CALIFORNIA MEN’S COLONY
Review Report
PAYROLL PROCESS REVIEW
July 1, 2012, through May 31, 2015
BETTY T. YEE California State Controller
August 2017
BETTY T. YEE
California State Controller
August 25, 2017
Josie Gastelo, Warden
California Men’s Colony
P.O. Box 8101
San Luis Obispo, CA 93409-8101
Dear Ms. Gastelo:
The State Controller’s Office reviewed the California Men’s Colony (CMC) payroll process for
the period of July 1, 2012, through May 31, 2015. CMC management is responsible for
maintaining a system of internal control over the payroll process within its organization, and for
ensuring compliance with various requirements under state laws and regulations regarding
payroll and payroll-related expenditures.
Our limited review identified material weakness in internal control over the CMC payroll
process that leaves CMC at risk of additional improper payments if not mitigated. Specifically,
CMC lacked adequate segregation of duties and compensating controls over its processing of
payroll transactions. The lack of segregation of duties and compensating controls has a pervasive
effect on the CMC payroll process and impairs the effectiveness of other controls by rendering
their design ineffective or by keeping them from operating effectively.
In addition, CMC inappropriately granted four employees keying access to the State’s payroll
system. CMC also improperly allowed other employees to input payroll transactions into the
system using the user credentials of one of the four employees, who transferred to another state
agency. This control deficiency leaves the payroll data at risk of misuse, abuse, and unauthorized
use.
CMC also lacked sufficient controls over the processing of specific payroll-related transactions
to ensure that CMC complies with collective bargaining agreements and state laws, and that only
valid and authorized payments are processed. The control deficiencies contributed to CMC
employees’ excessive vacation and annual leave balances; improper leave buy-back; improper
holiday credit accruals; improper payments for overtime, physical fitness incentive pay, and
separation lump-sum pay; and unrecovered long-outstanding salary advances, costing the State
an estimated net total of $1,278,936. Our review was performed on a limited number of
transactions only; a more extensive review may find that the amount of improper payments is
higher than what we identified.
Josie Gastelo, Warden -2- August 25, 2017
If you have any questions, please contact Andrew Finlayson, Chief, State Agency Audits Bureau,
by phone at (916) 324-6310.
Sincerely,
Original signed by
JEFFREY V. BROWNFIELD, CPA
Chief, Division of Audits
JVB/as
Attachment
cc: Scott Kernan, Secretary
California Department of Corrections and Rehabilitation
Ralph Diaz, Undersecretary, Operations
California Department of Corrections and Rehabilitation
Diana Toche, Undersecretary, Health Care Services
California Department of Corrections and Rehabilitation
Kenneth J. Pogue, Undersecretary, Administration and Offender Services
California Department of Corrections and Rehabilitation
Alene Shimazu, Director, Division of Administrative Services
California Department of Corrections and Rehabilitation
Bryan Beyer, Director, Division of Internal Oversight and Research
California Department of Corrections and Rehabilitation
Kathleen Allison, Director, Division of Adult Institutions
California Department of Corrections and Rehabilitation
Connie Gipson, Deputy Director, Division of Adult Institutions
California Department of Corrections and Rehabilitation
Jeffrey Macomber, Deputy Director, Division of Adult Institutions
California Department of Corrections and Rehabilitation
Katherine Minnich, Deputy Director, Human Resources
California Department of Corrections and Rehabilitation
Lori Zamora, Deputy Director, Office of Audits and Court Compliance
California Department of Corrections and Rehabilitation
Linda Larabee, External Audits Manager, Office of Audits and Court Compliance
California Department of Corrections and Rehabilitation
Yulanda Mynhier, Director, Health Care Policy and Administration
California Correctional Health Care Services
Janet Lewis, Deputy Director, Policy and Risk Management
California Correctional Health Care Services
Debbie Richardson, Chief of Internal Audits
California Correctional Health Care Services
Kathryn McQuaid, Assistant Warden, Business Services
California Men’s Colony
Nelly MacLean, Staff Services Manager I
California Men’s Colony
Mark Rodriguez, Chief, Administrative Services Division
California Department of Human Resources
California Men’s Colony Payroll Process Review
Contents
Review Report
Summary ............................................................................................................................ 1
Background ........................................................................................................................ 2
Objectives, Scope, and Methodology ............................................................................... 3
Conclusion .......................................................................................................................... 4
Views of Responsible Officials .......................................................................................... 5
Restricted Use .................................................................................................................... 5
Findings and Recommendations ........................................................................................... 6
Attachment—California Men’s Colony’s Response to Draft Review Report
California Men’s Colony Payroll Process Review
-1-
Review Report
The State Controller’s Office (SCO) reviewed the California Men’s
Colony (CMC) payroll process for the period of July 1, 2012, through
May 31, 2015. CMC management is responsible for maintaining a system
of internal control over the payroll process within its organization, and for
ensuring compliance with various requirements under state laws and
regulations regarding payroll and payroll-related expenditures.
Our limited review identified material weaknesses in internal control over
the CMC payroll process that leaves CMC at risk of improper payments if
not mitigated. We found that CMC has a combination of deficiencies in
internal control over its payroll process such that there is reasonable
possibility that a material misstatement in financial information or
noncompliance with provisions of laws, regulations, or contracts will not
be prevented, or detected and corrected on a timely basis. Specifically,
CMC lacked adequate segregation of duties and compensating controls
over its processing of payroll transactions. The lack of segregation of
duties and appropriate compensating controls has a pervasive effect on the
CMC payroll process and impairs the effectiveness of other controls by
rendering their design ineffective or by keeping them from operating
effectively.
