California State University, Sacramento Payroll Audit

CALIFORNIA STATE UNIVERSITY, SACRAMENTO Audit Report PAYROLL AUDIT March 1, 2017, through February 29, 2020 M M. C ALIA OHEN C ALIFORNIA S TATE C ONTROLLER January 2025 MALIA M. COHEN CALIFORNIA STATE CONTROLLER January 15, 2025 Dr. Luke Wood, President California State University, Sacramento 6000 J Street Sacramento, CA 95819 Dear Dr. Wood: This is the final report on our audit of the California State University, Sacramento’s payroll process and transactions for the period of March 1, 2017, through February 29, 2020. The audit was conducted pursuant to Government Code sections 12476 and 12410. California State University, Sacramento management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. If you have any questions regarding this report, please contact Roochel Espilla, Chief, State Agency Audits Bureau, by telephone at 916-323-5744. Thank you. Sincerely, Original signed by Kimberly A. Tarvin, CPA Chief, Division of Audits KAT/ac MAILING ADDRESS P.O. Box 942850, Sacramento, CA 94250 SACRAMENTO 3301 C Street, Suite 700, Sacramento, CA 95816 | 916.324.8907 LOS ANGELES 901 Corporate Center Drive, Suite 200, Monterey Park, CA 91754 | 323.981.6802 Dr. Luke Wood January 15, 2025 Page 2 of 2 Copy: Machelle Martin, Senior Associate Vice President for Human Resources California State University, Sacramento Margaret Lee, Director of Payroll Services California State University, Sacramento Margaret Hwang, Chief of Operations Administration and Business Affairs California State University, Sacramento Mashariki Lawson-Cook, Audit Manager Auditing and Consulting Services California State University, Sacramento Mildred García, Ed.D., Chancellor California State University Albert A. Liddicoat, Ph.D., Interim Vice Chancellor for Human Resources California State University Vlad Marinescu, Chief Audit Officer California State University Sharon Best, Senior Manager Investigations and Intergovernmental Audits California State University Lisa Dean, Acting Chief Personnel and Payroll Services Division State Controller’s Office Veronica Encinas, Bureau Chief Personnel and Payroll Services Division State Controller’s Office MAILING ADDRESS P.O. Box 942850, Sacramento, CA 94250 SACRAMENTO 3301 C Street, Suite 700, Sacramento, CA 95816 | 916.324.8907 LOS ANGELES 901 Corporate Center Drive, Suite 200, Monterey Park, CA 91754 | 323.981.6802 California State University, Sacramento Payroll Audit Contents Audit Report Summary ............................................................................................................................ 1 Background ........................................................................................................................ 1 Audit Authority .................................................................................................................. 1 Objectives, Scope, and Methodology ............................................................................... 2 Conclusion .......................................................................................................................... 3 Follow-up on Prior Audit Findings .................................................................................. 4 Views of Responsible Officials .......................................................................................... 4 Restricted Use .................................................................................................................... 4 Schedule—Summary of Audit Results ................................................................................. 5 Findings and Recommendations ........................................................................................... 6 Appendix—Audit Sampling Methodology ........................................................................... A1 Attachment—California State University, Sacramento’s Response to Draft Audit Report California State University, Sacramento Payroll Audit Audit Report Summary The State Controller’s Office (SCO) audited the California State University, Sacramento’s (CSUS) payroll process and transactions for the period of March 1, 2017, through February 29, 2020. CSUS management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. Our audit determined that CSUS did not: • Maintain adequate and effective internal controls over certain aspects of its payroll process, as described in Findings 1 through 5; • Process payroll and payroll-related disbursements accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures in certain instances, as described in Findings 2 through 4; or • Administer salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures, as described in Finding 5. Background In 1979, the State of California adopted collective bargaining for state employees. This created a significant workload increase for the SCO’s Personnel and Payroll Services Division (PPSD), as PPSD was the State’s centralized payroll processing center for all payroll-related transactions. PPSD