PAYROLL CONTROLS REVIEW 2004 FEBRUARY

Transcription

1 AUDIT REPORT PAYROLL CONTROLS REVIEW 2004 FEBRUARY

2 Audit Report Page 2 AUDIT REPORT PAYROLL CONTROLS REVIEW INDEX SECTION I EXECUTIVE SUMMARY Introduction Overview Audit Scope Audit Conclusion SECTION II DETAILED FINDINGS AND BUSINESS UNIT RESPONSES A. ORGANIZATION ISSUES 1.0 Controls Administration 2.0 Back-Up/Succession Planning 3.0 Co-Ordination of Control Duties 4.0 Separation of Duties B. PROCESSING ISSUES 1.0 New Hire Process 1.1 Forms Authorization 1.2 Policies 1.3 Distributed Procedures 2.0 Bi-Weekly Processing 2.1 Approval of Rates 2.2 Register Review 2.3 Reporting/Monitoring 3.0 Change Events 4.0 Control Reporting 5.0 Time Entry Interface 5.1 Interface Sustainment 5.2 Future Plans Time and Labour 6.0 Off-Cycle Cheques/Adjustments 7.0 Retroactive Payments 8.0 Tracking Systems 9.0 Control Reporting 10.0 Systems Documentation Page 2 of 34

3 Audit Report Page 3 C. TECHNICAL / SECURITY ISSUES 1.0 Access Control 1.1 Basic Process 1.2 Query Access 1.3 Access to Data Bases 1.4 Process Access 2.0 Password Procedures 3.0 Security Administration 4.0 Correction Mode 5.0 Super User Accounts 6.0 Payline Process 7.0 Field Level Security Page 3 of 34

4 Audit Report Page 4 SECTION I EXECUTIVE SUMMARY Introduction The review was undertaken as part of the City Auditor s annual audit plan. The purpose was to determine if Payroll controls were adequate to ensure accurate payroll data and remittances to employees. Overview The current Payroll system was implemented in July 1999 as part of the Human Resources Management System (HRMS), which administers both Payroll and HR functions. The Payroll system is made up of a PeopleSoft component, a legacy time feed system, and various spreadsheet/manual subsystems used to track employee information. Payroll is administered by staff in Finance, Human Resources, and ITS business units. This structure is still evolving; in January 2004, Payroll will report to HR. Planned enhancements (e.g. PeopleSoft Version 8 currently being installed) will provide additional tools to improve administration and system controls. In addition, a Business Process Review (BPR) project is underway to review components of the new hire process. Scope/Methodology The review focused on: Payroll procedures PeopleSoft application System interfaces Security Organization where relevant to administration of controls Page 4 of 34

5 Audit Report Page 5 The methodology used was a review of the numerous processes required to produce payroll data and remittances, and limited testing in selected areas: new hires change events bi-weekly transactions. Audit Conclusion Adequate control over payroll data and remittances has been achieved through the efforts of experienced and committed staff. Therefore, the effectiveness of controls is largely people dependant; there is no assurance that good controls will continue to be exercised. There is a need for enhanced control procedures, monitoring, and systems administration to ensure risks are managed on a continuous basis, given the complex nature of the system and interfaces. Discussion of Conclusion Organizational Issues There is a need to review, define, and formalize roles, tasks, and communication lines relevant to administering payroll and controls. As well, consideration should be given to setting up a controls coordinator to ensure the effectiveness and continuity of control procedures. Management Approvals and Monitoring Operational management are ultimately responsible for employee payroll records and status. Management should authorize all changes and adjustments to employee records, and review payroll processing results. Control Reporting Reporting needs to be enhanced to effectively monitor payroll transactions, new hires, change events and security issues. Time Interface Until the PeopleSoft Time and Labor module is implemented (mid 2005), it is important to provide sustainment backup resourcing for the interfaces. Page 5 of 34

