San Jose State University Payroll Audit

SAN JOSÉ STATE UNIVERSITY Audit Report PAYROLL AUDIT March 1, 2017, through February 29, 2020 M M. C ALIA OHEN C ALIFORNIA S TATE C ONTROLLER May 2025 MALIA M. COHEN CALIFORNIA STATE CONTROLLER May 19, 2025 Dr. Cynthia Teniente-Matson, President San José State University One Washington Square UPD Building 3rd Floor San José, CA 95192 Dear Dr. Teniente-Matson: The State Controller’s Office audited San José State University’s payroll process and transactions for the period of March 1, 2017, through February 29, 2020. The audit was conducted pursuant to Government Code sections 12476 and 12410. San José State University management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. If you have any questions regarding this report, please contact Roochel Espilla, Chief, State Agency Audits Bureau, by telephone at 916-323-5744. Thank you. Sincerely, Original signed by Kimberly A. Tarvin, CPA Chief, Division of Audits KAT/am MAILING ADDRESS P.O. Box 942850, Sacramento, CA 94250 SACRAMENTO 3301 C Street, Suite 700, Sacramento, CA 95816 | 916.324.8907 LOS ANGELES 901 Corporate Center Drive, Suite 200, Monterey Park, CA 91754 | 323.981.6802 Dr. Cynthia Teniente-Matson May 19, 2025 Page 2 of 2 Copy: E. Jeanne Durr, J.D., Interim Senior Associate Vice President University Personnel San José State University Terryn Ashley, Senior Director University Personnel Operations San José State University Stacy Perez, Lead Employee Support Services San José State University Michele Delfino, Liaison Employee Support Services San José State University Mildred García, Ed.D., Chancellor California State University Albert A. Liddicoat, Ph.D., Interim Vice Chancellor for Human Resources California State University Vlad Marinescu, Chief Audit Officer California State University Sharon Best, Senior Manager Investigations and Intergovernmental Audits California State University Lisa Dean, Acting Division Chief Personnel and Payroll Services Division State Controller's Office Veronica Encinas, Bureau Chief Personnel and Payroll Services Division State Controller's Office MAILING ADDRESS P.O. Box 942850, Sacramento, CA 94250 SACRAMENTO 3301 C Street, Suite 700, Sacramento, CA 95816 | 916.324.8907 LOS ANGELES 901 Corporate Center Drive, Suite 200, Monterey Park, CA 91754 | 323.981.6802 San José State University Payroll Audit Contents Audit Report Summary ............................................................................................................................ 1 Background ........................................................................................................................ 1 Audit Authority.................................................................................................................. 1 Objectives, Scope, and Methodology ............................................................................... 1 Conclusion .......................................................................................................................... 3 Follow-up on Prior Audit Findings .................................................................................. 4 Views of Responsible Officials .......................................................................................... 4 Restricted Use .................................................................................................................... 4 Schedule—Summary of Audit Results ................................................................................. 5 Findings and Recommendations ........................................................................................... 6 Appendix—Audit Sampling Methodology ........................................................................... A1 Attachment—San José State University’s Response to Draft Audit Report San José State University Payroll Audit Audit Report Summary The State Controller’s Office (SCO) audited San José State University’s (SJSU) payroll process and transactions for the period of March 1, 2017, through February 29, 2020. SJSU management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. Our audit determined that SJSU did not: • Maintain adequate and effective internal controls over its payroll process; • Process payroll and payroll-related disbursements accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures; or • Administer salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. Background In 1979, the State of California adopted collective bargaining for state employees. This created a significant workload increase for the SCO’s Personnel and Payroll Services Division (PPSD), as PPSD was the State’s centralized payroll processing center for all payroll-related transactions. PPSD decentralized the processing of payroll, allowing state agencies and departments to process their own payroll-related transactions. Periodic audits of the decentralized payroll processing at state agencies and departments ceased due to the budget constraints in the late 1980s. In 2013, the California State Legislature reinstated these payroll audits to gain assurance that state agencies and departments maintain adequate internal control over the payroll function, provide proper oversight of their decentralized payroll processing, and comply with various state laws and regulations regarding payroll processing and related transactions. Audit Authority We conducted this audit in accordance with Government Code (GC) section 12476, which authorizes the SCO to audit the State’s payroll system, the State Pay Roll Revolving Fund, and related records of state agencies within the State’s payroll system. In addition, GC section 12410 provides the SCO with general authority to audit the disbursement of state money for correctness, legality, and sufficient provisions of law for payment. Objectives, Scope, Our audit objectives were to determine whether SJSU: and Methodology • Maintained adequate and effective internal