In addition, CMC inappropriately granted four employees keying access
to the State’s payroll system. CMC also improperly allowed other
employees to input payroll transactions into the system using the user
credentials of one of the four employees, who transferred to another state
agency. This control deficiency leaves the payroll data at risk of misuse,
abuse, and unauthorized use.
CMC also lacked sufficient controls over the processing of specific
payroll-related transactions to ensure that CMC complies with collective
bargaining agreements and state laws, and that only valid and authorized
payments are processed. As summarized in the table on page 2, the control
deficiencies contributed to CMC employees’ excessive vacation and
annual leave balances; improper leave buy-back; improper holiday credit
accruals; improper payments for overtime, physical fitness incentive pay,
and separation lump-sum pay; and unrecovered long-outstanding salary
advances, costing the State an estimated net total of $1,278,936. Our
review was performed on a limited number transactions only; a more
extensive review may determine that the amount of improper payment is
higher than what we identified.
Summary
California Men’s Colony Payroll Process Review
-2-
The following table summarizes our review results:
Finding
Number Issues
Number of
Selections
Reviewed
Selection
Unit
Dollar
Amount of
Selections
Reviewed
Number of
Selections
with
Issues
Issues as a
Percentage
of
Selections
Reviewed *
Approximate
Dollar
Amount
Dollar
Amount of
Issues as a
Percentage
of Dollar
Amount of
Selections
Reviewed *
1 Inadequate segregation of duties
and compensating controls over
payroll transactions
N/A N/A N/A N/A N/A N/A N/A
2 Inappropriate keying access to the
State’s payroll system
21 Employee - 4 19% - -
3 Inadequate controls over vacation
and annual leave balances,
costing the State liability for
excessive credits
95 Employee 1,255,124$ 95 100% $ 1,255,124 100%
3 Inadequate controls over leave
balances, resulting in improper
leave buy-backs
1 Employee 7,691 1 100% 7,691 100%
4 Inadequate controls over holiday
credits, resulting in improper
accruals
330 Holiday
credit
transaction
114,912 186 56% 8,852 8%
5 Inadequate controls over overtime
compensation, resulting in
improper payments
21 Overtime
transaction
63,561 6 29% 2,308 4%
6 Inadequate controls over physical
fitness incentive pay, resulting in
improper payments
10 Employee 32,370 1 10% 1,040 3%
7 Inadequate controls over
employee separation lump-sum
pay, resulting in improper
payments
15 Employee 1,444,995 4 27% 175 -
8 Inadequate controls over salary
advances, resulting in a failure to
recover outstanding accounts
2 Salary
advance
transaction
3,746 2 100% 3,746 100%
Total 495 2,922,399$ 299 1,278,936$
* All percentages are rounded to the nearest full percentage point.
Selections Reviewed Selections with Issues
In 1979, the State of California adopted collective bargaining for state
employees. The adoption of collective bargaining created a significant
workload increase for the SCO’s Personnel and Payroll Services Division
(PPSD), as PPSD was the State’s centralized payroll processing center for
all payroll-related transactions. As such, PPSD decentralized the
processing of payroll, allowing state agencies and departments to process
their own payroll-related transactions. Periodic reviews of the
decentralized payroll processing at state agencies and departments ceased
due to budget constraints in the late 1980s.
In 2013, the California State Legislature reinstated these payroll reviews
to gain assurance that state agencies and departments maintain an adequate
internal control structure over the payroll function, provide proper
oversight over decentralized payroll processing, and comply with various
state laws and regulations regarding payroll processing and related
transactions.
Background
California Men’s Colony Payroll Process Review
-3-
Review Authority
Authority for this review is provided by California Government Code
(GC) section 12476, which states, “The Controller may audit the uniform
state pay roll system, the State Pay Roll Revolving Fund, and related
records of state agencies within the uniform state pay roll system, in such
manner as the Controller may determine.” In addition, GC section 12410
stipulates that “The Controller shall superintend the fiscal concerns of the
state. The Controller shall audit all claims against the state, and may audit
the disbursement of any state money, for correctness, legality, and for
sufficient provisions of law for payment.”
The objectives of this review were to determine whether:
Payroll and payroll-related disbursements were accurate and in
accordance with collective bargaining agreements and state laws,
regulations, policies, and procedures.
CMC had established adequate internal control for payroll, to meet the
following control objectives:
o Payroll and payroll-related transactions are properly approved and
certified by authorized personnel;
o Only valid and authorized payroll and payroll-related transactions
are processed;
o Payroll and payroll-related transactions are accurate and properly
recorded;
o Payroll systems, records, and files are adequately safeguarded;
and
o State laws, regulations, policies, and procedures are complied
with regarding payroll and payroll-related transactions.
CMC complied with existing controls as part of the ongoing
management and monitoring of payroll and payroll-related
expenditures.
CMC maintained accurate records of leave balances.
Salary advances were properly administered and recorded in
accordance with state laws, regulations, policies, and procedures.
We reviewed the CMC payroll process and transactions for the period of
July 1, 2012, through May 31, 2015.
