Department of Human Resources Payroll Accounting and Processing Audit Final Report : August 2009

Department of Human Resources
Payroll Accounting and Processing Audit
Final Report

August 2009

“promoting efficient & effective local government”

---

Introduction
The Internal Audit Office performed an audit of Payroll Accounting and Processing as part
of our Annual Audit Plan. Payroll processing involves paying county employees for their
services and accumulating and reporting payroll related information to interested third
parties in compliance with various laws, regulations, and other arrangements. It entails the
maintenance of detailed records for each employee on such information as gross earnings
and various payroll deductions as well as time worked and personal data. The total bi-
weekly pay processed by the Department of Human Resources (DHR) Payroll Division for
the pay period ended January 30, 2009, was approximately $35 million. While DHR Payroll
Division is responsible for the overall functions of payroll accounting, processing, and
information and records management; the tasks of compliance with personnel actions and
time and attendance reporting procedures and controls have been decentralized to
individual county departments.

Executive Summary
Our audit focused on determining the adequacy of internal controls over payroll
transactions within the Department of Human Resources (DHR) and the payroll processes
which have been decentralized to the agency level. Overall, the results of our audit
procedures indicated that controls over the processing and reporting of various payroll
transactions, and the maintenance of payroll records, were adequate and operating
effectively. Payroll amounts appeared to be accurately calculated, recorded and disbursed
and segregation of duties controls were generally well designed. However, the following
areas needed to be strengthened:

Time and Attendance

• Payroll contacts’ time was not being reviewed after time transfer each pay period at
five of the ten departments sampled for testing payroll controls increasing the risk
for erroneous or fraudulent payments.
• Overtime hours recorded on time cards for the Department of Public Works and
Environmental Services (DPWES) Solid Waste Collections and Recycling (SWCR)
and Disposal and Resource Recovery (SWDRR) employees were not supported by
adequate documentation, for disallowed overtime. Time punched in/out on the time
cards did not match the overtime hours reported. In addition, time cards were not
being signed by the employees. Other inconsistencies included instances where
the time clock was not being used to punch time in/out, and time was recorded
manually on time cards without supervisor initials.
• In one of the 10 departments tested, time and attendance reconciliations were not
being performed before calendar year 2008; reconciliations were not being signed
and dated by preparer at two departments and were not reviewed by anyone at two
departments. In addition, some of the departments tested were not performing a
periodic review of a representative sample of employee time records to actual time
processed, as required by county policy.
• Personnel in one division in the Park Authority were recording time directly into the
Payroll Accounting and Processing Audit
1

---

PRISM system without using time sheets to record approval of overtime and leave,
which was not consistent with the county policy.
• While the online time was being reviewed by supervisors, payroll contacts at Fire
and Rescue and Police were not performing a final review of each employee’s time
posted (including leave and overtime) with the approved time sheets prior to
submitting the time for processing, as required by the county policy.

System Controls

• Three out of ten departments sampled were not reviewing PRISM access levels of
employees on a periodic basis, as required by the county’s security policy, and
unnecessary access was found at seven departments reviewed.
• While the payments were found to be accurate, gross pay data was not included on
one of the screen prints for the PRISM system for some of the terminated
employees, raising concerns about the availability of payroll information.

Employee Record Maintenance

• Controls over the pay for performance process needed to be improved in
maintenance of evaluations in employee files and review of authorizations for
performance scores/rates, due to instances noted where evaluations were
completely unsigned or scanned in wrong employee files.
• DHR did not have a policy in place to update the authorized Personnel Action
Request form signatory for departments on a periodic basis to ensure that they
were current.

Employee Terminations

• One hundred eighty-five employees were coded as “active” on PRISM, though they
did not have any earnings for the past six months.
• Five of the ten departments sampled were not fully compliant with the county
Employee Clearance Record Checklist requirements, increasing the risk that county
property is not returned or access to county systems/information is not revoked at
the time of the employee termination.

Miscellaneous

• A sample of part-time (status T) employees revealed that several employees in this
category had worked in excess of 1,039 hours within the same employment year,
resulting in noncompliance with the county policy. The policy states that exempt
part-time employees may not work in excess of 1,039 hours in a given employment
year including both regular schedules and overtime hours, regardless of the
position’s scheduled hours.