decentralized the processing of payroll, allowing state agencies and departments to process their own payroll-related transactions. Periodic audits of the decentralized payroll processing at state agencies and departments ceased due to the budget constraints in the late 1980s. In 2013, the California State Legislature reinstated these payroll audits to gain assurance that state agencies and departments maintain adequate internal control over the payroll function, provide proper oversight of their decentralized payroll processing, and comply with various state laws and regulations regarding payroll processing and related transactions. Audit Authority We conducted this audit in accordance with Government Code (GC) section 12476, which authorizes the SCO to audit the State’s payroll system, the State Pay Roll Revolving Fund, and related records of state agencies within the State’s payroll system. In addition, GC section 12410 provides the SCO with general authority to audit the disbursement of state money for correctness, legality, and sufficient provisions of law for payment. -1- California State University, Sacramento Payroll Audit Objectives, Scope, We performed this audit to determine whether CSUS: and Methodology • Maintained adequate and effective internal controls over its payroll process; • Processed payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures; and • Administered salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. The audit covered the period from March 1, 2017, through February 29, 2020. The audit population consisted of payroll transactions totaling $634,140,171, as quantified in the Schedule. To achieve our audit objectives, we performed the following procedures: • We reviewed state and CSUS policies and procedures related to the payroll process to understand CSUS’s methodology for processing various payroll and payroll-related transactions. • We interviewed CSUS payroll personnel to understand CSUS’s methodology for processing various payroll and payroll-related transactions, determine the employees’ level of knowledge and ability relating to payroll transaction processing, and gain an understanding of existing internal control over the payroll process and systems. • We selected transactions recorded in the State’s payroll database using statistical sampling, as outlined in the Appendix, and targeted selection based on risk factors and other relevant criteria. • We analyzed and tested the selected transactions and reviewed relevant files and records to determine the accuracy of payroll and payroll-related payments; accuracy of leave transactions; adequacy and effectiveness of internal control over the payroll process; and compliance with collective bargaining agreements and state laws, regulations, policies, and procedures. • We reviewed salary advances to determine whether CSUS administered and recorded them in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. • We assessed the reliability of computer-processed data on payroll and payroll-related transactions by interviewing CSUS officials knowledgeable about the data; reviewing existing information about the data and the system that produced it; and tracing data to source documents, based on statistical sampling and targeted selection. We determined that the data was sufficiently reliable for the purposes of this report. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a -2- California State University, Sacramento Payroll Audit reasonable basis for our findings and conclusions based on our audit objectives. Conclusion Our audit determined that CSUS did not maintain adequate and effective internal controls over its payroll process;1 did not process payroll and payroll-related disbursements accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures; and did not administer salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. We found deficiencies in internal control over the payroll process that we consider to be material weaknesses, and instances of noncompliance with the requirements of collective bargaining agreements and state laws, regulations, policies, and procedures. The material weaknesses and instances of noncompliance are as follows: • CSUS had inadequate segregation of duties and a lack of compensating controls over payroll transactions (see Finding 1). • CSUS overpaid three of 105 (3%) employees whose separation lump- sum payments that we examined by a total of $910, and underpaid 22 of 105 (21%) employees by a total of $13,830. We projected an additional $5,753 in overpayments and $87,393 in underpayments. In addition, CSUS did not make separation lump-sum payments to 47 of 105 (45%) employees in a timely manner (see Finding 2). • CSUS overpaid one of 113 overtime pay transactions that we examined by $62 and underpaid two of 113 overtime transactions by $67. We projected an additional $2,573 in overpayments and $2,753 in underpayments. In addition, timesheets were not consistently maintained for overtime payments. Based on our audit testing, we