California Health Benefit Exchange Payroll Audit

CALIFORNIA HEALTH BENEFIT EXCHANGE Audit Report PAYROLL AUDIT July 1, 2018, through June 30, 2021 M M. C ALIA OHEN C ALIFORNIA S TATE C ONTROLLER April 2025 MALIA M. COHEN CALIFORNIA STATE CONTROLLER April 21, 2025 Ms. Jessica Altman, Executive Director California Health Benefit Exchange 1601 Exposition Boulevard Sacramento, CA 95815 Dear Ms. Altman: The State Controller’s Office audited the California Health Benefit Exchange’s payroll process and transactions for the period of July 1, 2018, through June 30, 2021. The audit was conducted pursuant to Government Code sections 12476 and 12410. California Health Benefit Exchange management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. If you have any questions regarding this report, please contact Roochel Espilla, Chief, State Agency Audits Bureau, by telephone at 916-323-5744. Thank you. Sincerely, Original signed by Kimberly A. Tarvin, CPA Chief, Division of Audits KAT/rs MAILING ADDRESS P.O. Box 942850, Sacramento, CA 94250 SACRAMENTO 3301 C Street, Suite 700, Sacramento, CA 95816 | 916.324.8907 LOS ANGELES 901 Corporate Center Drive, Suite 200, Monterey Park, CA 91754 | 323.981.6802 Ms. Jessica Altman April 21, 2025 Page 2 of 2 Copy: Darci Haesche, Director Administrative Services Division California Health Benefit Exchange Rachael McCord, Deputy Director Human Resources Branch California Health Benefit Exchange Anne Porter, Chief Payroll and Benefit Section California Health Benefit Exchange Jeremiah Bond, External Audit Coordinator Office of Audit Services California Health Benefit Exchange Jarrett Tomás Barrios, Member Board of Directors California Health Benefit Exchange Jerry Fleming, Member Board of Directors California Health Benefit Exchange Kate Kendell, Member Board of Directors California Health Benefit Exchange Kim Johnson, Member Board of Directors California Health Benefit Exchange Mayra Alvarez, Member Board of Directors California Health Benefit Exchange Helen Fairchild, Chief Administrative Services Division California Department of Human Resources Lisa Dean, Acting Chief Personnel and Payroll Services Division State Controller’s Office Veronica Encinas, Bureau Chief Personnel and Payroll Services Division State Controller’s Office MAILING ADDRESS P.O. Box 942850, Sacramento, CA 94250 SACRAMENTO 3301 C Street, Suite 700, Sacramento, CA 95816 | 916.324.8907 LOS ANGELES 901 Corporate Center Drive, Suite 200, Monterey Park, CA 91754 | 323.981.6802 California Health Benefit Exchange Payroll Audit Contents Audit Report Summary ............................................................................................................................ 1 Background ........................................................................................................................ 1 Audit Authority.................................................................................................................. 1 Objectives, Scope, and Methodology ............................................................................... 1 Conclusion .......................................................................................................................... 3 Follow-up on Prior Audit Findings .................................................................................. 4 Views of Responsible Officials .......................................................................................... 4 Restricted Use .................................................................................................................... 5 Schedule—Summary of Audit Results ................................................................................. 6 Findings and Recommendations ........................................................................................... 7 Appendix—Audit Sampling Methodology ........................................................................... A1 Attachment—California Health Benefit Exchange’s Response to Draft Audit Report California Health Benefit Exchange Payroll Audit Audit Report Summary The State Controller’s Office (SCO) audited the California Health Benefit Exchange’s (Covered California) payroll process and transactions for the period of July 1, 2018, through June 30, 2021. Covered California management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. Our audit determined that Covered California did not: • Maintain adequate and effective internal controls over certain aspects of its payroll process, as described in Findings 1 through 8; • Process payroll and payroll-related disbursements accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures in certain instances, as described in Findings 3 through 6, and 8; or • Administer salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures, as described in Finding 7. Background In 1979, the State of California adopted collective bargaining for state employees. This created a significant workload increase for the SCO’s Personnel and Payroll Services Division (PPSD), as PPSD was the State’s centralized payroll processing center for all payroll-related transactions. PPSD decentralized the processing of payroll, allowing state agencies and departments to process their own payroll-related transactions. Periodic audits of the decentralized payroll processing at state agencies and departments ceased due to the budget constraints in the late 1980s. In 2013, the California State Legislature reinstated these payroll audits to gain assurance that state agencies and departments maintain adequate internal control over the payroll function, provide proper oversight of their decentralized payroll processing, and comply with various state laws and regulations regarding payroll processing and related transactions. Audit Authority We conducted this audit in accordance with Government Code (GC) section 12476, which authorizes the SCO to audit the State’s payroll system, the State Pay Roll Revolving Fund, and related records of state agencies within the State’s payroll system. In addition, GC section 12410 provides the SCO with general authority to audit the disbursement of state money for correctness, legality, and sufficient provisions of law for payment. Objectives, Scope, Our audit objectives were to determine whether Covered California: and Methodology • Maintained adequate and effective internal controls over its payroll process; -1- California Health Benefit Exchange Payroll Audit • Processed payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures; and • Administered salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. The audit covered the period from July 1, 2018, through June 30, 2021. The audit population consisted of payroll transactions totaling $236,929,832, as quantified in the Schedule. To achieve our audit objectives we performed the following procedures: • We reviewed state and Covered California policies and procedures related to the payroll process to understand Covered California’s methodology for processing various payroll and payroll-related transactions. • We interviewed Covered California payroll personnel to understand Covered California’s methodology for processing various payroll and payroll-related transactions, determine the employees’ level of knowledge and ability relating to payroll transaction processing, and gain an understanding of existing internal control over the payroll process and systems. • We selected transactions recorded in the State’s payroll database using statistical sampling, as outlined in the Appendix, and targeted selection based on risk factors and other relevant criteria. • We analyzed and tested the selected transactions and reviewed relevant files and records to determine the accuracy of payroll and payroll-related payments; accuracy of leave transactions; adequacy and effectiveness of internal control over the payroll process; and compliance with collective bargaining agreements and state laws, regulations, policies, and procedures. • We reviewed salary advances to determine whether Covered California administered and recorded them in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. • We assessed the reliability of computer-processed data for payroll and payroll-related transactions by interviewing Covered California officials knowledgeable about the data; reviewing existing information about the data and the system that produced it; and tracing data to source documents, based on statistical sampling and targeted selection. We determined that the data was sufficiently reliable for the purposes of this report. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. -2- California Health Benefit Exchange Payroll Audit Conclusion Our audit determined that Covered California did not maintain adequate and effective internal controls over its payroll process;1 did not process payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures; and did not administer salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. We found deficiencies in internal control over the payroll process that we consider to be material weaknesses; and instances of noncompliance with the requirements of collective bargaining agreements and state laws, regulations, policies, and procedures. The material weaknesses and instances of noncompliance are as follows: • Covered California had inadequate segregation of duties and a lack of compensating controls over payroll transactions (see Finding 1). • Twelve of 50 (24%) employees whose records we examined during our audit had inappropriate access to the State’s payroll system (see Finding 2). • Covered California did not consistently maintain timesheets for regular pay. Based on our audit testing of 105 regular pay transactions, we estimated that 7% of the timesheets associated with regular pay during the audit period were not retained. We identified $35,561 and projected an additional $15,065,474 in unsupported payments (see Finding 3). • Covered California had inadequate controls to ensure that it adhered to requirements limiting the accumulation of vacation and annual leave credits. As of October 1, 2020, Covered California’s leave accounting records show 59 employees whose leave balances exceed the limits set by collective bargaining agreements and state regulations. The value of Covered California’s excess leave balances was at least $1,386,536 as of October 1, 2020. Based on our audit testing, we determined that for all 59 employees, Covered California had failed to implement controls to ensure that it adhered to the requirements (see Finding 4). 1 In planning and performing our audit of compliance, we considered Covered California’s internal control over compliance with collective bargaining agreements and state laws, regulations, policies, and procedures to determine the auditing procedures that were appropriate under the circumstances for the purpose of providing a conclusion on compliance, and to test and report on internal control over compliance. Our consideration of internal control over compliance was for the limited purpose described in the first paragraph of this footnote; it was not designed to identify all deficiencies in internal control over compliance that might be material weaknesses or significant deficiencies. As discussed in this section, we identified certain deficiencies in internal control over compliance that we consider to be material weaknesses. A deficiency in internal control over compliance exists when the design, implementation, or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A material weakness in internal control over compliance is a deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. A significant deficiency in internal control over compliance is a deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention from those charged with governance. -3- California Health Benefit Exchange Payroll Audit • Covered California overpaid nine of 105 (9%) overtime transactions that we examined, and underpaid two (2%) of them. We identified a net overpayment of $754 and projected a net overpayment of $51,577. In addition, Covered California did not consistently maintain timesheets for overtime pay. Based on our audit testing, we estimated that 19% of the timesheets associated with overtime payments during the audit period were not retained. We identified $17,994 and projected an additional $1,231,170 in unsupported overtime payments (see Finding 5). • Covered California did not reduce employees’ balances in the State’s leave accounting system after separation lump-sum payments were made to 19 of 70 (27%) employees whose records we examined. We identified unreduced leave credits with a value of $169,889 and projected additional unreduced leave credits with a value of $96,577. In addition, Covered California overpaid 18 (or 26%) of the employees by a total of $14,723 and underpaid six (or 9%) of the employees by a total of $6,681; we projected the additional overpayments to be $8,370 and underpayments to be $3,799. Furthermore, Covered California did not make separation lump-sum payments to 22 (31%) of the employees in a timely manner (see Finding 6). • Covered California had inadequate controls to ensure that salary advances were administered in accordance with requirements and collected in a timely manner. Sixty-nine salary advances, totaling $75,686, remained outstanding for an average of 719 days as of June 30, 2021 (see Finding 7). • Covered California did not reduce employees’ balances in the State’s leave accounting system for six of the 105 (6%) leave buy-back transactions that we examined We identified unreduced leave credits with a value of $10,824 and we projected additional unreduced leave credits with a value of $13,513. In addition, Covered California understated an employee’s balance by 60 hours in one (or 1%) of the transactions that we examined; we identified understated leave credits with a value of $7,860 and we projected additional understated leave credits with a value of $9,813 (see Finding 8). Follow-up on We have not previously conducted an audit of Covered California’s payroll process and transactions. Prior Audit Findings Views of We issued a draft audit report on September 11, 2024. A representative from Covered California responded by letter dated September 20, 2024, Responsible accepting the audit results. This final audit report includes Covered Officials California’s response as an attachment. -4- California Health Benefit Exchange Payroll Audit Restricted Use This audit report is solely for the information and use of Covered California and the SCO; it is not intended to be, and should not be, used by anyone other than these specified parties. This restriction is not intended to limit distribution of this audit report, which is a matter of public record and is available on the SCO website at www.sco.ca.gov. Original signed by Kimberly A. Tarvin, CPA Chief, Division of Audits April 21, 2025 -5- California Health Benefit Exchange Payroll Audit Schedule— Summary of Audit Results July 1, 2018, through June 30, 2021 Net Total Dollar Amount of Projected Improper Net Total Costs and Dollar Dollar Amount Identified and Number of Number of Amount of of Identified Projected Method of Units of Dollar Amount Selections Selections Improper Unsupported Finding Audit Area Tested Selection Population of Population Examined Examined Costs Costs Number Segregation of duties N/A N/A N/A N/A N/A N/A N/A 1 System access Targeted 50 N/A 50 Employees N/A N/A N/A 2 Regular pay Statistical 46,042 $ 2 29,042,155 105 Transactions $ 539,358 $ - $ 15,101,035 3 Excess vacation and annual leave Targeted 59 1,386,536 59 Employees 1 ,386,536 1 ,386,536 - 4 Overtime pay Statistical 7,857 3 ,541,402 105 Transactions 51,014 7 54 1 ,300,741 5 Separation lump-sum pay Statistical 164 1,702,448 70 Employees 1 ,085,419 1 77,931 1 01,148 6 Salary advance Targeted 76 88,289 76 Transactions 88,289 7 5,686 - 7 Leave buy-back Statistical 253 769,004 105 Transactions 342,003 2 ,964 3 ,700 8 Holiday credit Targeted 1,732 399,998 13 Transactions 3 ,167 - - $ 2 36,929,832 $ 3,495,786 $ 1 ,643,871 $ 16,506,624 -6- California Health Benefit Exchange Payroll Audit Findings and Recommendations FINDING 1— Covered California lacked adequate segregation of duties within its payroll transactions unit to ensure that only valid and authorized payroll Inadequate transactions were processed. Covered California also failed to implement segregation of other controls to compensate for this risk. duties and lack of compensating Our audit found that Covered California payroll transactions unit staff controls over performed conflicting duties. Staff members performed multiple steps in payroll processing payroll transactions, including entering data into