, DAVIS INTERNAL AUDIT SERVICES University of California, Davis, Health System Financial Services Payroll Processing Project #09-23 December 2008 Fieldwork Performed by: Amy Holzman, Senior Auditor Dahling Webb, Principal Auditor Reviewed by: Jeremiah Maher, Associate Directors Approved by: Rick Catalano, Director
, DAVIS, HEALTH SYSTEM FINANCIAL SERVICES PAYROLL PROCESSING Internal Audit Services Project #09-23 MANAGEMENT SUMMARY UCDHS Payroll Services (Payroll Services) has responsibility for all payroll related disbursement transactions for Hospital employees and School of Medicine staff authorized in the personnel database known as ehr. Collection of time and attendance data is accomplished through both a manual system and an electronic time keeping system (Kronos), and then batch transmitted to the University of California Office of the President (UCOP) via a software program known as TA00, for update into their Payroll/Personnel System (PPS) database. Kronos was introduced to the Health System in 2003 and is currently used by 7,118 hourly and exempt employees. A manual timekeeping system is used by 1,924 employees, primarily Patient Care Services. We noted that School of Medicine academic and student payroll is processed through the Davis campus utilizing the OPTRS module within PPS for time reporting. As part of the planned audits for fiscal year 2008-2009, Internal Audit Services performed a review of UCDHS Financial Services payroll processing. The purpose of this audit was to review the procedures and controls for ensuring the accuracy, completeness and integrity of payroll related payments including payroll adjustments, incentives and special payments. We also reviewed the accuracy of payroll reporting. Specific objectives included ensuring that UCDHS policy clearly defines time and attendance expectations, procedures, roles and responsibilities, confirming timecards are appropriately reviewed, approved and signed off by departments, and ascertain the management of payroll related adjustments and errors. The scope of this audit included both Hospital (Chart H) and School of Medicine (Chart S) employees whose time records are processed through UCDHS Payroll Services. This audit assumed that the employee was properly hired and employment data was properly input into the system. Payroll appears to have sufficient procedures and controls in place to accurately process payroll and ensure payment is calculated correctly. Payroll reps are knowledgeable regarding title codes, labor agreements, UCDHS time keeping systems and University policy. However, we noted some areas that could be enhanced to strengthen the overall management of time and attendance at UCDHS. Time and attendance policy needs to be more comprehensive. UCDHS Policy 2909 Time and Attendance (Kronos) could be strengthened by articulating critical expectations, responsibilities and procedures for either the electronic or the manual time keeping systems. Performance tracking of Payroll Services Representatives as well as time and attendance management within individual departments could be strengthened to improve the overall efficiency of payroll processing. The manual timekeeping system used by most of Patient Care Services is labor intensive and runs a high risk of human error. Efforts to automate time collection for Patient Care Services have occurred but have been unsuccessful in part due to challenges of integrating existing systems with Kronos. Management will be developing a definitive plan of action. i
, DAVIS, HEALTH SYSTEM FINANCIAL SERVICES PAYROLL PROCESSING Internal Audit Services Project #09-23 TABLE OF CONTENTS MANAGEMENT SUMMARY... i TABLE OF CONTENTS... ii I. BACKGROUND... 1 II. AUDIT PURPOSE AND SCOPE... 2 III. CONCLUSION... 2 IV. OBSERVATIONS, RECOMMENDATIONS, AND MANAGEMENT CORRECTIVE ACTIONS. A. Time and Attendance Policy... 3 B. Management of Payroll Services Adjustments and Errors... 7 C. Manual Timekeeping System... 8 ii
I. BACKGROUND The Payroll Services Division at the Davis Campus is responsible for computing the payroll for University of California Davis Health System (UCDHS) as well as the Davis Campus via the Payroll/Personnel System (PPS). PPS is a systemwide information system for the University of California, operated and maintained by the Office of the President. PPS contains payroll, personnel, benefits, and time reporting information on all campus employees. A sub-system of PPS, the On-Line Payroll Time Reporting System (OPTRS), allows for on-line reporting of work hours, administrative leave time, and transfers of payroll expense. UCDHS, however, does not utilize the OPTRS module within PPS for time reporting. Instead, collection of time and attendance data is accomplished through both a manual system and an electronic time keeping system (Kronos), and then batch transmitted to the University of California Office of the President (UCOP) via a software program known as TA00, for update into the PPS database. UCDHS Payroll Services (Payroll Services) has responsibility for all payroll related disbursement transactions for UCDHS staff authorized in the personnel database known as ehr. Payroll for academic appointees and students within UCDHS is processed through the Davis campus. Units and departments are responsible for verifying the accuracy of an employee s timecard. Payroll has a staff of 14 that performs the following: Process biweekly and monthly payroll ensuring payment is calculated correctly based on Union contracts and Personnel Policies for Staff Members. Initiate manual check requests as necessary for payroll adjustments, salary advances or final wages. Process corrections to pay such as retroactive rate increases, leave code changes, and amended timecards. Process labor expense transfers or recharges per departmental requests. Handle employee inquiries as they relate to payroll. Establish direct deposit arrangements or make changes to employee's payroll check disposition. Kronos was introduced to the Health System in 2003 and is currently used by 7,118 hourly and exempt employees. A manual timekeeping system is used by 1,924 employees, primarily Patient Care Services. 1
