Sacramento California State Prison Payroll Process and Transactions

CALIFORNIA STATE PRISON, SACRAMENTO Final Audit Report PAYROLL PROCESS AND TRANSACTIONS October 1, 2019, through September 30, 2022 M ALIA M. C OHEN C S C ALIFORNIA TATE ONTROLLER May 2026 S24-PAR-0002 STATE CONTROLLER’S OFFICE | DIVISION OF AUDITS Post Office Box 942850 | Sacramento, CA 94250 Sacramento Office: 3301 C Street, Suite 700 | Sacramento, CA 95816 | 916-324-8907 Monterey Park Office: 901 Corporate Center Drive, Suite 200 | Monterey Park, CA 91754 | 323-981-6802 www.sco.ca.gov MALIA M. COHEN CALIFORNIA STATE CONTROLLER May 29, 2026 Mr. Jason Schultz, Warden California State Prison, Sacramento 100 Prison Road Represa, CA 95671 Dear Mr. Schultz: The State Controller’s Office audited California State Prison, Sacramento’s payroll process and transactions for the period of October 1, 2019, through September 30, 2022. The audit was conducted pursuant to Government Code sections 12476 and 12410. California State Prison, Sacramento’s management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll- related expenditures. If you have any questions regarding this report, please contact Roochel Espilla, Chief, State Agency Audits Bureau, by telephone at 916-323-5744. Thank you. Sincerely, Original signed by Kimberly A. Tarvin, CPA Chief, Division of Audits MAILING ADDRESS P.O. Box 942850, Sacramento, CA 94250 SACRAMENTO 3301 C Street, Suite 700, Sacramento, CA 95816 | 916.324.8907 LOS ANGELES 901 Corporate Center Drive, Suite 200, Monterey Park, CA 91754 | 323.981.6802 Mr. Jason Schultz May 29, 2026 Page 2 of 2 Copy: Mike Iannone, Associate Warden California State Prison, Sacramento Krisann Charles, Institutional Personnel Officer California State Prison, Sacramento Jeff Macomber, Secretary California Department of Corrections and Rehabilitation Jennifer Barretto, Undersecretary of Administration California Department of Corrections and Rehabilitation Stacy Lopez, Director of Administrative Services California Department of Corrections and Rehabilitation Danyal Noel, Deputy Director of Human Resources California Department of Corrections and Rehabilitation Mai Lee Vang, External Audits Manager California Department of Corrections and Rehabilitation Helen Fairchild, Chief Administrative Services Division California Department of Human Resources Lisa Dean, Acting Chief Personnel and Payroll Services Division State Controller’s Office Veronica Encinas, Bureau Chief Personnel and Payroll Services Division State Controller’s Office Jennifer Burkett, Director California State Payroll System Project State Controller’s Office MAILING ADDRESS P.O. Box 942850, Sacramento, CA 94250 SACRAMENTO 3301 C Street, Suite 700, Sacramento, CA 95816 | 916.324.8907 LOS ANGELES 901 Corporate Center Drive, Suite 200, Monterey Park, CA 91754 | 323.981.6802 Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 CONTENTS SUMMARY 1 BACKGROUND 1 AUDIT AUTHORITY 2 OBJECTIVES, SCOPE, AND METHODOLOGY 2 CONCLUSION 5 FOLLOW-UP ON PRIOR AUDIT FINDINGS 7 VIEWS OF RESPONSIBLE OFFICIALS 7 RESTRICTED USE 8 SCHEDULE—SUMMARY OF AUDIT RESULTS 9 FINDINGS AND RECOMMENDATIONS 12 APPENDIX A—AUDIT SAMPLING METHODOLOGY 35 APPENDIX B—SUMMARY OF PRIOR AUDIT FINDINGS 37 ATTACHMENT—CALIFORNIA STATE PRISON, SACRAMENTO’S RESPONSE TO DRAFT AUDIT REPORT 38 Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 SUMMARY The State Controller’s Office (SCO) audited California State Prison, Sacramento’s (CSP SAC) payroll process and transactions for the period of October 1, 2019, through September 30, 2022. CSP SAC’s management is responsible for maintaining a system of internal control over the payroll process within its organization, and for ensuring compliance with various requirements under state laws and regulations regarding payroll and payroll-related expenditures. Our audit determined that CSP SAC did not: • Maintain adequate and effective internal controls over certain aspects of its payroll process, as described in Findings 1 through 10; • Process payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures in certain instances, as described in Findings 3 through 9; or • Administer salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures, as described in Finding 10. BACKGROUND The SCO maintains the State’s payroll system in accordance with Government Code (GC) section 12470 et seq. The system is decentralized, allowing state agencies and departments to process their own payroll-related transactions. The SCO conducts periodic payroll audits to gain assurance that state agencies and departments maintain adequate internal control over the payroll function, provide proper oversight of their decentralized payroll processing, and comply with various state laws and regulations regarding payroll processing and related transactions. -1- Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 All users of the State’s payroll system must comply with the Decentralized Security Program Manual (DSP Manual), issued by the SCO’s Personnel and Payroll Services Division, in order to access the payroll system. The DSP Manual defines the SCO’s security requirements and describes users’ responsibilities, which include securing, maintaining, and monitoring the confidentiality and integrity of sensitive and confidential data; and protecting data and systems against misuse, abuse, and unauthorized use. AUDIT AUTHORITY We conducted this audit in accordance with GC section 12476, which authorizes the SCO to audit the State’s payroll system, the State Payroll Revolving Fund, and related records of state agencies within the State’s payroll system. In addition, GC section 12410 provides the SCO with general authority to audit the disbursement of state money for correctness, legality, and sufficient provisions of law for payment. OBJECTIVES, SCOPE, AND METHODOLOGY We performed this audit to determine whether CSP SAC: • Maintained adequate and effective internal controls over its payroll process; • Processed payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures; and • Administered salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. -2- Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 The audit covered the period from October 1, 2019, through September 30, 2022. The audit population consisted of payroll transactions totaling $521,456,267, as quantified in the Schedule. In planning and performing our audit of compliance, we considered CSP SAC’s internal control over compliance with collective bargaining agreements and state laws, regulations, policies, and procedures to determine the auditing procedures that were appropriate under the circumstances for the purpose of providing a conclusion on compliance, and to test and report on internal control over compliance. Our consideration of internal control over compliance was for the limited purpose described in the previous paragraph. Our audit was not designed to identify all deficiencies in internal control over compliance that might be material weaknesses or significant deficiencies. As discussed in the Conclusion section, we identified certain deficiencies in internal control over compliance that we consider to be material weaknesses. A deficiency in internal control over compliance exists when the design or operation of a control does not allow management or employees, in the normal course of performing their assigned functions, to prevent, or detect and correct, noncompliance with provisions of laws, regulations, or contracts on a timely basis. Control deficiencies, either individually or in combination with other control deficiencies, may be evaluated as significant deficiencies or material weaknesses. A material weakness in internal control over compliance is a deficiency, or combination of deficiencies, in internal control over compliance, such that there is a reasonable