MEMORANDUM. Item A: Audit of City of San Juan Capistrano Payroll Transmittals

Transcription

1 ORANGE COUNTY EMPLOYEES RETIREMENT SYSTEM MEMORANDUM DATE: January 6, 2014 TO: FROM: Members of the Board of Retirement David James, Director of Internal Audit SUBJECT: Audit Committee Recommendations (Meeting on 12/19/13) Recommendation: Approve the Audit Committee recommendations. Discussion: Item A: Audit of City of San Juan Capistrano Payroll Transmittals The Audit Committee received the audit report that found that the City has adequate controls to ensure accurate, complete, and timely transmittal of payroll data to OCERS. However, in the report, Internal Audit found an opportunity to enhance existing internal controls. At the City, timesheets and time-off requests for all employees except department heads are approved. Internal Audit recommended that all timesheets require documented approval. The City concurred with and implemented this recommendation. Also, Internal Audit found eight pay periods with incorrect employee contributions totaling $1,054, which had been previously corrected by the City. Management also agreed to log payroll transmittal exceptions. The Committee voted to receive and file the report. Item B: Audit of Transportation Corridor Agencies (TCA) Payroll Transmittals The Audit Committee received the audit report that found that TCA has adequate controls to ensure accurate, complete, and timely transmittal of payroll data to OCERS. However, Internal Audit found that TCA s process for calculating and sending their payroll data to OCERS is a manual process, using spreadsheets that OCERS staff must use to manually enter the data into PensionGold. Internal Audit recommended that TCA s management consider automating this process to provide greater efficiencies. TCA s management agreed and is working with OCERS IT staff to implement the use of automated transmittal files to PensionGold. The Committee voted to receive and file the report. Item C: Audit of OCERS Process for the Annual Actuarial Data Extract The Audit Committee received the audit report that found there was not adequate documentation of sample testing of procedures performed on data sent to The Segal Company to verify the accuracy of that data. Internal Audit recommended that staff document their performance of this procedure for a better audit trail. Management asserted they have performed test work, though documentation of the test work was needed. Item C-4 Audit Committee Recommendations (Meeting on 12/19/13) Page 1 of 2 January 2014 Regular Board Meeting

2 Internal Audit also recommended that management develop and document procedures for queries for supplemental schedules. Internal Audit also recommended that management either automate the creation of these supplemental reports, or, because a key IT consultant who created the reports in 2012 has left OCERS, management should train staff to maintain such queries. Management asserted that IT staff are prepared to create the 2013 supplemental reports. Internal Audit recommended that OCERS divisions collaborate to delineate the procedures to be performed and by which division they are to be performed, and management concurred. The Committee voted to receive and file the report. Item D: Capital Calls Process Review The Audit Committee received the audit memo that concluded the current capital calls process, which involves Investments division authorizing the transfer of funds, and Finance division processing the wire transfer, was adequate and recommended that it not be changed. However, outside of the scope of capital calls, Internal Audit noted that other types of Investment fund transfers are approved and processed by the Investments division without the Finance division preparing and approving the wire transfer instructions. These could be both initiated and approved by an Investments staff member. Finance and Investments agreed that for amounts greater than $50 million, the wire transfers should be verified by Finance staff members who are Authorized Verifiers to State Street, OCERS s custodian bank. The Committee voted to receive and file the memo. Item E: Revised Policy and Procedure for the OCERS Hotline The Committee reviewed the revised hotline Policy and Procedure. It was confirmed that the Policy and Procedure were revised to add that in the event a report was filed regarding the CEO, then this information would be given to the Chair, Vice Chair, and Chair of the Audit Committee. Committee members asked that the Policy and Procedure be amended to clarify that when reports are filed on the hotline, the Director of Internal Audit and the Internal Auditor are each informed separately. The Committee approved the Policy and Procedure, subject to the insertion of changes as directed by the Audit Committee. Item F: Hotline Usage Report The Committee received an update on the hotline usage, which summarized reporting and investigation activities since the last Committee meeting. The Committee voted to receive and file the report. Item G: Status of Internal Audits The Committee received an update on the status of the audits being performed by the Internal Audit division and the revised Audit Plan for The Committee voted to receive and file the report. Prepared by: David James Director of Internal Audit Item C-4 Audit Committee Recommendations (Meeting on 12/19/13) Page 2 of 2 January 2014 Regular Board Meeting

3 ORANGE COUNTY EMPLOYEES RETIREMENT SYSTEM BOARD OF RETIREMENT 2223 WELLINGTON AVENUE, SUITE 100 SANTA ANA, CA AUDIT COMMITTEE MEETING December 19, :30 p.m. AGENDA This agenda contains a brief general description of each item to be considered. Except as otherwise provided by law, no action shall be taken on any item not appearing in the following agenda. A. AUDIT OF CITY OF SAN JUAN CAPISTRANO PAYROLL TRANSMITTALS Presentation by David James Recommendation: Receive and file. B. AUDIT OF TRANSPORTATION CORRIDOR AGENCIES (TCA) PAYROLL TRANSMITTALS Presentation by David James Recommendation: Receive and file. C. AUDIT OF OCERS PROCESS FOR THE ANNUAL ACTUARIAL DATA EXTRACT Presentation by David James Recommendation: Receive and file. D. CAPITAL CALLS PROCESS REVIEW Presentation by David James Recommendation: Receive and file. E. REVISED POLICY AND PROCEDURE FOR THE OCERS HOTLINE Presentation by David James Recommendation: Review and approve. F. HOTLINE USAGE REPORT Presentation by David James Recommendation: Receive and file.

4 Orange County Employees Retirement System December 19, 2013 Audit Committee Agenda G. STATUS OF INTERNAL AUDITS Presentation by David James Recommendation: Receive and file. PUBLIC COMMENTS: At this time members of the public may address the Committee regarding any items within the subject matter jurisdiction of the Committee, provided that no action may be taken on non-agendized items unless authorized by law. COMMITTEE MEMBER COMMENTS CHIEF EXECUTIVE OFFICER/STAFF COMMENTS ADJOURNMENT NOTICE OF NEXT MEETING REGULAR BOARD MEETING JANUARY 21, :00 a.m. ORANGE COUNTY EMPLOYEES RETIREMENT SYSTEM 2223 E. WELLINGTON AVENUE, SUITE 100 SANTA ANA, CA INVESTMENT COMMITTEE MEETING JANUARY 29, :00 a.m. ORANGE COUNTY EMPLOYEES RETIREMENT SYSTEM 2223 E. WELLINGTON AVENUE, SUITE 100 SANTA ANA, CA MANAGER MONITORING SUBCOMMITTEE MEETING JANUARY 30, :00 a.m. ORANGE COUNTY EMPLOYEES RETIREMENT SYSTEM 2223 E. WELLINGTON AVENUE, SUITE 100 SANTA ANA, CA

5 Orange County Employees Retirement System December 19, 2013 Audit Committee Agenda All supporting documentation is available for public review in the retirement office during regular business hours, 8:00 a.m. 5:00 p.m., Monday through Thursday and 8:00 a.m. 4:30 p.m. on Friday. It is OCERS' intention to comply with the Americans with Disabilities Act ("ADA") in all respects. If, as an attendee or participant at this meeting, you will need any special assistance beyond that normally provided, OCERS will attempt to accommodate your needs in a reasonable manner. Please contact Marisa Quintero the Board Secretary at as soon as possible prior to the meeting to tell us about your needs and to determine if accommodation is feasible. We would appreciate at least 48 hours notice, if possible. Please also advise us if you plan to attend meetings on a regular basis. 3

