1 O FFICE OF THE NEW YORK STATE COMPTROLLER DIVISION OF LOCAL GOVERNMENT & SCHOOL ACCOUNTABILITY Phoenix Central School District Internal Controls Over Payroll Report of Examination Period Covered: July 1, 2009 October 31, M-148 Thomas P. DiNapoli
2 Table of Contents AUTHORITY LETTER 2 Page INTRODUCTION 3 Background 3 Objective 3 Scope and Methodology 3 Comments of District Officials and Corrective Action 3 INTERNAL CONTROLS OVER PAYROLL 5 Recommendations 8 APPENDIX A Response From District Officials 10 APPENDIX B Audit Methodology and Standards 13 APPENDIX C How to Obtain Additional Copies of the Report 15 APPENDIX D Local Regional Office Listing 16 DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 11
3 State of New York Division of Local Government and School Accountability September 2011 Dear School District Officials: A top priority of the is to help school district officials manage their districts efficiently and effectively and, by so doing, provide accountability for tax dollars spent to support district operations. The Comptroller oversees the fiscal affairs of districts statewide, as well as districts compliance with relevant statutes and observance of good business practices. This fiscal oversight is accomplished, in part, through our audits, which identify opportunities for improving district operations and Board of Education governance. Audits also can identify strategies to reduce district costs and to strengthen controls intended to safeguard district assets. Following is a report of our audit of the Phoenix Central School District, entitled Internal Controls Over Payroll. This audit was conducted pursuant to Article V, Section 1 of the State Constitution and the State Comptroller s authority as set forth in Article 3 of the General Municipal Law. This audit s results and recommendations are resources for district officials to use in effectively managing operations and in meeting the expectations of their constituents. If you have questions about this report, please feel free to contact the local regional office for your county, as listed at the end of this report. Respectfully submitted, Offi ce of the State Comptroller Division of Local Government and School Accountability 2 OFFICE OF THE NEW YORK STATE COMPTROLLER
4 Introduction Background The Phoenix Central School District (District) is located in the Towns of Schroeppel, Palermo, Granby, Volney and Hastings in Oswego County, and the Towns of Clay and Lysander in Onondaga County. The District is governed by the Board of Education (Board) which comprises nine elected members. The Board is responsible for the general management and control of the District s financial and educational affairs. The Superintendent of Schools (Superintendent) is the chief executive officer of the District and is responsible, along with other administrative staff, for the day-to-day management of the District under the direction of the Board. There are four schools in operation within the District, with approximately 2,100 students and 540 employees. The District s expenditures for the fiscal year were $41.5 million, funded primarily with State aid, real property taxes, and grants. Objective The objective of our audit was to determine if internal controls over payroll were appropriately designed and operating effectively to adequately safeguard District assets. Our audit addressed the following related question: Is there adequate segregation of duties over the payroll process to ensure that payments of wages are in accordance with Board authorizations and approved employment contracts? Scope and Methodology We examined internal controls over payroll for the period July 1, 2009 to October 31, We extended our review of the payroll payout audit through December 7, We conducted our audit in accordance with generally accepted government auditing standards (GAGAS). More information on such standards and the methodology used in performing this audit is included in Appendix B of this report. Comments of District Officials and Corrective Action The results of our audit and recommendations have been discussed with District officials and their comments, which appear in Appendix A, have been considered in preparing this report. District officials generally agreed with our recommendations and indicated they planned to take corrective action. The Board has the responsibility to initiate corrective action. Pursuant to Section 35 of the General Municipal Law, Section 2116-a (3)(c) of the Education Law and Section of the Regulations of the DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 33
5 4 OFFICE OF THE NEW YORK STATE COMPTROLLER Commissioner of Education, a written corrective action plan (CAP) that addresses the findings and recommendations in this report must be prepared and provided to our office within 90 days, with a copy forwarded to the Commissioner of Education. To the extent practicable, implementation of the CAP must begin by the end of the next fiscal year. For more information on preparing and filing your CAP, please refer to our brochure, Responding to an OSC Audit Report, which you received with the draft audit report. The Board should make the CAP available for public review in the District Clerk s office.
