San Diego State University Payroll Audit

SAN DIEGO STATE UNIVERSITY Audit Report PAYROLL AUDIT March 1, 2017, through February 29, 2020 M M. C ALIA OHEN C ALIFORNIA S TATE C ONTROLLER February 2025 MALIA M. COHEN CALIFORNIA STATE CONTROLLER February 5, 2025 Dr. Adela De La Torre, President San Diego State University 5500 Campanile Drive San Diego, CA 92182 Dear Dr. De La Torre: The State Controller’s Office audited San Diego State University’s payroll process and transactions for the period of March 1, 2017, through February 29, 2020. The audit was conducted pursuant to Government Code sections 12476 and 12410. San Diego State University management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. If you have any questions regarding this report, please contact Roochel Espilla, Chief, State Agency Audits Bureau, by telephone at 916-323-5744. Thank you. Sincerely, Original signed by Kimberly A. Tarvin, CPA Chief, Division of Audits KAT/rs MAILING ADDRESS P.O. Box 942850, Sacramento, CA 94250 SACRAMENTO 3301 C Street, Suite 700, Sacramento, CA 95816 | 916.324.8907 LOS ANGELES 901 Corporate Center Drive, Suite 200, Monterey Park, CA 91754 | 323.981.6802 Dr. Adela De La Torre February 5, 2025 Page 2 of 2 Copy: Agnes Wong Nickerson, Vice President for Business and Financial Affairs San Diego State University Thom Harpole, Senior Director Human Resources San Diego State University Isidro Cervantes, Associate Director Human Resources Operations San Diego State University Lisa Hendricks, Manager Payroll Services San Diego State University Mayra Villalta, Director Audit and Continuous Improvement San Diego State University Mildred García, Ed.D., Chancellor California State University Albert A. Liddicoat, Ph.D., Interim Vice Chancellor for Human Resources California State University Vlad Marinescu, Chief Audit Officer California State University Sharon Best, Senior Manager Investigations and Intergovernmental Audits California State University Lisa Dean, Acting Chief Personnel and Payroll Services Division State Controller’s Office Veronica Encinas, Bureau Chief Personnel and Payroll Services Division State Controller’s Office MAILING ADDRESS P.O. Box 942850, Sacramento, CA 94250 SACRAMENTO 3301 C Street, Suite 700, Sacramento, CA 95816 | 916.324.8907 LOS ANGELES 901 Corporate Center Drive, Suite 200, Monterey Park, CA 91754 | 323.981.6802 San Diego State University Payroll Audit Contents Audit Report Summary ............................................................................................................................ 1 Background ........................................................................................................................ 1 Audit Authority.................................................................................................................. 1 Objectives, Scope, and Methodology ............................................................................... 2 Conclusion .......................................................................................................................... 3 Follow-up on Prior Audit Findings .................................................................................. 4 Views of Responsible Officials .......................................................................................... 4 Restricted Use .................................................................................................................... 4 Schedule—Summary of Audit Results ................................................................................. 5 Findings and Recommendations ........................................................................................... 6 Appendix—Audit Sampling Methodology ........................................................................... A1 Attachment—San Diego State University’s Response to Draft Audit Report San Diego State University Payroll Audit Audit Report Summary The State Controller’s Office (SCO) audited San Diego State University’s (SDSU) payroll process and transactions for the period of March 1, 2017, through February 29, 2020. SDSU management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. While SDSU generally maintained adequate internal controls over payroll in most areas, our audit determined that SDSU did not: • Maintain adequate and effective internal controls over certain aspects of its payroll process, as described in Findings 1 through 3; • Process some payroll and payroll-related disbursements accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures in certain instances, as described in Finding 3; or • Administer salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures, as described in Finding 2. Background In 1979, the State of California adopted collective bargaining for state employees. This created a significant workload increase for the SCO’s Personnel and Payroll Services Division (PPSD), as PPSD was the State’s centralized payroll processing center for all payroll-related transactions. PPSD decentralized the processing of payroll, allowing state agencies and departments to process their own payroll-related transactions. Periodic audits of the