follow-up of ghost employee audit

111

Karen E. Rushing Clerk of the Circuit Court and County Comptroller Office of the Inspector General Sarasota County, Florida

Follow-up Of Ghost Employee Audit November 2015 Original audit report issued August 2014

1 | F o l l o w ‐ u p o f G h o s t E m p l o y e e A u d i t N o v e m b e r 2 0 1 5

Contents

Summary and Results 2 Closed Conditions and Follow‐up Results 4 Appendix A Original Audit Report dated August 2014 7

Audit Services

David Beirau, CFE, CIGA Director of Internal Audit and Inspector General

Lead Auditor Jody Maxwell, CPA, CIA, CFE, CIGA, CIGI Senior Internal Auditor/Investigator

Please address inquires regarding this report to David Beirau, by e‐mail at [email protected] or by telephone at (941) 861‐5280. This and other reports prepared by the Office of the Inspector General are available at www.SarasotaClerk.com/Comptroller Services/Internal Audit.


Summary and Results

Background

The purpose of the August 2014 Ghost Employee Audit was to evaluate the effectiveness of

internal controls over data processing and maintenance of employee information in the Human

Resources Capital Management System (HCMS), specifically as it related to preventing the

creation of ghost employees. The scope of the audit included all documented Sarasota County

Board of County Commissioners (BOCC) employees that were employed or terminated between

October 1, 2013, and June 30, 2014 (audit period).

The original audit report concluded that the Office of Human Resources lacked adequate:

Policies and procedures to ensure the proper authorization and approval of time cards

in the time keeping system (KRONOS).

Segregation of duties over data entry in the HCMS system.

Authorization of changes being made to personnel data.

Communication of payroll changes from the HR department to the Finance Department.

Segregation of duties over persons permitted to pick up physical pay checks.

Objectives

The objectives of this follow‐up audit were to evaluate the current status of observations

reported on the Ghost Employee Audit, dated August 2014, and corrective actions initiated by

responsible management. This was achieved through independent, objective analysis to

provide reasonable assurance that the previous concerns have been addressed and appropriate

corrective measures implemented.

To meet the objectives of the follow‐up audit, the following procedures were performed:

Performed inquiries of Human Resources personnel.

Obtained an understanding of changes made within the Office of Human Resources, the

Sarasota County Government Human Resources Procedures and Guidelines, and the

Office of Human Resources Internal Standard Operating Procedures (SOPs) since the

original audit report.


Determined through walk‐thru of procedures and review of supporting documentation

that revised policies and procedures effectively addressed the opportunities for

improvement noted in the original report.

Overall Results

Based on the results of our follow‐up audit procedures, responsible management has

addressed all three conditions identified in the original audit report. These items are further

described in the report and include:

Condition Status

A. Lack of Approval and Authorization of Time Cards in the Kronos system Closed

B. Ineffective Internal Controls Over Data Entry Closed

C. Segregation of Duties Over Physical Pay Check Pick Up Closed


Closed Conditions and Follow-up Results A. Lack of Approval and Authorization of Time Cards in the Kronos System.

No written processes and procedures are in place to ensure that Department Supervisors and Managers are approving time cards.

