Internal Audit Report - Audit of Human Resources Management (HRM) - Payroll Administration

Audit Observation - Opportunities to Simplify Program Design

Policies and procedures followed by INFC for the administration and processing of payroll are generally consistent with relevant federal legislation, policies, and collective agreements.

To help ensure that payroll transactions are administered and processed in compliance with Treasury Board's directives and policies and with applicable collective agreements, INFC has implemented and documented a number of policies, procedures and control activities.

Specifically, INFC has a number of human resources policies and procedural guidelines that address required staffing and classification activities, and represent the initiation point of payroll transactions. In addition, INFC has documented delegations of authorities for human resources transactions as well as for financial transactions. INFC's policies and guidelines also refer to specific acts, regulations and administrative policies with which INFC must comply. Finally, INFC has a Departmental Security Policy that defines the responsibilities of INFC personnel with respect to the safeguarding of assets as well as information and information technology security requirements. This suite of policies and guidelines helps to ensure that payroll transactions are appropriately initiated, authorized, and safeguarded in accordance with federal policies and legislation.

Under its Memorandum of Understanding with SHRS, INFC is required to comply with the policies of the Government of Canada, which include the Financial Administration Act (FAA) and Treasury Board policies and guidelines, such as the Policy Framework for the Management of Compensation, Financial Management of Pay Administration, and Pay Administration Control Framework. As a result, INFC has not documented its own internal payroll policies and guidelines, but rather relies upon relevant federal payroll policies to guide its payroll activities. Given the relatively small size of INFC relative to other departments, this appears reasonable as it reduces the duplication of effort that may result in the development and maintenance of a suite of internal payroll policies that are required to mirror federal requirements and also helps to ensure that the most up to date federal policies are referred to in practice. In addition, INFC's practice of outsourcing its payroll processing to a third party (SHRS) appears reasonable given the small size of the department and the need to process payroll in a cost-effective manner.

Based on the results of our process walkthroughs and interviews with representatives of INFC's HR and Finance and Administration divisions, we confirmed that, in general, INFC's procedures are consistent with federal requirements and are reflective of relevant collective agreements.

It was identified through our process walkthroughs and control testing that, similar to other federal government departments, INFC's release of payment batches produced by SHRS could not be readily reconciled to substantiating documentation. The Directive on Financial Management of Pay Administration requires that a process be in place to allow persons with authority under section 33 of the FAA to verify that payments are a lawful charge against the appropriation and that funds are available. The process of reconciling payment batches provided by outsourced providers to substantiating documentation is a systemic challenge across the federal government and is not unique to INFC. INFC has a number of mitigating controls in place to help ensure that payroll payments are accurate and complete, such as monthly reviews of actual payroll expenditures to plan and various reconciliations. These mitigating controls, combined with the relatively small size of the department's payroll, help to reduce the risk of inaccurate payroll payments. We encourage management to continue to remain aware of and align their procedures with any government-wide initiatives that may help to strengthen the documentation available to support the FAA section 33 approval for payroll.

Audit Observation - Enforcement of Contribution Agreement Terms and Conditions

Roles and responsibilities for payroll administration within INFC and between INFC and PWGSC are defined, documented and understood.

INFC's Memorandum of Understanding with SHRS defines the roles and responsibilities of SHRS with respect to payroll administration. These responsibilities include creating and monitoring pay and compensation files, processing pay and benefits actions, and maintaining the pension system (such as ensuring that retirement salaries are correct and forwarding appropriate information to the Superannuation Directorate). The MOU also broadly defines INFC's responsibilities as being the accountability, authority and answerability for human resources management decision making for INFC.

Within INFC, specific roles and responsibilities of various personnel involved in the payroll administration process are defined through policies and procedures, such as delegations of authority, that provide descriptions of the roles and responsibilities of the Deputy Head, the People Management Committee, Managers, and the Human Resources function. In addition, in conjunction with this audit, the payroll administration process was documented through detailed flowcharts that clearly define specific steps and procedures to be performed at each phase of the payroll life cycle and the personnel responsible for performing each activity.

Based on the results of our process walkthroughs and interviews with representatives from SHRS and INFC, we confirmed that personnel were aware of the responsibilities of both SHRS and INFC and that personnel understood their individual roles and responsibilities with respect to payroll administration. This observation is consistent with the results of the 2008 internal audit of Staffing and Classification that reported that managers appeared to have a clear understanding of their responsibilities and accountabilities and clarity with respect to roles.