To achieve our review objectives, we:
Reviewed state and CMC policies and procedures related to the
payroll process to understand the practice of processing various
payroll and payroll-related transactions;
Interviewed CMC payroll personnel to understand the practice of
processing various payroll and payroll-related transactions, determine
their level of knowledge and ability relating to payroll transaction
processing, and obtain or confirm our understanding of existing
internal control over the payroll process and systems;
Objectives, Scope,
and Methodology
California Men’s Colony Payroll Process Review
-4-
Selected transactions recorded in the State’s payroll database based on
risk factors and other criteria for review;
Analyzed and tested transactions recorded in the State’s payroll
database and reviewed relevant files and records to determine the
accuracy of payroll and payroll-related payments, accuracy of leave
transactions, proper review and approval of transactions, adequacy of
internal control over the payroll process and systems, and compliance
with collective bargaining agreements and state laws, regulations,
policies, and procedures (errors found were not projected to the
intended population); and
Reviewed salary advances to determine whether they were properly
administered and recorded in accordance with state laws, regulations,
policies, and procedures.
Our limited review identified material weakness in internal control over
the CMC payroll process that leaves CMC at risk of improper payments if
not mitigated.1 CMC has a combination of deficiencies in internal control
over its payroll process such that there is reasonable possibility that a
material misstatement in financial information or noncompliance with
provisions of laws, regulations, or contracts will not be prevented, or
detected and corrected on a timely basis. Specifically, CMC lacked
adequate segregation of duties and compensating controls over its
processing of payroll transactions. The payroll transactions unit staff
performed conflicting duties. The staff performs multiple steps in
processing payroll transactions, including data entry into the State’s
payroll system; reconciling payroll, including system output to source
documentation; and processing adjustments or corrections. This control
deficiency was aggravated by the lack of compensating controls, such as
management oversight and review, to mitigate the risks associated with
such a deficiency. The lack of segregation of duties and compensating
controls has a pervasive effect on CMC payroll process and impairs the
effectiveness of other controls by rendering their design ineffective or by
keeping them from operating effectively.
In addition, CMC inappropriately granted four employees keying access
to the State’s payroll system. Specifically, two employees’ keying access
was not immediately removed after transfer to another agency or change
in classification; one manager should not have been allowed keying access
to the system due to the employee’s management status; and one employee
1An evaluation of an entity’s payroll process may identify deficiencies in its internal control over such a process. A
deficiency in internal control exists when the design or operation of a control does not allow management or
employees, in the normal course of performing their assigned functions, to prevent, or detect and correct
misstatements in financial information, impairments of effectiveness or efficiency of operations, or noncompliance
with provisions of laws, regulations, or contracts on a timely basis.
Control deficiencies, either individually or in combination with other control deficiencies, may be evaluated as
significant deficiencies or material weaknesses. A significant deficiency is a deficiency, or a combination of
deficiencies, in internal control that is less severe than a material weakness, yet important enough to merit attention
by those charged with governance. A material weakness is a deficiency, or a combination of deficiencies, in internal
control such that there is a reasonable possibility that a material misstatement in financial information, impairment
of effectiveness or efficiency of operations, or noncompliance with provisions of laws, regulations, or contracts will
not be prevented, or detected and corrected on a timely basis.
Conclusion
California Men’s Colony Payroll Process Review
-5-
had keying access while appointed to an ineligible classification without
written justification. CMC also improperly allowed other employees to
input payroll transactions into the system using the user credentials of the
employee who transferred to another state agency. This control deficiency
leaves the payroll data at risk of misuse, abuse, and unauthorized use.
CMC also lacked sufficient controls over the processing of specific
payroll-related transactions to ensure that CMC complies with collective
bargaining agreements and state laws, and that only valid and authorized
payments are processed. The control deficiencies contributed to CMC
employees’ excessive vacation and annual leave balances; improper leave
buy-back; improper holiday credit accruals; improper payments for
overtime, physical fitness incentive pay, and separation lump-sum pay;
and unrecovered long-outstanding salary advances, costing the State an
estimated net total of $1,278,936. Our review was performed on a limited
number of transactions only; a more extensive review may determine that
the amount of improper payment is higher than what we identified.
We issued a draft review report on June 14, 2017. Josie Gastelo, Warden,
responded by letter dated June 19, 2017 (Attachment). CMC provided
additional information and justification statements and indicated that it is
taking steps to correct the deficiencies noted in Findings 2 through 7. We
will follow up at the next payroll review to ensure that the corrective
actions were adequate and appropriate. CMC provided additional
information for Findings 1 and 8. Our comments to Findings 1 and 8 are
included in the Findings and Recommendation section.
This report is solely for the information and use of CMC, the California
Department of Corrections and Rehabilitation, California Correctional
Health Care Services, and the SCO; it is not intended to be and should not
be used by anyone other than these specified parties. This restriction is not
intended to limit distribution of this report, which is a matter of public
record.
Original signed by
JEFFREY V. BROWNFIELD, CPA
Chief, Division of Audits
August 25, 2017
Views of
Responsible
Officials
Restricted Use
California Men’s Colony Payroll Process Review
-6-
Findings and Recommendations
CMC lacked adequate segregation of duties within its payroll transactions
unit necessary to ensure that only valid and authorized payroll transactions
are processed. CMC also failed to implement other controls to compensate
for this risk.
GC sections 13402 and 13403 mandate state agencies to establish and
maintain a system of internal control, including proper segregation of
duties. Adequate segregation of duties reduces the likelihood that fraud or
error will remain undetected, by providing for separate processing by
different individuals at various stages of a transaction and for independent
reviews of the work performed.
Our review found that the CMC payroll transaction unit staff performed
conflicting duties. The staff executes multiple steps in processing payroll
transactions, including data entry into the State’s payroll system;
reconciling payroll, including system output to source documentation; and
processing adjustments or corrections. In addition, as described in Finding
2, a payroll transactions manager had keying access to the payroll system
while responsible for approving payroll transactions entered in the system.
