centralized payroll operations - denver · related to personnel action form processing performed by...

Dennis J. Gallagher

Auditor

Office of the Auditor

Audit Services Division

City and County of Denver

Centralized Payroll Operations Performance Audit

March 2010

The Auditor of the City and County of Denver is independently elected by the citizens of Denver. He is

responsible for examining and evaluating the operations of City agencies for the purpose of ensuring the

proper and efficient use of City resources and providing other audit services and information to City

Council, the Mayor and the public to improve all aspects of Denver’s government. He also chairs the

City’s Audit Committee and oversees the City’s Comprehensive Annual Financial Report (CAFR).

The Audit Committee is chaired by the Auditor and consists of seven members. The Audit Committee

assists the Auditor in his oversight responsibilities of the integrity of the City’s finances and operations,

including the integrity of the City’s financial statements. The Audit Committee is structured in a manner

that ensures the independent oversight of City operations, thereby enhancing citizen confidence and

avoiding any appearance of a conflict of interest.

Audit Committee

Robert Bishop Dennis Gallagher

Maurice Goodgaine Robert Haddock

Jeffrey Hart Bonney Lopez

Timothy O’Brien

Audit Staff

John Carlson, Deputy Director, JD, CIA, CICA

Chris Horton, Internal Audit Supervisor, MA

Anita Thompson, Lead Internal Auditor, CICA

Rebecca Corral, Senior Internal Auditor, CFE

You can obtain copies of this report by contacting us at:

Office of the Auditor

201 W. Colfax Avenue, Dept. 705 Denver CO, 80202

(720) 913-5000 Fax (720) 913-5026

Or view an electronic copy by visiting our website at:

www.denvergov.org/auditor

http://www.denvergov.org/auditor

To promote open, accountable, efficient and effective government by performing impartial reviews and other audit

services that provide objective and useful information to improve decision making by management and the people.

We will monitor and report on recommendations and progress towards their implementation.

City and County of Denver 201 West Colfax Ave., Dept. 705 Denver, Colorado 80202 720-913-5000 FAX 720-913-5247 www.denvergov.org/auditor

Dennis J. Gallagher

Auditor

March 18, 2010

Beth Machann, Controller

Department of Finance

City and County of Denver

Dear Ms. Machann:

Attached is the Auditor’s Office Audit Services Division’s report of its audit of City Payroll

Operations for the years 2008 and 2009. The purpose of the audit was to review internal quality

controls and various internal processes and to determine their adequacy.

The audit team found that the Division of Payroll Operations and Payroll Administration (Payroll

Division) can make some enhancements to its quality control practices. For example, the Payroll

Division should ensure that it maintains all relevant payroll files together, and that appropriate

quality control reviews of payroll data are performed. These reviews should specifically include

anti-fraud tests identified on pages 10 and 11 of the report. The audit team has also

documented some information-gathering improvements that can be made regarding personnel

action form processing and performance of separation audits.

I appreciate your concern that the Career Service Authority Rule 9-73 regarding snow closures

may be unclear. I am hopeful that the audit team’s findings regarding how vacation time was

used on snow closure days will lead to greater clarity in the Rule and better guidance in future

snow closure situations.

I am pleased with your response to our finding regarding supervisors who do not approve their

employees’ Kronos time cards. This is a critical quality control step, and supervisors who fail to

fulfill this responsibility should be held accountable for their lack of performance. Your proposed

action is a fine example of how good audit work and conscientious public servants can work in

tandem to create positive change for citizens of the City.

If you have any questions, please call Kip Memmott, Director of Audit Services, at 720-913-5029.

Sincerely,

Dennis Gallagher

Auditor

DJG/cnh


Ms. Beth Machann, Controller

March 18, 2010

Page Two

cc: Honorable John Hickenlooper, Mayor

Honorable Members of City Council

Members of Audit Committee

Ms. Roxane White, Chief of Staff

Mr. Claude Pumilia, Chief Financial Officer

Mr. David T. Roberts, Chief Services Officer

Mr. David Fine, City Attorney

Mr. L. Michael Henry, Staff Director, Board of Ethics

Ms. Lauri Dannemiller, City Council Executive Staff Director

Ms. Linda Misegadis, Director of Centralized Payroll

To promote open, accountable, efficient and effective government by performing impartial reviews and other audit

services that provide objective and useful information to improve decision making by management and the people.