the State’s transactions payroll system; auditing employee timesheets; reconciling payroll, including reconciling system output to source documentation; reporting payroll exceptions; and processing adjustments. For example, staff members keyed in regular and overtime pay, and reconciled the master payroll, overtime, and other supplemental warrants. Covered California failed to demonstrate that it implemented compensating controls to mitigate the risks associated with such a deficiency. We found no indication that these functions were subjected to periodic supervisory review. The lack of adequate segregation of duties and compensating controls has a pervasive effect on the Covered California payroll process, and impairs the effectiveness of other controls by rendering their design ineffective or by keeping them from operating effectively. These control deficiencies, in combination with other deficiencies discussed in Findings 2 through 8, represent a material weakness in internal control over the payroll process such that there is a reasonable possibility that material noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. Good internal control practices require that the following functional duties be performed by different work units, or at minimum, by different employees within the same unit: • Recording transactions – This duty refers to the record-keeping function, which is accomplished by entering data into a computer system. • Authorization to execute – This duty belongs to individuals with authority and responsibility to initiate and execute transactions. • Periodic review and reconciliation of actual payments to recorded amounts – This duty refers to making comparisons of information at regular intervals and taking action to resolve differences. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including proper segregation of duties and an effective system of internal review. Adequate segregation of duties reduces the likelihood that fraud or error will remain undetected by providing for separate processing by different individuals at various stages of a transaction and for independent reviews of the work performed. -7- California Health Benefit Exchange Payroll Audit Recommendation We recommend that Covered California: • Separate conflicting payroll functional duties to the greatest extent possible. Adequate segregation of duties will provide a stronger system of internal control whereby the functions of each employee are subject to the review of another. If it is not possible to segregate payroll functions fully and appropriately, Covered California should implement compensating controls. For example, if the payroll transactions unit staff member responsible for recordkeeping also performs a reconciliation process, then the supervisor should perform and document a detailed review of the reconciliation to provide additional control over the assignment of conflicting functions. Compensating controls may also include dual authorization requirements and documented reviews of payroll system input and output; and • Develop formal procedures for performing and documenting compensating controls. FINDING 2— Covered California lacked adequate controls to ensure that only appropriate staff members had access to the State’s payroll system. Inappropriate Covered California inappropriately allowed 12 employees keying or keying or inquiry inquiry access to the State’s payroll system because Covered California access to the did not immediately remove or modify the employees’ access after the State’s payroll employees’ separation from state service, transfer to another agency, or system change in classification. The SCO maintains the State’s payroll system. The system is decentralized, thereby allowing employees of state agencies to access it. All state agencies are required to comply with PPSD’s Decentralized Security Program Manual (DSP Manual) in order to access the payroll system. The DSP Manual describes how state agencies can secure and protect the confidentiality and integrity of payroll data against misuse, abuse, and unauthorized use. We examined the records of 50 Covered California employees who had keying or inquiry access to the State’s payroll system at various times between July 2018 and June 2021. Of the 50 employees, 12 had inappropriate access to the State’s payroll system. Specifically, Covered California did not immediately remove or modify the employees’ access after the employees’ separation from state service, transfer to another agency, or change in classification. For example, a Staff Services Manager (SSM) II was promoted to SSM III on November 1, 2017. The employee had been provided inquiry access before becoming an SSM III. Covered California determined that access was no longer required following the employee’s role change as a result of the promotion, but Covered California did not request to remove the employee’s access until August 28, 2018—300 days later. Covered California lacked periodic review of keying or inquiry access granted to employees to ensure compliance with the DSP Manual. -8- California Health Benefit Exchange Payroll Audit If not mitigated, this control deficiency leaves payroll data at risk of misuse, abuse, and unauthorized use. The December 2015 DSP Manual (“Access Requirements,” page 13) states, in part: The [State’s payroll system] contains sensitive and confidential information. Access is restricted to persons with an authorized, legal, and legitimate business requirement to complete their duties. . . . If the employee’s duties change, such that the need for access no longer exists, the access privilege MUST be removed or deleted immediately by a request submitted by the department/campus. The June 2020 DSP Manual (“Access Requirements,” page 6) states, in part: The [State’s payroll system] contains sensitive and confidential information. Access is restricted to persons with an authorized, legal, and legitimate business requirement to complete their regular daily duties. . . . If the employee's duties change, such that the need for access no longer exists, the access privilege MUST be removed or deleted immediately via a request submitted by the department/campus. The October 2020 DSP Manual (“Access Requirements,” page 5) states, in part: The [State’s payroll system] contains sensitive and confidential information. Access is restricted to persons with an authorized, legal, and legitimate business requirement to complete their regular daily duties. . . . If the employee's duties change, such that the need for access no longer exists, the access privilege MUST be removed or deleted immediately via a request submitted by the department/campus Security Monitor/Assistant Security Monitor. . . . The December 2015 DSP Manual (“Revocation and Deletion of User IDs,” page 17) states, in part: To prevent unauthorized use by a transferred, terminated or resigned employee's user ID, the Security Monitor must IMMEDIATELY submit all pages of the PSD125A [Security Authorization form] to delete the user’s system access. Using an old user ID increases the chances of a security breach, which is a serious security violation. Sharing a user ID is strictly prohibited and a serious violation. . . . The June 2020 DSP Manual (“Revocation and Deletion of User IDs,” page 10) states, in part: To prevent unauthorized use by a transferred, terminated or resigned employee's User ID, the Security Monitor must IMMEDIATELY submit all pages of the PSD125A signed by both Security Monitor and Authorizing Manager to delete the user’s system access. Using an old User ID increases the risk of a security breach, which is a serious security violation. Sharing a User ID is strictly prohibited. . . . -9- California Health Benefit Exchange Payroll Audit The October 2020 DSP Manual (“Revocation and Deletion of User IDs,” page 7) states, in part: To prevent unauthorized use by a transferred, terminated or resigned employee's User ID, the Security Monitor must IMMEDIATELY contact DSA [Decentralized Security Administrator] by email. The Security Monitor/Assistant Security Monitor must submit all pages of the PSD125A signed by both Security Monitor Assistant Security Monitor and Authorizing Official/Assistant Authorizing Official to delete the user’s system access. Using an old User ID increases the risk of a security breach, which is a serious security violation. Sharing