Department of Labor, Licensing and Regulation Division of Unemployment Insurance Division of Workforce Development

Transcription

1 Audit Report Department of Labor, Licensing and Regulation Division of Unemployment Insurance Division of Workforce Development April 2006 OFFICE OF LEGISLATIVE AUDITS DEPARTMENT OF LEGISLATIVE SERVICES MARYLAND GENERAL ASSEMBLY

2 This report and any related follow-up correspondence are available to the public through the Office of Legislative Audits at 301West Preston Street, Room 1202, Baltimore, Maryland The Office may be contacted by telephone at , , or Electronic copies of our audit reports can be viewed or downloaded from our website at Alternative formats may be requested through the Maryland Relay Service at The Department of Legislative Services Office of the Executive Director, 90 State Circle, Annapolis, Maryland can also assist you in obtaining copies of our reports and related correspondence. The Department may be contacted by telephone at or

3 April 25, 2006 Senator Nathaniel J. McFadden, Co-Chair, Joint Audit Committee Delegate Charles E. Barkley, Co-Chair, Joint Audit Committee Members of Joint Audit Committee Annapolis, Maryland Ladies and Gentlemen: We have audited the Department of Labor, Licensing and Regulation Division of Unemployment Insurance (DUI) and Division of Workforce Development (DWD) for the period beginning February 1, 2002 and ending July 31, Our audit disclosed that DUI frequently did not use certain collection options to recover delinquent unemployment insurance benefit overpayments, such as wage garnishments or referral of delinquent accounts to the Department of Budget and Management s Central Collection Unit. Additionally, DUI did not always properly investigate potential overpayments of unemployment insurance benefits identified through automated matches, and certain adjustments to accounts receivable were not properly controlled, including those that reduced benefit overpayment accounts. Benefit overpayment accounts receivable totaled approximately $76 million as of June 30, 2005, approximately $63 million of which was at least one year old. We also noted that DUI did not sufficiently control and restrict access to critical applications within its information systems using available security features. Finally, internal control deficiencies were noted with regard to certain refund checks, reimbursable employer accounts, and employer reported wage data. Respectfully submitted, Bruce A. Myers, CPA Legislative Auditor

4 2

5 Table of Contents Executive Summary 5 Background Information 7 Agency Responsibilities 7 Organizational Change 7 Current Status of Findings From Preceding Audit Report 7 Findings and Recommendations 9 Unemployment Insurance Benefit Overpayments * Finding 1 DUI Frequently Did Not Use Certain Collection Options to 9 Recover Delinquent Benefit Overpayments Finding 2 Potential Overpayments of Benefits Identified Through an 10 Automated Match Were Not Always Properly Investigated Finding 3 Certain Adjustments That Reduced Accounts Receivable 11 Were Not Subject to Supervisory Review and Approval Unemployment Insurance Contribution Refunds Finding 4 Internal Control Over the Issuance of Manual Refund Checks 12 Was Inadequate Reimbursable Employers Finding 5 Adequate Control Was Not Established Over Non-Cash Credit 13 Adjustments Posted to Reimbursable Employer Accounts Finding 6 Internal Control Over an Escrow Checking Account Was 14 Inadequate Information Systems Security and Control Finding 7 Security Review Processes and Related Security Reporting 15 Were Inadequate Finding 8 Modification Access to Critical Production Data Files Was 16 Not Properly Restricted * Denotes item repeated in full or part from preceding audit report 3

6 Employer Reported Wage Data Finding 9 Actions Taken to Investigate and Resolve Discrepancies in 16 Employer Reported Wage Data Were Not Documented Audit Scope, Objectives, and Methodology 19 Agency Response Appendix 4

