Internal Controls Surrounding the Payroll Control Cycle

1. Internal Controls Surrounding the Payroll Control Cycle MASBO 2009 Suzanne E. Smith, CPA

2. What are Internal Controls? • Internal accounting controls are a series of procedures designed to promote and protect sound management practices, both general and financial in nature. The controls promote: • Financial information that is reliable and timely; • Assets and records of the school district that are safeguarded (not stolen, misused, or accidentally destroyed); • The school district’s policies being followed; • Government regulations being met.

3. The Components of Internal Control of any District • The Control Environment • Risk Assessment • Control Activities • Information and Communication • Monitoring

4. Why Should We Be Concerned with this Thing called Internal Control? • Both the school board and district management are charged with safeguarding all inflowing monies in the form of tax dollars and other grants and awards and with safeguarding all assets and other resources purchased with these monies. (If you receive tax dollars, you are accountable.) • Auditing Standards now call for a risk-based audit, which identifies major control cycles in a district and alerts the auditor to areas of risk that may require more attention during the annual audit. (There may no longer be the concept of “auditing around controls.”) (New for 2007-2008 audits) • School Districts are now, more than ever, being held accountable for the absence of adequate control systems.

5. Phase I • The Control Environment • The ethics and integrity of the board, the administration, and the employees of the district • The commitment to competence at all levels • The administration’s operating style and attitude towards controls • Human resource policies (and practices) • Organizational structure

6. The Control Environment and the Payroll Cycle • How does management and the board perceive the Payroll Control Cycle in your district? • Are there high expectations for highly ethical behavior surrounding all aspects of employee pay and benefits? • How would you board react to embezzlement concealed in the payroll control cycle? • Is honesty and integrity important to top-level administration in your district?

7. Phase 2 - Risk Assessment • Each school district is different. A precondition to risk assessment is the establishment of clear, consistent financial goals. • The payroll cycle often represents the largest overall expenditures in the school district. • An analysis must be made of the possible risks associated with this control cycle.

8. Risk Assessment • Ask yourself – • What are the major threats? • What are the controls that can help minimize these threats? • A well-designed payroll cycle must be designed to meet: • Management’s needs • Employees’ needs • Government regulations

9. Payroll Input There are five major sources of payroll input: • Human resource department provides information about hirings, terminations, and rate changes. • Employees provide changes in voluntary deductions. • Various school locations provide data about the actual hours worked by the employees. • This system may be automated.

10. Payroll Input • Government agencies provide tax rates and regulatory instructions. • Insurance companies and other organizations (deferred compensation) provide instructions for calculating and remitting withholdings. • There are risks associated with each of these five inputs.

11. Payroll Outputs • Paychecks • Direct deposit transactions • Checks are issued to government agencies, insurance companies, and other organizations to remit employee and employee taxes and other withholdings. • A variety of payroll reports • There are risks associated with each of these outputs.

12. Basic Payroll Cycle Activities • Updates to the payroll master file • Updates to tax rates and deductions • Validation of time and attendance data • Automated • Hand-written records • Process (prepare) the payroll • Disburse the payroll • Calculate employer-paid benefits and taxes • Insurance • Payroll Taxes • Retirement Match • Disburse payroll taxes and miscellaneous deductions

13. What are the associated goals? • First, the goals should be determined. • All transactions are properly authorized • All transactions are valid • All valid and authorized transactions are captured and recorded • All transactions are recorded accurately • Assets are safeguarded from theft • The district is in compliance with all laws and regulations

14. Phase 3 - Control Activities • The “Biggie” in terms of commitment – The responses to a threat or set of threats • Internal control activities are the policies, procedures, techniques, and mechanisms that help ensure that district management’s directives to minimize risks are carried out. • Control activities occur at all levels and functions of the district. • They include approvals, authorizations, verifications, reconciliations, performance reviews, and the production of records and documentation.

15. Threats in Employment Practices • Hiring unqualified or trouble employees • Thorough background checks, review of employment history (30% dishonest, 30% situationally dishonest, 40% honest) • Verify skills and references, including college degrees earned (Data released in March 2004 indicates that 50% of resumes contain false or embellished information) • Check at least three references (1 out of 3 will be gratuitously positive)

16. Threats in Employment Practices • Violation of Employment Laws • Carefully document all actions related to recruiting, hiring, and dismissal of employees. • Provide your payroll and human resource employees with continual training to keep them current with employment laws. • State • Federal

17. Threats in Payroll Processing • Unauthorized changes to the payroll master file • Proper segregation of duties • HR department approval for updates • HR department should not directly participate in payroll processing or distribution • Changes to the master file should be reviewed and approved by someone other than the person recommending the change. • Restrict access to the payroll system and logic code • User IDs, passwords • Control terminals from which payroll data and programs can be accessed

18. Threats in Payroll Processing • Inaccurate time data • Automation can reduce unintentional inaccuracies. • Data entry programs should include edit checks. • Edit checks for employee numbers and hours worked • Limit checks on hours worked • Segregation of duties can reduce intentional inaccuracies: • People who process payroll should not have access to the payroll master file (to the extent practical). • Supervisors should approve all time cards.

