Audit of Parks and Recreation Payroll
Scope
The scope of the audit was from September 1, 2021, to August 31, 2022.
Objectives
The audit objectives were to provide reasonable assurance that the internal controls in place are adequate and effective and that the payroll processes comply with all applicable fiscal ordinances, policies, and procedures. Areas of audit focus included the processes and procedures for the following:- Onboarding of new employees
- Timekeeping
- Special allowances paid through payroll
- Overtime and compensatory time
- Reconciliations of payroll time and expenditures
- Offboarding of terminated employees
Additionally, in August 2023, the Salt Lake County Auditor’s Fraud Hotline received a fraud allegation regarding a Parks and Recreation Center. An anonymous employee alleged that another employee arrives to work late, avoids clocking in at the start of their shift, and then fabricates their start time when clocking out.
The Auditor’s Office has no opinion regarding the validity of the claim regarding an employee falsifying their time. However, as a result of the tip submitted, the scope of the audit was expanded to include additional audit procedures designed to provide reasonable assurance that controls are in place to prevent or detect fraudulent time entries.
Report Highlights
Background Checks Not Conducted or Not Conducted Before the Start of Employment
From a sample of forty-three newly hired or rehired employees, we found that one (2%) employee had not undergone a BCI background clearance check, and four (10%) employees had their BCI background clearance approved after starting employment.
Unable to Place Reliance on Timeclock Entries
Recreation Center staff are strongly encouraged to use the wall mounted clocks to clock in and out for work. However, there were no written policies regarding use of mobile or web-based timeclocks. We found that between August 2021 to October 2023, staff at one recreation center clocked-in 2,724 out of 8,514 (32%) times and clocked-out 2,310 out of 8,514 (27%) times, using the mobile application, not the wall mounted clock. The use of mobile and web-based applications for timeclock entries increases the risk that employees fraudulently punch in or out when not actually present and working at the designated work location. The risk of one employee fraudulently logging in for another employee is also increased with mobile and web-based applications, in contrast to the physical wall timeclock, which requires use of the employee’s fingerprint.
Agency Did Not Understand Retro Pay and Final Payout Responsibilities
During the audit period, we reviewed six retroactive payments and found that for four of the six (67%) transactions, there was no documentation on file regarding why the retroactive payment was required. In addition, for four of the six (67%) transactions, there was no evidence of management or supervisory approval of the payments. Finally for all retroactive payments there was no supporting documentation of the calculation of the amount due on file.
Documentation of Bonus Awards Not Retained
Parks and Recreation Management was unable to provide bonus award documentation for 27 of the 55 (49%) of the transactions we sampled. For the remaining 28 awards in our test sample, we found that bonus leave award documentation for six (21%) paychecks lacked important information such as the name and EIN of the employee receiving the award, the date the bonus leave was issued, and the pay period ending (PPE) when the award was being redeemed.