CMC management failed to demonstrate that it implemented
compensating controls to mitigate the risks associated with such a
deficiency. For example, we found no indication that supervisors conduct
reviews of transactions processed by the payroll transactions unit staff.
The lack of adequate segregation of duties and compensating controls has
a pervasive effect on the CMC payroll process and impairs the
effectiveness of other controls by rendering their design ineffective or by
keeping them from operating effectively. These control deficiencies, in
combination with other deficiencies discussed in Findings 2 through 8,
represent a material weakness in internal control over the payroll process
such that there is a reasonable possibility that a material misstatement in
financial information or noncompliance with provisions of state laws,
regulations, or contracts will not be prevented, or detected and corrected
on a timely basis.
Recommendation
We recommend that CMC separate conflicting payroll duties to the extent
possible. Adequate segregation of duties will provide a stronger system of
internal control whereby the functions of each employee are subject to the
review of another. Good internal control practices require that the
following functional duties be performed by different work units or, at
minimum, different employees within the same unit:
Recording transactions. This duty refers to the record-keeping
function, which is accomplished by entering data into a computer
system.
Authorization to execute. This duty belongs to individuals with
authority and responsibility to initiate and execute transactions.
FINDING 1—
Inadequate
segregation of
duties and
compensating
controls over
payroll
transactions
California Men’s Colony Payroll Process Review
-7-
Periodic reviews and reconciliation of actual payments to recorded
amounts. This duty refers to making comparisons at regular intervals
and taking action to resolve errors.
If it is not possible to segregate payroll functions fully and appropriately
due to specific circumstances, CMC should implement compensating
controls. For example, if the payroll transactions unit staff responsible for
recordkeeping also performs a reconciliation process, the supervisor could
perform and document a detailed review of the reconciliation to provide
additional control over the assignment of conflicting functions.
Compensating controls may also include dual authorization requirements
and documented reviews of payroll system input and output.
We also recommend that CMC develop formal written procedures for
performing and documenting compensating controls.
CMC’s Response
The Personnel Specialist (PS) duties and responsibilities consist of
processing various personnel/payroll transactions, which includes data
entry, reconciliation, and processing adjustments and corrections.
Custody attendance and overtime is processed by the Custody Personnel
Assignment office and Custody Timekeepers via the BIS Time and Shift
system. Timekeepers provide a PIP batch to the PS for inputting, which
includes overtime, shift, holiday and meal allowance. Segregation of
duties is in place between the Custody Timekeepers, Personnel
Assignment office and the PS. CMC will go live in August 2017, where
PS’s will no longer key custody overtime, as it will be system generated
from the Time and Shift system. Over the years the duties and
responsibilities have increased in the transaction arena, which has
created an unreasonable workload for PS’s and for Personnel
Supervisors. Newer PS’s are under close supervision and their work is
consistently reviewed, as it takes approximately eighteen months to train
a PS. CMC has implemented periodic reviews of various transactions. It
is not feasible to consistently review the work of every PS every day.
CMC will continue to conduct periodic reviews and will implement a
Proof of Practice. In addition, CalHR should provide standardized
direction to all California Department of Corrections and Rehabilitation
(CDCR) institutions on the segregation of duties.
SCO’s Comment
The finding remains as stated. As discussed in the finding, our review
revealed conflicting staff tasks. We observed and CMC confirmed that the
Personnel Specialist’s duties include data entry, reconciliation, and
processing adjustments and corrections; and that the Staff Services
Manager I, who approves payroll transactions prior to input into the
system, had access and may key various transactions when the need arises
(see CMC’s response to Finding 2).
CMC’s response asserts the existence of segregation of duties among its
Custody Timekeeper, Personnel Assignment Office, and Personnel
Specialist. This separation of duties, as described by CMC, is not adequate
and does not mitigate the risk that errors, intentional or not, could occur
when the Personnel Specialist enters the data into the system, certifies
attendance, and processes payroll disbursements. Our review found no
indication that supervisors conduct periodic review of transactions entered
by the Personnel Specialists.
California Men’s Colony Payroll Process Review
-8-
CMC indicated that it is implementing corrective actions subsequent to
our review to address the deficiencies noted in this finding. We will follow
up at the next payroll review to ensure that the corrective actions were
adequate and appropriate.
In reference to CMC’s statement that CalHR should provide standardized
direction to all CDCR institutions on the segregation of duties, we
recognize the benefit of implementing standardized direction for CDCR
institutions; however, this responsibility falls on CDCR and its
institutions. The State Leadership Accountability Act (GC sections 13400
through 13407) gives the heads of state agencies responsibility for the
establishment and maintenance of a system of internal control. The Act
requires the involvement of all levels of management of state agencies in
assessing and strengthening the systems of internal control.
CMC lacked adequate controls to ensure that only appropriate staff have
keying access to the State’s payroll system. Of the 21 employees whose
records we reviewed, four (19%) had improper keying access to the
system. CMC also improperly allowed other employees to input payroll
transactions into the system using the user credentials of one of the four
employees, who transferred to another state agency. If not mitigated, this
control deficiency leaves the payroll data at risk of misuse, abuse, and
unauthorized use.
The SCO maintains the State’s payroll information system. The system is
decentralized, thereby allowing employees of state agencies to access the
system. PPSD has established a Decentralization Security Program that all
state agencies are required to follow in order to access the payroll systems.
The program’s objectives are to secure and protect the confidentiality and
integrity of the data against misuse, abuse, and unauthorized use.
