PayData Payroll Services, Inc.

Transcription

1 PayData Payroll Services, Inc. Report on PayData s Description of Its Payroll Processing System and on the Suitability of the Design and Operating Effectiveness of Its Controls (SOC 1) For the period of

2 T Table of Contents S REPORT... 1 Management s Assertion Letter... 3 Organization and Management... 5 Management s Philosophy and Operating Style... 5 Assignment of Authority and Responsibility... 6 Organizational Structure... 6 Hiring Practices and Human Resource Policies... 7 Training... 7 Integrity and Ethics... 8 Confidentiality Agreement... 8 Code of Ethics... 8 Commitment to Competence... 8 Information and Communication... 9 Risk Assessment and Monitoring... 9 Transaction Processing New Client Conversion Payroll Processing Payroll Distribution Tax Payments and Compliance ACH Processing Finance and Administration Information Technology and Systems Security Description of IT Outsource Agreement Description of Computerized Information Systems General Computer Controls Building and Office Access Physical Access and Environmental Protection of Server Room Logical Access Software Change Management Information Safeguards Computer Operations Subservice Organizations Client Control Considerations Purpose and Objectives of the Report PayData s Control Objectives and Related Controls and Independent Service Auditor s Tests of Controls and Results of Tests Additional Information Provided by PayData Description of the Evolution Payroll Software Remote Access and Security... 76

3 S REPORT Management of PayData Payroll Services, Inc. We have examined PayData Payroll Services, Inc. s ( PayData ) description of its payroll processing system for processing user entities transactions throughout the period October 1, 2011 to September 30, 2012 and the suitability of the design and operating effectiveness of controls to achieve the related control objectives stated in the description. The description indicates that certain control objectives in the description can be achieved only if complementary user entity controls contemplated in the design of PayData s controls are suitably designed and operating effectively, along with the related controls at the service organization. We have not evaluated the suitability of the design or operating effectiveness of such complementary user entity controls. PayData uses a payroll software vendor, ACH processor, tax research software, and an IT outsource provider to supplement its processes in the performance of its payroll processing system. The description in Section III includes only the controls and related control objectives of PayData and excludes the control objectives and related controls of the subservice organizations. Our examination did not extend to controls of the subservice organizations. The information in section V, Additional Information Provided by PayData, describes PayData s payroll software and web application. This information is presented by management of PayData to provide additional information and is not a part of PayData s description of its payroll system made available to user entities during the period October 1, 2011 to September 30, Information about PayData s payroll software and web application has not been subjected to the procedures applied in the examination of the description of the payroll system and of the suitability of the design and operating effectiveness of controls to achieve the related control objectives stated in the description of the payroll system and accordingly, we express no opinion on it. In Section II of the description, PayData has provided an assertion about the fairness of the presentation of the description and suitability of the design and operating effectiveness of the controls to achieve the related control objectives stated in the description. PayData is responsible for preparing the description and for the assertion, including the completeness, accuracy, and method of presentation of the description and assertion, providing the services covered by the description, specifying the control objectives, selecting the criteria, and designing, implementing and documenting controls to achieve the related control objectives stated in the description. Our responsibility is to express an opinion on the fairness of the presentation of the description and on the suitably of the design and operating effectiveness of the controls to achieve the related control objectives stated in the description, based on our examination. We conducted our examination in accordance with attestation standards established by the American Institute of Certified Public Accountants. Those standards require that we plan and perform our examination to obtain reasonable assurance about whether, in all material respects, the description is fairly presented and the controls were suitably designed and operating effectively to achieve the related control objectives stated in the description throughout the period October 1, 2011 to September 30,

