Loading...
HomeMy WebLinkAboutAudit Reports - Public - Telestaff Business Process and Internal Control Review Report - 6/3/2021 FINAL REPORT City of Glendale TELESTAFF BUSINESS PROCESS AND INTERNAL CONTROL REVIEW DRAFT REPORT June 3, 2021 Moss Adams LLP 999 Third Avenue, Suite 2800 Seattle, WA 98104 (206) 302-6500 Telestaff Business Process & Internal Control Review Report for the City of Glendale Table of Contents Executive Summary 1 A. Objectives 1 B. Conclusions 1 Detailed Report 3 A. Introduction 3 B. Background 3 C. Scope and Methodology 3 Findings and Recommendations 5 Process Improvement Opportunities 8 Appendix: Definitions of Audit Findings Rankings 9 Telestaff Business Process and Internal Control Review Report for the City of Glendale | 1 EXECUTIVE SUMMARY Moss Adams LLP was contracted by the City of Glendale (the City) to evaluate and test internal controls related to the Fire Department’s use of the Telestaff system, which is the system used for scheduling and deploying department resources and reporting hours/shifts worked. Our review included evaluating manual processes for reviewing and updating timesheets, assessing access levels to key Telestaff functions, evaluating the system training available for users, assessing process and controls leave recording, and evaluating the overall controls over hours reporting. This engagement was performed in accordance with Standards for Consulting Services established by the American Institute of Certified Public Accountants. Accordingly, we provide no opinion, attestation, or other form of assurance with respect to our work or the information upon which our work is based. This engagement was also performed in accordance with the guidance issued by the Institute of Internal Auditor’s (IIA’s) International Professional Practices Framework (IPPF). This report was developed based on information gained from our interviews and analysis of sample documentation. The procedures we performed do not constitute an examination in accordance with generally accepted auditing standards or attestation standards. Our objectives for this engagement were:  To determine whether adequate internal controls were in place over the Fire Department’s use of the Telestaff system.  To assess whether the appropriate segregation of duties is in place to ensure that data exported from the Telestaff system to Simplicity, the payroll modular in Tyler MUNIS (MUNIS), were adequate to ensure the accuracy and integrity of time reported.  To evaluate the Fire Department’s overall use of the Telestaff system for opportunities for increased efficiency and effectiveness, and incorporation of industry best practices. The procedures and testing performed identified two areas that warrant improvement. These are highlighted in the following table: MANUAL PROCESSES 1 Finding Medium Risk – There are significant manual processes required to ensure time reporting information is correct, and multiple errors were not identified during the pay period, which requires adjustments/corrections on the back end. Recommendation Consider investing in Telestaff system training, specifically for those individuals responsible for editing rosters, calendars, and time reports; evaluate whether additional access could be granted to distribute responsibilities; and work with the service provider to identify potential system solutions. Telestaff Business Process and Internal Control Review Report for the City of Glendale | 2 TELESTAFF USER TRAINING 2 Finding Low Risk – Training on the Telestaff system has not been provided, and the system may have additional capabilities that are not being utilized. Recommendation Seek training opportunities for all Telestaff user levels and evaluate system capabilities for opportunities for increased utilization. Although the focus of this internal audit was to identify opportunities for improvement, it is also important to note areas of commendable operations. The City’s Fire Department should be commended for the following accomplishments:  Readiness for Change: During our interviews, feedback from Fire Department employees indicated an eagerness to adopt improvements to their use of the Telestaff system such as gaining efficiencies and empowering supervisory employees while maintaining adequate internal controls.  Comprehensive Reviews: Although there are opportunities for efficiency gains in this process, Fire Department administration had comprehensive reviews and reconciliations in place to ensure the accuracy and integrity of information exported from the Telestaff system into the payroll system for payroll processing. We would like to thank City staff and management for their willingness to assist with this project. Telestaff Business Process and Internal Control Review Report for the City of Glendale | 3 DETAILED REPORT Moss Adams LLP was contracted by the City to perform an internal audit over the processes and internal controls related to the Fire Department’s use of the Telestaff system. Telestaff is the system used for scheduling and deploying department resources and reporting hours/shifts worked. This internal audit was performed as part of the Fiscal Year (FY) 2020 Annual Audit Plan developed by the City’s Independent Internal Audit Program (IIAP). This internal audit was performed between August 2020 and February 2021. The Telestaff system acts as the electronic roster that the Fire Department uses to schedule employees on a weekly basis and track shifts and hours worked, by employee. It is also the main interface for data that is exported, manipulated as needed, and uploaded into Simplicity, the payroll module in MUNIS. During each payroll processing week, Fire Department Administration begins an internal quality control review, about two to three days before payroll processing, to review each employee’s