Folsom State Prison Payroll Audit

FOLSOM STATE PRISON Audit Report PAYROLL AUDIT July 1, 2018, through June 30, 2021 M M. C ALIA OHEN C ALIFORNIA S TATE C ONTROLLER December 2024 MALIA M. COHEN CALIFORNIA STATE CONTROLLER December 20, 2024 Mr. Joseph R. Tuggle, Acting Warden Folsom State Prison 300 Prison Road Represa, CA 95671 Dear Mr. Tuggle: The State Controller’s Office audited Folsom State Prison’s payroll process and transactions for the period of July 1, 2018, through June 30, 2021. The audit was conducted pursuant to Government Code sections 12476 and 12410. Folsom State Prison management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. If you have any questions regarding this report, please contact Roochel Espilla, Chief, State Agency Audits Bureau, by telephone at 916-323-5744. Thank you. Sincerely, Original signed by Kimberly A. Tarvin, CPA Chief, Division of Audits KAT/ac MAILING ADDRESS P.O. Box 942850, Sacramento, CA 94250 SACRAMENTO 3301 C Street, Suite 700, Sacramento, CA 95816 | 916.324.8907 LOS ANGELES 901 Corporate Center Drive, Suite 200, Monterey Park, CA 91754 | 323.981.6802 Mr. Joseph R. Tuggle December 20, 2024 Page 2 of 2 Copy: John Heckman, Chief Deputy Warden Folsom State Prison Carolyn Flores, Associate Warden of Business Services Folsom State Prison Keith Robinson, Correctional Business Manager Folsom State Prison Shauna Hougland, Institutional Personnel Officer Folsom State Prison Cheryl Gaylord, Personnel Supervisor II Folsom State Prison Jeff Macomber, Secretary California Department of Corrections and Rehabilitation Jennifer Barretto, Undersecretary of Administration California Department of Corrections and Rehabilitation Stacy Lopez, Director Division of Administrative Services California Department of Corrections and Rehabilitation Danyal Noel, Deputy Director of Human Resources California Department of Corrections and Rehabilitation Mai Lee Vang, External Audits Manager California Department of Corrections and Rehabilitation Helen Fairchild, Chief Administrative Services Division California Department of Human Resources Lisa Dean, Acting Chief Personnel and Payroll Services Division State Controller’s Office Veronica Encinas, Bureau Chief Personnel and Payroll Services Division State Controller’s Office MAILING ADDRESS P.O. Box 942850, Sacramento, CA 94250 SACRAMENTO 3301 C Street, Suite 700, Sacramento, CA 95816 | 916.324.8907 LOS ANGELES 901 Corporate Center Drive, Suite 200, Monterey Park, CA 91754 | 323.981.6802 Folsom State Prison Payroll Audit Contents Audit Report Summary ............................................................................................................................ 1 Background ........................................................................................................................ 1 Audit Authority .................................................................................................................. 1 Objectives, Scope, and Methodology ............................................................................... 2 Conclusion .......................................................................................................................... 3 Follow-up on Prior Audit Findings .................................................................................. 4 Views of Responsible Officials .......................................................................................... 4 Restricted Use .................................................................................................................... 4 Schedule—Summary of Audit Results ................................................................................. 5 Findings and Recommendations ........................................................................................... 6 Appendix—Audit Sampling Methodology ........................................................................... A1 Attachment—Folsom State Prison’s Response to Draft Audit Report Folsom State Prison Payroll Audit Audit Report Summary The State Controller’s Office (SCO) audited Folsom State Prison’s (FSP) payroll process and transactions for the period of July 1, 2018, through June 30, 2021. FSP management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. Our audit determined that FSP did not: • Maintain adequate and effective internal controls over certain aspects of its payroll process, as described in Findings 1 through 5; • Process payroll and payroll-related disbursements accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures in certain instances, as described in Findings 3 and 4; or • Administer salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures, as described in Finding 5. Background In 1979, the State of California adopted collective bargaining for state employees. This created a significant workload increase for the SCO’s Personnel and Payroll Services Division (PPSD), as PPSD was the State’s centralized payroll processing center for all payroll-related transactions. PPSD decentralized the processing of payroll, allowing state agencies and departments