4 An examination of a description of a service organization s system and the suitability of the design and operating effectiveness of the service organization s controls to achieve the related control objectives stated in the description involves performing procedures to obtain evidence about the fairness of the presentation of the description and the suitability of the design and operating effectiveness of those controls to achieve the related control objectives stated in the description. Our procedures included assessing the risks that the description is not fairly presented and that the controls were not suitably designed or operating effectively to achieve the related control objectives stated in the description. Our procedures also included testing the operating effectiveness of those controls that we consider necessary to provide reasonable assurance that the related control objectives stated in the description were achieved. An examination engagement of this type also includes evaluating the overall presentation of the description and the suitability of the control objectives stated therein, and the suitability of the criteria specified by the service organization and described in Section II. We believe that the evidence we obtained is sufficient and appropriate to provide a reasonable basis for our opinion. Because of their nature, controls at a service organization may not prevent, or detect and correct, all errors or omissions in processing payroll transactions. Also, the projection to the future of any evaluation of the fairness of the presentation of the description, or conclusions about the suitability of the design or operating effectiveness of the controls to achieve the related control objectives is subject to the risk that controls at a service organization may become inadequate or fail. In our opinion, in all material respects, based on the criteria described in PayData s assertion in Section II, a) the description fairly presents the payroll processing system that was designed and implemented throughout the period of October 1, 2011 to September 30, b) the controls related to the control objectives stated in the description were suitably designed to provide reasonable assurance that the control objectives would be achieved if the controls operated effectively throughout the period October 1, 2011 to September 30, 2012 and user entities applied the complementary user entity controls contemplated in the design of PayData s controls throughout the period October 1, 2011 to September 30, c) the controls tested, which together with the complementary user entity controls referred to in the scope paragraph of this report, if operating effectively, were those necessary to provide reasonable assurance that the control objectives stated in the description were achieved, operated effectively throughout the period October 1, 2011 to September 30, The specific controls tested and the nature, timing and results of those tests are listed in Section IV. This report, including the description of test of controls and results thereof in Section IV, is intended solely for the information and use of PayData, user entities of PayData s payroll processing system during some or all of the period of October 1, 2011 to September 30, 2012, and the independent auditors of such user entities, who have a sufficient understanding to consider it, along with other information including information about controls implemented by user entities themselves, when assessing the risks of material misstatements of user entities financial statements. This report is not intended to be and should not be used by anyone other than these specified parties. Kansas City, Missouri October 5,

5

6

7 PAYDATA PAYROLL SERVICES, INC. SECTION III. DESCRIPTION OF SYSTEM PROVIDED BY PAYDATA Organization and Management PayData is a regional payroll processing and related payroll tax compliance service organization. PayData was formed in 1987 and is located in Colchester, Vermont. PayData serves approximately 1,800 clients and generates approximately 120,000 checks each month. PayData is an S-Corp and is owned by Michael J. Trahan who serves as CEO. The President and Vice President of Operations are responsible for the day to day operations of PayData. The CEO, President and Vice President of Operations makes up the executive management team. PayData consist of an Operations, Tax, Sales, and Accounting departments. In order to enhance controls, the business operations are segregated into functional departments. The President oversees the Sales Department which is responsible for new client sales, expanding services to current clients and obtaining the new client setup packet. The Vice President oversees each of the departments, which perform the following: Operations Department Responsible for internal training, receiving and processing payroll information, client service, new client setup or conversion, timeclock setup, and new client trainings. Tax Department Responsible for approval of new client tax setup, payment of taxes, submission of filings and resolution of tax notices. Accounting Department Responsible for the daily bank reconciliations and monitoring bank transactions. Each department employs a manager or supervisor who oversees the department operations and reports to the President or Vice President of Operations. Management s Philosophy and Operating Style PayData s mission statement summarizes their business objectives and overall philosophy on professional conduct: Dedicated to quality, personalized service surpassing every expectation. PayData s management communicates this mission statement during meetings and by their actions. PayData s management monitors the organization to ensure compliance with the mission statement and that the company operates effectively and efficiently while remaining industry and client focused. Personnel turnover has been minimal. Senior management and operating management have frequent interaction in both formal and informal settings. PayData s management continuously emphasizes the importance of the payroll and tax processing function and its role in ensuring the reliability of client data. The Vice President of Operations is actively involved in the day-to-day operations and activities of the company. The President and Vice President of Operations have an open door communication policy. Every employee has access to the President daily and the President is visible to all employees on a daily basis to provide an opportunity for the employees to inform him of issues or concerns. The Vice 5

8 PAYDATA PAYROLL SERVICES, INC. SECTION III. DESCRIPTION OF SYSTEM PROVIDED BY PAYDATA President of Operations has weekly staff meetings where employee feedback and suggestions are encouraged. As applicable, departments maintain individual task schedules which outline the critical functions that must be completed throughout the day. The task schedules are reviewed daily by management to ensure that all required tasks have been performed. Assignment of Authority and Responsibility The Management Team, consisting of the President, Vice President and department managers, has the ultimate responsibility for all activities within the entity, including the internal control system. This also includes assignment of authority and responsibility for operating activities, and establishment of reporting relationships and authorization protocols. Organizational Structure An entity s organizational structure provides the framework within which its activities for achieving entity-wide objectives are planned, executed, controlled, and monitored. Significant aspects of establishing an effective organizational structure include defining key areas of authority and responsibility and establishing appropriate lines of reporting. 6