controls over its payroll process; -1- San José State University Payroll Audit • Processed payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures; and • Administered salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. The audit covered the period from March 1, 2017, through February 29, 2020. The audit population consisted of payroll transactions totaling $737,658,742, as quantified in the Schedule. To achieve our audit objectives, we performed the following procedures: • We reviewed state and SJSU policies and procedures related to the payroll process to understand SJSU’s methodology for processing various payroll and payroll-related transactions. • We interviewed SJSU payroll personnel to understand SJSU’s methodology for processing various payroll and payroll-related transactions, determine the employees’ level of knowledge and ability relating to payroll transaction processing, and gain an understanding of existing internal control over the payroll process and systems. • We selected transactions recorded in the State’s payroll database using statistical sampling, as outlined in the Appendix, and targeted selection based on risk factors and other relevant criteria. • We analyzed and tested the selected transactions, and reviewed relevant files and records to determine the accuracy of payroll and payroll-related payments; accuracy of leave transactions; adequacy and effectiveness of internal control over the payroll process; and compliance with collective bargaining agreements and state laws, regulations, policies, and procedures. • We reviewed salary advances to determine whether SJSU administered and recorded them in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. • We assessed the reliability of computer-processed data for payroll and payroll-related transactions by interviewing SJSU officials knowledgeable about the data; reviewing existing information about the data and the system that produced it; and tracing data to source documents, based on statistical sampling, judgmental selection, and targeted selection. We determined that the data was sufficiently reliable for the purposes of this report. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. -2- San José State University Payroll Audit Conclusion Our audit determined that SJSU did not maintain adequate and effective internal controls over its payroll process1; did not process payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures; and did not administer salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. We found deficiencies in internal control over the payroll process that we consider to be material weaknesses, and instances of noncompliance with the requirements of collective bargaining agreements and state laws, regulations, policies, and procedures. These material weaknesses and instances of noncompliance are as follows: • SJSU had inadequate segregation of duties and a lack of compensating controls over payroll transactions (see Finding 1). • Four of 10 (40%) employees whose records we examined during our audit had inappropriate keying access to the State’s payroll system (see Finding 2). • SJSU underpaid one of the 105 emergency pay transactions that we examined. We identified $1,507 in underpayments and projected an additional $86,504 in underpayments. In addition, SJSU did not consistently maintain supporting documentation for emergency payments. Based on our audit testing, we estimated that 7% of the supporting documentation associated with emergency payments during the audit period was not retained. We identified $19,284 and projected an additional $1,106,930 in unsupported emergency payments (see Finding 3). • SJSU overpaid 16 of 106 (15%) employees whose separation lump- sum payments we examined and underpaid 32 of 106 (30%) employees. The identified and projected overpayments and underpayments totaled $32,172 and $269,560, respectively. In addition, SJSU did not consistently maintain supporting documentation for separation lump-sum pay. Based on our audit testing, we estimated that 5% of the supporting documentation associated with separation lump-sum payments during the audit period 1 In planning and performing our audit of compliance, we considered SJSU’s internal control over compliance with collective bargaining agreements and state laws, regulations, policies, and procedures to determine the auditing procedures that were appropriate under the circumstances for the purpose of providing a conclusion on compliance, and to test and report on internal control over compliance. Our consideration of internal control over compliance was for the limited purpose described in the first paragraph of this footnote; it was not designed to identify all deficiencies in internal control over compliance that might be material weaknesses or significant deficiencies. As discussed in this section, we identified certain deficiencies in internal control over compliance that we consider to be material weaknesses. A deficiency in internal control over compliance exists when the design, implementation, or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance on a timely basis. A material weakness in internal control over compliance is a deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with a compliance requirement will not be prevented, or detected and corrected, on a timely basis. A significant deficiency in internal control over compliance is a deficiency, or a combination of deficiencies, in internal control over compliance that is less severe than a material weakness in internal control over compliance, yet important enough to merit attention from those charged with governance. -3- San José State University Payroll Audit was not retained. We identified $123,660 and projected an additional $447,322 in unsupported payments (see Finding 4). • SJSU overpaid three of the 116 overtime pay transactions that we examined. We identified $1,057 and projected an additional $25,882 in overpayments. In