II. AUDIT PURPOSE AND SCOPE As part of the planned audits for fiscal year 2008-2009, Internal Audit Services performed a review of UCDHS Financial Services payroll processing. The purpose of this audit is to review the procedures and controls for ensuring the accuracy, completeness and integrity of payroll related payments including payroll adjustments, incentives and special payments. We also reviewed the accuracy of payroll reporting. The scope of this audit included the review of employees whose time records are processed through UCDHS Payroll Services. This audit assumed that the employee was properly hired and employment data was properly input into the system. Specific objectives included ensuring that: UCDHS policy clearly defines time and attendance expectations, procedures, roles and responsibilities. Exempt employees are recording their absences accurately in Kronos. Timecards are appropriately reviewed, approved and signed off by departments. Money Orders purchased and issued by Payroll have proper controls and accountability. Determining causes of PPS detected payroll adjustments, errors, and potential overpayments and why UCDHS systems and procedures failed to detect these discrepancies. The following steps were taken to perform this audit. We observed Payroll Services processing time records and gained an understanding of both the electronic and manual timekeeping systems in use. We reviewed UCDHS time and attendance policies, department plans, and timekeeping practices of select departments. Fieldwork was conducted between August and December 2008 III. CONCLUSION Payroll appears to have sufficient procedures and controls in place to accurately process payroll and ensure payment is calculated correctly. Payroll reps are knowledgeable regarding title codes, labor agreements, UCDHS time keeping systems and University policy. However, we noted some areas that could be enhanced to strengthen the overall management of time and attendance at UCDHS. Time and attendance policy needs to be more comprehensive. UCDHS Policy 2909 Time and Attendance (Kronos) should be strengthened by articulating critical expectations, responsibilities and procedures for either the electronic or the manual time keeping systems. 2
Performance tracking of Payroll Services Representatives as well as time and attendance management within individual departments could be strengthened to improve the overall efficiency of payroll processing. The manual timekeeping system used by most of Patient Care Services is labor intensive and runs a high risk of human error. Efforts to automate time collection for Patient Care Services have occurred but have been unsuccessful in part due to challenges of integrating existing systems with Kronos. Management will be developing a definitive plan of action. IV. OBSERVATIONS, RECOMMENDATIONS, AND MANAGEMENT CORRECTIVE ACTIONS A. Time and Attendance Policy Policies, procedures, and systems need to be improved to sufficiently and consistently manage time and attendance data collection across UCDHS. The purpose of the UCDHS Policy 2909 Time and Attendance (the policy) is to outline the proper methods of time reporting, approvals, employee responsibilities and department responsibilities. However, the policy does not articulate critical expectations, responsibilities and procedures. Without sufficient policy guidance, departments may overlook key controls that ensure consistent and effective management of time and attendance. The following are examples of situations and facts highlighting the current weaknesses. A stronger policy could be pivotal in reducing the University s risks of fraudulent time reporting and inconsistent application of policy. 1. During October 2008, of the 5,511 hourly employees using Kronos, 922 (17%) accessed Kronos via Teletime, 2,000 (36%) accessed via the web and the remaining 2,589 (47%) used a badge reader. While the badge reader has been identified in policy as the primary clocking method, Teletime and web methods provide flexibility that may be needed by departments. The policy does not, however, define when it is appropriate to use Teletime or Kronos Timestamp (web access); what assessment department managers should perform to justify using Teletime and web access, and that those department managers should also monthly review system reports to ensure use is justified and authorized. There are some inherent control issues in using Teletime and web to access Kronos. Specifically, users can access Kronos from an unauthorized outside telephone line by first calling an inside telephone number and then being transferred to the Teletime number (734-TIME). Also, inappropriate practices can occur such as the use of Teletime from remote campus locations or other departments distant from the area of 3
work responsibility and thereby reducing productive time while clocked in. Additionally, employees have admitted to using Teletime to call in for other employees before they have arrived for work or after they have left early. 2. Kronos is designed to only allow employees to clock in or out via Teletime from authorized telephone numbers. However, procedures do not exist or are not sufficient to ensure unused or unneeded telephone numbers are deactivated, only properly authorized numbers can be used, and authorized numbers are effectively controlled. IAS found that 215 outside telephone numbers were authorized to access Teletime with no restrictions on who uses them plus another 60 telephone numbers accessed Teletime but were not included on the authorized list. In addition 111 authorized numbers were not used to record time in the month. 