9 PAYDATA PAYROLL SERVICES, INC. SECTION III. DESCRIPTION OF SYSTEM PROVIDED BY PAYDATA Each non-managerial employee s position has responsibilities outlined by published job descriptions that provide general functions and specific duties. Each employee is given written expectations of the position. It provides a basis for employee reviews and accountability. Hiring Practices and Human Resource Policies The formalized human resource policies include critical aspects of the employment process including: hiring, training and development, performance evaluations, advancement and termination. PayData is committed to hiring and retaining the best qualified personnel. The hiring practices are formalized and carefully performed. All candidates are interviewed and screened by at least two Management Team members. In addition, background and criminal checks are conducted and references are contacted before an offer of employment is extended. During the employee s first few days of employment, they meet with the a member of the Management Team who discuss the importance of the sensitivity of the information being managed by the company and the importance of the organization s role in protecting clients information. Performance evaluations are performed on a regular basis and provide employees with a tool to understand their job performance and areas for improvement. In addition, the evaluation process helps management in determining compensation, promotions and topics for upcoming training sessions. Training Training is an important part of management s commitment to excellence. Management encourages employees participation in outside continuing education and holds regular training sessions in-house to keep the employees skills fine-tuned. PayData has well documented operating procedure manuals to provide a reference to employees in the conduct of their daily responsibilities. The procedure documentation is maintained and includes: Procedures for marketing and sales, human resources, client services, tax services and general operations. Finance and Accounting Manual for billing, invoicing, accounts receivable and collection activities, commissions, purchasing, accounts payable and reporting activities. Training Manuals to provide initial and ongoing instruction to employees and serve as a reference tool for employees. Technical Manuals that range in subjects from the computer operation guides to tax-related documentation. The technical manuals serve as a valuable resource to many different positions within PayData. Departmental meetings are held regularly for a variety of purposes. The meetings are attended by the appropriate departmental staff members. Topics normally covered are company changes, new assignments, software changes, IRS pronouncements, new clients and other payroll related issues that affect the operation of the organization. Quarterly meetings are also conducted in which the President gives the entire staff an overview of budgetary goal items. At the end of the meeting, each employee is 7

10 PAYDATA PAYROLL SERVICES, INC. SECTION III. DESCRIPTION OF SYSTEM PROVIDED BY PAYDATA given the opportunity to discuss items they feel are important and offer suggestions, which are encouraged throughout the meeting. All new employees undergo training and observe seasoned veterans for approximately one week and then are observed another week before they begin to work on their own. Once they begin working independently, their work is reviewed before it is released until it is deemed they have an adequate understanding of their job duties. Integrity and Ethics The organization and management of PayData establishes a control environment within which the employees must function. It is a framework for all aspects of internal control. This control environment includes such items as integrity and ethics, conflict of interest and commitment to excellence. Confidentiality Agreement All employees are required to review and sign PayData s confidentiality agreement prior to gaining access to client data. The agreement provides employees with clear guidelines of the employee s role in protecting client information. Management reviews the confidentiality guidelines at regularly scheduled staff meetings. Code of Ethics PayData s business conduct is governed by a standard code of ethics to provide guidance for employees and inform clients on the way PayData wishes to conduct business. As a member of Independent Payroll Provider s Association (IPPA), PayData has adopted their published code of ethics. Responsibilities covered are: avoiding misrepresentation, gifts, personal conduct, compliance, service standards, equitable practices, confidentiality, conflicts of interest, marketing, and financial reporting. New hires are instructed on these codes and they are reinforced through staff meetings. Commitment to Competence Competence should reflect the knowledge and skills required to accomplish tasks that define an individual s job. Through consideration of an entity s objectives and the strategies and plans for achievement of those objectives, management specifies the competence levels required for particular jobs and translates those levels into requisite knowledge and skills. PayData management has analyzed and defined the tasks and knowledge requirements that comprise the positions within the organization. They consider such factors to the extent to which individuals must exercise judgment and the extent of related supervision when making hiring decisions. PayData management communicates this to personnel through the interview process, job descriptions, the establishment of performance and development plans, and through periodic meetings with personnel. 8

