centralized payroll operations - denver · related to personnel action form processing performed by...
TRANSCRIPT
Dennis J. Gallagher
Auditor
Office of the Auditor
Audit Services Division
City and County of Denver
Centralized Payroll Operations Performance Audit
March 2010
The Auditor of the City and County of Denver is independently elected by the citizens of Denver. He is
responsible for examining and evaluating the operations of City agencies for the purpose of ensuring the
proper and efficient use of City resources and providing other audit services and information to City
Council, the Mayor and the public to improve all aspects of Denver’s government. He also chairs the
City’s Audit Committee and oversees the City’s Comprehensive Annual Financial Report (CAFR).
The Audit Committee is chaired by the Auditor and consists of seven members. The Audit Committee
assists the Auditor in his oversight responsibilities of the integrity of the City’s finances and operations,
including the integrity of the City’s financial statements. The Audit Committee is structured in a manner
that ensures the independent oversight of City operations, thereby enhancing citizen confidence and
avoiding any appearance of a conflict of interest.
Audit Committee
Robert Bishop Dennis Gallagher
Maurice Goodgaine Robert Haddock
Jeffrey Hart Bonney Lopez
Timothy O’Brien
Audit Staff
John Carlson, Deputy Director, JD, CIA, CICA
Chris Horton, Internal Audit Supervisor, MA
Anita Thompson, Lead Internal Auditor, CICA
Rebecca Corral, Senior Internal Auditor, CFE
You can obtain copies of this report by contacting us at:
Office of the Auditor
201 W. Colfax Avenue, Dept. 705 Denver CO, 80202
(720) 913-5000 Fax (720) 913-5026
Or view an electronic copy by visiting our website at:
www.denvergov.org/auditor
To promote open, accountable, efficient and effective government by performing impartial reviews and other audit
services that provide objective and useful information to improve decision making by management and the people.
We will monitor and report on recommendations and progress towards their implementation.
City and County of Denver 201 West Colfax Ave., Dept. 705 Denver, Colorado 80202 720-913-5000 FAX 720-913-5247 www.denvergov.org/auditor
Dennis J. Gallagher
Auditor
March 18, 2010
Beth Machann, Controller
Department of Finance
City and County of Denver
Dear Ms. Machann:
Attached is the Auditor’s Office Audit Services Division’s report of its audit of City Payroll
Operations for the years 2008 and 2009. The purpose of the audit was to review internal quality
controls and various internal processes and to determine their adequacy.
The audit team found that the Division of Payroll Operations and Payroll Administration (Payroll
Division) can make some enhancements to its quality control practices. For example, the Payroll
Division should ensure that it maintains all relevant payroll files together, and that appropriate
quality control reviews of payroll data are performed. These reviews should specifically include
anti-fraud tests identified on pages 10 and 11 of the report. The audit team has also
documented some information-gathering improvements that can be made regarding personnel
action form processing and performance of separation audits.
I appreciate your concern that the Career Service Authority Rule 9-73 regarding snow closures
may be unclear. I am hopeful that the audit team’s findings regarding how vacation time was
used on snow closure days will lead to greater clarity in the Rule and better guidance in future
snow closure situations.
I am pleased with your response to our finding regarding supervisors who do not approve their
employees’ Kronos time cards. This is a critical quality control step, and supervisors who fail to
fulfill this responsibility should be held accountable for their lack of performance. Your proposed
action is a fine example of how good audit work and conscientious public servants can work in
tandem to create positive change for citizens of the City.
If you have any questions, please call Kip Memmott, Director of Audit Services, at 720-913-5029.
Sincerely,
Dennis Gallagher
Auditor
DJG/cnh
Ms. Beth Machann, Controller
March 18, 2010
Page Two
cc: Honorable John Hickenlooper, Mayor
Honorable Members of City Council
Members of Audit Committee
Ms. Roxane White, Chief of Staff
Mr. Claude Pumilia, Chief Financial Officer
Mr. David T. Roberts, Chief Services Officer
Mr. David Fine, City Attorney
Mr. L. Michael Henry, Staff Director, Board of Ethics
Ms. Lauri Dannemiller, City Council Executive Staff Director
Ms. Linda Misegadis, Director of Centralized Payroll
To promote open, accountable, efficient and effective government by performing impartial reviews and other audit
services that provide objective and useful information to improve decision making by management and the people.
We will monitor and report on recommendations and progress towards their implementation.
