CALIFORNIA MEN’S COLONY · 2020-07-17 · California Men’s Colony Payroll Process Review-3- Review Authority Authority for this review is provided by California Government Code

CALIFORNIA MEN’S COLONY

Review Report

PAYROLL PROCESS REVIEW

July 1, 2012, through May 31, 2015

BETTY T. YEE California State Controller

August 2017

BETTY T. YEE

California State Controller

August 25, 2017

Josie Gastelo, Warden

California Men’s Colony

P.O. Box 8101

San Luis Obispo, CA 93409-8101

Dear Ms. Gastelo:

The State Controller’s Office reviewed the California Men’s Colony (CMC) payroll process for

the period of July 1, 2012, through May 31, 2015. CMC management is responsible for

maintaining a system of internal control over the payroll process within its organization, and for

ensuring compliance with various requirements under state laws and regulations regarding

payroll and payroll-related expenditures.

Our limited review identified material weakness in internal control over the CMC payroll

process that leaves CMC at risk of additional improper payments if not mitigated. Specifically,

CMC lacked adequate segregation of duties and compensating controls over its processing of

payroll transactions. The lack of segregation of duties and compensating controls has a pervasive

effect on the CMC payroll process and impairs the effectiveness of other controls by rendering

their design ineffective or by keeping them from operating effectively.

In addition, CMC inappropriately granted four employees keying access to the State’s payroll

system. CMC also improperly allowed other employees to input payroll transactions into the

system using the user credentials of one of the four employees, who transferred to another state

agency. This control deficiency leaves the payroll data at risk of misuse, abuse, and unauthorized

use.

CMC also lacked sufficient controls over the processing of specific payroll-related transactions

to ensure that CMC complies with collective bargaining agreements and state laws, and that only

valid and authorized payments are processed. The control deficiencies contributed to CMC

employees’ excessive vacation and annual leave balances; improper leave buy-back; improper

holiday credit accruals; improper payments for overtime, physical fitness incentive pay, and

separation lump-sum pay; and unrecovered long-outstanding salary advances, costing the State

an estimated net total of $1,278,936. Our review was performed on a limited number of

transactions only; a more extensive review may find that the amount of improper payments is

higher than what we identified.

Josie Gastelo, Warden -2- August 25, 2017

If you have any questions, please contact Andrew Finlayson, Chief, State Agency Audits Bureau,

by phone at (916) 324-6310.

Sincerely,

Original signed by

JEFFREY V. BROWNFIELD, CPA

Chief, Division of Audits

JVB/as

Attachment

cc: Scott Kernan, Secretary

California Department of Corrections and Rehabilitation

Ralph Diaz, Undersecretary, Operations


Diana Toche, Undersecretary, Health Care Services


Kenneth J. Pogue, Undersecretary, Administration and Offender Services


Alene Shimazu, Director, Division of Administrative Services


Bryan Beyer, Director, Division of Internal Oversight and Research


Kathleen Allison, Director, Division of Adult Institutions


Connie Gipson, Deputy Director, Division of Adult Institutions


Jeffrey Macomber, Deputy Director, Division of Adult Institutions


Katherine Minnich, Deputy Director, Human Resources


Lori Zamora, Deputy Director, Office of Audits and Court Compliance


Linda Larabee, External Audits Manager, Office of Audits and Court Compliance


Yulanda Mynhier, Director, Health Care Policy and Administration

California Correctional Health Care Services

Janet Lewis, Deputy Director, Policy and Risk Management


Debbie Richardson, Chief of Internal Audits


Kathryn McQuaid, Assistant Warden, Business Services


Nelly MacLean, Staff Services Manager I


Mark Rodriguez, Chief, Administrative Services Division

California Department of Human Resources

California Men’s Colony Payroll Process Review

Contents

Review Report

Summary ............................................................................................................................ 1

Background ........................................................................................................................ 2

Objectives, Scope, and Methodology ............................................................................... 3

Conclusion .......................................................................................................................... 4

Views of Responsible Officials .......................................................................................... 5

Restricted Use .................................................................................................................... 5

Findings and Recommendations ........................................................................................... 6

Attachment—California Men’s Colony’s Response to Draft Review Report


-1-

Review Report

The State Controller’s Office (SCO) reviewed the California Men’s

Colony (CMC) payroll process for the period of July 1, 2012, through

May 31, 2015. CMC management is responsible for maintaining a system

of internal control over the payroll process within its organization, and for

ensuring compliance with various requirements under state laws and

regulations regarding payroll and payroll-related expenditures.

Our limited review identified material weaknesses in internal control over

the CMC payroll process that leaves CMC at risk of improper payments if

not mitigated. We found that CMC has a combination of deficiencies in

internal control over its payroll process such that there is reasonable

possibility that a material misstatement in financial information or

noncompliance with provisions of laws, regulations, or contracts will not

be prevented, or detected and corrected on a timely basis. Specifically,

CMC lacked adequate segregation of duties and compensating controls

over its processing of payroll transactions. The lack of segregation of

duties and appropriate compensating controls has a pervasive effect on the

CMC payroll process and impairs the effectiveness of other controls by

rendering their design ineffective or by keeping them from operating

effectively.

In addition, CMC inappropriately granted four employees keying access

to the State’s payroll system. CMC also improperly allowed other

employees to input payroll transactions into the system using the user

credentials of one of the four employees, who transferred to another state

agency. This control deficiency leaves the payroll data at risk of misuse,

abuse, and unauthorized use.

