Audit of compensation processes and controls: Findings

Roles and responsibilities

22. The Agency's HR-to-Pay process is based on the seamless and timely communication of information between its key internal stakeholders.^{Footnote 5} For example, Cost Centre Managers are responsible for completing the documentation to hire an employee, which is then sent to Staffing to generate a letter of offer. Compensation receives the signed letter of offer to enter pay information within the HR-to-Pay systems. Once the information is entered and an employee is paid, Corporate Accounting is responsible for reporting payroll expenditure. Given these interdependencies, it is important that all stakeholders understand their roles and responsibilities, as well as how their roles impact the other stakeholders involved.

23. Roles and responsibilities for various activities in the HR-to-Pay process were identified and documented in job descriptions and on the CBSA's intranet pages. Most key stakeholders we surveyed^{Footnote 6} understand their own roles and responsibilities related to the HR-to-Pay process. However, more than 50% of stakeholders from each functional area responded that they do not understand the roles and responsibilities of other stakeholder groups as they relate to the HR-to-Pay process. The HR-to-Pay process is not centrally documented anywhere, and as such, the interrelations and dependencies between stakeholders are not clearly communicated to all involved.

24. Overall, roles and responsibilities of employees working within the HR-to-Pay processes are clearly defined and communicated. Increasing awareness of the roles and responsibilities of all areas involved in the process would help individual stakeholders better understand how others contribute to the overall efficiency and effectiveness of the HR-to-Pay process.

Internal information sharing and communication

CBSA corporate governance

27. One|HR, Executive Committee – Human Resources, and the Executive Committee are the key internal corporate governance bodies for the HR-to-Pay process. These committees are the forum for bringing HR-to-Pay issues to the attention of the Agency's Senior Management.

28. Per our review of agendas and records of decision, these internal governance committees receive periodic updates on the progress towards the Compensation Backlog Strategy, including HRB's recent timeliness initiative, "Timeliness Pays", demonstrating that the Agency's Senior Management receive information relevant to the current high-priority items periodically.

Training and support

40. Adequate guidance, training and support are key to ensuring that all HR-to-Pay stakeholders can effectively execute their responsibilities. The Agency does not have a mandatory or formal compensation training program available for employees. Additionally, any compensation-related training taken by employees is not documented or tracked by the branch. While on-the-job training is provided, only 43% percent of Compensation staff surveyed found it to be sufficient.

41. To address the gaps in formalized and on-the-job training, Corporate Compensation was in the process of developing an in-house reference tool to assist new and existing Compensation Advisors. Additionally, mandatory training in client service delivery was taken to address improvements required for communication with employees on pay file issues.

42. The Agency's Compensation staff also have access to PSPC's training on HR-to-Pay processes. While the PSPC training is intended to be general enough for all users, the environmental scan identified that "almost all organizations indicated they need to adapt training materials to fit their context, which creates an additional burden".^{Footnote 11} When misapplied, the PSPC training can actually lead to errors, such as when a CBSA Compensation employee performs actions in Phoenix that are only meant for Pay Centre departments (i.e. not a web-service organization). When PSPC training and updates are disseminated to the community, Compensation must adapt and clarify the messaging in order to make it relevant for the CBSA.

43. Similar observations related to the sufficiency of training for compensation advisors have been identified by the OAG during their audit of the CBSA's Financial Statements. For the past two years, the OAG has recommended that the CBSA collaborate with PSPC and other stakeholders to assess training needs and develop training plans.

44. In lieu of training, Compensation staff depend on a number of other tools and guidance, such as standard operating procedures, reference manuals, and policies. However, while valuable, these resources do not replace training for establishing the foundation required to process various compensation actions.

45. A lack of relevant training and support can impact an employee's ability to effectively execute their duties. A formalized training program and supporting tools would assist with the effectiveness and consistency of pay processing, as well as strengthen compensation service delivery.

