Loading...
Audit Report 2012-7 Parks & Recreation (Immokalee Sports Complex and Immokalee Community Center Payroll) GOy( tER C pIvT� Internal Audit Department NE CIR Audit Report 2012-7 Parks and Recreation Department Immokalee Sports Complex and Immokalee Community Center Payroll October 2012 Dwight E. Brock Clerk of the Circuit Court 3299 Tamiami Trail East Suite#402 Naples, FL 34112-5746 www.collierclerk.com Prepared by: Megan Gaillard, Internal Auditor Report Distribution: Board of County Commissioners Leo Ochs,Jr., County Manager Mark Isackson,Director, Corporate Financial&Management Services Steve Carnell, Interim Administrator Barry Williams, Director of Parks and Recreation Ilonka Washburn, Operations Manager, Parks and Recreation Annie Alvarez,Regional Manager, Parks and Recreation Len Price,Administrator of Administrator Services Amy Lyberg,Human Resources Director Jeff Klatzkow, County Attorney Connie Murray, Clerk's General Operations Manager Cc: Dwight E. Brock, Clerk of the Circuit Court Crystal K.Kinzel,Director of Finance&Accounting TABLE OF CONTENTS Background 2 Summary 4 Objectives 5 Scope 5 Scope Limitations 5 Observations, Recommendation, and Management Response 6 Other Observations, Recommendations, and Management Response 21 Conclusion 22 Additional Management Comments 22 The files and draft versions of audit reports remain confidential and protected from public records requests during an active audit under Nicolai v. Baldwin (Aug. 28, 1998 DCA of FL, 5111 District) and Florida Statute 119.0713. Work- papers supporting the observations noted within this report are public record and can be made available upon request once the final audit report has been issued. 1 The Draft Audit Report 2012-7, dated October 2012, was initially reviewed with the Departments on October 11,2012 and was released to the Department for management response on December 4,2012. BACKGROUND Events Background On April 4, 2012, approximately 10:30am, Parks and Recreation Department returned a phone call received from a job bank employee's parent. The parent reported a discrepancy with the income earned amount reported on her daughter's 2011 W2. The parent said she believed the income reported was much greater than the hours she believed her daughter actually worked for the Immokalee Sports Complex(IMSC). At approximately 10:45am, Parks and Recreation requested Human Resources investigate the issue further. Human Resources review of the time report from the payroll system showed hours worked were continuous and checks were issued accordingly. At approximately 11:00am, Parks and Recreation spoke with the job bank employee's mother to review the information obtained. The parent said it was impossible for there to be continuous hours for 2011 because her daughter had been away at college. At approximately 11:10am, Parks and Recreation contacted the IMSC timekeeper and requested the job bank employee's supporting payroll records. At approximately 11:15am, Parks and Recreation and Human Resources contacted the IMSC supervisor and timekeeper on a conference call to discuss the discrepancy. Parks and Recreation staff indicated the supervisor admitted to obtaining the job bank employee's permission to falsify the time worked records and keep the checks. Parks and Recreation Director told the employees to immediately come to the Administration Office to be questioned. At approximately 12:30pm, Human Resources contacted the Clerk's Finance Department to request additional review of the checks issued and to obtain information needed to correct a W2. At approximately 1:00pm, the Clerk's Finance Department completed review of the check history and had verified the hours entered into the payroll system were consistent with the checks issued and all checks had cleared. The Clerk's Finance Department indicated that a corrected W2 could not be issued based on the current information and recommended additional review be completed. At approximately 1:30pm, the Parks and Recreation Director, a Human Resources staff member, and the Security Chief questioned the supervisor and at approximately 2:00pm questioned the timekeeper. The Behavioral Action Plans (BAP) for the employees were completed and signed by the employees on April 4, 2012. On April 5, 2012,the Parks and Recreation Director and Human Resources Director approved the BAPs. The supervisor's BAP indicated he knowingly authorized timecards for payment for hours not worked by the employee, subsequently cashed the checks at a local business in Immokalee, and retained the money. The timekeeper's BAP indicated he knowingly entered time for payment for hours not worked by the employee, subsequently cashed the checks at a local business in Immokalee, and retained the money. On April 5, 2012, Parks and Recreation explained the set of events as follows: the location supervisor would approve the falsified timecard, the timekeeper would enter the falsified time for the job bank employee into SAP to trigger issuance of a check, the check would then be picked up from Department Administration by the timekeeper to distribute, the timekeeper or supervisor would then cash the check at a local check cashing store, and retain the money. On April 19, 2012, Internal Audit was requested by the Finance Director to complete a payroll audit for IMSC and Immokalee Community Center(IMCC) for all job bank employees who received checks to determine if this was an isolated event. 2 Process Background The payroll process begins with the Parks and Recreation Department. The location supervisor prepares an internal time schedule for the location, listing the employees scheduled to work and their scheduled hours. The employee completes a timecard for the time worked for the pay period and signs the timecard to certify the hours worked. If the employee's hours changed from the internal time schedule, the changes are noted on the original hard copy of schedule and should be retained for payroll supporting document records. The timecard is then provided to the supervisor to be reviewed,approved, and signed. Once the timecard and all supporting documentation are approved by the location supervisor, they are given to the location timekeeper (if there is no location timekeeper, the timecard is brought to North Collier Regional Park Administration for entry). The timekeeper or supervisor records the time worked from the timecard onto a timesheet.The timesheet is approved by a supervisor or the regional manager. Once the timesheet has been approved by the supervisor or regional manager, it is provided to the timekeeper. The timecards and the timesheets are reviewed by the timekeeper for accuracy. The timekeeper enters the time worked into SAP (payroll system). Timecards with problems identified are returned to the location supervisor to be corrected then resubmitted to the timekeeper. All changes to timecards during review or after the period end are to be noted on the timesheets. After the timecard information is entered into SAP,the timecards and all supporting documentation are provided to an authorized approver,typically the regional manager. The authorized approver reviews and verifies the timecards, reviews timecards to timesheets, reviews the timecard information to the information inputted into SAP, and approves the time in SAP. If there are any timecard issues, the authorized approver resolves them with the location supervisor/employee prior to approval in SAP. Timecards and all supporting documentation are then stored at North Collier Regional Park(NCRP)Administration. When the time in SAP is approved by an authorized approver, Human Resources reviews payroll for time types and the possibility of employees needing Family Medical Leave Act (FMLA) leave. Through the use of comparison reports Human Resources completes trend reviews for large variances (compared only to prior pay period). If Human Resources detects any errors,the Department is notified and must correct the issue. The Clerk's Finance Department(Payroll)conducts a time entry audit by cost center(location)for irregularities and notifies Human Resources with concerns. Finance also completes a time entry audit for all adjustments to prior period entries. Once Finance receives notification typically by email from Human Resources and Finance completes the time entry audit,Finance proceeds with the check run for all approved time. Parks and Recreation Administration picks up all checks and remunerations (direct deposit statement of earnings and deductions) from Clerk's Finance signing a log verifying the checks and remunerations have been received by the Department. Parks and Recreation Administration then has each location supervisor/ authorized representative pick up the checks and remunerations from NCRP Administration. The location supervisor / authorized representative return to their location with the checks and remunerations. The checks and remunerations are then distributed to the employees. Note: Human Resources and Clerk's Payroll do not receive timecards. Time is reviewed through SAP workflow. It is the responsibility of Parks and Recreation to ensure the accuracy of the timecards. Parks and Recreation Management Response: Staff generally concurs with the representations set forth in the narratives as appearing under "Events Background" and Process Background". However, the record should also reflect the fact that Parks and Recreation staff contacted the Sheriff's Office within one hour of learning of the situation (i.e.; immediately after conducting an initial interview with the IMSC supervisor and timekeeper). 