We will monitor and report on recommendations and progress towards their implementation.

City and County of Denver 201 West Colfax Ave., Dept. 705 Denver, Colorado 80202 720-913-5000 FAX 720-913-5247 www.denvergov.org/auditor

Dennis J. Gallagher

Auditor

AUDITOR’S REPORT

We have completed our performance audit of City Payroll Operations. The purpose of the audit

was to examine and assess internal quality controls and various internal processes, and to

identify possible inefficiencies and opportunities for improvement.

This performance audit is authorized pursuant to the City and County of Denver Charter, Article

V, Part 2, Section 1, General Powers and Duties of Auditor, and was conducted in accordance

with generally accepted government auditing standards. Those standards require that we plan

and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis

for our findings and conclusions based on our audit objectives. We believe that the evidence

obtained provides a reasonable basis for our findings and conclusions based on our audit

objectives.

The audit revealed that the Division of Payroll Operations and Payroll Administration (Payroll

Division) can improve certain internal quality control areas. These include ensuring audits of data

entry are performed, ensuring appropriate application of rules regarding leave during

emergency snow closures, and instituting additional fraud tests. The Payroll Division can also

work with other City agencies to introduce incentives for supervisors to sign off on their

employees’ timecards. In addition, the Payroll Division can take steps to better track information

related to personnel action form processing performed by its Payroll Administration unit and

separation audits. Finally, a limited test of the City’s payroll system for ghost employees found no

issues of concern.

We extend our appreciation to the City Controller and to the Payroll Division, who assisted and

cooperated with us during the audit.

Audit Services Division

Kip Memmott, MA, CGAP, CICA

Director of Audit Services


TABLE OF CONTENTS

EXECUTIVE SUMMARY 1

INTRODUCTION & BACKGROUND 3

SCOPE 5

OBJECTIVE 5

METHODOLOGY 6

FINDING 1 7

Additional Payroll System Quality Control Steps Should Be Taken 7

RECOMMENDATIONS 11

FINDING 2 12

Improvements Needed in Timeliness of Processing Personnel Action Forms (PAFs) and in

Some Areas of Data Tracking 12

RECOMMENDATIONS 14

AGENCY RESPONSE 15

P a g e 1

OOffffiiccee ooff tthhee AAuuddiittoorr

EXECUTIVE SUMMARY

Overview of Centralized Payroll

In November 2006, Denver residents voted to enact Amendment 1B to the City Charter,

which centralized the City’s accounting and financial functions into a newly created

Department of Finance, overseen by a Chief Financial Officer (CFO).1 Because the

amendment would move payroll functions to the new Department, in 2007 various City

staff worked to evaluate payroll and human resources (HR) practices throughout the

City. This effort determined that improvements to the City’s payroll function could be

made by centralizing it into a citywide Payroll Operations and Payroll Administration

Division (Payroll Division). This Division is housed in the Controller’s Office within the

Department of Finance.

The Payroll Division is separated into four units: the Payroll Operations unit; the Payroll

Accounting unit; the Payroll Administration unit and the Training, Communications and

Technology unit. The function of the Payroll Division is supported by two key

technological applications. The first application is Kronos, which was implemented in July

of 2008 and is the City’s time, attendance, and leave management system. Payroll

information from Kronos is uploaded into the PeopleSoft Human Resources module which

processes payroll for all City agencies.

Additional Payroll System Quality Control Steps Should Be Taken

The Payroll Division performs various quality control activities; however, we recommend

certain system improvements be made by the Payroll Division and other City functions.

We found that a sample of payroll files from April 2009 and October 2009 did not contain

key payroll information. In addition, the payroll file sample revealed that an important

audit of data entry regarding Kronos Change Forms was not being consistently

performed. Supervisors are required to submit Kronos Change Forms in order to change

data in Kronos. The requested changes are generally corrections to prior pay period

information which only Centralized payroll can enter. Specifically, 224 of 225 Kronos

Change Forms from a pay period in April 2009 did not have documentation that the

information on the Form had been audited after being entered into Kronos. Our review

of a pay period in October 2009 showed that some improvement had been made.

However, we noted seventeen of 153 Kronos Change Forms still had no documentation

that the Form’s information had been audited after being entered into Kronos.

We also found that twenty-four City employees received an improper credit of vacation

leave time related a snow closure in March 2009. Specifically, fifty-two hours were

improperly reimbursed and should consequently be deducted from these employees’

leave balances.