possibility that material noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected on a timely basis. A significant deficiency in internal control over compliance is a deficiency, or a combination of deficiencies, in internal control over compliance with provisions of laws, regulations, or contracts that is less severe than a material weakness, yet important enough to merit attention from those charged with governance. -3- Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 To achieve our audit objectives, we performed the following procedures: • We reviewed state and CSP SAC policies and procedures related to the payroll process to understand CSP SAC’s methodology for processing various payroll and payroll-related transactions. • We interviewed CSP SAC payroll personnel to understand CSP SAC’s methodology for processing various payroll and payroll-related transactions, determine the employees’ level of knowledge and ability relating to payroll transaction processing, and gain an understanding of existing internal control over the payroll process and systems. • We selected transactions recorded in the State’s payroll system using statistical sampling, as outlined in Appendix A; judgmental selection; and targeted selection based on risk factors and other relevant criteria. • We analyzed and tested the selected transactions and reviewed relevant files and records to determine the accuracy of payroll and payroll-related payments; the accuracy of leave transactions; the adequacy and effectiveness of internal control over the payroll process; and compliance with collective bargaining agreements and state laws, regulations, policies, and procedures. • We reviewed salary advances to determine whether CSP SAC administered and recorded them in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. • We assessed the reliability of computer-processed data for payroll and payroll-related transactions by interviewing CSP SAC officials knowledgeable about the data; reviewing existing information about the data and the system that produced it; and tracing data to source documents, based on statistical sampling and judgmental and targeted selection. We determined that the data was sufficiently reliable for the purposes of this report. We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain -4- Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. CONCLUSION Our audit determined that CSP SAC did not maintain adequate and effective internal controls over its payroll process; did not process payroll and payroll-related disbursements and leave balances accurately and in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures; and did not administer salary advances in accordance with collective bargaining agreements and state laws, regulations, policies, and procedures. We found deficiencies in internal control over the payroll process that we consider to be material weaknesses; and instances of noncompliance with the requirements of collective bargaining agreements and state laws, regulations, policies, and procedures. The material weaknesses and instances of noncompliance are as follows: • CSP SAC had inadequate segregation of duties and compensating controls over payroll transactions (see Finding 1). • Fifteen of the 35 (43 percent) employees whose records we examined during the audit had inappropriate keying access to the State’s payroll system (see Finding 2). • CSP SAC overpaid one of the 77 regular pay transactions that we examined by $21. We projected an additional $14,722 in overpayments. In addition, CSP SAC did not consistently maintain timesheets for regular pay. Based on our audit testing, we estimated that 22 percent of the timesheets associated with regular pay during the audit period had not been retained. We identified $138,267 and projected an additional $97,771,455 in unsupported transactions (see Finding 3). -5- Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 • CSP SAC overpaid one of the 77 overtime pay transactions that we examined by $66 and underpaid two (three percent) transactions by a total of $545. We projected an additional $26,836 in overpayments and $220,882 in underpayments. Furthermore, CSP SAC did not consistently maintain timesheets for overtime pay. Based on our audit testing, we estimated that six percent of the timesheets and calculations associated with overtime payments during the audit period had not been retained. We identified $6,509 and projected an additional $2,637,438 in unsupported transactions (see Finding 4). • CSP SAC did not properly reduce employees’ balances in the State’s leave accounting system for 46 of the 62 (74 percent) employees whose separation lump-sum payments we examined. In addition, CSP SAC overpaid 12 (19 percent) employees by a total of $53,171 and underpaid 14 (23 percent) employees by a total of $42,303. Furthermore, CSP SAC did not make separation lump-sum payments to 12 (19 percent) employees in a timely manner (see Finding 5). • CSP SAC had inadequate controls to ensure that it adhered to requirements under collective bargaining agreements and state regulations limiting the accumulation of vacation and annual leave credits. As of September 30, 2022, CSP SAC had 88 employees who accumulated hours that exceeded the limits set by collective bargaining agreements and state regulations. Based on our audit testing, we determined that for 100 percent of these employees, CSP SAC had failed to adhere to the requirements. This noncompliance resulted in liability for excessive vacation and annual leave balances with a value of at least $2,214,834 (see Finding 6). • CSP SAC granted improper holiday credits, with an approximate value of $6,658, to employees in 16 of the 18 (89 percent) transactions that we examined. Although the number of transactions and the dollar amount is small, there could be additional improper credits (see Finding 7). • CSP SAC overpaid one of the 77 holiday pay transactions that we examined by $529 and underpaid one transaction by $1,367. We projected an additional $70,592 in overpayments and $182,310 in underpayments. In addition, CSP SAC did not consistently maintain -6- Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 timesheets for holiday pay. Based on our audit testing, we estimated that four percent of the timesheets associated with holiday payments during the audit period had not been retained. We identified $292 and projected an additional $38,880 in unsupported transactions (see Finding 8). • CSP SAC did not consistently maintain supporting documentation for leave buy-back payments. Based on our audit testing, we estimated that 48 percent of the supporting documentation associated with leave buy-back transactions during the audit period had not been retained. We identified $109,875 and projected an additional $203,311 in unsupported payments (see Finding 9). • CSP SAC had inadequate controls to ensure that salary advances were properly issued and collected in a timely manner, and administered in accordance with requirements. Four salary advances, totaling $11,505, remained outstanding for more than 90 days as of September 30, 2022 (see Finding 10). FOLLOW-UP ON PRIOR AUDIT FINDINGS CSP SAC has satisfactorily resolved the findings noted in our prior review report for the period of July 1, 2010, through June 30, 2013, issued on August 20, 2014, with the exception of Findings 7 and 9 of this audit report. The implementation status of corrective actions is described in Appendix B. VIEWS OF RESPONSIBLE OFFICIALS We issued a draft audit report on October 24, 2025. CSP SAC’s representative responded by letter dated November 3, 2025, acknowledging the audit results. CSP SAC also provided additional information regarding excess vacation and annual leave balances, as described in Finding 6. Our comment on CSP SAC’s response to Finding 6 