CMC also lacked sufficient controls over the processing of specific

payroll-related transactions to ensure that CMC complies with collective

bargaining agreements and state laws, and that only valid and authorized

payments are processed. As summarized in the table on page 2, the control

deficiencies contributed to CMC employees’ excessive vacation and

annual leave balances; improper leave buy-back; improper holiday credit

accruals; improper payments for overtime, physical fitness incentive pay,

and separation lump-sum pay; and unrecovered long-outstanding salary

advances, costing the State an estimated net total of $1,278,936. Our

review was performed on a limited number transactions only; a more

extensive review may determine that the amount of improper payment is

higher than what we identified.

Summary


-2-

The following table summarizes our review results:

Finding

Number Issues

Number of

Selections

Reviewed

Selection

Unit

Dollar

Amount of

Selections

Reviewed

Number of

Selections

with

Issues

Issues as a

Percentage

of

Selections

Reviewed *

Approximate

Dollar

Amount

Dollar

Amount of

Issues as a

Percentage

of Dollar

Amount of

Selections

Reviewed *

1 Inadequate segregation of duties

and compensating controls over

payroll transactions

N/A N/A N/A N/A N/A N/A N/A

2 Inappropriate keying access to the

State’s payroll system

21 Employee - 4 19% - -

3 Inadequate controls over vacation

and annual leave balances,

costing the State liability for

excessive credits

95 Employee 1,255,124$ 95 100% $ 1,255,124 100%

3 Inadequate controls over leave

balances, resulting in improper

leave buy-backs

1 Employee 7,691 1 100% 7,691 100%

4 Inadequate controls over holiday

credits, resulting in improper

accruals

330 Holiday

credit

transaction

114,912 186 56% 8,852 8%

5 Inadequate controls over overtime

compensation, resulting in

improper payments

21 Overtime

transaction

63,561 6 29% 2,308 4%

6 Inadequate controls over physical

fitness incentive pay, resulting in

improper payments

10 Employee 32,370 1 10% 1,040 3%

7 Inadequate controls over

employee separation lump-sum

pay, resulting in improper

payments

15 Employee 1,444,995 4 27% 175 -

8 Inadequate controls over salary

advances, resulting in a failure to

recover outstanding accounts

2 Salary

advance

transaction

3,746 2 100% 3,746 100%

Total 495 2,922,399$ 299 1,278,936$

* All percentages are rounded to the nearest full percentage point.

Selections Reviewed Selections with Issues

In 1979, the State of California adopted collective bargaining for state

employees. The adoption of collective bargaining created a significant

workload increase for the SCO’s Personnel and Payroll Services Division

(PPSD), as PPSD was the State’s centralized payroll processing center for

all payroll-related transactions. As such, PPSD decentralized the

processing of payroll, allowing state agencies and departments to process

their own payroll-related transactions. Periodic reviews of the

decentralized payroll processing at state agencies and departments ceased

due to budget constraints in the late 1980s.

In 2013, the California State Legislature reinstated these payroll reviews

to gain assurance that state agencies and departments maintain an adequate

internal control structure over the payroll function, provide proper

oversight over decentralized payroll processing, and comply with various

state laws and regulations regarding payroll processing and related

transactions.

Background


-3-

Review Authority

Authority for this review is provided by California Government Code

(GC) section 12476, which states, “The Controller may audit the uniform

state pay roll system, the State Pay Roll Revolving Fund, and related

records of state agencies within the uniform state pay roll system, in such

manner as the Controller may determine.” In addition, GC section 12410

stipulates that “The Controller shall superintend the fiscal concerns of the

state. The Controller shall audit all claims against the state, and may audit

the disbursement of any state money, for correctness, legality, and for

sufficient provisions of law for payment.”

The objectives of this review were to determine whether:

Payroll and payroll-related disbursements were accurate and in

accordance with collective bargaining agreements and state laws,

regulations, policies, and procedures.

CMC had established adequate internal control for payroll, to meet the

following control objectives:

o Payroll and payroll-related transactions are properly approved and

certified by authorized personnel;

o Only valid and authorized payroll and payroll-related transactions

are processed;

o Payroll and payroll-related transactions are accurate and properly

recorded;

o Payroll systems, records, and files are adequately safeguarded;

and

o State laws, regulations, policies, and procedures are complied

with regarding payroll and payroll-related transactions.

CMC complied with existing controls as part of the ongoing

management and monitoring of payroll and payroll-related

expenditures.

CMC maintained accurate records of leave balances.

Salary advances were properly administered and recorded in

accordance with state laws, regulations, policies, and procedures.

We reviewed the CMC payroll process and transactions for the period of

July 1, 2012, through May 31, 2015.

To achieve our review objectives, we:

Reviewed state and CMC policies and procedures related to the

payroll process to understand the practice of processing various

payroll and payroll-related transactions;

Interviewed CMC payroll personnel to understand the practice of

processing various payroll and payroll-related transactions, determine

their level of knowledge and ability relating to payroll transaction

processing, and obtain or confirm our understanding of existing

internal control over the payroll process and systems;

Objectives, Scope,

and Methodology


-4-

Selected transactions recorded in the State’s payroll database based on

risk factors and other criteria for review;

Analyzed and tested transactions recorded in the State’s payroll

database and reviewed relevant files and records to determine the

accuracy of payroll and payroll-related payments, accuracy of leave

transactions, proper review and approval of transactions, adequacy of

internal control over the payroll process and systems, and compliance

with collective bargaining agreements and state laws, regulations,

policies, and procedures (errors found were not projected to the

intended population); and

Reviewed salary advances to determine whether they were properly

administered and recorded in accordance with state laws, regulations,

policies, and procedures.