Audit Observation - Assurance on the Work of the Program Delivery Partners

Controls to help ensure the accuracy, completeness, and integrity of payroll transactions have been implemented and are generally operating effectively.

INFC has designed and implemented a number of controls at various stages of the payroll cycle to help ensure the accuracy, completeness and integrity of payroll administration and processing. Key controls tested through the audit included reconciliations, controls over data entry, controls designed to detect and prevent inaccurate payments, and monitoring controls.

a) Reconciliations

Through the audit, we tested the design and operating effectiveness of a number of key reconciliation controls in place within INFC including the following:

• Reconciliation of Integrated Financial Management System (IFMS) with Control Account Balance – A monthly reconciliation of INFC's IFMS trial balance with PWGSC's PS-GL control account balance report is conducted and is reviewed by the Head of Accounting Operations.
  
  
• Reconciliation of Suspense Account Balances – As part of their monthly procedures, Financial Analysts perform a review of all suspense accounts, including payroll accounts, to ensure they are cleared of all transactions by period end. Any suspense account balances are referred to the responsible manager for resolution to help ensure the transaction is properly accounted for.
  
  
• Reconciliations of IFMS and Payroll Transactions – For the period in scope for the audit testing (fiscal 2010-2011), monthly reconciliations were performed to verify the consistency between the payroll transactions recorded in IFMS and the payroll transactions processed by SHRS. This reconciliation was a manual procedure through which INFC cost centre managers were responsible for reviewing and confirming the accuracy of the payroll data for each of their employees as provided by Finance using Excel spreadsheets. These spreadsheets were updated on an on-going basis with payroll information received from Human Resources.

Based on the results of the audit testing, no errors or exceptions were identified in the reconciliation controls. It is noted that reconciliations between IFMS and payroll transactions are no longer being performed as described above. This is due to the fact that INFC implemented the Salary Resource Management System (SRMS) at the beginning of fiscal 2011-2012 to improve the efficiency of the payroll process through increased automation. As a result, separate reconciliations between the transactions in IFMS and the transactions processed by SHRS are no longer required as payroll data is automatically downloaded into SRMS from the PWGSC pay tapes.

b) Data Entry

INFC and PWGSC perform a number of peer review and independent validation activities to verify the accuracy and completeness of payroll data. SHRS Pay Advisors review supporting documentation received from INFC's HR division for payroll transactions to help ensure that pay transactions are in compliance with the relevant federal policies prior to entering the data into the RPS. To help ensure the accuracy of this data entry, each transaction or data element entered into the RPS is subject to a peer review conducted by an independent verifier. Through the audit control testing, we observed evidence of peer reviews being conducted as required for all of our sample items.

Within INFC, employee data is entered into the Human Resources Information System (HRIS) by the HR Administrators. All data entered is reviewed by a peer and this review is documented through a sign off on the personnel file checklist. Based on the audit testing, no errors or exceptions in this control were identified.

The audit testing confirmed that peer review procedures are in place and are operating effectively for all different transaction types examined in the audit, including basic pay, acting pay, bilingual bonuses, overtime pay, maternity allowances, pay at risk, and arrears pay. The one exception to this is the entry of accumulated overtime into the HRIS, which is not currently subject to a peer review. However, Supervisors have access to their respective employee balances and transactions through HRIS and are able to review this information for accuracy. As specified in the relevant collective agreements, overtime may be compensated through compensatory leave with pay upon mutual agreement between the employee and the employer. Accumulated overtime is tracked in the HRIS by the Leave Administrator, who manually enters the accumulated overtime based on the approved time sheets. The accumulated overtime may only be carried forward for a limited time depending on the collective agreement, at which point it must be reimbursed to the employee. While the lack of a peer review of the entry of accumulated overtime increases risks related to data entry errors, it is recognized that INFC has a number of compensating controls in place with respect to the accuracy of accumulated overtime. These controls include monthly reviews of Overtime Reports by the Leave Administrator and the review of reports supporting reimbursement payments for overtime that detail the total overtime accumulated, overtime taken, and remaining balance by the Head of Corporate Services. In addition, the amounts reimbursed are typically immaterial, with a total of only $46,261.00 being reimbursed to employees in fiscal 2010-2011. As a result, this lack of peer review is considered to be of low risk to the Department.

