KAREN E. RUSHING. Ghost Employee Audit

Transcription

1 KAREN E. RUSHING Clerk of the Circuit Court and County Comptroller Ghost Employee Audit Audit Services Karen E. Rushing Clerk of the Circuit Court and County Comptroller Jeanette L. Phillips, CPA, CGFO, CIG Director of Internal Audit and Office of the Inspector General Audit Team David Beirau, CFE, CIGA Senior Internal Auditor/Investigator William Bousman Internal Auditor/Investigator Kerkering, Barberio & Co. Certified Public Accountants Patricia J. Entsminger, CPA, CFE, CIA Mandi Someson, CPA, CFE, CIA Heather Coonradt, CFE August 2014

2 TABLE OF CONTENTS Page Summary and Results 3 Opportunities for Improvement and Management Response 6 Appendix A: Sampling Results 9 Page 2

3 Summary and Results The Clerk of the Circuit Court and County Comptroller s Internal Audit Department and Office of the Inspector General has completed a County-wide Ghost Employee Audit. The audit was planned and conducted in accordance with Generally Accepted Government Auditing Standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. The purpose of this audit was to evaluate the effectiveness of internal controls over data processing and maintenance of employee information in the Human Resource Capital Management System (HCMS), specifically as it relates to preventing the creation of ghost employees. The scope of this audit includes all documented Sarasota County Board of County Commissioners (BOCC) employees that were employed or terminated between October 1, 2013 and June 30, 2014 (audit period). Background Salary expenditures for BOCC employees exceeded $108 million in the Sarasota County Adopted Budget for Fiscal Year Since salaries and benefits constitute nearly 10% of the County s total adopted budget it may be an area of interest to defraud the County for illicit gain. The Human Resources (HR) Department is comprised of six divisions offering a variety of services. These services include (1) Work Force Planning, (2) Data Management and Analysis, (3) Employee and Labor Relations, (4) Training and Development, (5) Employee Wellness and Benefits, and (6) Safety and Risk Management. From these divisions, Work Force Planning and Data Management and Analysis personnel work together to process new hires, terminations, promotions, reclassifications, and a variety of other functions that require careful management of sensitive personnel data, such as social security numbers, birthdates, home addresses, hiring dates, pay rates and bank account information. The Finance Department is responsible for processing payroll utilizing data provided by the HR office and electronic time sheets exported from Kronos, the County Payroll time keeping application. Ghost employees are individuals included in the payroll register, who are not providing services, but who are receiving a payroll check or direct deposit. Generally, there are two types of ghost employees. The first type is the completely fictitious employee who is added to the payroll, the second type is a former employee that remained on the payroll after terminating from the Organization. According to the Association of Certified Fraud Examiners 2014 Report to the Nation on Occupational Fraud and Abuse, payroll fraud accounts for 8.2% of fraud cases that occur within organizations that employ more than 100 employees. These statistics indicate that, without proper controls in place, the ability to conduct a payroll fraud scheme should be evaluated for Sarasota County. Page 3

4 Objectives, Scope and Methodology The objectives of this audit were to determine if internal controls are operating effectively related to data processing and maintenance of employee information in the HCMS software application to prevent the falsification of personnel or payroll records to generate ghost employees. More specifically, the audits objectives were to: Obtain reasonable assurance that there are controls in place to prevent the creation of ghost employees. Determine if time and attendance records are properly completed, reviewed, and approved for payroll processing in a timely manner. To meet the objectives of the audit, the procedures performed included, but were not limited to, the following: Performed inquiries of County and Finance Department personnel. Reviewed HR policies and procedures and information on the County s intranet site related to new hire on-boarding, terminations and changes to active employees payroll. Obtained a complete database of BOCC employees maintained in HCMS software from the HR Data Management and Analysis manager and cross-referenced the population to the BOCC employee database maintained by the Finance Department in IFAS, the Accounting software used for payroll processing. The two populations were crossreferenced using a data analytic tool to determine if there were employees that appeared in one population but not the other. Identified any employees that have duplicate addresses within each population of the HCMS and IFAS databases using a data analysis tool. These employees were compared to the employee phone directory, on the County s intranet site, to ensure that the employee existed. Also, the employee s department and supervisor were reviewed to ensure that employees who co-habitate are not in a position to authorize or conceal payroll information for one another. Using a data analytic tool, identified employees that are directing payroll funds to the same direct deposit account as another employee. For employees identified, personnel and payroll files were reviewed to verify the deposits and accounts were authorized and to substantiate each employees existence as a BOCC employee. Utilized a data analysis tool to compare terminated employees to the May 16, 2014 payroll register. Personnel files were reviewed for each terminated employee that appeared in the payroll register to verify evidence of separation (i.e. resignation letter, approval for retirement by the State of Florida). In addition, payroll files were reviewed to ensure that the status of these employees was changed to inactive and they had not been receiving unauthorized pay. Reviewed time cards in Kronos for the pay period ended June 14, 2014 to ensure proper authorization. Page 4