addition, SJSU did not consistently maintain timesheets for overtime pay. Based on our audit testing, we estimated that 4% of the timesheets associated with overtime payments during the audit period were not retained. We identified $1,528 and projected an additional $83,826 in unsupported payments (see Finding 5). • SJSU underpaid five of the 105 settlement pay transactions that we examined. We identified $2,910 and projected an additional $86,132 in underpayments. In addition, SJSU did not consistently maintain supporting documentation for settlement pay. Based on our audit testing, we estimated that 3% of the supporting documentation associated with settlement payments during the audit period was not retained. We identified $6,346 and projected an additional $187,841 in unsupported payments (see Finding 6). • SJSU had inadequate controls to ensure that salary advances were properly issued, administered in accordance with requirements, and collected in a timely manner. We found deficiencies in seven salary advances, totaling $13,363. SJSU did not initiate timely collection efforts for two of the advances, and was unable to provide supporting documentation for five of the advances. In addition, SJSU did not cancel employees’ direct deposits before issuing any of the seven advances (see Finding 7). Follow-up on We have not previously conducted an audit of SJSU’s payroll process and Prior Audit transactions. Findings We issued a draft audit report on September 10, 2024. SJSU’s Views of representative responded by letter dated January 28, 2025, agreeing with Responsible the audit results. This final audit report includes SJSU’s response as an Officials attachment. Restricted Use This audit report is solely for the information and use of SJSU, the California State University, and the SCO; it is not intended to be, and should not be, used by anyone other than these specified parties. This restriction is not intended to limit distribution of this audit report, which is a matter of public record and is available on the SCO website at www.sco.ca.gov. Original signed by Kimberly A. Tarvin, CPA Chief, Division of Audits May 19, 2025 -4- San José State University Payroll Audit Schedule— Summary of Audit Results March 1, 2017, through February 29, 2020 Net Total Dollar Amount of Projected Improper Costs Net Total and Identified Number of Number of Dollar Amount Dollar Amount and Projected Method of Units of Dollar Amount Selections of Selections of Identified Unsupported Finding Audit Area Tested Selection Population of Population Examined Examined Improper Costs Costs Number Segregation of duties N/A N/A N/A N/A N/A N/A N/A 1 System access Targeted 1 0 N/A 1 0 Employees N/A N/A N/A 2 Regular pay Statistical 1 88,043 $ 693,276,623 7 7 Transactions $ 250,559 $ - $ - Emergency pay Statistical 5 ,711 27,646,872 1 05 Transactions 473,391 (1,507) 1,039,710 3 Separation lump-sum pay Statistical 8 65 5 ,396,650 1 06 Employees 746,512 ( 28,043) 361,637 4 and targeted Overtime pay Statistical 4 ,910 5 ,184,975 116 Transactions 98,777 1 ,057 111,236 5 and targeted Settlement pay Statistical 2 ,652 5 ,775,445 1 05 Transactions 188,746 (2,910) 108,055 6 Excess vacation and annual leave Targeted 1 42 356,681 1 42 Employees 356,681 - - Salary advance Targeted 1 0 21,496 1 0 Transactions 21,496 13,363 - 7 $ 737,658,742 $ 2,136,162 $ (18,040) $ 1,620,638 -5- San José State University Payroll Audit Findings and Recommendations FINDING 1— SJSU lacked adequate segregation of duties within its payroll transactions unit to ensure that only valid and authorized payroll transactions were Inadequate processed. SJSU also failed to implement other controls to compensate for segregation of this risk. duties and lack of compensating Our audit found that SJSU payroll transactions unit staff performed controls over conflicting duties. Staff members performed multiple steps in processing payroll payroll transactions, including entering data into the State’s payroll transactions system; auditing employee timesheets; reconciling payroll, including reconciling system output to source documentation; reporting payroll exceptions; and processing adjustments. For example, staff members keyed in regular and overtime pay, and reconciled the master payroll, overtime, and other supplemental warrants. SJSU failed to demonstrate that it implemented compensating controls to mitigate the risks associated with such a deficiency. We found no indication that these functions were subjected to periodic supervisory review. The lack of adequate segregation of duties and compensating controls has a pervasive effect on the SJSU payroll process, and impairs the effectiveness of other controls by rendering their design ineffective or by keeping them from operating effectively. These control deficiencies, in combination with other deficiencies discussed in Findings 2 through 7, represent a material weakness in internal control over the payroll process such that there is a reasonable possibility that material noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. Good internal control practices require that the following functional duties be performed by different work units, or at minimum, by different employees within the same unit: • Recording transactions – This duty refers to the record-keeping function, which is accomplished by entering data into a computer system. • Authorization to execute – This duty belongs to individuals with authority and responsibility to initiate and execute transactions. • Periodic review and reconciliation of actual payments to recorded amounts – This duty refers to making comparisons of information at regular intervals and taking action to resolve differences. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including proper segregation of duties and an effective system of internal review. Adequate segregation of duties reduces the likelihood that fraud or error will remain undetected by providing for separate processing by different individuals at various stages of a transaction and for independent reviews of the work performed. -6- San José State University Payroll Audit Recommendation We recommend that SJSU: • Separate conflicting payroll functional duties to the greatest extent possible. Adequate segregation of duties will provide a stronger system of internal control whereby the functions of each employee are subject to the review of another. If it is not possible to segregate payroll functions fully and appropriately, SJSU should implement compensating controls. For example, if the payroll transactions unit staff member responsible for recordkeeping also performs a reconciliation process, then the supervisor should perform and document a detailed review of the reconciliation to provide additional control over the assignment of conflicting functions. Compensating controls may also include dual authorization requirements and documented reviews of payroll system input and output; and • Develop formal procedures for performing and documenting compensating controls. FINDING 2— SJSU lacked adequate controls to ensure that only appropriate staff members had keying access to the State’s payroll system. SJSU Inappropriate inappropriately allowed four employees keying access to the State’s keying access to the payroll system because SJSU did not immediately remove or modify State’s payroll keying access for two employees after the employees’ separation from system state service, transfer to another agency, or change in classification. The SCO maintains the State’s payroll system. The system is decentralized, thereby allowing employees of state agencies to access it. All state agencies are required to comply with PPSD’s Decentralized Security Program Manual (DSP Manual) in order to access the payroll system. The DSP Manual describes how state agencies can secure and protect the confidentiality and integrity of payroll data against misuse, abuse, and unauthorized use. We examined the records of 10 SJSU employees who had keying access to the State’s payroll system at various times between March 2017 and February 2020. Of the 10 employees, four had inappropriate keying access to the State’s payroll system. Specifically, SJSU did not immediately remove or modify keying access for two employees after the employees’ separation from state service, transfer to another agency, or change in classification. For example, a Payroll Technician II left SJSU on July 15, 2019, but SJSU did not request to remove the employee’s access until November 19, 2019—127 days later. SJSU also had two employees with keying access while appointed to ineligible positions; SJSU could not provide the required justifications letters for these employees. Further, one of these two employees promoted to an Administrator III on July 1, 2018, but SJSU did not update the security authorization forms until November 19, 2019—506 days later. SJSU lacked periodic review of keying access granted to employees to ensure compliance with the DSP Manual. -7- San José State University Payroll Audit If not mitigated, this control deficiency leaves payroll data at risk of misuse, abuse, and unauthorized use. The December 2015 DSP Manual (“Access Requirements,” page 13) states, in part: The [State’s payroll system] contains sensitive and confidential information. Access is restricted to persons with an authorized, legal, and legitimate business requirement to complete their duties. . . . Currently, PIMS [Employment History], HIST [Payroll History], KEYM [Keymaster], PIP [Payroll Input Processing], LAS [Leave Accounting System], MPC [Master Payroll Certification] and/or ACAS [Affordable Care Act database] applications are restricted to Personnel Specialists or Personnel Technician classifications because their need is by definition a function of their specific job duties and any change in those duties requires a reevaluation of the need for access. If the employee’s duties change, such that the need for access no longer exists, the access privilege MUST be removed or deleted immediately by a request submitted by the department/campus. The December 2015 DSP Manual (“Letter of Justification,” page 14) states, in part: A request to grant access to an individual in a classification other than in the Personnel Specialist/Payroll Technician series to access PIMS, HIST, KEYM, PIP, LAS, MPC and/or ACAS requires a written justification from the Authorizing Manager. The justification must describe the individual’s specific job duties requiring the need to access system information . . . as well as level of access to that application, in order to perform their regular daily duties. . . . The December 2015 DSP Manual (“Revocation and Deletion of User IDs,” page 17) states, in part: To prevent unauthorized use by a transferred, terminated or resigned employee’s user ID, the Security Monitor must IMMEDIATELY submit all pages of the PSD125A to delete the user’s system access. Using an old user ID increases the chances of a security breach, which is a serious security violation. Sharing a user ID is strictly prohibited and a serious violation. . . . Recommendation We recommend that SJSU: • Update keying access to the State’s payroll system immediately after employees leave SJSU, transfer to another unit, or change classifications; and • Periodically review access to the system to verify that access complies with the DSP Manual. -8- San José State University Payroll Audit FINDING 3— SJSU lacked adequate segregation of duties within its payroll transactions Improper unit, as noted in Finding 1. It also lacked adequate controls over the payments and processing of emergency pay; adequate supervisory review to ensure missing accurate processing of emergency pay; and adequate controls to ensure that documentation was maintained to support emergency payments. documentation for emergency pay Payroll records show that SJSU processed 5,711 emergency pay transactions, totaling $27,646,872, between March 1, 2017, and February 29, 2020. We randomly selected a statistical sample (as described in the Appendix) of 105 transactions, totaling $473,391. Based on our examination of the 105 emergency pay transactions, we found the following errors: • SJSU underpaid one transaction by $1,507 because SJSU payroll transactions unit staff members used an incorrect salary rate when calculating emergency pay. SJSU also lacked adequate supervisory review to ensure accurate processing of emergency pay. We projected an additional $86,504 in underpayments. • SJSU could not locate supporting timesheets and pay rate documentation for seven of 105 (7%) of the transactions, totaling $19,284. We could not determine the validity, accuracy, and propriety of the payments made to these employees. We projected an additional $1,106,930 in unsupported payments. If not mitigated, these control deficiencies leave SJSU at risk of making additional improper emergency payments. Statistical sampling results The identified improper and unsupported payments have a net total of $17,777. We used a statistical sampling method to select the emergency pay transactions examined. We projected an additional $86,504 in underpayments and $1,106,930 in unsupported payments. The projected improper and unsupported payments represent a net total of $1,020,426. Therefore, the identified and projected improper and unsupported payments totaled a net of approximately $1,038,203, consisting of $88,011 in underpayments and $1,126,214 in unsupported payments. The following table summarizes the results of our statistical sampling (amounts are rounded to the nearest dollar): Identified improper and unsupported payments, net $ 17,777 Divide by: Sample 473,391 Error rate for projection (differences due to rounding) 3.76% Population that was statistically sampled 27,646,872 Multiply by: Error rate for projection 3.76% Identified and projected improper and unsupported payments, net (differences due to rounding) 1,038,203 Less: Identified improper and unsupported payments, net 17,777 Projected improper and unsupported payments, net $ 1,020,426 -9- San José State University Payroll Audit Criteria GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Collective bargaining agreements contain specific clauses regarding emergency pay. SJSU’s Records/Information Retention and Disposition Schedule specifies a four-year retention period for emergency pay documentation. Recommendation We recommend that SJSU: • Conduct a review of emergency payments made during the past three years to ensure that the payments complied with collective bargaining agreements and state laws and policies; and • Properly compensate those employees who were underpaid. We further recommend that, to prevent improper emergency payments from recurring, SJSU: • Establish adequate controls to ensure that emergency payments are accurate and in compliance with collective bargaining agreements and state policy; and • Maintain supporting documentation for emergency payments, pursuant to retention policies. FINDING 4— SJSU lacked adequate segregation of duties within its payroll transactions Improper and late unit, as noted in Finding 1. It also lacked adequate controls over the payments, and processing of employee separation lump-sum pay; adequate supervisory missing review to ensure accurate and timely processing of separation lump-sum pay; and adequate controls to ensure that documentation was maintained documentation for to support separation lump-sum payments. separation lump- sum pay Payroll records show that SJSU processed separation lump-sum payments, totaling $5,396,650, for 865 employees between March 2017 and February 2020, as follows: Separation Lump-Sum Pay Group Unit Amount Employees who were paid at least 1 $ 123,617 $100,000 (examined 100%) Employees who were paid less than 864 5,273,033 $100,000 (statistically sampled) Total population 865 $5,396,650 Of the 864 employees who were paid less than $100,000 each in separation lump-sum payments, totaling $5,273,033, we randomly selected a -10- San José State University Payroll Audit statistical sample (as described in the Appendix) of 105 employees who received separation lump-sum payments, totaling $622,895. We also examined the payment to the one employee who was paid $123,617. Based on our examination of the separation lump-sum payments made to these 106 employees, we found the following errors: • SJSU overpaid 16 of 106 (15%) employees by $3,800 and underpaid 32 of 106 (30%) employees by $31,843 because payroll transactions unit staff members miscalculated leave credits paid. SJSU also lacked adequate supervisory review to ensure accurate and timely processing of separation lump-sum pay. We projected an additional $28,372 in overpayments and $237,717 in underpayments. • SJSU did not make separation lump-sum payments to 43 of 106 (41%) employees in a timely manner. • SJSU could not locate supporting documents (lump-sum calculation worksheets, leave balance statements, state calendars, and timesheets) for payments, totaling $123,660, made to five of 106 (5%) employees. We could not determine the validity, accuracy, and propriety of the payments made to these employees; or the completeness and accuracy of the leave accounting records. We projected an additional $447,322 in unsupported payments. If not mitigated, these control deficiencies leave SJSU at risk of making additional improper and late separation lump-sum payments, noncompliance with agreements and laws, and liability for late payments. Statistical sampling results The identified improper and unsupported payments for projection to the intended population totaled a net of approximately $31,877. We used a statistical sampling method to select the employees whose separation lump-sum payments we examined. We projected an additional $28,372 in overpayments and $237,717 in underpayments. We also projected an additional $447,322 in unsupported payments. The