Audit of Time and Attendance Office of Internal Audit May 2015

Transcription

1 Audit of Time and Attendance Office of Internal Audit

2 TABLE OF CONTENTS Executive Summary 2 Background Scope and Methodology & Conclusion 4 Audit Findings, Recommendations, and Management Responses 6 Time and Attendance Systemic Issues 6 Fieldwork Findings 16 Summary of Audit Results by School 20

3 Executive Summary In accordance with the approved Internal Audit Plan, the has completed an audit of time and attendance across FCPS schools and departments. The objectives of the audit were to: document the existing control framework, including policies, regulations, and legislation; determine whether the systems and practices are adequate to detect and deter noncompliance; determine compliance with better practice time and attendance management; and identify areas of improvement for time and attendance management. The audit found that there is a very high level of satisfaction within the Division for the services and support provided by the Office of HR Business Services and the Office of Payroll Management. Time and attendance processors consider that they have been well trained and are able to seek advice when required. This is an important control which supports the effective management of time and attendance. As part of the fieldwork testing, Internal Audit randomly selected 55 schools and offices (26 elementary schools, six middle schools, four high schools, three centers/ alternative schools, and sixteen department offices) or 17 percent of the available 331 time reporting locations. One hundred percent of T&A records for the first biweekly and the monthly October 2014 payroll at these sites were reviewed for accuracy, completeness, and appropriateness. The exception is the fieldwork for Transportation Services where it was considered appropriate to reduce the sample size given the extremely high number of employees and the fact that there were no errors detected. The largest area of concern relates to maintaining system integrity with 62% of schools and departments audited failing to correctly enter time and attendance information into Lawson (the human resources information and payroll system), with a total of 316 exceptions. This results in a lack of confidence in the information maintained, which in turn has a direct impact on employee payroll and leave balances. It also undermines the ability for management to use the data contained in Lawson for strategic purposes. One reason for the lack of data integrity is the inflexibility of Lawson which prevents time and attendance processors entering the correct time for staff whose regular hours fall outside the preset data entry parameters. This is an issue that should be taken into consideration in the development of a new time and attendance recording system. Another significant opportunity for improvement identified in the audit relates to the strategic use of information housed within the time and attendance system to support the operations of FCPS and meet better practice standards for information management. FCPS has commenced a project for the replacement of the existing system and the findings in this audit are a timely input to the implementation of the new system. There is an opportunity for FCPS to determine the type of data that is needed to help inform and assess strategic planning for the Division. 2 of 23

4 Audit results are based on School Board policies, regulations, accounting procedures, and proper internal controls. The results were provided to each individual school/office detailing the findings noted during the audit and any suggestions for improvement. Additional information regarding the audit process has been included in the methodology section of this report. 3 of 23

5 Background Background, Scope and Methodology, & Conclusion FCPS currently has 38,235 employees in the time and attendance system, Lawson. This figure includes 5,491 registered substitute teachers and assistants. The total cost for compensation and benefits, according to the 2015 budget, is $2.2 billion. The payment of salaries and benefits is dependent on the information entered into Lawson. There are a number of different categories used for the administration of employee time and attendance. Employees can be categorized by the frequency of their pay as either monthly or biweekly and have the following attributes: Monthly Negative reporting: account for absences, presumed present unless reported otherwise. Paid according to contract days and scheduled hours. T&A Groups: 05 Less than 12 month employees month employees Bi-weekly Positive reporting: account for all time during scheduled work hours. Paid according to actual hours worked. T&A Groups: 01 Substitute teachers and assistants 03 Temporary assignments exempt 04 Temporary assignments nonexempt 06 Transportation route supervisors 08 Substitute food services 09 Maintenance and security 10 Custodians 11 Food services employees 13 Bus drivers 14 Transportation attendants 15 Substitute bus drivers 16 Substitute transportation attendants Of FCPS total contracted employees, 82% are paid monthly and 18% are paid biweekly. In addition, FCPS employs non-contracted individuals including substitutes and temporary assignments who are paid biweekly. Monthly employees are required to complete Form FS Leave Request for Monthly Paid Employee for any absence during their contracted hours. Leave types recorded on this form include: annual leave; FMLA leave; administrative leave; job related injury; personal leave; sick leave (self); leave without pay; and sick leave (family). Bi-weekly employees record the hours worked and leave taken on timesheets with a different form used for each time and attendance (T&A) group. 4 of 23