11 PAYDATA PAYROLL SERVICES, INC. SECTION III. DESCRIPTION OF SYSTEM PROVIDED BY PAYDATA Information and Communication PayData utilizes various methods of communication to help ensure employees understand their individual roles and company controls, and to help ensure significant events are communicated timely. All new employees are provided with orientation and training programs. Time sensitive information is communicated verbally and by to all employees. The minutes from the weekly Management meeting are ed to the staff each week. PayData also communicates with their clients on a routine basis. Each client organization has a designated Client Service Representative who communicates via phone, fax, letter and Internet with the client organization regularly. In addition, flyers are added to processed payrolls or sent via Internet for important announcements or reminders. Periodic training classes are offered to client personnel. Risk Assessment and Monitoring PayData has placed into operation a process to identify and manage risks that could affect their ability to provide reliable payroll processing to clients. This process requires management to identify significant risks inherent in the processing of payroll data for clients and to implement appropriate measures to monitor and manage these risks. On a regular basis management meets to discuss the risks the business is facing. These include various aspects of financial and technological risks. In addition, the Vice President meets with the staff on a regular basis to discuss any outstanding issues pertaining to the functioning of the company. Internal controls are evaluated and monitored by the management team. The management team monitors and reports on department functions and compliance with laws and regulations. Standard reporting includes: Departmental Scorecards These reports are utilized to track the number of payrolls processed versus payrolls scheduled, client and internal errors, ACH returns and open and closed tax notices. The staff responsible for each scorecard updates the information daily. These reports are reviewed weekly during the regularly scheduled management meeting. Billing Transactions Report This report summarizes check count activity for each client and is run on a monthly basis and is reviewed at the monthly management and executive meetings. Budget Variance On a monthly basis, the financial statements are compared to the annual budget spreadsheet. Areas of concern are discussed during the monthly executive meeting. Sales Analysis Report This report is run on a monthly basis and compares sales and labor results by month and is discussed in the monthly executive meeting. Annual Budget Report- This annual spreadsheet is created as a benchmark as to where management expects to be at the end of a fiscal year and monthly comparisons are reviewed at the monthly executive meetings. 9

12 PAYDATA PAYROLL SERVICES, INC. SECTION III. DESCRIPTION OF SYSTEM PROVIDED BY PAYDATA Transaction Processing The primary control objective of PayData is to ensure that all transactions are properly initiated, authorized, recorded, processed, reported and maintained. These controls are evident in every aspect of the business. The core service areas of PayData are payroll conversion, payroll processing, payroll distribution, ACH processing, tax compliance, information technology and systems security. PayData provides its clients with various service level options in order to fit its client s needs. Clients are able to contract with PayData on a service-by-service basis, determined by the products they require. PayData provides all of its clients with a full service payroll solution that includes optional automatic payroll tax filing and depositing. There are many optional services that are available and are identified below: Positive Pay Checks, payroll checks are drawn on a PayData account Employee Direct Deposit New Hire Reporting Agency and Third Party Checks Delivery Additional State Tax Filing Jurisdictions General Ledger Check Reconciliation Spreadsheet 401K Process Reports/Transmission Quarterly 941s, Annual 940, and Year-end W-2s Timekeeping solution HR resources Customized interfaces New Client Conversion The Conversions Department exists to ensure: 1) that the transition of payroll services is smooth, efficient, and error free, 2) all year to date wages are reconciled with both tax returns and tax payments, 3) the balancing and payment of tax liabilities is properly reconciled and communicated to the client, and 4) responsibility is established for the filing of all payroll tax returns and communicated to the client. Procedures and checklists are followed to ensure the conversion of new clients is complete and accurate. The Conversion Department works with the client to ensure that all the information is received timely and is accurate and complete. The Conversion Department also works with the Client Service Representatives to familiarize them with the specifics of the client after the first live payroll. The Conversions Department follows specific procedures to ensure that all the client data is complete when received. Client Set-Up Forms are completed by the Sales Department in conjunction with the client to document all earnings and deduction taxability, tax agencies, filing frequencies, tax rates and any other special needs the client may have. 10