decentralized payroll processing at state agencies and departments ceased due to the budget constraints in the late 1980s. In 2013, the California State Legislature reinstated these payroll audits to gain assurance that state agencies and departments maintain adequate internal control over the payroll function, provide proper oversight of their decentralized payroll processing, and comply with various state laws and regulations regarding payroll processing and related transactions. Audit Authority We conducted this audit in accordance with Government Code (GC) section 12476, which authorizes the SCO to audit the State’s payroll system, the State Pay Roll Revolving Fund, and related records of state agencies within the State’s payroll system. In addition, GC section 12410 provides the SCO with general authority to audit the disbursement of state money for correctness, legality, and sufficient provisions of law for payment. -1- San Diego State University Payroll Audit Objectives, Scope, Our audit objectives were to determine whether SDSU: and Methodology • Maintained adequate and effective internal controls over its payroll process; • Processed payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures; and • Administered salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. The audit covered the period from March 1, 2017, through February 29, 2020. The audit population consisted of payroll transactions totaling $768,202,418, as quantified in the Schedule. To achieve our audit objectives, we performed the following procedures: • We reviewed state and SDSU policies and procedures related to the payroll process to understand SDSU’s methodology for processing various payroll and payroll-related transactions. • We interviewed SDSU payroll personnel to understand SDSU’s methodology for processing various payroll and payroll-related transactions, determine the employees’ level of knowledge and ability relating to payroll transaction processing, and gain an understanding of existing internal control over the payroll process and systems. • We selected transactions recorded in the State’s payroll database using statistical sampling, as outlined in the Appendix, and targeted selection based on risk factors and other relevant criteria. • We analyzed and tested the selected transactions and reviewed relevant files and records to determine the accuracy of payroll and payroll-related payments; accuracy of leave transactions; adequacy and effectiveness of internal control over the payroll process; and compliance with collective bargaining agreements and state laws, regulations, policies, and procedures. • We reviewed salary advances to determine whether SDSU administered and recorded them in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. • We assessed the reliability of computer-processed data for payroll and payroll-related transactions by interviewing SDSU officials knowledgeable about the data; reviewing existing information about the data and the system that produced it; and tracing data to source documents, based on statistical sampling and targeted selection. We determined that the data was sufficiently reliable for the purposes of this report. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a -2- San Diego State University Payroll Audit reasonable basis for our findings and conclusions based on our audit objectives. Conclusion While SDSU generally maintained adequate internal controls over payroll in most areas, our audit determined that SDSU did not maintain adequate and effective internal controls over certain aspects of its payroll process;1 did not process some payroll and payroll-related disbursements accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures; and did not administer salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. We found one deficiency in internal control over the payroll process that we consider to be a material weakness, and instances of noncompliance with the requirements of collective bargaining agreements and state laws, regulations, policies, and procedures that we consider significant deficiencies. The material weakness and instances of noncompliance are as follows: • Seven of 31 (23%) employees whose records we examined during our audit had inappropriate access to the State’s payroll system (see Finding 1). • SDSU had inadequate controls to ensure that salary advances were administered in accordance with requirements and collected in a timely manner. Four salary advances, totaling $9,248, remained outstanding for more than 90 days as of February 29, 2020 (see Finding 2). • SDSU overpaid one of the 105 employees whose separation lump-sum payments we examined, and underpaid another of the employees. We identified approximately $149 in overpayments and projected an additional $1,194 in overpayments; and we identified $761 in underpayments and projected another $6,065 in underpayments. In addition, SDSU did not make separation lump-sum payments to 26 of the employees in a timely manner (see Finding 3). 