\   Office of Inspector General
      Report of Audit
REVIEW OF THE ACCURACY OF EPA's
 PAYROLL AND PERSONNEL SYSTEM
              (EPAYS)
                     D
            D
         E1AMF6-11-0005-6100275
            August 15, 1996

-------
INSPECTOR GENERAL DIVISION
CONDUCTING THE AUDIT:                  HEADQUARTERS AUDIT DIVISION

PROGRAM OFFICE COVERED:                OFFICE OF ADMINISTRATION AND
                                      RESOURCES MANAGEMENT

-------
                  UNITED STATES ENVIRONMENTAL PROTECTION AGENCY
                                WASHINGTON. D.C. 20460
                                     AUG  15  1996
                                                                           OFFICE OF
                                                                      "WE. INSPECTOR GENERAL
MEMORANDUM
SUBJECT:    Review of the Accuracy of EPA's Payroll and Personnel System (EPAYS)
             (Audit Report No. El AMF6-11-0005-6100275)
FROM:      Michael Simmons
             Deputy Assistant Inspector General
              for Internal and Performance Audits (2421)

TO:          Alvin M. Pesachowitz
             Acting Assistant Administrator
              for Administration and Resources Management (3101)

       Attached is our final report titled Accuracy of EPA*s Payroll and Personnel System
fEPAYSt. The primary objectives of our review were to determine whether: (1) EPAYS
provides accurate information for Reduction-in-force purposes; and (2) Management control
systems are in place to provide reasonable assurance that the relevant EPAYS information is
accurate.

       This report identifies corrective actions the Office of Inspector General (OIG)
recommends involving the accuracy of the EPAYS system. As such, it represents the opinion
of the OIG.  Final determinations on the matters in the report will be made by EPA managers
in accordance with established EPA audit resolution procedures. Accordingly, the findings
described in this report do not necessarily represent the final EPA position.

       The response by the Office of Administration and Resources Management (OARM) to
our draft report is included as Appendix V.  Our evaluation and comments on the response are
included throughout the report, as appropriate. Based on OARM's response to the draft report
and prior discussions, we made appropriate  changes to this final report.  Further, we believe
that the corrective actions planned and the milestones indicated are responsive to the
recommendations in the audit report, and are therefore closing the  report in our tracking
system upon issuance.

       We appreciate the cooperation extended to our auditors during this audit. If you or
your staff have any questions  concerning this report, please contact Edward Gekosky,
Divisional Inspector General for Audit, or Frances E. Tafer of my staff, on (703) 308-8222.

Attachment
                                                                 cAJ. HtcttttdltticttUt
                                                                                  I ink an paper mar

-------

-------
  ACCURACY OF EPA's PAYROLL

AND PERSONNEL SYSTEM (EPAYS)
               •

     E1AMF6-11-0005-6100275

-------
Report of the Accuracy of EPA'» Pem>tmel and PayroU System (EPAYS) _ El AMF6-1 l-OOOS-6 100275


                     TART.F OK
EXECUTIVE SUMMARY

CHAPTERS

     1.   INTRODUCTION . . ...... . ............................. 1

         PURPOSE ................. . . • ............. . ......... 1

         BACKGROUND ...................................... 1

         SCOPE AND METHODOLOGY . .  . ................. ........ 4

     2.   OHROS EFFORT IMPROVES ACCURACY OF PERSONNEL
         INFORMATION MAINTAINED IN EPAYS, BUT MANAGEMENT
         CONTROLS ARE NEEDED TO MAINTAIN ACCURACY ........... 7

     3.   CONTROL OVER OFFICIAL PERSONNEL FOLDERS COULD BE
         IMPROVED .......... . ........... . ...... . .......... 15

     4.   EPAYS SYSTEM SECURITY COULD BE COMPROMISED ......... 19
                            r

APPENDIX I - ACRONYMS   ................................ ...... 21

APPENDK H - OVERVIEW OF A REDUCTION-IN-FORCE  ................ 22

APPENDIX ffl - METHODOLOGY   ................................. 24

APPENDK IV - OHRQS PERSONNEL OPERATIONS WORKGROUP ........... 26

APPENDK V - AGENCY COMMENTS   ......... .............. . ...... 28

APPENDK VI - DISTRIBUTION ....... ..... ........................ 31

-------
Report of the Accuracy of EPA't Peraonnel and Payroll Syrtam (HPAYS)

