Internal Audit and Evaluation Bureau - Audit of TBS Pay Controls

Audit objective

The objective of this audit was to assess whether pay-related internal controls administered by the Treasury Board of Canada Secretariat (TBS) adequately support timely and accurate pay for TBS employees.

The audit was conducted in accordance with the International Standards for the Professional Practice of Internal Auditing of the Institute of the Internal Auditors (IIA).

Main observations

The audit team concludes with a reasonable level of assurance that TBS has adequate controls in place to support timely and accurate pay for TBS employees:

• all of the data entry reviewed was accurate
• there has been a substantial improvement in timeliness of data entry after the implementation of standards outlined in a memorandum of understanding between TBS and Public Services and Procurement Canada
• 92% of individuals who performed certification of authority (section 34 of the Financial Administration Act (FAA)) had financial delegated authority
• although half of the payments were authorized (section 33 of the FAA) without formal financial delegated authority, such authorizations were compatible with the corporate role of the person authorizing payments
• monitoring controls that are in place to identify pay errors focus mainly on financial risk
• system access to Phoenix is largely appropriate and monitored, and segregation of duties is maintained
• The audit team found that there was a case where system access to PeopleSoft was not properly authorized

Recommendations

1. Verify that individuals who sign letters of offer have financial delegated authority (section 34 of the FAA) and that individuals who exercise payment authority (section 33 of the FAA) have financial delegated authority.
2. Develop, approve and implement a quality assurance process to monitor pay transactions.
3. Continue to monitor human resources transactions based on risk and provide results to Public Services and Procurement Canada and the Office of the Chief Human Resources Officer.
4. Strengthen controls for managing access to PeopleSoft.

2.1 Authority

This Audit of TBS Pay Controls is part of TBS’s approved 2019–20 Integrated Audit and Evaluation Plan.

2.2 Objective and scope

The objective of the audit was to assess whether pay-related internal controls administered by TBS adequately support timely and accurate pay for TBS employees.

The audit was identified as a priority engagement based on the risks assessed during the 2019–20 audit and evaluation planning exercise. Since TBS was on-boarded to Phoenix in 2016, employees have experienced issues such as overpayments and underpayments, and in some cases, not being paid at all. Therefore, the purpose of this audit is to ensure that TBS’s Human Resources Division (HRD) and TBS’s Financial Management Division (FMD) are adequately supporting the timely and accurate receipt of pay by TBS employees.

The audit scope covered the period between February 2016 and November 2019.

The audit did not include an assessment of the issuance of emergency salary advances and priority payments to TBS employees.

2.3 Approach and methodology

The audit approach and methodology were risk-based and conformed to the International Standards for the Professional Practice of Internal Auditing of the IIA. These standards require that the audit be planned and performed in a way so as to obtain reasonable assurance that the audit objectives were achieved.

Methodologies to complete the audit work were as follows:

• interviews with management, staff and key stakeholders
• reviews and analysis of documents
• walk-throughs of HRD and FMD processes, testing, and data analytics

3.1 Current state

In May 2017, a year after Phoenix was implemented at TBS, there were 1,580 employees who had 3,458 cases in Phoenix. Pay issues escalated to a point in May 2018 where there were 2,788 employees who had 9,135 cases in Phoenix.

For the last three consecutive years, the Public Service Employee Survey asked TBS employees about the extent to which their compensation has been affected by issues with Phoenix. Figure 2 shows that the majority of TBS employees have reported they have had Phoenix issues from either a small to a very large extent since 2017.

                   

   

Figure 2 - Text version

       

Figure 2 is a line graph that shows, for the overall public service and for the Treasury Board of Canada Secretariat, the results of the 2019, 2018 and 2017 Public Service Employee Survey for the question, “To what extent has your pay or other compensation been affected by issues with the Phoenix pay system?”

The following table shows the data for the overall public service.

Response	2019	2018	2017
Not at all	25%	29%	30%
To a small extent	32%	26%	24%
To a moderate extent	20%	20%	19%
To a large extent	10%	11%	11%
To a very large extent	10%	11%	12%
Don’t know	2%	2%	4%
Not applicable	1%	1%	1%

The total respondents for each year was as follows:

• 2019: 181,161
• 2018: 161,576
• 2017: 174,272

The following table shows the data for the Treasury Board of Canada Secretariat.

Response	2019	2018	2017
Not at all	27%	25%	28%
To a small extent	31%	30%	24%
To a moderate extent	20%	19%	23%
To a large extent	11%	14%	12%
To a very large extent	9%	10%	10%
Don’t know	2%	1%	3%
Not applicable	1%	1%	1%

The total respondents for each year was as follows:

• 2019: 1,795
• 2018: 1,381
• 2017: 1,510

           

In June 2018, the pay pod responsible for TBS began its operations and was introduced as a new approach to stabilize the pay system. Its approach was to manage HR transactions as “new never becomes old,” whereby new transactions are treated first, which minimizes the risk of new transactions becoming old. Figure 3 illustrates the impact of this approach on TBS employees who had cases in Phoenix.^{Footnote 1}

                   

   

Figure 3 - Text version

       

Figure 3 is a complex lines graph that indicates, for certain months since 2017:

• the number of active cases that are less than or equal to 30 days old, more than 30 days but less than or equal to 1 year old, and more than 1 year old
• the number of personal record identifiers (PRIs) with active cases that are less than or equal to 30 days old, more than 30 days but less than or equal to 1 year old, and more than 1 year old

A vertical line at June 2018 indicates when the TBS pay pods were introduced.