CMC had 21 employees with keying access to the State’s payroll system
at various times between July 1, 2012 and May 31, 2015. Of the 21
employees, two did not have their keying access immediately removed or
modified subsequent to transfer to another agency, or change in
classification. For example, a Personnel Specialist transferred to another
state agency in April 13, 2015. However, the request to delete the
employee’s access was not made until May 28, 2015. In addition, this same
employee provided her user identification and password to her supervisor
prior to transferring.
Between April 13, 2015, and May 28, 2015, the CMC supervisor allowed
access to the payroll system by other CMC employees with the user
identification and password provided to key payroll and payroll-related
transactions, failing to follow guidelines set forth in the Decentralization
Security Program.
Also, one of the 21 employees was in a managerial position, which should
not have had keying access, and did not have a justification letter on file.
The manager is an approving official who often approves certain payroll
transactions prior to input into the system. The manager is also responsible
for reviewing the work of his or her staff. To properly segregate duties,
employees charged with approving transactions should not be able to input
the transactions that they approve.
FINDING 2—
Inappropriate
keying access to the
State’s payroll
system
California Men’s Colony Payroll Process Review
-9-
Further, one of the 21 employees had keying access while she was
appointed to a classification other than those allowed to have keying
access; however, CMC could not provide the required justification letter.
The employee had a classification change from Personnel Specialist to
Office Technician, then back to Personnel Specialist. However, the payroll
system access did not change during the time the employee was an Office
Technician, and no justification letter was on file.
The Decentralization Security Program manual states, in part:
The privilege to access the PPSD database poses a significant risk to the
ability for SCO to function. Therefore, privilege is restricted to persons
with a demonstrated need for such access. Currently… applications are
restricted to Personnel Services Specialists, and the Payroll Technician
classification because their need is by definition a function of their
specific job duties, and any change in those duties requires a reevaluation
of the need for access. If the employee’s duties change, such that the
need for access no longer exists, the access privilege MUST be removed
or deleted immediately by a request submitted by the department.
A request for an individual in a classification other than in the PSS/PST
series to access (the payroll system) requires a written justification from
the Personnel/Payroll Officer. The justification must describe the
individual’s specific job duties that require the need to each type of
information… as well as the level of access to that application, in order
to perform their Statutory and/or Constitutional duties.
Passwords are like credit cards—the owner is responsible for anything
for which his/her password is used. Therefore, as a matter of self-
protection, the password owner must:
1. NOT reveal their password to ANYONE.
2. NOT write down their password.
3. NOT log on to provide access/use by anyone.
4. NOT walk away from an active terminal session. Users must log off
(deactivate) terminals prior to leaving.
If anyone asks for a password, the owner MUST REFUSE to give it to
them and refer them to a supervisor/Security Monitor. Anyone who
knows that a password has been compromised should notify their
Security Monitor or the Decentralization Security Administrator
immediately.
The manual, as revised in January 2015, restricts manager classifications
to inquiry access only.
Recommendation
We recommend that CMC ensure that:
Keying access to the payroll system is updated/deleted after an
employee classification change or separation/transfer;
System access user identifications and passwords are not shared by
employees; and
The designated security monitor periodically reviews access to the
system to determine that access is in accordance with the
Decentralization Security Program.
California Men’s Colony Payroll Process Review
-10-
CMC failed to implement controls to ensure that it adheres to the
requirements of collective bargaining agreements and state regulations to
limit the accumulation of vacation and annual leave credits, and that it
processes authorized leave buy-backs only. The control deficiencies
resulted in a liability for excessive leave credits that could cost the State at
least $1,255,124 as of May 31, 2015, which is expected to increase if CMC
does not take action to address the excessive vacation and annual leave
credits; and improper leave buy-back totaling $7,691.
Excessive leave balances
Collective bargaining agreements and state regulations limit the amount
of vacation and annual leave that most state employees may accumulate to
no more than 80 days (640 hours). The limit on leave balance serves as a
tool for state agencies to manage leave balances and control the State’s
liability for accrued leave credits. State agencies may allow employees to
carry a higher balance only on limited exceptions. For example, an
employee may not be able to reduce accrued vacation or annual leave
hours below the limit because of business needs. When an employee’s
leave accumulation exceeds or is projected to exceed the limit, state
agencies should work with the employee to develop a written plan to
reduce leave balances below the applicable limit.
Our review of the leave accounting records found that, as of May 31, 2015,
CMC had 95 employees whose vacation or annual leave balances
exceeded the limit set by applicable collective bargaining agreements and
state regulations. For example, one employee had an accumulated balance
of 1,914 hours in annual leave, or 1,274 hours beyond the 640-hour limit.
Collectively, the 95 employees accumulated more than 30,900 hours in
excess vacation and annual leave, costing at least $1,255,124 as of May
31, 2015. This estimated liability does not adjust for salary rate increases
and additional leave credits.1 Accordingly, we expect that the amount
needed for the liability would be higher. For example, a CMC employee
separated from state service with 2,484 hours in leave credits, including
1,298 hours in annual leave. After adjusting for additional leave credits,
the employee should have been paid for 2,960 hours, or 19% more.
When we discussed this issue with the personnel office staff, they
indicated that CMC did not have any plans in place during the review
period to address excessive vacation and annual leave credits in
accordance with collective bargaining agreements and state regulations.
1 Most state employees receive pay rate increases every year pursuant to state laws or collective bargaining agreements,
until the employee reaches the top of the pay scale or is promoted to a position with a higher pay scale. Also, when
projecting accumulated leave balances upon separation, an employee earns additional leave credits equal to the
amount the employee would have earned had the employee taken time off and not separated from state service.