Our limited review identified material weakness in internal control over

the CMC payroll process that leaves CMC at risk of improper payments if

not mitigated.1 CMC has a combination of deficiencies in internal control

over its payroll process such that there is reasonable possibility that a

material misstatement in financial information or noncompliance with

provisions of laws, regulations, or contracts will not be prevented, or

detected and corrected on a timely basis. Specifically, CMC lacked

adequate segregation of duties and compensating controls over its

processing of payroll transactions. The payroll transactions unit staff

performed conflicting duties. The staff performs multiple steps in

processing payroll transactions, including data entry into the State’s

payroll system; reconciling payroll, including system output to source

documentation; and processing adjustments or corrections. This control

deficiency was aggravated by the lack of compensating controls, such as

management oversight and review, to mitigate the risks associated with

such a deficiency. The lack of segregation of duties and compensating

controls has a pervasive effect on CMC payroll process and impairs the

effectiveness of other controls by rendering their design ineffective or by

keeping them from operating effectively.

In addition, CMC inappropriately granted four employees keying access

to the State’s payroll system. Specifically, two employees’ keying access

was not immediately removed after transfer to another agency or change

in classification; one manager should not have been allowed keying access

to the system due to the employee’s management status; and one employee

1An evaluation of an entity’s payroll process may identify deficiencies in its internal control over such a process. A

deficiency in internal control exists when the design or operation of a control does not allow management or

employees, in the normal course of performing their assigned functions, to prevent, or detect and correct

misstatements in financial information, impairments of effectiveness or efficiency of operations, or noncompliance

with provisions of laws, regulations, or contracts on a timely basis.

Control deficiencies, either individually or in combination with other control deficiencies, may be evaluated as

significant deficiencies or material weaknesses. A significant deficiency is a deficiency, or a combination of

deficiencies, in internal control that is less severe than a material weakness, yet important enough to merit attention

by those charged with governance. A material weakness is a deficiency, or a combination of deficiencies, in internal

control such that there is a reasonable possibility that a material misstatement in financial information, impairment

of effectiveness or efficiency of operations, or noncompliance with provisions of laws, regulations, or contracts will

not be prevented, or detected and corrected on a timely basis.

Conclusion


-5-

had keying access while appointed to an ineligible classification without

written justification. CMC also improperly allowed other employees to

input payroll transactions into the system using the user credentials of the

employee who transferred to another state agency. This control deficiency

leaves the payroll data at risk of misuse, abuse, and unauthorized use.

CMC also lacked sufficient controls over the processing of specific

payroll-related transactions to ensure that CMC complies with collective

bargaining agreements and state laws, and that only valid and authorized

payments are processed. The control deficiencies contributed to CMC

employees’ excessive vacation and annual leave balances; improper leave

buy-back; improper holiday credit accruals; improper payments for

overtime, physical fitness incentive pay, and separation lump-sum pay;

and unrecovered long-outstanding salary advances, costing the State an

estimated net total of $1,278,936. Our review was performed on a limited

number of transactions only; a more extensive review may determine that

the amount of improper payment is higher than what we identified.

We issued a draft review report on June 14, 2017. Josie Gastelo, Warden,

responded by letter dated June 19, 2017 (Attachment). CMC provided

additional information and justification statements and indicated that it is

taking steps to correct the deficiencies noted in Findings 2 through 7. We

will follow up at the next payroll review to ensure that the corrective

actions were adequate and appropriate. CMC provided additional

information for Findings 1 and 8. Our comments to Findings 1 and 8 are

included in the Findings and Recommendation section.

This report is solely for the information and use of CMC, the California

Department of Corrections and Rehabilitation, California Correctional

Health Care Services, and the SCO; it is not intended to be and should not

be used by anyone other than these specified parties. This restriction is not

intended to limit distribution of this report, which is a matter of public

record.

Original signed by

JEFFREY V. BROWNFIELD, CPA

Chief, Division of Audits

August 25, 2017

Views of

Responsible

Officials

Restricted Use


-6-

Findings and Recommendations

CMC lacked adequate segregation of duties within its payroll transactions

unit necessary to ensure that only valid and authorized payroll transactions

are processed. CMC also failed to implement other controls to compensate

for this risk.

GC sections 13402 and 13403 mandate state agencies to establish and

maintain a system of internal control, including proper segregation of

duties. Adequate segregation of duties reduces the likelihood that fraud or

error will remain undetected, by providing for separate processing by

different individuals at various stages of a transaction and for independent

reviews of the work performed.

Our review found that the CMC payroll transaction unit staff performed

conflicting duties. The staff executes multiple steps in processing payroll

transactions, including data entry into the State’s payroll system;

reconciling payroll, including system output to source documentation; and

processing adjustments or corrections. In addition, as described in Finding

2, a payroll transactions manager had keying access to the payroll system

while responsible for approving payroll transactions entered in the system.

CMC management failed to demonstrate that it implemented

compensating controls to mitigate the risks associated with such a

deficiency. For example, we found no indication that supervisors conduct

reviews of transactions processed by the payroll transactions unit staff.