a User ID is strictly prohibited. . . . Recommendation We recommend that Covered California: • Update keying or inquiry access to the State’s payroll system immediately after employees leave Covered California, transfer to another unit, or change classifications; and • Periodically review access to the system to verify that access complies with the DSP Manual. Covered California’s Response Covered California accepts the audit findings, with one exception explained below, and is committed to ensuring timely addition and removal of staff to access the state payroll system. Several employees were identified with keying access not immediately removed or updated after a transfer, change in classification or duties, or separation. However, Covered California would like to address one of the individuals identified in the findings who was not inappropriately granted access and was not removed from access untimely, as follows: The findings indicate that a Staff Services Manager II left Covered California on March 23, 2016. However, the access was not requested to be removed until August 28, 2018. This data is inaccurate. The Staff Services Manager II identified on the findings report was initially appointed to Covered California on March 23, 2016, to a position in HRB [Human Resources Branch] and was appropriately granted access to the SCO systems at that time. Subsequently, the SSM II was promoted to a Staff Services Manager III position still within HRB. The request to remove access was submitted in 2018 after it was determined to be no longer necessary based on job duties due to the promotion. At all times this employee was working within HRB and never left Covered California. Other than this anomaly in the audit, Covered California has taken steps to mitigate the concerns addressed in this finding. Since the review, Covered California has added an assistant to the security monitor to ensure prompt notification of any changes. In addition to the assistant security monitor, to ensure compliance with the standards, Covered California requires the PBU [Payroll and Benefits Unit] Section Chief, as the security monitor, to review and validate the listing of authorized users every month as an additional safeguard. Lastly, since SCO has implemented the ability for state agencies to remove users and submit documents via secured email, it has helped to increase efficiency and remove delays in lieu of the more time-consuming process that was in place previously. -10- California Health Benefit Exchange Payroll Audit SCO Comment Based on additional information provided by Covered California, we modified our description of the nature and circumstances of system access granted to one of the 12 employees with inappropriate access to the State’s payroll system. In its response, Covered California accepted that 11 employees had inappropriate system access. Covered California also explained that one employee was not inappropriately granted access, and that access was removed in a timely manner. The employee had been provided inquiry access as an SSM II before a promotion to an SSM III position on November 1, 2017. Covered California determined that access was no longer necessary after the promotion. We disagree with Covered California’s count and its assertion that the SSM III had appropriate access, and that the access was removed in a timely manner. Our review of additional information provided by Covered California further confirmed that all 12 employees were inappropriately allowed access to the system. Although the SSM II was granted appropriate access before promoting to an SSM III position, that access should have been removed when the employee’s duties changed as a result of the promotion, based on the requirements described in the DSP Manual in order to ensure that state agencies secure and protect the confidentiality and integrity of payroll data against misuse, abuse, and unauthorized use. Covered California lacked segregation of duties and compensating FINDING 3— controls within its payroll transactions unit, as noted in Finding 1. It also Missing timesheets lacked adequate controls to ensure that timesheets were maintained to for regular pay support regular pay. Payroll records show that Covered California processed 46,042 regular pay transactions, totaling $229,042,155, between July 2018, and June 2021. We randomly selected a statistical sample (as described in the Appendix) of 105 transactions, totaling $539,358. Based on our examination of these transactions, we found that Covered California lacked timesheets for seven (7%) transactions, totaling $35,561. Without the required documentation, we could not determine the validity, accuracy, and propriety of the payments made to the employees; or the completeness and accuracy of the leave accounting records. If not mitigated, this control deficiency leaves Covered California at risk of making improper payments for regular pay. Statistical sampling results The identified unsupported payments totaled $35,561. We used a statistical sampling method to select the regular pay transactions that we examined. We projected the additional unsupported payments to be $15,065,474. Therefore, the identified and projected unsupported payments totaled approximately $15,101,035. -11- California Health Benefit Exchange Payroll Audit The following table summarizes the results of our statistical sampling (amounts are rounded to the nearest dollar): Identified unsupported payments $ 35,561 Divide by: Sample 539,358 Error rate for projection (differences due to rounding) 6.59% Population that was statistically sampled 229,042,155 Multiply by: Error rate for projection 6.59% Identified and projected unsupported payments (differences due to rounding) 15,101,035 Less: Identified unsupported payments 35,561 Projected unsupported payments $ 15,065,474 Criteria GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Collective bargaining agreements, and state laws and policies, contain specific clauses regarding regular pay. Covered California’s General Retention Schedule for Payroll/Personnel Records specifies a four-year retention period for timesheets. Recommendation We recommend that Covered California maintain supporting documentation for regular pay pursuant to its retention policies. Covered California’s Response Regarding the finding, Covered California stated that it “accepts the finding and is dedicated to ensuring proper documentation for all payroll transactions.” Regarding the missing timesheets for regular pay, Covered California stated, “Eleven (11) of the eighteen (18) documents originally missing during the audit were located and provided to SCO in June 2023.” SCO Comment Our finding and recommendation remain unchanged. Covered California accepted the finding, and indicated that it has initiated corrective actions. Covered California also stated that the supporting documentation for 11 of 18 transactions that originally lacked timesheets was provided to SCO auditors during the audit. We agree with that statement. The supporting documentation was reviewed by SCO auditors during the audit and reflected in our audit results. The finding correctly describes that the remaining seven transactions lacked timesheets. -12- California Health Benefit Exchange Payroll Audit Covered California’s leave accounting records show 59 employees with FINDING 4— unused vacation or annual leave credits at October 1, 2020. All Excessive vacation 59 employees exceeded the limits set by collective bargaining agreements and annual leave and state regulations. The employees accumulated 18,444 hours of excess balances vacation and annual leave, with a value of at least $1,386,536 as of October 1, 2020. Covered California failed to implement controls to ensure that it adhered to the requirements. This estimated liability does not adjust for salary rate increases and additional leave credits.2 Accordingly, we expect that the amount needed to pay for this liability will be higher. Collective bargaining agreements and state regulations limit the amount of vacation and annual leave that state employees may accumulate. The limit on leave balances helps state agencies to manage leave balances and control the State’s liability for accrued leave credits. State agencies may allow employees to carry a higher leave balance only under limited circumstances. For example, an employee