Internal Audit Report - Audit of Human Resources Management (HRM) - Payroll Administration
Approved by the Deputy Minister on April 25, 2012
Table of Contents
- Executive Summary
- Audit Objectives
- Audit Scope
- Audit Approach
- Audit Findings
- Audit Opinion
- Statement of Assurance
Appendix A: Assesment of Audit Criteria
1 Executive Summary
Responsibility for Infrastructure Canada's (INFC) payroll administration is shared by the Human Resources (HR) Division (Operations and Corporate) and the Finance and Administration Division under the Corporate Services Branch. INFC currently outsources its pay administration functions to Shared Human Resources Services (SHRS) of Public Works and Government Services Canada (PWGSC). Responsibility for the integrity, accuracy, and completeness of information provided to and received from PWGSC is shared between INFC's Human Resources (HR) Division and the Finance and Administration Division. In fiscal 2010-2011, the Department had 352 full-time equivalents (FTEs) who account for annual payroll costs of over $29 million.
The overall objective of the assurance engagement was to provide a high level of assurance that payroll administration policies and procedures are in compliance with INFC's departmental policies, Treasury Board policies, and federal legislation, and that payroll processing controls are adequate to ensure that INFC has performed its due diligence prior to and post processing by PWGSC.
The audit was conducted in accordance with the Internal Auditing Standards for the Government of Canada and the International Standards for the Professional Practice of Internal Auditing. Based on the audit evidence gathered to support the findings, key controls for payroll administration are in place and are operating effectively and payroll is processed in accordance with relevant federal policies and legislation. Management is encouraged to continue to align its policies and practices with federal government initiatives of relevance to payroll administration, if and as any new guidelines or requirements arise.
The audit noted the following minor area where Management would benefit from strengthening its existing practices:
- There is a need to reinforce the department's expectations and requirements for the nature and retention of documentation supporting pre-approval of overtime.
Management is in agreement with the audit findings and recommendations. Management has developed action plans to address the recommendations and these action plans have been included in this report.
Original signed by:
Director of Internal Audit for Infrastructure Canada
Chief Audit and Evaluation Executive for Infrastructure Canada and Transport Canada
The audit assurance engagement on HRM – Payroll Administration was approved by INFC's Departmental Audit Committee (DAC) as part of its approval of INFC's 2011 – 2014 risk-based internal audit plan (RBAP) in April 2011.
Responsibility for INFC's payroll administration is shared by the HR Division (Operations and Corporate) and the Finance and Administration Division under the Corporate Services Branch. INFC currently outsources its pay administration functions to SHRS that is governed by the terms and conditions of a Memorandum of Understanding (MOU). The MOU outlines the responsibilities of each party, including services to be provided, quality assurance and control, and service standards, and is updated annually.
HR Operations is primarily responsible for the entry of employee related information, excluding payroll, into the department's Human Resources Information System (HRIS) and the transmission of payroll requests to SHRS. SHRS is responsible for entering INFC employee payroll transactions into the Regional Pay System (RPS) and for processing payroll related transactions. PWGSC's Pay Office maintains the Payroll System General Ledger (PS-GL) that provides payroll control account balances, control data, and internal journal voucher reports used by departments in reconciling their payroll control account. Within INFC, Finance and Administration is responsible for implementing financial controls over the approval, monitoring, and reconciliation of payroll transactions recorded in the Infrastructure Financial Management System (IFMS).
Based on internal, unaudited financial reports, INFC's payroll transactions totalled $29,293,196 during fiscal year 2010-2011. This total includes transactions related to Indeterminate Employee Pay, Indeterminate Part-time Employee Pay, Term Employment (Casual or Part-time), Summer Students (FSWEP), Co-op Students, and Civilian Pay Equity. Given the many different types of payroll transactions, pay entitlement codes have been used to further classify the transactions. The main types of pay entitlement codes include Basic Pay, Acting Pay, Leave – Payment in Lieu, various Overtime Pays, Severance Pay, Bilingualism Bonus, Maternity Allowance, Pay at Risk, Arrears Pay, and various Recoveries. In addition, non-financial payroll transactions are recorded in HRIS for overtime that is paid out in leave rather than cash.