The lack of adequate segregation of duties and compensating controls has

a pervasive effect on the CMC payroll process and impairs the

effectiveness of other controls by rendering their design ineffective or by

keeping them from operating effectively. These control deficiencies, in

combination with other deficiencies discussed in Findings 2 through 8,

represent a material weakness in internal control over the payroll process

such that there is a reasonable possibility that a material misstatement in

financial information or noncompliance with provisions of state laws,

regulations, or contracts will not be prevented, or detected and corrected

on a timely basis.

Recommendation

We recommend that CMC separate conflicting payroll duties to the extent

possible. Adequate segregation of duties will provide a stronger system of

internal control whereby the functions of each employee are subject to the

review of another. Good internal control practices require that the

following functional duties be performed by different work units or, at

minimum, different employees within the same unit:

Recording transactions. This duty refers to the record-keeping

function, which is accomplished by entering data into a computer

system.

Authorization to execute. This duty belongs to individuals with

authority and responsibility to initiate and execute transactions.

FINDING 1—

Inadequate

segregation of

duties and

compensating

controls over

payroll

transactions


-7-

Periodic reviews and reconciliation of actual payments to recorded

amounts. This duty refers to making comparisons at regular intervals

and taking action to resolve errors.

If it is not possible to segregate payroll functions fully and appropriately

due to specific circumstances, CMC should implement compensating

controls. For example, if the payroll transactions unit staff responsible for

recordkeeping also performs a reconciliation process, the supervisor could

perform and document a detailed review of the reconciliation to provide

additional control over the assignment of conflicting functions.

Compensating controls may also include dual authorization requirements

and documented reviews of payroll system input and output.

We also recommend that CMC develop formal written procedures for

performing and documenting compensating controls.

CMC’s Response

The Personnel Specialist (PS) duties and responsibilities consist of

processing various personnel/payroll transactions, which includes data

entry, reconciliation, and processing adjustments and corrections.

Custody attendance and overtime is processed by the Custody Personnel

Assignment office and Custody Timekeepers via the BIS Time and Shift

system. Timekeepers provide a PIP batch to the PS for inputting, which

includes overtime, shift, holiday and meal allowance. Segregation of

duties is in place between the Custody Timekeepers, Personnel

Assignment office and the PS. CMC will go live in August 2017, where

PS’s will no longer key custody overtime, as it will be system generated

from the Time and Shift system. Over the years the duties and

responsibilities have increased in the transaction arena, which has

created an unreasonable workload for PS’s and for Personnel

Supervisors. Newer PS’s are under close supervision and their work is

consistently reviewed, as it takes approximately eighteen months to train

a PS. CMC has implemented periodic reviews of various transactions. It

is not feasible to consistently review the work of every PS every day.

CMC will continue to conduct periodic reviews and will implement a

Proof of Practice. In addition, CalHR should provide standardized

direction to all California Department of Corrections and Rehabilitation

(CDCR) institutions on the segregation of duties.

SCO’s Comment

The finding remains as stated. As discussed in the finding, our review

revealed conflicting staff tasks. We observed and CMC confirmed that the

Personnel Specialist’s duties include data entry, reconciliation, and

processing adjustments and corrections; and that the Staff Services

Manager I, who approves payroll transactions prior to input into the

system, had access and may key various transactions when the need arises

(see CMC’s response to Finding 2).

CMC’s response asserts the existence of segregation of duties among its

Custody Timekeeper, Personnel Assignment Office, and Personnel

Specialist. This separation of duties, as described by CMC, is not adequate

and does not mitigate the risk that errors, intentional or not, could occur

when the Personnel Specialist enters the data into the system, certifies

attendance, and processes payroll disbursements. Our review found no

indication that supervisors conduct periodic review of transactions entered

by the Personnel Specialists.


-8-

CMC indicated that it is implementing corrective actions subsequent to

our review to address the deficiencies noted in this finding. We will follow

up at the next payroll review to ensure that the corrective actions were

adequate and appropriate.

In reference to CMC’s statement that CalHR should provide standardized

direction to all CDCR institutions on the segregation of duties, we

recognize the benefit of implementing standardized direction for CDCR

institutions; however, this responsibility falls on CDCR and its

institutions. The State Leadership Accountability Act (GC sections 13400

through 13407) gives the heads of state agencies responsibility for the

establishment and maintenance of a system of internal control. The Act

requires the involvement of all levels of management of state agencies in

assessing and strengthening the systems of internal control.

CMC lacked adequate controls to ensure that only appropriate staff have

keying access to the State’s payroll system. Of the 21 employees whose

records we reviewed, four (19%) had improper keying access to the

system. CMC also improperly allowed other employees to input payroll

transactions into the system using the user credentials of one of the four

employees, who transferred to another state agency. If not mitigated, this

control deficiency leaves the payroll data at risk of misuse, abuse, and

unauthorized use.

The SCO maintains the State’s payroll information system. The system is

decentralized, thereby allowing employees of state agencies to access the

system. PPSD has established a Decentralization Security Program that all

state agencies are required to follow in order to access the payroll systems.

The program’s objectives are to secure and protect the confidentiality and

integrity of the data against misuse, abuse, and unauthorized use.

CMC had 21 employees with keying access to the State’s payroll system

at various times between July 1, 2012 and May 31, 2015. Of the 21

employees, two did not have their keying access immediately removed or

modified subsequent to transfer to another agency, or change in

classification. For example, a Personnel Specialist transferred to another

state agency in April 13, 2015. However, the request to delete the

employee’s access was not made until May 28, 2015. In addition, this same

employee provided her user identification and password to her supervisor

prior to transferring.