1 In planning and performing our audit of compliance, we considered SDSU’s internal control over compliance with collective bargaining agreements and state laws, regulations, policies, and procedures to determine the auditing procedures that were appropriate under the circumstances for the purpose of providing a conclusion on compliance, and to test and report on internal control over compliance. Our consideration of internal control over compliance was for the limited purpose described in the first paragraph of this footnote; it was not designed to identify all deficiencies in internal control over compliance that might be material weaknesses or significant deficiencies. As discussed in this section, we identified one deficiency in internal control over compliance that we consider to be a material weakness as described in Finding 1. A deficiency in internal control over compliance exists when the design, implementation, or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A material weakness in internal control over compliance is a deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. A significant deficiency in internal control over compliance is a deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention from those charged with governance. We considered Findings 2 and 3 significant deficiencies. -3- San Diego State University Payroll Audit Follow-up on We have not previously conducted an audit of SDSU’s payroll process and Prior Audit transactions. Findings Views of We issued a draft audit report on September 10, 2024. SDSU’s Responsible representative responded by letter dated September 18, 2024. SDSU Officials generally agreed with the audit results and provided additional information and context. After further consideration of the SDSU’s response to the draft report, we revised the Summary and Conclusion Section of the report. SDSU also provided additional information regarding the Findings. Our comments on SDSU’s response to the Findings are included in the Findings and Recommendations section. This final audit report includes SDSU’s response as an attachment. We appreciate SDSU’s willingness to take corrective actions to improve its internal controls. Additionally, we appreciate SDSU’s patience as the audit was paused for a period of time and recently finalized. Restricted Use This audit report is solely for the information and use of SDSU, the California State University, and the SCO; it is not intended to be, and should not be, used by anyone other than these specified parties. This restriction is not intended to limit distribution of this audit report, which is a matter of public record and is available on the SCO website at www.sco.ca.gov. Original signed by Kimberly A. Tarvin, CPA Chief, Division of Audits February 5, 2025 -4- San Diego State University Payroll Audit Schedule— Summary of Audit Results March 1, 2017, through February 29, 2020 Net Total Dollar Amount of Projected Improper Costs Net Total and Identified Number of Number of Dollar Amount Dollar Amount and Projected Method of Units of Dollar Amount of Selections of Selections of Identified Unsupported Finding Audit Area Tested Selection Population Population Examined Examined Improper Costs Costs Number Segregation of duties N/A N/A N/A N/A N/A N/A N/A System access Targeted 3 1 N/A 7 Employees N/A N/A N/A 1 Regular pay Statistical 1 78,791 $ 732,631,832 1 05 Transactions $ 335,629 $ - $ - Emergency pay Statistical 4 ,577 19,618,146 1 05 Transactions 405,580 - - Separation lump-sum Statistical 9 57 5,619,729 1 05 Employees 626,785 (612) (4,871) 3 pay Overtime pay Statistical 5 ,846 5,340,685 105 Transactions 110,976 - - Settlement pay Statistical 1 ,725 4,964,059 1 05 Transactions 271,462 - - Salary advance Targeted 1 8 26,570 1 8 Transactions 9 ,248 - 9 ,248 2 Excess vacation and Targeted 1 1,397 1 Employees 1 ,397 - - annual leave $ 768,202,418 $ 1,761,077 $ (612) $ 4,377 -5- San Diego State University Payroll Audit Findings and Recommendations FINDING 1— SDSU lacked adequate controls to ensure that only appropriate staff members had access to the State’s payroll system. SDSU inappropriately Inappropriate allowed seven employees keying or inquiry access to the State’s payroll keying or inquiry system because SDSU did not immediately remove or modify the access to the employees’ access after the employees’ separation from state service, State’s payroll transfer to another agency, or change in classification. system The SCO maintains the State’s payroll system, which contains several applications. These applications include, but are not limited to, the Personnel Information Management System (PIMS), Payroll History (HIST), Keymaster – Batch Process (KEYM), Payroll Input Processing (PIP), the Leave Accounting System, Master Payroll Certification (MPC), and the Affordable Care Act System (ACAS). The State’s payroll system is decentralized, thereby allowing employees of state agencies to access it. All state agencies are required to comply with PPSD’s Decentralized Security Program Manual (DSP Manual) in order to access the payroll system. The DSP Manual describes how state agencies can secure and protect the confidentiality and integrity of payroll data against misuse, abuse, and unauthorized use. We examined the records of 31 SDSU employees who had keying or inquiry