estimated that 2% of the timesheets associated with the audit period had not been retained. We identified $903 and projected an additional $37,316 in unsupported overtime payments (see Finding 3). • CSUS overpaid four of 105 settlement pay transactions that we examined by $397 and underpaid one of 105 transactions by $280. We 1 In planning and performing our audit of compliance, we considered CSUS’s internal control over compliance with collective bargaining agreements and state laws, regulations, policies, and procedures to determine the auditing procedures that were appropriate under the circumstances for the purpose of providing a conclusion on compliance, and to test and report on internal control over compliance. Our consideration of internal control over compliance was for the limited purpose described in the first paragraph of this footnote; it was not designed to identify all deficiencies in internal control over compliance that might be material weaknesses or significant deficiencies. As discussed in this section, we identified certain deficiencies in internal control over compliance that we consider to be material weaknesses. A deficiency in internal control over compliance exists when the design, implementation, or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct noncompliance on a timely basis. A material weakness in internal control over compliance is a deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. A significant deficiency in internal control over compliance is a deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention from those charged with governance. -3- California State University, Sacramento Payroll Audit projected an additional $6,978 in overpayments and $4,924 in underpayments (see Finding 4). • CSUS had inadequate controls to ensure that salary advances were administered in accordance with requirements and collected in a timely manner. Seven salary advances, totaling $5,413, remained outstanding for more than 200 days as of February 29, 2020 (see Finding 5). Follow-up on We have not previously conducted an audit of CSUS’s payroll process and Prior Audit transactions. Findings Views of We issued a draft audit report on September 10, 2024. CSUS’s Responsible representative responded by letter dated September 30, 2024, agreeing with the audit results. This final audit report includes CSUS’s response as Officials an attachment. Restricted Use This audit report is solely for the information and use of CSUS, the California State University, and the SCO; it is not intended to be, and should not be, used by anyone other than these specified parties. This restriction is not intended to limit distribution of this audit report, which is a matter of public record and is available on the SCO website at www.sco.ca.gov. Original signed by Kimberly A. Tarvin, CPA Chief, Division of Audits January 15, 2025 -4- California State University, Sacramento Payroll Audit Schedule— Summary of Audit Results March 1, 2017, through February 29, 2020 Net Total Dollar Amount of Projected Improper Costs Net Total and Identified Number of Number of Dollar Amount Dollar Amount and Projected Method of Units of Dollar Amount of Selections of Selections of Identified Unsupported Finding Audit Area Tested Selection Population Population Examined Examined Improper Costs Costs Number Segregation of duties N/A N/A N/A N/A N/A N/A N/A 1 System access Targeted 1 0 N/A 1 0 Employees N/A N/A N/A Regular pay Statistical 1 70,979 $ 592,894,238 7 7 Transactions $ 253,294 $ - $ - Excess vacation Targeted 1 17 3 48,875 1 0 Employees 96,620 - - Separation lump-sum pay Statistical 7 20 3,956,915 105 Employees 540,645 ( 12,920) ( 81,640) 2 Overtime pay Statistical 4 ,187 2,574,106 1 13 Transactions 68,858 283 38,039 3 and targeted Settlement pay Statistical 1 ,601 5,251,232 1 05 Transactions 282,557 117 2,054 4 Emergency pay Statistical 7 ,674 29,108,967 1 05 Transactions 267,456 - - Salary advance Targeted 8 5,838 8 Transactions 5 ,838 5 ,413 - 5 $ 634,140,171 $ 1,515,268 $ ( 7,107) $ (41,547) -5- California State University, Sacramento Payroll Audit Findings and Recommendations FINDING 1— CSUS lacked adequate segregation of duties within its payroll transactions unit to ensure that only valid and authorized payroll transactions were Inadequate processed. CSUS also failed to implement other controls to compensate segregation of duties for this risk. and a lack of compensating Our audit found that CSUS payroll transactions unit staff performed controls over payroll conflicting duties. Staff members performed multiple steps in processing transactions payroll transactions, including entering data into the State’s payroll system; auditing employee timesheets; calculating payments; reconciling payroll, including reconciling system output to source documentation; reporting payroll exceptions; and processing adjustments. For example, staff members keyed in regular and overtime pay, and reconciled the master payroll, overtime, and other supplemental warrants. CSUS