6 Data recorded on timesheets and leave requests is entered at each work location by a T&A processor. Currently there are 331 time reporting stations (TRS) and 1,139 staff with access to enter T&A information. The data is entered into FCPS human resources information system Lawson. The information entered is then used to generate the payroll each period either bi-weekly or monthly depending on the employee type. Lawson also maintains the records of employee leave balances. An audit of time and attendance was previously undertaken by the in Given the high dollar value of employee salary costs and potential for misuse, it was considered appropriate to include a further audit on the Internal Audit Plan. At the time of the prior audit, FCPS had begun a project to replace the HR/Payroll system with SAP as part of the FOCUS initiative. The new SAP system was expected to address many of the prior audit findings, so only the clarifications to procedures in regulations and training materials were made immediately following the prior audit. When the decision was made to halt the SAP implementation, all system changes were deferred until the current HR/Payroll system could be upgraded to a supportable version and a new time and attendance module could be implemented. Scope and Methodology Internal Audit conducted an audit of the FCPS time and attendance framework, including policies and regulations, internal control elements, electronic systems, and best practice time and attendance management across multiple jurisdictions. In depth fieldwork testing was also performed to assess the effectiveness of the internal controls to detect and prevent fraudulent activity. As part of the fieldwork testing, Internal Audit randomly selected 26 elementary schools, six middle schools, four high schools, three centers/ alternative schools, and sixteen departments. One hundred percent of T&A records for the first biweekly and the monthly October 2014 payroll at these sites were reviewed for accuracy, completeness, and appropriateness. The exception is the fieldwork for Transportation Services where it was considered appropriate to reduce the sample size given the extremely high number of employees and the fact that there were no errors detected. A comprehensive survey was sent to all employees with access to Lawson as an adjunct to the in depth fieldwork to determine the level of compliance with T&A regulations and guidelines and also identify potential areas of improvement, particularly in relation to the development of a new human resources information system. This survey was sent to 792 employees with 437 respondents, representing a response rate of 55%. It is noted that not all employees with access to Lawson are dedicated T&A processors. The FCPS is free from organizational impairments to independence in our reporting as defined by generally accepted government auditing standards. The office reports directly to the School Board Audit Committee. We report the results of our audits to the Audit Committee and the reports are made available to the public via the FCPS website. We conducted our audit in accordance with auditing standards generally accepted in the United States of America, and the standards applicable to performance audits contained in Government Auditing Standards, excepting peer review, issued by the Comptroller General of the United States. 5 of 23

7 Audit Findings, Recommendations, Time and Attendance and Management s Systemic Response Issues The audit identified a number of opportunities for improving the management of time and attendance within FCPS. These can be broadly divided into two categories: Systemic issues relate to either the electronic system, Lawson, or the administration of the time and attendance framework; or Effectiveness of the internal controls, reporting the results of the fieldwork testing. This report is accordingly structured in two parts, outlining the findings and recommendations as they relate to either systemic issues or fieldwork testing. 1. Systemic Issues The following findings and recommendations were identified as a result of the audit of better practice time and attendance management, the FCPS wide survey of time and attendance processors, and in-depth fieldwork. 1a Inability of Lawson to reflect actual time and attendance The purpose of any time and attendance information system is to accurately record the hours worked and leave taken by employees. This information then forms the basis for payroll and benefits management. It can also be used for strategic information purposes as well as maintaining records of employee location, which may have implications for establishing or disputing liability for an event involving an employee. At the time of the audit, Lawson does not have the capacity to record regular hours worked outside of a standard eight hour day nor record leave taken over a weekend. However, some staff, such as Safety and Security officers are required to work hour shifts over a seven day roster. Time and attendance processors are forced to split the time worked and/or leave taken over additional days to ensure employees are paid the correct amount. It is also difficult to account for part-time staff with leave often split over multiple days to ensure that the correct amount is debited from the employee s leave balance. The information recorded in Lawson for bus drivers and attendants also does not reflect the actual hours worked on the actual days, rather the total hours recorded on timesheets is spread over the work week. It is important that the information recorded in any time and attendance information system reflects as accurately as possible the actual hours worked and leave taken by employees on the days that the events actually took place. This enables executive management the opportunity to use the information to identify trends in attendance, overtime, and leave by employee group or worksite. It is also important to have an official record of employee attendance for liability purposes. The inability to correctly record employee time and leave information also contributes to higher error rates in data entry as T&A processors are required to convert the actual hours worked into a format that is accepted by Lawson. 6 of 23

