactions.
• Periodic review and reconciliation of actual payments to recorded
amounts – This duty refers to making comparisons of information at
regular intervals and taking action to resolve differences.
GC sections 13400 through 13407 require state agencies to establish and
maintain internal controls, including proper segregation of duties and an
effective system of internal review. Adequate segregation of duties
reduces the likelihood that fraud or error will remain undetected by
providing for separate processing by different individuals at various stages
of a transaction and for independent reviews of the work performed.
-7-
Department of Developmental Services Payroll Audit
Recommendation
We recommend that DDS:
• Separate conflicting payroll functional duties to the greatest extent
possible. Adequate segregation of duties will provide a stronger
system of internal control whereby the functions of each employee are
subject to the review of another.
If it is not possible to segregate payroll functions fully and
appropriately, DDS should implement compensating controls. For
example, if the payroll transactions unit staff member responsible for
recordkeeping also performs a reconciliation process, then the
supervisor should perform and document a detailed review of the
reconciliation to provide additional control over the assignment of
conflicting functions. Compensating controls may also include dual
authorization requirements and documented reviews of payroll system
input and output; and
• Develop formal procedures for performing and documenting
compensating controls.
FINDING 2— DDS lacked adequate controls to ensure that only appropriate staff
members had keying access to the State’s payroll system. DDS
Inappropriate
inappropriately allowed six employees keying access to the State’s payroll
keying access to the
system because DDS did not immediately remove or modify keying access
State’s payroll
for the employees after the employees’ separation from state service,
system
transfer to another agency, or change in classification.
The SCO maintains the State’s payroll system. The system is
decentralized, thereby allowing employees of state agencies to access it.
All state agencies are required to comply with PPSD’s Decentralized
Security Program Manual (DSP Manual) in order to access the payroll
system. The DSP Manual describes how state agencies can secure and
protect the confidentiality and integrity of payroll data against misuse,
abuse, and unauthorized use.
We examined the records of 19 DDS employees who had keying access to
the State’s payroll system at various times between March 2017 and
February 2020. Of the 19 employees, six had inappropriate keying access
to the State’s payroll system. Specifically, DDS did not immediately
remove or modify keying access for the employees after the employees’
separation from state service, transfer to another agency, or change in
classification. For example, a Senior Personnel Specialist left DDS on
February 28, 2018, but DDS did not request to remove the employee’s
access until June 7, 2018—99 days later. DDS lacked periodic review of
keying access granted to employees to ensure compliance with the DSP
Manual.
If not mitigated, this control deficiency leaves payroll data at risk of
misuse, abuse, and unauthorized use.
-8-
Department of Developmental Services Payroll Audit
The December 2015 DSP Manual (“Access Requirements,” page 13)
states, in part:
The [State’s payroll system] contains sensitive and confidential
information. Access is restricted to persons with an authorized, legal, and
legitimate business requirement to complete their duties. . . .
If the employee’s duties change, such that the need for access no longer
exists, the access privilege MUST be removed or deleted immediately
by a request submitted by the department/campus.
The December 2015 DSP Manual (“Revocation and Deletion of User
IDs,” page 17) states, in part:
To prevent unauthorized use by a transferred, terminated or resigned
employee's user ID, the Security Monitor must IMMEDIATELY submit
all pages of the PSD125A [Security Authorization form] to delete the
user’s system access. Using an old user ID increases the chances of a
security breach, which is a serious security violation. Sharing a user ID
is strictly prohibited and a serious violation. . . .
Recommendation
We recommend that DDS:
• Update keying access to the State’s payroll system immediately after
employees leave DDS, transfer to another unit, or change
classifications; and
• Periodically review access to the system to verify that access complies
with the DSP Manual.
FINDING 3— DDS lacked adequate segregation of duties within its payroll transactions
Inaccurate leave unit, as noted in Finding 1. It also lacked adequate controls to ensure that
paid credits were reduced and earned credits were recorded in the State’s
accounting and
leave accounting system, and that timesheets were maintained to support
missing timesheets
regular pay.
for regular pay
Payroll records show that DDS processed 18,403 regular pay transactions,
totaling $112,828,482, between March 1, 2017, and February 29, 2020.
