Four former employees of a California hospital have been charged with payroll fraud for allegedly being paid for hours they did not work, the
San Bernardino County Sun reports. San Bernardino County District Attorney's Office investigators say the former Patton State Hospital employees — including the hospital's former payroll clerk — stole more than US$800,000 between August 2007 and March 2011. Separately, the California State Controller's Office (SCO) issued audit findings in August detailing poor payroll practices at the hospital, including two fraud cases in which employees were overpaid by US$900,000 between July 2010 and June 2013.
A particular aspect of this story that should concern both auditors and management of public health-care facilities is the "we said, you said" disagreement between the SCO and the Department of State Hospitals (DSH)–Patton over the use of two fraud cases that have now resulted in criminal charges. The disagreement also encompasses the findings and recommendations included in
a recent SCO payroll process audit (PDF) mentioned in the news report.
The DSH's contention that, because it first found and reported the evidence of fraud on the part of those now charged, these two cases can't be linked to the SCO's findings of significant deficiencies in its payroll systems and controls is a bit of a jaw-dropper. Equally puzzling is its insistence that the SCO made errors and exaggerated the dollar amounts of overpayments that the DSH made to some of its employees. It is evident from the audit report that the DSH's internal controls over its payroll processes have several substantive weaknesses, and that these weaknesses have been left mostly unaddressed over several years. Furthermore, the debate over what the amounts involved were and the related statistical methodologies do not in any way negate the identification of significant weaknesses in the DSH's internal controls, taken as a whole. In fact, these weaknesses, along with many of the SCO's recommendations for improvements, serve as a good outline for what to watch for and fix in order to prevent the kind of fraud involved in this case.
Ensure that there is adequate segregation of duties regarding payroll transactions. Payroll transactions unit staff members were processing all payroll transactions, including data entry into the state payroll system, maintenance of attendance records, certification of overtime and pay differential, and reconciliation of payroll, including system output to source documentation. Additionally, the SCO found that there was insufficient oversight to ensure that the payroll transactions unit staff processes only authorized transactions that comply with collective bargaining agreements and state laws, regulations, and policies. In turn, the SCO found that these material weaknesses in internal control over the payroll process contributed to the fraud incident that resulted in the more than US$800,000 in false payments reported in this story. Note that the SCO does not say "caused," and that auditors performed additional limited procedures to determine whether there were other payroll payment irregularities similar to the two fraud incidents. No additional fraudulent payroll payments were found. Nonetheless, the concern remains that material weaknesses in internal controls over the payroll process are still present that leave the DSH at risk of future fraudulent or erroneous payments if they are not mitigated.
Ensure that there is adequate oversight of payroll policies, related procedures, and their implementation as prescribed. For example, the SCO's audit found lax practices regarding scrutiny of daily attendance records whereby several individuals signed in or out for multiple other employees in a single work shift. Supervisors need to review daily attendance records and verify the accuracy of each employee's hours when they sign employees' time sheets.
Ensure that existing policies and procedures regarding out-of-class compensation are complied with and sufficient oversight is applied. Inevitably, this includes ensuring that policies and procedures are implemented as prescribed in accordance with collective bargaining agreements and government policies. Also, ensuring that there is adequate supporting documentation for an approving official to appropriately review and approve the assignment is a must. A mitigating factor in the DSH's favor may be the apparent urgency and volume of needed resources to fill out-of-class assignments. Here, the SCO's findings and recommendations are perhaps a little narrow and could have identified a governance and control issue — that is, the need for the state level of the DSH to assess whether an expedited approval process for these cases may have been warranted.
Ensure that a visible, stable, and adequately resourced internal audit function is in place. The fact that the DSH recently decided to create an audit office suggests that one or more of the above criteria may not have been met by whatever resources had been previously performing the essential tasks of periodically and systematically auditing what is going on within the payroll functions and the DSH's employees.