Advanced Calendar for the pay period in Telestaff. The review includes tying out the final Advanced Calendars to the original Employee Rosters (i.e., schedule for the period). Once all calendars have been reviewed, the data for the pay period is exported into a CSV file and then uploaded into Executime, a system that is used to ensure that the timecard matches the calendar and roster. Currently, Telestaff and Simplicity are not integrated; therefore, the data in Telestaff requires manual adjustments and corrections before it can be uploaded into Simplicity for payroll processing. Once Telestaff data is reviewed and approved, it is exported into a CSV file, which often results in error messages that require review and correction from Fire Department Administration before the file can be uploaded into Simplicity. Our objectives for this internal audit were related to the Fire Department’s use of the Telestaff system. Specifically, the internal audit focused on the following objectives:  Determine whether adequate internal controls were in place over the Fire Department’s use of the Telestaff system.  Assess whether the appropriate segregation of duties is in place to ensure that data exported from the Telestaff system to Simplicity, the payroll modular in MUNIS, were adequate to ensure the accuracy and integrity of time reported.  Evaluate the Fire Department’s overall use of the Telestaff system for opportunities for increased efficiency, effectiveness, and best practices. In order to obtain an understanding of the specific processes and internal controls related to the Fire Department’s use of the Telestaff system, we conducted interviews with Fire Department personnel, who have designated responsibilities related to processing, reviewing, and managing rosters, calendars, and time reporting. We performed the following detailed testing procedures: Telestaff Business Process and Internal Control Review Report for the City of Glendale | 4  Manual Processes: For the pay period ending October 9, 2020, we performed a virtual (screen share) "live" walk-through of the processes that Fire Department Administration performs each pay period to evaluate, review, and correct/adjust the information in Telestaff and ultimately get it ready for upload into Simplicity for payroll processing. ○ We obtained all supporting documentation for the pay period, including the CSV files, Executime reports, reconciliations performed, and the final payroll reports from MUNIS, and we performed the following: − Assessed whether changes from the original roster to the final roster appear reasonable − Assessed whether all changes to the Advanced Calendar were supported by adequate supporting documentation such as a form, email, etc., noting the change requested and approved − Compared the original and final CSV files to assess the total changes processed − Determined if all final reports were reconciled and whether any variances were properly documented and explained ○ During the live walk-through, through discussions with personnel, we identified five employee rosters that appeared to potentially have errors requiring manual fixes. For the five employees selected, we virtually observed the review and correction processes as they were performed and obtained the following supporting documentation to review: − Original and final roster − Listing of changes processed − Emails/documentation of errors and fixes, including any formal forms or approvals documented − Advanced Calendar for the pay period − CSV file information prior to and after the correction − Executime original and final report information We evaluated the overall control environment, based on the detailed work performed above, to assess for adequate internal controls and opportunities for improvement.  Adequate Reviews: We requested any internal documentation available to show what internal reviews, approvals, and reconciliations are performed between the roster, AC, CSV, Executime and MUNIS payroll register. We assessed the current controls in place for adequacy in assessing whether overall hours worked are reasonable and paid correctly.  Telestaff Systems Access: We obtained a systems access report, generated from the Telestaff system, showing all individuals with "edit" access to certain key functions in the system such as processing changes to rosters, calendars, hours, etc. We evaluated the systems access report to determine if it appeared that access was properly restricted and whether more access could be granted to potentially empower employees and gain efficiencies.  Telestaff User Training: We obtained documentation of Telestaff system trainings provided to Fire Department personnel since system implementation. We assessed the trainings for adequacy and evaluated which users were receiving which levels of training.  Paid Time Off (PTO) Recording: We obtained a current listing (from MUNIS) of all PTO accrual balances as of November 2, 2020, for all Fire Department employees. Given the lack of integration between Telestaff and MUNIS, we evaluated balances for reasonableness and for potential signs of errors. Telestaff Business Process and Internal Control Review Report for the City of Glendale | 5 FINDINGS AND RECOMMENDATIONS 1 Finding There are significant manual processes required to ensure time reporting information is correct, and multiple errors were not identified during the pay period, which requires adjustments/corrections on the back end. Recommendation Consider investing in Telestaff system training, specifically for those individuals responsible for editing rosters, calendars, and time reports; evaluate whether additional access could be granted to distribute responsibilities; and work with the service provider to identify potential system solutions. Condition: There are significant manual processes