It is our understanding that Human Resources Corporate Services is currently in the process of automating its overtime recording process. The new form is expected to enable overtime to be calculated automatically based on the entered start and end times, which should in turn reduce the potential for errors in interpreting collective agreements with respect to overtime. This process may also reduce the need for a manual peer review of accumulated overtime provided appropriate system controls are in place to safeguard the accuracy and completeness of the overtime data.

c) Underpayments and Overpayments

In addition to the peer reviews and reconciliations described previously, INFC has a number of key controls designed to detect underpayments and overpayments of payroll. In particular, cost centre managers perform monthly reviews of actual payroll data and balances against the plan to identify errors or irregularities. This review is one of the primary controls relied upon by management to detect anomalies in payroll transactions, which is reasonable given the smaller size of the department (i.e. Management is aware of significant changes in staffing and as such, is in a position to readily identify unusual variations between actual payroll costs and staffing activity).

The audit testing of key controls for sampled payroll transactions included the recalculation of payroll amounts based on the supporting documentation included in the file. We did not note any errors or discrepancies between the payroll amounts and our recalculations and/or additional supporting information provided by management.

d) Monitoring

In addition to the monthly reviews of actual against planned payroll expenditures performed by the cost centre managers, a number of controls are in place on which INFC relies to monitor the accuracy and reasonableness of payroll processing. Two such controls that were tested in the audit were:

• Staffing Log – Human Resources has implemented a staffing log to monitor and follow-up on staffing actions, including the receipt of required employee documentation. The log is reviewed on a quarterly basis by the HR Manager and the HR Operations team to review the status of transactions and to take follow up action as necessary.
  
  
• In addition and as described previously, accumulated overtime is reviewed on a monthly basis for reasonableness by the Leave Administrator and Data Quality Coordinator.

Based on the testing of these controls, no errors or exceptions were identified.

In addition to these controls, management also reviews the results of periodic quality assurance reviews conducted by SHRS. These reviews include the selection of a sample of payroll transactions for which the transactions are re-performed to verify the accuracy of the transactions, and a review is conducted to verify that pay transactions were initiated with properly authorized documentation, pay data is documented on file, and pay transactions were verified by a peer. The first of these types of reports covered the period January 2011 to June 2011.

Finally, management participates in quarterly meetings with SHRS through which any areas of concern can be discussed for resolution.

Audit Observation - Documentation

In general, payroll transactions are properly authorized and supported by appropriate documentation. One area for improvement in the retention of supporting documentation was identified.

INFC has implemented procedures to help ensure that payroll transactions are approved by an appropriate level of authority. Specifically, delegations of authority are well-defined in existing INFC documents. To help ensure payroll transactions are properly authorized, the Human Resources Advisors have on-line access to signature cards that they consult to verify that payroll transactions were authorized by an appropriate delegated authority.

As specified in the MOU, SHRS also has access to INFC's delegation for HR management authorities. We confirmed through interviews with a representative of SHRS that they also will verify that transactions have been approved by a management level which has the appropriate level of delegated authority.

Based on the audit testing of controls in place for a sample of pay transactions, we confirmed that proper approvals as required under FAA Section 34 had been obtained in accordance with INFC's delegations of authority for all sample items tested.

However, we identified a gap in the application of FAA Section 32 which requires that overtime be pre-approved by supervisors. The results of our control testing identified that this pre-approval is generally provided verbally. As a result, there is no means of verifying that pre-approval of overtime was obtained. It is noted that in all cases, appropriate approval of the payment of overtime as required under FAA Section 34 was obtained and documented on file. However, the documentation of the approval of overtime in advance of it being incurred is a sound management practice that should be in place.

The audit testing also included assessing the adequacy of substantiating documentation to support payroll transactions. The results of the testing identified that in all cases sufficient supporting documentation was provided to SHRS and was on file in support of the payroll transactions.

As specified in the MOU, SHRS is responsible for maintaining sufficient information to substantiate and support payroll transactions in the employee files. However, INFC management is ultimately accountable and answerable for its payroll transactions. As a result and as mentioned previously, we encourage management to continue to align its policies and procedures with any relevant government-wide initiatives as they occur to further strengthen its existing practices, such as by incorporating any requirement for independent assessments of the effectiveness of controls within SHRS to be conducted should such assessments be required for federal third party service providers in the future.