FINDING 3—
Inadequate
controls over leave
balances, resulting
in liability for
excessive credits
and improper buy-
back
California Men’s Colony Payroll Process Review
-11-
The following table shows the annual change during our review period in
the number of employees with vacation and annual leave balances
exceeding the 640-hour limit, and the total vacation and annual leave hours
in excess of the 640-hour limit.
As of
Total number
of employees
Year-to-year
percentage
increase
(decrease)
Total number
of hours
Year-to-year
percentage
increase
(decrease)
July 1, 2012 99 N/A 26,723 N/A
June 30, 2013 115 16% 33,826 27%
June 30, 2014 113 (2%) 34,123 1%
May 31, 2015 95 (16%) 30,901 (9%)
Employees with vacation or
annual leave balance exceeding
640 hours
Vacation and annual leave hours
in excess of the 640-hour limit
If CMC does not take action to reduce the excessive leave, the liability for
accrued vacation will likely increase because most employees will receive
salary increases, additional leave credits, or have other non-compensable
leave credits that they can use instead of vacation or annual leave,
increasing their vacation or annual leave balances. In addition, the state
agency responsible for paying these leave balances could also face a cash
flow problem if a significant number of employees with excessive
vacation or annual leave balances separate from state service. Normally,
state agencies are not budgeted to make these lump sum payments.
However, the State’s current practice dictates that the state agency that last
employs an employee pays for that employee’s lump sum separation
payment, regardless of where the employee accrued the leave balance.
Improper leave buy-back
GC section 19839 allows employees to receive cash for applicable leave
credits when separating from state employment. In addition, Title 2,
California Code of Regulations, section 599.744 provides that CalHR may
authorize an annual leave buy-back for employees who are excluded from
collective bargaining, such as managers and supervisors. Leave buy-back
allows employees to receive cash payment in exchange for applicable
leave credits, such as vacation leave, annual leave, personal leave,
personal holiday, or holiday credit. CalHR indicated that the authorized
leave buy-back was available to excluded employees during fiscal year
(FY) 2006-07 and FY 2013-14 through FY 2016-17.
Our review of overtime payments found that CMC improperly bought
back a total of $7,691 in leave credits for one supervisor when she moved
to another facility. The leave buy-back payments included $4,882 for 166
hours of annual leave and $2,809 for 96 hours of holiday credits and excess
hours. These payment transactions occurred in October and November
2012 without CalHR authorization.
The SCO’s Payroll Procedures Manual provides specific coding that state
agencies should use when processing leave buy-back transactions. By
keying leave buy-back transactions as overtime payments instead of
keying them as leave buy-backs, CMC personnel office staff circumvented
the state payroll system’s internal controls.
California Men’s Colony Payroll Process Review
-12-
Records indicated that the human resources analyst instructed the
personnel specialist to process the leave buy-back. CMC personnel office
staff also stated that the personnel specialist lacked adequate experience at
that time.
Recommendation
We recommend that CMC implement controls, including existing policies
and procedures, to ensure that its employees’ vacation and annual leave
balances are maintained within levels allowed by collective bargaining
agreements and state regulations. If the State offers leave buy-back
programs, CMC should also participate in such programs if funds are
available.
We also recommend that CMC implement controls, including existing
policies and procedures, to ensure that unauthorized leave buy-back are
prevented. CMC also should establish controls:
Requiring personnel office staff to obtain documentation that specify
the authority for the leave buy-back and include appropriate
authorizing signatures;
Providing adequate supervisory review to ensure that personnel office
staff process only authorized and properly coded leave buy-back
transactions; and
Providing adequate training to responsible staff involved in leave buy-
back transactions to ensure that they understand the requirements
under state laws and regulation regarding leave buy-backs.
In addition, we recommend that CMC conduct ongoing monitoring of
controls to ensure that the controls are implemented and operating
effectively.
CMC lacked adequate controls over the accruals of employee holiday
credits. CMC improperly granted a total of 357 holiday credit hours in 48
(15%) of the 330 transactions reviewed, costing the State approximately
$8,852. Also, 138 holiday credit accrual transactions were entered a month
early in the system. If not corrected, this control deficiency leaves CMC
at risk of additional improper holiday credit accruals.
FINDING 4—
Inadequate
controls over
holiday credits,
resulting in
improper accruals
California Men’s Colony Payroll Process Review
-13-
Collective bargaining agreements and GC section 19853 specify the
number of hours of holiday credits an employee would receive per
qualifying holiday. In our review of 330 selected holiday credit
transactions recorded in the State’s leave accounting system, we found that
48 were improper, as shown in the following table:
Issues
Number of
Employees
Number of
Holiday
Credit
Transactions
Number of
Hours of
Improper
Holiday
Credits
Estimated Net
Cost to the
State as of
May 31, 2015
Holiday credit entered twice in
the system
38 38 304 6,716$
Holiday credit granted on pay
period with no holidays
4 4 32 878
Holiday credit exceeded the
limit set by collective
bargaining agreements and
state law
5 5 6 633
Holiday credit used entered as
earned in the system
1 1 15 625
Total 48 48 357 8,852$
In addition, in 138 of the 330 holiday credit transactions, the accruals were
reflected in March 2013 instead of April 2013.
We found no indication the holiday credit transactions were reviewed by
an individual other than the payroll transactions unit staff responsible for
keying these transactions into the system.