6 Audit Report Page 6 Page 6 of 34

7 Audit Report Page 7 System Security There is a need to improve system security in the areas of access control, data base controls, and use of special facilities. This includes super user, correction mode and the Payline process. Version 8.8 of PeopleSoft will provide the system tools and facilities to achieve better system security. Page 7 of 34

8 Audit Report Page 8 SECTION II DETAILED FINDINGS AND BUSINESS UNIT RESPONSES A. ORGANIZATIONAL ISSUES The organizational configuration to administer and control Payroll has been constantly evolving since the go-live date in Currently, Payroll is administered by: Human Resources/ Data Center New hire setup (benefits, rates etc.) Change events Interface of time input from operations Human Resources/ Employee Services Bi- weekly processing YTD data accumulation Off- cycle cheques, advances Co-ordination of distributed payroll Finance Distributed payroll Input of change event information Input of time Reconciliations Several studies have been done to move toward a more effective organization for administering payroll and control; however, these have been fairly high level and challenges remain. As a result of a study by TKMC Consulting in early 2003, the distributed payroll function will be reporting to HR as of January Page 8 of 34

9 Audit Report Page CONTROLS ADMINISTRATION Our review indicated that the effective administration of controls is very people dependant at present. During our review, staff showed outstanding commitment, knowledge and skill levels in administering payroll. However, control responsibilities evolved along with assignment of system administration duties, which changed several times since system implementation. At the time of our audit, there were still examples of: unclear communication lines and roles/responsibilities in some areas inconsistent control duties/roles between distributed areas overlap of control duties Communication lines, roles/ responsibilities, reporting and tasks related to system administration and controls should be reviewed and clearly defined. Agreed. We currently have a procedure for signing off changes to the earnings and deductions tables which we will extend to all other aspects of table controls within HCM 8.8. We will also communicate those changes to the entire community they affect. The Employee Services Team Lead responsible for the area involved, or in their absence, the Manager, Employee Services, will authorize all changes to a PeopleSoft control table. Page 9 of 34

10 Audit Report Page BACK-UP/SUCCESSION PLANNING The administration of the system and controls is very dependant on the knowledge of experienced staff currently occupying the various positions. Tasks and duties are not structured/ organized into an integrated procedure set, for backup, reference and consistency. We noted: When key staff are on vacation, some controls are not done. In some cases, staff in the IT Sustainment Section fill in for staff on vacation. There is no formal succession plan for team leaders and the manager. Audit Comment An initiative is underway to produce standard procedures for all distributed areas with control measures included. A back-up and succession plan should be developed for administering and controlling payroll, along with documenting of procedures. Agreed. Documentation of procedures is well under way. As backup to the Team Leads, the Manager, Employee Services will have the same access as the Team Leads and, in the Team Lead s absence, will ensure the work and controls continue as required. Page 10 of 34

11 Audit Report Page CO-ORDINATION OF CONTROL DUTIES Controls over core payroll processes, such as bi- weekly processing and year-to-date accumulations, are performed by knowledgeable and committed staff. However, these core controls are very people dependent. There are no disciplines to ensure controls are carried out consistently and completely: We found: Follow-up or evidencing of system balancing is not usually performed. (Failure to balance on a timely basis could lead to problems if system outages occur at the same time.) The payroll register is verified in different ways, or not at all. No one staff member is charged with designing new control procedures when system practices change. s I. Procedures should be implemented to ensure controls are carried out on a consistent basis II. Consideration should be given to setting up a controls co-ordinator position reporting to the Manager of Employee Services. Agreed. System balancing is done consistently. We will ensure that the balancing is evidenced on a more regular basis. We have already given some thought to setting up a position that among other things could act as Controls Coordinator, but budget constraints may preclude us from accomplishing this additional level of controls. Page 11 of 34

