Internal Controls Related to Payroll

Michael V. McKee, Assistant Vice President & University Controller

Pursuant to an audit of Internal Controls performed by the Office of Internal Audit (OIA), the following items were identified:

• 28 percent of the units reviewed did not document their review of the final paylist.
• 25 percent of the units reviewed did not have procedures to document advanced approval for overtime and compensatory time.
• 18 percent of the units reviewed did not have procedures to ensure that leave taken was properly approved or to verify the accuracy of leave use against time records.

Review of the preliminary and final pay lists on a timely basis is the primary internal control to ensure that payroll is accurate for services performed at the University of Florida. When preliminary and final pay lists are not reviewed, there is an increased likelihood that over or under payments will occur and go undetected.

Review of the preliminary pay lists will verify that identified errors have been resolved and reduce the need for issuance of emergency checks. Review of the final pay lists will also help determine that only active employees are receiving pay and the amount paid is for the proper number of hours at the correct rate of pay.

Recommended best practice is to retain in hard copy or electronic format of the final pay lists, with evidence of approval, in the unit.

Segregation of duties is a basic, key internal control that is used to ensure that no single individual has control over two or more phases of a transaction or operation. Instead, there is a crosscheck of duties.

Segregation of payroll duties is extremely important because payroll represents a major process and supports the University’s largest operational disbursement. For example, a person with the Time & Labor processor security role can both enter and approve time for another employee.   However, as a best practice, this is not recommended.  The time should be approved by another person in the department, particularly someone who has knowledge of the hours worked by the employee.

In those instances where duties cannot be fully segregated or where role conflicts cannot be avoided, compensating controls must be established. Compensating controls are additional procedures, such as supervisory reviews, designed to reduce the risk of errors, e.g. inaccurate recording of time and leave, or irregularities.

For assistance in establishing or reviewing good procedures, internal controls, segregation of duties or compensating controls, please contact Linda Orfield, Associate Controller at lorfield@ufl.edu or (352) 294-7267 or Kim Simpson, Sr. Associate Controller at (352) 392-1321.