1 Prior to the 2006 passage of Denver Ballot Amendment 1B, many city payroll functions were performed by the City Auditor’s Office. In July of 2007, City payroll functions were consolidated into one centralized group under the Department of Finance.

P a g e 2

CCiittyy aanndd CCoouunnttyy ooff DDeennvveerr

Further, upon our review of a sample of fulltime employees’ time cards for three pay

periods, we found a significant number of supervisors are not signing off on their

employees’ timecards which is a key internal control. Specifically, we found eleven

percent of these employees’ timecards did not receive a supervisor’s approval. This

lapse in controls increases the risk that employees could be paid inaccurately.

Finally, we performed limited testing for ghost employees using Computer Assisted

Auditing Techniques (CAAT) to identify our sample. We then physically verified the

selected employees exist. Audit work did not identify any ghost employees. However,

we identified additional anti-fraud controls the Payroll Division could implement to

prevent this and other types of payroll fraud.

Improvements Needed in Timeliness of Processing Personnel

Action Forms and in Some Areas of Data Tracking

Audit work revealed that processing of Personnel Action Forms (PAFs) from the agency,

through the Payroll Division’s Payroll Administration unit, and ultimately to CSA was an

average of thirty-seven to forty-four days late after their effective dates. Auditors could

not determine the extent to which the Payroll Division’s Administrative unit was

responsible for the overall lack of timeliness, in part due to the way that information is

tracked within the Unit’s PAF log. The logging inconsistencies impede the Payroll Division’s

ability to assess the Payroll Administration unit’s PAF processing performance and to

further assist the City in finding resolutions to timeliness issues.

In addition, auditors found that the Payroll Division does not consistently track key data

related to audits of payouts to separating employees. Specifically, the log generated by

the Payroll Division staff does not consistently contain the date a PAF for the separating

employee is received, the date the separation paperwork is complete, and the amount

of any underpayments or overpayments to the separating employee. This lack of data

hampers the Payroll Division’s ability to analyze trends in underpayments and

overpayments and to assess the timeliness of separation payouts.

P a g e 3


INTRODUCTION & BACKGROUND

Overview of Centralized Payroll

In November 2006, Denver residents voted to enact Amendment 1B to the City Charter

which centralized the City’s accounting and financial functions into a newly created

Department of Finance overseen by a Chief Financial Officer (CFO).2 Prior to passing

Amendment 1B, payroll operations was a part of the Auditor’s Office.

In 2007, various city staff worked to evaluate payroll and certain human resources (HR)

practices throughout the City as a result of this organizational change. This effort

determined that practices in payroll and human resources could be improved by

consolidating the functions into a Citywide Payroll Operations and Payroll Administration

Division (Division). The timeline of these activities are shown in Figure 1 below:

Figure 1: Payroll Centralization Timeline

November 2006 February 2010

November 2006

Voters Pass

Amendment 1B

June 2007

Payroll Function

Unofficially Moved

to Controller’s Office

June 2007

June – August

Examined Payroll

Operations Citywide

January 2008

Beginning of

Citywide

Payroll

Consolidation

January 2008

Implementation of

Department of Finance

Under Chief Financial

Officer

April 2008

City Agencies

Consolidated

Into

Centralized

Payroll

October 2009

8,500 Employees

Using Kronos

February 2010

Remaining CSA

Employees Using Kronos

(Excluding DIA)

July 2008

6,500 Employees

Begin Using Kronos

Source: Information provided by Payroll Division

The Division is sub-divided into four organizational units as follows:

Payroll Operations—The Payroll Operations unit is responsible for entering payroll

data into PeopleSoft, such as tax information, direct deposit forms, and

information about employee earnings and deductions. Payroll Operations also

processes Kronos Change Forms which identify changes that need to be made

to an employee’s Kronos timecard, such as correcting missed punches on an

2 In 2006, Denver voters passed Ballot Amendment 1. As a result, all payroll functions previously housed in the City Auditor’s Office moved to the newly created Department of Finance headed by the Chief Financial Officer.

P a g e 4


employee’s timecard, overtime and shift differential requests, and other historical

data changes. Finally, Payroll Operations communicates with City employees

and agencies regarding payroll issues.