Payroll Accounting and Processing Audit
2

---

Scope and Objectives
This audit was performed as part of our fiscal year 2008 Annual Audit Plan and was
conducted in accordance with generally accepted government auditing standards. We
tested controls over payroll transactions with DHR and those delegated to department
levels. The audit covered the period of July 1, 2006, through December 31, 2007, for our
substantive testing; however, for the purpose of better reporting on the adequacy of internal
controls over payroll especially at the sampled departments, we extended our audit period
into the calendar year 2008. The audit objectives were to determine that:

• Payroll records were accurate
• Authorization for personnel and payroll documents was proper
• Processed data matched source payroll records
• Overtime and compensatory time were properly approved
• Payments to current or terminated employees were accurate
• Cumulative tax withholdings and earnings were accurate
• Reconciliations were effective and supervisory reviews were adequate
• Reporting of payroll information to governmental agencies was accurate
• Payments were not made to terminated employees or to fictitious persons
• Assigned access levels to view or change payroll information were appropriate

Methodology
Our audit reviewed internal controls to determine if they were adequate to ensure that
amounts paid to employees were accurate and agreed with supporting documentation and
that only valid county employees were being paid. In addition, we reviewed processes to
determine that all the appropriate detailed records were accurately maintained and that
county agencies complied with the appropriate laws, rules, and regulations.

The majority of our audit fieldwork centered on testing within high risk areas. Our audit
approach included interviewing appropriate staff, observing employees' work functions,
detailed testing of transaction samples, and evaluating the processes for compliance with
sound internal controls, county policies, and departmental policies and procedures.
Information was extracted from PRISM for sampling and verification to source
documentation, and analytical reviews of exception reports were performed by pulling
PRISM data into our ACL audit software; however, our audit did not include an independent
review of system controls. Our transaction testing did rely on these controls; therefore, this
was a scope limitation. The potential impact of this circumstance on our findings was that
some portion of transaction data may have been erroneous. In addition, management
responses to findings were obtained only from the departments sampled for review, and not
from the ones resulting from a review at the DHR level.

The Fairfax County Internal Audit Office is free from organizational impairments to
independence in our reporting as defined by generally accepted government auditing
standards. We report directly and are accountable to the county executive. We report the
results of our audits to the county executive and the Board of Supervisors, and reports are
available to the public.
Payroll Accounting and Processing Audit
3

---

Findings, Recommendations, and Management Response
1.
Review of Payroll Contacts’ Time

DPWES Solid Waste Collection and Recycling Division, Reston Community Center,
Planning Commission, Park Authority, Fire and Rescue

The payroll contacts’ time was not being reviewed after time transfer for each pay
period. Payroll contacts have the ability to enter and transfer their own time, and to
change time that has been locked or even transferred without any independent
review. Personnel/Payroll Administration Policies and Procedures (PPAPP)
Memorandum #8 requires that department directors designate someone other than
the payroll contact to perform the final review of the payroll contact’s time and
compare the exceptions to the approved Leave and Overtime Schedule after time has
been transferred each pay period. Inadequate controls over payroll contacts’ time
could increase the risk of unauthorized or inaccurate payroll disbursements.

Recommendation: We recommend that the departments comply with the
requirement of PPAPP #8 to review payroll contacts’ time to provide greater
assurance that the payroll processed is accurate, properly approved and documented.
Further, the new ERP system should restrict access to payroll contacts to make
changes once their time has been locked in by supervisors.

Management Response: Each of the departments in the above finding have
provided responses which include action plans for correcting deficiencies and
ensuring future compliance. An itemized listing of these individual departmental
responses is included in Attachment A.

Department of Human Resources: DHR will revise Personnel/Payroll Administration
Policies and Procedures, Memorandum 8, to include a form that should be completed
each pay period by the person reviewing the payroll contacts’ time. This form is to be
maintained at the department along with the timesheets for a period of three years.
The Payroll Division will conduct a compliance audit biweekly by randomly selecting
departments. The anticipated completion date is December 31, 2009.