3 SUMMARY The following audit observations were generated during the review: 1. It appears payroll theft and/or forgery has occurred and the potential for theft may still exist. 2. The time entry process lacked management oversight. 3. Parks and Recreation staff did not follow the established practices for segregation of duties for the time entry process. 4. It appears employees have been improperly paid as a result of calculation and input errors. 5. It appears Parks and Recreation has not complied with the Fair Labor Standards Act, CMA 5341, or PM002 for overtime payments. 6. Original time entry documents (i.e. employee timecards) were altered and corrections were not properly approved by employees. 7. Employees did not properly complete or sign timecards. 8. It appears employees have not been provided benefits for hours worked. 9. It appears non-exempt employees have not received meal periods, and if they receive a meal period, they have not been relieved of job duties,which is a violation of CMA 5345. 10. It appears employees hours worked were allocated to the wrong cost center. 11. Cost distribution/allocation for payroll expenditures have not been properly reviewed. 12. The timecards do not appear to match the after period adjustments made for payroll and after period adjustments lack supporting documentation. 13. Inactive job bank employees have not been terminated in a timely manner or in accordance with the job offer memorandum. 14. There is a lack of an audit trail and it does not appear the department complied with the State of Florida General Records Retention Schedule. 15. Information and/or statements provided are inconsistent. The following additional observations were generated during the review: 1. It appears the Parks and Recreation Department did not comply with CMA 5202. The Human Resources Department did not properly review the Annual County Driver Agreement for approval. It appears there is a systemic lack of supervisory and management oversight and control over the time entry process. Without a proper audit trail and review of the time entry documents, the County is exposed to errors, fraud, loss, and liability. Immediate action is needed to protect County assets and correct the time entry and submission processes. 4 OBJECTIVES The initial objectives of the audit were to: 1. Validate payments to job bank employees for the Immokalee Sports Complex and the Immokalee Community Center; 2. Determine if the endorsed check signature was consistent with timecards and the Human Resources Signature on File; 3. Determine if the department is properly implementing internal controls;and 4. Compliance with Fair Labor Standards Act, Florida State Retention requirements, County Management Agency's Policies and Procedures (CMA's), and Parks and Recreation Policies and Procedures as they relate to the audited processes. All job bank employees from IMSC and IMCC were initially selected for review. The job bank employees were then separated into job bank employees who received manual checks and job bank employees who used direct deposit. All job bank employees who received a manual check between September 18, 2009 and March 30, 2012 were selected for testing at 100%. Job bank employee timecards selected for testing were from the time period August 29,2009—March 23,2012. During review, additional exceptions were discovered. SCOPE The audit consisted of, but was not limited to review of the following: • Review of the Fair Labor Standards Act; • Review of applicable Florida Statutes; • Review of applicable Collier County CMA's; • Review of applicable Parks and Recreation Policies and Procedures; • Review of Parks and Recreation Internal Time Schedules and Job Bank Employee Timecards for IMSC and IMCC for the time period August 29,2009 through March 23, 2012; • Review of Parks and Recreation Timesheets for IMSC and IMCC for the time period August 29, 2009 through March 23,2012; • Comparison of endorsed check signatures,Human Resources Signatures on File, and timecard signatures; • Observation of the timekeeping and payroll process; • Interviews with Parks and Recreation Management, Parks and Recreation Administrative Staff, and Human Resources Staff; • Interviews with Clerk's Payroll Staff; • Validation and tracing of timecard transactions; • Comparison of hours scheduled(Internal Time Schedules),worked(timecards), and paid(SAP records);and • Comparison of timecard information to the cost center allocations. SCOPE LIMITATIONS The scope of the audit was limited to review of job bank employees who received manual checks during the testing period and worked at either IMSC or IMCC. Employees who were not selected for testing include job bank employees with direct deposit for the entire testing period, regular full time employees, and regular part time employees. When employees worked in multiple locations, only the timecards for IMSC and IMCC were reviewed, all other timecards were not reviewed for purposes of this report. An additional scope limitation was that Parks and Recreation was unable to provide a portion of the internal time schedules, employee timecards, and timesheets for the testing period. The timesheets provided were excluded from testing because they are not considered source documents. They did not contain the employee's signature or the timekeeper's signature. Testing for purposes of this audit relied on the timecards that should have been certified by the employee and the supervisor. 5 OBSERVATIONS 1) It appears payroll theft and/or forgery has occurred and the potential for theft may still exist. The Behavioral Action Plans (BAP) for the employees indicates the supervisor and the timekeeper knowingly authorized and entered time for payment for hours not worked by the employee and subsequently cashed the checks at a local business in Immokalee and retained the money. On April 5, 2012, in a conference call, Parks and Recreation explained the set of events as follows: the location supervisor would approve falsified timecards, the timekeeper would enter the timecard information into SAP to trigger issuance of a check, the check would then be picked up from Department Administration by the timekeeper to distribute, and the timekeeper or supervisor would then cash the check at a local check cashing store, and retain the money. Lack of management oversight creates the opportunity for theft / fraud. When management and/or supervisors do not properly comply with CMA's and/or policies and procedures, it creates a loose set of internal controls creating the opportunity for and the concealment of theft/fraud. Lack of supporting documentation and inconsistent records make it impossible to validate what was actually worked and reported. This leads to an environment susceptible to fraud/theft. In reviewing signature consistency of the employee timecards, Human Resource Signatures on File, and endorsed check signatures, numerous inconsistencies were noted. Inconsistencies were not limited to the identified employee. It is possible that additional employee timecards and/or the endorsed checks have been diverted. Recommendations: • This matter should be referred to law enforcement for prosecution. • The Department should implement and adhere to a strong internal control system. • Regional Managers should routinely review and validate time and employee rosters. • Employees should periodically be required to show a valid ID and sign for their check with a person not involved in the payroll process to segregate employee duties. • Job bank employees should be terminated and/or suspended from Payroll by Human Resources in a timely manner. • New employees should be required to have direct deposit to minimize the opportunity for fraud. Parks and Recreation Management Response: In response to the first recommendation, Parks and Recreation contacted the Sheriff's Office on April 4, 2012 immediately upon learning of the situation and conducting initial interviews with the ISMC supervisor and time keeper.Parks staff continues to work with the Sheriff's office in the investigation. The Department immediately recognized the need to strengthen and enhance its existing internal controls and took significant actions to that effect several months ago (May and June, 2012). Among the actions implemented to date include initiating a department wide post payroll audit of all time entries for each pay period; segregating various duties associated with collecting, entering and approving payroll time and distribution of paychecks/stubs each pay period; and providing initial re-training to all timekeeping staff. It should be noted that the formal audit of past payroll records conducted by Internal Audit spans from August, 2009 through March, 2012. Subsequent to that time period and implementing the aforementioned changes, staff has noted a dramatic decrease (88%) in the number of payroll errors and corrections per pay period. Parks and Recreation staff will be working with Human Resources to update appropriate CMAs and conduct additional re-training of staff over the next 30-60 days. 6 Human Resources Management Response: Human Resources has strengthened internal controls by requiring, as of June 1, 2012, all new employees, including newly hired/rehired job bank employees, to receive their compensation through direct deposit into their accounts. Also, following appropriate notification of the change, individuals who continue to receive a physical payroll check will have these checks mailed to their home address versus manual distribution through the department. Finally, beginning in February 2013, issuance of checks/payments will change from one week following the close of the payroll period to two weeks following the close of the payroll period. This will provide for keying of hours worked and approval of the time entries following the end of the payroll period,and eliminate the need to forecast time. Further, the Human Resources staff is working closely with Parks managers to determine which of the temporary employees continue to work routinely and to remove them from the HR/Payroll system timely upon the end of the assignment. 