6 ORANGE COUNTY EMPLOYEES RETIREMENT SYSTEM MEMORANDUM DATE: December 10, 2013 TO: FROM: SUBJECT: Members of the Audit Committee David James, Director of Internal Audit Audit of City of San Juan Capistrano Payroll Transmittals Recommendation: Receive and file. Background: The OCERS Internal Audit Division has completed an independent review of the procedures for transmitting and processing payroll data between the City of San Juan Capistrano (SJC) and OCERS. Based on our review, Internal Audit has determined that SJC has adequate controls to ensure accurate, complete, and timely transmittal of payroll data to OCERS. However, we found an opportunity to enhance existing internal controls. Timesheets and time-off requests for all employees except department heads are approved. We recommend that all timesheets and time-off requests, including those of the department heads, require documented approval. Management has agreed to implement this recommendation. We also found eight pay periods with incorrect employee contribution amounts totaling $1,054, which had been corrected by SJC. Our findings and recommendations are discussed further in the report. Prepared by: Reviewed by: David James Director of Internal Audit Steve Delaney Chief Executive Officer Item A Audit of City of San Juan Capistrano Payroll Transmittals Page 1 of 1 Audit Committee Meeting December 2013

7 Audit of City of San Juan Capistrano Payroll Transmittals Report Date: September 18, 2013 Internal Audit Department Director of Internal Audit: David James, CPA, MBA Internal Auditor: Mark Adviento, CPA

8 OCERS Internal Audit Audit of San Juan Capistrano Payroll Transmittals September 18, 2013 Table of Contents Conclusion.1 Objective, Scope, and Methodology..1 Background...2 Findings, Recommendations, and Management Responses.. 4 Page ii

9 Executive Summary The OCERS Internal Audit Division has completed an independent review of the procedures for transmitting and processing payroll data between the City of San Juan Capistrano (SJC) and OCERS. Based on our review, Internal Audit has determined that SJC has adequate controls to ensure accurate, complete, and timely transmittal of payroll data to OCERS. However, we found an opportunity to enhance existing internal controls. Timesheets and time-off requests for all employees except department heads are approved. We recommend that all timesheets and time-off requests, including those of the department heads, require documented approval. We also found eight pay periods with incorrect employee contribution amounts totaling $1,054, which had been corrected by SJC. The details of our findings and recommendations are discussed further in the Findings, Recommendations, and Management Responses section of the report. Objective, Scope, and Methodology The objective of the review was to determine the accuracy, completeness, effectiveness, efficiency, and timeliness of the procedures for transmitting and processing SJC payroll data between SJC and OCERS. The scope of the review included payroll transmittals from July 10, 2009 to June 21, The methodology included, but was not limited to, the following: Review SJC s policies and procedures for the payroll transmittal process. Interview staff at SJC and OCERS involved in the payroll transmittal process to obtain an understanding of the processes in place, identify existing controls, and determine the efficiency of the processes. Determine whether the controls in place appear to be effective and functioning as designed. Trace sample transactions from SJC s payroll records to OCERS Pension Gold and OCERS cash receipts to determine accuracy, completeness, and timeliness. Trace sample transactions from SJC s payroll records to its source documents to determine the accuracy and completeness of data transmitted to OCERS. We planned and performed this review to obtain sufficient, appropriate evidence to provide a reasonable basis for our finding and conclusion based on our review objectives. We believe the evidence obtained provides a reasonable basis for our findings and conclusion based on our review objective. We would like to thank SJC management and staff for their cooperation. Audit of SJC Payroll Transmittals September 18, 2013 Page 1

10 Background The City of San Juan Capistrano uses software named GEMS to process more than $220,000 in base earnings for 76 current employees every biweekly pay period. SJC also sends payroll data every pay period to OCERS in order to update SJC employee records for salary history, years of service, employee contributions, and employer contributions necessary for eventual benefit payment calculations. Payroll Data Entry Each biweekly pay period, SJC s payroll accountant (accountant) collects a paper timesheet from each employee. The accountant reviews these timesheets for the appropriate supervisory approvals and also for authorizations for any time off taken such as for vacation or medical leave of absence. The accountant then enters hours worked or taken off for each employee into SJC s payroll software GEMS (Government e-management Solutions). Also, the accountant enters into GEMS any authorized employee status changes such as promotions or step increases. These status changes are summarized by the accountant into a spreadsheet. With both timesheet data and authorized employee status changes entered into GEMS, the accountant generates a preliminary payroll report. The preliminary payroll report also includes exception reports that identify potential payroll anomalies. Thresholds are programmed into GEMS to identify such anomalies, and one example includes flagging excessive gross pay or excessive net pay. Other exceptions flagged by GEMS include incorrect general ledger coding and employees that have not been paid. Once these items have been researched and corrected by the accountant, all timesheets and the preliminary payroll report are submitted to the Senior Accountant for supervisory review. SJC Management Review of Payroll The Senior Accountant reviews the timesheets and the preliminary payroll for accuracy and completeness. Once the review is completed and any errors identified by the review are corrected, the accountant runs the final payroll report. The Senior Accountant signs off on the cover page of the final payroll report indicating evidence of her review. The accountant then creates the journal entries from GEMS for posting in the General Ledger; payroll checks are cut, and electronic payment wires instructions are sent to the bank. Audit of SJC Payroll Transmittals September 18, 2013 Page 2

11 Payroll Transmittal to OCERS SJC has configured GEMS to create the electronic payroll transmittal file required by OCERS for every pay period. After payroll has been finalized, SJC s accountant generates the payroll transmittal file from GEMS. The file contains several data fields for the current pay period including employee name, pensionable salary, earnable salary, employee contributions, and employer contributions. To ensure that the transmittal file is accurate and complete, the accountant converts the transmittal file into Excel and compares the total of pensionable salary and contributions of the electronic payroll transmittal file against the totals as seen in the finalized payroll report. After this check, the accountant s a password protected transmittal file to OCERS Member Services division, IT division, and Finance division. OCERS pension administration system, PensionGold then performs a series of automated checks of SJC s transmittal files against expected values. Any exceptions, such as incorrect employee contribution rates, are tracked by OCER s transmittal desk personnel and communicated to SJC for research and correction. SJC also electronically wires the employee contributions for the pay period to OCERS bank. SJC s accountant s OCERS Finance division a spreadsheet containing a listing of employees, pensionable salary, and both employee and employer contribution calculations. The total of employee contributions on the spreadsheet should match with the amount wired to OCERS bank. SJC s employer contributions are not paid with each pay period, but are instead prepaid for the entire year in January. OCERS Finance Division s Reconciliation and Recordkeeping OCERS Finance division records SJC s employee contributions wire on the general ledger accordingly. The Finance division also compares PensionGold s updated SJC employee contribution records against the bank wire to ensure a match; any discrepancies are researched and cleared. Also, since SJC prepays employer contributions at the beginning of the year, Finance keeps a running tally of SJC s biweekly employer contribution calculations to make a final adjustment against the prepayment at the fiscal year end. Audit of SJC Payroll Transmittals Internal Audit Testwork During fieldwork, Internal Audit tested 200 individual payroll transactions from 40 payroll transmittal files sent biweekly to OCERS from July 10, 2009 through June 21, For each payroll transaction tested, Internal Audit traced hours worked, pensionable salary, employee contribution amount, and employee contribution rate from SJC s payroll records and Human Resources records to PensionGold for accuracy. Premium pay September 18, 2013 Page 3