8 It is recommended that business requirements for the new electronic time and attendance system include the capacity to reflect multiple standard hours for different employees. Management Response: In preparing and designing the new time and attendance system the restriction from time reporting on weekends and holidays has been removed, and common work schedules functionality will be configured in the new software where possible. 1b Opportunity to use information strategically In general, the purpose of any management information system is two-fold: provide an official record of transactions; and provide information to support strategic decision making. As discussed above, there are opportunities to improve the accuracy of the system to better meet the first purpose, but it is also apparent that the second purpose is not currently being met by Lawson. Better practice suggests the importance of using the information contained within a time and attendance information system to inform decisions about workforce planning, effectiveness of wellness programs, actual instructional hours, absence rates of different employee types, seasonal absenteeism, and leave liability, at the division level, regional level, and site level 1. For example, the United Kingdom (UK) has identified that teacher absences significantly reduce pupil achievement. As a result they have used time and attendance data to build absence profiles across schools, allowing managers to identify patterns of absences and help understand and respond to the range of factors influencing teacher absence 2. This in turn informs the development and evaluation of intervention strategies. The UK also identified that teachers responsible for special needs education have higher rates of absence, related to a more stressful environment. As a result, research into targeted wellness programs for special education teachers is being undertaken. Interviews with principals during the fieldwork stage of this audit also identified a desire for better access to information within Lawson to help manage local attendance issues. It is understood that Lawson does have some capability to provide some limited management information but there is little understanding at the local level of how to extract the information. It is considered that there is an opportunity with the planned implementation of a new time and attendance module for the Human Resources Information System (Workforce Management) to build in the capability for customized reporting modules. According to the 2015 FCPS budget, employee salary and benefits will cost FCPS $2.2 billion, making up 88.8% of the total budget. Ninety-three percent of employees are school-based. School divisions are in the unique position of being able to directly quantify the cost of instructional employees by tracking the amount spent on substitutes. Given the significance of the budget allocation to employees, it is considered part of the effective and efficient management of resources to better monitor and 1 Time and Attendance Best Practice (2008) Hackett Group; The Management of Substitution Cover for Teachers (2010) Northern Ireland Audit Office; Absence Management in the Australian Public Service ( ) Australian National Audit Office 2 The Management of Substitution Cover for Teachers (2010) Northern Ireland Audit Office 7 of 23

9 evaluate time and attendance information 3. This can be achieved by identifying benchmarks and objectives for attendance and reporting on their achievement. Benchmarks for average teacher absences are available, as well as broader public sector benchmarks from the United States Bureau of Statistics. It is important that time and attendance strategies are linked to the strategic goals of FCPS, such as the beliefs and operational expectations outlined in the School Board Strategic Governance Manual. For example, the effective educators are essential to student success belief and Operational Expectation One, particularly the Superintendent shall track, measure, and evaluate FCPS effectiveness in realizing student achievement and improving business processes, including both benefits and costs, in a timely manner. It is noted that, at the time of the audit, the Department of Human Resources was hosting focus group meetings with selected principals and program managers to identify reporting requirements at the local level. However, it is considered important that the strategic information needs also be considered in the development of Workforce Management. It is recommended that the Office of Payroll Management and the Office of HR Business Services ensure the new system has the capability to run strategically meaningful staffing reports. Management Response: While there are resources and information currently available from Lawson, the requirements for user friendly and robust reporting in WorkForce Management (WFM) have been identified. 1c High number of correction memoranda Time and attendance information is entered into Lawson at each work location with a Time Reporting Station (TRS). T&A processors are able, and encouraged, to enter time and attendance data on a daily basis until the deadline for the relevant period passes. Once the deadline passes, access to Lawson closes in order for Payroll to be processed and the results are then interfaced with the financial management system. It is understood, however, that exceptional circumstances arise where an error has been made, or an employee is not available to submit a timesheet on time and Lawson needs to be updated after access is closed to processors. In these cases, T&A processors are required to complete a Time and Attendance Corrections/ Omissions Memorandum (Form FS73-63) for approval by the program manager/ principal. Once approved, the memo and the original timesheet or leave request are sent to the Office of Payroll Management for entry into Lawson to correctly pay the employee. If five or more changes are required from the same location for the same pay period, the T&A processor is required to make the changes at the Office of Payroll Management if this can be done prior to payroll processing. If the payroll has been processed, the memos must be sent to the Payroll office for staff to enter. Interviews with Payroll Management staff indicate that the number of correction memos received is excessive with an estimated 150 correction memos processed per bi-weekly payroll and 200 per monthly payroll divisionwide. In terms of staffing costs, it is estimated that each of the eight staff members in Payroll Management spends two hours per day, or two FTE in total. 3 Absence Management in the Australian Public Service ( ) Australian National Audit Office. 8 of 23