is included in the Findings and -7- Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 Recommendations section. This final audit report includes CSP SAC’s response as an attachment. RESTRICTED USE This audit report is solely for the information and use of CSP SAC, the California Department of Corrections and Rehabilitation, and the SCO; it is not intended to be, and should not be, used by anyone other than these specified parties. This restriction is not intended to limit distribution of this audit report, which is a matter of public record and is available on the SCO website at www.sco.ca.gov. Original signed by Kimberly A. Tarvin, CPA Chief, Division of Audits May 29, 2026 -8- Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 SCHEDULE—SUMMARY OF AUDIT RESULTS October 1, 2019, through September 30, 2022 Legend for Column 2, Method of Selection: FE = 100 percent examined; J = Judgmental; S = Statistical; T = Targeted. Legend for Column 6, Selection Unit: EM = Employee; TR = Transaction. Net Total Dollar Amount of Projected Net Total Improper Dollar Costs and Dollar Amount of Identified and Audit Number of Dollar Number of Amount of Identified Projected Area Method of Units of Amount of Selections Selection Selections Improper Unsupported Tested Selection Population Population Examined Unit Examined Costs Costs Reference Segregation of duties Finding 1 Intentionally left blank Intentionally left blank Intentionally left blank Intentionally left blank Intentionally left blank Intentionally left blank Intentionally left blank Intentionally left blank System access FE 35 35 EM Finding 2 Intentionally left blank Intentionally left blank Intentionally left blank Intentionally left blank Regular pay S 55,933 $408,245,482 77 TR $576,518 $21 $97,924,444 Finding 3 Overtime pay S 33,670 86,875,277 77 TR 213,878 -479 2,449,901 Finding 4 -9- Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 Net Total Dollar Amount of Projected Net Total Improper Dollar Costs and Dollar Amount of Identified and Audit Number of Dollar Number of Amount of Identified Projected Area Method of Units of Amount of Selections Selection Selections Improper Unsupported Tested Selection Population Population Examined Unit Examined Costs Costs Reference Separation lump-sum pay J 407 10,603,464 62 EM 7,021,895 100,439 0 Finding 5 Excess vacation and annual leave J 160 4,335,588 88 EM 2,214,834 2,214,834 0 Finding 6 Holiday credit T 11,323 4,255,126 18 TR 17,242 6,658 0 Finding 7 Holiday pay S 9,042 3,705,117 77 TR 27,573 -838 -72,546 Finding 8 Leave buy-back S 171 631,783 63 TR 221,649 0 313,186 Finding 9 Uniform allowance S 3,020 2,627,957 77 TR 69,296 0 0 Intentionally left blank Institutional Worker Supervision Pay J 226 68,486 2 TR 650 0 0 Intentionally left blank Out-of-class pay J 13 3,507 6 TR 1,574 0 0 Intentionally left blank -10- Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 Net Total Dollar Amount of Projected Net Total Improper Dollar Costs and Dollar Amount of Identified and Audit Number of Dollar Number of Amount of Identified Projected Area Method of Units of Amount of Selections Selection Selections Improper Unsupported Tested Selection Population Population Examined Unit Examined Costs Costs Reference Premium pay J 117 15,000 2 TR 250 0 0 Intentionally left blank Salary advance J 17 89,480 4 TR 11,784 11,505 0 Finding 10 Total $521,456,267 $10,377,143 $2,332,140 $100,614,985 Intentionally left blank Intentionally left blank Intentionally left blank Intentionally left blank Intentionally left blank -11- Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 FINDINGS AND RECOMMENDATIONS Finding 1—Inadequate Segregation of Duties and Compensating Controls Over Payroll Transactions CSP SAC lacked adequate segregation of duties within its payroll transactions unit to ensure that only valid and authorized payroll transactions were processed. CSP SAC also failed to implement other controls to compensate for this risk. Our audit found that CSP SAC payroll transactions unit staff performed conflicting duties. Staff members performed multiple steps in processing payroll transactions, including entering data into the State’s payroll system; auditing employee timesheets; reconciling payroll, including reconciling system output to source documentation; reporting payroll exceptions; and processing adjustments. For example, staff members keyed in regular and overtime pay, and reconciled the master payroll, overtime, and other supplemental warrants. CSP SAC failed to demonstrate that it implemented compensating controls to mitigate the risks associated with such a deficiency. We found no indication that these functions were subjected to periodic supervisory review. The lack of adequate segregation of duties and compensating controls has a pervasive effect on the CSP SAC payroll process, and impairs the effectiveness of other controls by rendering their design ineffective or by keeping them from operating effectively. These control deficiencies, in combination with other deficiencies discussed in Findings 2 through 10, represent a material weakness in internal control over the payroll process such that there is a reasonable possibility that material noncompliance with provisions of laws, regulations, or contracts will not be prevented, or detected and corrected, on a timely basis. -12- Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 Internal control best practices require that the following functional duties be performed by different work units, or at minimum, by different employees within the same unit: • Recording transactions – This duty refers to the record-keeping function, which is accomplished by entering data into a computer system. • Authorization to execute – This duty belongs to individuals with authority and responsibility to initiate and execute transactions. • Periodic review and reconciliation of actual payments to recorded amounts – This duty refers to making comparisons of information at regular intervals and taking action to resolve differences. Criteria GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including proper segregation of duties and an effective system of internal review. Adequate segregation of duties reduces the likelihood that fraud or error will remain undetected by providing for separate processing by different individuals at various stages of a transaction and for independent reviews of the work performed. Recommendation We recommend that CSP SAC: • Separate conflicting payroll functional duties to the greatest extent possible. Adequate segregation of duties will provide a stronger system of internal control whereby the functions of each employee are subject to the review of another. If it is not possible to segregate payroll functions fully and appropriately, CSP SAC should implement compensating controls. For example, if the payroll transactions unit staff member responsible for recordkeeping also performs a reconciliation process, then the supervisor should perform and document a detailed review of the reconciliation to provide additional control over the assignment of conflicting functions. Compensating controls may -13- Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 also include dual authorization requirements and documented reviews of payroll system input and output; and • Develop formal procedures for performing and documenting compensating controls. Finding 2—Inappropriate Keying Access to the State’s Payroll System CSP SAC lacked adequate controls to ensure that only appropriate staff members had keying access to the State’s payroll system. CSP SAC inappropriately allowed 15 employees keying access to the State’s payroll system. If not mitigated, this control deficiency leaves payroll data at risk of misuse, abuse, and unauthorized use. We examined the records of 35 CSP SAC employees who had