EXECUTIVE SUMMARY
                                      EIAMF6-11-0005-6100275
PURPOSE
As a result of a potential $2.5 billion (34%) cut by the House of
Representatives to the Agency's fiscal 1996 budget, the Agency
had to prepare quickly for a reduction-in-force (RTF).  In view of
this and as a result of several other OIG audits which identified
problems associated with the Agency's information management
systems,  we initiated an audit of EPA's Payroll and Personnel
System (EPAYS). EPAYS contains the employees' personnel
information which would be used in conducting a RIF  (see
Appendix II). The emphasis of the audit was to determine
whether the personnel information contained in EPAYS was
complete and accurate, and whether the system could be used
quickly and with confidence during a required RIF, furlough, or
other minor or mass personnel action. Specific objectives were
to determine whether:
                          1.     EPAYS provides accurate information for RIF purposes;
                                and

                          2.     Management control systems are in place to provide
                                reasonable assurance that the relevant EPAYS information
                                is accurate.
BACKGROUND
EPAYS is an acronym for the Environmental Protection
Agency's integrated Payroll and Personnel System. EPA has
used the system since 1970, and has made major modifications to
comply with new governmental requirements to provide expanded
services and flexibility to EPA employees.

EPAYS integrates the functions formally performed
independently by the personnel, payroll and timekeeper's offices.
EPAYS now automates the tasks which at one time were done
manually, and all EPA offices throughout the United States
manage their EPAYS tasks (and others) through the Agency's
IBM 3090 mainframe computer located at Research Triangle Park
(RTP), North Carolina.

The Assistant Administrator for Administration and Resources
Management (OARM) has responsibility for EPAYS. Within
OARM, two offices have the responsibility for entering data into
EPAYS.  The Office of Human Resources and Organizational
Services (OHROS) is responsible for entering employees'
personnel information into EPAYS, while the Office of the
                                         11

-------
Report of the Accuracy of EPA'a Personnel and Payroll System (EPAYS)	El AMF6-1 l-OOOS-6100275

                          Comptroller (OC) is responsible for entering employee financial
                          and payroll information into EPAYS.

                          OHROS is also responsible for the management and control of all
                          Official Personnel files (OPFs) for EPA employees serviced by
                          the Headquarters's Human Resources Staff. OPFs are the official
                          repositories of the records, reports of personnel actions, and the
                          documents and papers required concerning actions affected during
                          an employee's federal service.  These records provide the basic
                          source of data about a person's employment while in the federal
                          service and after separation.
RESULTS.               Our audit found that OHROS, since September 1995 has been
IN BRIEF                expending a considerable amount of time reviewing and cleaning
                         up the OPFs and in making corrections to the personnel
                         information contained in EPAYS. We found that between
                         November 27, 1995 and January 31, 1996, the OHROS review
                         had reduced the number of EPAYS personnel information
                         inaccuracies by more than 65 %.  OHROS staff has continued to
                         review OPFs and enter information beyond our computer report
                         date of January 31,1996.  We were told by an Agency official,
                         that before a reduction-in-force would be fully executed, each
                         employee's OPF will be checked three times for accuracy, along
                         with a check by the employee.

                         However, we noted that OHROS apparently viewed the accuracy
                         of EPAYS and the currency of the OPFs as a low priority.
                         Although OHROS had conducted at least two reorganizations
                         devoted.to improving customer service and improving the filing
                         of OPFs, it was not until EPA was faced with a potential  RIF
                         that OHROS begin a comprehensive review of the OPFs and of
                         the accuracy of the EPAYS information. We found that OHROS
                         had not identified the accuracy or reliability of EPAYS personnel
                         information in any of its FMFIA documentation, had not planned
                         or conducted any quality assurance reviews of the EPAYS
                         system, and had not assigned responsibility for system accuracy
                         in any of its position descriptions for Personnel Management
                         Specialists. We were told by OHROS officials, that the
                         developing and executing of new procedures would not take place
                         until the  potential RIF concerns are eliminated.