Additionally, this issue is on the Draft Requirements list for the future ERP system
which is in the process of being prioritized and approved for implementation. DHR
has reviewed the potential software candidates for implementation and noted that they
all have the capability to address this control.

2.
Time and Attendance Reconciliations

Planning Commission, Reston Community Center, Park Authority, Department of
Administration for Human Services, DPWES Solid Waste Collection and Recycling
Division, Department of Family Services/Office for Children

Payroll Accounting and Processing Audit
4

---

While time and attendance reconciliations were being performed at most of the
departments in our sample, some of the departments were not fully compliant with the
reconciliation policies and procedures set forth in PPAPP #8. For instance, for the
Planning Commission, the reconciliation for the pay period ended in November 2007
was performed in March 2008. We were informed that the Planning Commission was
not performing reconciliations before 2008. At the Reston Community Center and Park
Authority, the reconciliations were not signed and dated by the preparer. At the
Department of Administration for Human Services and Planning Commission, the
reconciliations were not being reviewed. In addition, some of the departments tested
were not in compliance with PPAPP # 8 relating to periodic review of a representative
sample of employee time records to time processed.

PPAPP # 8 requires that all the reconciliation reports be signed and dated by the
person performing the reconciliation. The memorandum also requires that, on a
periodic basis, the department director or a designee other than the payroll contact
review the reconciliation process and documentation and compare a representative
sample of employee time records to the time processed for those employees and to
the supervisor’s approval for leave and overtime. Failure to sign and date the
reconciliations increases the risk of reconciliations being performed in an untimely
manner and violating segregation of duties controls. Lack of supervisory review
increases the risk of outstanding items that are not followed up in a timely manner.

Recommendation: We recommend that the departments comply with the
requirements of PPAPP #8. Reconciliations should be signed and dated by the
preparer in order to evidence that the reconciliations are being performed in a timely
manner by someone other than the personnel/payroll contact. In addition, a
representative sample of authorized employee time records should by periodically
reviewed by supervisors to compare leave and overtime to time processed and ensure
integrity of the time and attendance data.

Management Response: Each of the departments in the above finding have
provided responses which include action plans for correcting deficiencies and
ensuring future compliance. An itemized listing of these individual departmental
responses is included in Attachment A.

3.
Time and Attendance Controls

DPWES Solid Waste Collection and Recycling Division and Solid Waste Disposal and
Resource Recovery Division

In the DPWES Solid Waste Collection and Recycling (SWCR) and the Solid Waste
Disposal and Resource Recovery (SWDRR) Divisions overtime hours actually
reported did not match the time punched in/out on the time cards, and time cards
were not signed by employees.

Eight out of nine employees’ time cards verified for the SWCR Division for one pay
period did not accurately support the overtime granted to employees by their
Payroll Accounting and Processing Audit
5

---

supervisors. For instance, an employee punching out late would get overtime on one
day and on another day would get less or no overtime. An overtime analysis for the
eight employees for the pay period reflected a total of 39 overtime hours per the time
card data whereas the actual hours granted to employees by their supervisors was
15, a difference of 24 hours. We were informed that SWCR employees were
constantly observed by their supervisors who determined whether an employee was
entitled to overtime and could override overtime clocked on the time cards. However,
nothing was documented on the time cards which would support any differences
between time punched on time cards and time posted in PRISM. There was nothing
available in writing to document these overtime procedures. In addition, a comparison
of the overtime sheets with time records revealed that overtime for one employee was
not recorded and therefore, not paid. The department management informed us that a
pay adjustment for this omission would be submitted.

Similar inconsistencies were observed in six out of eight employees’ time cards
verified for the SWDRR Division for one pay period. An overtime analysis for the eight
employees for the pay period reflected a total of 103.6 overtime hours per the time
card data whereas the actual hours posted to PRISM was 63.5 hours, a difference of
40.1 hours. Further, the time clock was not consistently used to punch time in/out;
some time was recorded manually on time cards without supervisor initials.