projected improper and unsupported payments totaled a net of approximately $237,977. Therefore, the identified and projected improper and unsupported payments totaled a net of approximately $269,854, consisting of $32,172 in overpayments, $269,560 in underpayments, and $507,242 in unsupported payments. -11- San José State University Payroll Audit The following table summarizes the results of our statistical sampling (amounts are rounded to the nearest dollar): -12- I D E P M I L P d e n t if ie d im p r o p e r a n d u n s u iv id e b y : S a m p le r r o r r a t e f o r p r o j e c t io n ( d if f o p u la t io n t h a t w a s s t a t is t ic a u lt ip ly b y : E r r o r r a t e f o r p r d e n t if ie d a n d p r o j e c t e d im p r ( d if f e r e n c e s d u e t o r o u n d in e s s : I d e n t if ie d im p r o p e r a n d r o j e c t e d im p r o p e r a n d u n s u p p o r t e d p e r e n c e s d lly s a m p le o j e c t io n o p e r a n d g ) u n s u p p o p p o r t e d p a y u e d u n r t e a y m e n t s , n t o r o u n d s u p p o r t e d p a y m e m e n t s , n e t in g d p n t s e t ) a y , n m e t e n t s , n e t $ 3 6 2 5 5 , 2 7 5 2 6 3 $ 2 3 1 2 . 3 . 9 1 7 , 8 , 8 1 2 , 0 1 2 , 8 , 8 , 9 7 9 % 3 % 5 7 7 7 5 3 4 7 7 Criteria GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. Education Code section 89504 allows lump-sum payment for accrued eligible leave credits when an employee separates from state employment. Collective bargaining agreements include similar provisions regarding separation lump-sum pay. SJSU’s General Retention Schedule for Payroll/Personnel Records specifies a four-year retention period for separation lump-sum pay documentation. Recommendation We recommend that SJSU: • Conduct a review of separation lump-sum payments made during the past three years to ensure that the payments were accurate and in compliance with collective bargaining agreements and state law; • Recover overpayments made to separated employees through an agreed-upon collection method in accordance with Chapter 28, “Accounts Receivable,” of the California State University (CSU) Legal Manual; and • Properly compensate those employees who were underpaid. We further recommend that, to prevent improper separation lump-sum payments from recurring, SJSU: • Establish adequate controls to ensure accurate calculation and timely payment of separation lump-sum pay. • Provide adequate oversight to ensure that payroll transactions unit staff process only valid and authorized payments that comply with collective bargaining agreements and state laws; and San José State University Payroll Audit • Maintain supporting documentation for separation lump-sum payments pursuant to its retention policies. FINDING 5— SJSU lacked adequate segregation of duties within its payroll transactions Improper unit, as noted in Finding 1. It also lacked adequate controls over the processing of overtime pay; adequate supervisory review to ensure payments and accurate processing of overtime pay; and adequate controls to ensure that missing timesheets documentation was maintained to support overtime payments. for overtime pay Payroll records show that SJSU processed 4,910 overtime pay transactions, totaling $5,184,975, between March 2017 and February 2020, as follows: Separation Lump-Sum Pay Group Unit Amount Section 7(k) employees 4,899 $5,178,915 (statistically sampled) Non-section 7(k) employees 11 6,060 (examined 100%) Total population 4,910 $5,184,975 There were 4,899 transactions for employees who are considered non- exempt under the Fair Labor Standards Act; and 11 transactions for exempt employees (i.e., those who are not eligible for overtime pay, except when there are special considerations). We randomly selected a statistical sample (as described in the Appendix) of 105 transactions, totaling $92,717, from the 4,899 overtime pay transactions, totaling $5,178,915, for non-exempt employees. We also selected a targeted sample of the 11 overtime pay transactions, totaling $6,060, for exempt employees. Based on our examination of the 116 overtime pay transactions, we found the following errors: • SJSU overpaid three of the 116 (3%) transactions by $1,057 because the payroll transactions unit staff members incorrectly entered the overtime hours worked into the payroll system. SJSU also lacked adequate supervisory review to ensure accurate processing of overtime pay. We projected an additional $25,882 in overpayments. • SJSU could not locate timesheets and supporting calculations for five of 116 (4%) transactions, totaling $1,528. We could not determine the validity, accuracy, and propriety of the payments made to these employees; or the completeness and accuracy of the leave accounting records. We projected an additional $83,826 in unsupported payments. If not mitigated, these control deficiencies leave SJSU at risk of making additional improper overtime payments. -13- San José State University Payroll Audit Statistical sampling results The identified improper and unsupported payments for projection to the intended population totaled a net of approximately $2,000. We used a statistical sampling method to select the overtime pay transactions that we examined. We projected an additional $25,882 in overpayments and $83,826 in unsupported payments. The projected improper and unsupported payments represent a net total of $109,708. Therefore, the identified and projected improper and unsupported payments have a net total of $111,708, consisting of $26,354 in overpayments and $85,354 in unsupported payments. The following table summarizes the results of our statistical sampling (amounts are rounded to the nearest dollar): -14- I D E P M I L P d e n t if ie d im p r o p e r a n d u n s u iv id e b y : S a m p le r r o r r a t e f o r p r o j e c t io n ( d if f o p u la t io n t h a t w a s s t a t is t ic a u lt ip ly b y : E r r o r r a t e f o r p r d e n t if ie d a n d p r o j e c t e d im p r ( d if f e r e n c e s d u e t o r o u n d in e s s : I d e n t if ie d im p r o p e r a n d r o j e c t e d im p r o p e r a n d u n s u p p o r t e d p e r e n c e s d lly s a m p le o j e c t io n o p e r a n d g ) u n s u p p o p p o r t e d p a y u e d u n r t e a y m e n t s , n t o r o u n d s u p p o r t e d p a y m e m e n t s , n e t in g d p n t s e t ) a y , n m e t e n t s , n e t $ 2 9 2 2 . 