Recruitment and retention

46. The Agency requires a sufficiently staffed compensation function to process pay actions in a timely manner. In order to meet work demands, compensation uses a combination of indeterminate, determinate (term), casual and student employees. Most Non-Pay Centre organizations, including the CBSA, have faced challenges in the recruitment and retention of Compensation Advisors. Reports show that Non-Pay Centre Compensation Advisors are leaving their organizations for better classification, pay and training opportunities with the PSPC Pay Centre.^{Footnote 12}

47. Interviews with Compensation staff highlighted a discrepancy in the classification of Compensation Advisors at the Agency when compared to the Pay Centre Compensation Advisors for similar jobs. When surveyed, 38% of Compensation Operations employees indicated that they would consider leaving the Agency for a job at-level elsewhere in the government. Compensation has initiated a review of the classification of job descriptions for operational compensation employees to ensure they are aligned with those of other government departments.

48. The attrition rates of Compensation Advisors we calculated are greater than the overall CBSA rates:

49. In our sample of 14 indeterminate Compensation employee departures, five employees transferred to other government departments, and three of the five at the same classification level. The remaining nine employees in the sample retired.

50. Staffing challenges have been identified in the Compensation Backlog Strategy along with a plan to recruit additional Compensation Advisors. They have leveraged the population of retired Compensation Advisors by recruiting some retirees to assist directly with clearing the backlog. Additionally, retention strategies, such as providing opportunities to internal staff, looking at extending a retention allowance to compensation staff and updating job descriptions, have also been identified to facilitate the retention of Compensation Advisors.

51. When commenting on their job satisfaction, 60% of Compensation staff indicated that they were satisfied with their job and 49% felt supported in their career development. Of the employees that identified being satisfied with their job, the most common reasons for job satisfaction included recognition, good relationships, and the challenge in the job, as well as the ability to promote change or help a client. On the other hand, reasons for job dissatisfaction included a lack of proper training, systems issues, lack of recognition, overwhelming or stressful work levels, and unrealistic deadlines.

52. Despite the challenges to maintaining a fully staffed compensation function, HRB continues to implement strategies to recruit and retain qualified resources.

HR-to-Pay internal controls

53. The Government of Canada's Policy on Financial Management outlines the requirement for "establishing, monitoring, and maintaining a risk-based system of internal control over financial management" and "ensuring that prompt corrective action is taken when control weaknesses and material unmitigated risks are identified, including the risk of fraud".^{Footnote 15}

54. A well designed internal control framework consists of actions carried out by employees as well as actions designed in a system to ensure a process is properly controlled. The HR-to-Pay internal controls are outlined in Appendix D and include actions such as approvals, reconciliations, peer reviews and IT system restrictions. An internal control framework that is operating effectively ensures that processes are followed and systems are working as intended on a regular basis.

55. Within the HR-to-Pay process, the Agency relies on the internal controls to ensure that:

• pay actions are timely, valid and accurate
• payroll expenditure reporting is free from material errors
• risks to the administration of the Agency's payroll are minimized

56. As part of their mandate, the Agency's Internal Control team (within FCMB) is responsible for documenting the HR-to-Pay Internal Control Framework (framework) and assessing the controls within that framework to ensure they are operating effectively.

57. We used the framework developed by the Internal Control team to assess the key HR-to-Pay controls.^{Footnote 16} In addition to controls from the framework, we identified and tested IT system controls involved in the HR-to-Pay process. In total, we tested 53 controls consisting of 29 manual^{Footnote 17} and 24 IT controls^{Footnote 18}. The controls were tested by sampling 155 pay actions.^{Footnote 19}

58. The results of the control testing are summarized in Table 2. Further details on control descriptions and the results are included in Appendix D.