10 Data is not currently tracked to be able to qualify whether the corrections relate primarily to the late submission of T&A documents by employees or inaccuracies in data entry by T&A processor. Information about the frequency of correction memos from particular work locations would also be helpful to determine where the bulk of work comes from. It is considered that some efficiencies could be gained from reducing the number of correction memos by ensuring that correction memos are only used in exceptional circumstances. It is recommended that the Office of Payroll Management track the data relating to type of correction and location and if particular work locations are responsible for high numbers of correction memos and send a reminder about the need to complete T&A entry accurately and in a timely manner. Management Response: Where appropriate, OPM does reach out to the Principals/Program Managers at work locations who have frequent corrections memos and partner together for an improved system for timely and accurate reporting which may include re-training by HR Business Services. Time and attendance deadlines are published in N5620 and reminders are provided throughout the year in FCPS communications. Additionally, we collaborate with the time and attendance team in HR Business Services to regularly communicate directly with the T&A processors. While planning the Work Force Management (WFM) product implementation we will evaluate opportunities for tracking data related to corrections. 1d Approval of correction memos As outlined above, the use of correction memos is intended to operate as a back up in the case of exceptional circumstances to ensure that any omissions or errors in time and attendance data is corrected and employee pay and leave information is accurate. However, it is noted that correction memos pose a potential fraud risk as they can be used as a way of circumventing the normal control points in the processing of payroll. That is, time and attendance data is entered by a T&A processor based on timesheets and leave requests approved by the program manager/ principal or their designee. A report is then run prior to the close of payroll reflecting the data for each individual employee, which is then approved by the program manager/ principal. Therefore there are two control points where the authorizing authority reviews and approves the time and attendance information. It is therefore essential that any changes to this information, particularly changes that reverse leave or increase hours worked are also appropriately approved. It was noted that there is no centrally maintained register of authorized signatories. This is commonly used in other organizations as a control to ensure that all documents are approved by duly authorized employees. It is understood that the large number of work locations may make this control impractical to implement and maintain in FCPS. However, as a minimum, it is considered the control could be strengthened by maintaining a register of authorized employees by work location. That is, a list of principals/ program managers by location and any individuals to whom the authority to approve time and attendance documentation has been designated. When 9 of 23

11 processing correction memos, Payroll Management staff can then confirm that the memo has been approved by an authorized employee. It is recommended that, as a minimum, the Office of Payroll Management maintain a list of authorized approvers for each work location. Management Response: We will clarify in our regulations and instructions that Principals/Directors are expected to sign correction memos but that they can, as needed, delegate the authority to Assistant Principals/Coordinators. This information is available in the HR systems, so an additional list is not necessary. Program managers are responsible for approving monthly financial management reports which reflect time entry. This action provides an additional control in the process 1e Approval of timesheets for substitute teachers/ assistants The hiring and payment of substitute teachers and instructional assistants is governed by Regulation 4311 Substitute Personnel Teachers and Instructional Assistants and Notice 5620 Substitutes Allocations and Time and Attendance Reporting. The approval of substitute timesheets is governed by Regulation 5620 Time and Attendance Administration Procedures. Time worked by substitutes is recorded on Form FS73-39 Time Report for Substitute Teacher, IA, PHA, & PHTA and includes data about the substitute, hours and days worked, and the name and reason for leave of the employee on leave. This form is to be approved by the program manager or administrative designee. In practice, at 13 out of 39 schools tested, the administrative assistant or office assistant was responsible for completing substitute timesheets and also approving the timesheets. At one additional school, the assistant principal had pre-signed multiple blank timesheets. This is in recognition that the volume of substitute timesheets is very high and substitutes prefer to have their timesheet approved before they leave the school and it not always possible to find an administrator to approve the timesheets at that time. In addition, it is consistent with better practice guidelines to have timesheets approved by an employee with direct knowledge of the hours worked 4. However, it is clear that the regulation requires substitute timesheets, like all timesheets, to be approved by an administrator. In order to balance operational requirements with the requirements of the regulation, it is suggested that the administrative assistant or office assistant responsible for managing substitutes initial timesheets to verify that the hours worked by the substitute are correct. The timesheets can then be approved by an administrator when available. This allows the substitute to leave the school with an indication that the hours worked are acknowledged by the school. It is noted that the Office of HR Business Services has revised the time and attendance training to incorporate this change in procedure. 4 Best practices for time and attendance implementation Federal Maritime Commission (2010) Office of the Inspector General 10 of 23