2) The time entry process lacked management oversight. It appears authorized approvers (typically the regional manager) did not inspect timecards when approving them in SAP. The regional manager said when they were in the field working,they did not always have timecards available for review and would call the location supervisor to verify the information in SAP was accurate, then approve the time entered without the timecard. One instance was noted where a job bank employee worked at the IMSC and IMCC in the same day. The IMCC timecard showed the employee worked from 10am-3pm and the IMSC timecard showed the employee worked from 1pm-7pm. It appears the employee reported duplicated overlapping hours. When the time entered into SAP is reviewed by the authorized approver, the original source documents should be reviewed for possible duplicated hours. Seven exceptions were noted where employees submitted two timecards for the same pay period. In some instances the timecards contained conflicting information and were signed by the same supervisor or two different supervisors. It cannot be determined which timecard is accurate because both timecards were signed and certified by the employee and signed by a supervisor. It appears the authorized approver who approved the time in SAP should have detected the error if physical timecards were reviewed. Parks and Recreation Policy PN0003 states "Supervisor Responsibilities: Must review time cards for correctness and sign both sides of the time card."It does not appear the supervisor properly reviewed timecards for accuracy or consistency or signed to approve the timecard. Timecards submitted and approved contained the following: no supervisor signature; signatures on only one side of the timecard; calculation errors; input errors; blank spaces for the pay period, week of the pay period, employee SAP #'s, employee signatures; alterations; corrections not approved by the supervisor or the employee; and illegible numbers. CMA 5311.1 states "Personnel and other County records including employment applications, accident records, work records, purchase orders, timesheets, or any other report, record applications or any other documents must be truthful and contain accurate information." Documentation provided by Parks and Recreation do not contain accurate information. There are policies and procedures in place that authorized approvers, supervisors, and/or employees are not following. When policies and procedures are not followed, it leaves the opportunity for theft/fraud, documentation discrepancies,and exposes the County to possible loss. Recommendations: • Management should thoroughly review existing policies and procedures for any changes necessary to further protect the time entry process. • Management should ensure compliance with policies and procedures. • Parks and Recreation staff should adhere to policies and procedures. 7 • Authorized approvers should always review the physical timecard prior to approving time entered into SAP. If a timecard is not available,the time should not be approved. • Authorized approvers, supervisors, and timekeepers should use due diligence in reviewing timecards. Parks and Recreation Management Response: Prior and subsequent to this incident, the regional managers and supervisors were providing management oversight of the timekeeping process, though adherence to County and department procedures was not consistent across all of the supervision groups. As a result, the manager responsible for the terminated individuals has been disciplined. In addition to the aforementioned bi-weekly post audit of payroll time across the department; Management is taking steps in coordination with the Human Resources Department to update and enhance all written procedures governing payroll time. Additional training is planned for all time keepers for January 2013 in concert with the development of a timekeeping CMA for the agency. Further, the department will standardize forms for time collection, time entry processes, and internal department methodology for entering time on source documents as well as business processes for timekeeping. Internal Audit Response to Parks and Recreation Management Response: Over the course of approximately 3 years of documentation reviewed, numerous supervisors and management lacked oversight. The issues discovered were repeated at all locations tested indicating management and supervisory weakness in monitoring the process. Our audit did not indicate this was an isolated incident with the terminated supervisors, but a broader department issue warranting full review. 3) Parks and Recreation staff did not follow the established practices for segregation of duties for the time entry process. The Parks and Recreation Department has four steps in the time entry process: 1. Location supervisor approves the employee's timecard, 2. Timekeeper enters the timecard information into the payroll system (SAP), 3. Authorized approver reviews, approves, and releases the time entered in SAP, and 4. Checks are picked up from Administration and distributed to employees. These steps should also be properly segregated not allowing one employee to complete two steps in the time entry process to maximize control. It appears the IMSC did not have proper segregation of duties to prevent, detect, and control the opportunity for theft. The timekeeper entered the hours into SAP and was responsible for the distribution of checks to employees. The authorized approver did not observe and validate the physical timecards when reviewing, approving, and releasing the time entered in SAP. Segregation of duties does not prevent collusion; however, compliance with policies and management oversight can detect and reduce the potential for collusion. Exceptions noted include: IMCC's location supervisor is the timekeeper; timekeepers have entered the time in SAP and reviewed, approved, and released time in SAP; and the regional manager has approved/signed employee timecards and reviewed, approved, and released the time in SAP. The lack of proper segregation of duties and management review enables a person and/or persons to perpetrate and conceal a fraud and/or theft. Recommendations: • The Department should create, implement, and adhere to a policy for segregation of time entry process job duties. • Employee rosters should be routinely reviewed by an independent party. Parks and Recreation Management Response: As the audit reports states, the segregation of duties does not absolutely prevent the possibility of collusion that occurred in this instance. Nonetheless,the Department recognized the need for further segregation of the time entry process upon discovery of the discrepant information in April 2012. Accordingly, the department 8 shortly thereafter implemented a standard operating procedure that requires segregation of duties as follows: 1. Those who authorize time are separate from those who enter time. 2. Paychecks/stubs are picked up on payday by a third employee who neither performs time entry nor time approval. 3. In addition, all new and re-hires are now paid by direct deposit effective 6/1/12, further reducing the potential for fraud or theft. Human Resources Management Response: The Human Resources Department now requires newly hired employees to receive their compensation through direct deposit and, for employees still receiving manual checks, upon appropriate notification of the change, the County will initiate a process of mailing checks directly to employees' home address of record to ensure only the employee receives the check and in order to avert future possibility of theft. 