19. Threats in Payroll Processing • Inaccurate processing of payroll • Run and reconcile batch totals before and after processing • Master file totals +/- changes • Use of a payroll clearing account • Imprest system with a net zero balance in the control account • On-going training for payroll employees

20. Threats in Payroll Processing • Theft or fraudulent distribution of paychecks • Restrict access to blank payroll checks and check signing machine. • All checks should be sequentially prenumbered and accounted for periodically. • Someone independent of the payroll process should reconcile the payroll bank account. • Segregate the duties between those who authorize and record payroll and those who distribute checks and transfer funds. • Unclaimed checks should be returned to district administration for prompt investigation.

21. Phase 4 - Information and Communication • Internally generated information is critical to achieving the district’s financial objectives. • Financial reports • Understandable • Correct • Budget reports • Employee payroll reports • Time reports • Overtime reports • Absence reports • Annual/quarterly information reports

22. Phase 5 - Monitoring • Any control system must be continually monitored and updated in order to continue to work effectively. • The district should emphasize to managers that they have responsibility for internal control and that they should monitor the effectiveness of control activities as part of their regular duties. • Is the system re-evaluated when a breakdown in controls is uncovered? • The completion of each payroll provides you with a time for evaluation.

23. The Payroll Cycle • Authorization to hire or renew • Capturing of time/days worked • Processing • Disbursement • Recording • Reporting

24. Segregation of Duties • No one individual should be responsible for all facets of the payroll cycle. • The more segregation of the duties in the payroll cycle, the more difficult it is for someone to commit fraud or for errors to be made in the process. • Segregation of duties is vitally important.

25. Control Activities that will Minimize Risks Associated with Payroll Cycle • Segregation of the duties of: • Authorization for hiring • Approval of time captured or leave taken • Payroll processing/preparation of payroll checks • Approval of payroll checks • Disbursement of payroll checks • Reconciliation of the payroll clearing bank account

26. Control Activities that will Minimize Risks Associated with Payroll Cycle • Responsibilities for expenditure approval function segregated from those responsibilities for the actual payroll processing/check preparation function • Both administrative and school board approval should be given to hiring new employees. • Actual time/days worked and leave time taken should be approved by supervisors prior to the processing of the time worked as payroll. • Individuals who process payroll and prepare checks should not also approve new hires or approve time worked or leave taken. • Individuals who reconcile the payroll bank account should not process payroll or disbursement the payroll checks. • The actual cleared checks should be looked at.

27. Automation = Control • Control can be strengthened when • Standard programmed algorithms perform significant payroll calculations. • The payroll software calculates the payroll using database files holding employee information. • Accurate database files = Accurate payrolls • The payroll system automatically calculates the journal entry for payroll and posts the entry to the general ledger.

28. Checks and Balances • Current payrolls are compared with previous payrolls and variances are investigated and documented. • How can you prove this to an auditor? • Payroll registers are reviewed after processing, reconciled to control totals, and approved by an appropriate level of business department management. • How can you prove this to an auditor?

29. Helpful Forms • Employee Hire Form • Employee Action Form • Change of location • Mandatory deduction change • Voluntary deduction change • Funding source change • Wage/Salary adjustment • Employee Termination Form • All forms should be approved by both a personnel function and a business office function.

30. The Employee Master File • The employee master file contains valuable information needed to process correct payrolls. • Master file changes should be made only after approval for the changes is authorized. • Recommended: Employee action form • A payroll system master file change log, showing all changes made to payroll information, may be reviewed by appropriate management employee and by human resources to ensure it reflects accurate and complete information.

31. Legal Requirements • Pre-employment background checks • State Teacher Scale • Local supplements added • Board-approved Scales • Fair Labor Standards Act requirements • Mandatory Deductions • Federal taxes • Social security/medicare taxes • State taxes • Retirement • How does your district ensure retirement is appropriately withheld on all employees? • Training is vital • The flow of updated tax tables and other changes

32. Accounting for Payroll • Payroll generally posts automatically from the payroll module to the general ledger. • Programs, funds, and accounts must be assigned to all new or returning employees. • A knowledgeable employee should provide the appropriate account coding for employee master file updates. • Business manager level approval • Periodic reviews of check register or other listings • Periodic reviews by federal program administrators

33. Federal Payroll Expenditures • For all Federal payroll expenditures – • Does a person responsible for program expenditures and knowledgeable of the types of expenditures allowed from each program • Approve all new hires prior to the hire date? • Periodically review a listing of all personnel being paid from each federal program?

34. Disbursing Payroll Checks • Are all disbursements made by check/warrant? • No exceptions • Are only pre-printed, pre-numbered checks/warrants used? • Exception for laser checks • Laser signatures - - Remember the need for controls. • Are pre-printed checks controlled? • Limited access • Logging of useage • Physical controls

35. Are voided checks/warrants properly mutilated and held for inspection? • Are checks/warrants protected against alteration? • Who has last custody? • Who disburses payroll checks? • Who controls unclaimed checks? • Is the advance signing of checks/warrants prohibited? • What types of signatures are required? • Machine generated • Manual

36. The need for an imprest fund • A payroll clearing imprest fund/bank account is used to pay all claims. • The bank account is reconciled by a person independent of the payroll processing duties. • The bank statement is opened by the independent person each month, and not by the payroll department. • The bank account is reconciled on a timely basis.

37. Monitoring Opportunities • State Audits • Federal (IRS) Audits • Private CPA Audits • Each payroll cycle provides an opportunity for reflection and monitoring. • Take advantage of each cycle. • How can we be more effective? • How can we be more efficient? • How can we work to improve controls?