Internal Audit Report

Transcription

1 Internal Audit Report Salary Growth Plan TxDOT Internal Audit Division

2 Objective To determine if districts and divisions (D/D) are complying with the annual Salary Growth Plan (SGP) objectives and targets. Opinion Based on the audit scope areas reviewed, control mechanisms are effective and substantially address risk factors and exposures considered significant relative to impacting reporting reliability, operational execution, and compliance. The organization's system of internal controls provides reasonable assurance that key goals and objectives will be achieved despite control gap corrections and improvement opportunities identified. Control gap corrections and improvement opportunities identified have the potential to negatively impact the achievement of the organization's business/control objectives. Overall Engagement Assessment Satisfactory Control Environment The Financial Management Division (FIN) implemented the SGP in FY 2016, which included an SGP spreadsheet to help limit salary growth for the employees at TxDOT. Between FY 2016 and 2017, FIN and D/D used an SGP spreadsheet to coordinate salary growth budget. FIN used the spreadsheet to calculate, control and communicate each D/D s annual salary growth budget. Each D/D used the spreadsheet to plan and communicate planned salary growth actions to Human Resources Division (HRD) s Workforce Analysis Team (WFA) for review and reconciliation of salary growth actions submitted. If an SGP spreadsheet reflected a D/D was over budget, WFA was responsible for coordinating with the D/D to make changes to remain within budget. In early FY 2018, FIN and HRD coordinated to revise the SGP process and developed an SGP component in the ERP system. As a result of implementing the automated solution, FIN discontinued use of the SGP spreadsheet and WFA will no longer perform a review for exceeding salary growth budgets. Though automated, the SGP component will not prevent a D/D from going over budget. Summary Results Audit testing completed not resulting in management action plans. Scope Area Salary Growth Plan - Manual, FY Evidence Auditors reviewed FY SGP spreadsheets, process, and budget performance results and noted the following: FY 2016 $5,984,589 was budgeted for salary growth. o 48 of 59 (81%) D/Ds went over budget by a combined total of $1,017,485. o 11 of 59 (19%) D/Ds did not utilize their full budget by a combined total of $74,849. August

3 FY 2017 $6,379,414 was budgeted for salary growth. o 4 of 57 (7%) D/Ds went over budget by a combined total of $13,178. o 50 of 57 (88%) D/Ds did not utilize their full budget by a combined total of $1,304,099. Furthermore, 12 of 50 D/Ds had 50% or more of their budget remaining at the end of FY o 3 of 57 (5%) D/Ds used their full budget without going over. Salary Growth Plan - Automated, FY 2018 (design) In developing the FY 2018 SGP component, actions were taken by FIN and HRD to further resolve issues noted in FY 2016 and FY Design of the FY 2018 SGP component in the ERP system was reviewed and noted the following improvements in the SGP component as compared to the prior SGP spreadsheet: The results of an automated check are visible in SGP reporting output, which identifies differences between salary actions reflected in the Job Data component and salary actions reflected in the SGP component. Automated eligibility checks to include: o Confirming the proposed salary amount is within the employee s salary range o Whether an employee has received a merit increase or promotion within six months o Whether the employee has six months of continuous service Restricted access to SGP plans using ERP system login credentials. Automated population of each employee s personnel information such as name, identification number, current salary, current job code and title. Inclusion of prior year s employee performance rating. Review of the SGP component design documents (i.e., business requirements and job aid) noted the following: User support documentation was not made available through the SGP component of the ERP tool. Per review of user support documentation made available outside of the SGP component, the following items were not addressed: o Identification of those responsible for the independent review for accuracy and completeness of SGPs submissions. o Instructions for how to maintain records of SGP submissions from managers and outcomes of director s review. o Steps to assist in SGP version control since the SGP component allows multiple concurrent users with write access. o Milestones or due dates for creation, submission, and review of salary growth plans. o A legend for users to understand the highlighting and shading (color codes) within SGP reports. August