Between April 13, 2015, and May 28, 2015, the CMC supervisor allowed

access to the payroll system by other CMC employees with the user

identification and password provided to key payroll and payroll-related

transactions, failing to follow guidelines set forth in the Decentralization

Security Program.

Also, one of the 21 employees was in a managerial position, which should

not have had keying access, and did not have a justification letter on file.

The manager is an approving official who often approves certain payroll

transactions prior to input into the system. The manager is also responsible

for reviewing the work of his or her staff. To properly segregate duties,

employees charged with approving transactions should not be able to input

the transactions that they approve.

FINDING 2—

Inappropriate

keying access to the

State’s payroll

system


-9-

Further, one of the 21 employees had keying access while she was

appointed to a classification other than those allowed to have keying

access; however, CMC could not provide the required justification letter.

The employee had a classification change from Personnel Specialist to

Office Technician, then back to Personnel Specialist. However, the payroll

system access did not change during the time the employee was an Office

Technician, and no justification letter was on file.

The Decentralization Security Program manual states, in part:

The privilege to access the PPSD database poses a significant risk to the

ability for SCO to function. Therefore, privilege is restricted to persons

with a demonstrated need for such access. Currently… applications are

restricted to Personnel Services Specialists, and the Payroll Technician

classification because their need is by definition a function of their

specific job duties, and any change in those duties requires a reevaluation

of the need for access. If the employee’s duties change, such that the

need for access no longer exists, the access privilege MUST be removed

or deleted immediately by a request submitted by the department.

A request for an individual in a classification other than in the PSS/PST

series to access (the payroll system) requires a written justification from

the Personnel/Payroll Officer. The justification must describe the

individual’s specific job duties that require the need to each type of

information… as well as the level of access to that application, in order

to perform their Statutory and/or Constitutional duties.

Passwords are like credit cards—the owner is responsible for anything

for which his/her password is used. Therefore, as a matter of self-

protection, the password owner must:

1. NOT reveal their password to ANYONE.

2. NOT write down their password.

3. NOT log on to provide access/use by anyone.

4. NOT walk away from an active terminal session. Users must log off

(deactivate) terminals prior to leaving.

If anyone asks for a password, the owner MUST REFUSE to give it to

them and refer them to a supervisor/Security Monitor. Anyone who

knows that a password has been compromised should notify their

Security Monitor or the Decentralization Security Administrator

immediately.

The manual, as revised in January 2015, restricts manager classifications

to inquiry access only.

Recommendation

We recommend that CMC ensure that:

Keying access to the payroll system is updated/deleted after an

employee classification change or separation/transfer;

System access user identifications and passwords are not shared by

employees; and

The designated security monitor periodically reviews access to the

system to determine that access is in accordance with the

Decentralization Security Program.


-10-

CMC failed to implement controls to ensure that it adheres to the

requirements of collective bargaining agreements and state regulations to

limit the accumulation of vacation and annual leave credits, and that it

processes authorized leave buy-backs only. The control deficiencies

resulted in a liability for excessive leave credits that could cost the State at

least $1,255,124 as of May 31, 2015, which is expected to increase if CMC

does not take action to address the excessive vacation and annual leave

credits; and improper leave buy-back totaling $7,691.

Excessive leave balances

Collective bargaining agreements and state regulations limit the amount

of vacation and annual leave that most state employees may accumulate to

no more than 80 days (640 hours). The limit on leave balance serves as a

tool for state agencies to manage leave balances and control the State’s

liability for accrued leave credits. State agencies may allow employees to

carry a higher balance only on limited exceptions. For example, an

employee may not be able to reduce accrued vacation or annual leave

hours below the limit because of business needs. When an employee’s

leave accumulation exceeds or is projected to exceed the limit, state

agencies should work with the employee to develop a written plan to

reduce leave balances below the applicable limit.

Our review of the leave accounting records found that, as of May 31, 2015,

CMC had 95 employees whose vacation or annual leave balances

exceeded the limit set by applicable collective bargaining agreements and

state regulations. For example, one employee had an accumulated balance

of 1,914 hours in annual leave, or 1,274 hours beyond the 640-hour limit.

Collectively, the 95 employees accumulated more than 30,900 hours in

excess vacation and annual leave, costing at least $1,255,124 as of May

31, 2015. This estimated liability does not adjust for salary rate increases

and additional leave credits.1 Accordingly, we expect that the amount

needed for the liability would be higher. For example, a CMC employee

separated from state service with 2,484 hours in leave credits, including

1,298 hours in annual leave. After adjusting for additional leave credits,

the employee should have been paid for 2,960 hours, or 19% more.

When we discussed this issue with the personnel office staff, they

indicated that CMC did not have any plans in place during the review

period to address excessive vacation and annual leave credits in

accordance with collective bargaining agreements and state regulations.

1 Most state employees receive pay rate increases every year pursuant to state laws or collective bargaining agreements,

until the employee reaches the top of the pay scale or is promoted to a position with a higher pay scale. Also, when

projecting accumulated leave balances upon separation, an employee earns additional leave credits equal to the

amount the employee would have earned had the employee taken time off and not separated from state service.