may not be able to reduce accrued vacation or annual leave hours below the limit due to business needs. When an employee’s leave accumulation exceeds or is projected to exceed the limit, state agencies should work with the employee to develop a written plan to reduce leave balances below the applicable limit. Covered California has established policies and procedures for complying with state requirements for leave balances. On October 20, 2020, the California Department of Human Resources (CalHR) directed departments to immediately suspend policies that require leave balances to be reduced below the limit, and that require employees to implement leave-reduction plans. This suspension was in effect until the 2020 Personal Leave Program ended on June 30, 2021. Therefore, we examined employees’ vacation and annual leave balances as of October 1, 2020. We examined the records of the 59 employees with excess vacation or annual leave to determine whether Covered California had complied with collective bargaining agreements and state regulations. None of the 59 employees complied with collective bargaining agreements and state regulations for the following reasons: • Covered California could not demonstrate that, if the employees were unable to reduce their vacation and leave balances, it had allowed the employees to maintain excess balances because of the extenuating circumstances specified in the agreements and regulations. • Covered California had no plans in place during the audit period for the employees to reduce leave balances below the limit, in violation of its own policies and procedures. 2 Most state employees receive pay rate increases every year pursuant to state laws and/or collective bargaining agreements until they reach the top of their pay scale, or promote into a higher-paying position. In addition, when an employee’s accumulated leave balances upon separation are calculated for lump-sum pay, the employee is credited with additional leave credits equal to the amount that the employee would have earned had the employee taken time off and not separated from state service. -13- California Health Benefit Exchange Payroll Audit These 59 employees accumulated 18,444 hours of excess vacation and annual leave balances, with a value of at least $1,386,536 as of October 1, 2020. If Covered California does not take action to reduce the excessive leave balances, the liability for accrued vacation and annual leave will likely increase because most employees will receive salary increases or use other non-compensable leave credits instead of vacation or annual leave, thus increasing their vacation or annual leave balances. The state agency responsible for paying these leave balances may face a cash flow problem if a significant number of employees with excessive vacation or annual leave balances separate from state service. Normally, state agencies are not budgeted to make these separation lump-sum payments. However, the State’s current practice dictates that the state agency that last employed an employee pays for that employee’s separation lump-sum payment, regardless of where the employee accrued the leave balance. Collective bargaining agreements and state regulations limit the amount of vacation and annual leave that most state employees may accumulate to no more than 80 days (640 hours). Recommendation We recommend that Covered California: • Implement controls, including existing policies and procedures, to ensure that its employees’ vacation and annual leave balances are maintained within levels allowed by collective bargaining agreements and state regulations; • Conduct ongoing monitoring of controls to ensure that they are implemented and operating effectively; and • Participate in leave buy-back programs if the State offers such programs and funds are available. Covered California’s Response Regarding the finding, Covered California stated that it “accepts the finding and is committed to ensuring the state’s financial liabilities are not overextended through excessive vacation and annual leave balances that exceed statutory requirements.” Regarding the excessive vacation and annual leave balances, Covered California stated, “At the time of the audit, Covered California had a Leave Management policy and process. This enabled employees with excess leave to establish a leave reduction plan, lowering leave balances to the required maximum levels or lower.” SCO Comment Our finding and recommendation remain unchanged. We included, for clarity, additional information regarding Covered California’s policies and procedures for excessive leave balances. Covered California accepted the -14- California Health Benefit Exchange Payroll Audit finding, and indicated that it has initiated corrective actions. Covered California also stated that it has policies and procedures regarding excessive leave balances. We agree with that statement. However, as described in the finding, Covered California failed to implement these policies and procedures. FINDING 5— Covered California lacked adequate segregation of duties within its Improper payroll transactions unit, as noted in Finding 1. It also lacked adequate controls over the processing of overtime pay; adequate supervisory review payments and to ensure accurate processing of overtime pay; and adequate controls to missing timesheets ensure that timesheets were maintained to support overtime payments. for overtime pay Payroll records show that Covered California processed 7,857 overtime pay transactions, totaling $3,541,402, between July 2018 and July 2021. We randomly selected a statistical sample (as described in the Appendix) of 105 transactions, totaling $51,014. Based on our examination of the selected transactions, we found the following errors: • Covered California overpaid the employees in nine of 105 (9%) transactions by a total of $776 and underpaid employees in two of 105 (2%) transactions by a total of $22 because the payroll transactions unit staff members miscalculated overtime hours worked, failed to verify that employees were eligible for overtime pay, and incorrectly entered the overtime hours worked into the payroll system. Covered California also lacked adequate supervisory review to ensure accurate and timely processing of separation lump-sum pay. We projected the additional overpayments to be $53,071 and underpayments to be $1,494. • Covered California lacked timesheets associated with 20 of 105 (19%) transactions with a value of $17,994. Without the required documentation, we could not determine the validity, accuracy, and propriety of the payments made to the employees; or the completeness and accuracy of the leave accounting records. We projected the additional unsupported payments to be $1,231,170. If not mitigated, these control deficiencies leave Covered California at risk of making additional improper overtime payments. Statistical sampling results The identified improper and unsupported payments have a net total of $18,748. We used a statistical sampling method to select the overtime pay transactions that we examined. We projected an additional $53,071 in overpayments and $1,494 in underpayments; we also projected an additional $1,231,170 in unsupported payments. The projected improper and unsupported payments have a net total of $1,282,747. Therefore, the identified and projected improper and unsupported payments totaled a net of $1,301,495, consisting of $53,847 in overpayments, $1,516 in underpayments, and $1,249,164 in unsupported payments. -15- California Health Benefit Exchange Payroll Audit The following table summarizes the results of our statistical sampling (amounts are rounded to the nearest dollar): -16- I d e n tif ie d im p r o p e r a n d u n s u p p o r te d p a y D iv id e b y : S a m p le E r r o r r a te f o r p r o je c tio n ( d if f e r e n c e s d u e P o p u la tio n th a t w a s s ta tis tic a lly s a m p le d M u ltip ly b y : E r r o r r a te f o r p r o je c tio n I d e n tif ie d a n d p r o je c te d im p r o p e r a n d u n ( d if f e r e n c e s d u e to r o u n d in g ) L e s s : I d e n tif ie d im p r o p e r a n d u n s u p p o r te P r o je c te d im p r o p e r a n d u n s u p p o r te d p a y m e n ts , n to r o u n d s u p p o r te d p a y m e m e n ts , n e t in g d p n ts e t ) a y , n m e e t n ts , n e t $ 1 5 3 6 3 ,5 4 3 6 1 ,3 0 1 $ 1 ,2 8 8 ,7 1 ,0 .7 5 1 ,4 .7 5 1 ,4 8 ,7 2 ,7 4 1% 0 % 9 44 8 4 2 5 87 Criteria GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Collective bargaining agreements, and state laws and policies, contain specific clauses regarding overtime pay. Covered California’s General Retention Schedule for Payroll/Personnel Records specifies a four-year retention period for timesheets. Recommendation We recommend that Covered California: • Conduct a review of overtime payments made during the past three years to ensure that the payments complied with collective bargaining agreements and state laws and policies; • Recover any overpayments made to employees through an agreed- upon collection method in accordance with GC section 19838; and • Properly compensate those employees who were underpaid. We further recommend that, to prevent improper payments for overtime pay from recurring, Covered California: • Establish adequate internal controls to ensure that accurate calculations of overtime payments are properly supported and maintained; • Provide adequate oversight to ensure that payroll transactions unit staff members process only valid and authorized payments that comply with collective bargaining agreements and state laws and policies; and • Maintain supporting documentation for overtime payments pursuant to its retention policies. California Health Benefit Exchange Payroll Audit Covered California’s Response Covered California accepts the audit findings and has employed controls to prevent improper overtime payments, including the implementation of Workday. Currently, we are working to enhance the system to include rate calculations and electronic submission of overtime to the SCO system. The P Sup I [Personnel Supervisor I] in PBU provides regular monitoring of pay issued in the state payroll system and reviews a sampling of timesheets on a monthly basis with the PBU Manager (Staff Services Manager I) to ensure compliance. Prior to the implementation of Workday, overtime hours and rate calculations were done manually. The audit findings largely consisted of “carry over” of overtime worked on the last/first week of two (2) different pay periods that were not completed prior to processing pay. Workday is configured to require all employees to submit time and absence entries on a weekly basis. With weekly time submission in Workday, the PS [Personnel Specialist] is not waiting a full pay period for the timesheet to be submitted. As a result, Covered California no longer has “carry over” and hours are now processed in the proper pay period. Employees and supervisors document overtime on their electronic time submissions, which PBU reviews and keys into SCO. Regular monitoring, review, and audit of the pay issued by the P Sup I against the Overtime Report in Workday has demonstrated accurate and proper controls are in place over the last three (3) years since the implementation of Workday. SCO Comment Our finding and recommendation remain unchanged. Covered California accepted the finding and indicated that it has initiated corrective actions. FINDING 6— Covered California lacked adequate segregation of duties within its Inaccurate leave payroll transactions unit, as noted in Finding 1. It also lacked adequate controls to ensure that paid leave credits were properly reduced in the accounting; State’s leave accounting system; adequate controls over the processing of improper and late employee separation lump-sum pay; and adequate supervisory review to separation lump- ensure accurate and timely processing of separation lump-sum pay. sum payments Payroll records show that Covered California processed separation lump- sum payments, totaling $1,702,448, for 164 employees between July 2018 and June 2021. Of the 164 employees, we randomly selected a statistical sample (as described in the Appendix) of 70 employees who received separation lump-sum payments, totaling $1,085,419. Based on our examination of the records of 70 employees, we found that the following errors: • Covered California did not appropriately reduce the employees’ balances in the State’s leave accounting system for 19 of 70 (27%) employees to reflect the number of leave credits—with a value of $169,889— that had been paid. Unreduced leave balances pose a risk to the State because they overstate the State’s liabilities for leave balances and allow the possibility of improper and duplicative payments for leave credits. We projected additional unreduced leave credits with a value of $96,577. -17- California Health Benefit Exchange Payroll Audit • Covered California overpaid 18 of 70 (26%) employees by approximately $14,723 and underpaid six of 70 (9%) employees by approximately $6,681 because payroll transactions unit staff members miscalculated leave credits paid. Covered California also lacked adequate supervisory review to ensure accurate processing of separation lump-sum pay. We projected the additional overpayments to be $8,370 and underpayments to be $3,799. • Covered California did not make separation lump-sum payments to 22 of 70 (31%) employees in a timely manner. If not mitigated, these control deficiencies leave Covered California at risk of making additional improper and late separation lump-sum payments, noncompliance with agreements and laws, and liability for late payments. Statistical sampling results The identified value of unreduced paid leave credits and improper payments have a net total of $177,931. We used a statistical sampling method to select the employees whose separation lump-sum payments were examined. We projected the additional leave balances that had not been adjusted to reflect the number of leave credits that had been paid; the total projected value was $96,577. We also projected an additional $8,370 in overpayments and $3,799 in underpayments. The projected improper costs totaled a net of $101,148. The identified and projected improper costs totaled a net of approximately $279,079, consisting of $266,466 in unadjusted paid leave credits, $23,093 in overpayments, and $10,480 in underpayments. The following table summarizes the results of our statistical sampling (amounts are rounded to the nearest dollar): Identified value of unreduced paid leave credits and improper payments, net $ 177,931 Divide by: Sample 1,085,419 Error rate for projection (differences due to rounding) 16.39% Population that was statistically sampled 1,702,448 Multiply by: Error rate for projection 16.39% Identified and projected value of unreduced paid leave credits and improper payments, net (differences due to rounding) 279,079 Less: Identified value of unreduced paid leave credits and improper payments, net 177,931 Projected value of unreduced paid leave credits and improper payments, net $ 101,148 Criteria GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. -18- California Health Benefit Exchange Payroll Audit GC section 19839 allows lump-sum payment for accrued eligible leave credits when an employee separates from state employment. Collective bargaining agreements include similar provisions regarding separation lump-sum pay. Collective bargaining agreements and state laws, as summarized in section 1703 of CalHR’s Human Resources Manual, establish the requirements for separation lump-sum pay. Recommendation We recommend that Covered California; • Conduct a review of separation lump-sum payments made during the past three years to ensure that the payments were accurate and in compliance with collective bargaining agreements and state law; • Recover any overpayments made to separated employees in accordance with GC section 19838 and State Administrative Manual (SAM) sections 8291, 8291.1, and 8293; and • Properly compensate those employees who were underpaid. We further recommend that, to prevent improper payments from recurring, Covered California: • Establish adequate controls to ensure that employee leave balances are reduced in a timely manner after the separation lump-sum payment is made; • Establish adequate controls to ensure that separation lump-sum payments are calculated accurately; and • Establish adequate controls to ensure that separation lump-sum payments are made in a timely manner. Covered California’s Response Covered California accepts the audit findings with the exception identified below, and recognizes the importance of timely payment of wages and accurate leave accounting when calculating lump-sum payments. The