We randomly selected a statistical sample (as described in the Appendix)
of 105 transactions, totaling $670,237. Based on our examination of
these transactions, we found the following errors:
• DDS did not appropriately reduce employees’ balances in the State’s
leave accounting system for three of 105 (3%) transactions to reflect
the number of leave credits—with a value of $1,166—that had been
used or paid. Unreduced leave balances pose a risk to the State because
they overstate the State’s liability for leave balances and allow the
possibility of improper and duplicative payments for leave credits. We
projected additional unreduced leave credits with a value of $195,152.
• DDS did not increase employees’ balances in the State’s leave
accounting system for two of 105 (2%) transactions to reflect the
number of leave credits—with a value of $492—that the employees
-9-
Department of Developmental Services Payroll Audit
had earned. Unrecorded leave credits understate employees’ balances
in the State’s leave accounting system, and prevent the employees
from using or receiving cash compensation for credits that they have
earned. We projected additional unrecorded leave credits with a value
of $82,295.
• DDS lacked timesheets associated with nine of 105 (9%) regular pay
transactions totaling $48,665. Without the required documentation,
we could not determine the validity, accuracy, and propriety of the
payments made to the employees or the completeness and accuracy of
the leave accounting records. We projected the additional unsupported
payments to be $8,143,645.
If not mitigated, these control deficiencies leave DDS at risk of making
additional improper payments for regular pay.
Statistical sampling results
The identified value of unreduced leave credits, unrecorded leave credits,
and unsupported payments totaled $49,339.
We used a statistical sampling method to select the regular pay
transactions examined. We projected an additional $195,152 in unreduced
leave credits and an additional $82,295 in unrecorded leave credits. We
also projected additional unsupported payments of $8,143,645. The
projected improper and unsupported costs have a net total of $8,256,502.
Therefore, the identified and projected improper and unsupported costs
totaled approximately $8,305,841, consisting of $196,318 in unreduced
leave credits, $82,787 in unrecorded leave credits, and $8,192,310 in
unsupported payments.
The following table summarizes the results of our statistical sampling
(amounts are rounded to the nearest dollar):
-10-
I d e n tif ie d v a lu e o f u n r e d u c e d le a v e c r e d its
a n d u n s u p p o r te d p a y m e n ts , n e t
D iv id e b y : S a m p le
E r r o r r a te f o r p r o je c tio n ( d if f e r e n c e s d u e to r o u n d in g )
P o p u la tio n th a t w a s s ta tis tic a lly s a m p le d
M u ltip ly b y : E r r o r r a te f o r p r o je c tio n
I d e n tif ie d a n d p r o je c te d v a lu e o f u n r e d u c e d le a v e c r e d
a n d u n s u p p o r te d p a y m e n ts , n e t ( d if f e r e n c e s d u e to r
L e s s : I d e n tif ie d v a lu e o f u n r e d u c e d le a v e c r e d its
a n d u n s u p p o r te d p a y m e n ts , n e t
P r o je c te d v a lu e o f u n r e d u c e d le a v e c r e d its
a n d u n s u p p o r te d p a y m e n ts , n e t
its
o u n d in g )
$ 4
6 77
1 1 2 ,8 27
8 ,3 0
4
$ 8 ,2 5
9 ,3
0 ,2
.3 6
8 ,4
.3 6
5 ,8
9 ,3
6 ,5
33%
8%
4
3
0
97
2
1
9
2
Criteria
GC sections 13400 through 13407 require state agencies to establish and
maintain internal controls, including a system of policies and procedures
adequate to ensure compliance with applicable laws and other
requirements, and an effective system of internal review.
Department of Developmental Services Payroll Audit
Collective bargaining agreements, and state laws and policies, contain
specific clauses regarding regular pay.
DDS’s General Retention Schedule for Payroll/Personnel Records
specifies a four-year retention period for timesheets.