12 Audit Report Page SEPARATION OF DUTIES The current organizational configuration has situations where staff have a very large span of control. The duties and tasks performed could allow inappropriate usage of the system either in error or by intent. We noted: Some staff have sufficient span of control over payroll procedures to create accounts, change hours or rates, and issue cheques. In some situations, staff can cover errors by omitting or short cutting balancing controls. Sometimes staff in the IT Sustainment Section serve as backup to staff in Employee Services administering payroll. Sustainment staff can also make program changes and control production data. As part of the current initiative to review and stabilize the payroll administration organization, the separation of duties should be reviewed. Agreed. Separation of duties will be reviewed to ensure they provide an appropriate level of control. The Team Leader, Corporate Payroll has been appointed as primary backup to the staff member in Employee Services administering payroll. As soon as she is up to speed, the HCM Sustainment Group in IT will cease to serve as backup. The Manager Employee Services will act as a final backup in case catastrophic events preclude the person assigned and the primary backup cannot perform their duties. Page 12 of 34

13 Audit Report Page 13 B. PROCESSING ISSUES 1.0 NEW HIRE PROCESS 1.1 Forms Authorization Employee Record forms are prepared on all new hires, for entry into the Payroll System. The form records an employees pay and deduction rates by linking to PeopleSoft rate tables through special codes. Based on a limited sample of 30 forms for hires and re-hires, we found: Only six were properly authorized Some forms had authorization names typed in Some forms were authorized by the Payroll Clerk who does not have authority. The employee record form, as authority to effect the hire, or recall, should be authorized by operational management. The supervisor or manager responsible for hiring should approve new hire and re-hire forms to ensure the employee information is valid and accurate. Agree In Principle. As we have not yet implemented Workflow functionality, we have no mechanism for assuring the proper authority signs off on any form requiring an authorization. That process will change dramatically when we implement the erecruit functionality with workflow, which begins in Q Page 13 of 34

14 Audit Report Page Policies Hiring process policies have not been updated since the system was implemented. The Administration manual requires updating on: Current department roles/responsibilities Legal requirements Authorizations and control requirements. The employment policy should be updated to clearly indicate expectations in the hiring process. NOTE: The hiring process is outside of our area of responsibility, but will be updated once the erecruit functionality is implemented since the process will change dramatically. 1.3 Distributed Procedures The process for hiring/re-hiring employees is not consistent throughout the Corporation: In some areas, the payroll clerk processes and forwards employee record forms; in other areas this is done by HR Forms are not consistently completed and authorized. Page 14 of 34

15 Audit Report Page 15 Consistency in hiring procedures should be addressed as part of the BPR project. NOTE: The hiring process is outside of our area of responsibility, but will be updated once the erecruit functionality is implemented since the process will change dramatically. 2.0 BI-WEEKLY PROCESSING Overview The bi-weekly payroll process uses updated employee information and time data from a two week pay period to process gross pay, deductions and arrive at net pay. The bi-weekly produces a payroll register and either a direct deposit or pay cheque. 2.1 Approval of Rates In reviewing employee records we noted rates set up for individual new employees or changes to existing records were not always approved by management. Changes to employee rates and status should be approved by operational management. Page 15 of 34

16 Audit Report Page 16 Agreed. We will put in place a process to ensure that those rates that need approval (those not governed by a collective agreement) have the proper approval. Those that are governed by a collective agreement will be verified prior to their taking effect. 2.2 Register Review The Payroll Register is an important document showing the results of payroll processing (ie. time input and employee changes) that have taken place for the pay period. Management s review of the register is one procedure for ensuring that payroll transactions are proper and sanctioned by management. Operational management/ supervisory staff know the hours actually worked by an employee. Recently, concerns have been expressed regarding FOIP implications from operational managers reviewing the register. These concerns, however, have not been reviewed with the Privacy Commissioner for decision. The current process for reviewing registers is inconsistent. The review is performed by different levels of distributed payroll staff who also have the authority to enter transactions. Options should be considered for management s review of payroll processing results, subject to an interpretation from the Privacy Commissioner. Page 16 of 34