5 Overall Results Based upon the results of procedures performed, there were no instances of ghost employees identified. However, opportunities for internal control improvements relating to segregation of duties over data processing and maintenance of employee information did appear. Additionally, there are processes that lack documented Standard Operating Procedures. The Opportunities for Improvement section of this report discusses these results and recommendations in detail. The following summarizes the result of the audit: Lack of Approval and Proper Authorization of Time Cards in the Kronos System The County currently has no written procedures requiring Supervisors to approve and authorize their staff s time card report. Additionally, HR does not have a formal process in place to review time cards for proper authorization and to follow up on missing approvals. Ineffective Internal Controls Over Data Entry - Current internal controls in place over data entry in the HCMS system, authorization of changes being made to personnel data, and the communication of payroll changes to the Finance Department are ineffective. Segregation of Duties Over Physical Pay Check Pick Up Certain employees within the County have requested a manual payroll check as an alternative to direct deposit. These employees will either pick up their checks themselves or authorize someone else to retrieve them. Page 5

6 Opportunities for Improvement and Management Response The audit disclosed that procedures and practices could be improved. The audit was neither designed nor intended to be a detailed study of every relevant system, procedure, or transaction. Accordingly, the Opportunities for Improvement presented in this report may not be all-inclusive of areas where improvement may be needed. Observations and recommendations were made in the following areas: A. Lack of Approval and Authorization of Time Cards in the Kronos System B. Ineffective Internal Controls Over Data Entry C. Segregation of Duties Over Physical Pay Check Pick Up A. Lack of Approval and Authorization of Time Cards in the Kronos System. No written processes and procedures are in place to ensure that Department Supervisors and Managers are approving time cards. Observation Within the Kronos time card report for the pay period ended June 14, 2014, approval was not documented for 86 of the 1,923 employees included in the report. Currently, there is no process in place for HR staff to review time cards for authorization. This lack of oversight creates an opportunity to inflate hours, log unapproved overtime, and assign hours to an inactive employee. Recommendation Document responsibilities for approving time cards and the process and procedures used to ensure that those responsibilities are being met. Implement a process for HR to review time cards for proper authorization and follow up with those responsible who have not approved hours in the system in a timely manner. Those responsible should be held accountable for failure to authorize time in the system. The County should also ensure that the personnel authorizing staff time in Kronos is at the appropriate supervisory level. Management Response HR Management concurs that there should be a process and procedure to ensure that time cards are approved. Currently all employees receive an reminder at the end of a pay period to approve their time card and new employees receive training on the first day of employment for Kronos including instructions to approve time. HR will focus most of our efforts on supervisor approval including refreshers and HR follow-up procedures at the end of the pay period. 1) Revise HR internal Standard Operating Procedures (SOPs) to include staff review and follow-up on unapproved time-cards prior to close of pay period. Review for trends within the departments and provide additional training and follow up as necessary. Expected completion December 31, ) Provide refresher training for time card procedures including approvals to department supervisors. Expected completion August 31, Page 6

7 3) Add language to HR Procedures outlining time card approval procedures. Expected completion March 31, B. Ineffective Internal Controls Over Data Entry Current internal controls in place over data entry in the HCMS system, authorization of changes being made to personnel data, and the communication of payroll changes to the Finance Department are ineffective. Observation Currently, the Senior HR Assistant is in charge of reviewing Personnel Action forms and communicating any changes to the Finance Department. The Personnel Action (PA) form includes a signature line for a preparer and a reviewer. Instances were noted in which the Senior HR Assistant physically signed the preparers name on the Personnel Action form and also signed off as reviewer. In these instances, an electronic signature was included in the document to indicate that there was a preparer separate from the reviewer; however, this preparer did not physically sign the document. Physical signatures are an important part of the control process, as the Senior HR Assistant position has the application security access to edit, add or delete information within the HCMS system. In addition, this Senior HR Assistant is authorized to submit documentation to payroll for the creation of a new employee in the IFAS system. Recommendation The County should require two physical signatures for each Personnel Action form authenticated by two separate employees: a preparer and a reviewer. To mitigate the risk of overridden controls, the County should restrict access to view only in the HCMS application for the representative in charge of reviewing the Personnel Action forms and submitting them to the Finance Department. By restricting access and formalizing the segregation of duties, the County is mitigating the risk that an unauthorized ghost employee will be paid or go undetected. Management Response HR concurs with this recommendation. In order to reduce the risk that an unauthorized ghost employee could be submitted to Payroll for data entry and payment without detection, we will implement the following changes to our New Hire Personnel Action procedures (SOP s) by March 31, ) There will be 3 HR signatures on new hire appointment PA s. a. Preparer HR Staff member who initiates the hiring process on behalf of department and does not perform new hire entry. b. Data Entry HR Staff member who is not the a. Preparer or c. Reviewer. c. Reviewer - HR Management or HR designee who is not a. Preparer or b. Data Entry. 2) Revise Personnel Action form to include the new labeling. Signatures described as a. Preparer and b. Data Entry above will appear on the left side and the signatures described as c. Reviewer will appear on the right side. Page 7

