Newark Central School District Review of Payroll Processing, Reconciliation and Approval Procedures

Transcription

1 Review of Payroll Processing, Reconciliation and Approval Procedures June 7, 2017

2 Trust earned. II FreedMaxick June 7, 2017 Audit Committee 1 00 East Miller Street Newark, New York We have performed an internal audit of the internal controls over payroll processing, reconciliation and approval procedures of the (the District). Our internal audit was performed during 2017 in accordance with the terms of our engagement letter and the applicable internal audit procedures. Our report contains the following:!! Executive Summary - an overview of the risk factors considered, an overall internal audit rating, and a summary of the key observations. Observations- detail related to specific findings noted during the current year testing. This report contains recommendations for improvement in internal controls for consideration by the Board of Education, the Audit Committee and District officials. This report is intended solely for the information and use of the District. It is not intended to be and should not be used by anyone other than these specified parties. The New York State Comptrollers Office may be provided with a copy of this report in connection with fulfilling their oversight responsibilities. We appreciate the cooperation extended to us during this review. If we can be of assistance to you or if you have any questions concerning this report, please contact Kathryn Barrett at (585) or Chris Piedici at (585) Sincerely, ~!71 0 CIAs/!C. Freed Maxick CPAs, P.C.

3 TABLE OF CONTENTS SECTION PAGE I. Executive Overview..1-3 II. Detailed Observations and Recommendations....4 Appendix A - Internal Audit Methodology Appendix B - Internal Audit Procedures Performed

4 I. EXECUTIVE OVERVIEW Introduction We recently completed an internal audit of the District s internal controls over payroll processing, reconciliation and approval procedures with a primary objective of evaluating the significant control points for effectiveness, adequacy, and efficiency of operations. This report is intended solely for the information and use of the District, and should not be used for any other purpose. Overview of Issues During the course of our work, we discussed our findings with management. Our detailed observations and recommendations for improving controls and operations are described in Section II of this report. A summary of key issues is provided below. Table 1 Issue Description Relative Risk Resolution Level of Difficulty 1. Payroll change report limitations Low Moderate 2. Access rights Low Low Definitions: Relative Risk is an evaluation of the severity of the concern and the potential impact on the operations. Items rated as High are considered to be of immediate concern and could cause significant operational issues if not addressed in a timely manner. Items rated as Moderate may also cause operational issues and do not require immediate attention, but should be addressed as soon as possible. Items rated as Low could escalate into operational issues, but can be addressed through the normal course of conducting business. Resolution Level of Difficulty is an evaluation of the estimated level of difficulty and potential cost to resolve the concern based on our experience. Items rated as High are considered to be difficult to resolve and/or will require a significant amount of planning and management involvement/oversight in order to obtain resolution. Items rated as Moderate are not as difficult to resolve and/or do not require a significant amount of planning, but may be time-consuming to resolve. Items rated as Low are items that are not complex and/or do not require significant amounts of planning and time to resolve. 1

5 Conclusion A "Satisfactory" audit rating, as defined below, was assigned following this audit based on the identification of the key findings summarized above, as well as other less significant comments that can be addressed by management in the normal course of business. RATINGS SATISFACTORY NEEDS IMPROVEMENT UNSATISFACTORY CONDITIONS No significant deficiencies exist, while improvement continues to be appropriate; controls are considered adequate and findings are not significant to the overall District. Some improvement needed to bring the District to acceptable status but if continues without attention, could lead to further deterioration and an unacceptable status. Significant deficiencies exist which could lead to material financial loss or embarrassment to the District. Internal Audit Approach We completed an internal audit of the District s internal controls over payroll processing, reconciliation and approval procedures in accordance with the internal audit plan as outlined in Appendix B. Our internal audit was performed to: Gain an understanding of the functions and processes, Identify the risks and exposures, Assess the impact of such risks on the internal control environment, and Evaluate the adequacy of internal controls in place to mitigate the identified risks. To accomplish the scope of this internal audit, we reviewed: Internal controls over payroll processing, the reconciliation and approval of the payroll data entries Payroll related data (i.e. time sheets, additional pay requests, time off information, etc.) Approval process of the biweekly payroll Payroll processing and identification of and communication of errors Final verification and accuracy of payroll data It should be recognized that controls are designed to provide reasonable, but not absolute, assurance that errors and irregularities will not occur, and that procedures are performed in accordance with management's intentions. There are inherent limitations that should be recognized in considering the potential effectiveness of any system of controls. In the performance of most control procedures, errors can result from misunderstanding of instructions, mistakes in judgment, carelessness, or other personal factors. Control procedures can be circumvented intentionally by management with respect to the execution and recording of transactions, or with respect to the estimates and judgments required in the processing of data. Further, the projection of any evaluation of control to future periods is subject to the risk that the procedures may become inadequate because of changes in conditions, and that the degree of compliance with procedures may deteriorate. 2