keying access to the State’s payroll system at various times during the audit period. Of the 35 employees, 15 had inappropriate keying access to the State’s payroll system. Specifically, CSP SAC did not immediately remove or modify keying access for the employees after the employees’ separation from state service, transfer to another agency, or change in classification. For example, a Senior Personnel Analyst left CSP SAC on December 31, 2021. CSP SAC did not request to remove the employee’s access until July 8, 2022, a total of 189 days later. CSP SAC lacked periodic review of keying access granted to employees to ensure compliance with the DSP Manual. Criteria The December 2015 DSP Manual (“Access Requirements,” page 13) states, in part: The [State’s payroll system] contains sensitive and confidential information. Access is restricted to persons with an authorized, legal, and legitimate business requirement to complete their duties. . . . -14- Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 If the employee’s duties change, such that the need for access no longer exists, the access privilege MUST be removed or deleted immediately by a request submitted by the department/campus. The June 2020 DSP Manual (“Access Requirements,” pages 6–7) states, in part: The [State’s payroll system] contains sensitive and confidential information. Access is restricted to persons with an authorized, legal, and legitimate business requirement to complete their regular daily duties. . . . If the employee’s duties change, such that the need for access no longer exists, the access privilege MUST be removed or deleted immediately via a request submitted by the department/campus. The October 2020 DSP Manual (“Access Requirements,” pages 5–6) states, in part: The [State’s payroll system] contains sensitive and confidential information. Access is restricted to persons with an authorized, legal, and legitimate business requirement to complete their regular daily duties. . . . If the employee’s duties change, such that the need for access no longer exists, the access privilege MUST be removed or deleted immediately via a request submitted by the department/campus Security Monitor/Assistant Security Monitor. . . . The August 2022 DSP Manual (“Access Requirements,” pages 5–6) states, in part: The [State’s payroll system] contains sensitive and confidential information. Access is restricted to persons with an authorized, legal, and legitimate business requirement to complete their regular daily duties. . . . If the employee’s duties change, such that the need for access no longer exists, the access privilege MUST be removed or deleted immediately via a request submitted by the department/campus Security Monitor/Assistant Security Monitor. -15- Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 The December 2015 DSP Manual (“Revocation and Deletion of User IDs,” page 17) states, in part: To prevent unauthorized use by a transferred, terminated or resigned employee’s user ID, the Security Monitor must IMMEDIATELY submit all pages of the PSD125A [Security Authorization Form] to delete the user’s system access. Using an old user ID increases the chances of a security breach, which is a serious security violation. Sharing a user ID is strictly prohibited and a serious violation. . . . The June 2020 DSP Manual (“Revocation and Deletion of User IDs,” page 10) states, in part: To prevent unauthorized use by a transferred, terminated or resigned employee's User ID, the Security Monitor must IMMEDIATELY submit all pages of the PSD125A [Security Authorization Form] signed by both Security Monitor and Authorizing Manager to delete the user’s system access. Using an old User ID increases the risk of a security breach, which is a serious security violation. Sharing a User ID is strictly prohibited. . . . The October 2020 DSP Manual (“Revocation and Deletion of User IDs,” page 7) states, in part: To prevent unauthorized use by a transferred, terminated or resigned employee's User ID, the Security Monitor must IMMEDIATELY contact [the Decentralized Security Administrator] by email. The Security Monitor/Assistant Security Monitor must submit all pages of the PSD125A [Security Authorization Form] signed by both Security Monitor[/] Assistant Security Monitor and Authorizing Official/Assistant Authorizing Official to delete the user’s system access. Using an old User ID increases the risk of a security breach, which is a serious security violation. Sharing a User ID is strictly prohibited. . . . The August 2022 DSP Manual (“Revocation and Deletion of User IDs,” page 8) states, in part: To prevent unauthorized use by a transferred, terminated or resigned employee's User ID, the Security Monitor must IMMEDIATELY contact [the Decentralized Security Administrator] by email. The Security Monitor/Assistant Security Monitor must electronically submit all pages of the PSD125A [Security Authorization Form] signed by -16- Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 both Security Monitor[/]Assistant Security Monitor and Authorizing Official/Assistant Authorizing Official to delete the user’s system access. Using an old User ID increases the risk of a security breach, which is a serious security violation. Sharing a User ID is strictly prohibited. . . . Recommendation We recommend that CSP SAC: • Update keying access to the State’s payroll system immediately after employees leave CSP SAC, transfer to another unit, or change classifications; and • Periodically review access to the system to verify that access complies with the DSP Manual. Finding 3—Improper and Unsupported Regular Pay Transactions CSP SAC lacked adequate segregation of duties and compensating controls within its payroll transactions unit, as noted in Finding 1. It also lacked adequate supervisory review to ensure accurate processing of regular pay, and adequate controls to ensure that supporting documentation was maintained for regular pay. Payroll records show that CSP SAC processed 55,933 regular pay transactions, totaling $408,245,482, during the audit period. We randomly selected a statistical sample (as described in Appendix A) of 77 transactions, totaling $576,518. Based on our examination of these transactions, we found the following errors: • CSP SAC overpaid one transaction by $21 because an incorrect salary rate was used to calculate the payment. We projected the additional overpayments to be $14,722. • CSP SAC lacked timesheets associated with 17 (22 percent) transactions with a total value of $138,267. Without the required documentation, we could not determine the validity, accuracy, and propriety of the payments made to the employees; or the completeness and -17- Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 accuracy of the leave accounting records. We projected the additional unsupported payments to be $97,771,455. If not mitigated, these control deficiencies leave CSP SAC at risk of making additional improper payments for regular pay. Statistical Sampling Results The identified improper and unsupported payments have a total of $138,288. We used a statistical sampling method to select the regular pay transactions that we examined. We projected an additional $14,722 in overpayments and an additional $97,771,455 in unsupported payments. The projected improper and unsupported payments have a total of $97,786,177. Therefore, the identified and projected improper and unsupported payments totaled $97,924,465, consisting of $14,743 in overpayments and $97,909,722 in unsupported payments. The following table summarizes the results of our statistical sampling (amounts are rounded to the nearest dollar): Calculation of Projected Errors Amount Identified improper and unsupported payments $138,288 Divide by: Sample 576,518 Error rate for projection (differences due to rounding) 23.99% Population