13 PAYDATA PAYROLL SERVICES, INC. SECTION III. DESCRIPTION OF SYSTEM PROVIDED BY PAYDATA Checklists and standard procedures are in place to review the accuracy of the data and balance key amounts, such as wages and tax amounts to the information provided by the client. All year-to-date payroll information must be balanced successfully prior to any payrolls being processed. A key control is a second person review of all the manually entered or imported data to ensure accuracy. The company setup and employee demographics are audited by the Client Service Department. The tax information is audited by the Tax Department. The billing services and bank accounts are audited by the Accounting Department. In addition, clients are required to sign a Bank Credit Reference Form authorizing their bank to release to PayData credit information about the client s account including credit lines, and payment history, which is reviewed by the Accounting Department to evaluate the new client s credit risk in relation to the services they have requested, such as direct deposit. All aspects of the new client setup are verified by someone other than the person entering the data into the payroll software, and primarily someone from a separate department to enhance the segregation of duties. Once the review and verification process is completed, the Conversions Department performs the first payroll run for the new client and then communicates client information to the assigned Client Service Representative. For remote entry clients, the Conversion Department works with the client to schedule the setup and training on Evolution and assist them with their first live payroll. Payroll Processing The Client Services Department consists of a dedicated team of Client Service Representatives to assist clients with their payroll. The Client Service Representatives are responsible for supporting clients, which includes keying payroll data, assisting remote clients, balancing and submitting payrolls for processing. They ensure that each and every payroll is processed according to the schedule with the highest degree of accuracy and that the data is received from authorized sources. Procedures have been implemented to ensure that payroll processing is scheduled and performed appropriately and deviations from the schedule are identified and resolved. Each Client Service Representative receives a list of their assigned scheduled payrolls, Scheduling Report, for the following week on Friday morning. The payrolls are marked off as processed and clients are called as a courtesy if the data is not received by 1:00 PM of the scheduled date if the Client Service Representative has time. During the end of day procedures, the Client Service Representatives review the Payrolls Not Called In Report and notate the reason for the client not processing on the scheduled date and provide the report to the Client Services Manager for review. Every afternoon a Waiting Payrolls Report is reviewed by the Client Service Representatives to confirm that all payrolls that have been started are also added to the processing queue and given to the Team Leader for review. PayData has a strict cut off policy for payroll processing, all payrolls due to be processed the same day have to be submitted by 1:00 PM. Payroll data received after 3:00 PM will not be processed until the next day unless authorized by a manager. The 3pm List is created which includes all payrolls received which have not been submitted to the queue by that time. Only those payrolls already in the queue, reflected on the Waiting Payroll Report or on the 3pm List are processed that day; the rest are held until the next day. 11

14 PAYDATA PAYROLL SERVICES, INC. SECTION III. DESCRIPTION OF SYSTEM PROVIDED BY PAYDATA Clients can submit their payroll data by one of several methods: Fax, , Esheet, TimeClock Import or Remote Input. Fax Input Client Service Representatives input payroll data faxed from the clients. These clients are provided an Input Worksheet report with each payroll. The report contains the active employees, their rates (unless masking has been requested) and columns to record their hours for typical earnings and amounts for special deductions. The client records the payroll on the provided worksheets and sends to PayData for processing. The Client Service Representatives review the faxed pages received from the client for legibility and makes note of any questionable items. The client is contacted by the Client Service Representatives to resolve any of the noted items. In addition, the Client Service Representatives verify the client submission with the payroll processing schedule. If a change in client contact occurs, client must provide written approval of the new contact and, if needed, specify the security limitations or access for the new contact. This allows for the proper flow of information between the Client Service Representative and the client. After any issues are resolved, the payroll data is manually entered by the Client Service Representatives. After the input is complete, the Client Service Representatives compares the batch totals to the totals provided by the client on their cover sheet or worksheet. If the client does not provide control totals, the Client Service Representatives will calculate the totals for hours, earnings and deductions and compare to the batch totals provided by the software. All submitted data must agree with the entered data before the payroll can be processed. /Esheet/TimeClock Import The client submits , Esheet and TimeClock payroll data by and the Client Service Representatives verify the sender s address as well as the timing of the submission with the payroll processing schedule. If a change in client contact occurs, the client must provide written approval of the new contact and, if needed, specify the security limitations or access for the new contact. This allows for the proper flow of information between the Client Service Representative and the client. Esheet The Esheet clients submit their payroll data by an Evolution generated preformatted Excel spreadsheet, called Esheets. PayData provides with every payroll process an Excel spreadsheet that contains current payroll data to the client so they can enter the payroll data directly into the Esheet. The Esheet contains all current employees, pay rates and columns for the client to enter hours, deductions, salary amounts and bonuses. Esheets are then submitted directly to the Client Service Representative via once completed by the client. Upon receipt of the Esheet, the Client Service Representative reviews the data for questionable items and contacts the client to resolve any noted items. The data is then imported into 12