access to the State’s payroll system at various times between March 2017, and February 2020. Of the 31 employees, seven had inappropriate access to the State’s payroll system. Specifically, five employees had keying access and two had inquiry access. Of the five employees with keying access, two had keying access to ACAS; one had keying access to PIP; and the other two had keying access to KEYM, HIST, MPC, PIMS, and PIP. SDSU did not immediately remove or modify the seven employees’ access after the employees’ separation from state service, transfer to another agency, or change in classification. For example, a Personnel Technician I left SDSU on July 10, 2017, but SDSU did not request to remove the employee’s access until January 18, 2018—192 days later. SDSU lacked periodic review of the access granted to employees to ensure compliance with the DSP Manual. If not mitigated, this control deficiency leaves payroll data at risk of misuse, abuse, and unauthorized use. This control deficiency represents a material weakness. The December 2015 DSP Manual (“Access Requirements,” page 13) states, in part: The [State’s payroll system] contains sensitive and confidential information. Access is restricted to persons with an authorized, legal, and legitimate business requirement to complete their duties. . . . Currently, PIMS, HIST, KEYM, PIP, LAS [Leave Accounting System], MPC and/or ACAS applications are restricted to Personnel Specialists or -6- San Diego State University Payroll Audit Personnel Technician classifications because their need is by definition a function of their specific job duties and any change in those duties requires a reevaluation of the need for access. If the employee’s duties change, such that the need for access no longer exists, the access privilege MUST be removed or deleted immediately by a request submitted by the department/campus. The December 2015 DSP Manual (“Revocation and Deletion of User IDs,” page 17) states, in part: To prevent unauthorized use by a transferred, terminated or resigned employee's user ID, the Security Monitor must IMMEDIATELY submit all pages of the PSD125A [Security Authorization Form] to delete the user’s system access. Using an old user ID increases the chances of a security breach, which is a serious security violation. Sharing a user ID is strictly prohibited and a serious violation. . . . Recommendation We recommend that SDSU: • Update access to the State’s payroll system immediately after employees leave SDSU, transfer to another unit, or change classifications; and • Periodically review access to the system to verify that access complies with the DSP Manual. SDSU’s Response It is correct that San Diego State University failed to modify payroll system access for seven employees by immediately submitting Decentralized Security Designation forms. However, the phrasing of all these observations as keying access does not comport with the university’s understanding of the term “keying.” Three of the observations were related to employees who only had Inquiry access. This access only allows for information retrieval and does not permit updating or keying out-of-sequence documents. Two observations were related to employees who had Update access to the Affordable Care Act Database (used to facilitate related benefits reporting) and Inquiry access for other applications. Only two observations involved employees with Update access and the ability to key out-of-sequence documents (i.e., keying access) in the applications we would consider the payroll system. The university had and continues to have additional measures to control access to the State’s payroll system and mitigate the risk of unauthorized access. The State’s payroll system is only accessible through specific Center for Human Resources computers on assigned VPN [virtual private network] groups and IP [internet protocol] addresses. Due to the university’s identity management and SSO/MFA [single sign-on/multi- factor authentication] environment, employee access to business systems is automatically revoked the day after a separation event is processed in our human resources system of record, PeopleSoft HCM. This ensures that separated employees cannot access the payroll system within 24 hours of separation, even if there are delays in submitting Decentralized Security Designation Forms. Further, when employees transfer between departments, IT assets do not move with them, which -7- San Diego State University Payroll Audit would limit continuing access to the system for a transferring employee. While the university’s identity management, SSO/MFA environment, and IT asset management practices provide additional control for access to the State’s payroll system, we recognize that our observed delays in submitting Decentralized Security Designation Forms to the State Controller’s Office are inconsistent with the letter of the [DSP Manual], which constitutes a procedure violation and merits attention. . . . We agree with the audit recommendation and have completed remedial action. Upon learning of this deficiency from the audit team, in January 2022, SDSU changed the Security Monitor and Alternate Security