Payroll Accounting—The Payroll Accounting unit is responsible for processing

garnishments, tax returns, payroll adjustments, general ledger reconciliations, and

benefit reconciliations. The Payroll Accounting unit is also is responsible for

auditing manual inputs processed by the Payroll Operations team. This unit audits

the upload of Kronos data into the PeopleSoft payroll system to ensure all records

were received into Kronos and the information is accurate. Finally, Payroll

Accounting is responsible for auditing and processing employee separations.

Payroll Administration—The Payroll Administration unit has a variety of

administrative functions. These include handling personnel action forms (PAFs)

which cover such areas as new hires, performance evaluations, promotions,

demotions, job transfers, terminations, and separations. The PAFs are initiated by a

City agency, and pass through the Payroll Administration unit’s quality control

process before being forward to the Career Service Authority (CSA) for entry into

the PeopleSoft system. This unit also assists with other administrative duties related

to new employees, including citizenship confirmations (via the federal I-9 form)

which are forwarded to CSA for entry into the PeopleSoft system. The Payroll

Administration unit also manages City employees’ leave cases including

employees who are on Family Medical Leave (FML), disability leave, workers

compensation, and short-term disability. In September 2009, the unit reported

managing approximately 225 leave cases.

Training, Communications and Technology—The Training, Communication, and

Technology (TCT) unit assists the Division by supporting payroll technology

applications, such as Kronos, and by working to create data reports from these

applications. This unit also is the Division’s liaison with Technology Services in

support of both the PeopleSoft and Kronos applications. The TCT unit is responsible

for uploading payroll data from Kronos into PeopleSoft. Finally, the TCT unit

performs outreach functions including providing Kronos training, workshops for

both employees and supervisors, and focus groups used to maintain

improvement in business and service delivery.

Payroll Technology Systems and Applications

Effective payroll operations depend on key technology applications. For the City these

include:

Kronos Workforce—This application was implemented to replace manual

timecards and streamline time and attendance reporting across the City.

Centralized payroll requires employees and supervisors to review and approve

their time at the end of each pay period. This approval is a key control for

ensuring that employees’ time is coded correctly and employees correctly report

P a g e 5


work time. Finally, Kronos provides real time leave balances for sick, vacation,

and other leave types which were previously tracked in arrears by PeopleSoft.

PeopleSoft—PeopleSoft is an Enterprise Resource Planning (ERP) system that

allows for integration of various business functions. One of its functions is to

capture human resource and payroll data in order to process the City’s payroll.

Payroll is generated by uploading workforce information from Kronos into

PeopleSoft. However, not all agencies currently use Kronos.

Not All Agencies Utilize Kronos

While most agencies utilize Kronos, some agencies use their own timekeeping

applications. For example, the Police Department and Fire Department use a system

called TeleStaff, and the Sheriff’s Department uses a system called RFMS (Relief Factor

Management System). For these agencies Payroll Division staff must extract the payroll

files for upload into the PeopleSoft payroll system. The Department of Aviation (DIA)

utilizes a Kronos system which is not integrated with the City’s centralized system. As a

result, DIA e-mails employee time data to Payroll Division staff for upload into PeopleSoft.

The Denver Public Library, the Office of Economic Development, and the District

Attorney’s Office adopted the Kronos system in late 2009. Payroll Division management is

working with agencies not currently utilizing the application to bring additional

employees onto the Kronos system. For example, Payroll Division management reports all

CSA employees who work for Police, Fire and Sheriff were moved to Kronos in February of

2010. Further, Payroll management plans to implement a more secure method for

exchanging information between Telestaff, RFMS, and DIA’s Kronos systems for uniformed

employees of the Police and Fire Departments by March 31, 2010.

SCOPE

This audit reviewed activities in Payroll Operations for the years 2008 and 2009. Specific

testing activities focused on 2009 data with the exception of our reviews of personnel

action form processing timeliness which encompassed data from 2006 through 2009.

OBJECTIVE

This audit had two objectives:

To determine whether Payroll Operations had implemented a robust set of quality

control practices, and;

To determine whether other payroll processes such as tracking separation audit

findings and Personnel Action Form processing were being conducted efficiently and

effectively.