-------
Report of the Accuracy of EPA'i Personnel and Payroll System (EPAYS)
                                      El AMF6-1 1.000S-610027S
PRINCIPAL
FINDINGS

OHROS Aware of
need for corrections
Management Control
Reviews of EPAYS
Accuracy and Official
Personnel Files Not
Conducted
We summarized below and discussed our principal findings in
detail in Chapters 2 through 4 of this report.

On September 18, 1995, OHROS sent a memorandum to
all Headquarters' employees requesting that they review the
attached personnel data profile.  OHROS created the profile
based on the information in the Agency's automated personnel
system (EPAYS) and the employees' official personnel files.
Employees were requested to examine all the data elements on
the profile and make any corrections necessary, complete the
certification at the bottom of the profile page, and return the
profile sheet (along with any supporting documentation .to prove
changes to be made) by September 29,  1995. However, our
review of a sample of OPFs and "profiles"  received from Agency
staff identified a need  for OHROS to develop Management
Controls to verify that employee personnel information is entered
accurately in EPAYS.

We reviewed the fiscal 1993 Office of Human Resources
Management (OHRM) event cycle1  documentation and
related annual management control summaries conducted
between fiscal 1993 and 1995.  We found that OHRM had not
identified, as an event cycle, reviews of the OPFs and accuracy
of personnel information contained in EPAYS.  We also noted
that OHRM had not conducted any reviews to validate and ensure
the accuracy of the data in EPAYS compared with the
information contained within the OPFs.

Because of the lack of management control reviews and a
potential reduction-in-force caused by a potential $2.5 billion
(34%) cut by the House of Representatives to the Agency's fiscal
1996 budget, the Agency had to expend at least $55,300 in
overtime costs and countless hours in Agency staff time
correcting system errors and omissions, and updating missing
information in the official personnel folders.  If the event cycle
controls had been in place, the additional Agency staff time
expanded might have been reduced.
       1 Operations within a program or function are activities that fulfill the mission of the
program or function.  These are the event cycles. They are the processes followed to perform
related activities, create the necessary documentation, and gather and report data. Typical
examples of event cycles are:  (1) Policy and planning; (2) Program cycles; (3) Admin-
istrative cycles (personnel, procurement, budget, etc.); and (4) Assets management.
                                         IV

-------
 Report of the Accuracy of EPA's Personnel and Payroll System (HPAYS)
                                       El AMF6-11-0005-6100275
 OHROS Needs To
 Implement A
 Written Policy On
 Personnel Actions
 Data Entry Verification
Control Over
Official Personnel
Folders Needs
Improvement
To identify management controls established by OHROS,
we requested copies of policies, procedures, or guidelines
provided to OHROS staff.  We interviewed several personnel
management specialists to determine procedures used in
processing personnel actions. The procedures used by the staff
contained a verification process.  However, the staff we
interviewed also told us that it was not their responsibility to
verify data entry.  Although verification procedures we discussed
with them were consistent among the staff, no written policy
existed.

As of February 20, 1996, based on our review of 379 folders, we
identified that 58 individuals (15.3% of the folders we reviewed)
had performance appraisals in their official personnel folders for
fiscal years 1991 through 1994, but did not have those ratings
entered in EPAYS based on a November 27,  1995 computer
report. As a result of the on-going reviews of OPFs conducted
by OHROS, we requested a second EPAYS report (January 31,
1996) to determine if OFF information was being updated in
EPAYS.  Based on the January report, OHROS reduced  the
number of individuals missing information from 58  to 20 out of
379 or 5.3%.

Although OHROS has significantly reduced the number of
inaccuracies, improvements to its management controls over the
verification of data entry are still needed to ensure the future
accuracy of EPAYS.  Computer reports are available which could
assist OHROS  in identifying potentially missing, inaccurate, or
incomplete personnel information.  Also, OHROS should, at least
annually, notify EPA employees of the need to periodically
review and update the OPFs.