to process their own payroll-related transactions. Periodic audits of the decentralized payroll processing at state agencies and departments ceased due to the budget constraints in the late 1980s. In 2013, the California State Legislature reinstated these payroll audits to gain assurance that state agencies and departments maintain adequate internal control over the payroll function, provide proper oversight of their decentralized payroll processing, and comply with various state laws and regulations regarding payroll processing and related transactions. Audit Authority We conducted this audit in accordance with Government Code (GC) section 12476, which authorizes the SCO to audit the State’s payroll system, the State Pay Roll Revolving Fund, and related records of state agencies within the State’s payroll system. In addition, GC section 12410 provides the SCO with general authority to audit the disbursement of state money for correctness, legality, and sufficient provisions of law for payment. -1- Folsom State Prison Payroll Audit Objectives, Scope, Our audit objectives were to determine whether FSP: and Methodology • Maintained adequate and effective internal controls over its payroll process; • Processed payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures; and • Administered salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. The audit covered the period from July 1, 2018, through June 30, 2021. The audit population consisted of payroll transactions totaling $311,763,614, as quantified in the Schedule. To achieve our audit objectives, we performed the following procedures: • We reviewed state and FSP policies and procedures related to the payroll process to understand FSP’s methodology for processing various payroll and payroll-related transactions. • We interviewed FSP payroll personnel to understand FSP’s methodology for processing various payroll and payroll-related transactions, determine the employees’ level of knowledge and ability relating to payroll transaction processing, and gain an understanding of existing internal controls over the payroll process and systems. • We selected transactions recorded in the State’s payroll database using statistical sampling, as outlined in the Appendix, and targeted selection based on risk factors and other relevant criteria. • We analyzed and tested the selected transactions; and reviewed relevant files and records to determine the accuracy of payroll and payroll-related payments; accuracy of leave transactions; adequacy and effectiveness of internal control over the payroll process; and compliance with collective bargaining agreements and state laws, regulations, policies, and procedures. • We reviewed salary advances to determine whether FSP administered and recorded them in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. • We assessed the reliability of computer-processed data for payroll and payroll-related transactions by interviewing FSP officials knowledgeable about the data; reviewing existing information about the data and the system that produced it; and tracing data to source documents, based on statistical sampling and targeted selection. We determined that the data was sufficiently reliable for the purposes of this report. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a -2- Folsom State Prison Payroll Audit reasonable basis for our findings and conclusions based on our audit objectives. Conclusion Our audit determined that FSP did not maintain adequate and effective internal controls over its payroll process;1 did not process payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures; and did not administer salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. We found deficiencies in internal control over the payroll process that we consider to be material weaknesses; and instances of noncompliance with the requirements of collective bargaining agreements and state laws, regulations, policies, and procedures. The material weaknesses and instances of noncompliance are as follows: • FSP had inadequate segregation of duties and a lack of compensating controls over payroll transactions (see Finding 1). • Thirteen of 32 (41%) employees whose records we examined during the audit had inappropriate access to the State’s payroll system (see Finding 2). • FSP did not reduce employees’ balances in the State’s leave accounting system after separation lump-sum payments were made to 30 of 79 (38%) employees whose records we examined; we identified unreduced leave credits with a value of $1,468,712 and we projected additional unreduced leave credits with a value of $3,737,887. In addition, FSP underpaid two of the 79 employees (3%) by $926; we projected an additional $2,357 in underpayments. Furthermore, FSP did not make separation lump-sum payments to one of the employees in a timely manner (see Finding 3). • FSP did not reduce employees’ balances in the State’s leave accounting system after one of the 79 leave buy-back transactions that we examined. We identified unreduced leave credits with a value of 1 In planning and performing our audit of compliance, we