P a g e 6


METHODOLOGY

We utilized multiple methodologies to achieve audit objectives. These evidence

gathering and analysis techniques included, but were not limited to:

Interviewing key Payroll Division personnel overseeing and implementing the

City’s Payroll Operations;

Reviewing payroll files for pay periods in April and October 2009;

Obtaining and analyzing data from Kronos to better understand controls over

Kronos data including supervisory sign-offs on employee time entries;

Obtaining and analyzing information regarding Personnel Action Forms;

Obtaining and analyzing selected information from PeopleSoft related to

individuals’ pay to determine whether pay had been impacted by quality control

lapses;

Observing Division staff performing data entry and quality control functions;

Analyzing applicable Fiscal Rules;

Reviewing background information regarding the creation of centralized payroll;

Reviewing and analyzing CSA rules related to appropriate use of leave time for

days that the Mayor invokes an emergency snow closure for the City and;

Obtaining assistance from IT auditors who tested for ghost employees using

Computer Assisted Auditing Techniques (CAAT) as well as physical verification the

employee exist.

P a g e 7


FINDING 1

Additional Payroll System Quality Control Steps Should Be Taken

The Payroll Division performs various quality control activities. However, we noted several

additional system improvements can be made both by the Division and by other City

functions. First, auditors found that a sample of payroll files from April 2009 and October

2009 did not contain key payroll information. In addition, the payroll file sample revealed

that a key audit of data entry was not being consistently performed. Audit work also

determined certain employees received an improper credit of leave time related a City

emergency snow closure in March 2009. Further, we found that a significant number of

supervisors are not signing off on their employees’ timecards, which increases the risk that

employees could be paid inaccurately. Finally, while our limited testing for ghost

employees using Computer Assisted Auditing Techniques (CAAT) and physical

verification procedures did not identify any such employees, the Payroll Division could

implement additional anti-fraud controls to prevent this and other types of payroll fraud.

Payroll File Reviews Identified Missing Data and Indicated Important

Control Assessments Were Not Always Performed

Auditors reviewed payroll files for two pay periods in 2009: March 29 through April 11 and

October 11 through October 24. For the pay periods in April and October, the Payroll

Division provided files which included: Kronos Change Forms received during the pay

periods, records of error reports and audits conducted for the pay periods. Our review of

this information revealed the following:

Some Documents Missing from Payroll File—Auditors found that payroll file

documentation was not stored in one all-inclusive payroll file. Instead, Payroll Division staff

had to gather the information from multiple employees within the department. Other

payroll file documentation is located in a separate cabinet within the payroll records

room.

Key Information Missing—Additionally, auditors found that payroll files were missing key

information such as direct deposit forms, separation payouts, and W-4 tax forms that

were processed for the payroll period. As a consequence, payroll files were incomplete,

which prevented a single payroll run to be reconstructed. City Fiscal Rule 2.5 provides

“any disbursement . . . must include adequate supporting documentation.” Since Payroll

Division documents support the disbursement of City monies, payroll records should be

easily available, complete, and accurate to allow for reconstruction and audit at any

time. The Payroll Division should ensure that all relevant payroll file documents are

maintained together including direct deposit forms, separation payouts, and W-4 tax

forms.

Some Division Quality Reviews Not Performed—Audit work revealed the Payroll Division

did not adhere to good quality control practices with respect to Kronos Change Forms

and various audit reports. Data received through Kronos Change Forms must be

P a g e 8


manually entered into the Kronos system and an audit check should be done to ensure

that this data is entered correctly. However, auditors found that 224 of the 225 Kronos

Change Forms in the April pay period did not have signatures showing they were

reviewed by a second party to ensure accuracy. There was a marked improvement in

the quality control process for the October 2009 pay period but audit work determined

that seventeen of 153 Kronos Change Forms still lacked evidence of an audit of

accuracy. This shows a significant lack of quality control over these entries. The Payroll

Division should ensure that all data entered into Kronos from Kronos Change Forms be

reviewed to ensure accurate entry.

Additionally, payroll file reviews showed that while Payroll Division staff conducts internal

review tests to identify errors in payroll data, the quality review processes can be

improved. Similar to the Kronos Change form audit process, the process for these audits

calls for two signatures; one which indicates that payroll errors were fixed and one to

document an audit of whether the errors were appropriately removed from the payroll

data. Auditors found that Payroll Division personnel initially correcting errors had signed

off on only one of the eighteen audit reports generated for the April and October pay

periods. In addition, none of the reports had a second signature to show the original error

corrections were reviewed. Auditors reviewed a sample of adjustments reflected in the

error reports and found that all of the adjustments were made appropriately so in this

limited sample, no negative effects were noted due to the lack of an audit. However,

good quality control procedures are imperative for ensuring the propriety of adjusting

entries and overall accuracy of payroll. The Payroll Division should ensure that all error

reports receive two signatures identifying the staff originally adjusting the error and the

staff reviewing the error adjustment.