Over the five months (October 30, 1995 through March  15,
1996) of our review, the OPF Center staff had difficulty
in the timely retrieval of the OPFs for our review.  We would
receive only a portion of the OPFs requested and had to
continually request, through the project officer, OPFs not
initially provided.  During our review, we observed a Personnel
Management Specialist being told that she already had OPFs
signed  out to her which she was requesting, but the  specialist
insisted that she had returned the folders.  Further, during a
discussion with one of the Human Resources Team Directors, we
were told the Director also had difficulty in obtaining folders.
                          Individual staff team members may have had the folders at their
                          desks while awaiting additional information.  However,

-------
Report of the Accuracy of EPA's Personnel and Payroll System (EPAYS)
                                       El AMF6-11-0005-6100275
                          maintaining the folders at their desks versus the Central fileroom
                          compromises the security of the folders and increases the risk of
                          the folders being misplaced.
EPAYS System
Security Could
Be Compromised
RECOMMENDATIONS
We noted that 52.6% (41 out of 78) of the personnel
management specialists have supervisory data entry capability.
This capability permits the user to enter and modify information
contained in the personnel data base. We questioned several
OHROS staff about  whether the personnel management
specialists could access their own files and make changes to those
files. Two individuals (the Chief of the Client Support Branch
and the previous Acting Chief of the Systems Support Staff) said
that the system does not prevent access to an individual's own
record.  One individual, an OHROS staff Team Director, stated
that one of his individuals attempted to enter an award into
his/her own record but was blocked.

We did not identify any data entry activity, while reviewing the
EPAYS computer reports, which would have caused additional
fieldwork.  However, we did not review the activities of the
personnel specialists in the regional offices who have the
capability of entering both payroll and personnel information.
The system should contain a security control which would
prohibit an individual from entering information into their own
record. Without such a security control, information in the
system could be compromised and lead to potential fraudulent
activity.

Our detailed recommendations are listed following the findings in
Chapters 2 through 4. However, in summary, we are
recommending that the Acting Assistant Administrator for
Administration and Resources Management:

1.     Require semiannual briefings on the status of the
       implementation of planned quality assurance activities
       until a system is in place and effectively functioning.

2.     Require the workgroup to generate a computer report, as
       we did, to identify employees with missing performance
       rating information in EPAYS.

3.     Request that the OHROS Team Directors work with their
       staff to ensure that folders being reviewed for
       completeness and accuracy be returned to the OPF Center
       as timely as possible.
                                          VI

-------
 Report of the Accuracy of EPA'a Personnel and Payroll System (HPAYS)
                                       El AMF6-11-0005-6100275
                          4.     Require that an automated control be added to EPAYS to
                                 prevent an individual from accessing their own file and
                                 making changes to that file.
AGENCY COMMENTS
OIG COMMENTS
We met with Agency officials on April 4, 1996, to discuss the
position papers we provided them so they could preview our
potential audit findings. At that meeting, the Agency officials
commented on our draft material saying:

       The thorough manual rechecking they feel is necessary for
       any RIF listing, or similar iteration which could affect
,      EPA employees in such an important way, negates
       auditors* concerns with the accuracy of EPAYS data.

       Indeed, $55,000 in overtime is a minor cost in
       comparison with the high amount of effort officials
       believe must be expended to ensure absolute accuracy of
       any RIF listing prepared for the Agency.

       The error rate the OIG auditor found through testing is a
       low error rate (5%) for a system such as EPAYS2.

The agency in its July 24, 1996 response to our draft audit
report, agreed with our principal findings and indicated that its
Office of Human Resources and Organizational Services
(OHROS) has gone beyond our recommendations to ensure the
accuracy of EPAYS data (see Appendix V for the full response).

We continue to believe much less effort would have had to have
been expended on preparing for a potential RIF if management
controls had been in place and EPAYS and OPFs had been  more
accurate.  The overtime and during business hours time expended
to provide the necessary accuracy for preparation for a potential *
RIF would have been much less or even unnecessary. In regard
to the error rate, the OIG believes, although it is low, it is
significant based on the amount of time which has been and
continues to be spent in reviewing OPFs and entering ratings into
EPAYS. It reflects  two concerns: (1) a lack of management
controls in place to verify that information has been accurately
             At the time we presented our position papers to Agency officials for their
             review, we expressed separate individual error rates based on two sample
             reviews. When the samples were combined, based on the same factors, the
             combined error rate increased from 5.3 percent to 15.3 percent. Agency
             officials expressed their opinion on the lower error rate.