considered FSP’s internal control over compliance with collective bargaining agreements and state laws, regulations, policies, and procedures to determine the auditing procedures that were appropriate under the circumstances for the purpose of providing a conclusion on compliance, and to test and report on internal control over compliance. Our consideration of internal control over compliance was for the limited purpose described in the first paragraph of this footnote; it was not designed to identify all deficiencies in internal control over compliance that might be material weaknesses or significant deficiencies. As discussed in this section, we identified certain deficiencies in internal control over compliance that we consider to be material weaknesses. A deficiency in internal control over compliance exists when the design, implementation, or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A material weakness in internal control over compliance is a deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. A significant deficiency in internal control over compliance is a deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention from those charged with governance. -3- Folsom State Prison Payroll Audit $1,752 and we projected additional unreduced leave credits with a value of $3,061 (see Finding 4). • FSP had inadequate controls to ensure that salary advances were administered in accordance with requirements and collected in a timely manner. Three salary advances, totaling $3,153, remained outstanding for more than 90 days as of June 30, 2021 (see Finding 5). Follow-up on We have not previously conducted an audit of FSP’s payroll process and Prior Audit transactions. Findings Views of We issued a draft audit report on September 11, 2024. FSP’s representative responded by letter dated September 19, 2024, acknowledging the audit Responsible results. This final audit report includes FSP’s response as an attachment. Officials Restricted Use This audit report is solely for the information and use of FSP, the California Department of Corrections and Rehabilitation, and the SCO; it is not intended to be, and should not be, used by anyone other than these specified parties. This restriction is not intended to limit distribution of this audit report, which is a matter of public record and is available on the SCO website at www.sco.ca.gov. Original signed by Kimberly A. Tarvin, CPA Chief, Division of Audits December 20, 2024 -4- Folsom State Prison Payroll Audit Schedule— Summary of Audit Results July 1, 2018, through June 30, 2021 -5- A u d it A r e a T e s te d S e g r e g a tio n o f d u tie s S y s te m a c c e s s R e g u la r p a y O v e r tim e p a y S e p a r a tio n lu m p - s u m p a y E x c e s s v a c a tio n a n d a n n u a l le a v e U n if o r m a llo w a n c e L e a v e b u y - b a c k S a la r y a d v a n c e H o lid a y c r e d it M S TSS S TSSTT e th o d o e le c tio n N /A a r g e te d ta tis tic a ta tis tic a ta tis tic a a r g e te d ta tis tic a ta tis tic a a r g e te d a r g e te d f ll l ll N u m b e r o f U n its o f P o p u la tio n N /A 3 2 3 7 ,5 7 6 1 8 ,7 8 9 2 1 9 7 9 1 ,8 8 6 2 1 8 1 3 2 5 D o lla r A m o f P o p u la N /A N /A $ 2 6 9 ,5 5 4 2 9 ,0 9 9 8 ,0 7 9 2 ,4 4 4 1 ,6 2 7 8 3 7 9 8 2 2 $ 3 1 1 ,7 6 3 o u tio ,6,1 ,8 ,0,4,9,3,0,6 nn 88 9 158811 t 94 0 721564 N 11 1 NSE /A 3 2 0 5 0 5 7 9 7 9 0 5 7 9 1 3 2 5 uex m b e r o f le c tio n s a m in e d E m p lo y e e T r a n s a c tio T r a n s a c tio E m p lo y e e E m p lo y e e T r a n s a c tio T r a n s a c tio T r a n s a c tio T r a n s a c tio snn s snnnn ss ssss D o lla r A m o u n t o f S e le c tio n s E x a m in e d N /A N /A $ 7 9 7 ,2 8 9 1 6 2 ,6 6 0 2 ,2 7 9 ,2 2 9 2 ,4 4 4 ,0 1 7 9 0 ,8 1 7 3 0 5 ,0 0 9 9 8 ,3 8 5 2 2 ,0 1 6 $ 6 ,1 9 9 ,4 2 2 N e t T o ta l D o lla r A m o u n t o f I d e n tif ie d I m p r o p e r C o s ts N /A N /A $ - - 1 ,4 6 7 ,7 8 6 - - 1 ,7 5 2 3 ,1 5 3 - $ 1 ,4 7 2 ,6 9 1 N e t T o ta l D o lla r A m o u n t o f P r o je c te d I m p r o p e r C o s ts a n d I d e n tif ie d a n d P r o je c te d U n s u p p o r te d C o s ts N /A N /A $ - - 3 ,7 3 5 ,5 3 0 - - 3 ,0 6 1 - - $ 3 ,7 3 8 ,5 9 1 FN in d u m12 3 45 inb g e r Folsom State Prison Payroll Audit Findings and Recommendations FINDING 1— FSP lacked adequate segregation of duties within its payroll transactions unit to ensure that only valid and authorized payroll transactions were Inadequate processed. FSP also failed to implement other controls to compensate for segregation of this risk. duties and lack of compensating Our audit found that FSP payroll transactions unit staff performed controls over conflicting duties. Staff members performed multiple steps in processing payroll payroll transactions, including entering data into the State’s payroll transactions system; auditing employee timesheets; reconciling payroll, including reconciling system output to source documentation; reporting payroll exceptions; and processing adjustments. For example, staff members keyed in regular and overtime pay, and reconciled the master payroll, overtime, and