17 Audit Report Page 17 Agreed. We will examine options that will satisfy the needs of management to know what is being paid to their employees, while still respecting our need to maintain the privacy of some information. 2.3 Reporting/Monitoring Formal reports showing new hires, rehires and recalls are not sent to business unit staff for monitoring. Staff indicated a need for such reports to facilitate independent review of hire transactions. Reports showing new hires and recalls should be provided to staff for monitoring. Agreed. We will examine options, including implementing workflow, that will satisfy the needs of management to know who has been hired or recalled within their organization. Initial efforts may be paper based or manually sent in an electronic fashion. Page 17 of 34

18 Audit Report Page CHANGE EVENTS Overview Changes to employee status (e.g. promotions, terminations) are recorded on forms by distributed payroll staff, and submitted to the HR data center for input into HRMS. For most change events, there is no regular reporting back to management (initiating such events) on the actual updates made to the system. Although queries are available, these are not consistently used. Inappropriate entries, or entries not sanctioned by management could be made and not be detected. Version 8.8 will include increased capability for reporting. Consideration should be given to reporting back to management on changes to employee status. Agreed. We will examine options, including implementing workflow, that will satisfy the needs of management to know who has had a status change within their organization. Initial efforts may be paper based or manually sent in an electronic fashion. Page 18 of 34

19 Audit Report Page CONTROL REPORTING Overview PeopleSoft has some standard edits and reports on very basic types of errors. However, due to the systems design, most control reporting must be done using queries. Control reporting can be improved in two key areas: Control reporting is fairly ad-hoc and not structured into an integrated set. Reports are required for staff to monitor hires, employee status, etc. Queries required for monitoring input/output are not run on a consistent basis in distributed areas. In some cases, staff are not sufficiently familiar with query procedures. Control reporting requirements should be reviewed to ensure staff have sufficient tools for monitoring processed transactions. Agreed. Queries are a very useful tool to retrieve information from the HCM database. Public queries are a key component of our pay processing balancing procedure. There are many public queries that are available to the Distributed Payroll group; we will make a concerted effort to let everyone know what is available to them and train them on how to run them. Page 19 of 34

20 Audit Report Page TIME ENTRY INTERFACE Overview Time is accumulated for input into the bi-weekly payroll process using mainframe sub-systems. These sub-systems (as OTIS) were originally developed for the legacy system. Due to differences in platforms, considerable effort is required to support the interfaces (ie; extensive on-going mapping between the two systems.) PeopleSoft has a Time and Labor module which, if configured correctly, would eliminate problems associated with the interfaces. However, this component is not planned for implementation until 2005; considerable planning and re-configuration is required for Time and Labor to fit properly. 5.1 Interface Sustainment We were informed that the majority of errors occur in the time interface; this is where most of the control risks lie. During our review, we were informed there was only one systems analyst sufficiently familiar with the complex mapping between the two systems. If this employee ceases employment with the City, there would be a risk in sustaining the time feed interface. Backup resourcing should be provided for the time interface. Page 20 of 34

21 Audit Report Page 21 Agree In Principle. The technology involved is so old that although we have a support arrangement with IBM, it is difficult for them to find a technician who is capable of servicing OTIS. We will ask ITS to train a backup for the Technical Analyst currently supporting the functional side of OTIS. 5.2 Future Plans Time and Labor The Time and Labor module will represent considerable change in the way payroll is administered and will provide several benefits. However, implementing the module requires considerable planning, including a review of requirements in the distributed areas. This would include identifying required control procedures and reporting needs. Planning for the Time and Labor module should include all requirements in distributed areas. Agreed. That is one of the reasons the Distributed Payroll staff had to be merged into Employee Services, so that we could ensure that the planning and execution of Time & Labour would include the Distributed Pay. We must begin the Time and Labour implementation as soon as possible. Page 21 of 34