5 , 1 7 8 2 . 1 1 1 2 $ 1 0 9 , 0 , 7 1 6 , 9 1 6 , 7 , 0 , 7 0 1 % 1 % 0 0 0 0 7 5 8 0 8 Criteria GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Collective bargaining agreements and Education Code section 89502 contain specific clauses regarding overtime pay. SJSU’s General Retention Schedule for Payroll/Personnel Records specifies a four-year retention period for overtime pay documentation. Recommendation We recommend that SJSU: • Conduct a review of overtime payments made during the past three years to ensure that the payments complied with collective bargaining agreements and state law; and • Recover any overpayments made to employees through an agreed- upon collection method in accordance with Chapter 28, “Accounts Receivable,” of the CSU Legal Manual. San José State University Payroll Audit We further recommend that, to prevent improper overtime payments from recurring, SJSU: • Establish adequate internal controls to ensure that payments are accurate and comply with collective bargaining agreements and state law; • Provide adequate oversight to ensure that payroll transactions unit staff process only valid and authorized payments that comply with collective bargaining agreements and state law; and • Maintain supporting documentation for payments, pursuant to its retention policies. FINDING 6— SJSU lacked adequate segregation of duties within its payroll transactions Improper unit, as noted in Finding 1. It also lacked adequate controls over the payments and processing of settlement pay; adequate supervisory review to ensure accurate processing of settlement pay; and adequate controls to ensure that missing documentation was maintained to support settlement payments. documentation for settlement pay Payroll records show that SJSU processed 2,652 settlement pay transactions, totaling $5,775,445 from March 1, 2017, through February 29, 2020. We randomly selected a statistical sample of 105 transactions, totaling $188,746. Based on our examination of these transactions, we found the following errors: • SJSU underpaid five of 105 (5%) transactions by $2,910 because payroll transactions unit staff members made errors in the calculation and keying of settlement pay into the State’s payroll system. SJSU also lacked adequate supervisory review to ensure accurate processing of settlement payments. We projected an additional $86,132 in underpayments. • SJSU could not locate supporting documents (timesheets, academic pay calendars, and settlement pay worksheets) for three of 105 (3%) of the transactions, totaling $6,346. We could not determine the validity, accuracy, and propriety of the payments made to these employees; or the completeness and accuracy of the leave accounting records. We projected an additional $187,841 in unsupported payments. If not mitigated, these control deficiencies leave SJSU at risk of making additional improper settlement payments. Statistical sampling results The identified improper and unsupported payments have a net total of $3,436. We used a statistical sampling method to select the settlement pay transactions that we examined. We projected an additional $86,132 in underpayments and $187,841 in unsupported payments. The projected improper and unsupported payments have a net total of $101,709. Therefore, the identified and projected improper and unsupported -15- San José State University Payroll Audit payments totaled a net of approximately $105,145, consisting of $89,042 in underpayments and $194,187 in unsupported payments. The following table summarizes the results of our statistical sampling (amounts are rounded to the nearest dollar): -16- I D E P M I L P d e n t if ie d im p r o p e r a n d u n s u iv id e b y : S a m p le r r o r r a t e f o r p r o j e c t io n ( d if f o p u la t io n t h a t w a s s t a t is t ic a u lt ip ly b y : E r r o r r a t e f o r p r d e n t if ie d a n d p r o j e c t e d im p r ( d if f e r e n c e s d u e t o r o u n d in e s s : I d e n t if ie d im p r o p e r a n d r o j e c t e d im p r o p e r a n d u n s u p p o r t e d p e r e n c e s d lly s a m p le o j e c t io n o p e r a n d g ) u n s u p p o p p o r t e d p a y u e d u n r t e a y m e n t s , n t o r o u n d s u p p o r t e d p a y m e m e n t s , n e t in g d p n t s e t ) a y , n m e t e n t s , n e t $ 3 1 8 8 1 . 5 , 7 7 5 1 . 1 0 5 3 $ 1 0 1 , 4 , 7 8 2 , 4 8 2 , 1 , 4 , 7 3 4 % 5 % 4 3 0 6 6 5 5 6 9 Criteria GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Title 5, California Code of Regulations, section 42805 specifies the requirements for settlement pay. SJSU’s General Retention Schedule for Payroll/Personnel Records specifies a four-year retention period for settlement pay documentation. Section F 011 (revised August 1993) of SCO’s Payroll Procedures Manual states, in part: Adjustment of annual wages is referred to as a “settlement.” A settlement shall be certified for each academic year employee or ten-month academic employee whose pay has been adjusted during the period of employment due to a late start, dock, transfer between positions, or a separation. When settlements are submitted, adjustments will be made for work at two or more time bases or salary rates. Section F 012 (revised January 2002) of SCO’s Payroll Procedures Manual states, in part: When separate settlement amounts are computed and an employee has been employed at two or more time bases or has had two or more salary rates in the academic year, semester, quarter, or summer quarter, separate salary settlements shall also be computed for completed semesters and academic quarters prior to the semester