12 items were also traced from the payroll reports to PensionGold. SJC has eighteen types of premium pay items, including such items as a car allowance and bilingual pay. Internal Audit also verified that timesheets were properly approved by a supervisor and that final payroll reports were reviewed by the accountant s supervisor. Finally, Internal Audit tested for the timeliness of contributions amounts wired by SJC to OCERS. For each employee tested, Internal Audit traced name, social security number, age of entry into OCERS, entry date into OCERS, and date of birth from PensionGold against Member Affidavits to ensure correct employee contribution rates. To test for completeness of SJC payroll data sent to OCERS, Internal Audit also traced total employee contributions from the 40 contributions spreadsheets tested against cash receipts recorded by OCERS Finance division. For employer contributions, we recalculated amounts stated on SJC s payroll reports and compared these against amounts recorded by OCERS Finance division. OCERS is transitioning to a new pension administration system, V3, in early Per our inquiry of management, SJC possesses the current technical specifications for payroll transmittal files needed for V3. Furthermore, they intend to make the necessary programming changes to their payroll system to comply with OCERS V3 payroll transmittal requirements. The California Public Employees Pension Reform Act (PEPRA) established a new pension plan tier for new public employees hired after January 1, SJC does not have any employees subject to this new tier. However, SJC has added the new PEPRA tier to its payroll software for future employees classified in the new tier. PEPRA also requires that SJC communicate to OCERS if any of its employees have been convicted of any job-related felonies. Per inquiry of SJC management, they have been made aware of this requirement by OCERS executive staff. Also per PEPRA, Internal Audit also reviewed the benefit calculations for recent SJC retirees and did not note any exceptions related to compensation earnable or ad-hoc enhancements indicative of pension spiking. Findings, Recommendations and Management Responses Finding #1 Although SJC employees require supervisory approval of time sheets and time-off request forms, Internal Audit noted that secondary approval for timesheets and time-off request forms are not required for department heads. Internal Audit noted that timesheets were self-approved and time-off requests were missing for department heads on ten different occurrences. Without such secondary approval, there is increased risk that time entry is incorrect. Thus, benefit payments could be incorrectly increased if final average salary calculations include overstated leave accruals or cashouts, which are both pensionable pay items. Audit of SJC Payroll Transmittals September 18, 2013 Page 4

13 Year Pay Period 2009 PP# 17 3 occurrences 2010 PP # PP # PP # PP # PP # PP # PP #03 Recommendation All timesheets and requested time-off forms should require secondary approval. Department heads should have their secondary approval come from another department head or from Human Resources. Management Response The City concurs with the auditor s recommendation. Effective with the pay period ending August 23, 2013, the City Manager or her designee will review and approve the timesheets for all Department Heads, including the City Clerk. In addition, the Human Resources Manager will be responsible for reviewing and approving the City Manager s timesheets. Regarding leave requests, the City s current practice requires that Absence Request Forms are completed by the Department Heads and approved by the City Manager. However, the Payroll Accounting Specialist will be responsible for being more diligent in following up to ensure that all Absence Request Forms are obtained from the Department Heads and attached to the employee s timesheet to support that leave taken was authorized by the City Manager. Finding #2 During our test work, Internal Audit noted that eight pay periods had been corrected by SJC for incorrect employee contribution amounts totaling $1,054. These errors were identified by PensionGold s automated error checks of bi-weekly payroll transmittal files Audit of SJC Payroll Transmittals September 18, 2013 Page 5

14 received from SJC. However, SJC management did not keep a separate logging of such errors for analysis purposes. Pay Period Amount of Error Reason PP # PP # PP # PP # PP # Net of $31 Correction for PP s #16, #21 & #22 from 2009 $20 Correction for PP #9 from 2010 $11 Correction for PP #12 from 2010 $396 Correction for PP #04 from 2011 $596 Correction for PP #21 from 2011 Recommendation SJC s management review of payroll should include logging such payroll transmittal exceptions errors to identify any systemic problems, patterns of exceptions, causes, and help ensure that all necessary corrections are being made to their records. Management Response The City acknowledges that while we have always addressed any errors identified by PensionGold in a timely manner, we have not developed an Error Log for analytical purposes. Beginning with payroll for April 2013, the City has created an OCERS Correspondence Log to document all errors identified by PensionGold and resolutions. A copy of this log has been recently provided to OCERS. Audit of SJC Payroll Transmittals September 18, 2013 Page 6

15 ORANGE COUNTY EMPLOYEES RETIREMENT SYSTEM MEMORANDUM DATE: December 10, 2013 TO: FROM: SUBJECT: Members of the Audit Committee David James, Director of Internal Audit Audit of Transportation Corridor Agencies (TCA) Payroll Transmittals Recommendation: Receive and file. Background: OCERS Internal Audit Division has completed an independent review of the procedures for transmitting and processing payroll data between the Transportation Corridor Agencies (TCA) and OCERS. Based on our review, Internal Audit has determined that TCA has adequate controls to ensure accurate, complete, and timely transmittal of payroll data to OCERS. However, TCA s process for calculating and sending payroll data to OCERS is a manual process. We recommend that TCA s management consider automating this process to provide greater efficiencies. The details of our finding and recommendation are discussed further in the report. Prepared by: Reviewed by: David James Director of Internal Audit Steve Delaney Chief Executive Officer Item B Audit of Transportation Corridor Agencies (TCA) Payroll Transmittal Page 1 of 1 Audit Committee Meeting December 2013

16 Audit of Transportation Corridor Agencies (TCA) Payroll Transmittals Report Date: August 19, 2013 Internal Audit Department Director of Internal Audit: David James, CPA, MBA Internal Auditor: Mark Adviento, CPA

17 OCERS Internal Audit Audit of TCA Payroll Transmittals August 19, 2013 Table of Contents Conclusion.1 Objective, Scope, and Methodology..1 Background.. 1 Finding, Recommendation, and Management Response.. 5 Page ii

18 Executive Summary OCERS Internal Audit Division has completed an independent review of the procedures for transmitting and processing payroll data between the Transportation Corridor Agencies (TCA) and OCERS. Based on our review, Internal Audit has determined that TCA has adequate controls to ensure accurate, complete, and timely transmittal of payroll data to OCERS. However, TCA s process for calculating and sending payroll data to OCERS is a manual process. We recommend that TCA s management consider automating this process to provide greater efficiencies. The details of this finding and recommendation are discussed further in the Finding, Recommendation, and Management Response section of the report. Audit of TCA Payroll Transmittals Objective, Scope, and Methodology The objective of the review was to determine the accuracy, completeness, effectiveness, efficiency, and timeliness of the procedures for transmitting and processing TCA payroll data between TCA and OCERS. The scope of the review included payroll transmittals from January 3, 2009 to March 22, The methodology included, but was not limited to, the following: Review TCA s policies and procedures for the payroll transmittal process. Interview staff at TCA and OCERS involved in the payroll transmittal process to obtain an understanding of the processes in place, identify existing controls, and determine the efficiency of the processes. Determine whether the controls in place appear to be effective and functioning as designed. Trace sample transactions from TCA s spreadsheet file to OCERS Pension Gold and OCERS cash receipts to determine accuracy, completeness, and timeliness. Trace sample transactions from TCA s spreadsheet file to source documents to determine the accuracy and completeness of data transmitted to OCERS. We planned and performed this review to obtain sufficient, appropriate evidence to provide a reasonable basis for our finding and conclusion based on our review objectives. We believe the evidence obtained provides a reasonable basis for our finding and conclusion based on our review objective. We would like to thank TCA management and staff for their cooperation. Background TCA is comprised of two joint-powers agencies the Foothill/Eastern Transportation Corridor Agency and the San Joaquin Hills Transportation Corridor Agency formed in August 19, 2013 Page 1