other supplemental warrants. FSP failed to demonstrate that it implemented compensating controls to mitigate the risks associated with such a deficiency. We found no indication that these functions were subjected to periodic supervisory review. The lack of adequate segregation of duties and compensating controls has a pervasive effect on the FSP payroll process, and impairs the effectiveness of other controls by rendering their design ineffective or by keeping them from operating effectively. These control deficiencies, in combination with other deficiencies discussed in Findings 2 through 5, represent a material weakness in internal control over the payroll process such that there is a reasonable possibility that material noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. Good internal control practices require that the following functional duties be performed by different work units, or at minimum, by different employees within the same unit: • Recording transactions – This duty refers to the record-keeping function, which is accomplished by entering data into a computer system. • Authorization to execute – This duty belongs to individuals with authority and responsibility to initiate and execute transactions. • Periodic review and reconciliation of actual payments to recorded amounts – This duty refers to making comparisons of information at regular intervals and taking action to resolve differences. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including proper segregation of duties and an effective system of internal review. Adequate segregation of duties reduces the likelihood that fraud or error will remain undetected by providing for separate processing by different individuals at various stages of a transaction and for independent reviews of the work performed. -6- Folsom State Prison Payroll Audit Recommendation We recommend that FSP: • Separate conflicting payroll functional duties to the greatest extent possible. Adequate segregation of duties will provide a stronger system of internal control whereby the functions of each employee are subject to the review of another. If it is not possible to segregate payroll functions fully and appropriately, FSP should implement compensating controls. For example, if the payroll transactions unit staff member responsible for recordkeeping also performs a reconciliation process, then the supervisor should perform and document a detailed review of the reconciliation to provide additional control over the assignment of conflicting functions. Compensating controls may also include dual authorization requirements and documented reviews of payroll system input and output; and • Develop formal procedures for performing and documenting compensating controls. FINDING 2— FSP lacked adequate controls to ensure that only appropriate staff members had keying access to the State’s payroll system. FSP Inappropriate inappropriately allowed 13 employees keying access to the State’s payroll keying access to the system because FSP did not immediately remove or modify keying access State’s payroll for the employees after the employees’ separation from state service, system transfer to another agency, or change in classification. The SCO maintains the State’s payroll system. The system is decentralized, thereby allowing employees of state agencies to access it. All state agencies are required to comply with PPSD’s Decentralized Security Program Manual (DSP Manual) in order to access the payroll system. The DSP Manual describes how state agencies can secure and protect the confidentiality and integrity of payroll data against misuse, abuse, and unauthorized use. We examined the records of 32 FSP employees who had keying access to the State’s payroll system at various times between July 2018 and June 2021. Of the 32 employees, 13 had inappropriate keying access to the State’s payroll system. Specifically, FSP did not immediately remove or modify keying access for the employees after the employees’ separation from state service, transfer to another agency, or change in classification. For example, a Personnel Specialist left FSP on June 30, 2019, but FSP did not request to remove the employee’s access until December 12, 2019—165 days later. FSP lacked periodic review of keying access granted to employees to ensure compliance with the DSP Manual. If not mitigated, this control deficiency leaves payroll data at risk of misuse, abuse, and unauthorized use. -7- Folsom State Prison Payroll Audit The December 2015 DSP Manual (“Access Requirements,” page 13) states, in part: The [State’s payroll system] contains sensitive and confidential information. Access is restricted to persons with an authorized, legal, and legitimate business requirement to complete their duties. . . . If the employee’s duties change, such that the need for access no longer exists, the access privilege MUST be removed or deleted immediately by a request submitted by the department/campus. The June 2020 DSP Manual (“Access Requirements,” page 6) states, in part: The [State’s payroll system] contains sensitive and confidential