4) It appears employees have been improperly paid as a result of calculation and input errors. Parks and Recreation Policy PN0003 states"Supervisor Responsibilities: Must review time cards for correctness."It does not appear the supervisor properly reviewed the timecards for hours recorded. There were 639 time entry errors detected-303 from input errors,330 from calculation errors, and 6 from other errors noted in the review. Exceptions were noted where it appears the timekeeper input the timecard hours into SAP inaccurately and the supervisor/authorized approver did not discover the error. The timecard and the time entered into SAP appear inconsistent. It appears the input errors have recorded employees working more hours than shown on the timecard or the employee has been paid for more hours than worked. Exceptions were noted where the timecard was not properly calculated for the actual daily hours worked, indicating the employee may have been improperly paid. Employees should carefully review their timecards for accuracy prior to submitting them for review. Supervisors and authorized approvers should properly review timecards for accuracy and consistency with SAP. Without proper review and management oversight,employees may be under or over paid exposing the County to a liability or loss. Recommendations: • Authorized approvers should always review the physical timecard prior to approving time entered into SAP.If a timecard is not available,the time should not be approved. • Parks and Recreation staff should be trained on policies and procedures. • Authorized approvers should use due diligence in reviewing timecards and not approve timecards that are not approved by employees and supervisors. • Supervisors and authorized approvers should validate timecards are properly calculated. • The County should review and determine if there is a liability to employees for hours worked and not paid and for employees paid for hours not worked. Parks and Recreation Management Response: In June, 2012, the Department established a central, ongoing post-audit of payroll records for each payroll period to ensure standardization of time entry. This centralized post-audit includes: 1. Schedules for all cost centers in the department are posted and maintained electronically 2. Time cards are matched to the schedules 3. Time cards are matched to what has been entered into SAP 4. All entries are checked for completeness (e.g.; appropriate signatures, inclusion of leave slips, proper coding,etc.) 5. The Program Supervisor and Regional Manager are contacted immediately if any discrepancy is uncovered. 9 6. A log is kept that details the audit and filed for each pay period. 7. All new and re-hires are now paid by direct deposit only In the months following the implementation of this change, the Department, has noted that the payroll entry error rate has been reduced by 88%. Further,when errors are detected, they are promptly corrected in the next pay period. To further reduce the occurrence of time entry errors, new procedures will be formally memorialized through a CMA outlining employee,supervisor,timekeeper and time approver responsibilities, retraining efforts and ensuring that CMA guidelines are followed related to time card entries. Human Resources Management Response: Human Resources Department staff will work with Parks and Recreation to assist where needed in the review process, and where corrections are warranted, to provide notices to employees related to over- or underpayments. This will include requests through Finance to cut checks for payments to employees who were underpaid. Internal Audit Response: Responses appear to minimize the amount and severity of the problem. The audit was a limited scope audit representing 25 job bank employees at 2 Parks and Recreation locations. A total estimated calculation has an absolute variance of$24,496.05 based on under/over payments reflected by time recorded on the employee timecards is $13,746.97 for under payments and $10,749.08 for over payments. If the limited scope problem is pervasive and persistent, the potential additional amount of improperly paid employees could be significantly larger. 5) It appears Parks and Recreation has not complied with the Fair Labor Standards Act, CMA 5341, or PM002 for overtime payments. The Fair Labor Standards Act (FLSA) states non-exempt employees must receive overtime pay "at least 1 'h an employee's regular rate of pay for all hours worked over 40 in a workweek." It appears employees exceeded a 40.0 hour work week and did not receive an overtime pay rate. In some instances employees appear to have been paid regular hour rates instead of overtime rates. CMA 5341 states "except in emergency situations, all overtime must be approved in advance by the Department Director." Parks and Recreation Policy PM002 states "All overtime request need prior approval from the Regional Manager or Director." It does not appear the Parks and Recreation Director or Regional Managers approved employees working more than 40.0 hours in a work week. There were 90 overtime errors detected — 9 from input errors, 77 from calculation errors, and 4 from employees working multiple locations. It does not appear the supervisor or authorized approver properly reviewed the timecards for hours entered into SAP, proper calculation of timecards, or monitored employees working multiple locations,resulting in employees exceeding a 40.0 hour workweek. Exceptions were noted where it appears the timekeeper inaccurately input the timecard hours into SAP and the supervisor/authorized approver did not discover the error. The timecard and the time entered into SAP appear inconsistent. It appears the input errors have recorded employees working less hours than certified and approved on the timecard. Exceptions were noted where the timecard was not properly calculated for the actual daily hours worked, indicating employees were not paid for overtime hours worked. Exceptions were noted where the employees appear to have worked at multiple locations without proper monitoring by the supervisors, timekeepers, or authorized approvers. It appears the timekeeper input hours exceeding 40.0 hours for the work week without changing the wage type to overtime. It appears the final approver (manager) approved the time entered into SAP without discovering time was entered as regular hours worked when more than 10 40.0 hours were in the system. It also appears Payroll overlooked location errors when completing their payroll audits. Management does not appear to have properly approved overtime.Authorized approvers(regional managers)and/or supervisors do not appear to have monitored employees working in multiple locations, properly reviewed timecards, or properly reviewed time entered into SAP. Non-compliance with FLSA can lead to grievances, federal audits, and/or litigation. The County may have a liability to employees for wages improperly paid or for hours worked and not paid. Recommendations: • Management should properly approve overtime hours. • Authorized approvers and timekeepers should properly review time entered into the payroll system for wage type. • Managers and/or supervisors should monitor the hours worked by employees who work at multiple locations. • County staff should adhere to FLSA,CMA 5341, and PM002. • The County should determine if there is a liability to employees for overtime for hours worked and paid at the wrong wage type or for hours worked and not paid. • The SAP configuration should be reviewed to ensure maximum system controls are implemented. Parks and Recreation Management Response: The Parks and Recreation Director has been and will continue to be responsible for authorizing all overtime for the Department. Employees are generally provided compensatory time in lieu of overtime. Payroll time for part time employees who work additional hours, but less than 40 hours per week is coded as overtime, but paid on a straight time basis. Upon completion of this audit, the Director will request the audit detail from Internal Audit and review all data in question to determine if all time was/was not paid properly. Staff does not anticipate that this exercise will uncover significant unpaid balances. Additionally, the Department will establish a Standard Operating Policy to address job bank employees being used in multiple locations/roles no later than January 2013. Staff will be trained on policy prior to seasonal employment of job bankers for the Summer of 2013. Human Resources Management Response: The organization, in compliance with FLSA, must pay overtime or, when appropriately noticed in advance, provide the equivalent number of hours of compensatory time to eligible employees whose work hours exceed the 40 hour work-week threshold, regardless of whether it has been pre-approved by management. Human Resources is able to provide training to managers, supervisors or other Parks staff members regarding the requirements of FLSA and County CMAs to ensure they understand their roles and responsibilities and can successfully administer these functions of their jobs. Human Resources will work with Parks and Recreation on any necessary corrections that come out of the timecard review process. SAP enhancements in the area of timekeeping/time approval are on the organization's roadmap for future consideration,at such time as appropriate funding and other resources are available for the project. Payroll Management Response: We agree that our manual review did not detect these input exceptions. We concur that additional reporting and/or configuration of the SAP system that could enhance system alerts should be reviewed. We are exploring additional measures to enhance input alerts to the department and improve our ability to detect payroll exceptions, providing a stronger review of department input including: 1. A preventative control, which would alert the departments timekeeper when the time is entered, if more than 40 hours in a week have been input without an overtime time type being used 2. A detective control, consisting of a report being run after all time has been entered, that would alert us if an employee had more than more than 40 hours worked in a week without an overtime time type being used 11 3. A reformatting of the time display in the SAP CAT2 transaction,to show subtotals by week in addition to the totals per 2-week pay period. This would make it more obvious if time worked exceeded 40 hours in a week. Internal Audit Response to Parks and Recreation Management Response: :responses appear to minimize the amount and severity of the problem. The audit was a limited scope audit representing 25 job bank employees at 2 Parks and Recreation locations. An initial estimated calculation of unpaid overtime reflected on the employee timecards is $3,395.14. While the value may not be considered material for financial statement purposes, the lack of controls for review and calculation for overtime can lead to more significant issues relating to financial statement reporting and controls,FLSA,and/or grant compliance. If the limited scope problem is pervasive and persistent, the potential additional amount of improperly paid employees could be significantly larger. 