failed to demonstrate that it had implemented compensating controls to mitigate the risks associated with such a deficiency. We found no indication that these functions were subjected to periodic supervisory review. The lack of adequate segregation of duties and compensating controls has a pervasive effect on the CSUS payroll process, and impairs the effectiveness of other controls by rendering their design ineffective or by keeping them from operating effectively. These control deficiencies, in combination with other deficiencies discussed in Findings 2 through 5, represent a material weakness in internal control over the payroll process such that there is a reasonable possibility that a material noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. Good internal control practices require that the following functional duties be performed by different work units, or at minimum, by different employees within the same unit: • Recording transactions – This duty refers to the record-keeping function, which is accomplished by entering data into a computer system. • Authorization to execute – This duty belongs to individuals with authority and responsibility to initiate and execute transactions. • Periodic review and reconciliation of actual payments to recorded amounts – This duty refers to making comparisons of information at regular intervals and taking action to resolve differences. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including proper segregation of duties and an effective system of internal review. Adequate segregation of duties reduces the likelihood that fraud or error will remain undetected by providing for separate processing by different individuals at various stages of a transaction and for independent reviews of the work performed. -6- California State University, Sacramento Payroll Audit Recommendation We recommend that CSUS: • Separate conflicting payroll function duties to the greatest extent possible. Adequate segregation of duties will provide a stronger system of internal control whereby the functions of each employee are subject to the review of another. If it is not possible to segregate payroll functions fully and appropriately, CSUS should implement compensating controls. For example, if the payroll transactions unit staff member responsible for recordkeeping also performs a reconciliation process, then the supervisor should perform and document a detailed review of the reconciliation to provide additional control over the assignment of conflicting functions. Compensating controls may also include dual authorization requirements and documented reviews of payroll system input and output; and • Develop formal procedures for performing and documenting compensating controls. CSUS lacked adequate segregation of duties within its payroll transactions FINDING 2— unit, as noted in Finding 1, and lacked adequate controls over the Improper and late processing of employee separation lump-sum pay. CSUS also lacked separation lump- adequate supervisory review to ensure accurate and timely processing of sum payments separation lump-sum pay. Payroll records show that CSUS processed separation lump-sum payments, totaling $3,956,915, for 720 employees between March 2017 and February 2020. We randomly selected a statistical sample (as described in the Appendix) of 105 employees who received separation lump-sum payments, totaling $540,645. Based on our examination of the selected records, we found the following errors: • CSUS overpaid three of 105 (3%) employees by $910 and underpaid 22 of 105 (21%) employees by $13,830 because payroll transactions unit staff members miscalculated the leave credits associated with separation lump-sum pay. In addition, CSUS lacked adequate supervisory review to ensure accurate processing of separation lump- sum pay. We projected an additional $5,753 in overpayments and $87,393 in underpayments. • CSUS did not make separation lump-sum payments to 47 of 105 (45%) employees in a timely manner. If not mitigated, these control deficiencies leave CSUS at risk of making additional improper and late separation lump-sum payments, noncompliance with agreements and laws, and liability for late payments. Statistical sampling results The identified improper payments represent a net total underpayment of $12,920. -7- California State University, Sacramento Payroll Audit We used a statistical sampling method to select the employees whose separation lump-sum payments we examined. We projected an additional $5,753 in overpayments and $87,393 in underpayments. The projected improper payments represent a net total underpayment of $81,640. The identified and projected underpayments totaled a net of approximately $94,560, consisting of $6,663 in overpayments and $101,223 in underpayments. The following table summarizes the results of our statistical sampling (amounts are rounded to the nearest dollar): -8- IDE PMI LP d e n tif ie d u n d e r p a y m e n ts , n e t iv id e b y : S a m p le r r o r r a te f o r p r o je c tio n ( d