In recent years, INFC's programs portfolio and its staffing complement have increased significantly as the result of two significant Government of Canada budget announcements: Budget 2007 – The Building Canada Plan, and Budget 2009 – Canada's Economic Action Plan. From fiscal year 2007-2008 through to fiscal year 2010-11, INFC has grown from 217 to 352 full-time equivalents (FTEs) – an increase of 135 employees, or 62%, from fiscal 2007-2008 levels.
3 Audit Objectives
The objective of the audit was to provide a high level of assurance that: 1) payroll administration policies and procedures are in compliance with INFC's departmental policies, Treasury Board policies, and federal legislation; and 2) payroll processing controls are adequate to ensure that INFC has performed its due diligence prior to and post PWGSC processing.
A listing of the Audit Criteria for each audit objective is provided in Appendix A.
4 Audit Scope
The scope of the audit involved an assessment of the payroll administration processes, policies, and procedures in place within INFC and an examination of a sample of payroll transactions from the department's 2010-2011 fiscal year in support of key control testing procedures.
The scope of the audit did not include an assessment of the Salary Resource Management System (SRMS), as it was implemented subsequent to the period under scope. The audit scope also excluded an assessment of the controls and procedures followed within PWGSC with respect to the processing of INFC payroll transactions.
5 Audit Approach
The audit was conducted in accordance with the Internal Auditing Standards for the Government of Canada and the International Standards for the Professional Practice of Internal Auditing.
The planning phase of the audit was substantially completed by INFC's Audit Directorate, while the examination and reporting phases were completed by an independent consulting firm. The examination phase of the audit began in November 2011 and was substantially completed in January 2012. The examination employed various techniques including interviews with representatives of the Human Resources and Finance and Administration divisions and with representatives from SHRS, process walkthroughs, review of payroll policies and procedures, conduct of tests of operating effectiveness for key payroll controls, and analytical review. The audit criteria were developed with reference to the Core Management Controls as well as with reference to existing policies and guidelines including the Financial Administration Act and Treasury Board's Guideline for Financial Management of Pay Administration, Directive on Financial Management of Pay Administration, and the Policy Framework for the Management of Compensation.
The audit procedures included the testing of the operating effectiveness of key payroll controls. Sample sizes were determined based on the frequency with which the control operates, and individual sample items were selected on a judgmental basis. Our sample selection included testing of the following transaction types:
- Basic Pay;
- Acting Pay;
- Overtime Pay;
- Bilingualism Bonuses;
- Maternity Allowances;
- Pay at Risk; and
- Arrears Pay.
Each sample item was tested to determine whether the related internal control was operating as intended. Since this was not a statistical sample, the results cannot be extrapolated to all payroll transactions within INFC.
For purposes of this report, the residual risk rankings associated with findings follow a low, moderate, or high rating scale that were subjectively determined based on our analysis of the results of the audit procedures and the resulting observations and findings. The subjective criteria are:
|High||Threats/Opportunities have very significant impact on INFC's objectives, are imminently likely and no, or uncertain mitigation measures are in place.|
|Moderate||Threats/Opportunities have significant impact on INFC's objectives, have a longer-term likelihood and reliable mitigation measures are planned or are being established.|
|Low||Threats/Opportunities do not have a significant residual risk to INFC's objectives.|
6 Audit Findings
6.1 Payroll Policies and Procedures
The Treasury Board Policy on Internal Control states that Parliament and Canadians expect the federal government to be well managed with the prudent stewardship of public funds, the safeguarding of public assets, and the effective, efficient, and economical use of public resources.
It was expected that INFC would have documented policies and procedures regarding the administration and processing of payroll that are consistent with relevant federal legislation, including the Financial Administration Act, relevant Treasury Board policies and directives, and collective agreement requirements.
Audit Observation - Opportunities to Simplify Program Design
Policies and procedures followed by INFC for the administration and processing of payroll are generally consistent with relevant federal legislation, policies, and collective agreements.