6) Original time entry documents (i.e. employee timecards) were altered and corrections were not properly approved by employees. Parks and Recreation Policy PN0003 states "Corrections may be made on the time cards. All corrections must be initialed by the employee.Cross out and correct, do not use white out." It appears employees and/or supervisors used white-out to make corrections to original employee timecards. When white-out is used on a document, it makes it impossible to determine what information was changed. Corrections were not initialed by the employee to accept changes made to their timecards. It cannot be determined who altered the timecard or the reason for the alteration when the employee and/or the supervisor do not initial the changes. When timecards are altered without proper approval or authority, the integrity of the timecard/information is compromised. Unauthorized alterations circumvent the controls in place that ensure the accuracy and legitimacy of reported time. This can cause the under or over payment of an employee and/or discrepancies in the submitted timecards. Recommendations: • Policies and procedures must be followed by the supervisor and employees. • Supervisors should review all timecard changes with the employee and the employee should initial all changes. • Timecards with changes and without the employee's initials should not be entered into the payroll system by the timekeeper without proper validation. Parks and Recreation Management Response: The Department decentralized the time keeping process in 2007. This was done to ensure park supervisors were responsible for their respective employees' time and to compensate for diminishing administrative resources. The alterations on the time cards were the result of correcting projected time that had originally been submitted in advance in order to meet the payroll period deadlines in question. In May, 2012, all supervisors were re-trained on the requirements of time card entry and review. In June 2012, the department implemented an internal post pay period audit of each payroll submission. Through these changes, the Department has identified and effectively eliminated errors related to proper completion of time cards from that time forward. The Department is further standardizing the time keeping process and will retrain staff on these forthcoming changes in January 2013. 12 Human Resources Management Response: The Human Resources Department is leading an effort that will shift the schedule on which employees will receive their pay that will begin in February 2013, incrementally moving the day on which paychecks are issued over a period of five pay cycles. This will result in employees receiving payments for hours worked two weeks following the close of a pay cycle, compared to the current system of one week following the close of the cycle. This change enables departments to complete a payroll period and report hours worked in real time, eliminating the need for Parks and Recreation and all other County departments to estimate time worked for hours beyond the current submission date for time cards and leave slips. Internal Audit Response to Parks and Recreation Management Response: In numerous cases for the audited time period, timecards submitted contained alterations for actual time worked, not only the time submitted in advance as estimations. Regardless of the pay period schedule, all time should be reviewed for accuracy. 7) Employees did not properly complete or sign timecards. Parks and Recreation Policy PN0003 states"Each employee will be responsible for recording his/her own in and out work times on a daily basis." It appears supervisors have not required employees to complete timecards on a daily basis. It appears that employees have not properly completed timecards. Timecards submitted and approved contained the following: incomplete information for the week and pay period, inaccurate SAP#'s or no SAP#, blank information for hours worked,miscalculated hours,alterations,and blanks for the employee's name. Timecards contained conflicting information. One exception noted the employee recorded the time-out for meal period at 2pm and recorded the time-in for returning from the meal period at 1pm. Such inaccuracies lead to miscalculation of hours paid. Parks and Recreation Policy PN0003 states "Employees must sign both sides of the time card." It does not appear employees have always signed their timecards or both sides. When employees do not certify and sign approving the timecard, the timecard is unreliable. This can cause discrepancies between documentation, inaccurate payment of hours worked or overpayment for hours not worked, or allocation of hours to the wrong person or period. Care should be used when completing timecards to ensure employees receive proper payment. Recommendations: • Incomplete timecards should not be accepted by the supervisor or timekeeper. • Employees should be daily recording time worked. • Employees should be trained to properly complete a timecard according to policy and procedure. • Supervisors should review timecards to ensure they have been properly completed and certified. • Timekeepers and authorized approvers should review information to ensure proper approvals are in place and the time is accurately calculated. Parks and Recreation Management Response: From the time period of August 29, 2009 through possibly as late as May, 2012, the Department acknowledges that there were instances where employees did not sign both sides of the time card and instead relied on signing the card on one side as sufficient. Effective June, 2012, the Department implemented a post-audit of its payroll process. Through this process, the Department has identified and effectively eliminated errors related to proper completion of time cards identified in the audit report. 13 The Department is further standardizing the time keeping process and will retrain staff on proper completion of time cards and record keeping in January 2013. Internal Audit Response to Parks and Recreation Management Response: In numerous cases for the audited time period,both sides of the timecards were unsigned by the employee. 8) It appears employees have not been provided benefits for hours worked. 25 job bank employees were tested and it appears three employees had two employee SAP(ID #)numbers(12% of the population tested). Each employee has one SAP number as a regular part time employee (20 hours per week with benefits) and a second SAP number as a job bank employee for any additional hours worked above 20 hours per week(without benefits). Two regular part time employees received straight time overtime rates for additional hours worked in excess of the allotted 20 hours per week. Straight time overtime rates pay the employee the regular hourly rate and the FRS pension benefits,but do not accrue paid time off and are not used when computing holiday pay. Employees who are regular part time employees accrue vacation and sick time, personal time, receive holiday pay (a percentage of the hours worked), health benefit rates, and FRS pension plan benefits based on the hours worked. As employees work more hours each week,they would accrue additional benefits. It appears by paying an employee as a job bank employee (without benefits) or at straight time overtime rates when they were hired as a regular part time employee with benefits, may create inconsistent application of benefits and the employee may not have received benefits that have been earned for the additional hours worked. This could expose the County to possible grievances and/or litigation. It also could result in County liability to the employee for benefits that were earned and not paid. Recommendations: • Employees should not have two active SAP numbers. • Human Resources should review all employees for two SAP numbers and correct exceptions. • All hours worked should receive appropriate benefit allocations. • The County should review and determine if there is a liability to employees for benefits not paid. • The County should have a policy to address regular employees working additional hours for seasonal / temporary positions and programs. Parks and Recreation Management Response: During the audit period in question, the Department used job bank employees as well as regular part time employees for seasonal employment related to summer programming, resulting in these individuals being assigned two SAP numbers. The Department concurs with the recommendation to discontinue this practice and no longer does so. Care is provided to ensure that employees who are working at or close to 40 hours are provided all appropriate benefits. Past practice of individuals working one permanent part time position and another temporary part time position has raised benefit compensation questions. Employees who are permanent part time and work another temporary position, typically in the summer,will be identified and compensated if required for FRS benefits. Human Resources Management Response: We have discontinued the practice of allowing an individual to be employed under two different SAP ID numbers in the same agency, and do not have any employee who is actively working anywhere in the agency under two numbers. Human Resources will initiate a review of existing CMAs to determine if modifications are warranted in addressing additional hours worked for part time employees. 