19 1986 to manage the planning, financing, construction, and operation of State Routes 73, 133, 241, and 261 (i.e., The Toll Roads). Located in Irvine and with on average 75 current employees, TCA uses a third party payroll vendor, ADP, to process approximately $200,000 in base earnings every biweekly pay period. TCA sends certain payroll data every pay period to OCERS in order to update TCA employee records for salary history, years of service, employee contributions, and employer contributions necessary for eventual benefit payment calculations. Retirement Contributions Calculation Each biweekly pay period, TCA s payroll accountant (accountant) collects a paper timesheet from each employee. The timesheets are reviewed and signed off by the employee s supervisor. The accountant enters hours worked for each employee into the spreadsheet (contributions spreadsheet) to calculate employee pensionable and nonpensionable earnings, and employee/employer contributions to OCERS. The spreadsheet also separates premium pay items such as car allowance, standby time, holiday, and bonuses from regular earnings for accurate classification of pay. The spreadsheet is a template that is used for each pay period and lists employee names, hourly pay rates, employee contribution percentages and employer contribution percentages. The accountant also maintains a second spreadsheet for non-ocers deductions such as cafeteria plan deductions. TCA Management Review of Payroll Once both spreadsheets are completed, the accountant logs in to the ADP payroll website. An ADP Payload Spreadsheet is copied from the prior month and any changes in hours worked, salary, payroll deductions, and employee pension contributions are updated. Once data entry is complete, the accountant prints out a preliminary payroll register from the ADP website. The Assistant Controller reviews the preliminary payroll register, all employee timesheets, and the two spreadsheets for accuracy and completeness of hours. Evidence of such review is documented and includes the Assistant Controller s comments, signature, and date. The preliminary payroll register also includes a personnel change report that captures any changes to an employee s payroll information from the prior pay period. Thus, erroneous or unauthorized changes to payroll rates or creation of fictitious employees would be highlighted. The Assistant Controller also reviews the personnel change report. The accountant then enters any needed corrections noted from the Assistant Controller s review into ADP and prints a corrected payroll register. The accountant updates the spreadsheet sent to OCERS, and the Assistant Controller reviews the revised spreadsheet. Audit of TCA Payroll Transmittals August 19, 2013 Page 2

20 With the Assistant Controller s approval of the corrected payroll register, the accountant again logs in to the ADP website to generate final payroll on the Monday before the Friday payday. The next business day, TCA receives a binder from ADP. This binder contains receipts for direct deposit, paychecks, various payroll analytical reports, payroll compliance reports, and the final payroll register. TCA s Controller reviews the final payroll register and other documents in the Assistant Controller s review package for accuracy and completeness of hours, and notes any needed corrections to be processed in the next payroll. The review is evidenced with the Controller s review notes and signature signoff. Payroll Transmittal to OCERS Before payday Friday, the accountant mails to OCERS a hardcopy of the contributions spreadsheet noted above along with a check in the amount of total employee contributions for the current pay period. OCERS receives the contributions spreadsheet before the end of the following pay period. Preparation of the check is properly segregated from the payroll accountant. The TCA s contributions are not directly updated into OCERS pension administration system, PensionGold. OCERS creates the transmittal file to upload TCA s payroll data to PensionGold. The majority of the plan sponsors provide OCERS with a payroll transmittal file, which is an electronic text file containing the sponsor s biweekly payroll data. The electronic text file can be uploaded directly into PensionGold to automatically update member records without manual intervention. TCA and two smaller plan sponsors do not make use of automated payroll transmittal files. An OCERS transmittal desk employee in Member Services manually enters the payroll data from the contributions spreadsheet into a PensionGold utility screen named ManTran. Once the data entry is complete and reverified for accuracy by the above mentioned staff at Member Services, OCERS IT staff creates a payroll transmittal file in Pension Gold. PensionGold s exception report is also generated on the TCA s payroll transmittal file to detect potential errors. TCA s exception reports are few and usually caused by Member Services data entry errors. After exceptions are corrected, OCERS IT staff submits the payroll transmittal file into PensionGold to update TCA employee records for the current pay period. OCERS Finance Division s Reconciliation and Recordkeeping OCERS Finance division records the employee contributions check on the general ledger and deposits the check accordingly. The Finance Division also compares TCA s updated contribution records in PensionGold against the check to ensure a match; any Audit of TCA Payroll Transmittals August 19, 2013 Page 3

21 discrepancies are researched and cleared. Also, since TCA prepays employer contributions at the beginning of the year, Finance keeps a running tally of TCA s biweekly employer contribution calculations, also contained in the contributions spreadsheet, to make a final adjustment against the prepayment at the fiscal year end. Internal Audit Testwork During fieldwork, Internal Audit tested 200 individual payroll transactions from 40 contribution spreadsheets sent biweekly to OCERS from January 3, 2009 through March 22, For each payroll transaction tested, Internal Audit traced hours worked, earnable salary, employee contribution amount, and employee contribution rate from the contribution spreadsheet to PensionGold (OCERS pension administration system) for accuracy. Premium pay items were also traced to PensionGold, but TCA has only three types and these apply to seven employees. Internal Audit also traced from the TCA timesheets to the contributions spreadsheet for accuracy, traced the grand total from payroll/adp report to the contributions spreadsheet for completeness, and compared grand totals between the timesheets and contributions spreadsheet versus the total on the transmittal file for completeness. Internal Audit also tested for timeliness of contributions spreadsheets sent by TCA to OCERS. For each employee tested, Internal Audit compared name, social security number, age of entry into OCERS, entry date into OCERS, and date of birth from PensionGold against TCA Human Resources records and Member Affidavits to ensure correct employee contribution rates. Internal Audit also traced total employee contributions from the 40 contributions spreadsheets tested against cash receipts recorded by OCERS Finance division. For employer contributions, we recalculated amounts stated on the contributions spreadsheet and compared against amounts recorded by OCERS Finance division. Finally, we noted that TCA s management review of payroll records is clearly evidenced with dated signatures and review notes from the Assistant Controller and Controller as well as the Payroll accountant s signature evidencing clearance of the review notes. From the above testing, there were six data entry errors in which OCERS staff incorrectly keyed in both employee and employer contribution amounts from TCA s contributions spreadsheet into PensionGold. The total amount of these errors was $2,058. However, OCERS Finance division employees detected and corrected all of these errors when performing month-end reconciliation procedures. No errors were noted in the information that TCA provided to OCERS. Audit of TCA Payroll Transmittals August 19, 2013 Page 4

22 Pay Period Ending Employees effected Employee Contribution Errors Employer Contribution Errors August 14, $784 $396 June 3, ($270) June 17, ($125) ($60) September 9, $1,333 - Totals: $1,992 $66 Finding, Recommendation and Management Response Finding As mentioned previously, TCA does not have an automated process for calculating and sending payroll data to OCERS. TCA s payroll accountant manually prepares a spreadsheet containing employee payroll data needed for OCERS to update member records every pay period. Consequently, OCERS Member Services staff must manually enter the payroll data for OCERS IT staff to create a payroll transmittal file necessary to upload the information to PensionGold. This manual process leads to an increased risk of data entry error as well as creates inefficiency, as it currently requires both TCA and OCERS to manually enter data at different stages of the process. Recommendation Automating TCA s transmittal of payroll data to OCERS via an electronic text file would eliminate the need for OCERS Member Services staff to manually enter payroll data, reducing the risk of the type of data entry errors noted above and increasing efficiency. OCERS IT Division has provided TCA management with the technical requirements for an automated payroll transmittal file. OCERS IT staff and TCA IT staff will be having further discussions to determine how best to implement automated payroll transmittal files. Transitioning from manually generated payroll spreadsheets to data files that can be automatically transmitted into PensionGold would prepare TCA for automated payroll transmittal requirements of V3, OCERS new pension administration system currently being developed. Management Response TCA agrees with the recommendation and is working with OCERS IT staff to determine the technical requirements and cost necessary to best implement the use of automated payroll transmittal files for OCERS pension administration system, PensionGold. TCA Audit of TCA Payroll Transmittals August 19, 2013 Page 5