that was statistically sampled 408,245,482 Multiply by: Error rate for projection 23.99% Identified and projected improper and unsupported payments (differences due to rounding) 97,924,465 Less: Identified improper and unsupported payments 138,288 Projected improper and unsupported payments $97,786,177 Criteria GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. -18- Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 Collective bargaining agreements between the State and various bargaining units, and state laws and policies, contain specific clauses regarding regular pay. CSP SAC’s General Retention Schedule for Payroll/Personnel Records specifies a four-year retention period for timesheets. Recommendation We recommend that CSP SAC: • Conduct a review of regular pay transactions during the past three years to ensure that the payments complied with collective bargaining agreements and state laws and policies; • Recover any overpayments made to employees through an agreed-upon collection method in accordance with GC section 19838 and State Administrative Manual (SAM) sections 8291, 8291.1, and 8293; and • Maintain supporting documentation for regular pay pursuant to its retention policies. Finding 4—Improper and Unsupported Overtime Payments CSP SAC lacked adequate segregation of duties and compensating controls within its payroll transactions unit, as noted in Finding 1. It also lacked adequate supervisory review to ensure accurate processing of overtime pay, and adequate controls to ensure that timesheets were maintained to support overtime payments. Payroll records show that CSP SAC processed 33,670 overtime pay transactions, totaling $86,875,277, during the audit period. We randomly selected a statistical sample (as described in Appendix A) of 77 transactions, totaling $213,878. Based on our examination of these selected transactions, we found the following errors: • CSP SAC overpaid one transaction by $66 and underpaid two (three percent) transactions by a total of $545 because payroll transactions unit staff members miscalculated overtime -19- Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 hours worked and incorrectly entered the overtime hours worked into the payroll system. We projected the additional overpayments to be $26,836 and underpayments to be $220,882. • CSP SAC lacked timesheets and calculations associated with five (six percent) transactions with a value of $6,509. Without the required documentation, we could not determine the validity, accuracy, and propriety of the payments made to the employees; or the completeness and accuracy of the leave accounting records. We projected the additional unsupported payments to be $2,637,438. If not mitigated, these control deficiencies leave CSP SAC at risk of making additional improper overtime payments. Statistical Sampling Results The identified improper and unsupported payments have a net total of $6,030. We used a statistical sampling method to select the overtime pay transactions that we examined. We projected an additional $26,836 in overpayments and $220,882 in underpayments; we also projected an additional $2,637,438 in unsupported payments. The projected improper and unsupported payments have a net total of $2,443,392. Therefore, the identified and projected improper and unsupported payments totaled a net of $2,449,422, consisting of $26,902 in overpayments, $221,427 in underpayments, and $2,643,947 in unsupported payments. The following table summarizes the results of our statistical sampling (amounts are rounded to the nearest dollar): Calculation of Projected Errors Amount Identified improper and unsupported payments, net $6,030 Divide by: Sample 213,878 Error rate for projection (differences due to rounding) 2.82% Population that was statistically sampled 86,875,277 Multiply by: Error rate for projection 2.82% -20- Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 Calculation of Projected Errors Amount Identified and projected improper and unsupported payments, net (differences due to rounding) 2,449,422 Less: Identified improper and unsupported payments, net 6,030 Projected improper and unsupported payments, net $2,443,392 Criteria GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Collective bargaining agreements between the State and various bargaining units, and state laws and policies, contain specific clauses regarding overtime pay. CSP SAC’s General Retention Schedule for Payroll/Personnel Records specifies a four-year retention period for timesheets and calculations. Recommendation We recommend that CSP SAC: • Conduct a review of overtime payments made during the past three years to ensure that the payments complied with collective bargaining agreements and state laws and policies; • Recover any overpayments made to employees through an agreed-upon collection method in accordance with GC section 19838 and SAM sections 8291, 8291.1, and 8293; and • Properly compensate those employees who were underpaid. We further recommend that, to prevent improper payments for overtime pay from recurring, CSP SAC: • Establish adequate internal controls to ensure that payments are accurate and comply with collective bargaining agreements and state laws and policies; -21- Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 • Provide adequate oversight to ensure that payroll transactions unit staff members process only valid and authorized payments that comply with collective bargaining agreements and state laws and policies; and • Maintain supporting documentation for payments pursuant to its retention policies. Finding 5—Inaccurate Leave Accounting; Improper and Late Separation Lump-sum Payments CSP SAC lacked adequate segregation of duties and compensating controls within its payroll transactions unit, as noted in Finding 1. It also lacked adequate controls to ensure that paid credits were properly reduced in the State’s leave accounting system; and adequate supervisory review to ensure accurate and timely processing of separation lump-sum pay. Payroll records show that CSP SAC processed separation lump-sum payments, totaling $10,603,464, for 407 employees during the audit period. We judgmentally selected a sample of 62 employees who received the highest separation lump-sum payments, totaling $7,021,895. Based on our examination of the records of these employees, we found the following errors: • CSP SAC did not appropriately reduce employees’ balances in the State’s leave accounting system for 46 (74 percent) employees to reflect the number of leave credits— with a value of $89,571—that had been paid. Unreduced leave balances pose a risk to the State because they overstate the State’s liabilities for leave balances and allow the possibility of improper and duplicative payments for leave credits. • CSP SAC overpaid 12 (19 percent) employees by a total of $53,171 and underpaid 14 (23 percent) employees by a total of $42,303 because payroll transactions unit staff members miscalculated leave credits paid. • CSP SAC did not make separation lump-sum payments to 12 (19 percent) employees in a timely manner. -22- Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 If not mitigated, these control deficiencies leave CSP SAC at risk of making additional improper and late separation lump-sum payments, noncompliance with agreements and laws, and liability for late payments. Criteria GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. GC section 19839 allows lump-sum payment for accrued eligible leave credits when an employee separates from state employment. Collective bargaining agreements between the State and various bargaining units include similar provisions regarding separation lump-sum pay. Collective bargaining agreements and state laws summarized in section 1703 of the California Department of Human Resources’ (CalHR) Human Resources Manual