14 Internal Audit Response to Parks and Recreation Management Response: All applicable benefits such as accrued leave or other benefits should be reviewed in addition to FRS benefits. 9) It appears non-exempt employees have not received meal periods, and if they receive a meal period, they have not been relieved of job duties,which is a violation of CMA 5345. CMA 5345 —Work Hours states "Meal Periods: An unpaid meal break of at least 30 minutes, but not more than 60 minutes, shall be given during the workday. Nonexempt employees are prohibited from performing work during their meal break." Exceptions were noted for non-exempt employees not receiving meal periods and not being relieved of job duties when a meal period is provided. Parks and Recreation's explanation was that non-exempt job bank employees who worked as summer camp counselors or lifeguards were required to be on-site to supervise the children. Employees were either provided a meal period on rotation or were unable to be relieved of their job duties because the children required assistance or supervision. The exceptions were noted for all types of job bank employees not limited to childcare or lifeguard positions. It does not appear employees have been provided meal periods. It does not appear job bank employees have been provided relief from job duties for meal periods. It appears the department is not compliant to CMA 5345. Recommendations: • Employees should be provided meal periods in conformance with CMA 5345. • The County should review and determine if CMA 5345 should be revised for changes in operations/procedures. Parks and Recreation Management Response: The Department generally affords meal breaks to employees, excepting only in instances where it is not logistically feasible. Employees associated with child care programs are unable to take meal periods according to existing CMA's due to operational needs and in the case of summer camp counselors who eat with the children as a part of the programming. This practice is consistent with and permissible under FLSA standards. The Department will work with Human Resources to establish a written policy concurrent with Park and Recreation operational needs. Human Resources Management Response: Human Resources will review the existing language of the CMA, propose changes as necessary to meet organization needs. 10) It appears employees hours worked were allocated to the wrong cost center. Exceptions were noted indicating the timecard information and the cost center allocation for payroll expenses were inconsistent. The timecards provided indicated the employee worked at one location while the expense was allocated to a different location. The timecards contained no notations to indicate the employee worked at another location. Exceptions were noted for employees who appear to have worked at the IMSC, had a timecard provided by IMSC, and approved by the IMSC location supervisor. This indicates the employee worked at IMSC. The timecard contained no notations to indicate the employee worked elsewhere. The timekeeper input the hours to IMCC. It appears the timekeeper entered the hours to the wrong cost center. It cannot be determined where the employee physically worked because the timecards and information in SAP are inconsistent. When the department was asked, they were unable to provide an answer. The department said it was possible this was an input error or it was possible SAP was accurate and the timecard should have had a notation. It appears this may not comply with accounting cost matching principle—expenses incurred by a location should be allocated to the same location. This may cause financial information to be inaccurate. When budgets are created, they rely on the information from prior year's financial information. If the financial information is inaccurate, the budget may not have the funds necessary to cover the location's expenditures. If a location does not have funds 15 available for additional staff, budget amendments should be completed to ensure accurate cost matching by location/cost center. Recommendations: • Payroll expenses should be allocated to the cost center/location that incurs the expenditure. • Timecards should contain sufficient information or have supporting documentation to be able to determine the physical location where the employee worked. • Timekeepers and authorized approvers should properly review the time entered in SAP to ensure it is consistent with the timecard. Parks and Recreation Management Response: The Department concurs that Payroll expenses should be debited against the appropriate cost center(s) and that these hours should be properly documented. It appears that the problem identified under this finding primarily pertains to instances where job bank employees were working at multiple locations during summer camp or after school programs or in lifeguard positions. The Department will work with the Human Resources Department to develop a procedure that will account for a job bank employee working in multiple cost centers. 11) Cost distribution /allocation for payroll expenditures have not been properly reviewed. In SAP (payroll system) the highest allocation level for posting payroll expenditures is the IT27 cost distribution. When IT27 master data is entered into SAP for cost distribution / allocation, the salary expenditure will automatically post to the cost center recorded in the IT27 record. IT27 cost distribution is not a required entry. When a timekeeper enters hours worked from the timecard into SAP,the information is entered into the CAT2 time entry screen with the receiving cost center / WBS Element information. This entry should reflect the physical location where the employee worked. The SAP posting hierarchy is as follows: 1)IT27 Cost Distribution/Allocation 2)CAT2 Time Entry. When there is conflicting information between the IT27 cost distribution / allocation and the CAT2 time entry, SAP will post according to the IT27 cost distribution/allocation. Two exceptions were noted where the employees CAT2 time entered reflected time actually worked at North Collier Regional Park (Cost Center 156314), but the time was posted to the Immokalee Sports Complex (Cost Center 156349)because the employees had an IT27 cost distribution/allocation. In this case SAP posted according to the IT27 cost distribution/allocation. When employees rotate between multiple locations, there should not be master data entered for an IT27 cost distribution/allocation because it will then cause time to be allocated to the wrong cost center. Expenses incurred by a location should be allocated to that location. This may cause financial information to be inaccurate. Recommendations: • The IT27 cost distribution / allocation master data should be removed from all employees who work across multiple locations. • The department should review budget to actual reports to ensure salary expenditures are allocated to the appropriate cost center. Parks and Recreation Management Response: The department concurs with the recommendations set forth herein and will work with the Human Resources Department to ensure that proper coding entries are used for all payroll time submissions. Human Resources Management Response: Human Resources will provide periodic reports to Parks to review cost distribution records,inclusive of their start and end dates, if applicable. Prospectively, no entries will be made for job bank Parks and Recreation 16 new hires or rehires for IT27 Cost Distributions; the department will be responsible to key the appropriate cost center when making time entries each payroll period. 