if f e r e n c e s d u o p u la tio n th a t w a s s ta tis tic a lly s a m p le d u ltip ly b y : E r r o r r a te f o r p r o je c tio n d e n tif ie d a n d p r o je c te d u n d e r p a y m e n ts e s s : I d e n tif ie d u n d e r p a y m e n ts , n e t r o je c te d u n d e r p a y m e n ts , n e t e to , n e r o u n t ( d if d f e in g ) r e n c e s d u e to r o u n d in g ) $ 1 2 ,9 2 0 5 4 0 ,6 4 5 2 .3 9 % $ 3 ,9 5 6 ,9 1 5 2 .3 9 % 9 4 ,5 6 0 1 2 ,9 2 0 $ 8 1 ,6 4 0 Criteria GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. Education Code section 89504 allows lump-sum payment for accrued eligible leave credits when an employee separates from state employment. Collective bargaining agreements include similar provisions regarding separation lump-sum pay. Recommendation We recommend that CSUS: • Establish adequate controls to ensure that separation lump-sum payments are calculated accurately and made in a timely manner; • Conduct a review of separation lump-sum payments made during the past three years to ensure that the payments were accurate and in compliance with collective bargaining agreements and state law; • Recover any overpayments made to separated employees through an agreed-upon collection method in accordance with Chapter 28, “Accounts Receivable,” of the California State University (CSU) Legal Manual; and • Properly compensate those employees who were underpaid. FINDING 3— CSUS lacked adequate segregation of duties within its payroll transactions Improper payments unit, as noted in Finding 1. It also lacked adequate controls over the and missing processing of overtime pay, and adequate supervisory review to ensure timesheets for accurate processing of overtime pay transactions. overtime pay California State University, Sacramento Payroll Audit Payroll records show that CSUS processed 4,187 overtime pay transactions, totaling $2,574,106, between March 2017 and February 2020, as follows (amounts are rounded to the nearest dollar): -9- O v e r tim e N o n - e x e m p t u n d e r th e F ( s ta tis tic a lly s a m p le d ) E x e m p t u n d e r th e F a ir L ( ite m s e x a m in e d 1 0 0 % P a y m e n t T y p e b a ir L a b o r S ta n d a r a b o r S ta n d a r d s A )T o ta l p o p u la tio n y d c G r s A t o c u p t U n it 4 ,1 7 9 8 4 ,1 8 7 A m o u n t $ 2 ,5 6 5 ,8 8 ,2 $ 2 ,5 7 4 ,1 6 4 0 2 4 6 There were 4,179 transactions for employees who are considered non- exempt under the Fair Labor Standards Act; and eight transactions for exempt employees (i.e. those who are not eligible for overtime pay, except when there are special considerations). We randomly selected a statistical sample (as described in the Appendix) of 105 transactions, totaling $60,614, for non-exempt employees. We also selected a targeted sample of the eight overtime pay transactions, totaling $8,244, for exempt employees. Based on our examination of these selected transactions, we found the following errors: • Two transactions were overpaid by $350 and two were underpaid by $67 because payroll transactions unit staff members used an incorrect salary rate; and paid for overtime hours worked at the straight-time rate instead of the time-and-a-half rate, or vice-versa. In addition, CSUS lacked adequate supervisory review to ensure accurate processing of overtime pay. We projected an additional $2,573 in overpayments and $2,753 in underpayments. • Two transactions, totaling $903, were unsupported because payroll transactions unit staff members could not locate the supporting documentation (timesheets and calculations). We could not determine the validity, accuracy, and propriety of the payments made to the employees; or the completeness and accuracy of leave accounting records. We projected an additional $37,316 in unsupported payments. If not mitigated, these control deficiencies leave CSUS at risk of making additional improper and unsupported overtime payments. Statistical sampling results The identified improper and unsupported payments to non-exempt employees represent a net total of $898. We used a statistical sampling method to select the overtime pay transactions that we examined. We projected an additional $2,573 in overpayments and $2,753 in underpayments; we also projected an additional $37,316 in unsupported payments. The projected improper and unsupported payments represent a net total of $37,136. The identified and projected improper and unsupported payments totaled a net of approximately $38,034, consisting of $2,635 in overpayments, $2,820 in underpayments, and $38,219 in unsupported payments. California State University, Sacramento Payroll Audit The following table summarizes the results of our statistical sampling (amounts are rounded to the nearest dollar): Identified improper and unsupported payments, net $ 898 Divide by: Sample 60,614 Error rate for projection (differences due to rounding) 1.48% Population that was statistically sampled $ 2,565,862 Multiply by: Error rate for projection 1.48% Identified and projected improper and unsupported