23 will also work with OCERS IT staff to perform the same analysis to comply with payroll transmittal file requirements for OCERS new pension administration system, V3, currently being developed. September 15, 2013 is TCA s target date for determining when TCA can implement payroll transmittal files for PensionGold. Audit of TCA Payroll Transmittals August 19, 2013 Page 6

24 ORANGE COUNTY EMPLOYEES RETIREMENT SYSTEM MEMORANDUM DATE: December 10, 2013 TO: FROM: SUBJECT: Members of the Audit Committee David James, Director of Internal Audit Audit of OCERS Process for the Annual Actuarial Data Extract Recommendation: Receive and file. Background: OCERS Internal Audit Division has completed an independent audit of OCERS process for extracting actuarial data from its pension administration system, PensionGold. OCERS actuary, The Segal Company, uses these data, pertinent supplemental data such as plan assets, employer and employee contributions by rate group, plan reserves, and expenses as well as other various economic and demographic assumptions, to perform their annual actuarial valuation. The actuarial valuation is used to determine OCERS actuarial accrued liability for pension benefits for its members as well as funding status, unfunded actuarial accrued liability, and future contribution rates for employers and employees. During the course of our audit, Internal Audit noted that management should adequately document sample testing of procedures performed on data sent to Segal to verify accuracy of the data. Management asserted they performed sample testing, but Internal Audit was not able to validate this due to a lack of adequate documentation. We recommended that they document their performance of this procedure for a better audit trail. Internal Audit has also identified an opportunity to reduce the potential for inaccuracies in the data transmitted to Segal by automating certain procedures in the data extract process and thereby improve the efficiency of the process as well. As such, we have recommended to management to further study the feasibility of that transition. Additionally, Internal Audit has recommended that Member Services, Finance, and Information Technology (IT) collaborate to clearly delineate the procedures to be performed and by which division they are to be performed to formalize the process and the assignment of each procedure within the process. We have also recommended to management to update the relevant procedures manuals to reflect the actual practices in place. The details of our findings and recommendations are discussed further in the report. Prepared by: Reviewed by: David James Director of Internal Audit Steve Delaney Chief Executive Officer Item C Audit of OCERS Process for the Annual Actuarial Data Extract Page 1 of 1 Audit Committee Meeting December 2013

25 Audit of OCERS Process for the Annual Actuarial Data Extract Report Date: December 10, 2013 Internal Audit Department Director of Internal Audit: David James, CPA, MBA Internal Auditor: Mark Adviento, CPA

26 OCERS Internal Audit Department Audit of OCERS Process for the Annual Actuarial Data Extract December 10, 2013 Table of Contents Conclusion.1 Objective, Scope, and Methodology..1 Background 2-5 Findings, Recommendations, and Management Responses Exhibits Page ii

27 Executive Summary Internal Audit Division has completed an independent audit of OCERS process for extracting actuarial data from its pension administration system, PensionGold. OCERS actuary, The Segal Company (Segal), uses these data, pertinent supplemental data such as plan assets, employer and employee contributions by rate group, plan reserves, and expenses as well as other various economic and demographic assumptions, to perform their annual actuarial valuation. The actuarial valuation is used to determine OCERS actuarial accrued liability for pension benefits for its members as well as funding status, unfunded actuarial accrued liability, and future contribution rates for employers and employees. During the course of our audit, Internal Audit noted that management should adequately document sample testing of procedures performed on data sent to Segal to verify accuracy of the data. Management asserted they performed sample testing, but Internal Audit was not able to validate this due to a lack of adequate documentation. We recommended that they document their performance of this procedure for a better audit trail. Internal Audit has also identified an opportunity to reduce the potential for inaccuracies in the data transmitted to Segal by automating certain procedures in the data extract process and thereby improve the efficiency of the process as well. As such, we have recommended to management to further study the feasibility of that transition. Additionally, Internal Audit has recommended that Member Services, Finance, and Information Technology (IT) collaborate to clearly delineate the procedures to be performed and by which division they are to be performed to formalize the process and the assignment of each procedure within the process. We have also recommended to management to update the relevant procedures manuals to reflect the actual practices in place. The details of our findings and recommendations are discussed further in the Findings, Recommendations, and Management Responses section of the report. Objective, Scope, and Methodology The objective of the audit was to determine the adequacy of the internal controls in place to ensure accurate and complete data transmitted for the actuarial valuation. The scope of the audit included the 2012 actuarial extract process, and data extracted for the 2011 and 2012 actuarial valuations. We did not audit investments information, employer or employee contributions by rate group information, or financial reporting information transmitted to the actuary. Audit of OCERS Process for the Annual Actuarial Data Extract December 10, 2013 Page 1

28 The methodology included the following: Review OCERS policies and procedures comprised of Actuarial Extract Policy and Process and OCERS Actuarial Data Processing Guide. Interview personnel in Information Technology, Member Services, Finance, and Segal to obtain an understanding of the processes in place, identify existing controls, and assess their adequacy. Trace key data in the non-payee and payee data extract files to PensionGold, on a sample basis, to determine accuracy. Trace key data in the supplementary data files to PensionGold, on a sample basis, to determine accuracy. Search 2011 and 2012 actuarial extract files using ACL, a data analysis and audit software, to identify errors within data fields; duplicate non-payees and payees, and blank data within data fields such as employment date or contribution amounts. Compare the 2012 extract files against an independent count of member records, using ACL software, to determine whether the extract files contained all members. We planned and performed this audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objective. We believe the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objective. We would like to thank management, staff, and The Segal Company for their cooperation. Background OCERS actuary, The Segal Company, performs an actuarial valuation of OCERS plan assets and accrued liability as of December 31 on an annual basis. To perform the actuarial valuation, Segal requires data on OCERS current members, both non-payees and payees from PensionGold. Segal provides a detailed listing of the data required in a letter mailed in January to OCERS Assistant CEO of Finance and Internal Operations. The project manager for the process of gathering this data for Segal is OCERS Director of Information Technology (IT). She is assisted by a Member Services Manager and an IT consultant, who left OCERS on May 31, Furthermore, the Assistant CEO, Finance and Internal Operations, provides executive oversight as head of the Actuarial Steering Committee, which is comprised of employees from the IT Division, Member Services Division, and Finance Division. The majority of membership data requested by Segal is automatically captured in the actuarial data extract, which is comprised of two text files that the IT division extracts directly from PensionGold. One text file contains data of non-payees comprised of Audit of OCERS Process for the Annual Actuarial Data Extract December 10, 2013 Page 2

29 active and deferred members as of December 31. The second text file contains data of payees comprised of retired members, disabled retirees, surviving spouses or beneficiaries as of December 31. Both text files capture numerous data fields containing items such as names, identification numbers, demographic data, work and salary history, contribution history, and plan types. The remainder of membership data requested by Segal is captured in supplemental data schedules extracted by OCERS IT staff. PensionGold s extract process was never configured to capture such data when OCERS converted to PensionGold. To generate the schedules, in 2012 OCERS IT used queries in Microsoft Access and Crystal Reports to capture certain data from the two extract files as well as from PensionGold data tables. Current supplemental data schedules capture full-time equivalent salary and premium pay items for active members; final average salary for deferred members; rate groups assignments (along with a breakdown of contribution and benefit payments by rate group); benefit continuance information for retired and disabled members; and final average salary and years of service credit for payees. In 2010, OCERS discovered that the actuarial data extract provided to its actuary did not include premium pay items for the years 2004 through Premium pay items include, for example, pay for bilingual language skills or car allowances for managers. After OCERS compiled the missing premium pay items and provided it to the actuary, an additional $228 million was added to OCERS unfunded liability. The omission of premium pay was a result of an inadequately configured extract process within PensionGold. Premium pay items have since been compiled by the IT Division into a supplemental schedule, discussed above, for Segal s use in the actuarial valuation. The premium pay issue also triggered the hiring of an outside consulting firm (Clifton Gunderson) in 2011 to review several of OCERS business processes including the actuarial extract process. One result of the report s several recommendations was the formation of an Actuarial Extract Steering Committee to provide cross-divisional management to ensure that Segal s data requests for the annual valuation are met timely, completely, and accurately. A second result of the report was the development of the Actuarial Extract Policy, adopted by the Board of Retirement in June OCERS Validation of Data Before IT extracts the two text files, Member Services processes all status changes to members (i.e., new member retirements, deaths, lump-sum payments, retroactive adjustments, and payroll transmittal exceptions) for the valuation year by January 31. This helps to ensure that the text files have complete membership data. IT also runs several queries against both text files to find potential data errors (see Exhibit 1 for a listing). OCERS IT consultant built these queries based on data anomalies and errors uncovered by OCERS actuary, Segal, in previous years valuations. Examples of data anomalies and errors include missing members, salary Audit of OCERS Process for the Annual Actuarial Data Extract December 10, 2013 Page 3