12)The timecards do not appear to match the after period adjustments made for payroll and after period adjustments lack supporting documentation. Parks and Recreation Policy PN0003 states "End of second week hours are estimated. Any changes in actual hours worked for the remainder of the week are reflected in the next pay period. A notation is made in red ink on the time sheet for the hours to be changed." The original time cards provided by Parks and Recreation do not have notations for changes completed. A few exceptions were noted where the timecard actual hours worked that are not estimated when the timecard is submitted (i.e. Week 1 hours) should have been entered as "actual time worked" were entered after the pay period ended. Entries after the end of the pay period were for additional hours worked or time-off including vacation, sick, or personal time. A few exceptions were noted where additional hours worked were entered in SAP after the end of the pay period that are not consistent with the timecards certified by the employee and supervisor. Authorized approvers should review entries after the end of the pay period with additional scrutiny to ensure that internal controls are not being circumvented. All timecards should be reviewed by the employee, supervisor, timekeeper, and authorized approver to ensure time entered into SAP and timecards contain the same information and supporting documentation. It appears that employees may have been overpaid for hours entered into SAP after the end of the pay period. Recommendations: • All entries should be supported by appropriately calculated and approved documentation. • Timecards should be consistent with adjustments to payroll for after period entries. • Supervisors should review after period adjustments prior to entries being entered into SAP for payment. • Authorized approvers should review after period adjustments and timecards prior to approving the time entered in SAP. Parks and Recreation Management Response: The introduction of an internal post-audit has enabled the Department to identify and eliminate variations in actual time worked versus projected time entries. The agency wide plan to increase the time between the end of each pay period and each pay day will effectively eliminate this problem altogether. In addition, The Department is standardizing the time keeping process and will retrain staff on proper completion of time cards and record keeping early in 2013. Human Resources Management Response: The 2013 change in how the organization issues check/earnings payments will eliminate the need to estimate time in the second week of the payroll period, virtually eliminating the need for prior period corrections. Human Resources will support Parks and Recreation in the retraining of their employees on time card completion and other necessary updates. 13) Inactive job bank employees have not been terminated in a timely manner or in accordance with the job offer memorandum. Human Resources provide a job offer memorandum to new employees who sign and agree to the following: "if I do not work a shift for 90 days (concessions/childcare) or 120 days (lifeguard), my employment with Collier County will terminate." It appears inactive job bank employees have not been terminated in a timely manner or in accordance with the job offer memorandum. Ten SAP numbers (some job bank employees had two SAP numbers and both were used for testing)were tested for termination dates. Four SAP numbers(40%of the population tested)were not terminated when inactive. 17 An example of this is a job bank employee who last worked on September 30, 2011 and should have been terminated for inactivity no later than December 30, 2011 (90 days). The Human Resources Department listed the assignment end date as November 1,2011, but did not complete the termination in SAP until June 26,2012. Nineteen current job bank employees were tested for inactivity periods. One current job bank employee had an inactivity period of greater than 120 days without being terminated(approximately 5.3%). One exception was noted for a job bank employee who last worked on December 27, 2011 and should have been terminated no later than April 25, 2012 (120 days) for inactivity. The next pay period the employee worked was in mid-May 2012. It appears the Human Resources Department should have terminated the employee for inactivity. Terminating employees immediately at the end of an assignment through Human Resources is an internal control. Retaining inactive job bank employees can create the opportunity for fraud/theft. By properly terminating inactive employees, it lowers risk. Recommendations: • The County should have a policy to immediately inactivate or terminate inactive employees. • All periods of inactivity should be documented and reviewed by Human Resources. • All job bank employees should be reviewed for inactivity and appropriately terminated if the employee has been inactive or put on a no pay/inactive status. Parks and Recreation Management Response: The hiring and screening of each employee is a labor intensive and costly process. As such,the Department is not prepared to implement a policy where all temporary employees are terminated and immediately removed from the system at the end of a given assignment as the department may need to re-deploy one or more of them in the near future. The Department will work with the Human Resources Department to fully implement a policy where all job bank employees are identified with the Personnel Action Report (PAR) with an ending date on the PAR. Extensions will only be granted with the submission of a new PAR. Human Resources Management Response: Reviewing a temporary employee's time records for last date worked and last payment received is currently a multi-step process. We will work with SAP programmers to determine if a single report can be created to facilitate review of active job bank staff members to show last date worked and last check received. This will be used as a review tool for both Human Resources and Parks and Recreation employees for individuals currently employed by the agency,allowing us to take appropriate action at the prescribed times. Human Resources will ensure that all newly hired or rehired job bank employees have two PARS — one for their hiring action, and a second for their separation at the end of their assignment. The department will not process the action until both documents are received. Internal Audit Response to Parks and Recreation Management Response: The Internal Audit Recommendation did not include immediate removal of inactive employees from the system, but immediate inactivation to prevent unauthorized payments. Continuing inactive employees as an active employee,even for one pay period,enables unauthorized payments. 14) There is a lack of an audit trail and it does not appear the department complied with the State of Florida General Records Retention Schedule. The State of Florida General Records Retention Schedule for State and Local Government Agencies provided for the minimum retention periods as set forth by federal and state regulations, general administrative practices, and fiscal management principles. The records retention schedules are issued by the Department of State in accordance with statutory provisions,Florida Statute Chapter 119 and 257. 18 Item 195 Payroll Records: Supporting Documents states "This record series consists of, but is not limited to, time sheets/cards and certification reports signed by the supervisor approving hours worked by employees, correction forms to rectify errors in payroll processing,pay lists used to verify the payroll certification report, and other related supporting materials." Retention for record copies is "3 calendar years provided applicable audits have been released." Parks and Recreation was unable to provide portions of the requested documentation. 132 internal time schedules were requested from IMSC, 47 were received, and 85 were not received (64%). 134 internal time schedules were requested from IMCC, 127 were received, and 7 were not received(5%). 949 timecards were requested from IMSC and IMCC, 652 were received,and 297 were not received(31%). Parks and Recreation Policy PN0003 states "Supervisor Responsibilities: Time from the time card will be recorded on time sheets." 67 timesheets were requested from IMSC, 32 were received, and 35 were not received (52%). 67 timesheets were requested from IMCC,22 were received, and 45 were not received(67%). Internal time schedules, timecards, and timesheets do not appear to have been properly retained by the department or were not provided by the department for review and testing. Employee records cannot be fully validated because there is inadequate documentation. Without a proper audit trail, the County may be in violation of Florida Statute and may not have properly paid employees. Proper records must be available to document activity. Recommendations: • Parks and Recreation should retain payroll documentation according to State of Florida General Records Retention Schedule. • Timesheets should be signed by the preparer and retained as supporting payroll documentation or the policy should be updated to reflect different practices used in operation. • Policy should be reviewed and updated for duplication of automated controls. Parks and Recreation Management Response: The Department does require records be kept in accordance with Florida Statutes. Personnel associated with payroll discrepancies at Immokalee Sports Complex have been terminated from County employment. With the initiation of an ongoing internal payroll post audit in June, proper records are checked for accuracy, completeness and are centralized at the administrative offices of the Parks and Recreation Department. These records are properly retained and available for review. Internal Audit Response to Parks and Recreation Management Response: Mi: .ng records we not isolated to Immokalee Sports Complex. Based upon the audit, all locations should be consistently reviewed for proper records retention. 