Current Status, Follow‐Up Audit dated August 2015: HR internal Standard Operating Procedures (SOPs) were revised. At the close of every pay period Kronos is reviewed for time card approval by the Kronos Manager. Responsible parties receive an email reminder between 9:00 am – 11:00 am on the Kronos due date. This follow‐up procedure has been in place since September 2014. On April 27, 2015, Directors and Managers were reminded of their time card approval responsibilities via email by the Director of Human Resources. Going forward, one‐on‐one overview of Kronos functionality and responsibility will occur with new Kronos Managers. Directors and department supervisors completed Kronos refresher training that was provided April ‐ August 2015. HR Procedures were revised on July 16, 2015. Procedure #8.02 addresses recording time worked and approval procedures. The Auditor observed through walk‐thru of procedures, that Human Resources is weekly tracking and reminding managers/supervisors who have not properly approved employee time cards to complete the appropriate review by the stated deadline. The pay periods ending September 04, 2015 and September 18, 2015 reported 100 percent compliance with timely submission of Kronos Time card Approval. Reviewed the Power Point Presentation used to provide the refresher course and documentation to support that all Managers and Supervisors attended as of July 24, 2015. Original Audit Observation, Report dated August 2014: Within the Kronos time card report for the pay period ended June 14, 2014, approval was not documented for 86 of the 1,923 employees included in the report. Currently, there is no process in place for HR staff to review time cards for authorization. This lack of oversight creates an opportunity to inflate hours, log unapproved overtime, and assign hours to an inactive employee. Original Recommendations, Report dated August 2014: Document responsibilities for approving time cards and the process and procedures used to ensure that those responsibilities are being met. Implement a process for HR to review time cards for proper authorization and follow up with those responsible who have not approved hours in the system in a timely manner. Those responsible should be held accountable for failure to authorize time in the system. The County should also ensure that the personnel authorizing staff time in Kronos is at the appropriate supervisory level.


B. Ineffective Internal Controls Over Data Entry

Current internal controls in place over data entry in the HCMS system, authorization of changes being made to personnel data, and the communication of payroll changes to the Finance Department are ineffective.

Current Status, Follow‐Up Audit dated August 2015: HR internal Standard Operating Procedures (SOPs) for New Hire Personnel Action were updated to reflect the collection of 3 signatures including:

a. Preparer ‐ HR Staff member who initiates the hiring process on behalf of department and does not perform new hire entry.

b. Data Entry ‐ HR Staff member who is not the a. Preparer, or c. Reviewer. c. Reviewer ‐ HR Management or HR designee who is not a. Preparer, or b. Data Entry.

This procedure has been active since December 27, 2014. The auditor judgmentally selected 10 Personnel Action forms and verified the appropriate signatures of the Preparer, Reviewer and Data Entry Operator were designated and identified on the forms. Additionally, it was noted that the Reviewer of the Personnel Action Forms was permitted view only access in the HCMS application. Original Audit Observation, Report dated August 2014: Currently, the Senior HR Assistant is in charge of reviewing Personnel Action forms and communicating any changes to the Finance Department. The Personnel Action (PA) form includes a signature line for a preparer and a reviewer. Instances were noted in which the Senior HR Assistant physically signed the preparers name on the Personnel Action form and also signed off as reviewer. In these instances, an electronic signature was included in the document to indicate that there was a preparer separate from the reviewer; however, this preparer did not physically sign the document. Physical signatures are an important part of the control process, as the Senior HR Assistant position has the application security access to edit, add or delete information within the HCMS system. In addition, this Senior HR Assistant is authorized to submit documentation to payroll for the creation of a new employee in the IFAS system. Original Recommendations, Report dated August 2014: The County should require two physical signatures for each Personnel Action form authenticated by two separate employees: a preparer and a reviewer. To mitigate the risk of overridden controls, the County should restrict access to view only in the HCMS application for the representative in charge of reviewing the Personnel Action forms and submitting them to the Finance Department. By restricting access and formalizing the segregation of duties, the County is mitigating the risk that an unauthorized ghost employee will be paid or go undetected.


C. Segregation of Duties Over Physical Pay Check Pick Up

Supervisors who are responsible for authorizing or communicating the termination of their staff are not restricted from picking up physical pay checks.

Current Status, Follow‐Up Audit dated August 2015: In December 2015 employees who were previously having their pay check picked up and delivered by their supervisor, were notified by written correspondence of 3 options for pay check receipt ‐

