Audit of Departmental Payroll Administration – Phase 2

1. Background

Payroll administration includes tasks that are necessary to organize the compensation of employees. The Treasury Board of Canada Secretariat (TBS) Guideline on Financial Management of Pay Administration helps departments implement and exercise the spending and financial authorities for pay transactions. The guideline recommends pay administration procedures, controls, and monitoring activities to be carried out by departments.

Employment and Social Development Canada (ESDC) relies on the centralized pay processing centre (Pay Centre) to process pay. Public Services and Procurement Canada (PSPC) is the pay administrator for the Government of Canada. PSPC is responsible for managing the Pay Centre and maintaining the Phoenix system used for processing pay related transactions.

During the 2020 to 2021 fiscal year, ESDC had 28,296 full-time equivalent employees and had forecasted 32,108 full-time equivalents for the 2021 to 2022 fiscal year. ESDC paid $2.8 billion and $3.68 billion in salaries and benefits for the 2020 to 2021 and 2021 to 2022 respectively.

2. Audit findings

2.1 Controls related to payroll related action initiation, commitment and certification exist. However, the controls did not always function as described in the process flow chart.

• In general, pay related transactions were initiated and certified under Sections 32 and 34 of the Financial Administration Act (FAA) by an individual with the authorized delegated financial and human resources (HR) authority. However, we noted errors related to transactions that were not approved by individuals with proper delegated authority:
  • for 12% of the transactions tested, managers did not have the delegated authority to approve Section 32 payment initiation or documentation in support of expense pre-approval (overtime) was missing
  • for 10% of the transactions tested, managers did not have the delegated authority to approve section 34 payment certification
  • for 4% of the transactions tested, managers did not have the required HR sub-delegated level to approve payments (vacation requested by employees)
• CFOB advised that as part of the control activities, it conducts annual data analytics on Overtime and Labour time section 34 approvals in Phoenix. CFOB provided us with documentary evidence for the fiscal year 2022 to 2023, which showed an error rate of 7.6%. However, CFOB did not retain evidence for the entire audit scope
• The Department uses the Salary Forecasting Tool (SFT) as a compensating control for commitment authority. Overall, SFT was updated by the staffing actions for the sampled transactions and no issues had been noted

2.2 Quality Assurance activities are in place and operating as described in the process flow chart. However, areas for improvements were identified to strengthen the processes.

In general, the quality assurance (QA) activities were operating as designed. However, we noted the design of the QA activities could be strengthened to better support the FAA Section 33 post-payment certification requirements.

• The TBS Guideline on Payroll Administration indicates the level of review performed pre-payment (Review 1) directly impacts the level of review performed immediately after payment (Review 2) and for post-payment verification (PPV). For Review 1 and PPV, activities are carried out by CFOB in conjunction with HRSB. For Review 2, activities are carried out by CFOB
• Reviews 1 and 2 are cursory and do not verify Section 34 payment approval. As a result, most of the efforts fall on PPV
• The audit noted areas for improvement in the PPV process:
  • although random and judgmental samples testing are used as part of the PPV sampling approach to conclude on the population, we noted that very few (and often zero) higher risk transactions (for example, high dollar values, overtime) were sampled
  • CFOB has a practice of deferring to testing the " most recent HR action" and not the actual selected payment. A high proportion of the PPV samples (38%) were classified as miscellaneous because the most recent HR action did not require Section 34 certification. For these transactions, the purpose of PPV was not achieved

3. Conclusion

In general, pay related transactions were initiated and certified under FAA Section 32 and 34 by an individual with the authorized delegated financial and HR authority. However, we noted errors related to transactions that were not approved by individuals with proper delegated authority.

Quality assurance activities for payroll transactions were operating as designed. However, these activities could be updated to better support the FAA Section 33 requirements, most notably regarding the types of transactions reviewed as well as the extent of work conducted.

4. Statement of assurance

In our professional judgment, the audit team gathered and analyzed sufficient and appropriate evidence to support the accuracy of conclusions found in this report. The audit team based these conclusions on observations and analyses at the time of the audit. These conclusions are applicable only for the Audit of Payroll Administration - Phase 2. The audit team followed the Treasury Board Policy on Internal Audit and the International Standards for the Professional Practice of Internal Auditing.

Appendix A: Audit criteria assessment

Audit criteria

Processing of pay related actions: it was expected that the Department has implemented controls to:

• complete FAA Section 32, 34 and 33 approvals for pay related actions by officers with proper financial authority delegations and in accordance with the applicable TBS and ESDC's guidance. Supporting documentation of all pay related actions is maintained
  • Rating: controlled, but should be strengthened; medium-risk exposure
• update PeopleSoft and, where required, send necessary information to Phoenix, in an accurate and timely manner
  • Rating: sufficiently controlled; low-risk exposure
• process pay related actions in accordance with the Department and PSPC's ready for pay timeliness targets
  • Rating: controlled, but should be strengthened; medium-risk exposure

Payroll administration monitoring and quality assurance program: it was expected that the Department has implemented controls to:

• conduct pre- and post-payments quality assurance activities performed in support of the FAA Section 33 requirements
  • Rating: controlled, but should be strengthened; medium-risk exposure
• enable a sound quality assurance framework that aligns with the Guidance on Financial Management of Pay Administration
  • Rating: sufficiently controlled; low-risk exposure