Recommendation
We recommend that CMC:
Conduct a review of the leave accounting system to ensure that the
accrual of holiday credits complies with collective bargaining
agreements and state law;
Correct any improper holiday credit accruals in the leave accounting
system;
Implement adequate oversight to ensure accurate recording of holiday
credits; and
Provide training to staff involved in keying transactions into the leave
accounting system to ensure they understand the collective bargaining
agreements and state law regarding holiday credits.
CMC lacked adequate controls over overtime compensation. If not
corrected, the control deficiency also leaves CMC at risk of granting
additional improper payments.
Payroll records showed that CMC processed more than 70,000 overtime
payments between July 2012 and May 2015. We reviewed 21 selected
overtime payments and found that six of them were improper, which
resulted in overpayments to six employees totaling $2,308. CMC indicated
that the improper payments resulted from the payroll transactions unit staff
processing the payments even though the employees were not eligible to
receive overtime compensation. We found no indication that the overtime
FINDING 5—
Inadequate
internal controls
over overtime
compensation,
resulting in
improper
payments
California Men’s Colony Payroll Process Review
-14-
payments were reviewed by an individual other than payroll transactions
unit staff responsible of keying the transaction into the system.
The six employees, who belonged to Work Week Group E, included three
who were subject to the collective bargaining agreement between the State
and Bargaining Unit 19 and three who were excluded from collective
bargaining. The collective bargaining agreement between the State and
Bargaining Unit 19, section 6.1.B states, in part:
. . . . Work Week Group “E” includes classes that are exempted from
coverage under the FLSA because of the “white-collar” (administrative,
executive, professional) exemptions. . . . Work Week Group “E” applies
to classes and positions with no minimum or maximum number of hours
in an average workweek. Exempt employees are paid on a “salaried”
basis, and the regular rate of pay is full compensation for all hours
worked to perform assigned duties. . . .
. . . . The salary paid to FLSA exempt employees is full compensation
for all hours worked.
FLSA-exempt employees are not authorized to receive any form of
overtime compensation, whether formal or informal. . . .
CalHR’s California State Civil Service Pay Scales, section 10, includes
provisions similar to the collective bargaining agreement.
GC sections 13402 and 13403 mandate state agencies to establish and
maintain internal controls, including a system of authorization and an
effective system of internal review. State agencies are also responsible for
ensuring that these controls are functioning as prescribed. However, as
described, CMC lacked adequate controls to ensure that only overtime
payments that comply with the collective bargaining agreement and state
policy are processed.
Recommendation
We recommend that CMC conduct a review of overtime payments during
the past three years to ensure that the payments comply with collective
bargaining agreements and state policy. CMC should recover
overpayments made to employees through an agreed-upon collection
method in accordance with GC section 19838.
To prevent improper overtime payments from recurring, CMC should
establish adequate internal controls to ensure that overtime payments
comply with collective bargaining agreements and state policy. The
controls include providing adequate supervisory oversight of payroll
transactions unit staff.
California Men’s Colony Payroll Process Review
-15-
CMC lacked adequate controls to ensure that the payroll transactions unit
staff processes only valid and authorized physical fitness incentive pay
that complies with state policies. CMC, as a result, made a total of $1,040
in improper payments for physical fitness incentive pay. If not mitigated,
the control deficiencies also leave CMC at risk of additional improper
payments.
CalHR’s California State Civil Service Pay Scales, section 14, Pay
Differential 108, grants employees physical fitness incentive pay if they
meet the requirements to receive the pay. Pay Differential 108 requires
employees in the eligible classifications to have 60 or more qualifying pay
periods of state service in Bargaining Unit 6 and an annual physician’s
certification of having successfully passed a physical fitness exam. CDCR
policies also state that if an employee is on worker’s compensation, the
employee is entitled to continue to receive the pay differential, even if the
annual certification is expired. Once the employee returns to work, the
employee must submit an annual physician’s certification within 120 days
to continue to receive the pay differential. If the employee does not submit
the certification within the 120 days, the employee is no longer entitled to
the pay differential until a new certification is submitted.
Payroll records showed that CMC granted physical fitness incentive pay
to more than 1,000 employees between July 2010 and May 2015. Of the
10 employees whose records we reviewed, one did not have a valid
physical fitness certification on file for the period of July 1, 2012, through
June 30, 2013, during which time the employee continued to receive the
pay differential. The employee was on worker’s compensation prior to
July 1, 2012, and returned to work on July 12, 2012. The employee did not
submit a new certification until July 1, 2013. Therefore, the employee was
improperly compensated for the pay differential for pay periods from
November 2012 (120 days, or four months after returning to work) through
June 2013. The employee was improperly compensated for eight pay
periods at $130 per pay period, for a total of $1,040.
Recommendation
We recommend that CMC conduct a review of physical fitness incentive
pay during the past three years to ensure that the payments comply with
state policies. It should recover overpayments made to employees through
an agreed-upon collection method in accordance with GC section 19838.
We also recommend that CMC establish adequate internal controls to
ensure that payments comply with state policies and to prevent improper
payments. These controls should include:
Requiring payroll transactions unit staff to verify that payments are
granted only to eligible employees;
Providing adequate oversight to ensure that payroll transactions unit
staff processes only valid and authorized payments; and
Providing training to responsible staff involved in processing payment
transactions to ensure that they understand the requirements under
state policies.
FINDING 6—
Inadequate
internal controls
over physical
fitness incentive
pay, resulting in
improper
payments
California Men’s Colony Payroll Process Review
-16-
CMC lacked adequate controls over the processing of employee separation
lump-sum pay. Of the 15 employees whose records we reviewed, four
(27%) were improperly paid, resulting in a net total overpayment of $175.