59. Of the 53 controls, only 26 (49%) controls were deemed to be operating effectively, as there was sufficient evidence to show that the control activity was working as intended for all files sampled. The remaining 27 (51%) controls were either operating ineffectively, designed ineffectively or not adequately documented. While it is expected that some controls will require revisions from time to time, the number of controls that were found to be not documented or designed adequately suggests that the framework is not reflective of what employees are actually doing. Of greater concern was the number of controls found to be ineffective (16 out of 53 or 30%) as this means that important activities, on which we rely for pay accuracy, are not being performed as they should.

60. As shown in Table 2, we identified errors in 16 controls (operating ineffectively) where one or more of the files sampled did not contain sufficient support to show the control was working as intended. For instance, Compensation Advisors are required to prepare a calculation verifying the accuracy of an employee's first pay. In some of the files sampled, a calculation was not completed and a rationale for not preparing the calculation was not on file.

61. Given that the HR-to-Pay process has evolved since being documented, we observed that four control descriptions were outdated. We also noted seven instances where the description of the activity in the framework was no longer aligned with the actual process or the description did not clearly identify the key aspects of the activity. For example, the position who was required to approve a pay action.

62. Our observations also cover internal control weaknesses that have been previously highlighted by the OAG's annual audit of the CBSA's Financial Statements. One of the more notable gaps identified by the OAG in the 2017-2018 audit was a weak process to approve payments (Financial Administration Act Section 33) and identify potential errors related to pay. Despite the amount of time that has passed since this issue has been known, the controls for Financial Administration Act Section 33 approval had not yet been strengthened.

63. Without documented controls that are designed and operating effectively, there is a higher risk of invalid or inaccurate payments. Invalid and/or inaccurate payments can lead to employee frustration, financial loss, reputational damage or inaccurate reporting of payroll expenditure, and, as such, requires immediate attention. It is imperative that the required changes to the framework be made, that the framework be monitored and tested on an ongoing basis and that the importance of properly following established processes and procedures be reiterated.

IT systems

64. The Agency uses two systems that are critical to the HR-to-Pay process: CAS and Phoenix. Phoenix was implemented and is maintained by PSPC and CAS is hosted and maintained by CRA. Since the Agency is a web-service organization, pay actions are entered into CAS and data is transmitted to Phoenix for the issuance of the employee's pay. In order to efficiently and effectively process pay actions, systems must meet the needs of their users. We assessed whether CAS and Phoenix met users' needs and accurately processed transactions.

65. Per the internal audit survey, most of the Compensation staff (81%) stated that they feel the HR systems have the right functionalities for them to do their job. Furthermore, the majority of Compensation Operations, Corporate Compensation and HR Systems employees responded that risks related to the systems have been identified (71%) and that these risks were being actively managed (80%).

66. However, the majority of operational staff (73% of Compensation and 73% of Staffing) are concerned that system limitations, due to integration issues between CAS and Phoenix, prevent the accurate capture of relevant HR information. We were informed that even if a pay action is accurately processed by the Compensation Advisor and entered into CAS, Phoenix may not issue correct payment.^{Footnote 20} While reviewing pay files, we observed an instance where the compensation advisor entered accurate information in Phoenix that resulted in an invalid payment where a duplicate cheque was issued to the employee.

67. Phoenix also has issues processing payments, such as processing collective agreement changes or late pay actions. In an effort to align CAS and Phoenix payroll data, Corporate Compensation compare employee job data in CAS against data in Phoenix on a daily basis and correct any discrepancies between the two systems. This creates additional work and does not always prevent inaccurate pay, as the discrepancies may not be identified in time to make the necessary corrections. Invalid payments issued by system limitations can cause frustration amongst employees who are either owed pay or have to reimburse the Agency for an overpayment.

