E D I T E D BY D O U G L A S Z I E G E N F U S S RESEARCH CONNECTION

The Human Resources Audit

Adding HR to the

regular audit cycle can

help ensure major risksaren't overlooked.

BY KELLI W. V ITO

RENDS IN HUMAN RESOURCES {HR)management often find their way into theheadlines, forcing organizations to takenotice of their potential risks. Some recentissues include executive managementethics, skyrocketing health-care costs,employee fraud, and MR outsourcing.

Other risks associated with HR includenoncomphance with employment laws,inadequate compensation and benefitplan design, not maintaining appropriatestaffing levels, and poor record keeping.Despite all of these risks, internal audi-tors have only recently begun to considerregularly auditing the HR function.

Auditors may be surprised at the broadscope of HR issues to review. A com-prehensive HR audit includes the mainfunctional areas of workforce planning,employee development, compensation andbenefits, employee and labor relations, andrisk management.

WORKFORCE PLANNINGA common definition oi workforce plan-ning is "to have the right number of peo-ple, with the right skills, at the right timeto perform the required work." An audi-tor reviewing workforce-planning effortsshould focus on whether HR is performingadequate analyses and developing actionplans to ensure the organization is not leftwith a shortage of qualified workers.

HR departments often spend significanttime recruiting and selecting job candi-dates. Auditors should assess whetherHR is documenting applicant informa-tion accurately and timely and whetherrecords are current. Auditors should alsoverify that HR is using suitable recruitingsources that are capable of furnishing ade-quate numbers of qualified applicants.

Risks associated with the inter\aew pro-cess include permitting untrained managersto ask illegal questions, requiring applicant

tests that arc invalid or illegal, and docu-menting inappropriate reasons for selectionor nonselection. Supervisors should not beasking applicants questions related to theirrace, gender, religion, marital status, dis-abilities, ethnic background, or country oforigin. U.S. organizations should be carefulnot to develop hiring tests that vi(jlate theEqual Employment Opportunity Commis-sion's 4/5ths rule in minorities hired.

In reviewing the organization's structure,auditors should look for red Hags such asfirst-line supervisors with spans of controltoo great to he practical; middle managerswith lines of authority over only one othermanager, and chains of command that arenot clearly designated or that reflect mul-tiple, conflicting reporting relationships.Problems in this area can result in conflictsbetween departments, inefficiencies, inabil-ity to keep up with customer demands, andlow employee morale.

In organizations that hire contractors,auditors should ensure controls are in placeto monitor these individuals or pnividers. Inthe United States, contractor duties shouldbe routinely monitored to ensure they meetInternal Revenue Service requirements forcontractor versus employee status.

HR also has a vital role in analyzingemployee turnover. Auditors can reviewturnover analysis and the exit interviewprocess to determine whether high turn-over is putting a strain on recruitingefforts and work productivity and whethermanagement is appropriately addressingissues raised by exiting employees.

EMPLOYEE DEVELOPMENTTraining is notoriously one of the firstprograms to he cut in a budget crunch.However, a decrease in training can havea direct impact on performance and ulti-mately on an organization's bottom line.Auditors should assess whether HR is

APRIL 2 0 0 8 I N T E R N A L A U D I T O R

R E S E A R C H C O N N E C T I O N

monitoring training needs and makingadjustments, offering the appropriatelevel of training for different positions,and conducting cost-benefit analysis fortraining programs.

One of the greatest risks an organizationcan face is supervisors who are not trainedin employment law or how to manage theirsiihordinates' performance. When auditingthe employee performance managementsystem, auditors should assess whetherappraisals are done timely, are based onjob-specific criteria, and do not documentinformation that could be considereddiscriminatory. Ineffective performancemanagement systems can result in a lackof good informal feedback from managersto employees, minimal employee develop-ment, and low employee engagement levelsaffecting organizational productivity.

There are also risks associated withemployee counseling and discipline. Audi-tors should verify that management docu-ments performance problems and actionstaken, including acknowledgement thatthe employee was made aware of the prob-lem. This is important because disciplinedemployees may file an internal grievance

or external complaint or lawsuit. Manage-ment's documentation should include sup-port for the decision made because it couldbecome subject to further scrutiny.COMPENSATION AND BENEFITSEmployee reward systems, including allcompensation and benefits programs, areone of the most complex HR systems. Areward system should help support theorganization's strategic mission, motivateemployees, and reward performance. Com-pensation systems should be both externallycompetitive and provide internal equity.Auditors may want to work with a compen-sation expert when reviewing this area.

During the audit, auditors should ensurethat: a compensation philosophy has beendeveloped that defines how the organizationwants to pay people with respect to its posi-tion in the labor market; there are currentjob descriptions for each position; an effec-tive market analysis has been conducted; asalary structure has been developed to helpmanage pay; and an appropriate job evalu-ation system is being used to slot jobs intothe salary structure. A review ot the organi-zation's salary administration process is also

important to determine how employees arepaid throughout their careers, includingmerit increases, variable performance pay,promotions, bonuses, stock options, anddeferred compensation, to name a few.