Recommendation
We recommend that DDS:
• Establish adequate controls to ensure that employee leave balances are
adjusted in a timely manner after payments for regular pay are made;
and
• Maintain supporting documentation for regular pay pursuant to its
retention policies.
FINDING 4— DDS’s leave accounting records show 575 employees with unused
Excessive vacation vacation or annual leave credits at February 29, 2020. Of those employees,
and annual leave 77 exceeded the limits set by collective bargaining agreements and state
balances regulations. These employees accumulated 36,407 hours of excess
vacation and annual leave, with a value of at least $2,003,753 as of
February 29, 2020. DDS failed to implement controls to ensure that it
adhered to the requirements. This estimated liability does not adjust for
salary rate increases and additional leave credits.2 Accordingly, we expect
that the amount needed to pay for this liability will be higher.
Collective bargaining agreements and state regulations limit the amount
of vacation and annual leave that state employees may accumulate. The
limit on leave balances helps state agencies to manage leave balances and
control the State’s liability for accrued leave credits. State agencies may
allow employees to carry a higher leave balance only under limited
circumstances. For example, an employee may not be able to reduce
accrued vacation or annual leave hours below the limit due to business
needs. When an employee’s leave accumulation exceeds or is projected to
exceed the limit, state agencies should work with the employee to develop
a written plan to reduce leave balances below the applicable limit.
On October 20, 2020, the California Department of Human Resources
(CalHR) directed departments to immediately suspend policies that
require leave balances to be reduced below the limit, and that require
employees to implement leave-reduction plans. This suspension was in
effect until the 2020 Personal Leave Program ended on June 30, 2021.
We examined the records of the 77 employees with excess vacation and
annual leave to determine whether DDS had complied with collective
bargaining agreements and state regulations. None of the 77 employees
2 Most state employees receive pay rate increases every year pursuant to state laws and/or collective bargaining
agreements until they reach the top of their pay scale, or promote into a higher-paying position. In addition, when
an employee’s accumulated leave balances upon separation are calculated for lump-sum pay, the employee is
credited with additional leave credits equal to the amount that the employee would have earned had the employee
taken time off and not separated from state service.
-11-
Department of Developmental Services Payroll Audit
complied with collective bargaining agreements and state regulations for
the following reasons:
• DDS could not demonstrate that, if the employees were unable to
reduce their vacation and annual leave balances, it had allowed the
employees to maintain excess balances because of the extenuating
circumstances specified in the agreements and regulations.
• DDS had no plans in place during the audit period for the employees
to reduce leave balances below the limit.
These 77 employees accumulated 36,407 hours of excess vacation and
annual leave, with a value of at least $2,003,753 as of February 29, 2020.
If DDS does not take action to reduce the excessive leave balances, the
liability for accrued vacation and annual leave will likely increase because
most employees will receive salary increases or use other non-
compensable leave credits instead of vacation or annual leave, thus
increasing their vacation or annual leave balances.
The state agency responsible for paying these leave balances may face a
cash flow problem if a significant number of employees with excessive
vacation or annual leave balances separate from state service. Normally,
state agencies are not budgeted to make these separation lump-sum
payments. However, the State’s current practice dictates that the state
agency that last employed an employee pays for that employee’s
separation lump-sum payment, regardless of where the employee accrued
the leave balance.
Collective bargaining agreements and state regulations limit the amount
of vacation and annual leave that most state employees may accumulate to
no more than 80 days (640 hours).
Recommendation
We recommend that DDS:
• Implement controls, including existing policies and procedures, to
ensure that its employees’ vacation and annual leave balances are
maintained within levels allowed by collective bargaining agreements
and state regulations;
• Conduct ongoing monitoring of controls to ensure that they are
implemented and operating effectively; and
• Participate in leave buy-back programs if the State offers such
programs and funds are available.