Improper Application of Career Service Authority (CSA) Rule 9-73

While conducting our review of payroll files, audit work determined twenty-four

employees received an improper credit of leave time for a day when the City invoked

an emergency snow closure. On days that the Mayor declares an emergency snow

closure for the City, City employees who are still at work are allowed to leave early and

receive administrative time to cover the hours left in their work day. The Mayor declared

such an emergency on March 26, 2009 which closed the City at 2:00 pm.

CSA Rule 9-73 section B-3 covers how leave time is to be handled in this situation stating,

“Employees who were on other leave such as vacation, compensatory time, sick, or

leave without pay must use that leave unless called back to work. When called back to

work unused leave hours are returned to the banks and work hours are counted.”

However, during our review of Kronos Change Forms, we found that Payroll Division

personnel had erroneously applied credits to twenty-four employees’ leave banks

totaling approximately fifty-two hours for this day. In these instances, the employees were

either on vacation for the day or had left the workplace prior to the snow emergency

being declared while using vacation time to cover the remaining hours to be worked.

These employees were not called back to work on this day as the CSA Rule states.

Therefore, the leave banks should not have been credited.

P a g e 9


Based on a review of payroll files, Payroll Division staff did not obtain an interpretation of

the applicable CSA rules for this situation. Since the leave banks were improperly

credited, the City has an increased liability since leave time can be paid out when an

employee separates from the City. As such, the Payroll Division should remove improper

leave time credited to the twenty-four employees for the snow closure on March 26,

2009. In addition, the Payroll Division should ensure staff is trained in the procedures for

applying and seeking interpretation of payroll-related CSA rules.

Some City Supervisors Are Not Approving Kronos Timesheets

The Kronos timekeeping system provides supervisors with a way to review and approve

their employees’ time but not all supervisors in the City are utilizing this important quality

control step. Payroll Division staff can review and approve employees’ time cards when

preparing payroll but are not in a position to disapprove time cards in the absence of

compelling evidence for doing so, such as evidence that could be generated by an

audit or fraud assessment. Consequently, employees could enter erroneous or even

fraudulent work time information without being detected by management.

Audit Sample Determined That Eleven Percent of Kronos Timecards Were Not Approved

by Supervisors—Auditors reviewed timecards from a sample of three 2009 pay periods:

March 29 through April 11; September 27 through October 10; and December 6 through

December 19. In these reviews, we analyzed timecards of full-time employees who

logged 80 hours during the pay periods. This data filter was necessitated by limitations in

Kronos since Kronos pulled records for all current employees for each pay period even if

the employee had not yet been hired during one of the pay periods. Individuals who

entered 80 hours for a pay period were assumed to have been employed during that

pay period.

Audit work determined for the three pay periods reviewed, an average of eleven

percent of timecards were not approved by employees’ supervisors as shown in Table 1

below.

Table 1 – Timecards not approved by supervisors for selected pay periods

Pay Period—3/29

through 4/11

Pay Period—9/27

through 10/10

Pay Period—12/6

through 12/19

Total employees

with 80 hours 3147 3293 3655

Total of timecards

without supervisory

approval

331

325

453

Average

11%

10%

12%

P a g e 10


Kronos is currently not configured to require supervisory approval for timecards. Instead,

the only required approval is performed by Payroll Division staff. However, the lack of a

supervisor’s approval can result in inaccuracies or purposeful misstatements of time

worked or leave taken. This internal control weakness can lead to payroll underpayments

or overpayments to employees in addition to generating additional work for Payroll

Division staff by requiring additional processing of Kronos Change Forms in the event

corrections are requested after the pay period close date.

The City Controller has proposed to CSA that approving timecards be a standard part of

supervisors’ performance requirements and evaluation. The Payroll Division should

continue working to create a method of holding supervisors accountable for reviewing

and approving their employees’ timecards.