8 C. Segregation of Duties Over Physical Pay Check Pick Up Supervisors who are responsible for authorizing or communicating the termination of their staff are not restricted from picking up physical pay checks. Observation Currently, employees receiving manual pay checks can authorize another individual to pick up their check and deliver it to their work site. Due to the direct reporting relationship that may exist, it is possible that when an employee separates from the County this information may not be communicated timely since the individual responsible for communicating the status change may have physical access to the terminated employee s paycheck. Recommendation In the case of an employee authorizing a supervisor to pick up their check, this individual should not have the authority to approve and communicate personnel changes to HR. The authority to initiate personnel changes and access to the manual pay check creates an incentive to conceal information. The County should restrict physical access to employee paychecks to the person the check is made out to. Management Response HR concurs that the release to supervisor process needs to end. We will implement new procedures for release to employee only by March 31, Employees will be notified that they have 3 options for pay distribution. 1) Direct deposit 2) Pick-up in HR within normal business hour, on pay day Friday. Employees must sign for check and show photo id. 3) HR will mail check on Thursday afternoon with regular mail to address printed on pay check. No response will result with the pay check being mailed. Page 8

9 Appendix A: Sampling Results Based upon the results of procedures performed, there were no instances of ghost employees identified. The following summarizes the sampling results from procedures performed: The HCMS and IFAS populations were cross-referenced using a data analytic tool to determine if there were employees that appeared in one population but not the other. Of the 2,239 employees maintained in the HCMS population, 24 employees did not appear to have a match in IFAS. A review of supporting documentation reflected that 23 of the 24 employees were new hires that were not eligible for payroll and were properly excluded from IFAS. The remaining employee was a seasonal unpaid intern. HR personnel indicated that unpaid interns are communicated to the Benefits department for workers compensation requirements, but do not need to be communicated to the Finance Department or input into IFAS, as these employees are not paid. In addition, the employee personnel file was reviewed to confirm existence. Of the 2,421 employees included in the IFAS population, 206 employees were not in the HCMS population. One-hundred and sixty-eight (168) of the 206 exceptions were Supervisor of Elections employees and should have been excluded from the original population since they are not BOCC employees and are not part of this audit. Twenty-five (25) of the 206 exceptions are employees who had been terminated; however, this information was not communicated to the Finance Department. Information in the IFAS system was reviewed to ensure that employees were inactive and had not been receiving unauthorized pay. Nine (9) of the 206 exceptions had recently been identified as full time employees during an IRS audit; they had previously been treated as independent contractors which are not maintained by HR in the HCMS system. These nine (9) employees were added to IFAS as a one-time occurrence to process payroll taxes. Four (4) of the 206 exceptions are State employees who only receive a monthly cell phone stipend from the County. Therefore, they are not maintained by HR in the HCMS system but are included in IFAS so the stipend can be paid. Identified any employees that have duplicate addresses within each population of the HCMS and IFAS databases using a data analysis tool. One-hundred and seventy (170) employees were identified as having an address that appeared more than once. Of the 170 identified, 135 were listed in the employee phone directory and 31 were Supervisor of Elections employees and should have been excluded from the original population since they are not BOCC employees and are not part of this audit. The remaining four (4) employee s personnel files were reviewed substantiating their existence as a BOCC employee. Page 9

10 Using a data analytic tool, identified employees that are directing payroll funds to the same direct deposit account as another employee. There were 3,204 records tested within the May 16, 2014 payroll register and resulted in 661 duplicate direct deposit account numbers. Of the 661 duplicate accounts, 601 pertained to group funds, specifically the Fire Benevolent Fund and the Sarasota County Area Transit (SCAT) Union dues. The remaining 60 duplicate account numbers pertained to 27 checking accounts and one (1) loan payback account in which 57 individuals direct their pay. Personnel and payroll files were reviewed to verify the deposits and accounts were authorized and to substantiate their existence as a BOCC employee. Utilized a data analysis tool to compare terminated employees to the May 16, 2014 payroll register. Thirty-five (35) of the 169 employees that terminated between October 1, 2013 and June 18, 2014, appeared in this payroll register. Nine (9) of the 35 employees that appeared in the payroll register had a termination date prior to May 16, 2014 but within the current pay period. Personnel files were reviewed for each of these employees to verify evidence of separation (i.e. resignation letter, approval for retirement by the State of Florida). In addition, payroll files were reviewed to ensure that the status of these employees was changed to inactive and they had not been receiving unauthorized pay. Twenty-six (26) of the 35 employees terminated on or after the May 16, 2014 pay period. These employees were cross-referenced to the June 14, 2014 payroll register to verify that they were removed from payroll. Seven (7) of the employees appeared in the payroll register, however, they had a termination date prior to June 14, 2014 but within the current pay period. Personnel files were reviewed for each of these employees to verify evidence of separation (i.e. resignation letter, approval for retirement by the State of Florida). In addition, payroll files were reviewed to ensure that the status of these employees was changed to inactive and they had not been receiving unauthorized pay. Reviewed time cards in Kronos for the pay period ended June 14, 2014 to ensure proper authorization. Of the 1,923 employees included in the Kronos time card report for this pay period, there was no evidence of review or approval of time in the system for 86 employees. In addition, due to the lack of formal policies, we were unable to test if the proper authorized individual was approving timecards. Page 10