FINDING 5— DDS lacked adequate segregation of duties within its payroll transactions
Failure to collect unit, as noted in Finding 1. It also lacked adequate controls over salary
outstanding salary advances to ensure that advances were issued properly and collected in a
advances and timely manner, and that adequate records were maintained in accordance
with state laws, regulations, policies, and procedures. Fifteen salary
maintain related
advances, totaling $326,959, lacked required documentation.
documentation
-12-
Department of Developmental Services Payroll Audit
DDS was not able to provide accounting records with information about
outstanding salary advances as of February 29, 2020, or as of any given
time during the audit period. This was because DDS began using a new
accounting system in July 2018; data from before that date was
unavailable, and the system was unable to generate an outstanding salary
advance aging report because it lacked necessary information such as
issuance dates and ages of salary advances.
For our audit purposes, we used DDS’s list of 233 salary advances, totaling
$570,628, issued between July 2018 and February 2020. The list did not
include issuance dates or ages of salary advances. We examined the
15 largest salary advances, totaling $326,959. DDS was unable to provide
the required documentation for these advances; therefore, we were unable
to determine whether the 15 advances had been properly issued and
collected in a timely manner, or whether DDS attempted to recover the
advanced funds if overpayments had occurred.
The lack of adequate records, such as monthly reports, for salary advances
prevents DDS from performing adequate review and reconciliation of
salary advances. If not mitigated, these control deficiencies leave DDS at
risk of failing to collect future salary advances.
GC sections 13400 through 13407 require state agencies to establish and
maintain internal controls, including a system of policies and procedures
adequate to ensure compliance with applicable laws and other
requirements, and an effective system of internal review.
GC section 19838 and State Administrative Manual (SAM) sections 8291,
8291.1, 8293, and 8293.2 describe the State’s collection policies and
procedures, which require the collection of salary advances in a timely
manner and maintenance of proper records of collection efforts.
Specifically, GC section 19838(d) and SAM section 8293.2 require that
actions to recover overpayments begin within three years of the date of
overpayment.
Recommendation
We recommend that DDS:
• Establish adequate controls to ensure that salary advances are issued,
administered, and collected in compliance with state laws and policies;
• Conduct monthly review and reconciliation of salary advances; and
• Maintain adequate records of salary advances, collection efforts and
payments.
FINDING 6— DDS lacked adequate segregation of duties within its payroll transactions
unit, as noted in Finding 1. It also lacked adequate controls over the
Improper
processing of overtime pay, adequate supervisory review to ensure
payments and
accurate processing of overtime pay, and adequate controls to ensure that
missing timesheets
timesheets were maintained for overtime payments.
for overtime pay
-13-
Department of Developmental Services Payroll Audit
Payroll records show that DDS processed 1,698 overtime pay transactions,
totaling $1,606,819, between March 2017 and February 2020. We
randomly selected a statistical sample (as described in the Appendix) of
105 transactions, totaling $95,273. Based on our examination of these
transactions, we found the following errors:
• DDS overpaid 10 of 105 (10%) transactions by $1,607 and underpaid
four of 105 (4%) transactions by $779. The error occurred because
payroll transactions unit staff members miscalculated overtime hours
worked; paid for overtime hours worked at the straight-time rate
instead of the time-and-a-half rate, or vice-versa; and failed to verify
that employees were eligible for overtime pay. DDS also lacked
adequate supervisory review to ensure accurate and timely processing
of overtime pay. We projected the additional overpayments to be
$25,499 and the additional underpayments to be $12,359.
• DDS lacked timesheets and supporting calculations for 15 of 105
(14%) overtime pay transactions, with a value of $11,061. Without the
required documentation, we could not determine the validity,
accuracy, and propriety of the payments made to the employees; or the
completeness and accuracy of the leave accounting records. We
projected the additional unsupported payments to be $175,477.
If not mitigated, these control deficiencies leave DDS at risk of making
additional improper overtime payments.
Statistical sampling results
The identified improper and unsupported payments have a net total of
$11,889.
We used a statistical sampling method to select the overtime pay
transactions that we examined. We projected an additional $25,499 in
overpayments and $12,359 in underpayments; we also projected an
additional $175,477 in unsupported payments. The projected improper and
unsupported payments have a net total of $188,617. Therefore, the
identified and projected improper and unsupported payments totaled a net
of approximately $200,506, consisting of $27,106 in overpayments,
$13,138 in underpayments, and $186,538 in unsupported payments.