Limited testing did not detect ghost employees

The audit included an anti-fraud procedure using Computer Aided Auditing Techniques

(CAAT) to test for the existence of ghost employees. The term ghost employee refers to

someone on the payroll who does not actually work for the company3 whose pay goes

to an illicit receiver. These situations can defraud the City as monies are expended for

work that was not performed. Auditors selected a sample of names from the City’s

payroll registry based on certain risk indicators, and visited each employee in person to

ensure they actually existed. Auditors verified the employee by matching the name on

the payroll registry with the name and photo on the individual’s employee identification

badge. Although we cannot conclude for certain that there are no ghost employees on

the City’s payroll, for the sample tested, none were identified.

Additional Fraud Testing Could Be Performed—While audit work did not identify any ghost

employees, the Payroll Division could further mitigate risk of this fraud by incorporating

additional fraud assessments into their review processes. While reviewing payroll files, we

noted Payroll was testing for employees without tax tables, which is a good fraud test.

However, some additional tests could be made for common payroll frauds, such as ghost

employees or falsified hours and salary schemes.4 For example, auditors did not find

evidence of queries being run to identify employees without benefit records or potential

duplicate direct deposit accounts. Running queries for employees without tax tables,

benefits tables, and duplicate direct deposit accounts are three basic fraud tests which

can identify potential ghost employees and should be utilized. Additionally, auditors

found no evidence Payroll Division staff were reviewing Kronos timecards to determine

whether supervisors were creating employee time cards, whether supervisors were

approving overtime when out of the norm for the department, or whether employees

are clocking other employees’ time. These are examples of situations that could signal

fraudulent activity and would merit additional assessment.

Specifically, the Payroll Division should ensure that, at a minimum, it tests for: employees

without any tax information (such as the number of exemptions); employees without any

3 The Association of Certified Fraud Examiners Fraud Examiners Manual 2007 U.S. Edition pg. 1.553 4 Ibid.

P a g e 11


benefit information (such as health insurance); employees with duplicate direct deposit

numbers; whether supervisors are creating employee timecards; whether supervisors are

approving unusually high levels of overtime, and; whether an employee’s time is being

entered by a different person than the employee. The Payroll Division should consider

whether additional anti-fraud tests could be run and implement such tests where

feasible.

RECOMMENDATIONS

1. The Payroll Division should ensure that all relevant payroll file documents are

maintained together including direct deposit forms, separation payouts, and W-4 tax

forms.

2. The Payroll Division should ensure that all data entered into Kronos from Kronos

Change Forms be reviewed to ensure accurate entry.

3. The Payroll Division should ensure that all error reports receive two signatures

identifying the staff originally adjusting the error and the staff reviewing the error

adjustment.

4. The Payroll Division should deduct improper leave time granted to twenty-four

employees during a City snow closure on March 26, 2009.

5. The Payroll Division should ensure staff is trained in the procedures for applying and

seeking interpretation of CSA rules.

6. The Payroll Division should continue working to create a method of holding

supervisors accountable for approving their employees’ timecards.

7. The Payroll Division should ensure that, at a minimum, it tests for: employees without

any tax information (such as the number of exemptions); employees without any

benefit information (such as health insurance); employees with duplicate direct

deposit numbers; whether supervisors are creating employee timecards; whether

supervisors are approving unusually high levels of overtime; and whether an

employee’s time is being entered by a different person.

8. The Payroll Division should consider whether additional anti-fraud tests could be run

and implement such test where feasible.

P a g e 12


FINDING 2

Improvements Needed in Timeliness of Processing Personnel

Action Forms (PAFs) and in Some Areas of Data Tracking

Audit work revealed that processing for PAFs, which is now done in part by the Payroll

Administration unit, has been completed thirty-seven to forty-four days after their

effective dates for the years 2006-2009. The work done by the Unit in processing these

forms could be tracked in a way more consistent within PeopleSoft which would aid

management in assessing the Unit’s processing performance. In addition, the Payroll

Division could better track and report data related to audits of payouts to separating

employees.

Processing for PAFs Is Generally Completed After the PAFs’ Effective Date

Auditors reviewed data from 2006 through 2009 to assess the timeliness of PAF processing,

and found that processing for these forms is generally completed after their effective

dates. In some cases, this can have monetary consequences to the City. For example,

some PAFs are generated for employees’ performance evaluations, which CSA Rule 13

requires to be completed by supervisors and received by CSA within 30 days after their

effective dates. If this does not occur, the employee whose evaluation is late

automatically receives a rating of “successful,” which means that the employee would

receive a pay increase. However, such employees’ performance may not have merited

a rating of successful, thus resulting in an inappropriate and irreversible pay increase.