FINDING 3—

Inadequate

controls over leave

balances, resulting

in liability for

excessive credits

and improper buy-

back


-11-

The following table shows the annual change during our review period in

the number of employees with vacation and annual leave balances

exceeding the 640-hour limit, and the total vacation and annual leave hours

in excess of the 640-hour limit.

As of

Total number

of employees

Year-to-year

percentage

increase

(decrease)

Total number

of hours

Year-to-year

percentage

increase

(decrease)

July 1, 2012 99 N/A 26,723 N/A

June 30, 2013 115 16% 33,826 27%

June 30, 2014 113 (2%) 34,123 1%

May 31, 2015 95 (16%) 30,901 (9%)

Employees with vacation or

annual leave balance exceeding

640 hours

Vacation and annual leave hours

in excess of the 640-hour limit

If CMC does not take action to reduce the excessive leave, the liability for

accrued vacation will likely increase because most employees will receive

salary increases, additional leave credits, or have other non-compensable

leave credits that they can use instead of vacation or annual leave,

increasing their vacation or annual leave balances. In addition, the state

agency responsible for paying these leave balances could also face a cash

flow problem if a significant number of employees with excessive

vacation or annual leave balances separate from state service. Normally,

state agencies are not budgeted to make these lump sum payments.

However, the State’s current practice dictates that the state agency that last

employs an employee pays for that employee’s lump sum separation

payment, regardless of where the employee accrued the leave balance.

Improper leave buy-back

GC section 19839 allows employees to receive cash for applicable leave

credits when separating from state employment. In addition, Title 2,

California Code of Regulations, section 599.744 provides that CalHR may

authorize an annual leave buy-back for employees who are excluded from

collective bargaining, such as managers and supervisors. Leave buy-back

allows employees to receive cash payment in exchange for applicable

leave credits, such as vacation leave, annual leave, personal leave,

personal holiday, or holiday credit. CalHR indicated that the authorized

leave buy-back was available to excluded employees during fiscal year

(FY) 2006-07 and FY 2013-14 through FY 2016-17.

Our review of overtime payments found that CMC improperly bought

back a total of $7,691 in leave credits for one supervisor when she moved

to another facility. The leave buy-back payments included $4,882 for 166

hours of annual leave and $2,809 for 96 hours of holiday credits and excess

hours. These payment transactions occurred in October and November

2012 without CalHR authorization.

The SCO’s Payroll Procedures Manual provides specific coding that state

agencies should use when processing leave buy-back transactions. By

keying leave buy-back transactions as overtime payments instead of

keying them as leave buy-backs, CMC personnel office staff circumvented

the state payroll system’s internal controls.


-12-

Records indicated that the human resources analyst instructed the

personnel specialist to process the leave buy-back. CMC personnel office

staff also stated that the personnel specialist lacked adequate experience at

that time.

Recommendation

We recommend that CMC implement controls, including existing policies

and procedures, to ensure that its employees’ vacation and annual leave

balances are maintained within levels allowed by collective bargaining

agreements and state regulations. If the State offers leave buy-back

programs, CMC should also participate in such programs if funds are

available.

We also recommend that CMC implement controls, including existing

policies and procedures, to ensure that unauthorized leave buy-back are

prevented. CMC also should establish controls:

Requiring personnel office staff to obtain documentation that specify

the authority for the leave buy-back and include appropriate

authorizing signatures;

Providing adequate supervisory review to ensure that personnel office

staff process only authorized and properly coded leave buy-back

transactions; and

Providing adequate training to responsible staff involved in leave buy-

back transactions to ensure that they understand the requirements

under state laws and regulation regarding leave buy-backs.

In addition, we recommend that CMC conduct ongoing monitoring of

controls to ensure that the controls are implemented and operating

effectively.

CMC lacked adequate controls over the accruals of employee holiday

credits. CMC improperly granted a total of 357 holiday credit hours in 48

(15%) of the 330 transactions reviewed, costing the State approximately

$8,852. Also, 138 holiday credit accrual transactions were entered a month

early in the system. If not corrected, this control deficiency leaves CMC

at risk of additional improper holiday credit accruals.

FINDING 4—

Inadequate

controls over

holiday credits,

resulting in

improper accruals


-13-

Collective bargaining agreements and GC section 19853 specify the

number of hours of holiday credits an employee would receive per

qualifying holiday. In our review of 330 selected holiday credit

transactions recorded in the State’s leave accounting system, we found that

48 were improper, as shown in the following table:

Issues

Number of

Employees

Number of

Holiday

Credit

Transactions

Number of

Hours of

Improper

Holiday

Credits

Estimated Net

Cost to the

State as of

May 31, 2015

Holiday credit entered twice in

the system

38 38 304 6,716$

Holiday credit granted on pay

period with no holidays

4 4 32 878

Holiday credit exceeded the

limit set by collective

bargaining agreements and

state law

5 5 6 633

Holiday credit used entered as

earned in the system

1 1 15 625

Total 48 48 357 8,852$

In addition, in 138 of the 330 holiday credit transactions, the accruals were

reflected in March 2013 instead of April 2013.

We found no indication the holiday credit transactions were reviewed by

an individual other than the payroll transactions unit staff responsible for

keying these transactions into the system.

Recommendation

We recommend that CMC:

Conduct a review of the leave accounting system to ensure that the

accrual of holiday credits complies with collective bargaining

agreements and state law;

Correct any improper holiday credit accruals in the leave accounting

system;

Implement adequate oversight to ensure accurate recording of holiday

credits; and

Provide training to staff involved in keying transactions into the leave

accounting system to ensure they understand the collective bargaining

agreements and state law regarding holiday credits.