The following table summarizes the results of our statistical sampling
(amounts are rounded to the nearest dollar):
Identified improper and unsupported payments, net $ 11,889
Divide by: Sample 95,273
Error rate for projection (differences due to rounding) 12.48%
Population that was statistically sampled 1,606,819
Multiply by: Error rate for projection 12.48%
Identified and projected improper and unsupported payments, net
(differences due to rounding) 200,506
Less: Identified improper and unsupported payments, net 11,889
Projected improper and unsupported payments, net $ 188,617
-14-
Department of Developmental Services Payroll Audit
Criteria
GC sections 13400 through 13407 require state agencies to establish and
maintain internal controls, including a system of policies and procedures
adequate to ensure compliance with applicable laws and other
requirements, and an effective system of internal review.
Collective bargaining agreements, and state laws and policies, contain
specific clauses regarding overtime pay.
DDS’s General Retention Schedule for Payroll/Personnel Records
specifies a four-year retention period for timesheets.
Recommendation
We recommend that DDS:
• Conduct a review of overtime payments made during the past three
years to ensure that the payments complied with collective bargaining
agreements and state laws and policies;
• Recover any overpayments made to employees through an agreed-
upon collection method in accordance with GC section 19838 and
SAM sections 8291, 8291.1, and 8293; and
• Properly compensate those employees who were underpaid.
We further recommend that, to prevent improper payments for overtime
pay from recurring, DDS:
• Establish adequate internal controls to ensure that payments are
accurate and comply with collective bargaining agreements and state
laws and policies;
• Provide adequate oversight to ensure that payroll transactions unit
staff process only valid and authorized payments that comply with
collective bargaining agreements and state laws and policies; and
• Maintain supporting documentation for overtime pay pursuant to its
retention policies.
DDS lacked adequate segregation of duties within its payroll transactions
FINDING 7—
unit, as noted in Finding 1; it also lacked adequate controls to ensure that
Inaccurate leave
credits that had been bought back were properly reduced in the State’s
accounting and
leave accounting system, and that supporting documentation was
missing
maintained to support leave buy-back payments.
documentation for
leave buy-back A leave-buy back occurs when an employee receives payment at the
regular salary rate in exchange for accrued vacation, annual leave,
personal leave, personal holiday, and/or holiday credits. CalHR authorized
leave buy-backs for excluded employees from fiscal year 2016-17 through
fiscal year 2018-19. It also provided the State’s policies and procedures
regarding cash-out of vacation and annual leave.
Payroll records show that DDS processed 64 leave buy-back transactions,
totaling $187,037, between March 2017 and February 2020. We examined
-15-
Department of Developmental Services Payroll Audit
all 64 transactions to determine whether DDS complied with collective
bargaining agreements and state regulations, and found the following
errors:
• DDS did not reduce employees’ balances in the State’s leave
accounting system for seven of 64 (11%) transactions to reflect the
number of leave credits—with a value of $21,627—that had been
bought back. Unreduced leave balances pose a risk to the State
because they overstate the State’s liability for leave balances and allow
the possibility of improper and duplicative payments for leave credits.
• DDS lacked supporting leave buy-back forms and calculations
associated with 10 of 64 (10%) leave buy-back transactions totaling
$34,612. Without the required documentation, we could not determine
the validity, accuracy, and propriety of the payments made to the
employees or the completeness and accuracy of the leave accounting
records.
If not mitigated, these control deficiencies leave DDS at risk of making
additional improper leave buy-back payments.
GC sections 13400 through 13407 require state agencies to establish and
maintain internal controls, including a system of policies and procedures
adequate to ensure compliance with applicable laws and other
requirements, and an effective system of internal review.
Title 2, California Code of Regulations, section 599.744 provides that
CalHR may also authorize a leave buy-back program for employees
excluded from collective bargaining.
Collective bargaining agreements between the State and various
bargaining units allow for the annual cash-out of a certain number of hours
of accumulated vacation and annual leave if funds are available.