Auditors reviewed data from April 1 through December 31 for the years 2006 through

2008 and reviewed data from January 1 through November 19, 2009. The City’s

traditional PAF processing involves multiple entities including the originating agency, the

Payroll Division’s Payroll Administration unit, and CSA. Auditors eliminated PAFs of

temporary employees and uniformed personnel who do not work under CSA from the

review. As shown in Table 2, (p. 13) the average number of days beyond the effective

date that the PAF processing is completed is not significantly different in 2009 than it was

in 2006. Specifically, the average number of days in 2008 and 2009 was thirty-eight and

thirty-seven days beyond the PAF effective date, respectively, compared to thirty-eight

days in 2006 and forty-four days in 2007. Further, also shown in Table 2, auditors

determined the percent of PAFs that took longer than average to process. Finally, Table

2 shows the number of PAFs that took over one year to process.

P a g e 13


Table 2—Average Days Beyond the PAF Effective Date That Processing Is Completed

Average number of

days that PAFs are

completed after the

effective date

Percent of PAFs

completed

beyond the

average

timeframe

Number of

PAFs

processed in

more than 365

days

Total number

of PAFs

auditors

reviewed

2006 38 days 24.7% 122 10,107

2007 44 days 22.5% 222 12,154

2008 38 days 24.6% 142 11,223

2009 37 days 23.1% 133 11,484

Reporting Differences Limit Assessment of Processing Efficiency—Due to limitations in how

PAF processing data is recorded by the Payroll Administrative unit, auditors were unable

to specifically determine where improvements could be made in processing efficiency.

Upon reviewing PAF processing data kept by the Payroll Administrative unit, auditors

determined that the log of incoming PAFs maintained by the Unit does not fully match

information in PeopleSoft. Specifically, auditors found that the Unit does not consistently

use the same PAF descriptors in its log as is used in PeopleSoft. Additionally, audit work

identified numerous entries in the Unit’s PAF log that did not contain all of the requisite

information. Consequently, we were unable to significantly match PAFs found in

PeopleSoft to the log maintained by the HR Division. Because the Payroll Administrative

unit receives PAFs from agencies, and then sends them to CSA, the missing or

inconsistent information in the Unit’s PAF log did not allow auditors to confirm the stage of

the process that most contributes to processing inefficiency. Similarly, the missing and

inconsistent data would hamper any internal Payroll Division assessment of the

Administrative unit’s PAF processing performance, and further hinders management from

finding resolutions to timeliness issues. The Payroll Division should ensure that it consistently

maintains all PAF processing information and does so in a manner consistent with

PeopleSoft descriptors. The Payroll Division should also consider using this information to

conduct additional analysis regarding the extent to which agencies, the Payroll

Administrative unit and CSA contribute to lack of PAF processing timeliness.

Some Separation Audit Data Not Tracked For Management Reporting

While reviewing Payroll Division operations, audit work determined important information

related to audits of payouts to separating employees was not being regularly tracked

and therefore, not available for use in management decision-making. Specifically, the

log used by Payroll Division staff to track separation information did not consistently

contain the datea separation-related PAF is received, the date the separation

paperwork is complete, and the amount of any underpayments or overpayments to the

employee who has separated.

P a g e 14


Without compiling and tracking this information, the Payroll Division cannot provide its

management with adequate information about the separation audit process or trends in

underpayment or overpayments to separating employees. Additionally, the lack of such

reporting will make it difficult for management to ensure the overpayments are

recovered and the underpayments are made whole. The Payroll Division should ensure

that it consistently tracks and provides separation audit information to management

including the date a separation PAF is received, the date the separation paperwork is

complete, and any under or over payments.

RECOMMENDATIONS

1. The Payroll Division should ensure that it consistently maintains all PAF processing

information and does so in a manner consistent with PeopleSoft descriptors.

2. The Payroll Division should also consider using this information to conduct additional

analysis regarding the extent to which agencies, the Payroll Administrative unit and

CSA contribute to lack of PAF processing timeliness.

3. The Payroll Division should ensure that it consistently tracks and provides to

management separation audit information including the date a separation PAF is

received, the date the separation paperwork is complete, and any under or over

payments.

P a g e 15


AGENCY RESPONSE

P a g e 16


P a g e 17


P a g e 18


P a g e 19


P a g e 20


P a g e 21


P a g e 22
