Audit Report County Controller John T. Schimmel, P.A. CENTRALIZED PAYROLL PROCESSING As of August 2002 Audit Manager Frank S. Kedl, CIA Solicitor David J. Ceraul, Esq. County Executive Glenn F. Reibman County Council J. Michael Dowd, President Margaret Ferraro, Vice-President Ron Angle Michael F. Corriere, Esq. Mary Ensslin Wayne A. Grube Ann McHale Timothy B. Merwarth Nick R. Sabatine, Esq. Office of the Controller County of Northampton Pennsylvania
March 17, 2003 Members of the Northampton County Council Glenn F. Reibman, County Executive County of Northampton, Pennsylvania We have completed an audit of Centralized Payroll Processing as of August 2002. The Executive Summary on page 1 summarizes the audit results and identifies opportunities for improvement, while the Audit Results section provides a detailed explanation. We acknowledge the cooperation and assistance we received from the Payroll, Information Services and Human Resources Departments. Their help was essential to the performance of this audit. Our report was discussed with management at our exit conference on January 23, 2003. Management s response is included in the detailed audit report. Very truly yours, John T. Schimmel, PA County Controller Lynn Dicker, CPA, CIA Lead Auditor
Table of Contents PAGE EXECUTIVE SUMMARY - OPPORTUNITIES FOR IMPROVEMENT... 1 Section A - Policies and Procedures... 1 Section B Internal Controls... 1 INTRODUCTION... 2 PURPOSE AND SCOPE... 3 METHODOLOGY... 3 AUDIT RESULTS... 4 Section A - Policies and Procedures 1. Policies and Procedures for Payroll Functions...4 Section B Internal Controls 1. Access to Computer Payroll Systems...6 2. Manual Payroll Checks...7 3. Payroll Liability Accounts...8 ISSUES RESOLVED DURING FIELDWORK...10
Executive Summary EXECUTIVE SUMMARY - OPPORTUNITIES FOR IMPROVEMENT The following is a summary of the content of the enclosed report. See report references noted below for full detail. Section A - Policies and Procedures 1. Current Personnel Policies and Procedures relating to payroll would be more useful if they reflected present circumstances rather than past practice. Establishing policies and procedures for the payroll function would better ensure that responsibilities are defined, communicated and carried out. (Section A-1, Page 4) Section B Internal Controls 1. Security over the County computer network would be improved by promptly disabling access for terminated employees. (Section B-1, Page 6) 2. Improved controls over the issuance of manual payroll checks would reduce the risk of abuse. (Section B-2, Page 7) 3. Reconciling payroll liability accounts would better ensure that withheld amounts are properly remitted and that County financial records are accurate. (Section B-3, Page 8) 1
Introduction INTRODUCTION Currently, Northampton County has approximately 2,180 employees and produces approximately 2,130 paychecks on a bi-weekly basis. The Payroll Department consists of 2 individuals, a Payroll Administrator and a Clerical Specialist. They are responsible for: Entering time worked for select County departments. Meeting record retention requirements. Monitoring supervisory approval on timesheets. Monitoring new hires and terminations. Establishing withholding for garnishment orders. Setting up direct deposits. Generating payroll checks. Disbursing payroll withholdings. Preparing quarterly tax reports. Generating the payroll posting to the financial system. The payroll system is composed of three different software programs. Timepoint the method for scheduling and accumulating hours worked for 24-hour facilities where work schedules vary. The Prison, Gracedale and Juvenile Detention use this system. Simplex the method for accumulating hours worked for those with static work schedules. Hours are entered on an exception basis, such as when vacation, sick time, etc. are taken. Lawson the employee database. This system does the actual pay calculation and generates paychecks. Information from Timepoint is transferred to Simplex for payroll purposes. The data from the Simplex system is then transferred to the Lawson system for the calculation of pay and the issuance of paychecks. Paycheck Timepoint Simplex Lawson These client server systems replace the mainframe system Human Resource Information System (HRIS) that became obsolete as of January 1, 2000. 2
Purpose and Scope PURPOSE AND SCOPE The purpose of the audit was: To determine the adequacy of internal controls over the payroll process. To determine compliance with laws, regulations and policies and procedures. The scope of the audit was limited to functions of the Payroll Department and payroll-related functions of Human Resources. We did not look at offices entering their own payroll information, nor did we evaluate the economy and efficiency of the process. These areas will be addressed in separate audits. Our tests were conducted on transactions occurring from January 1, 2002 through August 31, 2002. Our tests did not include an examination of the payroll systems/software. We accepted all reports used as accurate and assumed that calculations were being accurately and properly (in compliance with regulatory requirements) completed and transferred (interfaced) within the different payroll systems. METHODOLOGY Our methodology included: Interviewing personnel to document the various processes. Flowcharting those processes to identify and assess internal controls. Identifying applicable policies, procedures, laws and regulations. Testing transactions for compliance with internal controls and regulations. Testing the interface between the County payroll system and the financial system. This audit was conducted in accordance with Government Auditing Standards issued by the Comptroller General of the United States. 3