30 increases greater than 25%, and members with more than one year of service credit since the prior year. To separate false positives from true data errors, the Member Services Manager researches PensionGold member records. For example, a member may possess more than one year of service since the prior year due to a Service Purchase Contract which allows a member to purchase additional service credit. Member Services corrects confirmed data errors in PensionGold. Such errors were typically caused by transmittal data received from employers, data entry error, or from past system conversions. Finally, OCERS staff sends updated text files and supplemental schedules to Segal for their review and provides Segal with answers to questions they may have. Often, Segal makes additional ad hoc requests that staff accommodate. For example, OCERS, based on recommendations made by Segal, revised how it calculates full-time equivalency salary for part-time workers, new hires, and deferred members. OCERS staff answers all such questions and sends final text files and supplemental schedules to Segal by late March or April. OCERS staff also sends final summary reports to each plan sponsor for review and verification of certain data submitted to Segal. See Exhibit 2 for a flowchart of the actuarial data extract process. Internal Audit Testwork During fieldwork, Internal Audit obtained the actuarial extract files for 2011 and From the 130 data fields in these files, Internal Audit judgmentally selected 10 data fields 1 for testing (for 60 randomly selected members) to determine whether there was a match between the extract files and data recorded in PensionGold to determine accuracy. Internal Audit found no exceptions. Premium Pay items are not included in the extract files but are gathered separately from a database into additional files by OCERS for Segal as mentioned previously in the Background section of this report. Internal Audit randomly selected a sample of 30 members from this file to verify that Premium Pay items in the file are accurate by tracing them to PensionGold. Internal Audit found no exceptions. In addition, using ACL, Internal Audit searched the 2011 and 2012 actuarial extract files for any data errors such as data entry errors with date fields; duplicate non-payees and payees; and blank data within data fields such as employment date or contribution amounts. Exceptions were noted and are discussed in detail in Finding #5 below. 1 The ten fields included: member name, member ID, date of birth, date of entry, earnable salary, service length, plan ID, separation date, pension amount, and annuity amount. Audit of OCERS Process for the Annual Actuarial Data Extract December 10, 2013 Page 4

31 According to management, these errors were data entry errors from past system conversions and do not materially impact the valuation due to the immateriality of the errors. Finally, to test for the completeness, Internal Audit compared the record count of the 2012 extract files (i.e. 26,007 non-payees and 14,390 payees) against the record count of an independent data query of PensionGold using ACL software. Internal Audit found one member that was not found on the extract files. At the time of issuance of this report, Member Services and IT have not identified the cause for this occurrence. See Finding #5 below for further discussion. Audit of OCERS Process for the Annual Actuarial Data Extract December 10, 2013 Page 5

32 Findings, Recommendations and Management Responses Finding #1: Procedure Regarding Confirmation of Data Accuracy As stated in step #5 of the Actuarial Extract Policy and Process, IT programming staff imports the actuarial extract file data into an Access database to enable Member Services staff and Finance staff to confirm data accuracy and create a test sample A reasonableness test is done to ensure the file contains accurate and complete data In the Clifton Gunderson report dated July 8, 2011, Observation #4 noted that there was currently no process in place to ensure that the data extracted from the Pension Gold system and subsequently sent to the actuary is complete and accurate. The report recommended that when data is extracted from PensionGold that a sample of the data is traced back to Pension Gold for accuracy. In addition, we also recommend that the total population per Pension Gold is reconciled and agreed to the total population sent to the actuary to ensure completeness of census data. Management concurred with these recommendations. Management has asserted to Internal Audit that sample testing was performed on the extract files and supplemental files prior to being sent to Segal for the 2012 actuarial valuation. However, Internal Audit noted that there was no documentation that such testing occurred, or the extent, methodology, or results of the testing. In addition, there is a lack of documented procedures for the testing methodology or sampling method(s) used, or how the testing documentation should be maintained as an audit trail. Recommendations Management should develop written procedures governing the testing methodology, sampling method(s), and documentation templates for the testing of the extract files and supplemental schedules sent to Segal. For example, management should develop and document sample testing procedures they have used or will use to verify that key membership data in the text files match the data in PensionGold. Key data includes, but is not limited to, date of birth, date of separation, years of service earned, plan ID #, benefit type, pensionable salary, premium pay items, pension amount, and annuity amount. Additionally, Management should develop and document sample testing procedures they have used or will use to verify that key data in the supplemental files match the data in PensionGold. Key data includes full-time equivalency salary calculations and rate group assignments. In selecting samples for verification, management could consider using statistical sampling to select members for testing. Alternatively, the sample may also be randomly selected. Audit of OCERS Process for the Annual Actuarial Data Extract December 10, 2013 Page 6

33 Management Response The actuarial extract and valuation process was significantly overhauled in Staff implemented intensive review procedures and significantly increased the participation of managers and staff from the Member Services department, IT staff and the Finance department. During the 2012 actuarial extract process, the OCERS team reviewed a large number of records (staff estimated to have reviewed thousands of records) to ensure completeness and accuracy of the data sent to Segal. However, during the first year of working under the new Actuarial Extract Policy that was adopted by the Board of Retirement in June 2012, documented evidence of a specific test group was not created or retained. The Actuarial Extract Steering Committee will continue to improve the process including creating a set of documented sample testing procedures and working papers to memorialize the work performed. Finding #2: Supplemental Data Schedules The majority of membership data required by Segal is captured in the two text files automatically extracted in PensionGold. According to IT management, additional membership data required by Segal not identified in the two text files has been captured in supplemental data reports developed by an IT consultant experienced with PensionGold s database architecture. These reports capture data elements such as fulltime equivalent salary and premium pay items for active members; final average salary for deferred members; rate groups assignments (plan sponsor groupings by benefit plan); benefit continuance information for retired and disabled members; and final average salary and years of service credit for payees. Additionally, queries are run against the actuarial extract files to generate numerous reports 2 used by the Finance and Communications divisions to prepare external reports, such as the Comprehensive Annual Financial Report (CAFR), OCERS by the Numbers, and State Controller s Office (SCO) reporting. 2 The following are sample reports used in the CAFR, OCERS by the Numbers and SCO report: Active and Deferred members report, OCERS membership report, Benefit Recipients summary report, Deferred Members summary report, Average monthly pension check report, Average pension by years of service report, Benefit recipients by benefit type report, Benefit recipients by option type report, Average retirement age report, Average years of service report. Audit of OCERS Process for the Annual Actuarial Data Extract December 10, 2013 Page 7

