A.G. Gancarski
The Jacksonville Sheriff’s Office payroll audit was released July 5, and it revealed some concerns the Council Auditor’s office had about payroll practices.
While “pay to JSO employees [in general] was properly supported, accurately calculated and timely paid,” the office “identified various internal control weaknesses, findings, and opportunities for improvement that need to be addressed.”
Room for improvement abounded: “JSO lacked detailed payroll procedures … JSO relied on manual timekeeping processes for some employees … JSO’s secondary review for payroll batches was inadequate … JSO did not require all employees to attest to time worked … The city had inadequate supporting documentation related to the creation and maintenance of pay elements within the Human Resources and Payroll System … Shift differential pay was inconsistently applied.”
The auditor had dealt with city practices previously in the year, but the sheriff’s office has a standalone system, and got separate treatment.
The holistic recommendations for improvement included advising the JSO to “develop written standard operating procedures for payroll, move away from manual timekeeping, enhance review of payroll batches and require all employees to attest to time worked.”
Meanwhile, the city was to “improve the process of creating, changing, and testing elements in the payroll system which would include supporting documentation with the approval and purpose. Also, the city needs to ensure that shift differential pay is applied consistently and in accordance with the collective bargaining agreement requirements.”
Going deeper into the report, one issue the auditors had was inadequate supporting documentation for pay elements.
“Based on a lack of existing documentation, ITD ultimately reviewed the internal programming code language and logs for the system to provide information related to our requests. However, this information did not provide sufficient assurance that each element had been properly developed or that the system was operating as the city intended. Examples of this issue can be seen in multiple findings below. A lack of documentation to provide evidence that changes to the Payroll System were authorized, tested, and approved represents an increased risk for repeated errors in the payments made to JSO employees,” read the auditor’s report.
The city “partially agree[d]” with this finding, vowing to improve the process via modifications with respect to “pay elements.”
A lack of written SOP for timekeeping staff also presented an issue.
“JSO had not established written SOP for staff with timekeeping management and payroll-related responsibilities. Written SOP promote compliance with applicable laws, rules, and regulations in a way that is consistent and in alignment with management’s objectives. The need for written procedures may have been overlooked due to the long-term experience of the few timekeeping staff members, which allowed operations to continue based on institutional knowledge. However, any future turnover could result in a significant loss of that knowledge,” the report asserted.
It was agreed a payroll procedure manual could only help to codify what is now the province of “institutional knowledge.”
Another issue: a lack of a secondary review for payroll batches, with a single person making changes manually and without oversight before transferring the batches to the payroll office for processing.
“JSO payroll staff regularly made manual adjustments after the transfer was complete. Although the adjustments may have been necessary (e.g., to correct known system errors), manual entries should be reviewed by someone other than the person who made them, if possible,” the auditor’s office claimed.
“Further, the JSO Timekeeping System allowed users in the supervisor role to update employee addresses, and this particular administrative supervisor was also responsible for safeguarding and distributing the checks. When one individual is responsible for entering and approving time and attendance records, initiating payroll and the distribution of any resulting paper checks, the combination presents an opportunity for that individual to misappropriate funds. An effective secondary review would mitigate this risk,” the report continued, painting a picture of a lack of accountability.
JSO didn’t completely agree with that assessment.
“An analytic review of each payroll is completed before each batch is sent to the COJ Payroll Office. The analytic review includes late leave submissions, leave-without-pay items, premium pay out of range, part-time hours out of range, and overtime hours. Any item of note during the analytical review is investigated and corrections are completed if necessary,” went the JSO reponse.
Another issue: incomplete documentation of the “custody trail” of paper checks.
The auditor’s office noted “an overall inadequate audit trail for the possession and distribution of paper checks.”
The claim was that a “master listing of the checks received from the City Payroll Office did not exist.”
No record existed of whether the checks were “successfully provided to the time and attendance staff member.”
As well, a “reliable record to identify which checks were mailed out did not exist, and details such as the mailing date, sender, and whether or not the check was delivered or returned were not documented elsewhere. JSO was unable to provide the internal log for a sample of paper checks that were dated eight months prior to our request, and presumed that the log had been purged. Further, the methodology of the internal log relied on signatures that were not always legible to identify the recipients, and did not specify which check or checks the recipient took with them. We were also informed that familiar employees were not always required to sign. Without effectively tracking the custody of paper checks, JSO may be limited in its ability to demonstrate that it has properly safeguarded the City’s assets. The lack of an effective trail could result in lost checks and provide an opportunity for unauthorized transactions.”
JSO “partially agreed.”
“The lack of an effective custody trail of paper payroll checks could result in an unauthorized transaction. However, in order for there to be an unauthorized transaction, an employee would have to commit a felony. Any crime committed by a JSO employee would be thoroughly investigated and any offense would be fully prosecuted. There is obviously a very strong deterrent to any employee conducting any unauthorized transaction involving payroll checks and there have been no criminal conduct related to payroll checks,” went their response.
Other issues included employees not having to attest to hours worked precisely, “compromised” PIN numbers that impeded security, system access for terminated employees lasting as long as 199 days after the end of employment in one case, and errors in manual timekeeping.
As well, “noncompliance with the records retention schedule,” regarding expense items such as clothing and military leave time, was another issue.
And still another issue: “several users had excessive access rights to both the JSO Timekeeping System and to the Human Resources and Payroll System.”
“There were a limited number of access groups and the range of access provided by each group setting was generally too broad. As a result, when JSO assigned a user to a group, the employee sometimes received access rights that they did not need in addition to the one or more rights they did need to fulfill their responsibilities,” the audit read.
The audit did not consider secondary employment for officers, but an audit of those practices is pending, claimed the report.