To help ensure that payroll transactions are administered and processed in compliance with Treasury Board's directives and policies and with applicable collective agreements, INFC has implemented and documented a number of policies, procedures and control activities.
Specifically, INFC has a number of human resources policies and procedural guidelines that address required staffing and classification activities, and represent the initiation point of payroll transactions. In addition, INFC has documented delegations of authorities for human resources transactions as well as for financial transactions. INFC's policies and guidelines also refer to specific acts, regulations and administrative policies with which INFC must comply. Finally, INFC has a Departmental Security Policy that defines the responsibilities of INFC personnel with respect to the safeguarding of assets as well as information and information technology security requirements. This suite of policies and guidelines helps to ensure that payroll transactions are appropriately initiated, authorized, and safeguarded in accordance with federal policies and legislation.
Under its Memorandum of Understanding with SHRS, INFC is required to comply with the policies of the Government of Canada, which include the Financial Administration Act (FAA) and Treasury Board policies and guidelines, such as the Policy Framework for the Management of Compensation, Financial Management of Pay Administration, and Pay Administration Control Framework. As a result, INFC has not documented its own internal payroll policies and guidelines, but rather relies upon relevant federal payroll policies to guide its payroll activities. Given the relatively small size of INFC relative to other departments, this appears reasonable as it reduces the duplication of effort that may result in the development and maintenance of a suite of internal payroll policies that are required to mirror federal requirements and also helps to ensure that the most up to date federal policies are referred to in practice. In addition, INFC's practice of outsourcing its payroll processing to a third party (SHRS) appears reasonable given the small size of the department and the need to process payroll in a cost-effective manner.
Based on the results of our process walkthroughs and interviews with representatives of INFC's HR and Finance and Administration divisions, we confirmed that, in general, INFC's procedures are consistent with federal requirements and are reflective of relevant collective agreements.
It was identified through our process walkthroughs and control testing that, similar to other federal government departments, INFC's release of payment batches produced by SHRS could not be readily reconciled to substantiating documentation. The Directive on Financial Management of Pay Administration requires that a process be in place to allow persons with authority under section 33 of the FAA to verify that payments are a lawful charge against the appropriation and that funds are available. The process of reconciling payment batches provided by outsourced providers to substantiating documentation is a systemic challenge across the federal government and is not unique to INFC. INFC has a number of mitigating controls in place to help ensure that payroll payments are accurate and complete, such as monthly reviews of actual payroll expenditures to plan and various reconciliations. These mitigating controls, combined with the relatively small size of the department's payroll, help to reduce the risk of inaccurate payroll payments. We encourage management to continue to remain aware of and align their procedures with any government-wide initiatives that may help to strengthen the documentation available to support the FAA section 33 approval for payroll.
|Recommendations||Management Action Plan|
|No recommendations required||N/A|
|Assistant Deputy Minister Responsible:||N/A|
6.2 Roles and Responsibilities
To help ensure compliance with established policies and procedures, we expected that the roles and responsibilities of INFC and PWGSC with respect to payroll administration would be clearly defined and understood.
Audit Observation - Enforcement of Contribution Agreement Terms and Conditions
Roles and responsibilities for payroll administration within INFC and between INFC and PWGSC are defined, documented and understood.
INFC's Memorandum of Understanding with SHRS defines the roles and responsibilities of SHRS with respect to payroll administration. These responsibilities include creating and monitoring pay and compensation files, processing pay and benefits actions, and maintaining the pension system (such as ensuring that retirement salaries are correct and forwarding appropriate information to the Superannuation Directorate). The MOU also broadly defines INFC's responsibilities as being the accountability, authority and answerability for human resources management decision making for INFC.
Within INFC, specific roles and responsibilities of various personnel involved in the payroll administration process are defined through policies and procedures, such as delegations of authority, that provide descriptions of the roles and responsibilities of the Deputy Head, the People Management Committee, Managers, and the Human Resources function. In addition, in conjunction with this audit, the payroll administration process was documented through detailed flowcharts that clearly define specific steps and procedures to be performed at each phase of the payroll life cycle and the personnel responsible for performing each activity.