information. Access is restricted to persons with an authorized, legal, and legitimate business requirement to complete their regular daily duties. . . . If the employee’s duties change, such that the need for access no longer exists, the access privilege MUST be removed or deleted immediately via a request submitted by the department/campus. The October 2020 DSP Manual (“Access Requirements,” page 5) states, in part: The [State’s payroll system] contains sensitive and confidential information. Access is restricted to persons with an authorized, legal, and legitimate business requirement to complete their regular daily duties. . . . If the employee's duties change, such that the need for access no longer exists, the access privilege MUST be removed or deleted immediately via a request submitted by the department/campus Security Monitor/Assistant Security Monitor. . . . The December 2015 DSP Manual (“Revocation and Deletion of User IDs,” page 17) states, in part: To prevent unauthorized use by a transferred, terminated or resigned employee’s user ID, the Security Monitor must IMMEDIATELY submit all pages of the PSD125A [Security Authorization form] to delete the user’s system access. Using an old user ID increases the chances of a security breach, which is a serious security violation. Sharing a user ID is strictly prohibited and a serious violation. . . . The June 2020 DSP Manual (“Revocation and Deletion of User IDs,” page 10) states, in part: To prevent unauthorized use by a transferred, terminated or resigned employee’s User ID, the Security Monitor must IMMEDIATELY submit all pages of the PSD125A signed by both Security Monitor and Authorizing Manager to delete the user’s system access. Using an old User ID increases the risk of a security breach, which is a serious security violation. Sharing a User ID is strictly prohibited. . . . -8- Folsom State Prison Payroll Audit The October 2020 DSP Manual (“Revocation and Deletion of User IDs,” page 7) states, in part: To prevent unauthorized use by a transferred, terminated or resigned employee's User ID, the Security Monitor must IMMEDIATELY contact DSA by email. The Security Monitor/Assistant Security Monitor must submit all pages of the PSD125A signed by both Security Monitor Assistant Security Monitor and Authorizing Official/Assistant Authorizing Official to delete the user’s system access. Using an old User ID increases the risk of a security breach, which is a serious security violation. Sharing a User ID is strictly prohibited. . . . Recommendation We recommend that FSP: • Update keying access to the State’s payroll system immediately after employees leave FSP, transfer to another unit, or change classifications; and • Periodically review access to the system to verify that access complies with the DSP Manual. FINDING 3— FSP lacked adequate segregation of duties within its payroll transactions Inaccurate leave unit, as noted in Finding 1. It also lacked adequate controls to ensure accurate leave accounting for separation lump-sum payments; adequate accounting; controls over the processing of employee separation lump-sum pay; and improper and late adequate supervisory review to ensure accurate and timely processing of separation separation lump-sum payments. lump-sum payments Payroll records show that FSP processed separation lump-sum payments, totaling $8,079,890, for 219 employees between June 2018 and July 2021. Of the 219 employees, we randomly selected a statistical sample (as described in the Appendix) of 79 employees who received separation lump-sum payments, totaling $2,279,229. Based on our examination of the employees’ records, we found the following errors: • FSP did not appropriately reduce employees’ balances in the State’s leave accounting system for 30 of 79 (38%) employees to reflect the number of leave credits—with a value of $1,468,712—that had been paid. Unreduced leave balances pose a risk to the State because they overstate the State’s liability for leave balances and allow the possibility of improper and duplicative payments for leave credits. We projected the additional unreduced leave credits with a value of $3,737,887. • FSP underpaid two employees by a total of $926 because payroll transactions unit staff members miscalculated leave credits paid. We projected the additional underpayments to be $2,357. • FSP did not make separation lump-sum payments to one employee in a timely manner. If not mitigated, these control deficiencies leave FSP at risk of making additional improper and late separation lump-sum payments, noncompliance with agreements and laws, and liability for late payments. -9- Folsom State Prison Payroll Audit Statistical sampling results The identified value of unreduced leave credits and improper payments was $1,467,786. We used a statistical sampling method to select the employees whose separation lump-sum payments that we examined. We projected the additional value of unreduced leave credits to be $3,737,887. We also projected an additional $2,357 in underpayments. The projected unreduced leave credits and underpayments have an approximate