7 Executive Summary Legislative Audit Report on Department of Labor, Licensing and Regulation (DLLR) Division of Unemployment Insurance (DUI) and Division of Workforce Development (DWD) April 2006 DUI frequently did not use certain collection options in pursuing collection of delinquent unemployment insurance benefit overpayments. DUI should take appropriate action to collect delinquent unemployment insurance benefit overpayments, such as initiating civil wage garnishments or referring accounts to the Department of Budget and Management s Central Collection Unit in a timely manner. DUI did not always take the necessary action to obtain wage information from employers that was needed to investigate potential unemployment insurance benefit overpayments. Additionally, investigations were not always initiated timely once the wage information was obtained. DUI should consider various alternatives for increasing the employer response rate to requests for wage information needed to investigate potential benefit overpayments, and initiate related investigations in a timely manner. DUI did not sufficiently control and restrict access to critical applications within its information systems using available security features. DUI should use available security features to restrict access to critical applications to only those users that need such access to perform their normal job duties. Internal control and recordkeeping deficiencies were noted with respect to benefit overpayment accounts receivable, employer contribution refunds, reimbursable employer accounts, and employer reported wage data. DUI should take the recommended actions to improve controls in these areas. 5

8 6

9 Agency Responsibilities Background Information The Division of Unemployment Insurance (DUI) and the Division of Workforce Development (DWD) are separate budgetary units within the Department of Labor, Licensing and Regulation. DUI administers the State s Unemployment Insurance Program that is funded by unemployment tax contributions collected from employers. DWD administers various employment and training activities that are primarily funded by the aforementioned unemployment tax contributions and the Federal government. Both Divisions headquarters are located in Baltimore City and DWD has 38 local offices throughout the State. According to DUI records, during fiscal year 2005, unemployment tax contributions collected from employers totaled approximately $516 million, and unemployment insurance benefits paid to claimants totaled approximately $376 million. In addition, according to the State s records, fiscal year 2005 operating expenditures for DUI and DWD totaled approximately $59.7 million and $53.9 million, respectively. Organizational Change Chapter 429, Laws of Maryland 2004, effective July 1, 2004, split the former Division of Employment and Training (DET) into the Division of Unemployment Insurance and the Division of Workforce Development. The activities of DET from February 1, 2002 to June 30, 2004 and of the new Divisions from July 1, 2004 to July 31, 2005 are included within the scope of this audit. Current Status of Findings From Preceding Audit Report We reviewed the current status of the four findings included in our preceding audit report on the Division of Employment and Training dated November 6, We determined that three of these findings had been satisfactorily addressed. The remaining finding is repeated in this report. 7

10 8

11 Findings and Recommendations Unemployment Insurance Benefit Overpayments Background State law allows DUI to recover benefits paid to claimants who are subsequently found to be ineligible, and to assess interest at 1.5 percent per month on overpayments made to claimants who either made a false statement or failed to disclose a material fact in order to obtain the benefits. According to DUI records, accounts receivable relating to unemployment insurance benefit overpayments totaled approximately $76 million as of June 30, 2005, of which approximately $63 million were at least one year old. Collections relating to benefit overpayments totaled approximately $11.9 million during fiscal year Finding 1 DUI frequently did not use certain collection options to recover delinquent unemployment insurance benefit overpayments. Analysis For accounts selected for testing, DUI did not use certain available collection options to recover delinquent unemployment insurance benefit overpayments. Specifically, DUI generally conducted certain collection activities, such as periodic billings and certifying accounts as eligible for the Tax Refund Intercept Program. However, other collection efforts, such as initiating wage garnishments or referring delinquent accounts to the Department of Budget and Management s Central Collection Unit (CCU) were not always pursued. Our test of 15 delinquent overpayment accounts, totaling approximately $143,000, disclosed that, for 8 of these accounts with balances totaling approximately $75,000, wage garnishments could have been initiated but were not. These 8 claimants had earned wages totaling approximately $215,000 during fiscal year 2005 and had no pending legal issues that would preclude wage garnishment. Additionally, 11 of these 15 accounts (totaling approximately $104,000) had not been referred to CCU although DUI had not received any payments on these 11 accounts for periods ranging from five months to over two years as of November 30, The lack of timely referral of delinquent overpayment accounts to CCU was commented upon in our two preceding audit reports. DUI collection policy requires that a civil wage garnishment be initiated for claimants with sufficient wages ($2,500 or more per quarter) and no pending legal issues. The policy further states that, in the absence of sufficient wages, claimants 9