payments, net (differences due to rounding) 38,034 Less: Identified improper and unsupported payments, net 898 Projected improper and unsupported payments, net $ 37,136 Criteria GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Collective bargaining agreements and Education Code section 89502 contain specific clauses regarding overtime pay. CSUS’s General Retention Schedule for Payroll/Personnel Records specifies a four-year retention period for timesheets. Recommendation We recommend that CSUS: • Conduct a review of overtime payments made during the past three years to ensure that the payments complied with collective bargaining agreements and state law; • Recover any overpayments made to employees through an agreed- upon collection method in accordance with Chapter 28, “Accounts Receivable,” of the CSU Legal Manual; and • Properly compensate those employees who were underpaid. We further recommend that, to prevent improper overtime payments from recurring, CSUS: • Establish adequate internal controls to ensure that payments are accurate and comply with collective bargaining agreements and state law; • Provide adequate oversight to ensure that payroll transactions unit staff members process only valid and authorized payments that comply with collective bargaining agreements and state law; and • Maintain supporting documentation for payments, pursuant to its retention policies. -10- California State University, Sacramento Payroll Audit CSUS lacked adequate segregation of duties within its payroll transactions unit, as noted in Finding 1. It also lacked adequate controls over the processing of settlement pay, and adequate supervisory review to ensure accurate processing of settlement pay. Payroll records show that CSUS processed 1,601 settlement pay transactions, totaling $5,251,232, between March 2017 and February 2020. We randomly selected a statistical sample (as described in the Appendix) of 105 settlement pay transactions, totaling $282,557. Based on our examination of the selected transactions, we found that CSUS overpaid four settlement payments by approximately $397 and underpaid one settlement payment by approximately $280 because payroll transactions unit staff members miscalculated the payments. We projected an additional $6,978 in overpayments and an additional $4,924 in underpayments. If not mitigated, these control deficiencies leave CSUS at risk of making additional improper settlement payments. Statistical sampling results The identified improper payments represent a net total of $117. We used a statistical sampling method to select the settlement payments that we examined. We projected an additional $6,978 in overpayments and $4,924 in underpayments. The projected improper payments represent a net total of $2,054. The identified and projected improper payments totaled a net of approximately $2,171, consisting of $7,375 in overpayments and $5,204 in underpayments. The following table summarizes the results of our statistical sampling (amounts are rounded to the nearest dollar): -11- I d e n tif ie d im p r o p e r p a y m e n ts , n e t D iv id e b y : S a m p le E r r o r r a te f o r p r o je c tio n ( d if f e r e n c e P o p u la tio n th a t w a s s ta tis tic a lly s a m M u ltip ly b y : E r r o r r a te f o r p r o je c tio I d e n tif ie d a n d p r o je c te d im p r o p e r p ( d if f e r e n c e s d u e to r o u n d in g ) L e s s : I d e n tif ie d im p r o p e r p a y m e n ts P r o je c te d im p r o p e r p a y m e n ts , n e t s d u e p le d na y m e , n e t to r o n ts , n u e n d t in g ) $ 1 1 7 2 8 2 ,5 5 7 0 .0 4 % 5 ,2 5 1 ,2 3 2 0 .0 4 % 2 ,1 7 1 1 1 7 $ 2 ,0 5 4 FINDING 4— Improper settlement payments Criteria GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. Title 5, California Code of Regulations, section 42805 specifies the requirements for settlement pay. California State University, Sacramento Payroll Audit Section F 011 (revised August 1993) of SCO’s Payroll Procedures Manual states, in part: Adjustment of annual wages is referred to as a “settlement.” A settlement shall be certified for each academic year employee or ten-month academic employee whose pay has been adjusted during the period of employment due to a late start, dock, transfer between positions, or a separation. When settlements are submitted, adjustments will be made for work at two or more time bases or salary rates. Section F 012 (revised January 2002) of SCO’s Payroll Procedures Manual states, in part: When separate settlement amounts are computed and an employee has been employed at two or more time bases or has had two or more salary rates in the academic year, semester, quarter, or summer quarter, separate salary settlements shall also be computed for completed semesters and academic quarters prior to the semester or academic quarter in which separation occurs. The separate settlement calculations shall then be added together to determine the total settlement amount due the employee for all time bases and rates combined. Recommendation