Based on the results of our process walkthroughs and interviews with representatives from SHRS and INFC, we confirmed that personnel were aware of the responsibilities of both SHRS and INFC and that personnel understood their individual roles and responsibilities with respect to payroll administration. This observation is consistent with the results of the 2008 internal audit of Staffing and Classification that reported that managers appeared to have a clear understanding of their responsibilities and accountabilities and clarity with respect to roles.
|Recommendations||Management Action Plan|
|No recommendations required.||N/A|
|Assistant Deputy Minister Responsible:||N/A|
6.3 Payroll Controls
To help ensure the prudent stewardship of public funds, the safeguarding of public assets, and the effective, efficient, and economical use of public resources, we expected that INFC would have designed and implemented effective controls to help ensure the accuracy, completeness, and integrity of payroll transactions.
Audit Observation - Assurance on the Work of the Program Delivery Partners
Controls to help ensure the accuracy, completeness, and integrity of payroll transactions have been implemented and are generally operating effectively.
INFC has designed and implemented a number of controls at various stages of the payroll cycle to help ensure the accuracy, completeness and integrity of payroll administration and processing. Key controls tested through the audit included reconciliations, controls over data entry, controls designed to detect and prevent inaccurate payments, and monitoring controls.
Through the audit, we tested the design and operating effectiveness of a number of key reconciliation controls in place within INFC including the following:
- Reconciliation of Integrated Financial Management System (IFMS) with Control Account Balance – A monthly reconciliation of INFC's IFMS trial balance with PWGSC's PS-GL control account balance report is conducted and is reviewed by the Head of Accounting Operations.
- Reconciliation of Suspense Account Balances – As part of their monthly procedures, Financial Analysts perform a review of all suspense accounts, including payroll accounts, to ensure they are cleared of all transactions by period end. Any suspense account balances are referred to the responsible manager for resolution to help ensure the transaction is properly accounted for.
- Reconciliations of IFMS and Payroll Transactions – For the period in scope for the audit testing (fiscal 2010-2011), monthly reconciliations were performed to verify the consistency between the payroll transactions recorded in IFMS and the payroll transactions processed by SHRS. This reconciliation was a manual procedure through which INFC cost centre managers were responsible for reviewing and confirming the accuracy of the payroll data for each of their employees as provided by Finance using Excel spreadsheets. These spreadsheets were updated on an on-going basis with payroll information received from Human Resources.
Based on the results of the audit testing, no errors or exceptions were identified in the reconciliation controls. It is noted that reconciliations between IFMS and payroll transactions are no longer being performed as described above. This is due to the fact that INFC implemented the Salary Resource Management System (SRMS) at the beginning of fiscal 2011-2012 to improve the efficiency of the payroll process through increased automation. As a result, separate reconciliations between the transactions in IFMS and the transactions processed by SHRS are no longer required as payroll data is automatically downloaded into SRMS from the PWGSC pay tapes.
b) Data Entry
INFC and PWGSC perform a number of peer review and independent validation activities to verify the accuracy and completeness of payroll data. SHRS Pay Advisors review supporting documentation received from INFC's HR division for payroll transactions to help ensure that pay transactions are in compliance with the relevant federal policies prior to entering the data into the RPS. To help ensure the accuracy of this data entry, each transaction or data element entered into the RPS is subject to a peer review conducted by an independent verifier. Through the audit control testing, we observed evidence of peer reviews being conducted as required for all of our sample items.
Within INFC, employee data is entered into the Human Resources Information System (HRIS) by the HR Administrators. All data entered is reviewed by a peer and this review is documented through a sign off on the personnel file checklist. Based on the audit testing, no errors or exceptions in this control were identified.