34 The IT Division has no documented policies and procedures that govern how these queries are created. Furthermore, the IT consultant who built and ran data queries necessary for not only the actuarial purpose but other external reporting left OCERS in May Extending the automated data extract process to include the data elements of the supplemental data schedules would eliminate the need for a programmer to build customized reports currently in use and reduce the likelihood of errors inherent in the supplemental schedules generated. Recommendations Management should develop and formally document procedures that govern how the queries for supplemental data schedules are created. Management should also consider reconfiguring PensionGold s current extract process to automatically include information provided by these queries. If management finds it more feasible to continue relying on some or all of the manually-generated queries to provide data to Segal until the V3 conversion, IT management should train appropriate staff in maintaining such queries due to the departure of the IT contractor noted earlier. Management Response Management is very cognizant of the Board s desire to minimize the amount of money spent on modifying PensionGold while we are in the middle of converting to V3. Management has committed to make only cost beneficial changes to the existing system. However, the design of the actuarial extract in V3 is substantially complete and includes all the required information without the need for the additional queries to provide the standard data needed by the actuary. OCERS IT Programming staff are currently developing processes and procedures to govern how all IT reports are created and maintained within the organization. This will provide for the proper documentation of the design, testing, and maintenance of all IT Programming reports. Finding #3: Defining Procedures, Assigning Roles and Supervisory Review We noted in the excerpt from the Actuarial Extract Policy and Process mentioned above in Finding #1 that it is not clearly stated which division is responsible for performing the data verification function. We also noted that OCERS does not have documented supervisory review and approval for the procedures performed to gather actuarial data. Ensuring accurate data for the valuation is an important business objective that spans several weeks involving multiple divisions and numerous meetings with Segal. In developing and assigning responsibility for the procedures, a secondary or supervisory review of critical tasks such as clearing the exceptions from validation reports and supplemental schedules, and the verification of the data (as discussed in Audit of OCERS Process for the Annual Actuarial Data Extract December 10, 2013 Page 8

35 Finding #1) should be incorporated in the procedures to ensure that they are completed properly. Recommendations Member Services, Finance, and Information Technology (IT) should collaborate to clearly delineate specific procedures to be performed in gathering the data for actuarial purposes and by which division they are to be performed to formalize the process and the assignment of each procedure within the process. Clearly defined roles named by function, supervisory reviews, and approvals should also be included as part of the procedures, where applicable. Taking this step at this time would be particularly beneficial considering the recent departure of a key IT consultant, who performed many of the data extract functions, as discussed in Finding #2. Management Response Management concurs with the recommendation. Significant changes were made to the actuarial extract process to improve its effectiveness and strengthen internal controls, however, there is still room to improve. Documenting all of the procedures involved in the end to end cross departmental process, clearly assigning specific tasks, including supervisory review is an area for improvement. Documenting the procedures with clearly stated task assignments and responsibilities will begin in December as the 2013 Actuarial Extract Process begins. Finding #4: Actuarial Data Processing Guide Is Not Current or Applicable The Actuarial Data Processing Guide, dated June 16, 2010, is not current and does not reflect the entire process for gathering data needed for Segal s actuarial valuation. It describes mostly IT processes and does not contain detailed descriptions of related processes performed by Member Services and Finance. Recommendations The Actuarial Steering Committee should replace the Actuarial Data Processing Guide with a new procedures document containing current descriptions of procedures carried out by staff for the actuarial valuation. Management Response Management concurs with the recommendation. The Actuarial Extract Committee will work together to not only update the Actuarial Data Processing Guide but to expand it to cover the end to end cross departmental process as discussed in Finding #3 above. Finding #5: Data Variances Audit of OCERS Process for the Annual Actuarial Data Extract December 10, 2013 Page 9

36 Data provided to the actuary should be complete and accurate to avoid the risk of an incorrect actuarial valuation. Internal Audit performed the following data integrity checks on the 2011 and 2012 data text files. Using ACL, Internal Audit searched the 2011 and 2012 actuarial extract files for any data errors such as data entry errors with date fields; duplicate non-payees and payees; and blank data within data fields such as employment date or contribution amounts. Internal Audit also compared the record count of the 2012 extract files against the record count of an independent data query of PensionGold to test for completeness of the files. In our completeness testing, we found one member that has not been included in past valuation extract files sent to Segal. The member s active status date is currently stated in PensionGold with the year The variances found from the testing are listed in the table below. These do not have a material impact to the valuation, according to Segal and Member Services. Manual data entry error during past system conversions were the cause. OCERS converted from the County s mainframe system in 1993 to HP, and converted from HP to PensionGold in Payee Text File Date of birth same as benefit effective date Member date of birth same as beneficiary date of birth Non-Payee Text File Date of birth greater than employment date 7 6 Completeness Testing 2012 Member missing from the extract 1 For discussion on other testwork performed by Internal Audit, see Internal Audit Testwork section above. Audit of OCERS Process for the Annual Actuarial Data Extract December 10, 2013 Page 10

37 Recommendations Member Services should review the variances and correct member records in PensionGold accordingly. Management Response Management has corrected the above errors for payee and non-payee text files in PensionGold. With regard to the error discovered during the completeness testing, the record will be corrected. Audit of OCERS Process for the Annual Actuarial Data Extract December 10, 2013 Page 11

38 Exhibit 1: Listing of Validation Queries Run by IT 1. Active or deferred members with no salary or service history. 2. Missing members 3. Payees with increased benefits 4. Active members without active work history 5. Active members with salary increases greater than 25% 6. Members in disabled status with a terminated benefit 7. Survivors of deceased members with wrong benefit type 8. Active non-standard full-time employees with salary increases greater than 25% 9. Multiple beneficiaries with an incorrect domestic relation order distribution 10. High service hours per pay period 11. Members with the wrong social security number 12. Active members with service increase or decrease greater than 1 ½ years 13. Members with less than one year of service 14. Members with high earnable salaries 15. Active members with no pensionable salary Audit of OCERS Process for the Annual Actuarial Data Extract December 10, 2013 Page 12

39 Exhibit 2: Actuarial Data Extract Process Audit of OCERS Process for the Annual Actuarial Data Extract December 10, 2013 Page 13

40 ORANGE COUNTY EMPLOYEES RETIREMENT SYSTEM MEMORANDUM DATE: December 10, 2013 TO: FROM: SUBJECT: Members of the Audit Committee David James, Director of Internal Audit Capital Calls Process Review Recommendation: Receive and file. Background: At the request of Finance and Investments divisions, Internal Audit has conducted a review of the process for initiating and approving capital calls to determine the adequacy of internal controls in place over the process. We determined that the capital call process in place was adequate and recommended that the current process remain unchanged. However, we noted during our review that other types of investment fund transfers other than capital calls are approved and processed by the Investments division without the Finance division preparing and approving the wire transfer instructions. After conferring with Investments and Finance divisions, their management agreed that for amounts greater than $50 million, the wire transfers should be verified by Finance staff members who are Authorized Verifiers to State Street. This ensures that for these large dollar transfers, only Finance staff can verify the transaction with State Street before the wire transfer can take place. Providing the segregation of duties between approval of payment and processing of the payment will also help to mitigate the risk of fraud and errors by having two divisions be involved in the transaction to enhance the assurance of the appropriateness of the fund transfer. Therefore, Finance will amend the State Street Funds Transfer Callback List of Authorized Verifiers so that Investments staff cannot verify wire transfers of amounts greater than $50 million. Prepared by: Reviewed by: David James Director of Internal Audit Steve Delaney Chief Executive Officer Item D - Capital Calls Process Review Page 1 of 1 Audit Committee Meeting December 2013