4 Audit Scope The audit was performed by Lilly Burson and Russ Chidester (Engagement Lead). The audit was conducted during the period from December 8, 2017 to February 20, The audit scope focused on the SGP process and spreadsheet utilized in FY 2016, FY 2017, and the design of the SGP component implemented for FY Methodology The methodology used to complete the objectives of this audit included: Reviewed policies and procedures for the SGP process for FY 2016, FY 2017, and FY Compared process and outcomes of all D/Ds FY 2016 salary growth planning to FY 2017 salary growth planning and outcomes. Evaluated the integrity and effectiveness of enhancements to the FY 2017 SGP spreadsheet template. Judgmentally sampled FY 2017 SGP spreadsheet submissions from eight districts and nine divisions to assess spreadsheet accuracy, and the efficiency and effectiveness of the manual WFA review. Interviewed key users from each of the judgmentally sampled D/Ds (eight districts and nine divisions) to identify perceived strengths and weaknesses of the FY 2017 SGP process and spreadsheet. Assessed the control design areas of improvement for the FY 2018 automated SGP component and process against controls in the FY 2017 SGP spreadsheet and process. Background This report is prepared for the Texas Transportation Commission and for the Administration and Management of TxDOT. The report presents the results of the Salary Growth Plan audit, which was conducted as part of the Fiscal Year (FY) 2018 Audit Plan. FIN introduced the salary growth planning (SGP) spreadsheet in FY 2016 to assist D/D s in managing their respective salary growth budgets. FIN developed and distributed the SGP spreadsheet to each D/D to assist in calculating the total salary impact of certain employee job actions. As part of the SGP process, FIN calculated salary growth budgets at the beginning of the fiscal year and communicated the budgets to each division. FIN monitored the high-level salary budget and, when requested by Administration, calculated and reported salary growth budget performance. Based on the requirements defined by Administration, each D/D was responsible for monitoring their respective salary growth plans and their performance to budget. In FY 2016 a total of 59 D/Ds had a salary growth budget, consisting of 25 districts and 34 divisions. Due to organizational changes, this reduced to 57 D/Ds in FY 2017, consisting of 25 districts and 32 divisions. In FY 2017, four job actions counted toward SGP, which included Career Ladder Promotions (CLP), One-Time Merits (OTM), Regular Merits (RM), and Professional Engineering License and Engineer-In-Training (PEI) when the increase was greater than 10%. No other job action counted toward the SGP budget. August

5 The frequency of updating the salary growth plan, the level of input across levels of management, and how to determine each staff member s salary growth varied by D/D. For example, some D/Ds delegated the task of entering job actions into the SGP spreadsheet to non-d/d leadership or supervisory positions. Vetting and execution of job actions submitted by D/Ds in FY 2016 FY 2018, were separate processes from salary growth planning, and different teams were responsible for performing the execution of job actions in the Job Data ERP component. HRD generalists executed CLP, RM, and PEI job actions in the Job Data ERP component. The FIN payroll team executed OTM job actions in the Job Data ERP component. We conducted this performance audit in accordance with Generally Accepted Government Auditing Standards and in conformance with the International Standards for the Professional Practice of Internal Auditing. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. Recommendations to mitigate risks identified were provided to management during the engagement to assist in the formulation of the management action plans included in this report. The Internal Audit Division uses the Committee of Sponsoring Organizations of the Treadway Commission (COSO) Internal Control Integrated Framework version A defined set of control objectives was utilized to focus on reporting, operational, and compliance goals for the identified scope areas. Our audit opinion is an assessment of the health of the overall control environment based on (1) the effectiveness of the enterprise risk management activities throughout the audit period and (2) the degree to which the defined control objectives were being met. Our audit opinion is not a guarantee against reporting misstatement and reliability, operational sub-optimization, or non-compliance, particularly in areas not included in the scope of this audit. August