establish separation lump-sum pay requirements. Recommendation We recommend that CSP SAC: • Conduct a review of separation lump-sum payments made during the past three years to ensure that the payments were accurate and in compliance with collective bargaining agreements and state law; • Recover overpayments made to separated employees in accordance with GC section 19838 and SAM sections 8291, 8291.1, and 8293; and • Properly compensate those employees who were underpaid. We further recommend that, to prevent inaccurate and untimely processing of separation lump- sum payments from recurring, CSP SAC establish adequate controls to ensure that: • Employee leave balances are reduced in a timely manner after payments are made; -23- Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 • Payments are calculated accurately; and • Payments are made in a timely manner. Finding 6—Excess Vacation and Annual Leave Balances CSP SAC’s leave accounting records show 1,388 employees with unused vacation or annual leave credits at September 30, 2022. Of those employees, 160 exceeded the limits set by collective bargaining agreements and state regulations. The employees accumulated 81,374 hours of excess vacation and annual leave, with a value of at least $4,335,588 as of September 30, 2022. This estimated liability does not adjust for salary rate increases and additional leave credits. Most state employees receive pay rate increases every year pursuant to state laws and/or collective bargaining agreements until they reach the top of their pay scale, or promote into a higher-paying position. In addition, when an employee’s accumulated leave balances upon separation are calculated for lump-sum pay, the employee is credited with additional leave credits equal to the amount that the employee would have earned had the employee taken time off and not separated from state service. Accordingly, we expect that the amount needed to pay for this liability will be higher. Collective bargaining agreements and state regulations limit the amount of vacation and annual leave that state employees may accumulate. The limit on leave balances helps state agencies to manage leave balances and control the State’s liability for accrued leave credits. State agencies may allow employees to carry a higher leave balance only under limited circumstances. For example, an employee may not be able to reduce accrued vacation or annual leave hours below the limit due to business needs. When an employee’s leave accumulation exceeds or is projected to exceed the limit, state agencies should work with the employee to develop a written plan to reduce leave balances below the applicable limit. On October 20, 2020, CalHR directed departments to immediately suspend policies that require leave balances to be reduced below the limit, and that require employees to implement -24- Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 leave-reduction plans. This suspension was in effect until the 2020 Personal Leave Program ended on June 30, 2021. Of the 160 employees with excess vacation or annual leave, we judgmentally selected 88 employees who accumulated 39,469 hours of excess vacation and annual leave balances, with a value of at least $2,214,834 as of September 30, 2022. We examined the records of these selected employees to determine whether CSP SAC complied with collective bargaining agreements and state regulations. Of the 88 employees whose records we examined, none complied with collective bargaining agreements and state regulations for the following reasons: • CSP SAC had no plans in place during the audit period for the employees to reduce leave balances below the limit. • CSP SAC could not demonstrate that, if the employees were unable to reduce their vacation and leave balances, it had allowed the employees to maintain excess balances because of the extenuating circumstances specified in the agreements and regulations. If CSP SAC does not take action to reduce the excessive leave balances, the liability for accrued vacation and annual leave will likely increase because most employees will receive salary increases or use other non-compensable leave credits instead of vacation or annual leave, thus increasing their vacation or annual leave balances. The state agency responsible for paying these leave balances may face a cash flow problem if a significant number of employees with excessive vacation or annual leave balances separate from state service. Normally, state agencies are not budgeted to make these separation lump- sum payments. However, the State’s current practice dictates that the state agency that last employed an employee pays for that employee’s separation lump-sum payment, regardless of where the employee accrued the leave balance. -25- Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 Criteria Collective bargaining agreements between the State and various bargaining units and state regulations limit the amount of vacation and annual leave that most state employees may accumulate to no more than 80 days (640 hours). Current collective bargaining agreements between the State and Bargaining Units 1, 3, 4, 15, 17, 19, and 20 temporarily increased the limit by 120 hours. Recommendation We recommend that CSP SAC: • Implement controls, including existing policies and procedures, to ensure that its employees’ vacation and annual leave balances are maintained within levels allowed by collective bargaining agreements and state regulations; • Conduct ongoing monitoring of controls to ensure that they are implemented and operating effectively; and • Participate in leave buy-back programs if the State offers such programs and funds are available. CSP SAC’s Response CSP SAC implemented the leave reduction plan requirements effective July 2019 to comply with the applicable leave reduction effort policies. The requirements state that employees with leave balances over the cap must have leave reduction plans that are approved by their respective supervisors. On June 4, 2019, the “Leave Reduction Plan Requirements - Action Due by July 5, 2019” memorandum was distributed to all staff from the CDCR [California Department of Corrections and Rehabilitation] HR [Human Resources] Mailbox, which requires the completion and documentation of leave reduction plans for all employees in excess of or approaching leave credit balance limitations. However, effective October 26, 2020, the California Department of Human -26- Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 Resources (CalHR) suspended leave reduction plan requirements for the duration of the 2020 Personal Leave Program (PLP) until July 1, 2022, or until PLP 2020 ended. The PLP 2020 ended June 30, 2021, for all employees. This resulted in leave balances continuing to rise. Although the leave reduction plan requirements were suspended, when operationally feasible and when the budget permits, managers and supervisors were encouraged to work with employees to reduce leave balances, utilizing PLP and vacation/annual leave for scheduled time off. CSP SAC has resumed Annual Leave Reduction Plans starting in April 2024, as detailed in the “Leave Reduction Plan Notification for 2024” memorandum that was distributed to all staff from the CDCR HR Mailbox on April 10, 2024. SCO Comment Our finding and recommendation remain unchanged. We appreciate the additional clarification and willingness of CSP SAC to implement corrective actions to improve its internal controls over excessive leave balances. However, as stated in this report, CSP SAC had no plans in place during the audit period for the 88 employees who accumulated excess vacation and annual leave balances. Finding 7—Improper Holiday Credit Transactions (Repeat Finding) CSP SAC lacked adequate segregation of duties and compensating controls within its payroll transactions unit, as