1. Direct deposit. 2. Pick‐up in HR during normal business hours, on pay day. Employees must sign for

the check and show photo id. 3. Mailing of the check on Thursday afternoon prior to payday to the address printed

on the pay check. Employees who did not elect an option received their paycheck in the mail. The auditor observed a copy of the letter mailed to the impacted employees. Additionally, the auditor observed through walk thru of the procedures that the manual checks were mailed and distributed for pay‐period ending September 4, 2015. These actions were found to be in accordance with the revised HR Internal Standard Operating Procedures for Pay Check Distribution. Original Audit Observation, Report dated August 2014: Currently, employees receiving manual pay checks can authorize another individual to pick up their check and deliver it to their work site. Due to the direct reporting relationship that may exist, it is possible that when an employee separates from the County this information may not be communicated timely since the individual responsible for communicating the status change may have physical access to the terminated employee’s paycheck. Original Recommendations, Report dated August 2014: In the case of an employee authorizing a supervisor to pick up their check, this individual should not have the authority to approve and communicate personnel changes to HR. The authority to initiate personnel changes and access to the manual pay check creates an incentive to conceal information. The County should restrict physical access to employee paychecks to the person the check is made out to.


Appendix A

Following is the original

Ghost Employee Audit

dated August 2014.

Audit Services

Ghost Employee Audit

Karen E. Rushing Clerk of the Circuit Court and County Comptroller

Jeanette L. Phillips, CPA, CGFO, CIG Director of Internal Audit and Office of the Inspector General

Audit Team David Beirau, CFE, CIGA

Senior Internal Auditor/Investigator William Bousman

Internal Auditor/Investigator

Kerkering, Barberio & Co. Certified Public Accountants

Patricia J. Entsminger, CPA, CFE, CIA Mandi Someson, CPA, CFE, CIA

Heather Coonradt, CFE

August 2014

KAREN E. RUSHING Clerk of the Circuit Court and County Comptro l le r

Audit Services – Clerk of the Circuit Court and County Comptroller Page 2

TABLE OF CONTENTS Page Summary and Results 3 Opportunities for Improvement and Management Response 6

Appendix A: Sampling Results 9


Summary and Results The Clerk of the Circuit Court and County Comptroller’s Internal Audit Department and Office of the Inspector General has completed a County-wide Ghost Employee Audit. The audit was planned and conducted in accordance with Generally Accepted Government Auditing Standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. The purpose of this audit was to evaluate the effectiveness of internal controls over data processing and maintenance of employee information in the Human Resource Capital Management System (HCMS), specifically as it relates to preventing the creation of ghost employees. The scope of this audit includes all documented Sarasota County Board of County Commissioners (BOCC) employees that were employed or terminated between October 1, 2013 and June 30, 2014 (audit period). Background Salary expenditures for BOCC employees exceeded $108 million in the Sarasota County Adopted Budget for Fiscal Year 2013 - 2014. Since salaries and benefits constitute nearly 10% of the County’s total adopted budget it may be an area of interest to defraud the County for illicit gain. The Human Resources (HR) Department is comprised of six divisions offering a variety of services. These services include (1) Work Force Planning, (2) Data Management and Analysis, (3) Employee and Labor Relations, (4) Training and Development, (5) Employee Wellness and Benefits, and (6) Safety and Risk Management. From these divisions, Work Force Planning and Data Management and Analysis personnel work together to process new hires, terminations, promotions, reclassifications, and a variety of other functions that require careful management of sensitive personnel data, such as social security numbers, birthdates, home addresses, hiring dates, pay rates and bank account information. The Finance Department is responsible for processing payroll utilizing data provided by the HR office and electronic time sheets exported from Kronos, the County Payroll time keeping application. Ghost employees are individuals included in the payroll register, who are not providing services, but who are receiving a payroll check or direct deposit. Generally, there are two types of ghost employees. The first type is the completely fictitious employee who is added to the payroll, the second type is a former employee that remained on the payroll after terminating from the Organization. According to the Association of Certified Fraud Examiners’ 2014 Report to the Nation on Occupational Fraud and Abuse, payroll fraud accounts for 8.2% of fraud cases that occur within organizations that employ more than 100 employees. These statistics indicate that, without proper controls in place, the ability to conduct a payroll fraud scheme should be evaluated for Sarasota County.


Objectives, Scope and Methodology The objectives of this audit were to determine if internal controls are operating effectively related to data processing and maintenance of employee information in the HCMS software application to prevent the falsification of personnel or payroll records to generate ghost employees. More specifically, the audits objectives were to:

Obtain reasonable assurance that there are controls in place to prevent the creation of ghost employees.