Monitor for payroll system access and designated members of the university’s Human Resources Information Management team to monitor and audit access to ensure timely submission of Decentralized Security Designation Forms for all system access (Inquiry, Update, and keying of Out-of-Sequence documents). Additional business processes are being implemented to ensure the effectiveness of this remedial action. Additionally, the university will ensure periodic review of payroll system access as per the DSP [Manual] through quarterly access audits integrated with other quarterly security audits conducted by the Human Resources Information Management Team. SCO Comment Based on additional information provided by SDSU, we modified our description of the level of system access granted to the seven employees. In its response, SDSU agrees that seven employees had inappropriate system access. SDSU lists three employees with inquiry access only; two employees with update access (which we consider to be “keying” access) to ACAS (which SDSU does not consider to be part of the State’s payroll system) and two employees with keying access to “the applications [SDSU] would consider the payroll system.” We disagree with the count. One of the three employees who SDSU claimed had inquiry access only had keying access to PIP. Furthermore, ACAS is indeed part of the State’s payroll system. Access to all applications within the State’s payroll system should be granted based on strict compliance with the requirements described in the DSP Manual in order to ensure that state agencies secure and protect the confidentiality and integrity of payroll data against misuse, abuse, and unauthorized use. FINDING 2— SDSU lacked adequate controls over salary advances to ensure that Failure to collect advances were collected in a timely manner in accordance with state law outstanding salary and policies. Four outstanding salary advances, totaling $9,248, had been outstanding for more than 90 days as of February 29, 2020. advances At February 29, 2020, SDSU’s accounting records show 18 outstanding salary advances, totaling $26,596. Four salary advances, totaling $9,248 had been outstanding for more than 90 days. The oldest uncollected salary advance was outstanding for over three years. We examined all four advances, and noted that SDSU had not initiated timely collection efforts -8- San Diego State University Payroll Audit for any of them. Salary advances are more difficult to collect after the employee leaves state service, and they may become uncollectable if not collected within three years. If not mitigated, these control deficiencies leave SDSU at risk of failing to collect further salary advances. Chapter 28, “Accounts Receivable,” of the California State University Legal Manual and State Administrative Manual sections 8291, 8291.1, and 8293 describe state and SDSU collection policies and procedures, which require the collection of salary advances in a timely manner, and maintenance of proper records of collection efforts. Recommendation We recommend that SDSU ensure that it collects salary advances in a timely manner, pursuant to state and SDSU policies and procedures. SDSU’s Response We agree with the audit recommendation and have already implemented corrective action. Our use of the term “salary advance” should be clarified. SDSU does not have a practice of issuing salary advances in the traditional sense of providing payment to employees in advance of payday. Salary advance, in this instance, refers to particular revolving fund payments. With the four observations, three revolving fund payments were made because timely and accurate compensation could not be provided through the State’s payroll systems, and one was made due to direct deposit to a closed account. These payments were paid from the revolving fund on or near the date the pay was due to the receiving employee. One observed exception was cleared by a personal check on March 6, 2020, yet its status remained outstanding in reporting documentation. It has since been corrected. One observed exception was cleared with a personal check on November 26, 2018, which bounced. It was sent to collections on December 13, 2018, and ultimately referred to a collection agency. Its status remains outstanding in reporting documentation and is in the process of being corrected. One observed exception will be written off in accordance with policy. We are working with Accounting Services to address the status of the remaining observed exception. The findings and observations have led the university to conclude that the business process for revolving fund payments and employee receivables needs to be redesigned. The Center for Human Resources will collaborate with the University Controller, the Bursar, and Accounting Services to ensure SDSU collects and reconciles salary advances in a timely manner, pursuant to state and SDSU policies and procedures. -9- San Diego State University Payroll Audit SCO Comment Our finding and recommendation remain unchanged. We appreciate the additional clarification and willingness of the SDSU to implement corrective actions to improve its internal controls over