12 with no pending legal issues be considered for referral to CCU when the overpayment is 90 days past due. In this regard, while DUI is exempt from CCU regulations requiring the referral of delinquent accounts within a specified time period, it has received the required approval to forward unemployment insurance benefit overpayments to CCU for collection assistance. Recommendation 1 We recommend that DUI use available collection options to pursue delinquent unemployment insurance benefit overpayment accounts. Specifically, as required by the aforementioned collection policy, we recommend that civil wage garnishments be initiated in cases where the claimant has sufficient wages and no pending legal issues. Furthermore, we again recommend that applicable accounts be referred to the CCU in a timely manner. Finding 2 Potential unemployment insurance benefit overpayments identified by an automated match were not always adequately investigated. Analysis DUI did not always adequately investigate potential overpayments of unemployment insurance benefits identified by quarterly automated matches of employee wage data and unemployment insurance benefit payments. Specifically, to investigate potential overpayments identified by the automated matches, DUI sent wage request forms to employers to determine if the claimant earned wages during the same period that they received benefit payments. Although DUI generally sent second wage request forms to employers that did not initially respond, no further action was taken by DUI to obtain the required wage information. According to DUI records, employers responded to only 3,300 of 5,004 requests for wage information (66 percent) made by DUI relating to potential benefit overpayments identified during calendar year Additionally, we tested ten cases identified by the automated match conducted for the fourth quarter of calendar year 2004 where wage information provided by employers indicated that further investigation was warranted. However, in nine of these ten cases, investigations were not initiated for periods ranging from 66 to 158 days after DUI had received the wage information. Due to the failure to obtain wage data or to perform timely follow-up for those cases for which wage data were provided, DUI may have been precluded from recovering benefit overpayments from a significant number of claimants. 10

13 We were advised by DUI that it did not have the authority, such as by imposing a penalty, to force employers to respond to the wage requests. In this regard, Code of Maryland Regulations (COMAR) permit DUI to assess monetary penalties against employers that fail to provide certain other required information (such as employment separation notices). However, a similar provision for failure to provide wage information does not currently exist in COMAR. Recommendation 2 We recommend that DUI consider various alternatives for increasing the employer response rate to requests for wage information needed to investigate potential overpayments of unemployment insurance benefits identified by the automated matches. For example, DUI should consider enacting regulations that would provide for monetary penalties against employers that fail to provide timely responses to requests for wage information. Additionally, we recommend that DUI initiate investigations of potential overpayments of unemployment insurance benefits timely (for example, within 60 days of receipt of wage information from employers). Finding 3 Certain adjustments made to claimant data that resulted in reductions to benefit overpayment accounts receivable were not subject to supervisory review and approval. Analysis Certain adjustments to claimant data recorded in the Maryland Automated Benefits System (MABS) that resulted in a reduction of unemployment insurance benefit overpayment accounts receivable were not subject to supervisory review and approval. Specifically, claims center employees routinely recorded adjustments to claimant data (such as earned wages and reason for separation from employment) in MABS, which then automatically recalculated the amount of any benefit overpayments and adjusted the related accounts receivable balances. However, DUI did not generate output reports of the adjustments recorded by the claims center employees which could be used by supervisory personnel to verify the propriety of the adjustments. Consequently, unauthorized adjustments to claimant data, and subsequently to benefit overpayment accounts receivable, could be made without detection. Recommendation 3 We recommend that DUI generate output reports of adjustments recorded in MABS that result in a reduction of unemployment insurance benefit overpayment accounts receivable. We further recommend that such adjustments be reviewed and approved by supervisory personnel, at least on a test basis, and that such reviews be documented and retained for future reference. 11

14 Unemployment Insurance Contribution Refunds Finding 4 Internal controls over the issuance of manual contribution refund checks were inadequate. Analysis Internal controls over manual contribution refund checks issued from the benefits checking account were inadequate. Specifically, five employees with unrestricted access to the blank check paper stock also had the ability to initiate manual refund checks and print them with the required authorized signatures. Additionally, one of these employees was responsible for transferring funds to the benefits checking account to cover the refund checks written. As a result of these control weaknesses, unauthorized checks could be prepared without detection. According to DUI records, 968 manual refund checks totaling approximately $1.5 million were processed during fiscal year 2005, and as of June 30, 2005, the benefits checking account balance totaled approximately $1.7 million. Refund checks are generated when employers have overpaid their periodic unemployment insurance tax liability, such as due to using an incorrect contribution rate. Recommendation 4 We recommend that DUI establish controls to ensure that employees do not have the capability to both initiate and print manual refund checks. Furthermore, we recommend that access to blank check paper stock be limited to only those employees responsible for printing the checks. We advised DUI on accomplishing the necessary separation of duties using existing personnel. Reimbursable Employers Background State law provides that certain not-for-profit organizations, such as charitable organizations, may elect to be classified as reimbursable employers. These organizations are exempt from paying quarterly unemployment insurance taxes, but are required to reimburse DUI for unemployment insurance benefits paid by DUI to former employees of the organizations. State law further requires reimbursable employers to provide DUI with collateral in the event the employers default on reimbursement of claims paid to their former employees. According to DUI records, during fiscal year 2005, DUI billings to reimbursable employers 12