noted in Finding 1. It also lacked adequate supervisory review to ensure accurate processing of holiday credit transactions. Leave accounting records show that CSP SAC processed 11,323 accrual transactions of holiday credit with an estimated value of $4,255,126. We examined 18 of these transactions, with an estimated value of $17,242, because they involved unusual credits. Our examination found that 16 transactions involved improper credits, with an estimated value of $6,658, because payroll transactions unit staff members granted holiday credits to employees during -27- Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 months with no holidays or holiday credits that exceeded the limit set by the collective bargaining agreements. As we tested only a targeted selection, there could be additional improper credits. If not mitigated, this control deficiency leaves CSP SAC at risk of granting additional improper holiday credits. Criteria GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. GC section 19853 specifies the compensation that an eligible employee is entitled to receive when required to work on a qualifying holiday. Collective bargaining agreements between the State and various bargaining units include similar provisions regarding holiday credit for represented employees. Recommendation We recommend that CSP SAC: • Conduct a review of holiday credits granted during the past three years to ensure that credits complied with collective bargaining agreements and state law; • Correct any improper holiday credits in the State’s leave accounting system; and • Establish adequate controls to ensure that holiday credits granted are valid, and comply with collective bargaining agreements and state laws. Finding 8—Improper and Unsupported Holiday Pay Transactions CSP SAC lacked adequate segregation of duties and compensating controls within its payroll transactions unit, as noted in Finding 1. It also lacked adequate supervisory review to ensure -28- Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 accurate processing of holiday pay, and adequate controls to ensure that documentation was maintained to support holiday pay. Payroll records show that CSP SAC processed 9,042 holiday pay transactions, totaling $3,705,117, during the audit period. We randomly selected a statistical sample (as described in Appendix A) of 77 transactions, totaling $27,573. Based on our examination of these transactions, we found the following errors: • CSP SAC overpaid one transaction by $529 and underpaid one transaction by $1,367 because payroll transactions unit staff members miscalculated the payments. We projected the additional overpayments to be $70,592 and underpayments to be $182,310. • CSP SAC lacked timesheets associated with three (four percent) transactions with a value of $292. Without the required documentation, we could not determine the validity, accuracy, and propriety of the payments made to the employees; or the completeness and accuracy of the leave accounting records. We projected the additional unsupported payments to be $38,880. If not mitigated, these control deficiencies leave CSP SAC at risk of making additional improper holiday payments. Statistical Sampling Results The identified improper and unsupported payments have a net total of $546. We used a statistical sampling method to select the holiday pay transactions that we examined. We projected an additional $70,592 in overpayments and $182,310 in underpayments; we also projected an additional $38,880 in unsupported payments. The projected improper and unsupported payments have a net total of $72,838. Therefore, the identified and projected improper and unsupported payments totaled a net of $73,384, consisting of $71,121 in overpayments, $183,677 in underpayments, and $39,172 in unsupported payments. -29- Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 The following table summarizes the results of our statistical sampling (amounts are rounded to the nearest dollar): Calculation of Projected Errors Amount Identified improper and unsupported payments, net -$546 Divide by: Sample 27,573 Error rate for projection (differences due to rounding) -1.98% Population that was statistically sampled 3,705,117 Multiply by: Error rate for projection -1.98% Identified and projected improper and unsupported payments, net (differences due to rounding) -73,384 Less: Identified improper and unsupported payments, net -546 Projected improper and unsupported payments, net -$72,838 Criteria GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including an effective system of internal review. GC section 19853 specifies the compensation that eligible employees are entitled to receive when required to work on a qualifying holiday. Collective bargaining agreements between the State and various bargaining units include similar provisions regarding holiday pay for represented employees. CSP SAC’s General Retention Schedule for Payroll/Personnel Records specifies a four-year retention period for timesheets. Recommendation We recommend that CSP SAC: • Conduct a review of holiday pay transactions made during the past three years to ensure that the payments were accurate and in compliance with collective bargaining agreements and state law; -30- Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 • Recover overpayments made to employees in accordance with GC section 19838 and SAM sections 8291, 8291.1, and 8293; and • Properly compensate those employees who were underpaid. We further recommend that, to prevent inaccurate processing of holiday pay from recurring, CSP SAC: • Establish adequate controls to ensure that holiday pay transactions are calculated accurately; and • Maintain supporting documentation for holiday pay transactions pursuant to its retention policies. Finding 9— Unsupported Leave Buy-back Payments (Repeat Finding) CSP SAC lacked adequate segregation of duties and compensating controls within its payroll transactions unit, as noted in Finding 1. It also lacked adequate controls to ensure that documentation was maintained to support leave buy-back payments. A leave-buy back occurs when an employee receives payment at the regular salary rate in exchange for accrued vacation, annual leave, personal leave, personal holiday, and/or holiday credits. CalHR authorized leave buy-backs for excluded employees in fiscal year 2020-21 and fiscal year 2021-22. It also provided the State’s policies and procedures regarding cash-out of vacation and annual leave. Payroll records show that CSP SAC processed 171 leave buy-back transactions, totaling $631,783, during the audit period. We randomly selected a statistical sample (as described in Appendix A) of 63 transactions, totaling $221,649. Based on our examination of these transactions, we found that CSP SAC lacked supporting documentation (leave buy-back forms and calculations) associated with 30 (48 percent) of the transactions totaling $109,875. Without the required documentation, we could not determine the validity, accuracy, and -31- Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 propriety of the payments made to the employees or the completeness and accuracy of the leave accounting records. We projected the additional unsupported payments to be $203,311. If not mitigated, these control deficiencies leave CSP SAC at risk of making improper leave buy-back payments. Statistical Sampling Results The identified unsupported payments have a total of $109,875. We used a statistical sampling method to select the leave buy-back transactions that we examined. We projected an additional $203,311 in unsupported payments. Therefore, the identified and projected unsupported payments totaled $313,186. The following table summarizes the results of our statistical sampling (amounts are rounded to the nearest dollar): Calculation of Projected