AUDIT RESULTS Section A - Policies and Procedures 1. Policies and Procedures for Payroll Functions OBSERVATION The payroll department/function as it exists today is an outgrowth of the installation of an entirely new payroll/personnel software system that replaced software that was not Y2K compliant. The system was installed and brought on line over a period of three years. Duties and procedures evolved as needed along the way. Written policies and procedures for the payroll function, however, were never established. In certain instances, currently existing policies were not updated to reflect changes. The lack of and need for documented current policies and procedures is also inherent to every issue noted in Section B. The following were observed during the audit process and exemplify the condition noted above: Personnel Policy and Procedure Code 3.407 Working Hours/Payroll Certification does not reflect current practice with regard to time reports. The policy requires that completed payroll time reports, with both employee and supervisory signatures, be forwarded to Payroll. Currently, individual time reports, with both employee and supervisory signature, are retained in the originating department. Summary time reports with supervisory signature only are forwarded to Payroll. Some departments do their own time entry for payroll while others do not. Departments doing their own data entry are responsible for keeping hard copy of the records. There does not appear to be a policy with regard to who does payroll data entry nor is there any specific guidance as to the type of records that must be maintained. BACKGROUND Currently existing policies and procedures reflect practices used with the HRIS human resource and payroll system utilized by the County in prior years. With the advent of the new human resource and payroll systems, Lawson, Simplex and Timepoint, procedures and functions changed to meet the needs of the new systems. 4
RECOMMENDATION Review current policies and procedures and make changes to reflect the present circumstances. Establish policies and procedures for the payroll function as it currently exists. The Controller s office would be available to assist with these tasks. MANAGEMENT RESPONSE Jean Mateff Director of Fiscal Affairs Dave Pinter Accounting Manager The governing policy, with which we have always complied, remains consistent: pay the employees the correct amounts on each payday. Procedures are different in the client server environment. We welcome the Controller s office assistance to document the current policies and procedures. 5
Section B Internal Controls Internal controls are all measures used by an organization to: Protect assets from waste, loss or theft. Provide reliable and timely financial information. Comply with laws and regulations. Support economy and efficiency in all processes. Strong internal controls promote accountability to the taxpayer for properly utilizing County resources. 1. Access to Computer Payroll Systems OBSERVATION We reviewed Payroll system access lists and noted 9 instances where terminated employees still had access to the system. BACKGROUND As was detailed in the Introduction, the payroll system utilizes 3 separate software programs, Lawson, Simplex and Timepoint. Only the Human Resources and Payroll departments may access Lawson. Many different departments utilize Simplex and Timepoint for the purpose of entering the number and type of hours worked. The County s Information Services Department is responsible for security over the Payroll systems. They enable and disable access to them with the authorization of a designated individual(s). Controlling access to these systems is key to preventing payroll fraud. Currently, access is enabled with the submission of a properly authorized Network Access Form. Access is disabled with submission of the same form from the employee s departmental supervisor. It appears that supervisors are not consistently notifying Information Services of terminations. This issue was addressed in the Bi-Tech Access Security Audit with the recommendation that termination lists be run by Human Resources and forwarded periodically to Information Services. Termination lists are being forwarded to Information Services; however, they have neither the resources nor the time to research each individual on the list to determine if and what type of access they might have had. Currently the problem remains unresolved. RECOMMENDATION Revise the paperwork (PAN) that must be completed upon hiring, transferring or terminating employees to include a reference to computer/network access with the Network Access Form noted. Forward all attached forms to Information Services for processing. 6