Determine if time and attendance records are properly completed, reviewed, and approved for payroll processing in a timely manner.

To meet the objectives of the audit, the procedures performed included, but were not limited to, the following:

Performed inquiries of County and Finance Department personnel.

Reviewed HR policies and procedures and information on the County’s intranet site related to new hire on-boarding, terminations and changes to active employees’ payroll.

Obtained a complete database of BOCC employees maintained in HCMS software from the HR Data Management and Analysis manager and cross-referenced the population to the BOCC employee database maintained by the Finance Department in IFAS, the Accounting software used for payroll processing. The two populations were cross-referenced using a data analytic tool to determine if there were employees that appeared in one population but not the other.

Identified any employees that have duplicate addresses within each population of the HCMS and IFAS databases using a data analysis tool. These employees were compared to the employee phone directory, on the County’s intranet site, to ensure that the employee existed. Also, the employee’s department and supervisor were reviewed to ensure that employees who co-habitate are not in a position to authorize or conceal payroll information for one another.

Using a data analytic tool, identified employees that are directing payroll funds to the

same direct deposit account as another employee. For employees identified, personnel and payroll files were reviewed to verify the deposits and accounts were authorized and to substantiate each employees’ existence as a BOCC employee.

Utilized a data analysis tool to compare terminated employees to the May 16, 2014

payroll register. Personnel files were reviewed for each terminated employee that appeared in the payroll register to verify evidence of separation (i.e. resignation letter, approval for retirement by the State of Florida). In addition, payroll files were reviewed to ensure that the status of these employees was changed to inactive and they had not been receiving unauthorized pay.

Reviewed time cards in Kronos for the pay period ended June 14, 2014 to ensure proper

authorization.


Overall Results Based upon the results of procedures performed, there were no instances of ghost employees identified. However, opportunities for internal control improvements relating to segregation of duties over data processing and maintenance of employee information did appear. Additionally, there are processes that lack documented Standard Operating Procedures. The Opportunities for Improvement section of this report discusses these results and recommendations in detail. The following summarizes the result of the audit:

Lack of Approval and Proper Authorization of Time Cards in the Kronos System – The County currently has no written procedures requiring Supervisors to approve and authorize their staff’s time card report. Additionally, HR does not have a formal process in place to review time cards for proper authorization and to follow up on missing approvals.

Ineffective Internal Controls Over Data Entry - Current internal controls in place over data entry in the HCMS system, authorization of changes being made to personnel data, and the communication of payroll changes to the Finance Department are ineffective.

Segregation of Duties Over Physical Pay Check Pick Up – Certain employees within the

County have requested a manual payroll check as an alternative to direct deposit. These employees will either pick up their checks themselves or authorize someone else to retrieve them.


Opportunities for Improvement and Management Response The audit disclosed that procedures and practices could be improved. The audit was neither designed nor intended to be a detailed study of every relevant system, procedure, or transaction. Accordingly, the Opportunities for Improvement presented in this report may not be all-inclusive of areas where improvement may be needed. Observations and recommendations were made in the following areas:

A. Lack of Approval and Authorization of Time Cards in the Kronos System B. Ineffective Internal Controls Over Data Entry C. Segregation of Duties Over Physical Pay Check Pick Up

A. Lack of Approval and Authorization of Time Cards in the Kronos System.

No written processes and procedures are in place to ensure that Department Supervisors and Managers are approving time cards.

Observation Within the Kronos time card report for the pay period ended June 14, 2014, approval was not documented for 86 of the 1,923 employees included in the report. Currently, there is no process in place for HR staff to review time cards for authorization. This lack of oversight creates an opportunity to inflate hours, log unapproved overtime, and assign hours to an inactive employee. Recommendation Document responsibilities for approving time cards and the process and procedures used to ensure that those responsibilities are being met. Implement a process for HR to review time cards for proper authorization and follow up with those responsible who have not approved hours in the system in a timely manner. Those responsible should be held accountable for failure to authorize time in the system. The County should also ensure that the personnel authorizing staff time in Kronos is at the appropriate supervisory level. Management Response HR Management concurs that there should be a process and procedure to ensure that time cards are approved. Currently all employees receive an email reminder at the end of a pay period to approve their time card and new employees receive training on the first day of employment for Kronos including instructions to approve time. HR will focus most of our efforts on supervisor approval including refreshers and HR follow-up procedures at the end of the pay period.