15) Information and/or statements provided are inconsistent. Statements in the Behavioral Action Plans (BAP) do not appear consistent with statements from Parks and Recreation staff. The BAPs are inconsistent with Parks and Recreation staff's documented recollections of the attendees present for the initial conference call and the second conference call.Accurate records are critical when interviewing people for suspected fraud/theft. If a person's name is not in the written record, valuable information may be lost if all attendees do not document their recollection of events. 19 The BAPs indicate a Human Resource staff member was present for the interviews but do not specify who was in attendance. When acts of this nature occur, as many details as possible should be included in final documentation to ensure the records are thorough and accurate. The BAP for Joseph Boney, Supervisor, indicates "As a result of the conference call, and with Joe and Michael being unable to explain the discrepancy..." This is inconsistent with Parks and Recreation staff recollection of events. Parks and Recreation staff's documented recollections indicate Joseph Boney had spoken to the job bank employee and obtained her consent to enter false time into SAP and cash her paychecks for himself. He, also, reportedly indicated he had admitted to having financial issues with his house. The endorsement on the check issued 1/6/2012 to the job bank employee was deposited into the job bank employee's account and appears suspect: 1. The endorsement signature appears inconsistent with the job bank employee's signatures on file; 2. There is no timecard for the job bank employee for the time period; other employees had timecards available for the time period; and 3. Two employees documented Joseph Boney's statement that the job bank employee consented to the payroll arrangement. CMA 5311.1 "An employee who intentionally lies during an internal investigation or otherwise impedes the County's ability to properly conduct an internal investigation may be subject to disciplinary action up to and including discharge." The BAPs appear to lack a detailed accounting of the events that occurred. Detailed accountings and recollections of events should be documented at the time of incident to prevent poor recollections of events or discrepancies between records of event. Documentation should be thorough and approved by all parties present to ensure accuracy. Recommendations: • The County should have a policy for how events are documented. • Incidents should be properly documented at the time of the incident to provide an accurate record of events. Parks and Recreation Management Response: Department staff documented the initial facts as known in the BAP and confronted the employees who in turn immediately confessed to committing serious crimes. As a result, management recommended both for termination of their employment immediately thereafter and referred the matter to the Collier County Sheriff s Office (CCSO). Given that the matter appeared criminal in nature, the Department did not seek to investigate further at that time in order to protect the integrity of the CCSO's investigation. Statements made by others were not considered as part of the disciplinary process; however,the Department will work with the Human Resources Department to formalize processes for investigation of allegations of impropriety in the work force. Human Resources Management Response: The Department will work to formalize processes for internal investigations,including investigations for allegations of impropriety in the workplace,and provide appropriate education to Human Resources staff members conducting investigations. Internal Audit Response to Parks and Recreation Management Response: All statements made during a review or investigation may be relevant and should be documented. 20 OTHER OBSERVATIONS 1) It appears the Parks and Recreation Department did not comply with CMA 5202. The Human Resources Department did not properly review the Annual County Driver Agreement for approval. CMA 5202 Annual County Driver Agreement states "the Directors will acknowledge the agreement by signing in the space provided."The director is required to sign each employee's Annual County Driver Agreement authorizing the employee to drive a County vehicle. One exception was noted when reviewing Annual County Driver's Agreements for signature comparison. It was noted on an Annual County Driver Agreement that the employee appears to have properly signed and dated the agreement, but the department director does not appear to have signed approving the agreement. Department Directors are required to approve each employee who drives a County vehicle in the course of business to ensure the employee is an authorized driver and proper training was received. It does not appear that the Human Resources Department properly reviewed the Annual County Driver Agreements for approvals. Without proper approval, the employee may not be authorized to drive a County vehicle, which could impose liabilities on the County. Recommendations: • Department Directors should properly approve all Annual County Driver Agreements. • Human Resources should review the Annual County Driver Agreements to ensure proper approval was obtained, lists are current, and driver's license information is accurate. • Human Resources should review all current Annual County Driver Agreements to ensure there are not additional exceptions. Parks and Recreation Management Response: The Parks and Recreation Human Resources Technician shall be assigned the task of ensuring all drivers have this form completed each January,in accordance with the CMA. Human Resource Management Response: In accordance with CMA 5202, Annual County Driving Agreement, County employees will be submitting new agreements in January 2013. Upon submittal to Human Resources for filing in the personnel file, these agreements will be reviewed. If they have not been properly completely, the forms will be returned to the Department Director with a memorandum of explanation and request to make the proper corrections. 21 CONCLUSION It appears there is a systemic lack of supervisory and management oversight and control over the time entry process. Without a proper audit trail and review of the time entry documents, the County is exposed to errors, fraud, loss, and liability. Immediate action is needed to protect County assets and correct the time entry and submission processes. Audits do not relieve management of their responsibilities. As a reminder, it is the ultimate responsibility of management to understand and implement the proper processes and proper controls to comply with the Fair Labor Standards Act, Florida Statute, County CMA's, and Department Policies and to limit the risk of fraud, error, and misappropriation of County assets. The Clerk's Office may suggest recommendations in audit reports, but it is the ultimate decision of management to formulate and implement controls for operations. Additional Recommendations: • The Department should confirm and ensure all employees being paid are active employees. • Training should be provided to County staff to ensure they understand the policies, procedures, and payroll forms. • All County Departments should review their time entry processes and validate adherence to FLSA, CMA's and Department Policies and Procedures. • The Parks and Recreation Department should be reviewed for all locations, including but not limited to, using job bank employees(review should be completed by Parks and Recreation). Additional Parks and Recreation Management Comments: The Parks and Recreation Department recognizes the severity of the theft by the two former employees. While, the theft associated with the Immokalee Sports Complex is viewed as an isolated incident; its occurrence has established the need for strengthening existing controls within the department. To this end, the Department has taken several steps to strengthen controls in response to the incident including: • Retraining staff(May 2012) on proper time keeping processes. • Hiring staff (June, 2012) to post-audit all payroll time submissions to ensure proper documents are retained, information is entered correctly and corrective action is taken immediately with any discrepancies. It should be noted that the department has documented an 88% reduction in the error rate as a result. • Requiring all new job bank employees to receive direct deposit The Department continues to work on further standardizing payroll reporting procedures and forms and will be delivering additional training to appropriate staff in January 2013. Additional Human Resource Management Comments: Human Resources staff responded immediately in assisting with recommendations to the department,as well as taking steps to require all new employees as of June 1,2012 to receive earning payments via direct deposit. We began discussions on moving the pay date as well to eliminate the need to estimate working times,with a projected implementation date of February—April 2013. The Department is currently in the process of changes to our service delivery model,ensuring our customer needs are met,and there will be additional Human Resources staff members focused specifically on training activities. We will conduct a needs assessment with Department management in early 2013 to determine appropriate training activities. Internal Audit Comments: Internal Audit gratefully acknowledges the cooperation and assistance from the Parks and Recreation staff, Human Resources, and Clerk's Finance staff. The assistance provided by the departments greatly assisted Internal Audit in the audit process. 22