DDS’s General Retention Schedule for Payroll/Personnel Records
specifies a four-year retention period for leave buy-back documentation.
Recommendation
We recommend that DDS:
• Establish adequate internal controls to ensure that the employee leave
balances are reduced in a timely manner after leave buy-back
payments are made; and
• Maintain supporting documentation for leave buy-back payments
pursuant to DDS retention policies.
FINDING 8— DDS lacked adequate segregation of duties within its payroll transactions
Improper and late unit, as noted in Finding 1. It also lacked adequate controls over the
payments, and processing of employee separation lump-sum pay; adequate supervisory
missing review to ensure accurate and timely processing of separation lump-sum
pay; and adequate controls to ensure that documentation was maintained
documentation for
to support separation lump-sum payments.
separation lump-
sum pay
-16-
Department of Developmental Services Payroll Audit
Payroll records show that DDS processed separation lump-sum payments,
totaling $1,772,969, for 97 employees between March 2017 and
February 2020, as follows.
Separation Lump-Sum Pay Group Unit Amount
Employees who were paid at least 3 $ 351,828
$100,000 (examined 100%)
Employees who were paid less than 94 1,421,141
$100,000 (statistically sampled)
Total population 97 $1,772,969
We examined the payments for all three employees who were paid at least
$100,000 each in separation lump-sum payments. Of the 94 employees
who were paid less than $100,000 each in separation lump-sum payments,
we randomly selected a statistical sample (as described in the Appendix)
of 55 employees who received separation lump-sum payments, totaling
$597,582.
Based on our examination of the payments made to these 58 employees,
we found the following errors:
• DDS overpaid seven of 58 (12%) employees by $3,530 and underpaid
14 of 58 (24%) employees by $21,369 because payroll transactions
unit staff members miscalculated leave credits paid. DDS also lacked
adequate supervisory review to ensure accurate and timely processing
of separation lump-sum pay. We projected the additional
overpayments to be $3,237 and underpayments to be $27,381.
• DDS did not make separation lump-sum payments to 18 of 58 (31%)
employees in a timely manner.
• DDS could not locate supporting documents (lump-sum calculation
worksheets, leave balance statements, state calendars, and timesheets)
for payments, totaling $14,059, made to six of 58 (or 10%) employees.
We could not determine the validity, accuracy, and propriety of the
payments made to these employees; or the completeness and accuracy
of the leave accounting records. We projected the additional
unsupported payments to be $19,377.
If not mitigated, these control deficiencies leave DDS at risk of making
additional improper and late separation lump-sum payments,
noncompliance with agreements and laws, and liability for late payments.
Statistical sampling results
The identified improper and unsupported payments resulted in a net total
underpayment of $3,460.
We used a statistical sampling method to select the employees whose
separation lump-sum payments were examined. We projected an
additional $3,237 in overpayments and $27,381 in underpayments. We
also projected an additional $19,377 in unsupported payments. The
projected improper and unsupported payments resulted in a net total
underpayment of $4,767. Therefore, the identified and projected improper
and unsupported payments resulted in a net total underpayment of
-17-
Department of Developmental Services Payroll Audit
approximately $8,227, consisting of $5,586 in overpayments, $47,249 in
underpayments, and $33,436 in unsupported payments.
The following table summarizes the results of our statistical sampling
(amounts are rounded to the nearest dollar):
-18-
I d e n tif ie d u n d e r p a y m e n ts a n d u n s u p p o r te d p a y
D iv id e b y : S a m p le
E r r o r r a te f o r p r o je c tio n ( d if f e r e n c e s d u e to r o u
P o p u la tio n th a t w a s s ta tis tic a lly s a m p le d
M u ltip ly b y : E r r o r r a te f o r p r o je c tio n
I d e n tif ie d a n d p r o je c te d u n d e r p a y m e n ts a n d u n
( d if f e r e n c e s d u e to r o u n d in g )
L e s s : I d e n tif ie d u n d e r p a y m e n ts a n d u n s u p p o r te
P r o je c te d u n d e r p a y m e n ts a n d u n s u p p o r te d p a y
m e n ts , n
n d in g )
s u p p o r te
d p a y m e
m e n ts , n
e
d
ne
t
p
ts
t
a y
, n
m
e
e
t
n ts , n e t
$ 3 ,4 6 0
5 9 7 ,5 8 2
0 .5 8 %
1 ,4 2 1 ,1 4 1
0 .5 8 %
8 ,2 2 7
3 ,4 6 0
$ 4 ,7 6 7
Criteria
GC sections 13400 through 13407 require state agencies to establish and
maintain internal controls, including an effective system of internal
review.