3. Kronos has two levels of approval that can be confusing, and contribute to inconsistent application of the approval process. The final Sign-off is required by Kronos and this step also locks the time record from further editing. Departments need to understand that approval represents an initial review by a timekeeper, supervisor or other designee to provide input as to the validity and accuracy of time recorded. The final sign off indicates all time records are accurate, complete, and have been properly reviewed and approved by those with the knowledge to validate time recorded. Department structure and size generally determine whether initial approval is warranted or bypassed prior to the required final sign-off. Internal Audit observations underscore this inconsistent application of the approval process. An overview of FY08 bi-weekly Kronos timesheets submitted to Payroll Services shows that 7,828 (5%) timesheets did not have an initial review by a supervisor or a final sign off. Another 3,535 (2%) timesheets had supervisory approval but did not have the required sign off. The total 11,363 (7%) timesheets without a sign off causes Payroll Services to engage in a wasteful business practice by pursuing after-the-fact certification that the time reported was accurate. 4. Employees such as department managers, who are exempt from the Fair Labor Standards Act, report sick leave and vacation taken through a Kronos timesheet. UCDHS Policy 1816, Departmental Financial Administration Controls, states employees will certify their own time and attendance records. During 2008 61% of monthly exempt employees did not certify their Kronos timesheets. As described above, managers are responsible for the completeness, accuracy, and final sign-off of time records submitted to the Payroll Department for compensation. During 2008, 22% of monthly exempt Kronos timesheets were submitted to Payroll lacking the required final sign off. Without appropriate certification by employees and review and approval by supervisors the risk for unreported leave increases. 4
5. Instances of timekeepers modifying their own Kronos time stamps have been observed in other Internal Audit reviews. The policy requires edits to a timekeeper s Kronos timecard be made by another timekeeper or manager. The timekeeper access profile in Kronos does not currently restrict self edits but capability to modify profiles exists. Restricting this capability in Kronos would provide a stronger preventative control. 6. Although the policy requires departments to develop a plan to provide employees instructions on how, where and when to record their time and methods for recording adjustments, our limited review found that 6 of 10 departments did not have a departmental plan or the equivalent components. Recommendations Financial Services should revise UCDHS Policy 2909 Time and Attendance to provide sufficient guidance to departments that ensures consistent and effective management of time and attendance. The policy should be modified in the following areas: Encourage users to use the Kronos badge reader as the primary method for recording time and justify in their departmental plans the use of alternate methods to record time in Kronos such as Teletime and the web. Require that departments who allow the use of Teletime and web to access Kronos to monthly review Kronos access points to ensure only authorized staff are using the alternate methods of recording time. Reinforce that departmental plans are required to provide employees instructions on how, where and when to clock in and methods for recording adjustments and Departmental Management must monitor for compliance with these plans. These requirements should be emphasized in a separate section in the policy. Instruct employees not to clock in/out for other employees, only for themselves, except as authorized by their role. Exempt employees will sign their own Kronos time record (Kronos approval) and appropriate managers will approve these time records. Management will ensure vacation and sick time are properly recorded in the timekeeping system through verification of supporting documents. Clearly define the roles, responsibilities, and expectations of supervisors and managers with special attention given to the time record review, approval, and sign-off process. Further, establish a mechanism to 5
document, monitor, or escalate non-compliance with this essential requirement. Detail requirements necessary to maintain Teletime authorized phone numbers. Establish a procedure of annually having Financial Services review copies of departmental plans. In addition, Financial Services should make the following procedural changes to further strengthen controls over time reporting: Formally request an opinion from Health System Counsel on whether Federal or State law allows the Health System to not pay employees on official University paydays if their time records have not been properly approved. Until an opinion is obtained, efforts should continue to get departments to comply with critical aspects of the policy and Payroll Services should begin to report non-compliance to the Controller. The Controller should decide when it is appropriate to elevate chronic issues to executive management. Payroll needs to implement procedures to ensure the authorized list of Teletime phone numbers established in Kronos are authorized and appropriate. Kronos timekeeper access profile should be changed to restrict timekeepers from editing their own time stamps. Management Corrective Action Payroll Services will take the lead in revising UCDHS Policy 2909 Time and Attendance which is expected to be completed by October 1, 2009. IAS has agreed to review a draft of the revised policy prior to sending it to others for review and approval. Revisions will include the following: o Reinforce that Kronos badge reader is the primary method for time collection. Management should monitor how and where staff are recording time as outlined in their departmental plans. o Describe the elements of a departmental plan and require departmental plans be submitted to payroll annually for review. o Clearly define roles, responsibilities and expectations, addressing the concerns noted in this report. 6