net total value of $3,735,530. Therefore, the identified and projected unreduced leave credits and underpayments have an approximate net total value of $5,203,316, consisting of $5,206,599 in unreduced leave credits and $3,283 in underpayments. The following table summarizes the results of our statistical sampling (amounts are rounded to the nearest dollar): -10- I d e n tif ie d v a lu e o f u n r e d u c e d le a v e c r e d its a n d im p r o p e r p a y m e n ts , n e t D iv id e b y : S a m p le E r r o r r a te f o r p r o je c tio n ( d if f e r e n c e s d u e to r o u n d in P o p u la tio n th a t w a s s ta tis tic a lly s a m p le d M u ltip ly b y : E r r o r r a te f o r p r o je c tio n I d e n tif ie d a n d p r o je c te d v a lu e o f u n r e d u c e d le a v e c im p r o p e r p a y m e n ts , n e t ( d if f e r e n c e s d u e to r o u n d L e s s : I d e n tif ie d v a lu e o f u n r e d u c e d le a v e c r e d its a n im p r o p e r p a y m e n ts , n e t P r o je c te d v a lu e o f u n r e d u c e d le a v e c r e d its a n d im p r o p e r p a y m e n ts , n e t g ) r e d in g d its ) a n d $ 1 2 8 5 1 $ 3 ,4 ,26 ,0 6 ,2 ,4 ,7 6 74 7 4 0 6 3 7 ,7 9 ,2 .4 0 9 ,8 .4 0 3 ,3 7 ,7 5 ,5 8 2% 9 % 1 8 3 6 9 0 6 6 0 Criteria GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. GC section 19839 allows lump-sum payment for accrued eligible leave credits when an employee separates from state employment. Collective bargaining agreements include similar provisions regarding separation lump-sum pay. Collective bargaining agreements and state laws summarized in section 1703 of the California Department of Human Resources’ (CalHR) Human Resources Manual establish the requirements for separation lump- sum pay. Folsom State Prison Payroll Audit Recommendation We recommend that FSP: • Establish adequate controls to ensure that leave balances are properly reduced, and that separation lump-sum payments are calculated accurately and made in a timely manner; • Conduct a review of separation lump-sum payments made during the past three years to ensure that the payments were accurate and in compliance with collective bargaining agreements and state law; and • Properly compensate those employees who were underpaid. FINDING 4— FSP lacked adequate segregation of duties within its payroll transactions Inaccurate leave unit, as noted in Finding 1, and lacked adequate controls to ensure that accounting for credits that had been bought back were properly reduced in the State’s leave accounting system. leave buy-back A leave-buy back occurs when an employee receives payment at the regular salary rate in exchange for accrued vacation, annual leave, personal leave, personal holiday, and/or holiday credits. CalHR authorized leave buy-backs for excluded employees in fiscal year 2017-18 and fiscal year 2018-19. It also provided the State’s policies and procedures regarding cash-out of vacation and annual leave. Payroll records show that FSP processed 218 leave buy-back transactions, totaling $837,981, between July 2018 and July 2021. We randomly selected a statistical sample (as described in the Appendix) of 79 transactions, totaling $305,009. We examined these selected transactions to determine whether FSP complied with collective bargaining agreements and state regulations. We found that the leave balance for one employee had not been reduced to reflect the number of leave credits—with a value of $1,752—that had been paid. Unreduced leave balances pose a risk to the State because they overstate the State’s liability for leave balances and allow the possibility of improper and duplicative payments for leave credits. If not mitigated, these control deficiencies leave FSP at risk of making additional improper leave buy-back payments. Statistical sampling results The identified value of unreduced leave credits was $1,752. We used a statistical sampling method to select the leave buy-back transactions that we examined. We projected the additional value of unreduced leave credits to be $3,061. Therefore, the identified and projected unreduced leave credits have a total value of $4,813. -11- Folsom State Prison Payroll Audit The following table summarizes the results of our statistical sampling (amounts are rounded to the nearest dollar): -12- I d e n tif ie d v a lu e o f u n r e d u c e d le a v e D iv id e d b y : S a m p le E r r o r r a te f o r p r o je c tio n ( d if f e r e n c e s d u e to r o u n d in g ) P o p u la tio n th a t w a s s ta tis tic a lly s a m M u ltip ly b y : E r r o r r a te f o r p r o je c tio I d e n tif ie d a n d p r o je c te d v a lu e o f u n le a v e c r e d its ( d if f e r e n c e s d u e to L e s s : I d e n tif ie d v a lu e o f u n r e d u c e d P r o je c te d v a lu e o f u n r e d u c e d le a v e c r e d its p le d n r e d u c e d r o u n d in g ) le a v e c r e c r e d its d its $ 1 ,7 3 0 5 ,0 0 .5 7 8 3 7 ,9 0 .5 7 4 ,8 1 ,7 $ 3 ,0 5 0 % 8 % 1 56 2 9 1 3 21 Criteria GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Title 2, California Code of Regulations, section 599.744 provides that CalHR may