15 PAYDATA PAYROLL SERVICES, INC. SECTION III. DESCRIPTION OF SYSTEM PROVIDED BY PAYDATA Evolution and verified for accuracy. The Esheet totals and the Evolution on-screen batch totals must agree before the payroll is submitted. Any differences are researched and resolved prior to processing. Some clients will send the employee information regarding hours, payments and other payroll data by . The Client Service Representatives review the ed data received from the client and make note of any questionable items. The client is contacted by the Client Service Representative to resolve any of the noted items. After all issues are resolved, the payroll data is manually entered by the Client Service Representative. After the data entry is complete, the Client Service Representative compares the Evolution on-screen batch totals to the totals provided by the client. If the client does not provide control totals, the Client Service Representative will calculate the totals for hours and earnings and compare to the Evolution on-screen batch totals. All submitted data must agree with the entered data before the payroll can be processed. TimeClock Import Clients can also authorize the Client Service Representatives to access online timekeeping systems to import hours on behalf of the client. Once the client notifies the Client Service Representatives that the data in the timekeeping system is accurate and ready for download, the Client Service Representatives will access the timekeeping system and import the hours into the payroll system. A report from the timekeeping system is created which gives the summary of hours for the pay period. The hours from the summary report are verified with the hours in the payroll system to confirm accuracy of the imported data prior to processing. Remote Input Clients can also elect to utilize the remote input entry option, in which they log into PayData s payroll software through the Remote Access Server (RAS) using a unique user ID and password. PayData manages the administration of the client s unique user ID and security access. Once the client authenticates themselves using a user id and password, the client enters company data, employee information and payroll data into Evolution. Through this option, the client is responsible for the accuracy of the payroll data entered in the payroll software. The client is encouraged to run a Pre- Processing Payroll Register Report to verify the payroll data prior to submitting the payroll to PayData for processing. PayData assumes no responsibility for the accuracy of the payroll data for remote clients as it processes the data as it was entered by the client. All Clients Payrolls other than regular payrolls, such as supplemental payrolls, client corrections or service bureau correction runs must be approved by management prior to processing. The Evolution software, through security features, requires these types of payrolls to appear on a queue which requires management approval in order to be processed. 13

16 PAYDATA PAYROLL SERVICES, INC. SECTION III. DESCRIPTION OF SYSTEM PROVIDED BY PAYDATA During payroll processing, the Evolution software calculates gross wages, taxable wages, employee and employer taxes, voluntary deductions and net pay. Checks, direct deposit vouchers and reports are created during the payroll process. The Evolution software detects if certain items are not set up properly, such as employee state data, and creates a log of these items. If there are any corrections to be made, the Client Service Representative to makes these corrections prior to completing the processing. Payroll Distribution The Processing Department is responsible for the distribution of each payroll. Procedures have been established for the production and distribution of payroll checks and reports. These procedures ensure that the checks and reports are produced and distributed completely, accurately and in accordance with client specifications. Checks and vouchers are printed on blank check stock that is specifically designed and printed with industry standard security protection. Some of the security features include an artificial watermark on the back of the check that can only be viewed at an angle to protect the document from scanner duplication and a micro-printed border that becomes distorted when duplicated. Each client receives a report package for each processed payroll based on their initial conversion setup. Some of the standard reports available are: 1. Delivery Label 2. Cover Letter 3. Payroll Register 4. Check Reconciliation 5. Payroll Tax Report 6. Input Worksheet Clients can elect a paperless payroll option in which they receive payroll reports and check stubs electronically. They may also choose to receive reports electronically, but have checks/vouchers available for delivery or pick up. If the client elects to electronically receive the payroll reports the transmission of that information is handled by the Evolution software and is sent automatically via when the payroll is processed. PayData configures Evolution for the electronic delivery of clients payroll reports during the new client implementation process or at the client s request. The client specifies the addresses to which the information is sent. Only direct deposit vouchers are sent electronically; all live checks are automatically printed. To enhance security, confidential information, such as Social Security Numbers and bank accounts are masked and not included on the electronic version of the reports. If the client wishes, the reports can be sent in a PDF format. Regardless of which option the client chooses, the reports are password protected. For those clients preferring to receive physical reports, once the payroll has been processed the reports and checks are printed. Once the payroll has been processed, the reports and checks are printed. Delivery instructions print as each payroll processes. All checks are counted and the count compared to the total checks on the Payroll Cover Letter report. The payroll is then packaged according to 14