6 Internal Controls Over Payroll Payroll is the District s most significant operating cost, accounting for 51 percent of its annual expenditures in the fiscal year. An effective system of internal controls over payroll processing is therefore essential to ensure that employees are properly paid the wages and salaries to which they are entitled. An important component of any internal control system is proper segregation of duties to ensure that no one person controls all phases of a transaction. In addition, internal controls should include restricting each user s access to the financial software based on job description and official job duties. These controls also provide for proper segregation of duties by allowing users to access only those computer functions that are necessary to fulfill their job responsibility, preventing users from being involved in multiple aspects of a financial transaction. When complete segregation of duties is not possible, the District should institute mitigating controls such as routine managerial review of the employee s work. Written payroll policies and procedures, including specific job descriptions, help to ensure that payroll is processed consistently and accurately, while providing a framework for employees to understand the Board s objectives and each employee s role in the process. Written policies are particularly important when a separation of duties is necessary to provide an adequate level of control. Although the payroll clerk has developed an informal system to process payroll, the Board has not established written policies and procedures for payroll processing, District officials have not adequately segregated payroll duties and each employee s responsibilities have not been defined. Management has not instituted mitigating controls, such as verification of payroll changes, or conducting a payroll audit. 1 These control deficiencies leave the District vulnerable to payrollrelated errors and irregularities that may not be detected and corrected. Segregation of Duties A strong system of internal control provides for an adequate segregation of duties, reducing the risk of errors and irregularities through the separation of incompatible job functions. Functions such as authorization of transactions, recordkeeping and custody of payroll checks should be distributed so that no one employee controls all aspects of the process. For example, the same individual should not have the ability to add and delete employees in the computer system, update salary information, and process, print, 1 A payroll audit was performed subsequent to our audit period. DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 55
7 6 OFFICE OF THE NEW YORK STATE COMPTROLLER and distribute payroll checks. Access controls prevent users from performing multiple aspects of a financial transaction. To ensure adequate controls, users should have access only to those computer functions needed to fulfill their job responsibilities. District officials did not adequately segregate the duties over the payroll process. The payroll clerk has the ability to create new employee records, update employee information, input salary detail, set up withholdings and direct deposits, and print signed checks. Although the District s Human Resource (HR) Department is responsible for entering new employee information, the payroll clerk is responsible for entering payroll changes such as salary changes, stipends, employee direct deposit, deductions and withholding information into the payroll application. In 2008, the District s internal auditors strongly recommended that only the HR personnel have the ability to change salary rates; however, the District did not implement the recommendation because they felt that it wasn t practical. During our review of user permission rights within the payroll module, we found the payroll clerk and six additional District employees have permission rights allowing them to add, delete, and modify employee information such as salary rates. User rights assigned to these employees allowed them access to functions of the accounting system beyond those required to fulfill their job duties. The Business Official stated that certain District employees were provided temporary permission rights in the payroll module for a project in September 2008 to update personnel information; however, permissions were inadvertently not revoked after the project was completed. 2 We examined transaction history reports for the Business Office employees for the period July 1, 2009 through October 31, 2010 and we determined that the transactions performed were within the scope of their prescribed duties. Although we found no exceptions, there was an increased risk that errors, irregularities or fraud could occur and not be detected and corrected in a timely manner. Verification of Payroll Changes Verification procedures enable management to determine the completeness, accuracy, authenticity and/or validity of transactions, events or information. They provide assurance that activities are completed in accordance with established directives. A good internal control system provides for the periodic verification of payroll changes (such as those for new hires, dismissals, salary increases, etc.) to ensure that they are both appropriate and properly authorized. Management should determine which payroll 2 On December 22, 2010, the Business Official requested that these rights be revoked.
8 changes should be verified based upon the risks to the organization. The District payroll clerk makes all changes to payroll with only limited oversight. The Business Official receives a new hire listing along with the payroll reports to be certified each pay period from the payroll clerk. However, a change report indicating the changes made to payroll during the period is not provided for review. During the payroll certification process, the Business Official reviews the total payroll amount and compares it to previous total payroll amounts to determine reasonableness; however, he does not review individual employee change reports. For example, the Business Official could review a change report that would detail salary changes for each employee from the previous pay period to the current pay period which would be a good mitigating control to ensure additions or changes are authorized. Payroll Payout Audit One way to help safeguard the District against fraud is to require that periodic payroll payout audits be performed by an employee not connected with the payroll process. A payout audit entails personally handing out each paycheck or remittance advice (for direct deposits) to the appropriate individual. The employee signs for the paycheck or remittance advice when he or she receives it, and provides identification when necessary to verify his or her identity. This process validates the existence of all employees receiving pay. The District conducted a payroll payout audit subsequent to our audit period. This process was completed on November 12, As part of the payroll payout audit, each building s school secretary obtained the signature of each employee on the payroll register for each respective school building. Employee identification was required for each employee to receive their paycheck or remittance advice. As of December 7, 2010, the District had not obtained 14 signatures out of 523 employees who were listed on the November 12, 2010 payroll. We verified that these 14 individuals were District employees by reviewing personnel files. In addition, Business Office employees, i.e., the payroll clerk, the accounts payable clerk, the Business Office assistant and the Treasurer, as well as the Director of Personnel were notified several weeks in advance of the payroll payout audit, which diminishes the effectiveness of the payroll payout audit. A payroll payout audit, performed on a sporadic and unannounced basis, requires employees to pick up their paychecks or direct deposit remittances in person and to produce identification to verify their identity. This internal control procedure helps confirm the accuracy of payroll records by ensuring that individuals receiving paychecks are legitimate employees. Because of the lack of segregation of duties, including inadequate user permission rights and the limited mitigating controls, we reviewed the District s payroll reports, employment contracts, and DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 77
9 Board minutes to determine whether wages were paid in accordance with Board authorizations and approved employment contracts for the and fiscal years. We reviewed the wages paid to 10 District employees 3 who had access to make payroll changes or had oversight responsibilities, to verify the appropriateness of their wages totaling $610,686 in and $210,156 during Eight out of these ten employees received wages of $454,749 in and $161,695 in without a contractual agreement or board resolution providing authorization for their salaries. While these employees initially had individual confidential employment agreements that spelled out their salaries and benefits, they had lapsed and were not current. The eight employees were the Business Official, the Director of Personnel, the Business Office assistant, the Treasurer, the Personnel Office assistant, the accounts payable clerk, the secretary to the Superintendent and the payroll clerk. The amounts paid were consistent with other staff increases; however, the Board did not formally authorize their salaries with a Board resolution. The Business Official provided a copy of the salary increases proposed to the Board in each of the years of our audit period; however, they were not formally approved. In addition, we reviewed personnel files of 72 employees 4 and verified that they were legitimate District employees. Although our review did not identify any unauthorized employees, significant discrepancies or unusual transactions, the lack of segregation of duties without mitigating controls in place increases the risk that unauthorized payroll disbursements could occur and go undetected. Recommendations 1. District officials should develop a comprehensive payroll policy that provides for an adequate segregation of duties, and written procedures, including job descriptions, to guide employees in their payroll processing responsibilities. 2. District officials should periodically review financial software permissions and access to ensure that they are compatible with assigned duties. 8 OFFICE OF THE NEW YORK STATE COMPTROLLER 3 We selected our 10 employees based on access rights to the payroll system and/or those who had oversight roles within the payroll system. We selected the former Superintendent, the current Superintendent, the Business Official, the Director of Personnel, the Business Office assistant, the Treasurer, the Personnel Office assistant, the accounts payable clerk, the secretary to the Superintendent, and the payroll clerk. 4 The 14 employees we verified as legitimate District employees from the payroll payout audit are included in the 72 employees we reviewed for this concern.
10 3. The School Business Official should ensure that a supervisor or someone independent of the payroll process reviews payroll change reports to verify that adjustments to employee records that are entered into the payroll system are authorized. 4. District officials should periodically conduct a payroll payout with little or no notice to those that are part of the payroll process. 5. The Board should establish contractual agreements or Board resolutions authorizing all salaries paid to employees. DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 99