A key area of risk for U.S. organizationsis appropriately complying with the FairLabor Standards Act (FLSA) regardingovertime pay. Organizations must cor-rectly classify each position as nonexempt(subject to overtime pay) or exempt (notsubject to overtime pay). In addition, theymust correctly calculate overtime pay fornonexempt employees. A review of thepayroll function should ensure that newhires, personnel actions, work hours, anddifferential pay are efficiently processed sothat paychecks are accurate and processedtimely. Auditors should verify controls toensure that the confidentiality of personneldata is maintained, addifions to base pay areappropriately calciJated and authorized, fullcompliance with tax and other deductions ismade, terminating employees' payrolls areprocessed appropriately, and payroll costsare in line with budgeting objectives.

On the benefits side, employee benefitprograms often include medical insurance.

SOX TestedQAR AccreditedIndependent; toensure you receiveunbiased results

PRI AUDIT & CONTROL

Providing internal audit services andstaffing support worldwide since 1984.We are big enough to be competitive,but small enough to care.

www.pr iaudi t .com

ChJcago-lndianapolis-South Bend-NashvilleNew Orieans-Antwerp Belgium

(574) 237-0877-(800) PRI-2003pni Is a division of Professional Resources International

I N T E R N A L A U D I T O R A P R I L 2 0 0 8

R E S E A R C H C O N N E C T I O N

life insurance, vacation and leave policies,and some form of orgimization-sponsoredretirement or savings plan. Factors to con-sider in auditing benefit plans are exter-nal competitiveness, cost effectiveness,management goals, employee needs, andcompliance with state and federal laws. Inaddition to being financially burdensome,poorly designed benefit plans may not sup-port an organization's strategies.

EMPLOYEE AND LABOR RELATI0N5Much of HR administration deals with theprocesses related to managing employeesthroughout their careers with the orga-nization. There are several employmentrisks to consider, including discrimination,harassment, wrongfiil discharge, negligentbiring, retention, and employee privacy.Internal auditors should ensure that HR: I las comprehensive policies and

procedures that are compliant withemployment regulations and reflectbest practices.

Conducts employee attitude surveys andtakes action based on survey results.

Miunt;uns appropriate employment filesfor each employee, including separate

files that document demographic andmedical infonnation.How an organization handles employee

complaints and grievances is an area wherea clear audit trail is necessary. Documenta-tion should include the date, situation, andnature of the grievance or complaint; theaction management has taken; any inves-tigation results; and the final outcome orsettlement. If an organization has a laboragreement, then policy changes, attitudesurveys, and employee complaints andgrievances have an added element of reviewand negotiation.

RrSK MANAGEMENTAccording to the Society for HumanResource Management, the "people risk"is exposing organizations to more liabilitythan traditional areas of risk management.With the surge in worker's compensationexpenses, discrimination violations, andother compliance issues, the risk function isoverlapping with safety and IIR more thanever. Auditors' review of the organization'ssafet)' and health program should focuson whether work-site analyses to identiiyhazards and potential hazards, stringent

prevention and control measures, andthorough training are provided. HR shouldestablish controls to minimize risk, includ-ing succession planning, adequate sever-ance and outplacement services, executivecoaching and development, thorough HRhandbooks, documented employee hiring,training and termination procedures, andinternal employee surveys.

AN OVERLOOKED AUDIT AREADespite its integral role, MR has often beenconsidered a "soft" area, and managementmay not understand the inherent risksinvolved with this function. Adding anHR audit to an organization's regular auditcycle pro\ades important risk coverage thatmay have been previously overlooked.

KELLI W. VITO. SPHR, CCP, is the principal ofKV Consulting, a human resources consultingfirm based in Austin. Texas, and the authorof Auditing Human Resources from The IIAResearch Foundation Handbook Series (2007).

To comment on this article, e-mail the authorat kelli.vito@theiia.org.

\ou ik-scnf murketinf; syour [lotcntiji through:

Partnership Program - lilnjoy(.nntafl w i lh I IA niemhers.

Conference Exhibits & Sponsorships -\k 'c l \(iiii i.-usinnK'i"^ livt' iind in person.

Print and Online Advertising Get yourmessage read by affluent, well-traveleddecision makers.

IIA niiirke! ing so lu t ions w o r k - ("or you!

Contact us today at adverttsJng@theiJa.orgor+1-407-937-1109.

08314

MMMn

The Auditor's Choice

To expose suspected errors

WizRulebusiness rules detector

To reveal similar or identical records

SSS WizSame

. r i ^ duplicate rccord.s di.scoverv

To match one-to-many and many-to-many

WtjWizCounf^ ^ ^ B f l bank/account reconciliation

for a live online demonstration visit www.wizsoft.com

WizSofrmakes a difference

(516)393-5841 info@wizsoft.com

A P R I L 2 0 0 8 I N T E R N A L A U D I T O R