required to ensure time reporting information is correct and in the proper format to upload into MUNIS for payroll processing. Fire Department administration spends significant time each pay period comparing employees’ rosters, Advanced Calendars, and time reports; making manual corrections/adjustments; and reconciling the data to ensure it is accurate. Multiple errors are typically identified throughout the process, which requires time consuming communication and related corrections/adjustments. Examples of common errors identified include corrections for certain types of leave (i.e., COVID-related) and certain overtime codes. In addition, given that Telestaff and MUNIS are not integrated, a manual process is required to export approved time reports into a CSV file that can ultimately be uploaded into MUNIS for payroll processing. During the export process, error messages are consistently encountered, which require research and additional manual corrections to be made, prior to the final information being uploaded into MUNIS. Criteria: Best practices to ensure that time reporting can be performed efficiently and effectively to ensure errors are identified, and adjustments/corrections are processed on the front-end (i.e., throughout the pay period as shifts are scheduled, worked, and reported). Best practices require that adequate internal controls be in place to maintain the integrity of time reported, but also at a reasonable level to promote accountability on the front-end. Cause: There has not been formal training provided to those individuals who are responsible for reviewing Telestaff data (i.e., schedules, Advanced Calendars, and time reported), what common errors or inconsistencies are seen and how to correct them, and what overall monitoring and reconciliations should be performed at the supervisory level. Access to edit data in Telestaff is limited to Shift Commanders and Captains, which can result in these individuals being overburdened during long shifts, changes not being processed timely or correctly, and errors and inconsistencies not being identified. Finally, the Fire Department has not worked with the Telestaff system provider to identify solutions for the export issues or evaluate options for improved system reporting. Effect: A lack of training results in errors that are not identified and/or changes/adjustments to schedules, Advanced Calendars, and time reports that are not correct and require time-consuming reviews and corrections/adjustments on the back end. Given that Shift Commanders and Captains are the only individuals that have access to process edits, the responsibilities cannot be distributed to others. Telestaff Business Process and Internal Control Review Report for the City of Glendale | 6 Recommendation: The Fire Department should consider investing in Telestaff system training for all users to help promote efficient and effective system utilization. Those responsible for monitoring, reviewing, and editing Telestaff data should receive training on what their reviews should cover, common errors identified, and, overall, how to ensure the accuracy of the time reporting that they approve. Telestaff does provide built-in, real-time reports and a reports builder to create custom reports. The Fire Department should work with the system provider to identify potential reports that may reduce manual processes, and at a minimum, how the export issues could be resolved. Finally, the Fire Department should consider giving more individuals access to adjusting certain data points in Telestaff, such as the rosters and/or Advanced Calendars. If more individuals had access to process changes, then higher-level management could review system change reports to assess the reasonableness of changes processed and focus on a higher-level review to help identify errors on the front end in a timelier manner. Management Response: Management Agreement Owner Target Completion Date Glendale Fire has purchased an additional module for our Telestaff software to include an XML importer for all accruals into Telestaff from Tyler Munis. This will reduce significantly the manual corrections that are being made after the export to Munis. Acting Captain Cory Johnson 05/25/2021 Acting Captain Cory Johnson will be meeting with shift commanders and incident safety officers to develop a training manual for all staff assigned to the shift commander’s office who are responsible for making changes to the rosters. Acting Captain Cory Johnson 07/2022 2 Finding Training on the Telestaff system has not been provided, and the system may have additional capabilities that are not being utilized. Recommendation Seek training opportunities for all Telestaff user levels and evaluate system capabilities for opportunities for increased utilization. Condition: The Telestaff system is new, and most users have not received adequate training. In addition, the system may have additional capabilities that are not being fully utilized since they have not been researched or trained on. Only limited personnel are familiar with and responsible for processing changes, corrections, schedule updates, etc., in the system. Criteria: Providing proper training to employees promotes a more even distribution of responsibilities and workload throughout the Department and more efficient and effective system utilization. Telestaff Business Process and Internal Control Review Report for the City of Glendale | 7 Cause: The Telestaff system was implemented recently, and customized training or training manuals have not been provided. The Fire Department has not worked with the service provider to discuss system capabilities and training options for the various levels of Telestaff users. Effect: Without proper training or training manuals for users to refer to when questions arise, there are