17 PAYDATA PAYROLL SERVICES, INC. SECTION III. DESCRIPTION OF SYSTEM PROVIDED BY PAYDATA instructions from the client and ready for distribution via pickup, mail, Federal Express or courier service. A Security Seal sticker is applied to the package when complete. The Processing Department is also responsible for confirming that outside delivery services have retrieved all packages and for communication as to special delivery and tracking of packages. Payrolls which have been processed but not delivered by the end of the day are stored in a secure location. Clients sign for payrolls which are delivered via courier, Federal Express or if they pick them up from PayData s office. Tax Payments and Compliance PayData has a full service tax-filing department that generates agency approved federal, state and local tax returns and payments. Formalized procedures are followed to ensure the appropriate tax filings are complete, accurate and timely. Payments for Federal, State and Local taxes are remitted electronically for many agencies supporting electronic funds transfer. Checklists are prepared by tax type and client and utilized to ensure that all monthly, quarterly and annual tax returns are filed, even if no payments were made. In addition, the Tax Specialists keep a spreadsheet of clients who require zero returns to be filed. The following reports are created by the tax staff to manage the tax payments and returns: Due Date Report (Federal, State and local) is generated each day for tax liabilities that are due within a specified date range which corresponds to the current days federal deposit period. In addition a separate 100k Due Date Report is run to ensure that all accelerated deposits are accounted for. The Tax Specialist completes a Deposit Check List that summarizes the various payment methods and reconciles any differences, such as clients that are on hold or negative payment amounts that are included on the Due Date Report but are not remitted to the taxing agency. The report is utilized to select clients to include in the EFTPS file and submitted electronically. The Tax Specialist will compare the totals of the EFTPS file with the Due Date Report to ensure that the file is complete and accurate. The Tax Specialist will use the EFTPS software to confirm the receipt of the submitted payments and then export that data and import it into Evolution to update the database and indicate the payments were made. The next day, the EFTPS software is reviewed to confirm that the funds submitted the previous day settled. The report is also utilized to select clients to generate an ACH file or checks to send to the appropriate taxing agency for state and local taxes. The Tax Specialist will print the checks and then compare each check to the Due Date Report to ensure that all the required tax payments have been submitted. The amounts on the tax checks and the return or coupon are verified and then packaged and mailed to the appropriate taxing agency. This report also reflects the taxes which need to be paid electronically to the state and local agencies. The totals for the ACH file created for the electronic payments are compared to the Due Date Report to ensure that all payments are timely and correctly paid. Balancing Report - Weekly shows the difference in the taxes calculated and taxes collected for each client, any differences are researched and resolved by the Tax Manager as necessary. 15

18 PAYDATA PAYROLL SERVICES, INC. SECTION III. DESCRIPTION OF SYSTEM PROVIDED BY PAYDATA The above reports are reviewed by the Tax Specialist and appropriate action taken according to the data on the reports. The Deposit Check List with backup documentation is given to the Tax Manager daily for audit of the daily tax payments. The quarterly and annual return process has several phases to ensure the accuracy, completeness and timeliness of the returns using the following procedures: A master quarterly control is created to ensure all quarterly processes are completed. Checklists are prepared by tax type and client. The lists are utilized to ensure that all monthly, quarterly and annual tax returns are filed, even if no payments were made. Quarterly all companies are subjected to a preprocess function, which tests all tax liabilities against calculated taxes for the quarter. A payroll is automatically created in the system to correct for these discrepancies such as over/under collection of state unemployment insurance (SUI) resulting from a rate change and Vermont HealthCare Assessments due quarterly. Quarterly and annual returns are created and are subjected to a review process to ensure the accuracy of the returns. Delivery envelopes are created for each taxing agency and the returns sent to the taxing agency are compared to checklist to ensure all returns are properly submitted. For returns sent electronically, the clients contained in the file are also compared to the checklist. PayData contracts the maintenance of the source code and tax tables in the Evolution system to isystems, however updates to the source code or tax tables are reviewed prior to implementation, see further discussion in the Software Change Management section. PayData maintains memberships in a payroll industry trade association that keeps their members up to date on tax related issues. PayData will notify isystems of any changes received from external sources that are not reflected in the documentation sent with their latest software update. In addition, PayData utilizes BNA, which provides a library of research information related to payroll and taxation and CCH/Intelliconnect for tax research. ACH Processing Automated Clearing House (ACH) files are created twice a day (once on Friday); one at approximately 3pm and the second one at the end of each day to capture all remaining payroll processing. The ACH files collect billing, taxes, direct deposit and net check \trust account funds (as applicable based on service offering) from each client that has processed that day. PayData and its clients contract with Cachet Banq, Inc. (Cachet Banq) to perform the preparation and transmission of ACH entries, subject to the National Automated Clearing House Association (NACHA) rules. During the new client implementation process, all clients must sign an Employer Electronic Debit Agreement which authorizes PayData to electronically debit the client s bank account(s) for payroll transactions. PayData has also designed an Employee Direct Deposit Authorization form for the use of its clients employees. The form gives authorization for the deposit of credit transactions to accounts listed on the form. It also gives permission to withdraw any credits mistakenly sent by debiting the same 16