6 Internal Audit Scope and Methodology During this internal audit we examined internal controls over payroll processing, reconciliation and approval procedures of the District that existed at the time of our internal audit. During the course of our review, we held discussion and inspected documentation to understand and assess controls in place. The engagement included specific testing procedures to verify the design and operating effectiveness of the District s controls related to payroll processing, reconciliation and approval. More information on such standards and the methodology used in performing this audit are included in Appendix A and Appendix B of this report. Comments of the District Officials and Corrective Action The results of our internal audit and recommendations have been discussed with the District officials and their comments, which appear in this report, have been considered in preparing this report. The Audit Committee has the responsibility to initiate corrective action. The Audit Committee should prepare a plan of action that addresses the recommendations in this report. For guidance in preparing the plan of action, the Audit Committee may refer to applicable sections in the publication issued by the Office of the State Comptroller entitled Local Government Management Guide. 3

7 II. DETAILED OBSERVATIONS AND RECOMMENDATIONS Observation Recommendation Management Response 1. Payroll Change Report Limitations Relative Risk: Low Resolution Level of Difficulty: Moderate The payroll change report currently captures any and all changes. At times this report can contain too much information, seem overwhelming and become less value added. Further, the report consists largely of penny differences. We recommend adding filters or queries to the report to present relevant information. (i.e. 5% change in pay). We recommend that the payroll calendar be adjusted so that penny differences are adjusted once at year end. We will continue with our current practice but may consider changing in the future. 2. Access Rights Relative Risk: Low Resolution Level of Difficulty: Low The Human Resources Clerk has access to all payroll modules within N-Vision. In addition, the Payroll Clerk can delete employees. The District should fully evaluate the roles/responsibilities of the Payroll and Human Resources Clerks and segregate incompatable duties to the extent possible in an effort to strengthen internal controls and limint the potential for risk to the District. The District will work with Edutech at WFL BOCES to remove or limit the Human Resource Clerks access to the Payroll module in nvision. Other Matter Observed During Review of Data As part of payroll processing, system generated error reports are not utilized. The District should work with its software provider to determine how to run or custom design a payroll error report to show errors or corrections outside the payroll change report that happen within the process. The District informally documents payroll processing and does not have written procedures to support responding to identified payroll errors. We recommend the District develop comprehensive and detailed written policies and procedures for the complete payroll transaction cycle, addressing such issues as referenced above, correcting payroll errors. 4

8 APPENDIX A INTERNAL AUDIT METHODOLOGY To accomplish our internal audit objective, we performed a risk assessment of the internal controls in order to design our internal audit to focus on high risk areas. Our risk assessment included evaluations of the following areas: accounting systems, centralized and decentralized cash receipts, grant administration, state aid, purchasing and cash disbursements, payroll, employee benefits and paid time off, fuel depot, and fixed assets. During the risk assessment, we interviewed appropriate District officials and reviewed pertinent documents such as District policies and procedures manuals and financial records and reports. Further, we reviewed the District s internal controls and procedures over the computerized financial databases to help ensure that the information produced by such systems was reliable. After reviewing the information gathered during our risk assessment, we determined where weaknesses existed, and evaluated those weaknesses for the risk of potential fraud, theft and/or professional misconduct, identified for internal audit those areas most at risk. The Audit Committee selected payroll for further audit testing. For payroll we interviewed appropriate District officials and employees to obtain an understanding of the District s controls and operations associated with payroll. We reviewed policies, time sheets, attendance logs, payroll certifications, payroll change reports, other payroll processing reports. 5

9 APPENDIX B INTERNAL AUDIT PROCEDURES PERFORMED We performed the procedures enumerated below, which were agreed to by the Audit Committee of the District. The sufficiency of these procedures was solely the responsibility of the specified users of the report. Consequently, we make no representation regarding the sufficiency of procedures described below either for the purpose for which this report has been requested or for any other purpose. The procedures performed are summarized as follows: General payroll processing, reconciliation and approval procedure testing 1. Selected the month of May 2017 to verify the below processes were being performed. If no such process was performed during the sampled one month period, inquired of an instance where the process was performed in a month during 2016/2017 and verified the step was performed. a. We reviewed and documented the process of how the payroll related data (i.e. time sheets, additional pay requests, time off information, etc.), as well as payroll change information (i.e. changes in deductions, etc.) is submitted to the District s Human Resources and/or Payroll Department for processing. b. We reviewed and documented the internal controls and process over review and reconciliation of the payroll data entries for payroll data entered by the District Payroll Department (salaried employees). c. We reviewed and documented the review and approval process of the biweekly payroll.thisincluded obtaining an understanding of the reports obtained for review purposes, the specific information included in the reports that is reviewed, how information is verified and types of errors noted, if any. d. We reviewed any/all written documentation of how payroll processing occurs, how errors are identified and corrected, how the reconciliation of the payroll is conducted and the related timelines for these processes to occur. e. We reviewed the process for correction of errors noted during the reconciliation process. f. We reviewed the process of how errors noted in the reconciliation process are communicated to the appropriate individuals. g. We reviewed the process for verification that errors have been corrected. h. We verified who is responsible for the final verification of the accuracy of the payroll data input prior to review and approval by the Superintendent. 2. We reviewed any/all payroll audit reports available in NVision for any unusual activity or activity by unauthorized employees for the 2016/2017 school year. 3. We communicated any best practices and preventative evaluation to correct, enhance and improve the process. 6