The following table shows the age of active cases in certain months.

Month	Number of cases by age
	30 days or less	More than 30 days but less than or equal to 1 year	More than 1 year
June 2017	612	3,073	412
December 2017	757	3,850	1,549
June 2018	755	4,091	2,214
December 2018	580	3,025	2,669
June 2019	390	1,542	2,773

The following table shows, for certain months since 2017, the number of PRIs with active cases, by age of the case.

Date	Number of PRIs with active cases, by case age
	30 days or less	More than 30 days but less than or equal to 1 year	More than 1 year
June 2017	457	1472	337
December 2017	525	1743	913
June 2018	543	1928	1193
December 2018	439	1851	1419
June 2019	315	1068	1542

When the TBS pay pods were introduced in June 2018, total cases between 30 days and 1 year decreased and total cases over 1 year old increased.

           

Since July 2018, the number of employees who had cases less than a year old has decreased, likely because of the approach to treat new transactions right away. However, the number of cases over a year old increased to the point where, as of July 2019, most cases for TBS employees were over a year old. Therefore, the pay pod approach has been effective for employees who have new cases, but it has not had a meaningful impact on addressing employees’ cases that are older than one year.

As of July 2019, there were 5,255 cases remaining in Phoenix for TBS employees. The number of outstanding cases in Phoenix, in conjunction with the results from the Public Service Employee Survey, support why this audit engagement was important. TBS needs to ensure that it has adequate controls in place to:

• prevent data entry errors
• monitor HR and pay transactions
• verify that system access is appropriate

3.2 Controls to prevent pay errors: data entry

At TBS, PeopleSoft and Phoenix are two critical components of pay administration. Data entry for HR transactions is entered into PeopleSoft by HRD’s data entry team and is uploaded into Phoenix in real time. Such HR transactions include new hires, departures and employees transferring between departments. Data that is not entered into PeopleSoft in a timely or accurate manner may result in a pay issue for an employee.

The audit team reviewed 90 HR transactions to determine whether data entry into PeopleSoft was conducted accurately. The audit team found that all data entry was accurate, but it observed one case where data entry into PeopleSoft did not upload to Phoenix and caused a pay error for an employee.

The audit team reviewed 67 HR transactions (from the sample of 90) to determine whether data entry into PeopleSoft was completed in a timely manner. The audit team observed a marked improvement in the timeliness of data entry transactions since the standardized timelines were put in place on April 1, 2019. There were 31 pay transactions tested for timeliness that occurred before the standardized timelines came into effect; 36 pay transactions were tested that occurred after the timelines were established. Using these standards (generally 10 working days before the effective date of the transaction), timeliness of data entry increased from 3% to 61%. Improving the timeliness of data entry should reduce the likelihood of pay issues for employees. Of the 67 HR transactions reviewed, the audit team found that one HR transaction was entered late into PeopleSoft which caused a pay error for an employee.

Employees enter overtime and leave without pay (less than six days) directly into Phoenix, and fund centre managers are responsible for approving these transactions. The audit team reviewed the data entry of 25 HR transactions to determine the timeliness of data entry by TBS employees and approvals in Phoenix by fund centre managers. The audit team found that five transactions were entered and approved on time, and that these transactions were accurately reflected in the pay period in which they occurred. The remaining 20 transactions were either entered or approved too late by employees or managers to be accurately reflected in the appropriate pay period. Despite the lack of timely data entry, there were no pay issues that had a financial impact on the employees.

Overall, the majority of data entry completed by HRD into PeopleSoft was accurate, and there was a noticeable improvement in the timeliness of data entry.

3.3 Certification and payment authority

The Financial Administration Act (FAA) provides the legal framework for the expenditure of public funds. Section 34 of the FAA provides the certification authority with the authority to certify that the employee is eligible for a payment. In pay administration, section 34 is exercised once a fund centre manager signs a letter of offer to approve payments from their designated fund centre.^{Footnote 2} A letter of offer, signed by the appropriate fund centre manager, confirms that the employee is eligible for a salary paid by TBS.

Once the letter of offer has been signed by both the fund centre manager and the employee, a trusted source^{Footnote 3} within HRD sends the documentation, accompanied by a Pay Action Request (PAR) Form, to the Pay Centre. The trusted source ensures that all required supporting documentation has been obtained and that the PAR is complete and accurate before the information is sent to the Pay Centre. To minimize pay errors and ensure that pay requests are authorized, only individuals on the trusted source list can send a PAR to the Pay Centre. HRD is responsible for verifying that signatures on the letter of offer are authenticated by a fund centre manager who has delegated financial authority.