15 totaled approximately $47.6 million and, as of December 31, 2005, collateral pledged by employers totaled approximately $116.9 million, including approximately $1.3 million in cash deposits held in an escrow account. Finding 5 Controls over recording non-cash credit adjustments to reimbursable employer accounts were inadequate. Analysis Adequate internal control had not been established over non-cash credit adjustments recorded in the reimbursable employer accounts receivable records. Specifically, two employees responsible for recording non-cash credit adjustments also generated billing notices to reimbursable employers. Additionally, 12 other employees had the capability to record non-cash credit adjustments to reimbursable employer accounts even though this capability was not required for them to perform their normal job duties. One of these 12 employees initially received collections from reimbursable employers totaling approximately $6 million during fiscal year Furthermore, although monthly output reports of non-cash credit adjustments recorded in the accounts receivable records were generated, these reports were generally not reviewed by supervisory personnel. As a result of these control weaknesses, unauthorized non-cash credit adjustments to reimbursable employers account receivable records could be recorded without detection. According to DUI records, non-cash credits totaled approximately $250,000 during fiscal year Recommendation 5 We recommend that the ability to record non-cash credit adjustments in the reimbursable employer accounts receivable records be limited to employees whose normal job duties require such capability and who are not responsible for the related billing and cash receipt processes. Additionally, we recommend that non-cash credit adjustments reflected on the monthly output reports be verified to appropriate supporting documentation, at least on a test basis, by an employee independent of the adjustment recording process and that such verifications be documented. We advised DUI on accomplishing the necessary separation of duties using existing personnel. 13

16 Finding 6 Controls over the escrow checking account used to hold cash collateral pledged by reimbursable employers were inadequate. Analysis Internal controls over the reimbursable employers cash collateral held in an escrow checking account were inadequate. Specifically, three employees had unrestricted access to both the blank checks and the related check signature stamp containing the authorizing signatures of the State Treasurer and a DUI management employee. One of these three employees also prepared the monthly bank reconciliations. Additionally, four other employees had unrestricted access to the blank checks even though their job responsibilities did not require such access. As a result of these deficiencies, unauthorized disbursements could be made from the escrow checking account without detection. According to its records, DUI made 20 payments from the escrow checking account totaling approximately $133,000 during fiscal year Such payments represented the return of collateral, which had been received in lieu of periodic payments of unemployment compensation tax, to certain reimbursable employers. Recommendation 6 We recommend that employees with access to blank checks not have access to the signature stamp, and that access to blank checks be restricted to only those employees who require such access. Additionally, we recommend that the signature stamp be modified to contain only the signature of the State Treasurer, and that checks be manually countersigned by an authorized DUI check signer after reviewing documentation supporting the checks. Information Systems Security and Control Background DUI manages the development, maintenance, and support of the DUI business information systems. One system, the Unemployment Insurance Tax System (UITS), is used to process employers unemployment insurance taxes owed and paid and a second system, the Maryland Automated Benefit System (MABS), tracks payments to and amounts due from claimants. The DUI applications for these two systems operate on the Comptroller of the Treasury s Annapolis Data Center (ADC), with security software used as the primary means to protect the 14