22 Audit Report Page OFF-CYCLE CHEQUES/ADJUSTMENTS Overview Off-cycle cheques are produced in situations where employees are paid in between the normal payroll cycles (e.g. terminations). Adjustments are required when errors occur in an employees pay (e.g. short hours.) In both, payroll adjustment forms must be initiated by the distributed areas. Our review indicated: Some forms were not properly authorized. Off cycle transactions are not reviewed by management to ensure the accuracy and completeness of such transactions. Comment During the review, procedures were implemented to ensure requests for off-cycle cheques were from authorized sources. Reports on off cycle cheques and adjustments should be produced for management review. Agreed. Off cycle payments are part of the payroll register for the following pay period and will be included in any report we produce to line management of what is being paid. Page 22 of 34

23 Audit Report Page TRACKING SYSTEMS Overview Procedures are required to track all events triggering input to employee status records for predicted events, such as step increases, service pay, etc. In the business units, various methods are used to track changes to status records. These processes include simple spreadsheets and manual methods, neither of which interface with the main system. The PeopleSoft Time and Labor module will, if configured properly, automatically track these tasks. Our discussions with staff indicated that tracking systems were: Not consistent (standards, rules etc.) between areas. This may impact the uniform application of contracts. Informal and hard to control. Required considerable extra work to do the tracking. Procedures should be standardized to prepare for initiating the Time and Labor module. Agreed. Bringing Distributed Pay into Employee Services will greatly facilitate the standardization process and will make it more straightforward when we come to plan and design how we implement Time & Labour. Page 23 of 34

24 Audit Report Page 24 Page 24 of 34

25 Audit Report Page SYSTEMS DOCUMENTATION Systems documentation seems adequate for instructing staff on most routine procedures. However, the documentation does not cover control procedures in a complete and structured manner. This can have the result in controls not being exercised in the event of staff changes (involving less experienced staff) or relief situations. Audit Comment At the time of the audit, the distributed team leader was beginning to prepare detailed documentation for all categories of procedures. Page 25 of 34

26 Audit Report Page 26 D. TECHNICAL / SECURITY Overview The System s security procedures for HRMS evolved after system go-live, along with the administration and staff infrastructure. The next version of PeopleSoft, 8.8, to be implemented in December 2003, will include tools to improve security. 1.0 ACCESS CONTROL 1.1 Basic Process At the time of our review: There was no process to grant and maintain access based on job functions. Developers often had inappropriate access and staff members with dissimilar job duties had the same access. Many staff had very large spans of control. There was no logging or history maintained of access attempts. A process should be developed to grant and maintain access based on job responsibilities. Agreed. With the implementation of HCM 8.8, we now have a streamlined control process for granting security access to our users. We will continue to improve it, to the point that we will base security permission on job codes, once those are fully developed within HR. Page 26 of 34

27 Audit Report Page Query Access All employees have access to public queries even if it is not required for their job. Some queries include confidential information. PeopleSoft Version 7.5 does not provide the facility to limit query access. Query access should be limited to staff who require them to perform their duties. Agreed. Done. This has been delivered in HCM 8.8. Users now only have access to those queries which use the underlying security structure which governs the online access they already have. No one can therefore see something through a report that they cannot see online. 1.3 Access to Data Bases All systems analysts have access to the HRMS production database. This access can result in the bypassing of application security for payroll. We noted: There is no audit trail when analysts sign in as system administrators. There is no monitoring of database access. Page 27 of 34

28 Audit Report Page Process Access Audit Comment The IT Security area has developed a draft procedural change to limit access to the database. Access to run PeopleSoft processes can include the ability to generate cheques and direct deposits. Our review indiciated: all system super-users can run all processes other users can run specific processes there is no process to determine appropriate access to processes based on job function. Access to payroll processes should be reviewed and restricted based on job function. Agreed. 2.0 PASSWORD PROCEDURES At the time of our audit, password controls were weak due to limitations in PeopleSoft 7.5. For example: no minimum length, or special characters enforced no process for expiry and regular changing no lock-out after repeated attempts. Page 28 of 34

29 Audit Report Page 29 We understand Version 8.8 will provide the facility to improve password controls. Password control facilities should be activated when Version 8.8 implementation is complete. Agreed. Done. Enhanced password procedures have been activated as of 2004 January SECURITY ADMINISTRATION We noted that security administrators can give themselves inappropriate access by adding classes to the SECADM profile. s I. Security administrators should not be allowed to update security administration profiles without written authorization. II. Changes to the security administration profiles should be monitored by Employee Services. Agreed. All security changes have to be approved in writing by the Manager, Employee Services (Remedy tickets are now used.) Page 29 of 34

30 Audit Report Page 30 Changes to overall profiles and permission lists will also be approved in writing by the Manager, Employee Services via Remedy tickets. 4.0 CORRECTION MODE Overview Correction mode is a powerful system utility that can change data without history logging or effective dating. All superusers and Data Centre staff have correction access. The Data Centre supervisor monitors correction access using spreadsheets for changes made by Data Centre staff. Our review of correction mode access indicated: There is no audit trail (no effective dating) for transactions created using correction mode. There is no system wide monitoring of transactions entered using correction access. Although Data Centre staff are monitored, staff in other areas with this access are not monitored. s Consideration should be given to: I. Reassessing the need for correction access. II. Monitoring all correction access adds, deletes and changes. Agree In Principle. Correction mode is strictly controlled. In the Data Centre, only the Senior Data Administrator and Data Administrators have correction mode access. Changes to who has correction mode must be approved by Page 30 of 34

31 Audit Report Page SUPER-USER ACCOUNTS the Manager, Employee Services. The Manager, Employee Services now runs SQR PER029 (Database audit) on a weekly basis to monitor database changes, including correction activity. Due to the wide range of system power held by super-users, these accounts are normally limited to 2-3 staff per system. We noted: Five people have defined super-user access and can update or correct all panels, processes, queries, and objects in HRMS. An additional three people can give themselves super-user access through the Security Administration access. A review should be done of super-user access to ensure access is on a need to have basis related to job duties. Agreed. The following changes will be made: the 4 superusers in the HCM Sustainment group will have their capacity to update employee data in the production environment removed. alternate superusers will be established within Employee Services, one of which will be the Manager, Employee Services in that role s capacity as both Payroll Process Owner and Payroll Data Owner. Page 31 of 34

32 Audit Report Page PAYLINE PROCESS Overview The Payline process is part of the PeopleSoft Bi-weekly. It allows staff to make last minute changes before pay confirmation. Eleven employees have access to Payline. It is possible to create a new employee, change hours and rates of an existing employee and update ones own records in Payline. Employees with Payline access also have access to produce cheques or direct deposits. Payline entries are monitored by staff who can also access that process. s I. The number of employees with access to Payline should be reviewed. II. Transactions made through Payline should be independently monitored. Agreed. The Manager, Employee Services will review the appropriateness of the current level of access to Payline taking into consideration operational needs. Page 32 of 34

33 Audit Report Page FIELD LEVEL SECURITY Although field level security does exist for some critical fields, none is provided for additional pay fields or for Payline entries. There is no reporting or monitoring of field level security. Security staff were not aware that some fields have field level security. (A query had to be run to identify which fields had security turned on). s I. All critical fields should have field level security turned on. II. Reports on adds, changes or deletes to critical fields should be developed to enable monitoring and review of transactions for appropriateness. Partially agree. to protect the integrity of the payline process, we do monitor the aggregate effect on a pay by pay basis for reasonableness and it is them compared to the corresponding pay in the previous year. Turning on field level security is precluded by the PeopleSoft application. We are also changing our Net Pay Over $2000 report to be either $3000 in net pay or more regular hours than typically reasonable. These two measures will make our control report much more useful. Page 33 of 34

34 Audit Report Page 34 R. D. MacLean TK/mic-g Date Draft Audit Report Issued: 2003 December 15 cc. Owen Tobert, Acting CEO Chris Good, General Manager, Corporate Services Wes Koehn, A/Director/City Treasurer, Finance & Supply G. Champagne, Manager, Employee Services Audit Committee External Auditor Page 34 of 34