Payroll Services will review departmental plans annually and assist departments as needed to ensure the plans adequately address key elements as described in the policy. The first review is expected to be completed by November 1, 2009. Payroll Services will review on an annual basis the authorized Kronos Teletime list of phone numbers obtained from Information and Communication Services. All telephone numbers no longer authorized will be deleted. The first review is expected to be completed by August 31, 2009. A procedure will be established so that going forward all Teletime requests from departments will be approved by Payroll prior to being added by Information and Communication Services. By August 1, 2009, Payroll Services will modify the Kronos timekeeper access profile to restrict timekeepers from accessing their own timesheets. Financial Services will formally request by September 1, 2009, an opinion from Health System Counsel as to whether Federal or State law allows the Health System to not pay employees on official University paydays if their time records have not been properly approved. Payroll Services will begin reporting critical non-compliance of the policy to the Controller beginning August 1, 2009. The Controller will elevate chronic issues to executive management. B. Management of Payroll Services Adjustments and Errors Performance monitoring is needed to fulfill oversight responsibilities. Error detection and prevention is an important management function. The UC Davis PPS Accountability and Performance Standards, dated June 30, 2008, requires performance monitoring by the central offices of payroll and timekeeping entries for which they have oversight responsibility. This includes monitoring for errors as well as follow-up and corrective action. Payroll Services does have a robust system in place to detect and correct potential errors and Campus Accounting provides another layer of control to detect errors prior to the issuance of paychecks. Through an established query protocol Payroll Services identifies Kronos time records that may have potential errors and need to be reviewed by a Payroll Representative. A substantial number of these records stem solely from the lack of department sign offs as noted above. While Payroll Services has a system to detect errors, they have no process designed to prevent errors. Payroll Services management does not track the number, source, and frequency of errors and adjustments made either by Payroll Representatives or individual units and employees. This represents a lost opportunity to enhance internal controls, 7
increase productivity, and apply training or other corrective actions to reduce or eliminate adjustments and errors. Recommendations In compliance with the UC Davis PPS Accountability and Performance Standards, UCDHS Payroll Services should: Develop a system to review, monitor and track adjustments and errors. Identify reoccurring errors or trends and develop solutions to prevent future occurrences. Management Corrective Action Payroll will take the following steps to monitor adjustments and errors. On a monthly basis, review Kronos queries for types of adjustments and errors made after sign off but prior to transmission; use TA00 and payroll change reports to review prior period adjustments, identify type of errors, and the reasons for the adjustments; and track reasons for manual checks, overpayments, error reports, site checks and other non standard or exceptional processes. Create a log to track specific payroll staff, employees and departments and types of errors so Payroll can instruct or offer refresher courses on a quarterly basis as warranted. It is expected these procedures will be implemented by July 31, 2009. C. Manual Timekeeping System UCDHS does not have a plan in place for implementing Kronos in Patient Care Services or developing a system to facilitate the capture of employee work and leave time and electronically transfer it to Kronos. UCDHS Policy 2909, Time and Attendance, states Kronos will be used to document time and attendance for all UCDHS employees who are paid through UCDHS Payroll. Kronos was implemented at the Health System in 2003 and is used by all Health System departments except those in Patient Care Services (PCS). Currently, nearly 2,000 PCS employees record work and administrative leave time on paper timesheets. This manual timekeeping system presents a greater opportunity for human error and demands a significant amount of resources. The manual process that captures data from the paper timesheets and ultimately transfers into TA00 is labor intensive and under tight time constraints. Both Payroll Services and the Data Entry unit invest significant time each pay period to capture this data and review for input accuracy. Multiple edit reports are reviewed to correct detected errors. 8
PCS currently utilizes Automated Nursing Scheduling Office System (ANSOS) which is designed for scheduling employees and not for timekeeping purposes. PCS has indicated openness to using an electronic timekeeping system. They prefer, however, that pay be calculated based on the ANSOS schedule, as opposed to individual time stamps via the Kronos badge reader. While actions to develop an interface between the two systems were initially taken, they have not been successful. Continued actions are needed, guided by an effective plan and clear timeline to implement an electronic timekeeping system for Patient Care Services. Without it, significant reductions in both the effort and risks associated with manual time reporting cannot be realized. Recommendation Develop a plan and timeline for converting the remaining UCDHS employees onto Kronos for time and attendance. Management Corrective Action Information and Communication Services (I&CS) has been working with PCS and the Payroll Department to evaluate the existing policies and procedures, processes, and Kronos software. I&CS needs to assess the use of Kronos in creating an interface with ANSOS and install new hardware. I&CS expects to have a final timeline and plan developed by January 1, 2010 for getting PCS converted to an automated time collection system. * * * 9