17 applications, online transactions, and related data. Although there are various server subsystems involved in some DUI processing and data entry, our review was principally limited to the mainframe systems. Finding 7 Security review processes and related security reporting were inadequate. Analysis Security review processes and related security reporting were inadequate. Specifically, we noted the following conditions: The security reports of changes made to critical production data files were not properly reviewed and investigated. Although a cursory review was performed, an adequate review and investigation of logged activity to critical data files was generally not performed. Accordingly, improper changes made to critical production data files might not be detected. The employee responsible for processing security file access rules initially received and processed the related security rule change reports prior to their submission for an independent review and approval. In addition, the independent review of these rule changes reports was inadequate since it was limited to verification of approval by the aforementioned employee. Consequently, this employee could make improper data file access rule changes without being detected. The employees responsible for the maintenance of security access had improper modification access to a critical data file which held the daily security reports. As a result, these employees had the ability to conceal any unauthorized activity (for example, rule modification, production data file modification) by changing the report prior to its being printed. Recommendation 7 We recommend that procedures be established to provide adequate controls over the information technology security reviews, reports and data files. We made detailed recommendations which, if implemented, should provide for the necessary controls. 15

18 Finding 8 Modification access to critical production data files was not properly restricted. Analysis Access to DUI production data files was not properly restricted. Specifically, 15 individuals had unnecessary direct, logged modification access to critical MABS and UITS production data files. Such direct access was not required by these individuals for their job responsibilities. Improper, direct, modification access to these data files could result in the disruption of MABS payments or the improper modification of UITS unemployment tax contributions data. Recommendation 8 We recommend that DUI restrict access to critical production data files only to users who require such access. Employer Reported Wage Data Finding 9 DUI did not document the actions taken to investigate and resolve differences between employer reported wage data recorded in UITS and corresponding data recorded in the MABS. Analysis DUI did not document actions taken to investigate and resolve differences between the employer reported wage data recorded in UITS and the corresponding data recorded in the MABS. Specifically, an automated comparison of wage data contained in UITS and MABS was performed quarterly. Although we were advised by DUI management personnel that material differences identified as a result of this comparison were investigated, documentation was not maintained indicating which differences, if any, were investigated and how the differences were resolved. Our test of employee wages reported by five employers for calendar year 2004 disclosed that for two employers, total wages recorded in UITS significantly differed from the total wages recorded in MABS, and DUI management personnel were unable to explain the cause of the difference. For example, one employer s total wages reported in UITS ($379.3 million) exceeded the corresponding total wages reported in MABS ($153.3 million) by $226 million. 16

19 Employee wage data provided by employers are recorded in UITS and MABS via an automated imaging system. Wage data in UITS is used to help track employer contribution information and calculate related contribution rates, and wages contained in MABS are used to verify eligibility for unemployment benefits. This wage data is also used by other State agencies (for example, the Department of Human Resources) to determine eligibility for various entitlement and benefit programs. Consequently, inaccuracies in employee wage data in these systems could result in employer contributions being improperly calculated, or in unemployment benefits or other benefits being improperly paid or denied. Recommendation 9 We recommend that DUI ensure the accuracy of the UITS and MABS reported wage data, and investigate significant differences between the systems including the differences noted for the aforementioned two employers. We further recommend that investigative efforts be documented and retained for future reference. 17

20 18

21 Audit Scope, Objectives, and Methodology We have audited the Department of Labor, Licensing and Regulation Division of Unemployment Insurance and Division of Workforce Development (the Divisions) for the period beginning February 1, 2002 and ending July 31, The audit was conducted in accordance with generally accepted government auditing standards. As prescribed by the State Government Article, Section of the Annotated Code of Maryland, the objectives of this audit were to examine the Divisions financial transactions, records and internal control, and to evaluate its compliance with applicable State laws, rules, and regulations. We also determined the current status of the findings included in our preceding audit report on the Division of Employment and Training. In planning and conducting our audit, we focused on the major financial-related areas of operations based on assessments of materiality and risk. Our audit procedures included inquiries of appropriate personnel, inspections of documents and records, and observations of the Divisions operations. We also tested transactions and performed other auditing procedures that we considered necessary to achieve our objectives. Data provided in this report for background or informational purposes were deemed reasonable, but were not independently verified. Our audit did not include a review of certain support services provided to the Divisions by the Department of Labor, Licensing and Regulation Office of the Secretary. These support services (for example, payroll, purchasing, and maintenance of accounting records) are included within the scope of our audits of the Office of the Secretary. We did not audit the Divisions federal financial assistance programs for compliance with Federal laws and regulations because the State of Maryland engages an independent accounting firm to annually audit such programs administered by State agencies. The Divisions managements are responsible for establishing and maintaining effective internal control. Internal control is a process designed to provide reasonable assurance that objectives pertaining to the reliability of financial records, effectiveness and efficiency of operations including safeguarding of assets, and compliance with applicable laws, rules, and regulations are achieved. 19