CMC lacked adequate controls over overtime compensation. If not

corrected, the control deficiency also leaves CMC at risk of granting

additional improper payments.

Payroll records showed that CMC processed more than 70,000 overtime

payments between July 2012 and May 2015. We reviewed 21 selected

overtime payments and found that six of them were improper, which

resulted in overpayments to six employees totaling $2,308. CMC indicated

that the improper payments resulted from the payroll transactions unit staff

processing the payments even though the employees were not eligible to

receive overtime compensation. We found no indication that the overtime

FINDING 5—

Inadequate

internal controls

over overtime

compensation,

resulting in

improper

payments


-14-

payments were reviewed by an individual other than payroll transactions

unit staff responsible of keying the transaction into the system.

The six employees, who belonged to Work Week Group E, included three

who were subject to the collective bargaining agreement between the State

and Bargaining Unit 19 and three who were excluded from collective

bargaining. The collective bargaining agreement between the State and

Bargaining Unit 19, section 6.1.B states, in part:

. . . . Work Week Group “E” includes classes that are exempted from

coverage under the FLSA because of the “white-collar” (administrative,

executive, professional) exemptions. . . . Work Week Group “E” applies

to classes and positions with no minimum or maximum number of hours

in an average workweek. Exempt employees are paid on a “salaried”

basis, and the regular rate of pay is full compensation for all hours

worked to perform assigned duties. . . .

. . . . The salary paid to FLSA exempt employees is full compensation

for all hours worked.

FLSA-exempt employees are not authorized to receive any form of

overtime compensation, whether formal or informal. . . .

CalHR’s California State Civil Service Pay Scales, section 10, includes

provisions similar to the collective bargaining agreement.

GC sections 13402 and 13403 mandate state agencies to establish and

maintain internal controls, including a system of authorization and an

effective system of internal review. State agencies are also responsible for

ensuring that these controls are functioning as prescribed. However, as

described, CMC lacked adequate controls to ensure that only overtime

payments that comply with the collective bargaining agreement and state

policy are processed.

Recommendation

We recommend that CMC conduct a review of overtime payments during

the past three years to ensure that the payments comply with collective

bargaining agreements and state policy. CMC should recover

overpayments made to employees through an agreed-upon collection

method in accordance with GC section 19838.

To prevent improper overtime payments from recurring, CMC should

establish adequate internal controls to ensure that overtime payments

comply with collective bargaining agreements and state policy. The

controls include providing adequate supervisory oversight of payroll

transactions unit staff.


-15-

CMC lacked adequate controls to ensure that the payroll transactions unit

staff processes only valid and authorized physical fitness incentive pay

that complies with state policies. CMC, as a result, made a total of $1,040

in improper payments for physical fitness incentive pay. If not mitigated,

the control deficiencies also leave CMC at risk of additional improper

payments.

CalHR’s California State Civil Service Pay Scales, section 14, Pay

Differential 108, grants employees physical fitness incentive pay if they

meet the requirements to receive the pay. Pay Differential 108 requires

employees in the eligible classifications to have 60 or more qualifying pay

periods of state service in Bargaining Unit 6 and an annual physician’s

certification of having successfully passed a physical fitness exam. CDCR

policies also state that if an employee is on worker’s compensation, the

employee is entitled to continue to receive the pay differential, even if the

annual certification is expired. Once the employee returns to work, the

employee must submit an annual physician’s certification within 120 days

to continue to receive the pay differential. If the employee does not submit

the certification within the 120 days, the employee is no longer entitled to

the pay differential until a new certification is submitted.

Payroll records showed that CMC granted physical fitness incentive pay

to more than 1,000 employees between July 2010 and May 2015. Of the

10 employees whose records we reviewed, one did not have a valid

physical fitness certification on file for the period of July 1, 2012, through

June 30, 2013, during which time the employee continued to receive the

pay differential. The employee was on worker’s compensation prior to

July 1, 2012, and returned to work on July 12, 2012. The employee did not

submit a new certification until July 1, 2013. Therefore, the employee was

improperly compensated for the pay differential for pay periods from

November 2012 (120 days, or four months after returning to work) through

June 2013. The employee was improperly compensated for eight pay

periods at $130 per pay period, for a total of $1,040.

Recommendation

We recommend that CMC conduct a review of physical fitness incentive

pay during the past three years to ensure that the payments comply with

state policies. It should recover overpayments made to employees through

an agreed-upon collection method in accordance with GC section 19838.

We also recommend that CMC establish adequate internal controls to

ensure that payments comply with state policies and to prevent improper

payments. These controls should include:

Requiring payroll transactions unit staff to verify that payments are

granted only to eligible employees;

Providing adequate oversight to ensure that payroll transactions unit

staff processes only valid and authorized payments; and

Providing training to responsible staff involved in processing payment

transactions to ensure that they understand the requirements under

state policies.

FINDING 6—

Inadequate

internal controls

over physical

fitness incentive

pay, resulting in

improper

payments


-16-

CMC lacked adequate controls over the processing of employee separation

lump-sum pay. Of the 15 employees whose records we reviewed, four

(27%) were improperly paid, resulting in a net total overpayment of $175.

If not corrected, the control deficiency leaves CMC at risk of granting

additional improper payments.