41 ORANGE COUNTY EMPLOYEES RETIREMENT SYSTEM MEMORANDUM DATE: September 16, 2013 TO: FROM: SUBJECT: Steve Delaney, Chief Executive Officer Girard Miller, Chief Investment Officer Brenda Shott, Assistant CEO of Finance and Internal Operations David James, Director of Internal Audit Internal Controls over the Capital Calls Process At the request of Finance and Investments divisions, Internal Audit has conducted a review of the process for initiating and approving capital calls to determine the adequacy of internal controls in place over the process. Payment Approval and Processing The Investments division initiates the transferring of funds necessary for capital calls. Either the Director of Investment Operations or the Investment Analyst stamps, signs, and dates the capital call notice received from an OCERS investment manager to signify approval. Investments division then submits the approved capital call notice to Finance division to initiate the wire transfer. The Accountant Auditor from Finance then prepares wire transfer instructions, which are then approved by the Finance Reporting Manager. The Accountant Auditor from Finance sends the approved wire transfer instructions to OCERS custodian bank, State Street, for processing the wire transfer. Since wire transfers for capital calls involve significant sums of multi-millions of dollars, management should have adequate internal controls to mitigate the risk of fraud and errors. We concur that the segregation of duties that currently exists by Investments performing the authorization of funds function and Finance performing the processing of funds function is a strong internal control to protect against unauthorized or inappropriate transfers of funds. Therefore, we recommend that payment request for capital calls should continue to be initiated and approved by the Investments division, and that the Finance division should continue to prepare and approve the payment, i.e. the wire transfer instructions. Additional internal controls are in place to ensure that capital call wire transfers are authorized before funds are transferred. When a capital call is initiated by Investments staff, multiple parties in Investments and Finance are notified by before the transfer occurs. Item D - Internal Controls over the Capital Calls Process Page 1 of 3 Audit Committee Meeting December 2013

42 State Street confirms by to multiple parties in OCERS Investments and Finance divisions to notify the receipt of the fax with wiring instructions from OCERS Finance division. Additionally, before the day of the transfer, State Street makes a telephone call to an OCERS staff to verbally verify the details of the wire transfer. State Street refers to the Incumbency Certificate, last updated on April 1, 2013, which lists certain OCERS staff members from the Investments and Finance divisions who are Authorized Initiators or Authorized Verifiers of wire transfers. Recordkeeping We noted that adequate internal controls exist to ensure that capital call transactions are recorded accurately in OCERS records. Both Investments and Finance maintain records on capital call transactions. The Investment Analyst from the Investments division maintains a spreadsheet called OCERS Cash Needs, which tracks the balance in the OCERS Unallocated Cash Account JV1B for State Street. This spreadsheet is compared with the State Street report Private Edge All Performance Report quarterly by the Investment Analyst to verify that OCERS transactions are accurately recorded by State Street. The Accountant Auditor from the Finance division maintains a spreadsheet called Schedule of Commitment Open to track the total capital commitment and capital drawn with each private equity fund that OCERS has an agreement. The Accountant Auditor also maintains a spreadsheet called Drawdown Reports, which records the capital call fund, fund number, transfer date, capital call amount, and wire transfer amount. The Senior Accountant from the Finance division compares each transaction in the Drawdown Reports with the monthly State Street Working Trial Balance report when preparing monthly journal entries of investment transactions. Recommendation to Enhance Internal Controls We noted during our review that aside from capital calls, other types of investment fund transfers are approved and processed by the Investments division, without the Finance division preparing and approving the wire transfer instructions. These are typically initial funding of investments with high dollar amounts that are initiated by the CIO and that can potentially be verified by Investments staff only because they are Authorized Verifiers to State Street. After conferring with Investments and Finance divisions, their management agreed that for amounts greater than $50 million, the wire transfers should be verified by Finance staff members who are Authorized Verifiers to State Street. This ensures that for these large dollar transfers, only Finance staff can verify the transaction with State Street before the wire transfer can take place. Item D - Internal Controls over the Capital Calls Process Page 2 of 3 Audit Committee Meeting December 2013

43 Because only the CIO or CEO can authorize the initial funding of investments, requiring that authorized Finance staff verify the transaction with State Street would enhance internal controls by providing the segregation of duties between approval of payment and processing of the payment. It will also help to mitigate the risk of fraud and errors by having two divisions be involved in the transaction to enhance the assurance of the appropriateness of the fund transfer. Therefore, Finance will amend the State Street Funds Transfer Callback List of Authorized Verifiers so that Investments staff cannot verify wire transfers of amounts greater than $50 million. David James Director of Internal Audit CC: Tracy Bowman, Director of Finance Shanta Chary, Director of Investments Operations Item D - Internal Controls over the Capital Calls Process Page 3 of 3 Audit Committee Meeting December 2013

44 ORANGE COUNTY EMPLOYEES RETIREMENT SYSTEM MEMORANDUM DATE: December 10, 2013 TO: FROM: SUBJECT: Members of the Audit Committee David James, Director of Internal Audit Revised Policy and Procedure for the OCERS Hotline Recommendation: Review and approve. Background: Attached are revised hotline policy and procedure prepared by Internal Audit. The original policy and procedure were presented at the Audit Committee meeting on June 6, 2013, and presented at the Board of Retirement meeting on July 15, A member of the Board requested an amendment to the policy. Please refer to paragraphs 7 and 8 of the Policy, and page 2 of the Procedure, with changes highlighted in red. Prepared by: Reviewed by: David James Director of Internal Audit Steve Delaney Chief Executive Officer Item E Revised Policy and Procedure for the OCERS Hotline Page 1 of 1 Audit Committee Meeting December 2013

45 OCERS BOARD POLICY ETHICS, COMPLIANCE, AND FRAUD HOTLINE PURPOSE AND BACKGROUND 1. The OCERS Ethics, Compliance, and Fraud Hotline (the Hotline) was established in October 2012 to aid management in the detection of activities that are unethical, fraudulent, or not in compliance with the policies of OCERS. The Hotline facilitates anonymous reporting by employees, contractors, members, and the general public to report concerns about potential misconduct or inappropriate activities, including but not limited to, harassment, conflict of interest, violation of policy, fraud, and waste of resources. 2. The Hotline reinforces OCERS efforts to ensure transparency, accountability, fairness, and integrity in the workplace. OBJECTIVE 3. The purpose of this document is to establish a policy for conducting an investigation when a report of potential misconduct or inappropriate activity is made through the Hotline, and for assigning responsibility for taking appropriate actions as a result of the investigation. POLICY 4. OCERS management is responsible for the implementation of procedures and controls designed to prevent and detect fraud, misappropriations, deception, wrongdoing, and other inappropriate conduct. Fraud is defined by the Association of Certified Fraud Examiners as any intentional act to deprive another of property or money by acts of guile, deception, or other unfair means. Fraud can include conflict of interest, theft, or breach of fiduciary duty. Each member of the OCERS management team must be familiar with the types of improprieties that might occur within his or her area of responsibility, and be alert for any indication of irregularity. 5. All allegations of potential misconduct or inappropriate activity raised by any source will be taken seriously and properly investigated. Retaliation against anyone who reports suspected misconduct or inappropriate activity will not be tolerated. 6. OCERS Director of Internal Audit will be responsible for conducting an investigation as a result of a report being filed on the Hotline. The investigation will be conducted without regard to the alleged wrongdoer s length of service, position, title, or relationship with OCERS. 7. If an allegation is made against the Chief Executive Officer, then the Director of Internal Audit will inform the Board Chair, the Vice Chair, and the Chair of the Audit Committee about the allegation and the results of any investigation that may occur. 8. If an allegation is made against the Director of Internal Audit, then the Director of Internal Audit or Internal Auditor, as appropriate, will inform the Chief Executive Officer, who will then be responsible for directing any investigation that may occur. Ethic, Compliance, and Fraud Hotline Policy Page 1 of 2 Adopted Last Revised June 11, 2013