or academic quarter in which separation occurs. The separate settlement calculations shall then be added together to determine the total settlement amount due the employee for all time bases and rates combined. San José State University Payroll Audit Recommendation We recommend that SJSU: • Establish adequate controls to ensure that settlement payments are accurate and in compliance with state regulations and policy; • Properly compensate those employees who were underpaid; • Provide adequate oversight to ensure that payroll transactions unit staff members process only valid and authorized payments that comply with state regulations and policies; and • Maintain supporting documentation for settlement payments, pursuant to its retention policies. FINDING 7— SJSU lacked adequate segregation of duties within its payroll transactions Failure to collect unit, as noted in Finding 1. It also lacked adequate controls over salary outstanding salary advances to ensure that advances were issued properly and collected in a timely manner, and that adequate records were maintained in accordance advances and with state laws, regulations, policies, and procedures. Two salary maintain related advances, totaling $1,846, remained outstanding for over 200 days as of documentation February 29, 2020. At February 29, 2020, SJSU’s accounting records show 10 outstanding salary advances, totaling $21,496, which had been outstanding for more than 60 days. We examined all 10, and noted the following deficiencies in seven salary advances, totaling $13,363: • SJSU had not initiated timely collection efforts for two advances, totaling $1,846. • SJSU did not cancel employees’ direct deposits before issuing any of the seven advances. • SJSU lacked supporting documentation for five advances, totaling $11,517. We were unable to determine whether the salary advances had been properly issued and promptly collected, or whether SJSU attempted to recover the advanced funds if overpayments had occurred. The two salary advances with supporting documentation had been outstanding for an average of 274 days, and the oldest uncollected balance was outstanding for more than a year. The lack of adequate records for salary advances prevents SJSU from performing adequate review and ensuring timely collection of salary advances. If not mitigated, these control deficiencies leave SJSU at risk of failing to collect further salary advances. GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. -17- San José State University Payroll Audit Chapter 28, “Accounts Receivable,” of the CSU Legal Manual and SAM sections 8291, 8291.1, and 8293 describe the state and SJSU collection policies and procedures, which require the collection of salary advances in a timely manner and the maintenance of proper records of collection efforts. SJSU’s General Retention Schedule for Payroll/Personnel Records specifies a five-year retention period for salary advance documentation. Recommendation We recommend that SJSU: • Establish adequate controls to ensure that salary advances are issued, administered, and collected in compliance with state and SJSU policies and procedures; and • Maintain adequate records of salary advances, collection efforts, and payments pursuant to its retention policies. -18- San José State University Payroll Audit Appendix— Audit Sampling Methodology This Appendix outlines our audit sampling application for all audit areas for which statistical sampling was used. We used attributes sampling for tests of compliance. We chose this sample design because: • It follows the American Institute of Certified Public Accountants (AICPA) guidelines; • It allowed us to achieve our objectives for tests of compliance in an efficient and effective manner; • Audit areas included high volumes of transactions; • We planned to project the results to the intended population; and • We had the collective knowledge and skills to plan and perform the sampling plan and design. We conducted compliance testing on samples chosen by computer-generated simple random selection. For populations of 250 items or more, we determined the sample size using a calculator with a binomial distribution. As stated in Technical Notes on the AICPA Audit Guide: Audit Sampling (March 1, 2012), page 5, although the hypergeometric distribution is the correct distribution to use for attributes sample sizes, the distribution becomes unwieldy for large populations unless suitable software is available. Therefore, more convenient approximations are frequently used instead. The confidence level was 90.00%; the tolerable error rate was 5.00%; and the expected error rates were 1.00 (1.25%) for regular pay, and 2.00 (1.75%) for emergency pay, separation lump-sum pay, overtime pay, and settlement pay. Pursuant to the AICPA’s Audit Guide: Audit Sampling (December 1, 2019 edition), pages 131–132, the expected error rate is the expected number of errors planned for in the sample. It is derived by multiplying the expected error rate by the sample size. The expected number of errors in the sampling tables on pages 135–136 was rounded upward, e.g., 0.2 errors become 1.0 error. Results were projected to the intended (total) population. -A1- R E S O S e m e v e A u d i A r e a g u la r e r g e n c y p a y p a r a tio n lu m p e r t im e p a y tt le m e n t p a y t - s u m p a y P o p u l a t io ( U n i t ) 1 8 8 ,0 4 5 ,7 1 8 6 4 ,8 9 2 ,6 5 n 3 1 4 9 2 P o p ( D $ 6 9 3 2 7 5 5 5 u l a t io o l la r ) ,2 7 6 ,6 ,6 4 6 ,8 ,2 7 3 ,0 ,1 7 8 ,9 ,7 7 5 ,4 n 2 7 3 1 4 3 2 3 5 5 T T T T T S r r r r r a a n a n a n a n a n m U s s s s s p n a c a c a c a c a c l in i t tio tio tio tio tio g n n n n n S a m p S i z e 7 7 1 0 5 1 0 5 1 0 5 1 0 5 l e F N i n u d m 3 4 5 6 i n b g e r San José State University Payroll Audit Attachment— San José State University’s Response to Draft Audit Report State Controller’s Office Division of Audits Post Office Box 942850 Sacramento, CA 94250 www.sco.ca.gov S21-PAR-0006