GC section 19839 allows lump-sum payment for accrued eligible leave
credits when an employee separates from state employment. Collective
bargaining agreements include similar provisions regarding separation
lump-sum pay.
Collective bargaining agreements and state laws summarized in
section 1703 of CalHR’s Human Resources Manual establish the
requirements for separation lump-sum pay.
DDS’s General Retention Schedule for Payroll/Personnel Records
specifies a four-year retention period for separation lump-sum pay
documentation.
Recommendation
We recommend that DDS:
• Conduct a review of separation lump-sum payments made during the
past three years to ensure that the payments were accurate and in
compliance with collective bargaining agreements and state law;
• Recover any overpayments made to separated employees in
accordance with GC section 19838 and SAM sections 8291, 8291.1,
and 8293; and
• Properly compensate those employees who were underpaid.
We further recommend that, to prevent improper payments from recurring,
DDS establish adequate controls to ensure that:
• Separation lump-sum payments are calculated accurately;
• Separation lump-sum payments are made in a timely manner; and
• Supporting documentation for payments is maintained pursuant to
DDS retention policies.
Department of Developmental Services Payroll Audit
Appendix—
Audit Sampling Methodology
This Appendix outlines our audit sampling application for all audit areas in which statistical sampling was
used.
We used attributes sampling for tests of compliance. We chose this sample design because:
• It follows the American Institute of Certified Public Accountants (AICPA) guidelines;
• It allowed us to achieve our objectives for tests of compliance in an efficient and effective manner;
• Audit areas included high and low volumes of transactions;
• We planned to project the results to the intended population; and
• We had the collective knowledge and skills to plan and perform the sampling plan and design.
We conducted compliance testing on samples chosen by computer-generated simple random selection. For
populations of fewer than 250 items, we determined the sample size using a calculator with a
hypergeometric distribution. For populations of 250 items or more, we determined the sample size using a
calculator with a binomial distribution. As stated in Technical Notes on the AICPA Audit Guide: Audit
Sampling (March 1, 2012), page 5, although the hypergeometric distribution is the correct distribution to
use for attributes sample sizes, the distribution becomes unwieldy for large populations unless suitable
software is available. Therefore, more convenient approximations are frequently used instead.
The confidence level was 90.00%; the tolerable error rate was 5.00%; and the expected error rates were
2 (1.75%) for regular and overtime pay and 2 (2.00%) for separation lump-sum pay. Pursuant to the
AICPA’s Audit Guide: Audit Sampling (December 1, 2019, edition), pages 131–132, the expected error
rate is the expected number of errors planned for in the sample. The rate is derived by multiplying the
expected error rate by the sample size. The expected number of errors in the sampling tables on pages 135–
136 was rounded upward; e.g., 0.2 errors become 1.0 error. Results were projected to the intended (total)
population.
Audit Population Population Sampling Sample Finding
Area (Unit) (Dollar) Unit Size Number
Regular pay 18,403 $ 112,828,482 Transaction 105 3
Overtime pay 1,698 1,606,819 Transaction 105 6
Separation lump-sum pay 9 4 1,421,141 Employee 55 8
-A1-
Department of Developmental Services Payroll Audit
Attachment—
Department of Developmental Services’
Response to Draft Audit Report
State Controller’s Office
Division of Audits
Post Office Box 942850
Sacramento, CA 94250
www.sco.ca.gov
S21-PAR-0003