1) Revise HR internal Standard Operating Procedures (SOPs) to include staff review and follow-up on unapproved time-cards prior to close of pay period. Review for trends within the departments and provide additional training and follow up as necessary. Expected completion December 31, 2014.

2) Provide refresher training for time card procedures including approvals to department supervisors. Expected completion August 31, 2015.


3) Add language to HR Procedures outlining time card approval procedures. Expected completion March 31, 2015.

B. Ineffective Internal Controls Over Data Entry

Current internal controls in place over data entry in the HCMS system, authorization of changes being made to personnel data, and the communication of payroll changes to the Finance Department are ineffective.

Observation Currently, the Senior HR Assistant is in charge of reviewing Personnel Action forms and communicating any changes to the Finance Department. The Personnel Action (PA) form includes a signature line for a preparer and a reviewer. Instances were noted in which the Senior HR Assistant physically signed the preparers name on the Personnel Action form and also signed off as reviewer. In these instances, an electronic signature was included in the document to indicate that there was a preparer separate from the reviewer; however, this preparer did not physically sign the document. Physical signatures are an important part of the control process, as the Senior HR Assistant position has the application security access to edit, add or delete information within the HCMS system. In addition, this Senior HR Assistant is authorized to submit documentation to payroll for the creation of a new employee in the IFAS system. Recommendation The County should require two physical signatures for each Personnel Action form authenticated by two separate employees: a preparer and a reviewer. To mitigate the risk of overridden controls, the County should restrict access to view only in the HCMS application for the representative in charge of reviewing the Personnel Action forms and submitting them to the Finance Department. By restricting access and formalizing the segregation of duties, the County is mitigating the risk that an unauthorized ghost employee will be paid or go undetected. Management Response HR concurs with this recommendation. In order to reduce the risk that an unauthorized ghost employee could be submitted to Payroll for data entry and payment without detection, we will implement the following changes to our New Hire Personnel Action procedures (SOP’s) by March 31, 2015.

1) There will be 3 HR signatures on new hire appointment PA’s. a. Preparer – HR Staff member who initiates the hiring process on behalf of

department and does not perform new hire entry. b. Data Entry – HR Staff member who is not the a. Preparer or c. Reviewer. c. Reviewer - HR Management or HR designee who is not a. Preparer or b. Data

Entry. 2) Revise Personnel Action form to include the new labeling. Signatures described as a.

Preparer and b. Data Entry above will appear on the left side and the signatures described as c. Reviewer will appear on the right side.


C. Segregation of Duties Over Physical Pay Check Pick Up

Supervisors who are responsible for authorizing or communicating the termination of their staff are not restricted from picking up physical pay checks.

Observation Currently, employees receiving manual pay checks can authorize another individual to pick up their check and deliver it to their work site. Due to the direct reporting relationship that may exist, it is possible that when an employee separates from the County this information may not be communicated timely since the individual responsible for communicating the status change may have physical access to the terminated employee’s paycheck. Recommendation In the case of an employee authorizing a supervisor to pick up their check, this individual should not have the authority to approve and communicate personnel changes to HR. The authority to initiate personnel changes and access to the manual pay check creates an incentive to conceal information. The County should restrict physical access to employee paychecks to the person the check is made out to. Management Response HR concurs that the release to supervisor process needs to end. We will implement new procedures for release to employee only by March 31, 2015. Employees will be notified that they have 3 options for pay distribution.

1) Direct deposit 2) Pick-up in HR within normal business hour, on pay day Friday. Employees must sign for

check and show photo id. 3) HR will mail check on Thursday afternoon with regular mail to address printed on pay

check. No response will result with the pay check being mailed.


Appendix A: Sampling Results Based upon the results of procedures performed, there were no instances of ghost employees identified. The following summarizes the sampling results from procedures performed:

The HCMS and IFAS populations were cross-referenced using a data analytic tool to determine if there were employees that appeared in one population but not the other.