We recommend that CSUS: • Establish adequate controls to ensure that settlement payments are accurate and in compliance with state regulations and policy; and • Recover overpayments made to employees through an agreed-upon collection method in accordance with Chapter 28, “Accounts Receivable,” of the CSU Legal Manual; and • Properly compensate those employees who were underpaid. FINDING 5— CSUS lacked adequate segregation of duties within its payroll transactions Failure to collect unit, as noted in Finding 1. It also lacked adequate controls over salary advances to ensure that advances were collected in a timely manner in outstanding salary accordance with state laws and policies. Seven salary advances, totaling advances $5,413, remained outstanding for more than 200 days as of outstanding salary February 29, 2020. advances At February 29, 2020, CSUS’s accounting records showed eight outstanding salary advances, totaling $5,838. One balance was written off as a result of an agreement between the employee and CSUS. We further examined the remaining seven balances, totaling $5,413, which had been outstanding for an average of 874 days. We noted that the oldest unrecovered salary advance was outstanding for over five years, and that CSUS had not initiated timely collection efforts for the seven advances. For example, CSUS issued a salary advance to an employee in May 2014; however, CSUS did not issue any collection notices during the audit period. Salary advances are more difficult to collect after an employee leaves state service, and they might become uncollectable if not collected within three years. -12- California State University, Sacramento Payroll Audit If not mitigated, these control deficiencies leave CSUS at risk of failing to collect further salary advances. Chapter 28, “Accounts Receivable,” of the CSU Legal Manual and State Administrative Manual sections 8291, 8291.1, and 8293 describe the state and CSUS collection policies and procedures, which require the collection of salary advances in a timely manner and the maintenance of proper records of collection efforts. Recommendation We recommend that CSUS ensure that it collects salary advances in a timely manner, pursuant to pursuant to Chapter 28, “Accounts Receivable,” of the CSU Legal Manual and State Administrative Manual sections 8291, 8291.1, and 8293. -13- California State University, Sacramento Payroll Audit Appendix— Audit Sampling Methodology This Appendix outlines our audit sampling application for all audit areas where statistical sampling was used. We used attributes sampling for tests of compliance. We chose this sample design because: • It follows the American Institute of Certified Public Accountants (AICPA) guidelines; • It allowed us to achieve our objectives for tests of compliance in an efficient and effective manner; • Audit areas included high volumes of transactions; • We planned to project the results to the intended population; and • We had the collective knowledge and skills to plan and perform the sampling plan and design. We conducted compliance testing on samples chosen by computer-generated simple random selection. For populations of 250 items or more, we determined the sample size using a calculator with a binomial distribution. As stated in Technical Notes on the AICPA Audit Guide: Audit Sampling (March 1, 2012), page 5, although the hypergeometric distribution is the correct distribution to use for attributes sample sizes, the distribution becomes unwieldy for large populations unless suitable software is available. Therefore, more convenient approximations are frequently used instead. The confidence level was 90.00%; the tolerable error rate was 5.00%; and the expected error rates were 1.00 (1.25%) for regular pay, and 2.00 (1.75%) for the other audit areas. Pursuant to the AICPA’s Audit Guide: Audit Sampling (December 1, 2019 edition), pages 131–132, the expected error rate is the expected number of errors planned for in the sample. It is derived by multiplying the expected error rate by the sample size. The expected number of errors in the sampling tables on pages 135–136 was rounded upward, e.g., 0.2 errors become 1.0 error. Results were projected to the intended (total) population. -A1- R S O S E A u d A r e e g u la r p a y e p a r a tio n lu m p v e r tim e p a y e ttle m e n t p a y m e r g e n c y p a y it a - s u m p a y P o p u la t io ( U n it ) 1 7 0 ,9 7 4 ,1 1 ,6 7 ,6 n 7 2 8 0 7 9 0 7 1 4 P o p u ( D o $ 5 9 2 3 2 5 2 9 la t io n lla r ) ,8 9 4 ,2 ,9 5 6 ,9 ,5 7 4 ,1 ,2 5 1 ,2 ,1 0 8 ,9 3 1 0 3 6 8 5 6 2 7 T E T T T S r a m r a r a r a a n p n n n m p lin U n it s a c tio lo y e e s a c tio s a c tio s a c tio g n n n n S a m p le S iz e 7 7 1 0 5 1 0 5 1 0 5 1 0 5 FN in d u m 2 3 4 in g b e r California State University, Sacramento Payroll Audit Attachment— California State University, Sacramento’s Response to Draft Audit Report State Controller’s Office Division of Audits Post Office Box 942850 Sacramento, CA 94250 www.sco.ca.gov S21-PAR-0001