If not corrected, the control deficiency leaves CMC at risk of granting
additional improper payments.
Pursuant to collective bargaining agreements and state law, employees are
entitled to receive cash for accrued eligible leave credits when separating
from state employment. Payroll records indicated that CMC had processed
separation lump-sum pay for 421 employees between July 2012 and May
2015. We reviewed records of 15 selected employees who received lump-
sum payments due to separation from state employment. Of the 15
employees, four were improperly paid. Two employees were overpaid by
a total of $763 and two employees were underpaid by a total of $588.
These improper payments resulted from miscalculation of the employees’
accrued leave credits by the payroll transactions unit staff. We found no
indication that an authorized individual reviewed the processing of these
lump-sum payments.
Recommendation
We recommend that CMC:
Establish adequate controls to ensure accurate calculation and
payment of employee separation lump-sum pay;
Conduct a review of employee separation lump-sum payments during
the past three years to ensure that the payments are accurate and in
compliance with collective bargaining agreements and state law; and
Recover overpayments made to separated employees in accordance
with GC section 19838 and State Administrative Manual (SAM)
section 8776.6, and properly compensate those employees who were
underpaid.
CMC lacked adequate controls over salary advances to ensure that they
are collected in accordance with state law and policies. At May 31, 2015,
CMC had $3,746 in salary advances that had been outstanding for over
120 days. The longest outstanding was one year and nine months. The
control deficiency leaves CMC at risk for additional uncollectable salary
advances.
GC section 19838 and SAM section 8776.7 allow CMC to collect salary
advances in a timely manner. At May 31, 2015, CMC’s accounting records
showed 12 outstanding salary advances totaling $26,357, including two
balances totaling $3,746 that had been outstanding for more than 120 days.
Generally, the prospect of collection diminishes as an account ages. When
an agency is unable to collect after three years, the possibility of collection
is remote.
FINDING 7—
Inadequate
controls over
employee
separation lump-
sum pay, resulting
in improper
payments
FINDING 8—
Inadequate
internal controls
over salary
advances, resulting
in a failure to
recover
outstanding
accounts
California Men’s Colony Payroll Process Review
-17-
In our review of the two salary advances totaling $3,747 that were over
120 days old, we found that:
For the first outstanding balance of $2,070 issued on August 30, 2013,
documentation provided by CMC indicated attempts to collect the
outstanding salary advance began six months after the date of the
issuance. No collection letters were sent to the recipient of the salary
advance. Collection to reduce the balance began on July 23, 2015.
For the second outstanding balance of $1,676 issued on December 15,
2009, documentation provided by CMC indicated that the first
collection letter was sent to the recipient of the salary advance on
June 5, 2012, two and a half years later. The balance remains
outstanding.
The lack of adequate controls over salary advances increases the risk of
financial loss, reduces the likelihood of collection, increases the amount
of resources expended on collection efforts, and negatively impacts cash
flow.
Recommendation
We recommend that CMC ensure that salary advances are recovered in a
timely manner pursuant to GC section 19838 and SAM section 8776.7. If
all reasonable collection procedures do not result in payment, CMC may
request discharge from accountability of uncollectable amounts.
CMC’s Response
CMC diligently strives to timely clear salary advances. In addition,
CDCR has adequate control over the salary advances. All salary
advances are downloaded onto the BIS Salary Advance Aging Report
system, which is overseen by BIS and Regional Accounting Office
(RAO) staff. The report is reviewed and monitored and sent to the
institution monthly to process and return. The report is monitored by the
supervisor to ensure salary advances are cleared in a timely manner.
There is an explanation for the two outstanding salary advances
mentioned in the audit report for CMC. The employee, who was issued
a salary advance for the amount of $2,070.00, was under investigation
by the Office of Internal Affairs. Personnel was instructed by the Hiring
Authority not to notify the employee of the outstanding salary advance
until the investigation was concluded. Once the investigation was
concluded, the advance was cleared. The second outstanding salary
advance for the amount of $1,676.00 was issued on 12/15/2009. An error
was made whereby the employee received both the salary advance and
warrant. Once discovered, accounting requested a copy of the cashed
salary advance, which resulted in the employee owing money. Due to the
employee separating, the salary advance was sent to RAO for
collections. It was later discovered the employee had never been notified.
The notice was later sent and downloaded onto the BIS Aging Report
system. His current balance is $1,279.21; RAO has submitted a request
to the Franchise Tax Board for 2014, 2015, 2016, and 2017 tax collection
and reimbursement to CDCR.
California Men’s Colony Payroll Process Review
-18-
SCO’s Comment
The finding remains as stated. As discussed in the finding, our review
found that CMC lacked adequate controls over salary advances to ensure
that they are collected in accordance with state law and policies. CMC
confirmed this deficiency by stating that for one salary advance, the
employee received both the salary advance and warrant, and the employee
was never notified of the outstanding salary advance. For another salary
advance, CMC stated that the employee was under investigation and the
Personnel Office was instructed not to notify the employee about the
outstanding salary advance until after the investigation was concluded.
During the review, it was unclear to us when the investigation had started.
However, our review of available documentation indicated that the earliest
efforts to determine the status of the outstanding salary advance began six
months after the date of issuance.
California Men’s Colony Payroll Process Review
Attachment—
California Men’s Colony’s Response to Draft Review Report
State Controller’s Office
Division of Audits
Post Office Box 942850
Sacramento, CA 94250-5874
http://www.sco.ca.gov
S16-PAR-9000