19 PAYDATA PAYROLL SERVICES, INC. SECTION III. DESCRIPTION OF SYSTEM PROVIDED BY PAYDATA account. Clients are advised to retain copies of these forms in the employee s personnel file and fax or copies to PayData. Clients are instructed to receive voided checks from the employee to verify the transit and account number of the account receiving the payroll funds. If the client is a Remote Input client, they are trained as to the proper setup of the direct deposit accounts. The Processing Department uses the Cash Management module in Evolution to generate the ACH file. The Processing Department selects all companies that are reflected on the queue at the time of ACH creation. The Processing Department logs into Cachet Banq s secure website using a unique user ID and password to upload the ACH file. The website displays a confirmation page with control totals for verification by the Processing Department with the detail ACH Transaction Report. Once all procedures for submitting an ACH file to Cachet Banq are completed, the Processing Department logs the ACH file and totals on the ACH Total Excel file. Once Cachet Banq has processed the file, they send an confirmation to PayData, which is reviewed by the Vice President or Operations for verification and is documented in the ACH Total Excel file. Cachet Banq then warehouses and sends the NACHA transmission to the appropriate banks on the clients behalf. Cachet Banq also generates a daily Returns and Notifications of Changes report. The information is accessed through Cachet Banq s secure website daily. Pre-note direct deposit changes are distributed to the assigned Client Service Representatives to contact the client and correct the information. The Client Service Representatives contacts the client if any employee monies are returned. The returns may be caused by an employee closing an account and failing to notify the payroll contact or by invalid routing or account numbers. A member of the Accounting Department contacts the client when a notification of a return due to insufficient funds is received. Depending on the dollar amount of the return, the debit is either resubmitted or the client is instructed to wire the funds. The tax liabilities are marked NSF until PayData has received the funds. Finance and Administration All payroll transaction funds are collected via Automated Clearing House (ACH). Separate withdrawals are sent to collect billing, tax, direct deposit and netcheck\trust funds from the client. Billing transactions post to PayData s operation account. The direct deposit funds are maintained in an account held by Cachet Banq and all the reconciliation process is performed by Cachet Banq, PayData does not have control of those funds. The Daily Funds Reconciliation Report is automatically run each night and then reviewed the next morning by the Accounting Manager for any exceptions from the previous day s payroll processing and ACH files. This report compares the payroll amounts transmitted in the banking file for the previous day to the transactions posted in the bank account register for each client, any exceptions are reviewed for appropriateness and resolved in a timely manner. Transactions for the ACH account are reconciled by Cachet Banq. For clients that choose to be a full service tax client, funds are impounded for taxes withheld and employer taxes collected each pay period and are held in escrow in a separate tax account until they are due. Transactions are downloaded daily from the bank and imported into Evolution to facilitate the 17

20 PAYDATA PAYROLL SERVICES, INC. SECTION III. DESCRIPTION OF SYSTEM PROVIDED BY PAYDATA reconciliation process. An exception report is printed showing any discrepancy and researched. Any items not automatically cleared are matched up manually or by manual entry. Another option for clients is the netcheck\trust account services. Clients who utilize this service are debited for the full amount of net payroll and then the individual net payroll checks are drawn on PayData s trust account. The NetCheck\Trust account is a separate Positive Pay bank account. Transactions are downloaded daily from the bank and imported into Evolution to facilitate the reconciliation process At the end of each day the Processing Department creates a Positive Pay file containing Payee, Amount, Serial Number, and Check date and uploads this file to the bank. Each item that is presented on the trust account is validated by the bank to the daily Positive Pay files. PayData is notified of any exceptions at which time they can Approve or Deny the item. Formalized procedures are used to reconcile the bank accounts. All bank accounts are reconciled to the bank balance monthly by the Accounting Manager. Various audits are performed to validate that all tax, billing and client funds have been collected and paid accurately. The Vice President of Operations reviews the bank reconciliations tie-outs on a monthly basis. In addition, the Accounting Manager reconciles the total tax liabilities in Evolution to the tax impound bank account balance on a monthly basis. Information Technology and Systems Security PayData provides technological solutions to its clients and understands the critical and sensitive nature of the data transmitted on a daily basis. Physical access to computer equipment and storage media is restricted to properly authorized individuals. Current technology is employed to ensure that data is secure and that appropriate access to information is given only to authorized users. Access to the Evolution payroll software is restricted based on job function. isystems IT Department implements the Evolution updates, but the process is coordinated by the Vice President of Operations. The network and operating system updates are also outsourced to isystems IT Department which functions as PayData s IT Department. The President and Vice President of Operations oversee the services provided by isystems IT Department. Procedures are in place to review, test, approve and properly implement the software vendor supplied changes to existing software. PayData is a payroll service bureau. As such, the critical computer related tasks consist of the following: collecting and processing client company payroll data creating electronic banking transactions to: collect funds from client company accounts make direct deposit payments into client employee accounts make payments to federal, state and local tax collection agencies make payments to designated third parties, including PayData print checks and direct deposit vouchers print and/or reports 18