audit findings identified nineteen (19) employees who were overpaid, and six (6) who were underpaid in their lump-sum payments. Other than the exceptions below, Covered California will submit requests to SCO to issue payment to those employees who were underpaid, and will also take action to recoup any overpayments, if allowed by statutory limitations. Covered California recognizes and accepts the discrepancies with leave balance tracking in CLAS [California Leave Accounting System] which were identified in the audit. In October 2022, Covered California requested SCO to decommission CLAS due to having transitioned to Workday as the system to track leave balances. However, during the course of the audit, Covered California learned the CLAS decommission was not completely processed by SCO until late April 2023. As a result, leave balances were still showing in CLAS at the time of the audit, but Covered California was no longer able to access CLAS to make any corrections in that system, as requested by the audit team. However, as -19- California Health Benefit Exchange Payroll Audit part of the transition from CLAS to Workday, employee’s leave records were audited and updated in Workday to reflect the correct balance as of implementation in August 2021. In practice, Covered California did not use CLAS as a leave balance management system after the transition to Workday was implemented in August 2021. Since the time period covered by the audit, Covered California has implemented oversight controls such that all lump-sum calculations now require review and approval by the P Sup I or PBU Manager (Staff Services Manager I) prior to an employee separation being processed for payment. Covered California will continue to provide regular training to all transaction staff to maintain the integrity of the state payroll system, comply with all federal and state laws, and ensure employees receive accurate and timely separation pay. Notwithstanding the mitigating measures and explanations above, Covered California notes discrepancies with one of the more significant findings in this area related to untimely lump-sum payment. The audit identified a specific transaction found to be an improper and untimely lump-sum payment of $29,639 to a separating employee. However, this transaction was originally keyed and subsequently corrected by SCO due to a lump-sum deferral. Because this transaction was not entered by Covered California, we respectfully disagree with its inclusion in the final analysis. It is worth noting this particular finding was for a higher dollar amount than the others, so Covered California believes this may have unduly inflated any extrapolated calculations of potential liability for the department. SCO Comment Based on additional information provided by Covered California for one employee, we modified the number and amount of improper and late separation lump-sum payments. In its response, Covered California also explained that its leave accounting transitioned from the State’s leave accounting system to another system in August 2021. Covered California stated that it requested that the SCO decommission the State’s leave accounting system in October 2022, and that it was no longer able to access the State’s leave accounting system during the audit to correct the unreduced leave balances for 19 employees. Our audit results reflect the leave balances in the State’s leave accounting system as of June 30, 2021—prior to Covered California’s transition to the new system and the decommissioning of the State’s leave accounting system. As stated in the Lump Sum Separation Toolkit, which the PPSD made available on the SCO website, state agencies should update the State’s leave accounting system a day after the separation information is keyed into the state payroll system. The separation information for the 19 employees was keyed into the system between August 2018 and May 2021. Covered California lacked adequate segregation of duties within its FINDING 7— payroll transactions unit, as noted in Finding 1. It also lacked adequate Failure to collect controls over salary advances to ensure that advances were collected in a outstanding salary timely manner in accordance with state law and policies. Sixty-nine salary advances advances, totaling $75,686, remained outstanding for more than 90 days as of June 30, 2021. -20- California Health Benefit Exchange Payroll Audit At June 30, 2021, Covered California’s accounting records show 76 outstanding salary advances, totaling $88,289. We examined all 76 and found that 69 of them—with a value of $75,686—had been outstanding for more than 90 days. The salary advances had been outstanding for an average of 719 days, and the oldest uncollected salary advance was outstanding for three years. We noted that Covered California had not initiated timely collection efforts for any of the salary advances that we examined. Salary advances are more difficult to collect after the employee leaves state service, and they may become uncollectable if not collected within three years. If not mitigated, these control deficiencies leave Covered California at risk of failing to collect further salary advances. GC section 19838 and SAM sections 8291, 8291.1, 8293, and 8293.2 describe the State’s collection policies and procedures, which require the collection of salary advances in a timely manner and the maintenance of proper records of collection efforts. Specifically, GC section 19383(d) and SAM section 8293.2 require that actions to recover overpayments begin within three years of the date of overpayment. Recommendation We recommend that Covered California ensure that it collects salary advances in a timely manner, pursuant to GC section 19838 and SAM sections 8291, 8291.1, 8293, and 8293.2. Covered California’s Response Covered California accepts the audit findings and takes seriously the responsibility to clear all salary advances in a timely manner. Prior to the audit there was miscommunication between the Financial Management Division (FMD) and PBU resulting in uncollected salary advances. Currently PBU and FMD meet regularly to review outstanding salary advances and remedy any issues that arise. Additionally, HRB has developed new tracking mechanisms to monitor balances and collection efforts. In the past, a majority of salary advances issued were due to late dock reporting. Since the implementation of Workday, PBU has the capability to know when employee dock is being reported much sooner than in the past, since the system is in “real time”, instead of relying primarily on supervisory reporting. Also, now that the eligibility requirements for direct deposit no longer requires a minimum balance of 40 hours of leave, the number of salary advances needed has reduced when late dock is reported prior to pay day. Per the State Administrative Manual (SAM), salary advances should be cleared within 30 days of issuance. Since the audit and implementation of Workday, Covered California has consistently cleared salary advances within that time frame. FMD now distributes a monthly salary advance tracking report that is reviewed and monitored by the P Sup I and PBU Manager (Staff Services Manager I). -21- California Health Benefit Exchange Payroll Audit SCO Comment Our finding and recommendation remain unchanged. Covered California accepted the finding and indicated that it has initiated corrective actions. Covered California lacked adequate segregation of duties within its FINDING 8— payroll transactions unit, as noted in Finding 1. It also lacked adequate Inaccurate leave controls to ensure that credits that had been bought back were properly accounting for reduced in the State’s leave accounting system. leave buy-back A leave-buy back occurs when an employee receives payment at the regular salary rate in exchange for accrued vacation, annual leave, personal leave, personal holiday, and/or holiday credits. CalHR authorized leave buy-backs for excluded employees in fiscal year 2017-18 and fiscal year 2018-19. It also provided the State’s policies and procedures regarding cash-out of vacation and annual leave. Payroll records show that Covered California processed 253 leave buy- back transactions, totaling $769,004, between July 2018 and July 2021. We randomly selected a statistical sample (as described in the Appendix) of 105 transactions, totaling $342,003. We examined these selected transactions to determine whether Covered California complied with collective bargaining agreements and state regulations, and found the following errors: • Covered California did not reduce employees’ balances in the State’s leave accounting system in five of 105 (5%) transactions to reflect the number of leave credits—with a value of $10,824—that had been bought back. Unreduced leave balances pose a risk to the State because they overstate the State’s liability for leave balances and allow the possibility of improper or duplicative payments for leave credits. • Covered California understated an employee’s leave balance by 60 hours in one (1%) transaction—with a value of $7,860—because the payroll transactions unit staff member reduced the balance in the State’s leave accounting system by a number of leave credits that was more than the number of leave credits that had been bought back. If not mitigated, these control deficiencies leave Covered California at risk of making additional improper leave buy-back payments. Statistical sampling results The identified unreduced and understated leave credits represent a net total value of $2,964. We used a statistical sampling method to select the leave buy-back transactions that we examined. We projected additional unreduced leave credits with a value of $13,513. We also projected additional understated leave credits with a value of $9,813. The projected unreduced and understated leave credits have a net total of $3,700. Therefore, the identified and projected unadjusted leave credits that were bought back resulted in a net total value of $6,664, consisting of $24,337 in unreduced leave credits and $17,673 in understated leave balances. -22- California Health Benefit Exchange Payroll Audit The following table summarizes the results of our statistical sampling (amounts are rounded to the nearest dollar): -23- I d e n tif ie d v a lu e o f u n r e d u c e d a n d u n d e r s ta te d le a v e c r e d its , n e t D iv id e b y : S a m p le E r r o r r a te f o r p r o je c tio n ( d if f e r e n c e s d u e to r o u n d in P o p u la tio n th a t w a s s ta tis tic a lly s a m p le d M u ltip ly b y : E r r o r r a te f o r p r o je c tio n I d e n tif ie d a n d p r o je c te d v a lu e o f u n r e d u c e d a n d u n d le a v e c r e d its , n e t ( d if f e r e n c e s d u e to r o u n d in g ) L e s s : I d e n tif ie d v a lu e o f u n r e d u c e d a n d u n d e r s ta te d le a v e c r e d its , n e t P r o je c te d v a lu e o f u n r e d u c e d a n d u n d e r s ta te d le a v e c r e d its , n e t g e ) r s ta te d $ 2 ,9 3 4 2 ,0 0 .8 7 7 6 9 ,0 0 .8 7 6 ,6 2 ,9 $ 3 ,7 6 0% 0 % 6 6 0 4 3 4 4 4 0 Criteria GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Title 2, California Code of Regulations, section 599.744 provides that CalHR may also authorize a leave buy-back program for employees excluded from collective bargaining. Collective bargaining agreements between the State and various bargaining units allow for the annual cash-out of a certain number of hours of accumulated vacation and annual leave if funds are available. Recommendation We recommend that Covered California establish adequate internal controls to ensure that leave balances are adjusted after leave credits are bought back. Covered California’s Response Covered California accepts the audit findings and takes seriously the responsibility to ensure accurate leave accounting. SCO identified improper payments were made due to PBU staff failing to reduce leave balances in the leave accounting system. As we identified above in Finding #6, Covered California ceased the use of CLAS in July 2021 and requested to decommission the system in October 2022. Unfortunately, Covered California no longer had access to CLAS to correct the findings in that system, as requested by the audit team. However, all leave records were accurately updated in Workday upon implementation of the new system in August 2021. Similar to the mitigating measures implemented for Finding #1, PBU now requires a “dual authorization” of these transaction types to be reviewed by the P Sup I prior to leave being deducted and paid out to the employee(s). Additionally, PBU has updated written procedures for PS staff and, prior to the buy-back programs being authorized, will provide California Health Benefit Exchange Payroll Audit annual training to transaction staff on the proper processing of the leave buy-back transactions. SCO Comment Our finding and recommendation remain unchanged. Covered California accepted the finding and indicated that it has initiated corrective actions. In its response, Covered California explained that its leave accounting transitioned from the State’s leave accounting system to another system in August 2021. Covered California stated that it requested that the SCO decommission the State’s leave accounting system in October 2022, and that it was no longer able to access the State’s leave accounting system during the audit to correct the unreduced leave balances for five leave buy- back transactions and the understated leave balance for one transaction. Our audit results reflect the leave balances in the State’s leave accounting system as of June 30, 2021—prior to Covered California’s transition to the new system and the decommissioning of the State’s leave accounting system. The SCO’s Payroll Procedures Manual and Payroll Letters indicated that leave balances are updated in the State’s leave accounting system simultaneously with the leave buy-back payment. -24- California Health Benefit Exchange Payroll Audit Appendix— Audit Sampling Methodology This Appendix outlines our audit sampling application for all audit areas where statistical sampling was used. We used attributes sampling for tests of compliance. We chose this sample design because: • It follows the American Institute of Certified Public Accountants (AICPA) guidelines; • It allowed us to achieve our objectives for tests of compliance in an efficient and effective manner; • Audit areas included high and low volumes of transactions; • We planned to project the results to the intended population; and • We had the collective knowledge and skills to plan and perform the sampling plan and design. We conducted compliance testing on samples chosen by computer-generated simple random selection. For populations of fewer than 250 items, we determined the sample size using a calculator with a hypergeometric distribution. For populations of 250 items or more, we determined the sample size using a calculator with a binomial distribution. As stated in Technical Notes on the AICPA Audit Guide: Audit Sampling (March 1, 2012), page 5, although the hypergeometric distribution is the correct distribution to use for attributes sample sizes, the distribution becomes unwieldy for large populations unless suitable software is available. Therefore, more convenient approximations are frequently used instead. The confidence levels were 95.00% for separation lump-sum pay and 90.00% for regular pay, overtime pay, and leave buy-back; the tolerable error rate was 5.00%, and the expected error rate were 3.00 (1.25%) for separation lump-sum pay and 2.00 (1.75%) for regular pay, overtime pay, and leave buy-back. Pursuant to the AICPA’s Audit Guide: Audit Sampling (December 1, 2019 edition), pages 131–132, the expected error rate is the expected number of errors planned for in the sample. It is derived by multiplying the expected error rate by the sample size. The expected number of errors in the sampling tables on pages 135– 136 was rounded upward, e.g., 0.2 errors become 1.0 error. Results were projected to the intended (total) population. -A1- R O S L e v e e g u e r p a a v AA l a r p a y ti m e p a r a ti o n l e b u y - b u d r e y u m a c it a p k - s u m p a y P o p u la t io ( U n it ) 4 6 ,0 4 7 ,8 5 1 6 2 5 n 2 7 4 3 P o p u la t io n ( D o lla r ) $ 2 2 9 ,0 4 2 ,1 5 3 ,5 4 1 ,4 0 2 1 ,7 0 2 ,4 4 8 7 6 9 ,0 0 4 5 T T E T S r a r a m r a a n n p n m p lin g U n it s a c tio n s a c tio n lo y e e s a c tio n S a m p S iz e 1 0 5 1 0 5 7 0 1 0 5 le FN inu dm3 5 6 8 inb g e r California Health Benefit Exchange Payroll Audit Attachment— California Health Benefit Exchange’s Response to Draft Audit Report State Controller’s Office Division of Audits Post Office Box 942850 Sacramento, CA 94250 www.sco.ca.gov S22-PAR-0004