12 It is recommended that the Office of HR Business Services update the Time and Attendance Reporting Manual to provide for administrative assistants or office assistants to verify substitute timesheets prior to approval by an administrator. Management Response: We will document a standard operating procedure and incorporate guidelines in the T&A manual and training. 1f Recording of administrative leave Administrative leave is the code given for leave taken for a number of different purposes including: emergency (such as school or office closures); employee request (covers in-service training, conferences, Superintendent s advisory council meetings, and special situations not authorized elsewhere); unusual circumstances (where it is in the best interests of the employee or school system); organization leave (covers activities related to employee organizations); civil leave (such as jury duty, witness, or job-related legal proceedings); military leave; and employees serving as election officers. Religious leave is also often documented through the use of administrative leave, although the relevant regulation (4817 Religious Accommodation for Employees) does not specify any particular format for documenting leave taken for religious purposes. There is considerable confusion among T&A processors and program managers/ principals about the different types of administrative leave, the forms required for each type, and when/if such leave needs to be entered into Lawson. The area for which there is most confusion is employee request leave where employees are undertaking professional development activities either in-house, at other FCPS locations, incounty locations, local travel, or non-local travel. Regulation 4811 Administrative Leave Employee Request provides that written approval is required whenever an absence necessitates the employment of a substitute and/or travel outside the building to which the employee is assigned. The format of this approval is left to the discretion of program managers. If the activity requires travel to a facility not under the auspices of FCPS or Fairfax County, an administrative leave form is required. The guidelines are silent on the issue of whether the information is to be reported through Lawson. The Time and Attendance Manual, which all T&A processors are required to follow, provides that an employee using leave, other than a leave of absence, must complete the appropriate time report form showing date of absence, number of hours absent, and type of leave. It is apparent from fieldwork, that T&A processors and program managers/principals have developed local rules for the treatment of administrative leave in the absence of clear and consistent regulations. As Regulation 4811 Administrative Leave Employee Request requires written approval any time an employee s absence requires a substitute or they leave the building, and an administrative leave form is required in all other cases, the simplest solution would appear to require an administrative leave form (Form HR-334) for all administrative leave taken by employees. It is 11 of 23

13 noted that this form is rarely used, with most work locations preferring to use Form FS Leave Request for Monthly Paid Employees (the short form). Consideration should be given to replacing HR-334 with the more universally used FS It is also better practice to ensure that all leave is recorded in the information system so absences can be tracked and used for management reporting. For example, principals may wish to track the number of in-class instructional hours spent by employee or location. FCPS may also wish to track this information. It is therefore suggested that all administrative leave is recorded in Lawson. It is recommended that the Office of HR Business Services update the guidelines and regulations relating to administrative leave to provide greater clarity about the approval and recording of administrative leave. Management Response: Regulation 4811, Administrative Leave Employee Request will be updated to provide better guidelines and clarity around administrative leave requested by employees. 1g Inadequate controls for the prevention of fraud The process for entering and approving time and attendance data at work locations has been outlined previously. The process is designed to ensure that data entry is reviewed and therefore reduce inaccuracies. Access to data after the deadline for entering the relevant pay period information is closed to all TRS to ensure that the payroll information is up to date and not corrupted by late changes. The T&A processor is required to print the T-2200 report, which, for bi-weekly employees documents the number of hours worked per day per employee, including overbase and callback hours. The T-2200 report for monthly employees documents hours taken as leave per employee. If no leave is taken for an employee, they do not appear on the report. The T&A processor is required to reconcile the report to the supporting documentation and then the report is reviewed and approved by the program manager/ principal. The approved report then becomes the official documentation for the time and attendance at that location. There is a significant control weakness in that there is a period where there is access to Lawson to make changes after the T-2200 report is run and before the system is closed. Should this occur, there is no control to ensure that the change is detected. Any person with access to that TRS station could add additional hours or overbase hours to a biweekly employee s record, or reverse leave from a monthly employee s record. It is noted that this control weakness has been exploited previously in a recent time and attendance fraud case. It is considered that the most efficient manner of addressing this control weakness is to require T&A processors run the T-2200 report after access for data entry is closed. This would require that the report is run twice once to reconcile to supporting documentation and once for approval after payroll has been run. It is noted that the proposed human resources information system will effectively close this weakness by requiring any change to data to be approved at the time of the change. However, it is considered that the control weakness should be addressed to prevent and detect any fraud in the intervening period prior to full system implementation. 12 of 23