multiple manual errors made that require correction on the backend during the pay period close process. Recommendation: Telestaff training for the team is crucial to understanding the full capabilities of the software. Telestaff software through Kronos offers yearly conventions and specialized training for fire departments. If additional employees were properly trained, then the workload and responsibilities could be distributed more evenly, and errors could be identified in real time, resulting in efficiencies during the pay-period close process. Management Response: Management Agreement Owner Target Completion Date If funding is available in the upcoming fiscal year 22, we will ensure that at least three employees attend or participate in training provided by Kronos Telestaff. They offer a variety of training opportunities. We would like to include Acting Captain Cory Johnson, one Incident Safety Officer and one Shift Commander. Acting Captain Cory Johnson 07/2022 Glendale Fire Department would like to include all 40-hour Memorandum of Understanding (MOU) represented employees in the Telestaff export. We will work with IT and Payroll to test and evaluate this change. Acting Captain Cory Johnson 07/2022 With the assistance of our City of Glendale IT staff, we have implemented the use of a messaging software (Twilio) to ensure all Glendale Fire Department operational staff are receiving all call messages from Telestaff in a timely manner. This will assist and enhance our staffing time frame and reduce the amount of late changes to the roster. Acting Captain Cory Johnson 04/26/2021 Telestaff Business Process and Internal Control Review Report for the City of Glendale | 8 PROCESS IMPROVEMENT OPPORTUNITIES Moss Adams LLP identified opportunities for process improvements as a result of this internal audit. The following table summarizes these recommendations: CATEGORY PROCESS IMPROVEMENT RECOMMENDATIONS 1 Negative PTO Accruals During interviews, we found that when PTO was requested and entered into the Telestaff system for scheduling, there was no way to determine if the related employee had enough accrued PTO to support the request because the balances are in MUNIS, which does not integrate with Telestaff. In addition, due to the lack of integration, there was the potential for PTO to be entered into Telestaff and ultimately not recorded as a reduction to the employee’s accrued balance in MUNIS. During the course of this internal audit, in December of 2020, a fix was implemented to allow for assessing PTO balances in Telestaff. We assessed the total accrued balance of approximately $245,000 and found that some employees had negative accrued totals. In total, there were 76 negative accrued balances (out of 2,116 accruals), totaling $1,370. In assessing these negative balances, 75 were under the description code "FD SMOOTH". The additional negative accrual was labeled "RECOG LVE" and was for a total amount of -.2. Although the amount was immaterial overall, the Fire Department was not familiar with the PTO accrual process and the potential risk of negative balances. The Fire Department should work with the Payroll Department to help understand why these negative balances are occurring, what corrections may be needed, and what can be done to ensure that utilized PTO is properly recorded in MUNIS and to prevent negative balances from occurring. 2 40-Hour Employee Timecards Unlike 52-hour employees, all 40-hour employees are expected to fill out a timecard manually outside of the Telestaff system, which is provided to the Payroll Department for entry into MUNIS. Currently, employees classified as 40-hour employees are only tracked in Telestaff for their roster (scheduling) rather than time reporting. Given the inconsistency in processing these employee timecards, there is a risk that the same level of scrutiny that is in place for the employees who have all activity reported in Telestaff is not applied. The inconsistent processes also increase the need for reconciliations and the risk of errors overall. The Fire Department should assess whether Telestaff should be used for all employees, including those on a 40-hour schedule. If this is not feasible, the department should work with the Payroll department to identify additional opportunities for streamlining their overall time reporting processes to reduce manual intervention and increase consistency across all processes. Telestaff Business Process and Internal Control Review Report for the City of Glendale | 9 APPENDIX: DEFINITIONS OF AUDIT FINDINGS RANKINGS We utilized the City IIAP’s risk rankings and assigned rankings based on our professional judgment. The following table shows a qualitative assessment of high, medium, or low to help prioritize implementation of corrective action: HIGH Represents critical control deficiencies that exposes the City to a high degree of combined risks. Recommendations from High risk findings should be implemented immediately (preferably within 3 months) to address areas with most significant impact or highest likelihood of loss, misappropriation, or damage related to the City assets. MODERATE Represents less than critical deficiencies that expose the City to a moderate degree of combined risks. Recommendations arising from moderate risk findings should be implemented in a timely manner (preferably within 6 months) to address moderate risks and strengthen or enhance efficiency in internal controls on areas with moderate impact and likelihood of exposure. LOW Represents low risk or control deficiencies, and the exposure is not likely to expose the City and its assets to significant losses. However, they should be addressed in order to improve efficiency and effectiveness of operations. Recommendations arising from low- risk findings should be implemented within 12 months.