salary advance collections. FINDING 3— SDSU lacked adequate controls over the processing of employee Improper and late separation lump-sum pay. We calculated a net total of $5,483 in improper separation lump- payments for separation lump-sum pay, consisting of $1,343 in overpayments and $6,826 in underpayments. SDSU also did not make sum payments separation lump-sum payments to 26 employees in a timely manner. Payroll records show that SDSU processed separation lump-sum payments, totaling $5,619,729, for 957 employees between March 2017 and February 2020. Of the 957 employees, we randomly selected a statistical sample (as described in the Appendix) of 105 employees who received separation lump-sum payments, totaling $626,785. Of these employees, one was overpaid by approximately $149 and another was underpaid by approximately $761 because payroll transactions unit staff members miscalculated leave credits paid. SDSU also lacked adequate supervisory review to ensure accurate and timely processing of separation lump-sum pay. If not mitigated, these control deficiencies leave SDSU at risk of making additional improper and late separation lump-sum payments, noncompliance with agreements and laws, and liability for late payments. Statistical sampling results The identified improper payments totaled a net underpayment of $612. We used a statistical sampling method to select the employees whose separation lump-sum payments were examined. We projected an additional $1,194 in overpayments and $6,065 in underpayments. The projected improper payments represent a net total underpayment of $4,871. Therefore, the identified and projected underpayments totaled a net of approximately $5,483, consisting of $1,343 in overpayments and $6,826 in underpayments. -10- San Diego State University Payroll Audit The following table summarizes the results of our statistical sampling (amounts are rounded to the nearest dollar): -11- I D E P M I L P d d e n tif ie d u n d e r p a y m e n ts , n e t iv id e b y : S a m p le r r o r r a te f o r p r o je c tio n ( d if f e r e n c e s d u e to o p u la tio n th a t w a s s ta tis tic a lly s a m p le d u ltip ly b y : E r r o r r a te f o r p r o je c tio n e n tif ie d a n d p r o je c te d u n d e r p a y m e n ts , n e e s s : I d e n tif ie d u n d e r p a y m e n ts , n e t r o je c te d u n d e r p a y m e n ts , n e t r o t ( d u n if f d e in r e g n ) c e s d u e to r o u n d in g ) $ 6 6 2 6 ,7 0 .1 0 5 ,6 1 9 ,7 0 .1 0 5 ,4 6 $ 4 ,8 1 8% 2 % 8 1 7 2 5 9 3 2 1 Criteria GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. Education Code section 89504 allows lump-sum payment for accrued eligible leave credits when an employee separates from state employment. Collective bargaining agreements include similar provisions regarding separation lump-sum pay. Recommendation We recommend that SDSU: • Evaluate and improve controls to ensure accurate calculation and timely payment of separation lump-sum pay; • Conduct a review of separation lump-sum payments made during the past three years to ensure that the payments were accurate and in compliance with collective bargaining agreements and state law; • Recover overpayments made to separated employees through an agreed-upon collection method in accordance with Chapter 28, “Accounts Receivable,” of the California State University Legal Manual and State Administrative Manual sections 8291, 8291.1, and 8293; and • Properly compensate those employees who were underpaid. SDSU’s Response Regarding the audit recommendation, SDSU stated, “We generally agree with the audit recommendation and have already initiated corrective action.” San Diego State University Payroll Audit Regarding the improper separation lump-sum payments, SDSU stated: The observed overpayment exception cannot be collected due to the statute of limitations, and we are working with Accounting Services to address its status. On September 13, 2024, we processed a correction for the underpayment and submitted Form 674 (Payroll Adjustment Notice) to the State Controller’s Office. The State Controller’s Office timeframe for processing these is currently 90 days. Upon issuance of the final audit report, the university will review all separation lump-sum payments over the prior three years to ensure compliance with collective bargaining agreements and state law. Based on the results of this review, we will: • Compensate any employees, separated or active, who were underpaid; and, • Recover overpayments made to both separated and active employees (in the CSU environment, lump-sum separation payments can also be issued to active employees when they change pay plans or separate in concurrent jobs) in compliance with cited policy and procedure. Regarding the late separation lump-sum payments, SDSU stated: While not detailed in the audit report, based on our understanding of California public policy (Labor Code Sections 201 and 202) and our discussion with the audit team, this finding relates to an employer’s obligation to provide final pay at the time of separation or within 72 hours of a voluntary separation without prior notice. The university has established business processes to