The audit testing confirmed that peer review procedures are in place and are operating effectively for all different transaction types examined in the audit, including basic pay, acting pay, bilingual bonuses, overtime pay, maternity allowances, pay at risk, and arrears pay. The one exception to this is the entry of accumulated overtime into the HRIS, which is not currently subject to a peer review. However, Supervisors have access to their respective employee balances and transactions through HRIS and are able to review this information for accuracy. As specified in the relevant collective agreements, overtime may be compensated through compensatory leave with pay upon mutual agreement between the employee and the employer. Accumulated overtime is tracked in the HRIS by the Leave Administrator, who manually enters the accumulated overtime based on the approved time sheets. The accumulated overtime may only be carried forward for a limited time depending on the collective agreement, at which point it must be reimbursed to the employee. While the lack of a peer review of the entry of accumulated overtime increases risks related to data entry errors, it is recognized that INFC has a number of compensating controls in place with respect to the accuracy of accumulated overtime. These controls include monthly reviews of Overtime Reports by the Leave Administrator and the review of reports supporting reimbursement payments for overtime that detail the total overtime accumulated, overtime taken, and remaining balance by the Head of Corporate Services. In addition, the amounts reimbursed are typically immaterial, with a total of only $46,261.00 being reimbursed to employees in fiscal 2010-2011. As a result, this lack of peer review is considered to be of low risk to the Department.
It is our understanding that Human Resources Corporate Services is currently in the process of automating its overtime recording process. The new form is expected to enable overtime to be calculated automatically based on the entered start and end times, which should in turn reduce the potential for errors in interpreting collective agreements with respect to overtime. This process may also reduce the need for a manual peer review of accumulated overtime provided appropriate system controls are in place to safeguard the accuracy and completeness of the overtime data.
c) Underpayments and Overpayments
In addition to the peer reviews and reconciliations described previously, INFC has a number of key controls designed to detect underpayments and overpayments of payroll. In particular, cost centre managers perform monthly reviews of actual payroll data and balances against the plan to identify errors or irregularities. This review is one of the primary controls relied upon by management to detect anomalies in payroll transactions, which is reasonable given the smaller size of the department (i.e. Management is aware of significant changes in staffing and as such, is in a position to readily identify unusual variations between actual payroll costs and staffing activity).
The audit testing of key controls for sampled payroll transactions included the recalculation of payroll amounts based on the supporting documentation included in the file. We did not note any errors or discrepancies between the payroll amounts and our recalculations and/or additional supporting information provided by management.
In addition to the monthly reviews of actual against planned payroll expenditures performed by the cost centre managers, a number of controls are in place on which INFC relies to monitor the accuracy and reasonableness of payroll processing. Two such controls that were tested in the audit were:
- Staffing Log – Human Resources has implemented a staffing log to monitor and follow-up on staffing actions, including the receipt of required employee documentation. The log is reviewed on a quarterly basis by the HR Manager and the HR Operations team to review the status of transactions and to take follow up action as necessary.
- In addition and as described previously, accumulated overtime is reviewed on a monthly basis for reasonableness by the Leave Administrator and Data Quality Coordinator.
Based on the testing of these controls, no errors or exceptions were identified.
In addition to these controls, management also reviews the results of periodic quality assurance reviews conducted by SHRS. These reviews include the selection of a sample of payroll transactions for which the transactions are re-performed to verify the accuracy of the transactions, and a review is conducted to verify that pay transactions were initiated with properly authorized documentation, pay data is documented on file, and pay transactions were verified by a peer. The first of these types of reports covered the period January 2011 to June 2011.
Finally, management participates in quarterly meetings with SHRS through which any areas of concern can be discussed for resolution.
|Recommendations||Management Action Plan|
|No recommendation required.||N/A|
6.4 Documentation and Authorization of Payroll Transactions
As part of the design and implementation of effective controls over payroll administration, we expected that INFC would have controls to help ensure the proper authorization of payroll transactions and sufficient documentation on file to support authorizations and approvals.
Audit Observation - Documentation
In general, payroll transactions are properly authorized and supported by appropriate documentation. One area for improvement in the retention of supporting documentation was identified.