22 Because of inherent limitations in internal control, errors or fraud may nevertheless occur and not be detected. Also, projections of any evaluation of internal control to future periods are subject to the risk that conditions may change or compliance with policies and procedures may deteriorate. Our reports are designed to assist the Maryland General Assembly in exercising its legislative oversight function and to provide constructive recommendations for improving State operations. As a result, our reports generally do not address activities we reviewed that are functioning properly. This report includes findings that we consider to be significant deficiencies in the design or operation of internal control that could adversely affect the Divisions ability to maintain reliable financial records, operate effectively and efficiently, and/or comply with applicable laws, rules, and regulations. This report also includes a finding regarding a significant instance of noncompliance with applicable laws, rules or regulations. Other less significant findings were communicated to the Divisions that did not warrant inclusion in this report. The Department of Labor, Licensing and Regulation Office of the Secretary s response, on behalf of the Divisions, to our findings and recommendations is included as an appendix to this report. As prescribed in the State Government Article, Section of the Annotated Code of Maryland, we will advise the Department regarding the results of our review of its response. 20

23

24 Department of Legislative Services Office of Legislative Audits Audit Report Department of Labor, Licensing & Regulation Division of Unemployment Insurance Division of Workforce Development Responses to Comments and Recommendations Finding 1 The Division of Unemployment Insurance (DUI) frequently did not use certain collection options to recover delinquent unemployment insurance benefit overpayments. Office of Legislative Audits (OLA) Recommendation: We recommend that DUI use available collection options to pursue delinquent unemployment insurance benefit overpayment accounts. Specifically, as required by the aforementioned collection policy, we recommend that civil wage garnishments be initiated in cases where the claimant has sufficient wages and no pending legal issues. Furthermore, we again recommend that applicable accounts be referred to the Central Collections Unit (CCU) in a timely manner. Department of Labor, Licensing and Regulation (DLLR) Response: DUI does not agree with the recommendation. We do not believe that all of the cases cited for lack of wage garnishment provides an accurate assessment of current our operations. In one case that was reviewed, DLLR did get a garnishment order but the claimant was already having wages garnished for another unrelated debt. Some of the other cases listed contain information documented by the audit that does not coincide with the Maryland Automated Benefits System (MABS) or the Benefit Payment Control (BPC) records. In addition, DUI has recently made some staff changes relative to the wage garnishment oversight duties. We believe our current procedures are both accurate and timely. DUI has also steadily increased its CCU referrals. Based on recommendations from previous audits, DUI has increased its referrals to CCU three-fold since Lack of staff is still our primary reason for not referring every case. It takes significantly more time to prepare a case for CCU than it does for us to pursue the case ourselves. We spend hundreds of hours every month, dealing with claimants who can t get CCU to respond to them and/or reconcile their accounts. Also, more importantly, CCU only collects about 10% of the outstanding monies we send them. Our unit averages over 50%. 1

25 Finding 2 - Potential unemployment insurance overpayments identified by an automated match were not always adequately investigated. OLA Recommendation: We recommend that DUI consider various alternatives for increasing the employer response rate to requests for wage information needed to investigate potential overpayments of unemployment insurance benefits identified by the automated matches. For example, DUI should consider enacting regulations that would provide for monetary penalties against employers that fail to provide timely responses to requests for wage information. Additionally, we recommend that DUI initiate investigations of potential overpayments of unemployment insurance benefits timely basis (for example, within 60 days of receipt of wage information from the employers). DLLR Response: DUI agrees with the recommendation. We currently specify a time frame, but it s done in order of priority. Hotline requests, other investigations, Report of Hire, have priority since they affect claimants currently filing. Post audits are after the fact - claimants are not in claim status. Again, the limited number of staff available to conduct these audits is the primary issue in our efforts to ensure that all cases are assigned immediately. During some quarters of the fiscal year, we receive hits on post audits. For those quarters with such high volume, we are not always able to assign all cases within 60 days (to 5 or 6 staff) and have all of the cases completed within 45 days. Finding 3 - Certain adjustments made to claimant data that resulted in reductions to benefit overpayment accounts receivable were not subject to supervisory review and approval. OLA Recommendation: We recommend that DUI generate output reports of adjustments recorded in MABS that result in a reduction of unemployment insurance benefit overpayment accounts receivable. We further recommend that such adjustments be reviewed and approved by supervisory personnel, at least on a test basis, and that such reviews be documented and retained for future reference. DLLR Response: DUI does not agree with the recommendation. There already is an audit trail on every claim. Any adjustments, accesses or determinations relative to each claim are tracked. Additionally, the United States Department of Labor mandates that DUI conducts an audit of a percentage of all claims that are paid. As part of each audit, we must look at every item that went in to the establishment and payment of that claim. Any discrepancy relative to downward adjustments in overpayments or inflation in payment amount would be detected. No issues relative to a..reduction of unemployment insurance benefit overpayment accounts receivable have been detected in the last 15 years of Federal audits. It should be noted 2