Employees working at field sites for the SWCR and SWDRR reported their hours
worked by punching in and out on a time clock at the beginning and end of each work
day. The time cards indicated all time worked each day, including overtime. The
administrative assistants at the sites used the time cards to enter time into PRISM.
Therefore, information contained on the time cards should have been compatible and
form the basis to support the individual wages earned and paid to each employee.
Further, county policy requires all time sheets be signed and dated by employees and
time cards are considered a form of time sheet. Lack of proper documentation on time
cards for time reported could increase the risk of under/over-stated payroll
disbursements and of payroll fraud. Since signatures on time cards are part of the
payroll approval process, integrity and accuracy of payroll processing may be
compromised.

Recommendation: SWCR and SWDRR should take immediate action to ensure that
all overtime allowed or disallowed at the field sites is properly documented and the
actual overtime hours reported is reconciled with the time cards. In addition, they
should document their procedures specifying when overtime will be allowed or
disallowed. All time cards should be signed by the employees. If signatures are
unattainable, documentation of efforts should be maintained.

Management Response:

DPWES Solid Waste Collection and Recycling Division: All time cards will be signed
by the employee for verification of time worked. Should the punched time card reflect
a difference from actual time worked, it will be documented. The implementation is
effective April 2009. A SOP will be developed documenting required agency
Payroll Accounting and Processing Audit
6

---

timekeeping procedures by July 1, 2009.

DPWES Solid Waste Disposal and Resource Recovery Division: Agency personnel
are drafting an agency-specific standard operating procedure for time and attendance
documentation; reconciliation, employee time card usage; purpose; signatures; and
accurate, consistent and verifiable authorization of overtime by supervisory personnel.
The anticipated implementation date is June 1, 2009.

4.
Use of Time Sheets

Park Authority

None of the Park Authority payroll staff was using time sheets to report time, even
though exceptions to regular schedule (sick leave, annual leave) for some employees
were noted for the time period tested. All time including exceptions to regular schedule
was being recorded directly into the PRISM system.

PPAPP # 8 requires the use of “Leave and Overtime Schedule” or a similar form
designed by the agency to suit its needs, for the purpose of reporting exceptions to
employees’ regular schedule, e.g. leave and overtime. Non-compliance with the
requirements of this memorandum can result in incomplete time and attendance
reporting documentation and a lack of audit trail for exceptions to the employee’s
regular schedule, increasing the risk of erroneously or fraudulently posted time.

Recommendation: Park Authority should comply with the requirements of PPAPP #
8, and ensure the department completes the Leave and Overtime Schedule Form (or
a similar form designed by the department to suit its needs) for reporting and approval
of all exceptions to employees’ regular schedules.

Management Response: Payroll specialists and payroll supervisor will complete a
Leave and Overtime Schedule to record work hours and exceptions consistent with
PPAPP #8. Additionally, staff in Financial Branch of the Administration Division will
complete Leave and Overtime Schedules, consistent with PPAPP #8. Further,
appropriate time and attendance reporting and documentation procedures will be
reinforced with staff agency-wide through issuance of a Director’s Critical
Communication. The anticipated implementation date is June 5, 2009. Director’s
Critical Communication scheduled for release in September 2009.

5.
Review of Online Time by Payroll Contacts

Fire and Rescue, Police Department

We noted that while the online time was being reviewed by supervisors, payroll
contacts at the Fire and Rescue and Police Department were not performing a final
review of each employee’s time and comparison of exceptions (leave and overtime)
with the approved time sheets prior to submitting the time for processing, as required
by PPAPP #8. The non-compliance applied to the entire department. The payroll
Payroll Accounting and Processing Audit
7

---

contacts were not receiving the time sheets in time to review the time prior to transfer.
At the Fire and Rescue Department, the payroll office was only verifying the
correctness of sub-object codes, scheduled hours, etc. online before transferring time.
At the Police Department, the payroll office was verifying the overtime summaries
received from stations and the PRISM online screens for each employee; however, a
comparison of time sheets to PRISM was not being performed.