MANAGEMENT RESPONSE Jean Mateff Director of Fiscal Affairs Dave Pinter Accounting Manager Affiliated Computer Services, Inc. (ACS) will be required to improve network access management to acceptable levels. 2. Manual Payroll Checks OBSERVATION Internal controls over manual payroll checks are inadequate. Manual payroll checks may be issued without written authorization. Hours paid have been changed without written authorization from the employee s department. Backup documentation does not indicate why the manual check was necessary. BACKGROUND Manual payroll checks may be issued for a number of reasons. When a paycheck is lost, Payroll will notify fiscal to place a stop payment on the lost check and will then issue a manual check. Payroll also issues manual checks when there is a mistake in a pay and the payroll check has already been generated. Payroll voids the printed check, issues a manual check in its place and makes the necessary corrections to the records in the next pay period. Backup documentation generally consists of screen prints from the Lawson system evidencing the changes that were made. Issuing manual checks and making changes to payroll after closing the pay period are two functions that are inherently subject to abuse. To protect the County and the employee(s) carrying out the functions, strong internal controls should be established. RECOMMENDATION Issue manual payroll checks only upon written authorization of a fiscal department supervisor. Make changes to pay only with written authorization from the appropriate departmental authorized signer. Maintain backup documentation for a manual check such that the circumstances surrounding the need to issue the check are evident and need no further explanation. 7
MANAGEMENT RESPONSE Jean Mateff Director of Fiscal Affairs Dave Pinter Accounting Manager The Controller s recommendations for the issue of manual payroll checks have been implemented. 3. Payroll Liability Accounts OBSERVATION Payroll liability accounts are not reconciled. As a result, during 2002, New Jersey payroll withholding taxes were overpaid. Also, Occupational Privilege Tax collection fees earned by the County remained in a General Fund liability account rather than being transferred and posted as revenue. BACKGROUND Each pay period, the payroll system generates totals for all amounts withheld from employee paychecks. These amounts are posted to General Fund liability accounts. These accounts are used to hold amounts withheld from employee paychecks until such time as the funds are distributed to the appropriate parties. The balances in the accounts should equal the amount due to be distributed and should be traceable to payroll (Lawson) system reports. When checks are issued for payroll liabilities, the check amounts are derived from information provided by Lawson. General Fund liability account balances are not considered. This practice can result in incorrect payments and/or account balances. Errors have been minimal in the past because most remittances are made each pay period and because spreadsheets have been established to accumulate amounts and generate totals for various categories such as Union dues. Amounts withheld from employee paychecks for New Jersey state income tax are remitted to New Jersey on a monthly basis. The amount to be paid is derived from information provided by the payroll system (Lawson). The General Ledger liability account balance is not considered nor is there a secondary control account, such as a spreadsheet, that details all the withholding and remittance amounts. This situation makes errors more likely as is evidenced by the noted overpayment. RECOMMENDATION Reconcile all payroll liability accounts on a monthly basis. Provide for payroll department supervisory review of the reconciliations/account balances on a periodic basis. 8
MANAGEMENT RESPONSE Jean Mateff Director of Fiscal Affairs Dave Pinter Accounting Manager The Controller s recommendations for reconcilement of payroll liability accounts have been implemented. 9
ISSUES RESOLVED DURING FIELDWORK 1. Access Authorization for the Simplex and Timepoint Systems Through conversations with various individuals during the initial phase of the Payroll audit, we determined that no one person was assigned responsibility for authorizing access to the Simplex and Timepoint systems. Information Services determined that individuals were being given access based on the authorization of a department head or a department supervisor. They took immediate action to correct this situation by changing the Network authorization form used to request access and by informing their staff not to implement access without the proper authorizing signature. 10