Errors Amount Identified unsupported payments $109,875 Divide by: Sample 221,649 Error rate for projection (differences due to rounding) 49.57% Population that was statistically sampled 631,783 Multiply by: Error rate for projection 49.57% Identified and projected unsupported payments (differences due to rounding) 313,186 Less: Identified unsupported payments 109,875 Projected unsupported payments $203,311 Criteria GC sections 13400 through 13407 require state agencies to establish and maintain internal controls, including a system of policies and procedures adequate to ensure compliance with applicable laws and other requirements, and an effective system of internal review. Title 2, California Code of Regulations, section 599.744 provides that CalHR may also authorize a leave buy-back program for employees excluded from collective bargaining. -32- Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 Collective bargaining agreements between the State and various bargaining units allow for the annual cash-out of a certain number of hours of accumulated vacation and annual leave if funds are available. CSP SAC’s General Retention Schedule for Payroll/Personnel Records specifies a four-year retention period for leave buy-back supporting documentation. Recommendation We recommend that CSP SAC maintain supporting documentation for leave buy-back payments, pursuant to its retention policies. Finding 10—Failure to Collect Outstanding Salary Advances CSP SAC lacked adequate segregation of duties and compensating controls within its payroll transactions unit, as noted in Finding 1. It also lacked adequate controls over salary advances to ensure that advances were collected in a timely manner in accordance with state law and policies. Four salary advances, totaling $11,505, remained outstanding for more than 90 days as of September 30, 2022. At September 30, 2022, CSP SAC’s accounting records show 17 outstanding salary advances, totaling $89,480. We judgmentally selected and examined four salary advances, totaling $11,784, that were the oldest outstanding balances. Of these balances, $11,505 had been outstanding for more than 90 days. The four salary advances had been outstanding for an average of 553 days, and the oldest unrecovered salary advance was outstanding for over three years. We noted that CSP SAC had not initiated timely collection efforts for any of the salary advances that we examined. Salary advances are more difficult to collect after the employee leaves state service, and they may become uncollectable if not collected within three years. If not mitigated, these control deficiencies leave CSP SAC at risk of failing to collect further salary advances. -33- Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 Criteria GC section 19838 and SAM sections 8291, 8291.1, 8293, and 8293.2 describe the State’s collection policies and procedures, which require the collection of salary advances in a timely manner and the maintenance of proper records of collection efforts. Specifically, GC section 19383(d) and SAM section 8293.2 require that actions to recover overpayments begin within three years of the date of overpayment. Recommendation We recommend that CSP SAC ensure that it collects salary advances in a timely manner, pursuant to GC section 19838 and SAM sections 8291, 8291.1, 8293, and 8293.2. -34- Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 APPENDIX A—AUDIT SAMPLING METHODOLOGY This Appendix outlines our audit sampling application for all audit areas where statistical sampling was used. We used attributes sampling for tests of compliance. We chose this sample design because: • It follows the American Institute of Certified Public Accountants (AICPA) guidelines; • It allowed us to achieve our objectives for tests of compliance in an efficient and effective manner; • Audit areas included high and low volumes of transactions; • We planned to project the results to the intended population; and • We had the collective knowledge and skills to plan and perform the sampling plan and design. We conducted compliance testing on samples chosen by computer-generated simple random selection. For populations of fewer than 250 items, we determined the sample size using a calculator with a hypergeometric distribution. For populations of 250 items or more, we determined the sample size using a calculator with a binomial distribution. As stated in Technical Notes on the AICPA Audit Guide: Audit Sampling (March 1, 2012), page 5, although the hypergeometric distribution is the correct distribution to use for attributes sample sizes, the distribution becomes unwieldy for large populations unless suitable software is available. Therefore, more convenient approximations are frequently used instead. The confidence level was 90.00 percent; the tolerable error rate was 5.00 percent; and the expected number of errors was 1.0 for regular pay, overtime pay, holiday pay, and uniform allowance, and 2.0 for leave buy-back. Pursuant to the AICPA’s Audit Guide: Audit Sampling (December 1, 2019 edition), pages 131–132, the expected number of errors planned for in the sample is derived by multiplying the expected error rate by the sample size. The -35- Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 expected error rate for regular pay, overtime pay, holiday pay, and uniform allowance was 1.25 percent and the expected error rate for leave buy-back was 1.00 percent. The expected number of errors in the sampling tables on pages 135–136 of Audit Guide: Audit Sampling is rounded upward, e.g., 0.2 errors become 1.0 error. Results were projected to the intended (total) population. The following table summarizes the population details and sample sizes for all audit areas where statistical sampling was used: Audit Population Population Sampling Sample Area (Unit) (Dollar) Unit Size Reference Regular pay 55,933 $408,245,482 Transaction 77 Finding 3 Overtime pay 33,670 86,875,277 Transaction 77 Finding 4 Holiday pay 9,042 3,705,117 Transaction 77 Finding 8 Leave buy-back 171 631,783 Transaction 63 Finding 9 Uniform allowance 3,020 2,627,957 Transaction 77 Intentionally left blank -36- Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 APPENDIX B—SUMMARY OF PRIOR AUDIT FINDINGS The following table shows the implementation status of California State Prison, Sacramento’s corrective actions related to the findings contained in our review report dated August 20, 2014. Prior Review Finding Status Finding 1— Not fully implemented; The Prison Agencies (California State Prison – Sacramento and see current Finding 9 California Correctional Health Care Services at California State Prison – Sacramento) inappropriately bought back leave credits Finding 2— Implemented The Prison Agencies made improper payments for institutional worker supervision pay Finding 3— Implemented The Prison Agencies lacked proper documentation for 77 percent of employees who received out-of-class compensation; overpaid employees for out-of-class assignments Finding 4— Implemented California State Prison – Sacramento overpaid employees for uniform allowance Finding 5— Implemented The Prison Agencies made payments for premium pay to employees who lacked proper documentation or were not eligible to receive the pay. Finding 6— Not implemented; see The Prison Agencies erroneously overstated employee holiday current Finding 7 credit balances -37- Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 ATTACHMENT—CALIFORNIA STATE PRISON, SACRAMENTO’S RESPONSE TO DRAFT AUDIT REPORT -38- Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 -39- Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 -40- Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 -41- Office of the State Controller | California State Prison, Sacramento Payroll Process and Transactions Final Audit Report May 2026 End of report -42-