ensure the timely payment of wages upon involuntary separation. However, due to limitations [of] the State’s payroll system and its frequent inability to issue timely pay, our ability to issue the final payment of wages for voluntary separations in accordance with the Labor Code is an ongoing challenge. We anticipate the same is true for many large agencies with a large contingent workforce, especially when some separations occur with little to no notice. In our meeting with the audit team, we explained [the challenges that we face] with the State’s payroll system, and its inability to support agencies in meeting this statutory requirement. The audit team affirmed our obligation to issue revolving fund payments (i.e., payroll advances) when the payroll system cannot issue timely pay. Such action may be feasible for some agencies. However, for a higher education agency that processed 6,123 voluntary separations in calendar year 2023, the manual processing and accountancy involved in issuing revolving fund payments for all separations is not feasible or sustainable. The university believes [that] the true remedy for this finding (one that addresses the need for public policy compliance and efficient public service) can only be achieved through changes to the State’s payroll system and State Controller Office processes to ensure system responsiveness (i.e., timely issuance of pay upon keying or requisitioning). . . . While we hold the view that changes to the State’s payroll system and State Controller Office processes to ensure system responsiveness are part of the remedy to this finding, we recognize the opportunity to better manage factors within our control and have taken steps to improve outcomes. -12- San Diego State University Payroll Audit We have developed and are implementing a new separation business process with notification and workflow that utilizes the OnBase solution and allows initiation of the process by the employee, their supervisor, or an authorized divisional representative. The process will be deployed in October 2024, and we anticipate [that] it will reduce (but not eliminate) exceptions related to timely separation lump-sum payments. These changes may result in new opportunities for further improvement. SCO Comment Our finding and recommendation remain unchanged. SDSU generally agrees with the recommendation and indicated that it has initiated corrective actions. SDSU also stated its views regarding the limitations of the State’s payroll system and the challenges that SDSU faces in making timely separation lump-sum payments. To assist state agencies in the timely issuance of separation lump-sum pay, PPSD made available the Lump Sum Separation Toolkit on the SCO website. -13- San Diego State University Payroll Audit Appendix— Audit Sampling Methodology This Appendix outlines our audit sampling application for all audit areas for which statistical sampling was used. We used attributes sampling for tests of compliance. We chose this sample design because: • It follows the American Institute of Certified Public Accountants (AICPA) guidelines; • It allowed us to achieve our objectives for tests of compliance in an efficient and effective manner; • Audit areas included high volumes of transactions; • We planned to project the results to the intended population; and • We had the collective knowledge and skills to plan and perform the sampling plan and design. We conducted compliance testing on samples chosen by computer-generated simple random selection. For populations of 250 items or more, we determined the sample size using a calculator with a binomial distribution. As stated in Technical Notes on the AICPA Audit Guide: Audit Sampling (March 1, 2012), page 5, although the hypergeometric distribution is the correct distribution to use for attributes sample sizes, the distribution becomes unwieldy for large populations unless suitable software is available. Therefore, more convenient approximations are frequently used instead. The confidence level was 90.00%, the tolerable error rate was 5.00%, and the expected error rate was 2.00 (1.75%). Pursuant to the AICPA’s Audit Guide: Audit Sampling (December 1, 2019 edition), pages 131–132, the expected error rate is the expected number of errors planned for in the sample. It is derived by multiplying the expected error rate by the sample size. The expected number of errors in the sampling tables on pages 135–136 was rounded upward, e.g., 0.2 errors become 1.0 error. Results were projected to the intended (total) population. Results Projected to Audit Population Population Sampling Sample Intended Finding Area (Unit) (Dollar) Unit Size Population Number Regular pay 1 78,791 $732,631,832 Transaction 105 Yes Emergency pay 4,577 19,618,146 Transaction 105 Yes Separation lump-sum pay 9 57 5 ,619,729 Employee 105 Yes 3 Overtime pay 5,846 5 ,340,685 Transaction 105 Yes Settlement pay 1,725 4 ,964,059 Transaction 105 Yes -A1- San Diego State University Payroll Audit Attachment— San Diego State University’s Response to Draft Audit Report State Controller’s Office Division of Audits Post Office Box 942850 Sacramento, CA 94250 www.sco.ca.gov S21-PAR-0007