26 that DUI did use an overpayment established report until However, this report was discontinued based on recommendations of Federal auditors, largely because it was a massive report and could never be completely reviewed. Finding 4 - Internal controls over the issuance of manual refund checks were inadequate. OLA Recommendation: We recommend that DUI establish controls to ensure that employees do not have the capability to both initiate and print manual refund checks. Furthermore, we recommend that access to blank check paper stock be limited to only those employees responsible for printing the checks. We advised DUI on accomplishing the necessary separation of duties using existing personnel. DLLR Response: DUI agrees with the recommendation. The following procedures are now in effect for manually printing checks for both employers and claimants: 1. Two employees from the Cashiers Unit enter check information into the DUI Tax Network Application Program. These two individuals cannot print checks. 2. Another Cashiers Unit employee will print checks through the network application. 3. The Cashiers Unit Supervisor, or an alternate, will verify checks produced to the warrant, and approve the checks for distribution. 4. The Chief of Accounting and Fund Maintenance or the Supervisor of the Cashier s Unit will then send the check issues to the Benefit Account with the bank. 5. The DUI Tax network application has also been modified to display the check number, dollar amount, date, payee, warrant number as well as the creator and printer of each check. Finding 5 - Controls over the recording of non-cash credit adjustments to reimbursable employer accounts were inadequate. OLA Recommendation: We recommend that the ability to record non-cash credit adjustments in the reimbursable employer accounts receivable records be limited to employees whose normal job duties require such capability and who are responsible for the related billing and cash receipt processes. Additionally, we recommend that non-cash credit adjustments reflected on the monthly output reports be verified to appropriate supporting documentation, at least on a test basis, by an employee independent of the adjustment recording process and that such verifications be documented. We advised DUI on accomplishing the necessary separation of duties using existing personnel. 3

27 DLLR Response: DUI agrees with the recommendation. DUI has rescinded the ability to record non-cash credit adjustments from all but three employees within the Reimbursable Employer Unit. These three employees do not prepare the billings or process cash receipts. Also, beginning with the non-cash adjustments for December 2005, the DUI Tax Internal Auditor has reviewed all noncash adjustments, and determined that they were documented and accurate. This review procedure is now performed monthly. Finding 6 - Controls over the escrow checking account used to hold cash collateral pledged by reimbursable employers were inadequate. OLA Recommendation: We recommend that employees with access to blank checks not have access to the signature stamp, and that access to blank checks be restricted to only those employees who require such access. Additionally, we recommend that the signature stamp be modified to contain only the signature of the State Treasurer, and that checks be manually countersigned by an authorized DUI check signer after reviewing documentation supporting the checks. DLLR Response: DUI agrees with the recommendation. DUI will obtain a separate file cabinet for storage of the blank checks for the UI Escrow Account. Access to this cabinet will be restricted to Cashiers Office employees and DUI Tax management personnel who require such access. Also, DUI will use a new signature stamp with only the State Treasurer s signature. Those individuals with signatory authority shall not have access to the blank checks. Future checks drawn on the Escrow Account will be countersigned by authorized DUI personnel after a review of supporting documentation. Finding 7 - Security review processes and related security reporting were inadequate. OLA Recommendation: We recommend that procedures be established to provide adequate controls over the information technology security reviews, reports and data files. We made detailed recommendations which, if implemented, should provide for the necessary controls. DLLR Response: The Office of Information Technology (OIT) agrees with the finding. OIT shall now provide access to the production dataset access security logs to the UI Security coordinator for review, investigative follow-up and documentation. The daily security log will be kept for 60 days. The procedure detailing the reports to be reviewed has been changed to state the reports for rule and LOGONID change must be reviewed against the printout of the action done and the 4