INFC has implemented procedures to help ensure that payroll transactions are approved by an appropriate level of authority. Specifically, delegations of authority are well-defined in existing INFC documents. To help ensure payroll transactions are properly authorized, the Human Resources Advisors have on-line access to signature cards that they consult to verify that payroll transactions were authorized by an appropriate delegated authority.
As specified in the MOU, SHRS also has access to INFC's delegation for HR management authorities. We confirmed through interviews with a representative of SHRS that they also will verify that transactions have been approved by a management level which has the appropriate level of delegated authority.
Based on the audit testing of controls in place for a sample of pay transactions, we confirmed that proper approvals as required under FAA Section 34 had been obtained in accordance with INFC's delegations of authority for all sample items tested.
However, we identified a gap in the application of FAA Section 32 which requires that overtime be pre-approved by supervisors. The results of our control testing identified that this pre-approval is generally provided verbally. As a result, there is no means of verifying that pre-approval of overtime was obtained. It is noted that in all cases, appropriate approval of the payment of overtime as required under FAA Section 34 was obtained and documented on file. However, the documentation of the approval of overtime in advance of it being incurred is a sound management practice that should be in place.
The audit testing also included assessing the adequacy of substantiating documentation to support payroll transactions. The results of the testing identified that in all cases sufficient supporting documentation was provided to SHRS and was on file in support of the payroll transactions.
As specified in the MOU, SHRS is responsible for maintaining sufficient information to substantiate and support payroll transactions in the employee files. However, INFC management is ultimately accountable and answerable for its payroll transactions. As a result and as mentioned previously, we encourage management to continue to align its policies and procedures with any relevant government-wide initiatives as they occur to further strengthen its existing practices, such as by incorporating any requirement for independent assessments of the effectiveness of controls within SHRS to be conducted should such assessments be required for federal third party service providers in the future.
3.1 It is recommended that the Human Resources Division reinforce INFC's expectations to front line supervisors and managers with respect to required documentation to support the pre-approval of overtime.
3.1 Human Resources Management commits to reinforcing INFC's expectation to supervisors and managers with respect to the required documentation to support the pre-approval of overtime in the following ways:
|Assistant Deputy Minister Responsible:||Su Dazé, ADM, Corporate Services|
|Due Date:||March 31, 2013|
7 Audit Opinion
Based on the audit evidence gathered, it was found that, overall, INFC processes payroll in accordance with relevant federal policies and legislation and that key controls for payroll administration are in place and are operating effectively. Management is encouraged to continue to align its policies and practices with federal government initiatives of relevance to payroll administration, if and as any new guidelines or requirements arise.
The audit noted the following area where management would benefit from further strengthening its practices:
- There is a need to reinforce the department's expectations and requirements for the nature and retention of documentation supporting pre-approval of overtime.
8 Statement of Assurance
In the professional judgment of the Chief Audit and Evaluation Executive, sufficient and appropriate audit procedures have been performed and evidence gathered to support the accuracy of the conclusions reached and contained in this report. The audit findings and conclusions are based on observations and analyses of conditions as they existed on the audit date, against established criteria agreed upon with management.
The findings are only applicable to the entity examined. The evidence was gathered in accordance with the Internal Auditing Standards for the Government of Canada and the International Standards for the Professional Practice of Internal Auditing.
Appendix A: Audit Criteria
1.1: Policies and procedures are in compliance with federal legislation such as the Financial Administration Act, relevant Treasury Board Policy and applicable collective agreements.
1.2: Roles and responsibilities between INFC and PWGSC are established and clearly communicated.
2.1: Reconciliations are performed on a periodic basis, corrective actions are taken, as required, and the work is reviewed at an appropriate level.
2.2: Data entry into key payroll administration IT systems is reviewed to help ensure the accuracy and completeness of the entered data. The review is documented.
2.3: Underpayments and overpayments are detected and corrective action is taken on a timely basis.
2.4: Monitoring is performed to help ensure that payroll data and transactions are accurately processed and supported by appropriate documentation. The monitoring is documented.
2.5: Payroll transactions are appropriately authorized and the authorization is documented.
- Date modified: