ARCHIVED - Audit of Payroll Controls

This page has been archived.

Internal Audit Report
January 2010

Table of Contents

• Executive Summary
• Introduction
  • Background
  • Risk Assessment
  • Audit Objective and Scope
  • Approach and Methodology
  • Audit Criteria
  • Statement of Assurance
• Audit Opinion
• Findings, Recommendations and Management Action Plans
  • Adequacy and Effectiveness of Controls
  • Knowledge and Ability
  • Monitoring
• Appendix A: Audit Criteria
• Appendix B: Assessment of Controls
• Appendix C: Pay Administration Flow
• Appendix D: List of Acronyms

Executive Summary

Background

Canada Border Services Agency (CBSA) payroll obligations for its 15,000-plus employees amount to $1.1 billion, or 71% of the Agency’s annual expenses. The pay and benefits function within the Agency encompasses the administration of salaries to employees, the management of leave and overtime, and the provision of related counselling services to employees. This responsibility primarily rests with the Human Resources Branch, although the Comptrollership Branch is also involved in reconciling the final pay and benefit expenses and accounting for the Agency.

CBSA’s compensation process is decentralized between Headquarters (HQ) and the regions. Each of CBSA’s eight regions and HQ has a human resources function. Part of their responsibility is to provide regional and HQ employees with advice and guidance on compensation and benefits, and process various pay and leave entitlements and benefits documentation within the Corporate Administration System (CAS) and the Regional Pay System (RPS).

While pay and benefits are compiled and administered at the Agency level, the final payment is done through the Public Works and Government Services Canada (PWGSC) Pay and Compensation Division. PWGSC also requires that the Agency provide administrative and other services needed for the disbursement of pay, employee benefit plans, and superannuation or pension plans.

Objective and Scope

The objective of this audit was to provide assurance that adequate payroll controls are in place and functioning effectively within CBSA.

The audit scope included review and analysis of a sample of non-executive employee files between January 1 and December 31, 2008. The audit did not include a review of the Executive Human Resources function due to low volume of executive employee transactions. Audit testing was conducted within HQ and within the following regions: Greater Toronto Area (GTA), Pacific and Atlantic. The review of employee files was substantially completed during the audit fieldwork between May and July 2009.

Statement of Assurance

The audit engagement was planned and conducted in accordance with the Internal Auditing Standards for the Government of Canada.

Audit Opinion

The audit found that the Agency’s main payroll controls were adequate and functioning effectively. Opportunities for improvement were noted for system access; financial delegations for pay administration; pay transaction processing and verification; and reconciliations of variable shift scheduling arrangements.

Main Observations

Overall, the Agency had payroll controls in place which addressed high risk areas of the payroll process. A compensation control framework had been drafted to document these controls, however, management indicated that additional work was required before it could be finalized.

The compensation financial delegations, for the most part, were in place. Two issues were noted regarding the section 34 of the Financial Administration Act (FAA) delegations of compensation advisors and the section 33 FAA certification for some transactions made in the RPS. The audit found that the section 34 FAA certification by managers was satisfactorily performed. The section 33 FAA certification was being performed by Corporate Accounting, however, Corporate Accounting relied heavily on the transaction verification process conducted by compensation personnel in performing the section 33 FAA certification and conducted no monitoring to obtain reasonable assurance over this process.

Payroll transactions were completed accurately and in a timely manner by compensation employees, however, some issues were noted regarding the verification process and file documentation. As well, the audit indicated that the managers’ review of employee timesheets revealed some issues regarding the accounting of premium shift hours and the reconciliation of the variable shift scheduling arrangements.

Controls in place for salary expenditure monitoring including the salary interdepartmental settlement process, reconciliation of expenditures between CAS and RPS, and the recovery of salary overpayments were found to be adequate and effective, however, access monitoring of CAS and RPS was not functioning as intended.

Management Response

The CBSA agrees with the report findings.

The audit report captures the complexity of the Agency’s decentralized compensation processes.

The key branches – Human Resources and Comptrollership – in consultation with other branches of the CBSA will work collaboratively to address the recommendations in the audit.

Management action plans have or will be developed for each of the audit recommendations.

Introduction

Background

Canada Border Services Agency (CBSA) payroll obligations for its 15,000-plus employees amount to $1.1 billion, or 71% of the Agency’s annual expenses. Consequently, it is important that adequate controls be in place as part of CBSA’s overall payroll process function, including proper recording of salaries, wages, bonuses and applicable deductions.

Within the Agency, the pay and benefits function encompasses the administration of salaries to employees, as well as the management of leave and overtime, and the provision of related counselling services to employees. This responsibility primarily rests with the Human Resources Branch (HRB); as well, the Comptrollership Branch is involved in reconciling the final pay and benefit expenses and accounting for overall cost for the Agency.

The Labour Relations and Compensation Directorate of HRB is responsible for ensuring that the payroll policies and guidelines are up to date and being followed, and the payroll process is in compliance with all relevant Treasury Board policies, procedures and guidelines. They are also responsible for providing Headquarters (HQ) and the regions with clarification on any new regulations and policies, as needed.

Corporate Accounting and Financial Policy Division, Corporate Finance Directorate, Comptrollership Branch, is responsible for the reconciliation of data in the Corporate Administration System (CAS), Regional Pay System (RPS) and PS-GL (Pay System General Ledger)[ 1 ]. In addition, they also reconcile the liability for unused vacation and compensatory leave as well as perform accrual calculations for pay.

Each of the CBSA branches has a Branch Management Services Unit (BMSU) that provides a variety of financial and human resource services, including time and activity reporting.

CBSA’s compensation process is decentralized between HQ and the regions. Each of CBSA’s eight regions and HQ has an HR function. Part of their responsibility is to provide regional and HQ employees with advice and guidance on compensation and benefits, and process various pay and leave entitlements and benefits documentation within CAS and RPS.

In support of the Treasury Board Secretariat’s (TBS) human resources management and compensation management roles, the Secretariat develops and oversees the Policy Framework for the Management of Compensation to determine compensation in the core public administration. While pay and benefits are compiled and administered at the Agency level, the final payment is done through the Public Works and Government Services Canada (PWGSC) Compensation Sector. PWGSC also requires that the Agency provide administrative and other services needed for the disbursement of pay, employee benefit plans, and superannuation or pension plans.

Employee pay entitlements and benefit deductions are governed by various Acts and Regulations such as the Public Service Employment Act (PSEA), collective agreements and Terms and Conditions of Employment Regulations. Compensation personnel such as compensation advisors and managers apply these regulations as well as various compensation and benefits guidelines, directives, and manuals, developed by PWGSC, TBS and CBSA.

No internal audit on payroll controls had been conducted within CBSA since its creation in 2003. Canada Revenue Agency (CRA) conducted an internal audit on their Compensation Management in October 2008 and found that the majority of key management and processing controls were in place. However, their audit tests showed that a large percentage of pay actions had not been processed in a timely manner, with the most significant contributing factor being late paperwork submitted by the managers. The audit concluded that processing standards needed to be developed to assist in measuring performance, as the monitoring measures currently in place did not give a complete picture of compensation activities. It should be noted that like CRA, CBSA utilizes CAS to process employee pay and benefit related actions.

Risk Assessment

To assist in audit planning and determining areas of audit, a preliminary risk assessment identified the following key risks for inclusion in the audit program

• Governance and Accountability: There is a risk that delegated authorities may not be exercised appropriately; a payroll control framework may not be in place; and compensation guidelines, policies and procedures may not have been developed to ensure consistency of the payroll process.
• Compliance with Policies and Procedures: There is a risk that the policies and procedures on payroll may not be complete or actions may not be in compliance with these policies resulting in over- or underpayments.
• Knowledge and Ability: There is a risk that compensation managers, advisors and staff may not possess the necessary knowledge and ability to properly carry out their responsibilities or those policies and procedures are not communicated and/or understood by compensation managers, advisors, and staff.
• Monitoring and Reconciliation: There is a risk that the monitoring and reconciliation performed may be inadequate to ensure compliance, identification of problems, and corrective measures taken, when required.

Audit Objective and Scope

The objective of this audit was to provide assurance that adequate payroll controls are in place and functioning effectively within CBSA.

The audit included an analysis of various types of high-risk non-executive employee pay transactions and a review and analysis of sample employee files between January 1 and December 31, 2008. The testing also included a review of employee timesheets and Variable Shift Scheduling Arrangements (VSSAs) between July 2008 and July 2009. In addition, salary recoveries and payments through the interdepartmental settlement process as well as year-end salary reconciliation procedures within Comptrollership Branch were reviewed for the 2008 2009 fiscal year. Supporting documents relating to all samples selected for review were requested directly from the regions or branches. CAS, RPS, and supporting document information were reviewed for accuracy, consistency in application, and timeliness of processing.

Audit testing was conducted within HQ and the following regions: Greater Toronto Area (GTA), Pacific, and Atlantic. HQ, GTA and Pacific were selected due to their high volume of payroll transactions. Pacific and GTA were also specifically chosen due to the large volume of student employees in those regions, whereas Atlantic was selected as a region that processes a lower volume of transactions but has a high number of shift-scheduled employees.

The audit did not include a review of the Executive Human Resources function due to low volume of executive employee transactions. In addition, the function is managed by a separate compensation unit and may be audited in the future.

For non-executive employees, leave management was included in the audit, however, the focus was on those transactions that had a financial impact as well as the controls in place for ensuring that leave was properly entered into CAS for those higher-risk employees (i.e. students, casual, seasonal). The audit did not include the management of overtime as an audit is planned for this area in 2010/11. The accuracy of overtime hours recorded on timesheets and in CAS was examined as part of the review of employee timesheets.

The review of employee files was substantially completed during the audit fieldwork between May and July 2009. Regional timesheet and VSSA analysis and HQ data analysis was not completed mid September 2009.

Approach and Methodology

The following approach was used in conducting this audit:

• Compensation personnel in HQ and the selected regions were interviewed to understand the practice of processing various compensation transactions.
• Sample files of active and inactive employees (as of December 31, 2008) and employees who were taken-on-strength [ 2 ] (TOS) or struck-off-strength [ 3 ] (SOS) were selected between January and December 2008. A review of both employee file and CAS data was performed to ensure:
  • Accuracy of salary amounts (substantive and acting), including leave without pay or temporary SOS transaction processing and any related recoveries;
  • SOS and TOS transactions were processed both accurately and in a timely manner and the pay was adjusted accordingly;
  • Accuracy of leave payouts indicated in the file and in CAS;
  • Evidence of peer verification and utilization of appropriate checklists and calculation tools within the file;
  • All financial transactions reviewed had the appropriate section 34 Financial Administration Act (FAA) authority indicated.
• Ensured that appropriate and adequate controls were in place relating to section 34 and section 33 FAA financial delegations for pay administration.
• A sample of employee timesheets was reviewed to ensure accuracy to CAS data; selected VSSA schedules to reconcile employee hours worked to what was paid.
• Interviewed compensation personnel to determine their level of knowledge and ability relating to the compensation transaction processing and examined what training programs were in place.
• Reviewed overall monitoring and reconciliation processes to assess whether performance measures and indicators have been incorporated and/or monitored within the payroll function of the Agency.

Audit Criteria

Based on audit planning work and the preliminary risk analysis conducted, lines of enquiry and audit criteria were developed. The lines of enquiry include: Governance and Accountability; Compliance with Policies and Procedures; Knowledge and Ability; and Monitoring and Reconciliation. The associated criteria are listed under Appendix A.

Statement of Assurance

The audit engagement was planned and conducted in accordance with the Internal Auditing Standards for the Government of Canada.

Audit Opinion

The audit found that the Agency’s main payroll controls were adequate and functioning effectively. Opportunities for improvement were noted for system access; financial delegations for pay administration; pay transaction processing and verification; and reconciliations of variable shift scheduling arrangements.

Findings, Recommendations and Management Action Plans

Overall, the Agency had payroll controls in place which addressed high risk areas of the payroll process. A compensation control framework had been drafted to document these controls, however, management indicated that additional work was required before it could be finalized.

The compensation financial delegations, for the most part, were in place. Two issues were noted regarding the section 34 FAA delegations of compensation advisors and the section 33 FAA certification for some transactions made in the RPS. The audit found that the section 34 FAA certification by managers was satisfactorily performed. The section 33 FAA certification was being performed by Corporate Accounting, however, Corporate Accounting relied heavily on the transaction verification process conducted by compensation personnel in performing the section 33 FAA certification and conducted no monitoring to obtain reasonable assurance over this process.

Payroll transactions were completed accurately and in a timely manner by compensation employees, however, some issues were noted regarding the verification process and file documentation. As well, the audit indicated that managers’ review of employee timesheets revealed some issues regarding the accounting of premium shift hours and the reconciliation of the variable shift scheduling arrangements.

Controls in place for salary expenditure monitoring including the salary interdepartmental settlement process, reconciliation of expenditures between CAS and RPS, and the recovery of salary overpayments were found to be adequate and effective, however, access monitoring of CAS and RPS was not functioning as intended.

Adequacy and Effectiveness of Controls

Compensation Control Framework

Control frameworks are required to be developed in preparation for audited financial statements. The Agency’s compensation control framework will be used by the financial statement auditors during their testing in order to gain an understanding of the Agency’s payroll process.

The Agency has developed a draft Compensation Control Framework; however, management had indicated that it required additional work before it could be finalized.

The audit did assess the adequacy and effectiveness of payroll controls that were based upon the Treasury Board Secretariat (TBS) Pay Administration Control Framework, PricewaterhouseCoopers Compensation Control Framework (prepared for CBSA), and the CBSA developed draft compensation control framework. The summary results are presented in Appendix B.

Financial Delegations

Consistent and appropriate financial delegations should be in place across the Agency to ensure that all financial transactions are processed as per the Financial Administration Act (FAA). The TBS Pay Administration Guide and the TBS Pay Administration Control Framework were used as references during the audit in order to establish a context on how the financial delegations are applied for pay administration. Appendix C provides a flow chart of the process. Further, the financial delegation matrices developed for HQ and the regions were also examined.

The audit found that the financial delegation matrices for the most part are complete, but noted two issues. First, some compensation employees who authorized transactions in the system did not have the appropriate section 34 FAA delegation. This is a requirement under the TBS Pay Administration Control Framework. The second point was with respect to section 33 authorization for compensation transactions entered directly into RPS [ 4 ]. The financial delegation matrix indicated that regional finance had this authority, however; it was not being exercised. De facto, this authority was being done by the compensation managers.

Without clear delegations within the pay administration transaction process, there is a risk that employee compensation transactions could be in error or processed without the appropriate authorization.

Compensation Transaction Peer Verification

Within CBSA, compensation advisors are able to perform both the key (input) and verify related functions for a given pay list. As per CAS process documentation – Module 285 – Manage Verification Process, after a transaction has been keyed by a compensation advisor, another advisor displays the transaction to verify the entries against supporting documentations. If corrections are required, the transaction is rejected and the compensation advisor is notified to make the necessary correction. As the access granted to the compensation advisors does not restrict them from verifying the transaction they have input, the compensating control is that the compensation authorizer should ensure that the user IDs of the keyer and verifier are different prior to authorizing the transaction in the system.

The audit reviewed a sample of 128 transactions to determine if the peer verification process was operating effectively. In this review, no errors were detected in the calculation of the employees’ compensation. However, in some regions discrepancies were noted in the peer verification process and the file documentation. For example:

• Some transactions were not always peer verified. This was found in both the paper files and the CAS data reviewed;
• The process had not been updated to accommodate tele-work arrangements in some regions; and
• Supporting documentation was not always on file.

While the compensating controls have been effective, continued reliance on these may not detect potential transaction processing errors in the future.

Employee Timesheets

CAS is the official departmental system for managing salary, time and activity information for all CBSA employees. Each employee is required to record their time by activity. The recorded time includes regular time and where applicable, extra duty, leave and premiums. The completed timesheet form, BSF509, is submitted to the employee’s supervisor for review and approval before being forwarded to the Common Services Administrative Service Clerk for subsequent keying. The signature on the BSF509 does not constitute section 34 authorization pursuant to the FAA; consequently, those supervisors are not required to complete Delegated Financial Authority training in order to approve those timesheets.

The audit examined the controls in place for inputting and processing timesheets accurately with appropriate approvals. The review of 59 timesheets of employees selected from the four regions identified an issue with incorrect entries recorded on the timesheet. The most common error was due to incorrect calculation of premium hours on the timesheet completed by the employee and approved by their supervisor/responsibility centre (RC) managers. This error was identified 11 times on eight of the 59 timesheets reviewed. Three of the errors were identified and corrected by the keyer prior to input into CAS. The result of these errors was over or underpayments to employees, however, the financial impact for the sample was insignificant. Interviews indicated that these errors resulted from inadequate understanding of the activity reporting process by some employees, superintendents, and timesheet keyers

A best practice noted in the GTA region was that compensation advisors were providing all new employees and supervisors with an information session relating to their entitlements and deductions, including a Compensation Web Application (CWA) [ 5 ] presentation and BSF509 presentation. The goal of this information session was to improve the timesheets submitted by employees and ensure that CAS information was accurate and complete. From the audit sample, all timesheet errors were corrected by the timesheet keyers in the GTA region prior to entry into CAS, resulting in no financial impact.

Variable Shift Scheduling Arrangement (VSSA) Reconciliations

The audit examined the reconciliation procedures in place for ensuring that VSSA schedules were properly reconciled. Regardless of hours reported in CAS from the employee’s timesheets, regular pay is processed at 7.5 hours per day, 37.5 hours per week and 75 hours per pay period. The number of week periods and the hours of work to be covered under the VSSA schedule are determined by an agreement between the Agency and the Public Service Alliance of Canada (PSAC), at the local level. Superintendents at the ports of entry (POEs) have the responsibility to monitor and balance employees’ hours to the schedule to ensure that the employee has worked the correct number of hours which they were paid for. In the POEs reviewed, these VSSA schedules ranged from 300 to 525 hours.

The audit found that each of the POEs were using various systems to maintain VSSA schedules, including paper based templates, Excel, and COSS [ 6 ]. CAS has the capability to incorporate VSSA scheduling into the system, however the Agency currently does not have this as an “active” function, due to associated upgrades and maintenance cost considerations. Consequently, work schedule rules have not been fully developed in CAS in order to maximize system-based automated controls over time reporting.

To examine the effectiveness of the VSSA reconciliation process, the audit reviewed 24 employee files from five POEs. It compared the total number of hours reported in CAS to the total number of hours paid over a period of three consecutive VSSAs. The analysis identified that 17 of 24 employees reviewed had hours reported in CAS that did not reconcile with actual hours being paid. The percentage differences between the scheduled hours and CAS data ranged from -0.5% to 2.0%. There were limitations in this analysis, as it considered only three VSSA periods, which ranged from a period of six to nine months. Interviews indicated that there were opportunities to balance out the CAS reported hours with actual hours being paid in future VSSA periods, however, if this is not performed, employee compensation may not be aligned with the actual hours worked. In the review of VSSA agreements for the five POEs, one agreement indicated that the reconciliation could be conducted over two VSSA schedules, three agreements allowed for administrative flexibility at the local level for reconciliation, and the last agreement was silent on this matter.

Potential causes that contributed to this include the tools used by management to monitor the situation, as well as the current incapacity of CAS to properly recognize VSSA schedules. A best practice was noted in the GTA region where the differences were very negligible. The COSS system was being used effectively at the Toronto Pearson International Airport and this included a superintendent being assigned to manage this function.

Salary Interdepartmental Settlement Process

An Interdepartmental Settlement (IS) is a mechanism to settle transactions or to transfer funds between two government departments or agencies that operate within the Consolidated Revenue Fund. Interdepartmental Settlements are usually processed on a creditor-initiated basis. The Corporate Accounting and Financial Policy Division of the Comptrollership Branch is responsible for the accounting and reconciliation of expenditure and non-tax revenue transactions recorded through the IS process in CAS and each regional finance unit or BMSU is responsible for processing Interdepartmental Settlements within their region or branch. A consistent process should be in place within the Agency to identify when salary recoveries are required, as well as for processing Interdepartmental Settlements that are received from OGDs.

A sample of two seconded or transferred-in employees and two seconded or transferred-out employees was selected for review from each region and from two HQ BMSUs. All of the samples related to Interdepartmental Settlements that were processed during 2008/09. The audit noted that adequate controls were in place to ensure that salary recoveries or payments were processed accurately and in a timely manner through the interdepartmental settlement process.

Recommendations:

1. The Vice-President of the Comptrollership Branch should review the financial delegations to bring them in line with the TBS Pay Administration Control Framework.

2. The Vice-President of the Comptrollership Branch, in collaboration with the Human Resources Branch, should finalize the Agency’s Compensation Control Framework, receive approval from senior management, and perform on-going testing of controls.

3. The Vice-President of the Human Resources Branch should establish documented procedures relating to the consistent application of the compensation transaction peer verification process.

4. The Vice-President of the Human Resources Branch should review the controls, tools and procedures that will result in accurate timesheet processing and VSSA reconciliations.

Knowledge and Ability

Training, policies, procedures, and guidelines should be in place and understood by compensation employees to enable them to perform their roles and responsibilities more effectively.

Compensation System and Training Consultants (CSTCs) in each region were responsible for developing CAS and compensation training sessions for compensation advisors in order to improve operational efficiency and client service levels. For any new acts, regulations, or guidance introduced, the CSTCs would deliver training packages to the compensation advisors based on Corporate Compensation guidance.

In addition, the CSTCs developed and implemented internal procedures such as checklists, ad-hoc training sessions, and information on the integration of other roles (i.e. CAS Role 43 – time administration).

The audit found that appropriate policies, procedures and guidelines were in place and understood by compensation employees to ensure that they were able to perform their roles and responsibilities.

The majority of training for junior compensation advisors came from on-the-job, one-on-one training and job shadowing provided by the CSTCs. The CSTCs conducted periodic reviews of transactions that were processed by compensation advisors and if there are consistent errors/issues identified, the CSTCs provided the necessary training to address those specific issues. The training program for compensation advisors also included taking multiple courses offered by PWGSC. All the regions that were reviewed also pro-actively supported and monitored the training progress of staff.

Monitoring

Monitoring is a core fundamental control and programs and activities should be monitored on a regular basis, and the results reported to the required management level.

Financial Process Monitoring

Financial process monitoring is required to ensure that the Agency is complying with the responsibilities of the FAA. As per the TBS Pay Administration Control Framework, quality assurance of the adequacy of the section 34 FAA verification process performed by compensation staff occurs either before or after the section 33 FAA payment requisition is applied. Further, in order to complete section 34 FAA verification, managers are required to periodically review payroll expenses for accuracy as they are mostly unaware of the actual value of most transactions at the time of FAA certification.

The audit noted that CBSA management was provided with the necessary tools in order to adequately manage their salary budgets and periodically review salary expenditures. Staff was able to provide the necessary data through CAS and the Salary Management System (SMS) to identify current salary expenses and allow for the ability to forecast future expenses based on commitments in place.

Audit interviews indicated that no monitoring or statistical sampling was performed by Corporate Accounting prior to performing section 33 FAA. Reliance was largely placed on the transaction verification process within Compensation and no review had been performed to obtain reasonable assurance over this process. This lack of monitoring at the corporate level increases the potential risk that errors may occur and remain undetected after payment to the employee.

National Compensation Service Standards (Non-EX)

During the examination phase of the audit, it was noted that informal transaction processing standards were in place within the compensation units visited. Formal National Compensation Service Standards (Non-EX) had been drafted; however, they had not been implemented or monitored by Corporate Compensation to provide reasonable assurance that compensation transactions were processed in a timely and consistent manner across the Agency.

After the conduct of the audit (September – October 2009), the National Compensation Service Standards were published on the CBSA Intranet site outlining reasonable and achievable time frames within which clients may expect service delivery under normal circumstances. Corporate Compensation outlined the roles, responsibilities, and processes of the regions and HQ regarding monitoring and reporting on the achievement of the developed standards. The review of the sample files found no issues relating to the timing of transaction processing within the compensation units visited.

Recovery of Salary Overpayments

The timing and/or accuracy of processing various compensation transactions may potentially lead to a salary overpayment to an employee. Common transactions where this may occur include: leave without pay (LWOP), maternity leave, leave with income averaging (LIA), or temporary struck-off-strength (T-SOS). Where possible, the overpayment is deducted from subsequent salary payments (first available funds), but it may also be recovered from superannuation benefits, income tax refunds, or other money payable to the employee, if required.

Controls should be in place for periodically monitoring, and recovering salary overpayments. The audit found that compensation advisors were aware of their responsibilities relating to monitoring and following-up with employees for any outstanding overpayments. This was particularly important when an employee was struck-off-strength from CBSA and was not transferring to an OGD. Comptrollership Branch was responsible for regularly monitoring the applicable GL accounts and ensuring that recovered amounts were cleared and that aging of amounts was performed and provided to Compensation for further follow-up, when necessary. As per the CBSA Financial Administration Control Framework, roles and responsibilities as well as detailed step-by-step processes were outlined for the respective parties.

The audit also found that the various salary asset accounts which relate to overpayments were periodically monitored by Corporate Accounting and Financial Policy Division in the Comptrollership Branch to identify outstanding overpayments and the Branch was working collaboratively with Compensation to resolve the outstanding amounts.

CAS and RPS System Access and Monitoring

Controls and procedures should be in place to ensure that only those individuals that require CAS and RPS on-line access have them and that these were periodically monitored by Corporate Compensation to ensure that only valid Agency employees continued to have the HR CAS role and associated pay list accesses.

CAS Role 18 is required by compensation advisors to perform their job functions. This role is currently granted through the CAS unit within CBSA. In January 2007, Human Resources Branch, Corporate Compensation was assigned the role of granting, deleting or amending pay list access for compensation advisors in CAS. The following roles are normally assigned: display, modify, verify, or authorize. For a given pay list, segregation of duties must exist between the verify and authorize functions, and which is also reiterated in CAS training documents.

Data extractions were analyzed for all of those CBSA employees that have CAS Role 18 access, as well as an extraction of the pay lists that they had access to and the associated role (i.e. display, modify, verify, or authorize) to ensure that the listed employees were valid CBSA compensation employees and that their job description warranted having such access. The audit found that no formal monitoring of accesses was being performed to ensure that only eligible employees continued to have CAS Role 18 access.

Further, the pay lists assigned were reviewed to ensure that they were appropriate and that necessary segregation of duties had taken place. No issues were identified relating to improper segregation of duties. However, there may be some issues with 24 of 146 employees with CAS Role 18; thereby potentially permitting them to view personal employee data that their position may not require. The issues were:

• User was not a current valid CBSA employee, or,
• Job description was not consistent with access.

Compensation advisors are also required to use PWGSC’s RPS system to process transactions. Some transactions must be entered directly on-line through this system as they cannot be processed through CAS. Such transactions require a similar verification and authorization process to occur (as with CAS entries). Interviews further indicated that compensation advisors were occasionally required to go into RPS directly in order to fix transactions that were rejected at RPS subsequent to being keyed into CAS. If this were the case, the CAS data would remain correct and the RPS data would need to be updated to rectify the error.

Security Access Control Officers (SACOs) are located within each region to assign RPS access to their compensation advisors. Interviews indicated that all CBSA compensation advisors had the ability to enter information into RPS directly. This was primarily required during the recent Frontière/Border (FB) classification conversion when many transaction processing errors had occurred within CAS. Corporate Compensation had also recently started to take on SACO responsibility, in order to remove the authority from the regions and initiate central monitoring, as well as to enable them to grant access to new Corporate Compensation employees, as required.

The audit also noted that RPS access was not being monitored centrally within Corporate Compensation. The lack of monitoring could lead to data integrity issues between payroll data in CAS and RPS due to multiple systems users, and employees could have access to personal information that is not required to do their job.

Reconciliation of Expenditures between CAS and RPS

CAS is used as the Agency’s financial reporting system. While the Agency’s salary expenses are recorded in CAS, employees are paid by PWGSC through the RPS. Information is transmitted regularly between the CAS and RPS systems as transactions are processed within CAS by compensation employees. PWGSC also performs adjustments (i.e. new entitlements or deductions) and the data is transmitted back to CAS so that information can be updated. Due to timing differences, human errors, system configurations, or transactions being entered directly into RPS, at any given point, differences can and do exist between the two systems. Corporate Accounting and Compensation are therefore responsible for ensuring that these differences are immaterial or relate to known issues. Corporate Accounting’s responsibility also includes periodic monitoring between the CAS and RPS data to reconcile the two systems and make adjustments when required at year-end.

Processes and procedures should be in place within Corporate Accounting in order to ensure that payroll errors are identified and corrected so that an accurate reconciliation between CAS and RPS GL control accounts could be performed. Furthermore, the identification of any significant variances should be detected and any necessary adjusting entries made in CAS to accurately reflect fiscal year-end salary amounts.

The audit reviewed the process that was conducted during the 2008-09 fiscal year-end and found that an appropriate and adequate risk-based process was in place within Corporate Accounting to identify potential errors and discrepancy issues between CAS and RPS. Operating procedures and guidelines were received to support the procedures being conducted by Corporate Accounting. These also indicated that Compensation was involved in resolving payroll system errors to ensure a more accurate year-end reconciliation.

Recommendations:

5. The Vice-President of the Comptrollership Branch should implement and report on a monitoring framework to ensure that reasonable assurance is obtained over the section 34 FAA compensation verification process.

6. The Vice-President of the Human Resources Branch should implement and report on a monitoring process to periodically review CAS and RPS system access.

Appendix A: Audit Criteria

The audit criteria used for the Engagement Phase were:

Appendix B: Assessment of Controls

	Controls*	Assessment**
Financial Delegations
1	Financial compensation transactions are approved and certified under FAA section 34 by an appropriate delegated authority.	Satisfactory
2	Financial compensation transactions are verified as part of FAA section 34 account verification by an appropriate delegated authority within Compensation.	Partially Satisfactory
3	CAS transaction pay file approval (section 33 FAA) is performed and sent to PWGSC for payment.	Partially Satisfactory
Compensation Transaction Processing
1	Service standards are in place and being monitored for processing of compensation transactions (outlining required information/forms, compensation response time/deliverables, and management and compensation roles and responsibilities).	Partially  Satisfactory
2	Compensation advisors possess the knowledge and ability to perform their roles and responsibilities in accordance with applicable regulations, policies, and procedures.	Satisfactory
3	All transactions are verified for accuracy and completeness, prior to CAS processing, by a peer verifier who is independent of the compensation advisor who entered the transaction. This would mean that compensation consultants do not input and verify the same transaction.	Partially Satisfactory
4	Based on expiry dates entered into CAS at origination of acting pay actions, the system will cut off the acting pay and revert the employee back to their basic pay.	Satisfactory
Timesheet Processing and VSSA Schedule Reconciliations
1	All timesheets are verified and approved by the appropriate superintendent/manager; confirming the accuracy and completeness of the hours worked and the related activity/absence codes.	Partially  Satisfactory
2	Only timesheets with appropriate approval are processed in CAS; timesheets that are not signed are returned to superintendents/managers.	Satisfactory
VSSA Schedule Reconciliations
1	Work schedule rules for shift employees are developed within CAS in order to maximize CAS based automated controls over time reporting.	Not Satisfactory
Monitoring and Oversight
1	Overpayments are identified and corrected, and an oversight function is in place to monitor any necessary recoveries.	Partially Satisfactory
2	Role 18 CAS access (HR role) is granted based on job requirements. Applicable segregation of duties is in place and is being monitored by Corporate Compensation.	Partially Satisfactory
3	Corporate Compensation authorizes access to RPS on-line centrally to minimize access based on operational needs.	Not Satisfactory
4	RPS on-line authorization includes review for appropriateness (necessity of input directly into RPS) and confirmation of subsequent parallel entry into CAS in order to maintain data integrity between the two systems.	Partially Satisfactory
5	Identification and correction of payroll errors and monthly reconciliation of CAS and RPS payroll information is conducted.	Satisfactory
6	Interdepartmental settlements for transfers or secondments out are processed accurately and in a timely manner. Appropriate section 34 approval is obtained prior to issuing an invoice for a transfer or secondment in.	Satisfactory
7	Reasonable assurance over the adequacy of the section 34 FAA verification is conducted.	Not Satisfactory
8	CBSA RC managers monitor salary expenditures and commitments and resolve any identified discrepancies.	Satisfactory

* Controls based on the PricewaterhouseCoopers Compensation Control Framework, the CBSA developed Compensation Control Framework (Draft) and the TBS Pay Administration Control Framework.

** Ratings defined:

• Satisfactory – Control is functioning as intended
• Partially Satisfactory – Control is functioning for some areas but not all or some elements of control are functioning as intended.
• Not Satisfactory – Control is not functioning as intended.

Appendix C: Pay Administration Flow [ 10 ]

Appendix C is also available in PDF (20 KB) [help with PDF files]

• Pay-related documents certified (letter of offer, overtime request, etc.)
  [S. 34 FAA certification (often originates from letter of offer)]
• Comp. Advisor confirms eligibility, calculates and enters transactions into Pay system (“Pay Input”)
• Comp. Advisor verifies transaction (“Pay verification”)
  [S.34 FAA account verification]
• QA of adequacy of S.34 FAA verification (occurs pre-payment or post-payment)
• Pay transaction is authorized (“Pay Authorization”)
  [S.33 FAA payment requisition (one time or recurring)]
• PWGSC processes pay, issues payments and provides Pay Register and Detailed Pay Expenditure file to Departments
• Compensation reviews pay register file and HR releases Payment
• Manager reviews pay expenses and confirms accuracy
  [Verification (completion of S.34 FAA)]

Appendix D: List of Acronyms

Notes

1. CAS shows the amount of all compensation transactions including non-cash transactions (i.e. leave), calculated on an accrual basis; RPS provides the Agency with detailed pay expenditure data, calculated on a cash basis; and PS-GL provides the Agency with the payroll control account balance, calculated on a cash basis. RPS and PS-GL are systems maintained by PWGSC. [Return to text]
2. To commence basic pay for an employee of the Agency through the PWGSC Pay System. [Return to text]
3. To stop the pay on termination of employment from the Agency through the PWGSC Pay System. [Return to text]
4. Two examples where this could occur include processing a taken-on-strength from another government department or when an employee is on a secondment and is in an acting position. [Return to text]
5. Compensation Web Applications (CWA) – a PWGSC administered suite of web-based, secure, on-line pay and pension services. [Return to text]
6. Computerized Officer Scheduling System (COSS) is a “real time” system that assists superintendents in making quick staffing decisions according to changing parameters. It provides information on each employee’s scheduled shifts, registered leave of absence and registered unavailability for overtime. Note that COSS is not utilized at all POEs. [Return to text]
7. This line of enquiry was developed based on key controls identified within the PricewaterhouseCoopers developed Payroll Control Framework as well as the Office of the Comptroller General Core Management Controls. [Return to text]
8. This line of enquiry will encompass the review of many of the key controls within the Payroll Control Framework. [Return to text]
9. This relates to those employees who must submit a timesheet in order to be paid. This is primarily for students or those employees who are under positive reporting. [Return to text]
10. As per TBS Pay Administration Guide [Return to text]