Pursuant to collective bargaining agreements and state law, employees are

entitled to receive cash for accrued eligible leave credits when separating

from state employment. Payroll records indicated that CMC had processed

separation lump-sum pay for 421 employees between July 2012 and May

2015. We reviewed records of 15 selected employees who received lump-

sum payments due to separation from state employment. Of the 15

employees, four were improperly paid. Two employees were overpaid by

a total of $763 and two employees were underpaid by a total of $588.

These improper payments resulted from miscalculation of the employees’

accrued leave credits by the payroll transactions unit staff. We found no

indication that an authorized individual reviewed the processing of these

lump-sum payments.

Recommendation

We recommend that CMC:

Establish adequate controls to ensure accurate calculation and

payment of employee separation lump-sum pay;

Conduct a review of employee separation lump-sum payments during

the past three years to ensure that the payments are accurate and in

compliance with collective bargaining agreements and state law; and

Recover overpayments made to separated employees in accordance

with GC section 19838 and State Administrative Manual (SAM)

section 8776.6, and properly compensate those employees who were

underpaid.

CMC lacked adequate controls over salary advances to ensure that they

are collected in accordance with state law and policies. At May 31, 2015,

CMC had $3,746 in salary advances that had been outstanding for over

120 days. The longest outstanding was one year and nine months. The

control deficiency leaves CMC at risk for additional uncollectable salary

advances.

GC section 19838 and SAM section 8776.7 allow CMC to collect salary

advances in a timely manner. At May 31, 2015, CMC’s accounting records

showed 12 outstanding salary advances totaling $26,357, including two

balances totaling $3,746 that had been outstanding for more than 120 days.

Generally, the prospect of collection diminishes as an account ages. When

an agency is unable to collect after three years, the possibility of collection

is remote.

FINDING 7—

Inadequate

controls over

employee

separation lump-

sum pay, resulting

in improper

payments

FINDING 8—

Inadequate

internal controls

over salary

advances, resulting

in a failure to

recover

outstanding

accounts


-17-

In our review of the two salary advances totaling $3,747 that were over

120 days old, we found that:

For the first outstanding balance of $2,070 issued on August 30, 2013,

documentation provided by CMC indicated attempts to collect the

outstanding salary advance began six months after the date of the

issuance. No collection letters were sent to the recipient of the salary

advance. Collection to reduce the balance began on July 23, 2015.

For the second outstanding balance of $1,676 issued on December 15,

2009, documentation provided by CMC indicated that the first

collection letter was sent to the recipient of the salary advance on

June 5, 2012, two and a half years later. The balance remains

outstanding.

The lack of adequate controls over salary advances increases the risk of

financial loss, reduces the likelihood of collection, increases the amount

of resources expended on collection efforts, and negatively impacts cash

flow.

Recommendation

We recommend that CMC ensure that salary advances are recovered in a

timely manner pursuant to GC section 19838 and SAM section 8776.7. If

all reasonable collection procedures do not result in payment, CMC may

request discharge from accountability of uncollectable amounts.

CMC’s Response

CMC diligently strives to timely clear salary advances. In addition,

CDCR has adequate control over the salary advances. All salary

advances are downloaded onto the BIS Salary Advance Aging Report

system, which is overseen by BIS and Regional Accounting Office

(RAO) staff. The report is reviewed and monitored and sent to the

institution monthly to process and return. The report is monitored by the

supervisor to ensure salary advances are cleared in a timely manner.

There is an explanation for the two outstanding salary advances

mentioned in the audit report for CMC. The employee, who was issued

a salary advance for the amount of $2,070.00, was under investigation

by the Office of Internal Affairs. Personnel was instructed by the Hiring

Authority not to notify the employee of the outstanding salary advance

until the investigation was concluded. Once the investigation was

concluded, the advance was cleared. The second outstanding salary

advance for the amount of $1,676.00 was issued on 12/15/2009. An error

was made whereby the employee received both the salary advance and

warrant. Once discovered, accounting requested a copy of the cashed

salary advance, which resulted in the employee owing money. Due to the

employee separating, the salary advance was sent to RAO for

collections. It was later discovered the employee had never been notified.

The notice was later sent and downloaded onto the BIS Aging Report

system. His current balance is $1,279.21; RAO has submitted a request

to the Franchise Tax Board for 2014, 2015, 2016, and 2017 tax collection

and reimbursement to CDCR.


-18-

SCO’s Comment

The finding remains as stated. As discussed in the finding, our review

found that CMC lacked adequate controls over salary advances to ensure

that they are collected in accordance with state law and policies. CMC

confirmed this deficiency by stating that for one salary advance, the

employee received both the salary advance and warrant, and the employee

was never notified of the outstanding salary advance. For another salary

advance, CMC stated that the employee was under investigation and the

Personnel Office was instructed not to notify the employee about the

outstanding salary advance until after the investigation was concluded.

During the review, it was unclear to us when the investigation had started.

However, our review of available documentation indicated that the earliest

efforts to determine the status of the outstanding salary advance began six

months after the date of issuance.


Attachment—

California Men’s Colony’s Response to Draft Review Report

State Controller’s Office

Division of Audits

Post Office Box 942850

Sacramento, CA 94250-5874

http://www.sco.ca.gov

S16-PAR-9000

Documents

CALIFORNIA MEN’S COLONY · 2020-07-17 · California Men’s Colony Payroll Process Review-3- Review Authority Authority for this review is provided by California Government Code