6 Observations and Recommendations Audit Observation : Design Improvements for the Salary Growth Plan (SGP) Component. Through evaluation of FY 2016 and FY 2017 SGP procedures and results, in addition to evaluation of and interviews with users of the FY 2018 SGP component, the following are design opportunities to improve SGP efficiency and effectiveness: FY SGP: In FY 2016, budget overutilization was significant, with many D/Ds exceeding their allotted salary budgets. In FY 2017, SGP tool and process changes resulted in a decrease in the number of D/Ds exceeding salary growth budgets. However, a majority of D/Ds underutilized their respective salary growth budgets. FY 2018 SGP: Make the SGP Job Aid available within the SGP component and update it to include: The process for submitting and reviewing job actions relevant to salary growth planning. Identification of those responsible for the independent review for accuracy and completeness of the SGP. Steps to assist in SGP version control since the SGP component allows multiple concurrent users with write access. Prescribed milestones or due dates for creation, submission, and review of salary growth plans. A legend for users to understand the highlighting and shading (color codes) within SGP reports. Implement SGP component changes to include the following: Highlight specific fields when the automated check identifies differences between salary actions reflected in the ERP system and salary actions reflected in the SGP component. Ability to maintain records of SGP submissions and review outcomes. Visibility to a history (log) of which edits are performed and by which user. Add real-time view of users concurrently logged in to a plan in the SGP component. Initiate workflows for submission by managers and approval by the division head, recording the history of each plan as it passes through the approval steps. Interface the SGP component with the Job Data ERP component to eliminate duplicated effort and potential for error when manually typing job actions into two components. Automatically update the SGP component with salary changes when HRD or FIN executes a job action. Allow users to input promotions for licensure (PEI) actions >10%. Enable distribution of budget among managers and visibility to how each manager s plan compares to their portion of the budget. Add sort and filter capability for all fields to allow easy adjustments in view. Provide real-time update of differences between salary growth plan totals and salary budget. August

7 Ability to maintain version control, considering that the SGP component allows multiple concurrent users with write access. Enable full visibility of all salary job actions within the same viewing area for each D/D by also including job actions that are not included in the salary growth budget (e.g. competitive promotions (PRO) and promotions for licensure (PEI <=10%). Effect/Potential Impact Improved efficiency and effective use of the SGP component for the system users. Audit Recommendation FIN and HRD should solicit broader D/D user feedback (in relation to the above-noted items) as well as a post-mortem review to identify opportunities to drive salary growth planning efficiencies and effectiveness across all D/Ds. August

8 ERM Component Control Environment Risk Assessment Summary Results Based on Enterprise Risk Management Framework Organizational Tone Control Activities Business Objective/Goal-Setting Resource Capacity Forecasting/Budget Training and Development Risk Identification/Planning Risk Assessment/Impact Analysis Risk Response/Cost-Benefit Analysis Business Continuity Policies/Procedure Development & Maintenance Approvals/Authorizations Control Activities Supporting Evidence/Records Retention Information & Communication Monitoring Segregation of Duties/System Access Safeguarding Assets/Security Information Classification Information Input Information Processing Information Output Internal and External Reporting Exception Reporting Review Reconciliations Root-Cause Analysis Evaluations/Inspections Management Action Plans Scope Area Assessment Audit Results Dashboard Salary Growth Plan Salary Growth Plan - Manual, FY16-17 Scope Areas Evaluated Business Objectives (Reporting, Operational, Compliance) R, O, C R, O, C Salary Growth Plan - Automated, FY18 (design) Rating Assessment Grid Exemplary Satisfactory Needs Improvement Unsatisfactory Closing Comments The results of this audit were discussed with/provided to the Financial Management Division Director and the Human Resources Division Director on June 13, The Internal Audit Division appreciates the cooperation and assistance received from the Financial Management and Human Resources Divisions during this audit. August