14 In addition, it is recommended that there be a segregation of duties between time and attendance processing and financial review responsibilities. In schools, the employee responsible for finance administration reviews monthly financial management reports (FMR) which, in part, reconcile payroll information with the financial records. This forms an additional review of the appropriateness of time and attendance information. It is considered important that the responsibility for reviewing FMRs is separated from the time and attendance function wherever possible to provide an additional control to detect potential fraud. It is recommended that the Office of HR Business Services in conjunction with the Office of Payroll Management update the guidelines to require T&A processors to run the T2200 report after the closing of payroll so that principals/ program managers are approving the actual payroll. It is recommended that the Office of Payroll Management and the Office of the Comptroller update the guidelines to provide that, wherever possible, the finance technician responsibilities and the time and attendance functions be separated. Management Response: The guidance and system will be updated so the T-2220 will be ran after the closing of payroll. In addition, WFM will provide an electronic audit trail. Recognizing that Elementary Schools are challenged by limited staffing and that the separation of duties may not always be possible, careful review by Principals is necessary. For all other work locations, the need for separation of duties between the finance technician and the time and attendance processor will be reinforced through FCPS communications, regulations, and best practice guidelines. 1h Pre-approval of overtime Regulation 5620 Time and Attendance Administration requires that any time worked in addition to an employee s regular hours overbase or callback hours must be approved in advance by the program manager/ principal or administrative designee. This is an important control to ensure that resources are used effectively and efficiently and to ensure that program funds are not spent in excess of the budget. It is also acknowledged that there is a requirement to ensure that FCPS workforce is flexible enough to respond to emerging issues, particularly in relation to maintenance and security issues. While the regulation requires prior approval for overtime hours, it is silent on the format such approval should take. In practice, in many cases approval takes the form of a telephone call from a supervisor to an employee requesting them to attend work at short notice. In other cases, overtime is required for a planned event. In this case, it would be expected that the request for overtime should also be planned. Given there is no prescribed format for documenting pre-approval of overtime worked, it is difficult to determine whether overtime hours were approved before they were worked. It is considered important to balance the requirement for flexibility with compliance with the regulation. To this end, it is recommended that preapproval of overtime be documented on the employee timesheet by having the supervisor or manager sign a certification that the additional 13 of 23

15 hours worked were necessary and approved prior to the employee working those hours. This would formally document the preapproval while still maintaining the flexibility to respond to operational requirements. The Office of HR Business Services has raised a concern regarding potential non-compliance with the Federal Fair Labor Standards Act (FLSA) provisions which require payment of additional compensation where non-exempt employees work more than 40 hours per work week 5. It is the contention of the Office of HR Business Services that these provisions require FCPS to pay any non-exempt employee overtime rates (at 1.5 times the employee s regular pay rate) for any hours worked above 40 hours, whether the employee was directed to work the hours or not. That is, the requirement for pre-approval is inconsistent with the FLSA. Notwithstanding the above, it is considered that managers still have an obligation to monitor overtime worked in their program area or school for budgetary, resource management, and work distribution purposes. It is recommended that the Office of Payroll Management update the various timesheets for all payroll groups to require program managers/ principals to sign a certification to the effect that the hours worked were operationally necessary and approved in advance. Management Response: Currently, the FS 71-1 Request For Shift Differential, Overbase, Callback and/or Overtime Pay For Monthly Paid Employees indicates that overtime must be preapproved. Regulations 5620 and 4660 will be modified to emphasize managerial control. 1i Inadequate system security Given the high dollar value of transactions relating to time and attendance, it is considered that system security is a high priority and an important control. Regulation 6225 FCPS Information Security Policy requires network access passwords to be changed at least annually in order to provide adequate network security. A survey was sent to all employees who had access to process T&A. This survey found only 25% of those responding change their password annually and 67% of respondents have never changed their password. Of more concern, ten respondents had shared their password with someone else and four were uncertain whether they had ever shared their password. This is considered to be an unacceptable risk to highly sensitive information and a significant fraud risk. It is noted that the proposed new time and attendance module of the human resources information system will require users to log on through UConnect which requires the user s network access password rather than the system specific password. This will ensure that password change protocols will be aligned with Regulation 6225 FCPS Information System Security Policy. However, Lawson does not have an automatic prompt to change passwords on a regular basis. It is considered important that, until the implementation of the new system is complete, all Lawson users are prompted to change passwords on at least an annual basis. It is recommended that the Office of HR Business Services update the guidelines to require T&A processors to change their access password at least annually U.S. Code s of 23

16 Management Response: HR will coordinate with Information Technology to require that Lawson passwords are changed on an annual basis at the beginning of each fiscal year. 1j Integration with SmartFind Express Monthly employees are responsible for negative reporting their time. That is, instead of reporting hours worked, they are required to report any exception to their scheduled hours and days either in leave taken or extra work performed. There is a degree of trust invested in employees that they will accurately report absences, as well as an obligation on managers to monitor employee attendance. For instructional employees however, there is an additional control in that absences from the classroom are required to be covered, commonly through the use of substitutes. During the in depth fieldwork testing, substitute timesheets were tied to the relevant employee records to determine whether an appropriate leave request was submitted. T&A processors at many schools have implemented similar systems for ensuring that leave requests are submitted by all staff before entering the monthly time and attendance data. Some schools use a diary system to record all absences, but many schools use the centralized substitute management system SmartFind Express. This system is used by schools to identify and request substitutes as required. Data entered into this system include details of the absent employee and the reason for the absence. Reports can be run from Smart Find Express and T&A processors reconcile these reports to the leave requests from staff to ensure completeness of records. This is considered to be a helpful additional control. Interviews with T&A processors indicated a desire for the proposed new human resources information system to be able to interface with SmartFind Express as a way of automating this process. However, it should not be considered a complete control as not all substitutes are contacted through SmartFind Express, for example, where a school contacts a particular substitute directly. It is recommended that the Office of HR Business Services in conjunction with the Office of Payroll Management determine the viability of integrating the new system with SmartFind Express. Management Response: While designing the WorkForce Management (WFM), an interface of substitute hours from the SmartFind Express system will be evaluated. 1k Designation of approving authority Regulation 5620 Time and Attendance Administration requires all timesheets, overtime requests and leave requests be signed by the principal, program manager or designee. The designee must be an administrator. This has been generally interpreted as meaning an assistant principal or head of department in schools. However there is no clear understanding what an administrator is, particularly in departments and there is no guidance in the relevant guidelines and regulations on this point. 15 of 23

17 This results in potentially inappropriate approval of time and attendance documents because of confusion about what is meant by administrative designee. Some schools have interpreted this to mean administrative or office assistants. Regulation 5112 Approval Authority for Financial Documents provides that the authority to approve financial documents may be designated to the level directly below the approving authority. It may be construed that time and attendance documents are financial documents as they form the basis of FCPS payroll liability. It is therefore considered appropriate to maintain consistency between Regulation 5112 Approval Authority for Financial Documents and Regulation 5620 Time and Attendance Administration and specify that authorization to approve time and attendance documents may be designated to the position directly beneath the program manager/ principal. It is recommended that the Office of Payroll Management update the guidelines to clarify that approval for time and attendance related documentation may be designated to staff in the position directly below the program manager/ principal. Management Response: Regulation 5620 will be updated to provide clarity on the delegation of authority to approve time and attendance in the absence of the principal or program manager. 2. Fieldwork Findings The following section documents the findings from the in-depth fieldwork. 2a Work Locations with no reportable findings The following work locations did not have any reportable findings. In many cases, this was due to experienced T&A processors using a shadow system to support the collection of T&A information. Schools: Belle View Elementary School Laurel Ridge Elementary School Virginia Run Elementary School Departments: ITSS- Program Management and Planning Financial Services - Administration Early Childhood & Family Services Electrical - Edison Transportation Lorton Center HR Business Services Superintendent's Office Transportation Services Internal Audit would like to particularly commend Transportation Services for their accuracy and attention to detail, given the extremely high volume (nearly 2,000 employees) and complex nature of their time and attendance documentation. 16 of 23

18 2b Approval of T&A documentation As outlined above, all time and attendance documentation, such as timesheets and leave requests are required to be approved by the relevant program manager/ principal. Testing identified 587 instances at 33 work locations where the documentation was not appropriately approved. This is a result of a number of factors, either: Documents not approved at all; or Approved at the incorrect level. Approval at the correct level is an important control to ensure that there is adequate oversight over the resourcing implications of time and attendance. It also provides assurance that the information entered into Lawson is a correct reflection of the hours worked, or leave taken. A number of incorrect approvals relate to the issue of administrative staff approving timesheets for substitutes as well a lack of understanding of the term administrative designee. Both of these issues have been addressed above in the systemic issues section. In some cases, the lack of approval at the program manager/ principal level is a result of a belief that time and attendance is not as important as other finance related processes. However, given the high dollar value of payroll, over 88% of FCPS budget, it is considered important that program managers/ principals be reminded that they are ultimately responsible for the payroll records and expenses within their program area. It is recommended that the Office of Payroll Management remind all program manager/ principals of their responsibility to approve, or designate to an appropriate designee, all timesheets and leave requests. Management Response: Through FCPS communications, guidelines on the designation of appropriate personnel to approve leave and time transactions in their absence will be shared. 2c Reconciliation of T2200 report The T-2200 report is the official record of the data entered into Lawson for each pay period, one for bi-weekly and one for monthly payroll. The report is generated from Lawson and includes details of all employees and the hours/ days worked or the leave taken. According to the Time and Attendance Manual, T&A processors are required to print the T-2200 report and reconcile with the supporting documentation. Once this is completed, the T-2200 report is to be reviewed and approved by the program manager/ principal. This procedure is designed to reduce the number of data entry errors and ensure that the payroll is as accurate as possible. This should also reduce the number of correction memoranda resulting from inaccurate data entry. The in-depth fieldwork testing revealed a concerning number of errors where the information in the T-2200 report could not be tied to the supporting documentation. There were 316 exceptions identified in 34 work locations. These errors relate to details such as the incorrect leave type, incorrect leave date, incorrect hours, missing leave requests, leave requests not entered into the system, incorrect timesheet details such as incorrect shift differential and missing timesheets. Shift differentials only apply to a small number of employees (1,580 out of 17 of 23

19 38,235). Where errors were identified that resulted in incorrect pay or incorrect leave balances, the relevant school or department was immediately advised so corrections could be processed. These errors undermine confidence in the system as a source of management information as well as the authority for payment of payroll. It is considered important that the integrity of the system be improved by ensuring that the data entered is reviewed and reconciled for each payroll period. It is recommended that the Office of HR Business Services in conjunction with the Office of Payroll Management issue a reminder to all T&A processors and program manager/ principals of the importance of reconciling the T2200 report to the supporting documentation to ensure accuracy and completeness. It is recommended that the Office of HR Business Services amend the T2200 report to include a certification to be signed by the T&A processor that a reconciliation has been completed. Management Response: The time and attendance manual and training information and Regulation 5620 will be updated to include guidance on reconciling the T2200 report. As this report will be replaced by a WFM product, we do not anticipate altering the current report; however, the importance of reconciliation will be re-emphasized. 2d Incomplete documentation As mentioned previously, timesheets and leave requests are the documents which trigger pay and leave actions in Lawson. It is therefore important that these forms are fully completed. The information contained within these forms is also the basis for approval by the program manager/ principal. In-depth fieldwork testing identified 32 schools and 846 instances where the forms are not fully completed. Missing details include missing employee signatures, missing dates for approval signatures, missing leave codes for substitute timesheets, missing leave or attendance codes, and missing title for approvers. It is assumed that where there is missing information, the T&A processor identifies the missing information based on their knowledge of the employee and/ or work requirements. It is important that all documents are fully completed to ensure that the data entered into Lawson is correct and that the employee agrees to the resulting actions that is, pay and leave details. It is recommended that the Office of Payroll Management issue a reminder to all T&A processors and program managers that all fields of timesheets and leave requests are to be fully completed. Management Response: To reach all employees we will use FCPS communication tools to emphasize the importance of correct and complete information on each timesheet. 18 of 23

20 2e Missing leave requests When teacher leave was indicated as the reason for hiring a substitute, one way to determine whether monthly employees were submitting all leave requests was to tie the substitute timesheets to the leave request for the identified employee. The in-depth fieldwork revealed that faculty staff do not always submit leave requests when a substitute is hired 49 findings in total. Schools that have a system for monitoring substitutes and reconciling to employee leave requests are less likely to have findings in this area. This results in inaccurate leave balances in Lawson. It is important to ensure that management can place reliance on the information in Lawson for employee absence management and identify trends at the strategic level. A number of T&A processors at schools indicated that it is difficult to monitor staff attendance and ensure that all leave requests are submitted for absence, particularly in middle and high schools. As noted above, schools with a good system for monitoring staff attendance have fewer issues with missing leave requests. One such school is Hybla Valley Elementary School which has modified the standard monthly employee request for leave form. This modified form is at attachment A. Essentially; the modified form requires employees to provide details of their proposed leave in order to request a substitute. That is, if a member of faculty requires a substitute to cover any absence from the classroom, the request for leave is included in the request for the substitute. This is considered a better practice and could be implemented across the division in order to reduce the amount of time spent by administrative staff in following up missing leave requests. It is recommended that the Office of Payroll Management implement the use of the modified leave request in all schools. Management Response: The FS Leave Request for Monthly paid employees provides instructions regarding use, approval, and proper crediting of leave taken as outlined in Regulation The data elements of this form are those minimally required to ensure timely and accurate submission. With the implementation of WFM, paper time sheets will be eliminated and employees will have the ability to add comments while requesting leave. Summary Results by Work Location The following pages contain a summary of all the exceptions for each TRS location audited. 19 of 23