Of the 2,239 employees maintained in the HCMS population, 24 employees did not

appear to have a match in IFAS. A review of supporting documentation reflected that 23 of the 24 employees were new hires that were not eligible for payroll and were properly excluded from IFAS. The remaining employee was a seasonal unpaid intern. HR personnel indicated that unpaid interns are communicated to the Benefits department for workers compensation requirements, but do not need to be communicated to the Finance Department or input into IFAS, as these employees are not paid. In addition, the employee personnel file was reviewed to confirm existence.

Of the 2,421 employees included in the IFAS population, 206 employees were not in

the HCMS population. One-hundred and sixty-eight (168) of the 206 exceptions were Supervisor of

Elections employees and should have been excluded from the original population since they are not BOCC employees and are not part of this audit.

Twenty-five (25) of the 206 exceptions are employees who had been terminated; however, this information was not communicated to the Finance Department. Information in the IFAS system was reviewed to ensure that employees were inactive and had not been receiving unauthorized pay.

Nine (9) of the 206 exceptions had recently been identified as full time employees during an IRS audit; they had previously been treated as independent contractors which are not maintained by HR in the HCMS system. These nine (9) employees were added to IFAS as a one-time occurrence to process payroll taxes.

Four (4) of the 206 exceptions are State employees who only receive a monthly cell phone stipend from the County. Therefore, they are not maintained by HR in the HCMS system but are included in IFAS so the stipend can be paid.

Identified any employees that have duplicate addresses within each population of the

HCMS and IFAS databases using a data analysis tool. One-hundred and seventy (170) employees were identified as having an address that appeared more than once. Of the 170 identified, 135 were listed in the employee phone directory and 31 were

Supervisor of Elections employees and should have been excluded from the original population since they are not BOCC employees and are not part of this audit.

The remaining four (4) employee’s personnel files were reviewed substantiating their existence as a BOCC employee.


Using a data analytic tool, identified employees that are directing payroll funds to the same direct deposit account as another employee. There were 3,204 records tested within the May 16, 2014 payroll register and resulted in 661 duplicate direct deposit account numbers.

Of the 661 duplicate accounts, 601 pertained to group funds, specifically the Fire

Benevolent Fund and the Sarasota County Area Transit (SCAT) Union dues.

The remaining 60 duplicate account numbers pertained to 27 checking accounts and one (1) loan payback account in which 57 individuals direct their pay. Personnel and payroll files were reviewed to verify the deposits and accounts were authorized and to substantiate their existence as a BOCC employee.

Utilized a data analysis tool to compare terminated employees to the May 16, 2014

payroll register. Thirty-five (35) of the 169 employees that terminated between October 1, 2013 and June 18, 2014, appeared in this payroll register. Nine (9) of the 35 employees that appeared in the payroll register had a termination

date prior to May 16, 2014 but within the current pay period. Personnel files were reviewed for each of these employees to verify evidence of separation (i.e. resignation letter, approval for retirement by the State of Florida). In addition, payroll files were reviewed to ensure that the status of these employees was changed to inactive and they had not been receiving unauthorized pay.

Twenty-six (26) of the 35 employees terminated on or after the May 16, 2014 pay

period. These employees were cross-referenced to the June 14, 2014 payroll register to verify that they were removed from payroll. Seven (7) of the employees appeared in the payroll register, however, they had a termination date prior to June 14, 2014 but within the current pay period. Personnel files were reviewed for each of these employees to verify evidence of separation (i.e. resignation letter, approval for retirement by the State of Florida). In addition, payroll files were reviewed to ensure that the status of these employees was changed to inactive and they had not been receiving unauthorized pay.

Reviewed time cards in Kronos for the pay period ended June 14, 2014 to ensure proper

authorization. Of the 1,923 employees included in the Kronos time card report for this pay period,

there was no evidence of review or approval of time in the system for 86 employees. In addition, due to the lack of formal policies, we were unable to test if the proper authorized individual was approving timecards.

follow-up of ghost employee audit

Documents