Per PPAPP #8 Time Data Entry/Verification, payroll contacts are responsible for
performing a final review of each employee’s time and comparing exceptions (leave
and overtime) with the approved leave and overtime schedule form (or similar form
used by that department) prior to submitting the time for processing by the payroll
system. Non-compliance with this requirement results in bypassing the second level of
time sheet review for the accuracy of time and attendance reporting.

Recommendation: We recommend that the departments concerned meet with DHR
to develop an acceptable application of PPAPP # 8 that meets the control objectives.
The memorandum requires compliance by all the county departments; however, for
departments which cannot comply with the requirements due to the nature of
operations, DHR should either provide an exception or amend the memorandum to
exclude those agencies.

Management Response:

Fire and Rescue Department: Due to the 1400 field personnel on three separate 24-
hour shifts (and day work) in the Fire and Rescue Department completing Online Time
and Attendance reports each pay period, the responsibility for performing a final
review of each employee time will rest with field supervisors. The Fire and Rescue
Department will develop a verification form to be signed by field supervisors validating
the reporting of leave and overtime exceptions with the approved department form,
FRD-043, Authorization for Leave and Overtime. Payroll contacts will also spot check
field battalion time and attendance reports to ensure a redundant means of
verification. The implementation is effective pay July 17, 2009.

Police Department: The department requested from DHR an exemption to PPAPP #8,
Online Time Data Entry/Verification, on June 9, 2009.

Department of Human Resources: DHR will work with Fire and Rescue and the Police
Department to develop acceptable compensating controls in this area to be able to
provide these departments with a written exception to Personnel/Payroll
Administration Policies and Procedures, Memorandum 8. The anticipated completion
date is December 31, 2009.

In the future, we believe the ERP will reduce, if not eliminate this risk if configured for
such a scenario.


6.
PRISM Access
Payroll Accounting and Processing Audit
8

---

DPWES Solid Waste Disposal and Resource Recovery Division, Department of
Administration for Human Services, Police Department, Fire and Rescue Department,
Park Authority, Department of Family Services/Office for Children

Two of the ten departments sampled were not reviewing employee PRISM access on
a periodic basis to assure that they reflected current employee job assignments, in
accordance with the county’s revised security policy. Further, unnecessary access to
PRISM for update and inquiry was found in six of the ten sampled departments. For
instance, one employee at the DPWES Solid Waste Disposal and Resource Recovery
Division had PRISM access to update and view records which was not in agreement
with the employee’s job function. The departments where we found instance(s) of
unnecessary access were: Department of Family Services, Department of
Administration for Human Services, Police Department, DPWES Solid Waste Disposal
and Resource Recovery, Fire and Rescue Department and Park Authority.

The County’s Information Technology Security Policy 70-05.01 provides that “each
agency must authorize and enforce a user’s access to and action towards specified
resources based on least privilege.” Providing unnecessary capabilities to PRISM
users presents opportunities for making unauthorized additions, deletions, or changes
to information that could compromise the integrity and confidentiality of payroll data
and increase the potential for fraud.

Recommendation: We recommend that the county departments periodically review
the validity and reasonableness of all access to PRISM. Users should be granted
access only to the resources needed to perform their official functions. The access
authorizations of system users, who have been terminated, transferred, or whose job
responsibilities have changed, should be removed. Emergency and temporary access
authorizations should also be automatically terminated after a predetermined period.
The new ERP system should be capable of automatically generating access reports
and emailing them to agency management for tracking employee access.

Management Response: Each of the departments in the above finding have
provided responses which include action plans for correcting deficiencies and
ensuring future compliance. An itemized listing of these individual departmental
responses is included in Attachment A.

Department of Human Resources: DHR will send out a memo at least quarterly,
modifying as needed, to encompass the issue at hand. They will also attach the
policy noted above. Also, in the monthly training seminars, they can elevate this issue
in their discussions with attendees. The anticipated completion date is July 31, 2009.

Additionally, this issue is on the Draft Requirements list for the future ERP system
which is in the process of being prioritized and approved for implementation. DHR
has reviewed the potential software candidates for implementation and noted that they
have the capability to address this control through an identity management tool.

Payroll Accounting and Processing Audit
9

---

Document Outline

• ??
• ??
• ??
• ??

---