11 APPENDIX A RESPONSE FROM DISTRICT OFFICIALS The District officials response to this audit can be found on the following pages. 10 OFFICE OF THE NEW YORK STATE COMPTROLLER
12 DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 1111
13 12 OFFICE OF THE NEW YORK STATE COMPTROLLER
14 APPENDIX B AUDIT METHODOLOGY AND STANDARDS Our overall goal was to assess the adequacy of the internal controls put in place by officials to safeguard District assets. To accomplish this, we performed an initial assessment of the internal controls so that we could design our audit to focus on those areas most at risk. Our initial assessment included evaluations of the following areas: financial oversight, cash receipts and disbursements, purchasing, payroll and personal services and information technology. During the initial assessment, we interviewed appropriate District officials, performed limited tests of transactions and reviewed pertinent documents, such as District policies and procedures manuals, Board minutes, and financial records and reports. In addition, we obtained information directly from the computerized financial databases and then analyzed it electronically using computer-assisted techniques. This approach provided us with additional information about the District s financial transactions as recorded in its databases. Further, we reviewed the District s internal controls and procedures over the computerized financial databases to help ensure that the information produced by such systems was reliable. After reviewing the information gathered during our initial assessment, we determined where weaknesses existed and evaluated those weaknesses for the risk of potential fraud or abuse. We then decided on the reported objectives and scope by selecting for audit those areas most at risk. We selected payroll for further audit testing. To accomplish the objective of this audit, our procedures included the following: We examined the following records and reports: o Employee personnel files o Collective bargaining agreements and individual employment contracts o Board minutes o District staff directory o Payroll registers generated from computerized accounting system o Payroll schedules and time cards for hourly employees. We interviewed the payroll clerk and management to gain an understanding of the payroll process. We reviewed compensation of 10 employees totaling $610,687 paid during and $210,156 paid during We selected employees with user permission rights providing them the ability to add, delete, and modify employee information such as salary rates. We also selected those who have oversight responsibilities and potentially the ability to override controls. We compared the amounts paid to board authorizations. We verified the existence of employees receiving pay. We selected 34 employees based on criteria such as employee identification (I.D.) with more than one name; same name with more than one employee I.D.; employees with low withholdings; separate direct deposits in same account; employees with address not local; and rounded gross payroll. DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 13
15 We reviewed the District s processes for conducting payroll payout audits and examined another 38 employee personnel files to validate the existence of the employees receiving pay. The employees selected consisted of the 14 employees who had not signed the payroll verification sheet; 14 employees that were on September 30, 2010 payroll certification but not listed on the payroll payout audit; and 10 employees on the payroll audit but not September 30, 2010 payroll certification. We conducted this performance audit in accordance with generally accepted government auditing standards (GAGAS). Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objective. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective. 14 OFFICE OF THE NEW YORK STATE COMPTROLLER
16 APPENDIX C HOW TO OBTAIN ADDITIONAL COPIES OF THE REPORT To obtain copies of this report, write or visit our web page: Public Information Office 110 State Street, 15th Floor Albany, New York (518) DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY 15
17 APPENDIX D OFFICE OF THE STATE COMPTROLLER DIVISION OF LOCAL GOVERNMENT AND SCHOOL ACCOUNTABILITY Steven J. Hancox, Deputy Comptroller Nathaalie N. Carey, Assistant Comptroller LOCAL REGIONAL OFFICE LISTING BINGHAMTON REGIONAL OFFICE H. Todd Eames, Chief Examiner State Office Building - Suite Hawley Street Binghamton, New York (607) Fax (607) Serving: Broome, Chenango, Cortland, Delaware, Otsego, Schoharie, Sullivan, Tioga, Tompkins Counties BUFFALO REGIONAL OFFICE Robert Meller, Chief Examiner 295 Main Street, Suite 1032 Buffalo, New York (716) Fax (716) Serving: Allegany, Cattaraugus, Chautauqua, Erie, Genesee, Niagara, Orleans, Wyoming Counties NEWBURGH REGIONAL OFFICE Christopher Ellis, Chief Examiner 33 Airport Center Drive, Suite 103 New Windsor, New York (845) Fax (845) Serving: Columbia, Dutchess, Greene, Orange, Putnam, Rockland, Ulster, Westchester Counties ROCHESTER REGIONAL OFFICE Edward V. Grant, Jr., Chief Examiner The Powers Building 16 West Main Street Suite 522 Rochester, New York (585) Fax (585) Serving: Cayuga, Chemung, Livingston, Monroe, Ontario, Schuyler, Seneca, Steuben, Wayne, Yates Counties GLENS FALLS REGIONAL OFFICE Jeffrey P. Leonard, Chief Examiner One Broad Street Plaza Glens Falls, New York (518) Fax (518) Serving: Albany, Clinton, Essex, Franklin, Fulton, Hamilton, Montgomery, Rensselaer, Saratoga, Schenectady, Warren, Washington Counties SYRACUSE REGIONAL OFFICE Rebecca Wilcox, Chief Examiner State Office Building, Room E. Washington Street Syracuse, New York (315) Fax (315) Serving: Herkimer, Jefferson, Lewis, Madison, Oneida, Onondaga, Oswego, St. Lawrence Counties HAUPPAUGE REGIONAL OFFICE Ira McCracken, Chief Examiner NYS Office Building, Room 3A10 Veterans Memorial Highway Hauppauge, New York (631) Fax (631) STATEWIDE AND REGIONAL PROJECTS Ann C. Singer, Chief Examiner State Office Building - Suite Hawley Street Binghamton, New York (607) Fax (607) Serving: Nassau and Suffolk Counties 16 OFFICE OF THE NEW YORK STATE COMPTROLLER