Section 33 of the FAA provides the payment authority with the authority to requisition payments. Section 33 is completed by FMD, where payments are verified on a risk-based approach before and after they have been paid to employees. Section 33 is exercised with the purpose of ensuring that payments made to employees are reasonable.

In order to have formal delegated authority, both the certification and payment authorities must have completed and signed forms that outline their responsibilities. Figure 4 illustrates details on section 33 and 34 authorities that are exercised in the hiring process.

                   

   

Figure 4 - Text version

       

Figure 4 illustrates the steps involved in approving pay under the Financial Administration Act.

There are 6 steps in all.

The first 4 steps are completed under section 34 of the act:

1. Fund Centre Manager exercises section 34 authority by signing a letter of offer
2. Letter of offer and other relevant documentation is sent to the Human Resources Division (HRD)
3. Human Resources verifies that the staffing request was authorized by a section 34 manager for the appropriate fund centre and completes data entry into PeopleSoft
4. The trusted source sends the Pay Action Request and other relevant signed documentation to the Pay Centre

The last 2 steps are completed under section 33 of the act:

5. The Phoenix Pay System calculates an employee’s pay based on the inputted data, and the Pay Centre sends a report to TBS’s Finance Division (FMD)
6. FMD exercises section 33 of the act by reviewing and approving payments for release

           

The audit team reviewed 25 PARs and accompanying letters of offer to test the two key controls to:

• determine whether the individual who signed the letter had certification authority (section 34)
• determine whether the individual who sent the PAR to the Pay Centre was on the trusted source list

We observed that all PARs were sent by individuals on the trusted source list. However, two of the letters of offer were signed by individuals who did not have certification of authority (section 34). In both cases, the individuals had financial authority, but not for the fund centres for which they signed. Nonetheless, the audit team noted that in both cases the staffing actions were approved by senior management at TBS.

The audit team reviewed 25 payments to determine whether the individual who performed the payment authority (section 33) had the formal delegated authority to approve the payment to the employee. We found that three individuals who had approved 13 payments in Phoenix did not have the formal delegated financial authority to exercise this authority. Specifically, the signed delegation of authority forms were not completed and signed off by a supervisor. Despite not having formal delegated authority, releasing payments to employees was compatible with their corporate role within FMD.

Awareness of the key controls required as part of certification (section 34) and payment authority (section 33) is necessary to ensuring the proper administration of public funds. Ensuring that those who have payment authority have signed delegated authority forms confirms that payments are reviewed for reasonableness by authorized individuals. Furthermore, verifying that letters of offer are signed by fund centre managers who have appropriate financial delegated authority confirms that the department is paying a salary to an eligible employee.

Recommendation: The Assistant Secretary, Corporate Services Sector, should ensure that (section 33) financial delegated authorities are formalized.

Recommendation: The Director General, Human Resources Division, should inform staff of the necessity to verify that fund centre managers who exercise (section 34) certification authority have financial delegated authority over the position being staffed.

3.4 Monitoring pay transactions to identify pay errors

3.5 System access

Identity and access management (IAM) is the process of managing who has access to what information over time. IAM is a broad concept that encompasses policies, processes, methodologies and tools to maintain access privileges within an IT environment, including granting access to valid users and denying access to invalid users. At TBS, access privilege includes identifying, tracking, controlling and managing authorized or specified users’ access to the Phoenix pay system and PeopleSoft.

In addition, IAM is used to ensure that appropriate access control policies are in place to protect confidential and sensitive information, such as employee salaries, home addresses and Personal Record Identifiers (PRIs). TBS access controls for pay systems enable:

• user identification and authentication
• restriction of access
• generation of audit trails to prevent improper use or manipulation of pay files and data

These controls ensure that only individuals who have a bona fide purpose and authorization have access to TBS payroll information and data. In short, IAM is a critical component of TBS’s security and compliance protocols as it relates to pay administration.

As such, the audit team reviewed IAM controls for both Phoenix and PeopleSoft, as these systems comprise an essential component of the payroll administration process.

Recommendation 1

The Assistant Secretary, Corporate Services Sector, should ensure that (section 33) financial delegated authorities are formalized.

Recommendation 2

The Director General, Human Resources Division, should inform staff of the necessity to verify that fund centre managers who exercise (section 34) certification authority have financial delegated authority over the position being staffed.

Recommendation 3

The Assistant Secretary, Corporate Services Sector, should complete, approve and implement the quality assurance process for pay administration.

Recommendation 4

The Director General, Human Resources Division, should continue to monitor HR transactions on a risk-managed basis for TBS employees and provide results to PSPC and OCHRO.

Recommendation 5

The Director General, Human Resources Division, should review the process for granting user access to PeopleSoft and ensure that controls are adequately communicated and monitored.