City and County of Denver 201 West Colfax Ave., Dept. 705 Denver, Colorado 80202 720-913-5000 FAX 720-913-5247 www.denvergov.org/auditor
Dennis J. Gallagher
Auditor
AUDITOR’S REPORT
We have completed our performance audit of City Payroll Operations. The purpose of the audit
was to examine and assess internal quality controls and various internal processes, and to
identify possible inefficiencies and opportunities for improvement.
This performance audit is authorized pursuant to the City and County of Denver Charter, Article
V, Part 2, Section 1, General Powers and Duties of Auditor, and was conducted in accordance
with generally accepted government auditing standards. Those standards require that we plan
and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis
for our findings and conclusions based on our audit objectives. We believe that the evidence
obtained provides a reasonable basis for our findings and conclusions based on our audit
objectives.
The audit revealed that the Division of Payroll Operations and Payroll Administration (Payroll
Division) can improve certain internal quality control areas. These include ensuring audits of data
entry are performed, ensuring appropriate application of rules regarding leave during
emergency snow closures, and instituting additional fraud tests. The Payroll Division can also
work with other City agencies to introduce incentives for supervisors to sign off on their
employees’ timecards. In addition, the Payroll Division can take steps to better track information
related to personnel action form processing performed by its Payroll Administration unit and
separation audits. Finally, a limited test of the City’s payroll system for ghost employees found no
issues of concern.
We extend our appreciation to the City Controller and to the Payroll Division, who assisted and
cooperated with us during the audit.
Audit Services Division
Kip Memmott, MA, CGAP, CICA
Director of Audit Services
TABLE OF CONTENTS
EXECUTIVE SUMMARY 1
INTRODUCTION & BACKGROUND 3
SCOPE 5
OBJECTIVE 5
METHODOLOGY 6
FINDING 1 7
Additional Payroll System Quality Control Steps Should Be Taken 7
RECOMMENDATIONS 11
FINDING 2 12
Improvements Needed in Timeliness of Processing Personnel Action Forms (PAFs) and in
Some Areas of Data Tracking 12
RECOMMENDATIONS 14
AGENCY RESPONSE 15
P a g e 1
OOffffiiccee ooff tthhee AAuuddiittoorr
EXECUTIVE SUMMARY
Overview of Centralized Payroll
In November 2006, Denver residents voted to enact Amendment 1B to the City Charter,
which centralized the City’s accounting and financial functions into a newly created
Department of Finance, overseen by a Chief Financial Officer (CFO).1 Because the
amendment would move payroll functions to the new Department, in 2007 various City
staff worked to evaluate payroll and human resources (HR) practices throughout the
City. This effort determined that improvements to the City’s payroll function could be
made by centralizing it into a citywide Payroll Operations and Payroll Administration
Division (Payroll Division). This Division is housed in the Controller’s Office within the
Department of Finance.
The Payroll Division is separated into four units: the Payroll Operations unit; the Payroll
Accounting unit; the Payroll Administration unit and the Training, Communications and
Technology unit. The function of the Payroll Division is supported by two key
technological applications. The first application is Kronos, which was implemented in July
of 2008 and is the City’s time, attendance, and leave management system. Payroll
information from Kronos is uploaded into the PeopleSoft Human Resources module which
processes payroll for all City agencies.
Additional Payroll System Quality Control Steps Should Be Taken
The Payroll Division performs various quality control activities; however, we recommend
certain system improvements be made by the Payroll Division and other City functions.
We found that a sample of payroll files from April 2009 and October 2009 did not contain
key payroll information. In addition, the payroll file sample revealed that an important
audit of data entry regarding Kronos Change Forms was not being consistently
performed. Supervisors are required to submit Kronos Change Forms in order to change
data in Kronos. The requested changes are generally corrections to prior pay period
information which only Centralized payroll can enter. Specifically, 224 of 225 Kronos
Change Forms from a pay period in April 2009 did not have documentation that the
information on the Form had been audited after being entered into Kronos. Our review
of a pay period in October 2009 showed that some improvement had been made.
However, we noted seventeen of 153 Kronos Change Forms still had no documentation
that the Form’s information had been audited after being entered into Kronos.
We also found that twenty-four City employees received an improper credit of vacation
leave time related a snow closure in March 2009. Specifically, fifty-two hours were
improperly reimbursed and should consequently be deducted from these employees’
leave balances.
1 Prior to the 2006 passage of Denver Ballot Amendment 1B, many city payroll functions were performed by the City Auditor’s Office. In July of 2007, City payroll functions were consolidated into one centralized group under the Department of Finance.
P a g e 2
CCiittyy aanndd CCoouunnttyy ooff DDeennvveerr
Further, upon our review of a sample of fulltime employees’ time cards for three pay
periods, we found a significant number of supervisors are not signing off on their
employees’ timecards which is a key internal control. Specifically, we found eleven
percent of these employees’ timecards did not receive a supervisor’s approval. This
lapse in controls increases the risk that employees could be paid inaccurately.
Finally, we performed limited testing for ghost employees using Computer Assisted
Auditing Techniques (CAAT) to identify our sample. We then physically verified the
selected employees exist. Audit work did not identify any ghost employees. However,
we identified additional anti-fraud controls the Payroll Division could implement to
prevent this and other types of payroll fraud.
Improvements Needed in Timeliness of Processing Personnel
Action Forms and in Some Areas of Data Tracking
Audit work revealed that processing of Personnel Action Forms (PAFs) from the agency,
through the Payroll Division’s Payroll Administration unit, and ultimately to CSA was an
average of thirty-seven to forty-four days late after their effective dates. Auditors could
not determine the extent to which the Payroll Division’s Administrative unit was
responsible for the overall lack of timeliness, in part due to the way that information is
tracked within the Unit’s PAF log. The logging inconsistencies impede the Payroll Division’s
ability to assess the Payroll Administration unit’s PAF processing performance and to
further assist the City in finding resolutions to timeliness issues.
In addition, auditors found that the Payroll Division does not consistently track key data
related to audits of payouts to separating employees. Specifically, the log generated by
the Payroll Division staff does not consistently contain the date a PAF for the separating
employee is received, the date the separation paperwork is complete, and the amount
of any underpayments or overpayments to the separating employee. This lack of data
hampers the Payroll Division’s ability to analyze trends in underpayments and
overpayments and to assess the timeliness of separation payouts.
P a g e 3
OOffffiiccee ooff tthhee AAuuddiittoorr
INTRODUCTION & BACKGROUND
Overview of Centralized Payroll
In November 2006, Denver residents voted to enact Amendment 1B to the City Charter
which centralized the City’s accounting and financial functions into a newly created
Department of Finance overseen by a Chief Financial Officer (CFO).2 Prior to passing
Amendment 1B, payroll operations was a part of the Auditor’s Office.
In 2007, various city staff worked to evaluate payroll and certain human resources (HR)
practices throughout the City as a result of this organizational change. This effort
determined that practices in payroll and human resources could be improved by
consolidating the functions into a Citywide Payroll Operations and Payroll Administration
Division (Division). The timeline of these activities are shown in Figure 1 below:
Figure 1: Payroll Centralization Timeline
November 2006 February 2010
November 2006
Voters Pass
Amendment 1B
June 2007
Payroll Function
Unofficially Moved
to Controller’s Office
June 2007
June – August
Examined Payroll
Operations Citywide
January 2008
Beginning of
Citywide
Payroll
Consolidation
January 2008
Implementation of
Department of Finance
Under Chief Financial
Officer
April 2008
City Agencies
Consolidated
Into
Centralized
Payroll
October 2009
8,500 Employees
Using Kronos
February 2010
Remaining CSA
Employees Using Kronos
(Excluding DIA)
July 2008
6,500 Employees
Begin Using Kronos
Source: Information provided by Payroll Division
The Division is sub-divided into four organizational units as follows:
Payroll Operations—The Payroll Operations unit is responsible for entering payroll
data into PeopleSoft, such as tax information, direct deposit forms, and
information about employee earnings and deductions. Payroll Operations also
processes Kronos Change Forms which identify changes that need to be made
to an employee’s Kronos timecard, such as correcting missed punches on an
2 In 2006, Denver voters passed Ballot Amendment 1. As a result, all payroll functions previously housed in the City Auditor’s Office moved to the newly created Department of Finance headed by the Chief Financial Officer.
P a g e 4
CCiittyy aanndd CCoouunnttyy ooff DDeennvveerr
employee’s timecard, overtime and shift differential requests, and other historical
data changes. Finally, Payroll Operations communicates with City employees
and agencies regarding payroll issues.
Payroll Accounting—The Payroll Accounting unit is responsible for processing
garnishments, tax returns, payroll adjustments, general ledger reconciliations, and
benefit reconciliations. The Payroll Accounting unit is also is responsible for
auditing manual inputs processed by the Payroll Operations team. This unit audits
the upload of Kronos data into the PeopleSoft payroll system to ensure all records
were received into Kronos and the information is accurate. Finally, Payroll
Accounting is responsible for auditing and processing employee separations.
Payroll Administration—The Payroll Administration unit has a variety of
administrative functions. These include handling personnel action forms (PAFs)
which cover such areas as new hires, performance evaluations, promotions,
demotions, job transfers, terminations, and separations. The PAFs are initiated by a
City agency, and pass through the Payroll Administration unit’s quality control
process before being forward to the Career Service Authority (CSA) for entry into
the PeopleSoft system. This unit also assists with other administrative duties related
to new employees, including citizenship confirmations (via the federal I-9 form)
which are forwarded to CSA for entry into the PeopleSoft system. The Payroll
Administration unit also manages City employees’ leave cases including
employees who are on Family Medical Leave (FML), disability leave, workers
compensation, and short-term disability. In September 2009, the unit reported
managing approximately 225 leave cases.
Training, Communications and Technology—The Training, Communication, and
Technology (TCT) unit assists the Division by supporting payroll technology
applications, such as Kronos, and by working to create data reports from these
applications. This unit also is the Division’s liaison with Technology Services in
support of both the PeopleSoft and Kronos applications. The TCT unit is responsible
for uploading payroll data from Kronos into PeopleSoft. Finally, the TCT unit
performs outreach functions including providing Kronos training, workshops for
both employees and supervisors, and focus groups used to maintain
improvement in business and service delivery.
Payroll Technology Systems and Applications
Effective payroll operations depend on key technology applications. For the City these
include:
Kronos Workforce—This application was implemented to replace manual
timecards and streamline time and attendance reporting across the City.
Centralized payroll requires employees and supervisors to review and approve
their time at the end of each pay period. This approval is a key control for
ensuring that employees’ time is coded correctly and employees correctly report
P a g e 5
OOffffiiccee ooff tthhee AAuuddiittoorr
work time. Finally, Kronos provides real time leave balances for sick, vacation,
and other leave types which were previously tracked in arrears by PeopleSoft.
PeopleSoft—PeopleSoft is an Enterprise Resource Planning (ERP) system that
allows for integration of various business functions. One of its functions is to
capture human resource and payroll data in order to process the City’s payroll.
Payroll is generated by uploading workforce information from Kronos into
PeopleSoft. However, not all agencies currently use Kronos.
Not All Agencies Utilize Kronos
While most agencies utilize Kronos, some agencies use their own timekeeping
applications. For example, the Police Department and Fire Department use a system
called TeleStaff, and the Sheriff’s Department uses a system called RFMS (Relief Factor
Management System). For these agencies Payroll Division staff must extract the payroll
files for upload into the PeopleSoft payroll system. The Department of Aviation (DIA)
utilizes a Kronos system which is not integrated with the City’s centralized system. As a
result, DIA e-mails employee time data to Payroll Division staff for upload into PeopleSoft.
The Denver Public Library, the Office of Economic Development, and the District
Attorney’s Office adopted the Kronos system in late 2009. Payroll Division management is
working with agencies not currently utilizing the application to bring additional
employees onto the Kronos system. For example, Payroll Division management reports all
CSA employees who work for Police, Fire and Sheriff were moved to Kronos in February of
2010. Further, Payroll management plans to implement a more secure method for
exchanging information between Telestaff, RFMS, and DIA’s Kronos systems for uniformed
employees of the Police and Fire Departments by March 31, 2010.
SCOPE
This audit reviewed activities in Payroll Operations for the years 2008 and 2009. Specific
testing activities focused on 2009 data with the exception of our reviews of personnel
action form processing timeliness which encompassed data from 2006 through 2009.
OBJECTIVE
This audit had two objectives:
To determine whether Payroll Operations had implemented a robust set of quality
control practices, and;
To determine whether other payroll processes such as tracking separation audit
findings and Personnel Action Form processing were being conducted efficiently and
effectively.
P a g e 6
CCiittyy aanndd CCoouunnttyy ooff DDeennvveerr
METHODOLOGY
We utilized multiple methodologies to achieve audit objectives. These evidence
gathering and analysis techniques included, but were not limited to:
Interviewing key Payroll Division personnel overseeing and implementing the
City’s Payroll Operations;
Reviewing payroll files for pay periods in April and October 2009;
Obtaining and analyzing data from Kronos to better understand controls over
Kronos data including supervisory sign-offs on employee time entries;
Obtaining and analyzing information regarding Personnel Action Forms;
Obtaining and analyzing selected information from PeopleSoft related to
individuals’ pay to determine whether pay had been impacted by quality control
lapses;
Observing Division staff performing data entry and quality control functions;
Analyzing applicable Fiscal Rules;
Reviewing background information regarding the creation of centralized payroll;
Reviewing and analyzing CSA rules related to appropriate use of leave time for
days that the Mayor invokes an emergency snow closure for the City and;
Obtaining assistance from IT auditors who tested for ghost employees using
Computer Assisted Auditing Techniques (CAAT) as well as physical verification the
employee exist.
P a g e 7
OOffffiiccee ooff tthhee AAuuddiittoorr
FINDING 1
Additional Payroll System Quality Control Steps Should Be Taken
The Payroll Division performs various quality control activities. However, we noted several
additional system improvements can be made both by the Division and by other City
functions. First, auditors found that a sample of payroll files from April 2009 and October
2009 did not contain key payroll information. In addition, the payroll file sample revealed
that a key audit of data entry was not being consistently performed. Audit work also
determined certain employees received an improper credit of leave time related a City
emergency snow closure in March 2009. Further, we found that a significant number of
supervisors are not signing off on their employees’ timecards, which increases the risk that
employees could be paid inaccurately. Finally, while our limited testing for ghost
employees using Computer Assisted Auditing Techniques (CAAT) and physical
verification procedures did not identify any such employees, the Payroll Division could
implement additional anti-fraud controls to prevent this and other types of payroll fraud.
Payroll File Reviews Identified Missing Data and Indicated Important
Control Assessments Were Not Always Performed
Auditors reviewed payroll files for two pay periods in 2009: March 29 through April 11 and
October 11 through October 24. For the pay periods in April and October, the Payroll
Division provided files which included: Kronos Change Forms received during the pay
periods, records of error reports and audits conducted for the pay periods. Our review of
this information revealed the following:
Some Documents Missing from Payroll File—Auditors found that payroll file
documentation was not stored in one all-inclusive payroll file. Instead, Payroll Division staff
had to gather the information from multiple employees within the department. Other
payroll file documentation is located in a separate cabinet within the payroll records
room.
Key Information Missing—Additionally, auditors found that payroll files were missing key
information such as direct deposit forms, separation payouts, and W-4 tax forms that
were processed for the payroll period. As a consequence, payroll files were incomplete,
which prevented a single payroll run to be reconstructed. City Fiscal Rule 2.5 provides
“any disbursement . . . must include adequate supporting documentation.” Since Payroll
Division documents support the disbursement of City monies, payroll records should be
easily available, complete, and accurate to allow for reconstruction and audit at any
time. The Payroll Division should ensure that all relevant payroll file documents are
maintained together including direct deposit forms, separation payouts, and W-4 tax
forms.
Some Division Quality Reviews Not Performed—Audit work revealed the Payroll Division
did not adhere to good quality control practices with respect to Kronos Change Forms
and various audit reports. Data received through Kronos Change Forms must be
P a g e 8
CCiittyy aanndd CCoouunnttyy ooff DDeennvveerr
manually entered into the Kronos system and an audit check should be done to ensure
that this data is entered correctly. However, auditors found that 224 of the 225 Kronos
Change Forms in the April pay period did not have signatures showing they were
reviewed by a second party to ensure accuracy. There was a marked improvement in
the quality control process for the October 2009 pay period but audit work determined
that seventeen of 153 Kronos Change Forms still lacked evidence of an audit of
accuracy. This shows a significant lack of quality control over these entries. The Payroll
Division should ensure that all data entered into Kronos from Kronos Change Forms be
reviewed to ensure accurate entry.
Additionally, payroll file reviews showed that while Payroll Division staff conducts internal
review tests to identify errors in payroll data, the quality review processes can be
improved. Similar to the Kronos Change form audit process, the process for these audits
calls for two signatures; one which indicates that payroll errors were fixed and one to
document an audit of whether the errors were appropriately removed from the payroll
data. Auditors found that Payroll Division personnel initially correcting errors had signed
off on only one of the eighteen audit reports generated for the April and October pay
periods. In addition, none of the reports had a second signature to show the original error
corrections were reviewed. Auditors reviewed a sample of adjustments reflected in the
error reports and found that all of the adjustments were made appropriately so in this
limited sample, no negative effects were noted due to the lack of an audit. However,
good quality control procedures are imperative for ensuring the propriety of adjusting
entries and overall accuracy of payroll. The Payroll Division should ensure that all error
reports receive two signatures identifying the staff originally adjusting the error and the
staff reviewing the error adjustment.
Improper Application of Career Service Authority (CSA) Rule 9-73
While conducting our review of payroll files, audit work determined twenty-four
employees received an improper credit of leave time for a day when the City invoked
an emergency snow closure. On days that the Mayor declares an emergency snow
closure for the City, City employees who are still at work are allowed to leave early and
receive administrative time to cover the hours left in their work day. The Mayor declared
such an emergency on March 26, 2009 which closed the City at 2:00 pm.
CSA Rule 9-73 section B-3 covers how leave time is to be handled in this situation stating,
“Employees who were on other leave such as vacation, compensatory time, sick, or
leave without pay must use that leave unless called back to work. When called back to
work unused leave hours are returned to the banks and work hours are counted.”
However, during our review of Kronos Change Forms, we found that Payroll Division
personnel had erroneously applied credits to twenty-four employees’ leave banks
totaling approximately fifty-two hours for this day. In these instances, the employees were
either on vacation for the day or had left the workplace prior to the snow emergency
being declared while using vacation time to cover the remaining hours to be worked.
These employees were not called back to work on this day as the CSA Rule states.
Therefore, the leave banks should not have been credited.
P a g e 9
OOffffiiccee ooff tthhee AAuuddiittoorr
Based on a review of payroll files, Payroll Division staff did not obtain an interpretation of
the applicable CSA rules for this situation. Since the leave banks were improperly
credited, the City has an increased liability since leave time can be paid out when an
employee separates from the City. As such, the Payroll Division should remove improper
leave time credited to the twenty-four employees for the snow closure on March 26,
2009. In addition, the Payroll Division should ensure staff is trained in the procedures for
applying and seeking interpretation of payroll-related CSA rules.
Some City Supervisors Are Not Approving Kronos Timesheets
The Kronos timekeeping system provides supervisors with a way to review and approve
their employees’ time but not all supervisors in the City are utilizing this important quality
control step. Payroll Division staff can review and approve employees’ time cards when
preparing payroll but are not in a position to disapprove time cards in the absence of
compelling evidence for doing so, such as evidence that could be generated by an
audit or fraud assessment. Consequently, employees could enter erroneous or even
fraudulent work time information without being detected by management.
Audit Sample Determined That Eleven Percent of Kronos Timecards Were Not Approved
by Supervisors—Auditors reviewed timecards from a sample of three 2009 pay periods:
March 29 through April 11; September 27 through October 10; and December 6 through
December 19. In these reviews, we analyzed timecards of full-time employees who
logged 80 hours during the pay periods. This data filter was necessitated by limitations in
Kronos since Kronos pulled records for all current employees for each pay period even if
the employee had not yet been hired during one of the pay periods. Individuals who
entered 80 hours for a pay period were assumed to have been employed during that
pay period.
Audit work determined for the three pay periods reviewed, an average of eleven
percent of timecards were not approved by employees’ supervisors as shown in Table 1
below.
Table 1 – Timecards not approved by supervisors for selected pay periods
Pay Period—3/29
through 4/11
Pay Period—9/27
through 10/10
Pay Period—12/6
through 12/19
Total employees
with 80 hours 3147 3293 3655
Total of timecards
without supervisory
approval
331
325
453
Average
11%
10%
12%
P a g e 10
CCiittyy aanndd CCoouunnttyy ooff DDeennvveerr
Kronos is currently not configured to require supervisory approval for timecards. Instead,
the only required approval is performed by Payroll Division staff. However, the lack of a
supervisor’s approval can result in inaccuracies or purposeful misstatements of time
worked or leave taken. This internal control weakness can lead to payroll underpayments
or overpayments to employees in addition to generating additional work for Payroll
Division staff by requiring additional processing of Kronos Change Forms in the event
corrections are requested after the pay period close date.
The City Controller has proposed to CSA that approving timecards be a standard part of
supervisors’ performance requirements and evaluation. The Payroll Division should
continue working to create a method of holding supervisors accountable for reviewing
and approving their employees’ timecards.
Limited testing did not detect ghost employees
The audit included an anti-fraud procedure using Computer Aided Auditing Techniques
(CAAT) to test for the existence of ghost employees. The term ghost employee refers to
someone on the payroll who does not actually work for the company3 whose pay goes
to an illicit receiver. These situations can defraud the City as monies are expended for
work that was not performed. Auditors selected a sample of names from the City’s
payroll registry based on certain risk indicators, and visited each employee in person to
ensure they actually existed. Auditors verified the employee by matching the name on
the payroll registry with the name and photo on the individual’s employee identification
badge. Although we cannot conclude for certain that there are no ghost employees on
the City’s payroll, for the sample tested, none were identified.
Additional Fraud Testing Could Be Performed—While audit work did not identify any ghost
employees, the Payroll Division could further mitigate risk of this fraud by incorporating
additional fraud assessments into their review processes. While reviewing payroll files, we
noted Payroll was testing for employees without tax tables, which is a good fraud test.
However, some additional tests could be made for common payroll frauds, such as ghost
employees or falsified hours and salary schemes.4 For example, auditors did not find
evidence of queries being run to identify employees without benefit records or potential
duplicate direct deposit accounts. Running queries for employees without tax tables,
benefits tables, and duplicate direct deposit accounts are three basic fraud tests which
can identify potential ghost employees and should be utilized. Additionally, auditors
found no evidence Payroll Division staff were reviewing Kronos timecards to determine
whether supervisors were creating employee time cards, whether supervisors were
approving overtime when out of the norm for the department, or whether employees
are clocking other employees’ time. These are examples of situations that could signal
fraudulent activity and would merit additional assessment.
Specifically, the Payroll Division should ensure that, at a minimum, it tests for: employees
without any tax information (such as the number of exemptions); employees without any
3 The Association of Certified Fraud Examiners Fraud Examiners Manual 2007 U.S. Edition pg. 1.553 4 Ibid.
P a g e 11
OOffffiiccee ooff tthhee AAuuddiittoorr
benefit information (such as health insurance); employees with duplicate direct deposit
numbers; whether supervisors are creating employee timecards; whether supervisors are
approving unusually high levels of overtime, and; whether an employee’s time is being
entered by a different person than the employee. The Payroll Division should consider
whether additional anti-fraud tests could be run and implement such tests where
feasible.
RECOMMENDATIONS
1. The Payroll Division should ensure that all relevant payroll file documents are
maintained together including direct deposit forms, separation payouts, and W-4 tax
forms.
2. The Payroll Division should ensure that all data entered into Kronos from Kronos
Change Forms be reviewed to ensure accurate entry.
3. The Payroll Division should ensure that all error reports receive two signatures
identifying the staff originally adjusting the error and the staff reviewing the error
adjustment.
4. The Payroll Division should deduct improper leave time granted to twenty-four
employees during a City snow closure on March 26, 2009.
5. The Payroll Division should ensure staff is trained in the procedures for applying and
seeking interpretation of CSA rules.
6. The Payroll Division should continue working to create a method of holding
supervisors accountable for approving their employees’ timecards.
7. The Payroll Division should ensure that, at a minimum, it tests for: employees without
any tax information (such as the number of exemptions); employees without any
benefit information (such as health insurance); employees with duplicate direct
deposit numbers; whether supervisors are creating employee timecards; whether
supervisors are approving unusually high levels of overtime; and whether an
employee’s time is being entered by a different person.
8. The Payroll Division should consider whether additional anti-fraud tests could be run
and implement such test where feasible.
P a g e 12
CCiittyy aanndd CCoouunnttyy ooff DDeennvveerr
FINDING 2
Improvements Needed in Timeliness of Processing Personnel
Action Forms (PAFs) and in Some Areas of Data Tracking
Audit work revealed that processing for PAFs, which is now done in part by the Payroll
Administration unit, has been completed thirty-seven to forty-four days after their
effective dates for the years 2006-2009. The work done by the Unit in processing these
forms could be tracked in a way more consistent within PeopleSoft which would aid
management in assessing the Unit’s processing performance. In addition, the Payroll
Division could better track and report data related to audits of payouts to separating
employees.
Processing for PAFs Is Generally Completed After the PAFs’ Effective Date
Auditors reviewed data from 2006 through 2009 to assess the timeliness of PAF processing,
and found that processing for these forms is generally completed after their effective
dates. In some cases, this can have monetary consequences to the City. For example,
some PAFs are generated for employees’ performance evaluations, which CSA Rule 13
requires to be completed by supervisors and received by CSA within 30 days after their
effective dates. If this does not occur, the employee whose evaluation is late
automatically receives a rating of “successful,” which means that the employee would
receive a pay increase. However, such employees’ performance may not have merited
a rating of successful, thus resulting in an inappropriate and irreversible pay increase.