also authorize a leave buy-back program for employees excluded from collective bargaining. Collective bargaining agreements between the State and various bargaining units allow for the annual cash-out of a certain number of hours of accumulated vacation and annual leave if funds are available. Recommendation We recommend that FSP establish adequate internal controls to ensure that employee leave balances are reduced in a timely manner after leave buy- back payments are made. FINDING 5— FSP lacked adequate segregation of duties within its payroll transactions Failure to collect unit, as noted in Finding 1, and lacked adequate controls over salary outstanding salary advances to ensure that they were collected in a timely manner in advances accordance with state law and policies. Three salary advances, totaling $3,153, remained outstanding for more than 90 days as of June 30, 2021. At June 30, 2021, FSP’s accounting records show 13 outstanding salary advances, totaling $98,385. We examined all 13 and found that three of them—with a value of $3,153—had been outstanding for more than 90 days. The oldest uncollected salary advance was outstanding for over 122 days. We noted that FSP had not initiated collection efforts for any of the salary advances that we examined. Salary advances are more difficult to collect after the employee leaves state service, and they may become uncollectable if not collected within three years. Folsom State Prison Payroll Audit If not mitigated, these control deficiencies leave FSP at risk of failing to collect further salary advances. GC section 19838 and State Administrative Manual (SAM) sections 8291, 8291.1, 8293, and 8293.2 describe the State’s collection policies and procedures, which require the collection of salary advances in a timely manner and maintenance of proper records of collection efforts. Specifically, GC section 19838(d) and SAM section 8293.2 require that actions to recover overpayments begin within three years of the date of overpayment. Recommendation We recommend that FSP ensure that it collects salary advances in a timely manner, pursuant to GC section 19838 and SAM sections 8291, 8291.1, 8293, and 8293.2. -13- Folsom State Prison Payroll Audit Appendix— Audit Sampling Methodology This Appendix outlines our audit sampling application for all audit areas where statistical sampling was used. We used attributes sampling for tests of compliance. We chose this sample design because: • It follows the American Institute of Certified Public Accountants (AICPA) guidelines; • It allowed us to achieve our objectives for tests of compliance in an efficient and effective manner; • Audit areas included high and low volumes of transactions; • We planned to project the results to the intended population; and • We had the collective knowledge and skills to plan and perform the sampling plan and design. We conducted compliance testing on samples chosen by computer-generated simple random selection. For populations of fewer than 250 items, we determined the sample size using a calculator with a hypergeometric distribution. For populations of 250 items or more, we determined the sample size using a calculator with a binomial distribution. As stated in Technical Notes on the AICPA Audit Guide: Audit Sampling (March 1, 2012), page 5, although the hypergeometric distribution is the correct distribution to use for attributes sample sizes, the distribution becomes unwieldy for large populations unless suitable software is available. Therefore, more convenient approximations are frequently used instead. The confidence levels were 95,00% for separation lump-sum pay and leave buy-back, and 90.00% for regular pay, overtime pay, and uniform allowance; the tolerable error rate was 5.00%; and the expected error rates were 3.00 (1.25%) for separation lump-sum pay and leave buy-back, and 2.00 (1.75%) for regular pay, overtime pay, and uniform allowance. Pursuant to the AICPA’s Audit Guide: Audit Sampling (December 1, 2019 edition), pages 131–132, the expected error rate is the expected number of errors planned for in the sample. It is derived by multiplying the expected error rate by the sample size. The expected number of errors in the sampling tables on pages 135–136 was rounded upward, e.g., 0.2 errors become 1.0 error. Results were projected to the intended (total) population. -A1- R O S U L e v e n e A u d A r e g u l a r p a y e r ti m e p a y p a r a ti o n l u m i f o r m a l l o w a v e b u y - b a c it a p - s a n c k u e m p a y P o p u ( U la t io n n it ) 3 7 ,5 7 6 1 8 ,7 8 9 2 1 9 1 ,8 8 6 2 1 8 $ P 2 o p ( D 6 9 2 9 8 1 u la t io n o lla r ) ,5 5 4 ,6 ,0 9 9 ,1 ,0 7 9 ,8 ,6 2 7 ,4 8 3 7 ,9 8 8 9 5 8 9 4 0 2 1 T T T T S r r E r r a a a m a a mU n s n s p n s n s p lin n it a c ti a c ti l o y e a c ti a c ti g o o e o o n n n n S a m p S iz e 1 0 5 1 0 5 7 9 1 0 5 7 9 le FN inu dm 3 4 inb g e r Folsom State Prison Payroll Audit Attachment— Folsom State Prison’s Response to Draft Audit Report State Controller’s Office Division of Audits Post Office Box 942850 Sacramento, CA 94250 www.sco.ca.gov S22-PAR-0006