68. In order to understand what could affect the validity of payments within the HR-to-Pay systems, we analyzed Phoenix data related to overpayments, to distinguish the potential root cause of the errors. A sample of 15 known overpayments was selected for our analysis. By tracing the payment through the HR-to-Pay process, we were able to determine the following root causes:

• processing late payments (eight payments): late submission of critical information by the cost centre manager (acting end date) or late entry of pay action (e.g. an employee receiving full pay while on leave due to documentation being submitted or entered after the effective date)
• system errors (one payment): Phoenix generated a duplicate cheque, however this was caught and cancelled before payment to the employee
• subsequent revision of timesheets (six payments): an employee reported their time using a paid timecode (overtime compensated as payment, leave with pay) and subsequently changed their reported time to a non-paid timecode (overtime compensated as leave, leave without pay) after the payment was issued

69. The current pay systems and associated interfaces do not always facilitate an accurate end-to-end compensation process. However, with increased focus on communicating and educating employees and managers on the impact various behaviours have on pay accuracy, as well as training for HR systems users and the timely submission and processing of pay actions, the Agency can reduce the issues that are within its control.

IT systems – segregation of duties

70. Segregation of duties (SOD) is required when assigning access rights to users of a system in order to prevent an individual from having incompatible duties (i.e. initiating, approving, and reviewing the same transaction). The restriction in access is designed so users cannot initiate unauthorized transactions. For example, having segregation between individuals who process pay actions and those who approve pay actions reduces the potential for fraud and helps to ensure that only valid actions are entered into systems. In instances where SOD cannot be maintained, it is expected that mitigating controls are in place to prevent inappropriate use or fraud.

71. Incompatible roles in the HR-to-Pay IT systems have been identified by system owners^{Footnote 21} of CAS and Phoenix. We assessed whether the SOD was being respected by the CBSA.

Segregation of duties in CAS

72. Each role granted to a user has various combinations of available actions and permissions associated with it. We attempted to assess whether the permissions, known as transaction codes (T-codes), associated with each role were appropriate. However, we were unable to obtain documentation that showed which T-codes are incompatible. Due to this limitation, we assessed segregation of duties at the role level.

73. Compensation Advisors are given the "Compensation – Transaction Processing" role within CAS that allows them to process pay actions. There are four roles with which the "Compensation – Transaction Processing" role cannot be combined. Requests for these roles are submitted through the Agency's IT ticketing system by the employee's manager and then sent to the appropriate authorized individuals to be granted.^{Footnote 22}

74. We identified six users who had incompatible roles in CAS. Four users had the ability to authorize and process pay actions. Two users had the ability to process pay actions and modify the pay list to which an employee is assigned, which would allow them to process pay actions for those employees. All six situations of incompatible roles were removed after we brought them to management's attention.

75. Given that incompatible roles were granted by authorized individuals, it is important that the SOD matrix be consulted prior to granting access to CAS in order to reduce the likelihood that employees receive access to incompatible roles.

Segregation of duties in Phoenix

76. PSPC identified specific roles in the Phoenix SOD matrix that should not be granted in combination with each other. These roles include, among others: Compensation Advisor, Section 33 Approver and HR Systems Analyst. In order to request a role in Phoenix, the employee's manager must submit a form to the Agency's Phoenix Security Access Control Officer.

77. When incompatible roles are unavoidable, an attestation by the Chief Financial Officer is required by PSPC to authorize the override. We found that six users had a combination of incompatible roles, which the Agency's Chief Financial Officer authorized.

78. When granting incompatible roles, the Chief Financial Officer is required to confirm that compensating controls are implemented to manage the risks created by allowing incompatible roles to exist in the system. The Corporate Compensation team has recently initiated a quarterly review of the appropriateness of user access in CAS and Phoenix. However, no compensating controls are in place that would reduce the misuse of the incompatible roles. Business Process Owners in HRB and FCMB for systems related to the HR-to-Pay process do not perform any monitoring of user activity in Phoenix or CAS, specifically for those with incompatible roles. Furthermore, these process owners do not assess incompatible roles across the two systems to ensure that duties are segregated for users with access to both systems.

79. While we did not come across any signs of fraud during the pay file review, the lack of monitoring of user activities within the systems and instances of controls designed or operating ineffectively increase the risk of fraud.