28 ACF2 form authorizing the action by both the Primary and Alternate OIT Security Officers. In the absence of either one, the section manager must review the reports. The ACF2 dataset rules for the Security Report file have been modified to remove the security officer s ability to modify the dataset containing the daily ACF2 security reports. Finding 8 - Modification access to critical production data files was not properly restricted. OLA Recommendation: We recommend that DUI restrict access to critical production data files only to users who require such access. DLLR Response: OIT agrees with the finding. All logged modification access to critical MABS and UITAX production files was implemented upon proper authorization by the UI Division Coordinator as request by owner of data. Upon review of audit findings, ACF2 rules were written to restrict the 16 log-on-ids (OIT) identified by the audit from having logged WRITE/ALLOC access to the identified critical files. All additional log-on-id (user) logged modification access to critical MABS and UITAX files (identified by the audit) have been brought to the attention of the owners (UITAX and MABS supervisory personnel) and were reviewed to determine if those log-on-ids still having access are required. The required rule changes have been completed. Finding 9 - DUI did not document the actions taken to investigate and resolve differences between employer reported wage data recorded in UITS and corresponding data recorded in MABS. OLA Recommendation: We recommend that DUI ensure the accuracy of the UITS and MABS reported wage data, and investigate significant differences between the systems including the differences noted for the aforementioned two employers. We further recommend that investigative efforts be documented and retained for future reference. DLLR Response: DUI agrees with this recommendation. DUI Contributions staff have already investigated and explained the differences, in the two cases cited, that exceeded $500,000 for total wages in the TAS and MABS systems. These differences were caused by a restriction on the size of the data field for wage records in MABS. Some employees of the two employer accounts exceeded $9,999,999 for the calendar quarter in question. The MABS wage record file cannot store wages greater than this figure. For wage records reported on tape, the limit was $9, (Note: this shall be expanded to $9,999,999.) When this was detected and investigated by the Wage Records Unit, the wages were changed to $9,999,999. This change 5

29 does not affect the employee weekly benefit amount if a claim for benefits is made in the future. Also, because this restriction did not exist in TAS, both employers reported the correct amount of total and taxable wages on the Contribution Summary Report. Most importantly, it must be noted that all benefits were properly calculated and all taxes were properly paid for both accounts. Beginning in the first quarter of 2005, DUI has taken the following steps to investigate and document these differences. All large employer wage record files that are received via tape, diskette, or the E-Wage application are reviewed to determine if there is a difference of 5% or more between the TAS and MABS records. If these differences cannot be explained by an internal review, the employer is sent a letter requesting a corrected wage detail report. The report is due within 7 days of the date of the letter. All results of the internal investigation have been documented on the MABS notepad. All adjustments to wages on the TAS and MABS system are documented. The MABS system audits every R01 (Add Wage), R02 (Change Wage), and R05 (Add/Delete multiple SS# s) transactions. All wage adjustments are noted on the G-14 (employer notepad) in case wages added affect a UI claim in MABS. DUI will take the following additional steps to monitor wage adjustments: 1. An IT request will be made to produce a weekly report of wage adjustments (R01, R02 or R05) that increase the WBA of a current or prior UI claim; 2. This report will be reviewed by a Wage Record supervisor, dated, signed and retained for three years; 3. Discrepancies detected will be investigated by a Wage Record supervisor, and, if necessary, referred to Internal Security. 6

30 AUDIT TEAM Mark A. Ermer, CPA Audit Manager A. Jerome Sokol, CPA Information Systems Audit Manager Jonathan H. Finglass, CPA Senior Auditor Omar A. Gonzalez, CPA Information Systems Senior Auditor Kelly A. Hammond, CPA Jay C. Striby Staff Auditors Alicia N. Dennis Staff Auditor Intern