Auditors reviewed data from April 1 through December 31 for the years 2006 through
2008 and reviewed data from January 1 through November 19, 2009. The City’s
traditional PAF processing involves multiple entities including the originating agency, the
Payroll Division’s Payroll Administration unit, and CSA. Auditors eliminated PAFs of
temporary employees and uniformed personnel who do not work under CSA from the
review. As shown in Table 2, (p. 13) the average number of days beyond the effective
date that the PAF processing is completed is not significantly different in 2009 than it was
in 2006. Specifically, the average number of days in 2008 and 2009 was thirty-eight and
thirty-seven days beyond the PAF effective date, respectively, compared to thirty-eight
days in 2006 and forty-four days in 2007. Further, also shown in Table 2, auditors
determined the percent of PAFs that took longer than average to process. Finally, Table
2 shows the number of PAFs that took over one year to process.
P a g e 13
OOffffiiccee ooff tthhee AAuuddiittoorr
Table 2—Average Days Beyond the PAF Effective Date That Processing Is Completed
Average number of
days that PAFs are
completed after the
effective date
Percent of PAFs
completed
beyond the
average
timeframe
Number of
PAFs
processed in
more than 365
days
Total number
of PAFs
auditors
reviewed
2006 38 days 24.7% 122 10,107
2007 44 days 22.5% 222 12,154
2008 38 days 24.6% 142 11,223
2009 37 days 23.1% 133 11,484
Reporting Differences Limit Assessment of Processing Efficiency—Due to limitations in how
PAF processing data is recorded by the Payroll Administrative unit, auditors were unable
to specifically determine where improvements could be made in processing efficiency.
Upon reviewing PAF processing data kept by the Payroll Administrative unit, auditors
determined that the log of incoming PAFs maintained by the Unit does not fully match
information in PeopleSoft. Specifically, auditors found that the Unit does not consistently
use the same PAF descriptors in its log as is used in PeopleSoft. Additionally, audit work
identified numerous entries in the Unit’s PAF log that did not contain all of the requisite
information. Consequently, we were unable to significantly match PAFs found in
PeopleSoft to the log maintained by the HR Division. Because the Payroll Administrative
unit receives PAFs from agencies, and then sends them to CSA, the missing or
inconsistent information in the Unit’s PAF log did not allow auditors to confirm the stage of
the process that most contributes to processing inefficiency. Similarly, the missing and
inconsistent data would hamper any internal Payroll Division assessment of the
Administrative unit’s PAF processing performance, and further hinders management from
finding resolutions to timeliness issues. The Payroll Division should ensure that it consistently
maintains all PAF processing information and does so in a manner consistent with
PeopleSoft descriptors. The Payroll Division should also consider using this information to
conduct additional analysis regarding the extent to which agencies, the Payroll
Administrative unit and CSA contribute to lack of PAF processing timeliness.
Some Separation Audit Data Not Tracked For Management Reporting
While reviewing Payroll Division operations, audit work determined important information
related to audits of payouts to separating employees was not being regularly tracked
and therefore, not available for use in management decision-making. Specifically, the
log used by Payroll Division staff to track separation information did not consistently
contain the datea separation-related PAF is received, the date the separation
paperwork is complete, and the amount of any underpayments or overpayments to the
employee who has separated.
P a g e 14
CCiittyy aanndd CCoouunnttyy ooff DDeennvveerr
Without compiling and tracking this information, the Payroll Division cannot provide its
management with adequate information about the separation audit process or trends in
underpayment or overpayments to separating employees. Additionally, the lack of such
reporting will make it difficult for management to ensure the overpayments are
recovered and the underpayments are made whole. The Payroll Division should ensure
that it consistently tracks and provides separation audit information to management
including the date a separation PAF is received, the date the separation paperwork is
complete, and any under or over payments.
RECOMMENDATIONS
1. The Payroll Division should ensure that it consistently maintains all PAF processing
information and does so in a manner consistent with PeopleSoft descriptors.
2. The Payroll Division should also consider using this information to conduct additional
analysis regarding the extent to which agencies, the Payroll Administrative unit and
CSA contribute to lack of PAF processing timeliness.
3. The Payroll Division should ensure that it consistently tracks and provides to
management separation audit information including the date a separation PAF is
received, the date the separation paperwork is complete, and any under or over
payments.