                                          vii

-------
Report of tho Accuracy of EPA'« Personnel and Payroll System (EPAYS)	ElAMF6-11-0005-6100275

                           entered into EPAYS and (2) it increases EPA staffs concern
                           about the accuracy of EPAYS when they discover that
                           information supplied still was not entered into EPAYS.
                                           Vlll

-------
Report of the Accuracy of EPA'« Personnel and Payroll System (EPAYS)	E1AMF6-J1-0005-6100275
                              [This page intentionally left blank]
                                               IX

-------
Report of die Accuracy of EPA'f Personnel and Payroll System (EPAYS)
                                      El AMF6-11-0005-6100275
PURPOSE
         CHAPTERl

      INTRODUCTION

As a result of a potential $2.5 billion (34%) cut by the House of
Representatives to the Agency's fiscal 1996 budget, the Agency
had to prepare quickly for a potential reduction-in-force (RIF).
The Agency took preliminary steps to organize a RIF in case the
Senate failed to restore some of the agency's funding. It is for
this reason, and because several other Office of Inspector General
(OIG) and General Accounting Office (GAO) audits had
identified problems associated with the Agency's information
management systems, that the OIG conducted an audit of the
accuracy of the Agency's Personnel and Payroll System
(EPAYS). The emphasis of the audit was to determine whether
the personnel information contained in EPAYS was complete and
accurate and whether the system could be used quickly and with
confidence during a required reduction-in-force, furlough, or
other minor or mass  personnel action.

Although the fiscal 1996 budget impasse has recently been
resolved, and the Administrator has announced that no RIFs or
furloughs will occur during the remainder of fiscal 1996, doubt
about the future remains. Congress will soon debate the fiscal
1997 budget.  In  the near future, EPA may again have to plan for
potential RIFs and furloughs.

Specific objectives of our review were to determine whether:  (1)
EPAYS provides accurate information for RIF purposes and (2)
management control systems are in place to provide reasonable
assurance that the relevant EPAYS information is accurate.
BACKGROUND

Environmental Protection   EPAYS is an acronym for the Environmental Protection
Agency '$ Payroll and
Personnel System
(EPAYS)
Agency's integrated Payroll and Personnel System.
The Department of the Interior originally developed it and called
it DIPS (Departmental Integrated Personal Services System).
EPA has used the system since 1970, and since then
has made major modifications to comply with new governmental
requirements, and has enhanced the system to provide expanded
services and flexibility to EPA employees.

-------
 Report of th« Accuracy of EPA'« Personnel mid Payroll System (EPAYSL
                                      E1AMF6-11-0005-6100275
 System Responsibility
Personnel Management
Staff
Central Systems
Branch
The Office of Hitman
Resources Management
and Organizational
Services (OHROS)
The Assistant Administrator for Administration and Resources
Management (OARM) has the responsibility for EPAYS. Within
the Office of Administration and Resources Management
(OARM), two offices carry out most of the EPAYS Personnel
system functions.

•      The personnel management staff under the personnel
       teams conducts personnel data entry, and they are
       responsible for the Human Resources functions of specific
       AA ships. The personnel teams are in the Headquarters
       Operations and Client Services Division of the Office of
       Human Resources Management.

•      Monitoring and maintaining the programs and systems are
       handled by the Central Systems Branch (CSB) in the
       Enterprise Systems Division (BSD) of the Office of
       Information Resources Management (OIRM).  CSB works
       very closely with the staff at Research Triangle Park
       (RTF), North Carolina, who maintain the Agency's
       mainframe system and share the task of monitoring
       EPAYS in all its stages. Any change in pay structure,
       benefits, etc., required of EPA by Congress or other
       governmental bodies and enhancements to EPAYS
       requiring program modification, are dealt with by CSB.

The Office of Human Resources Management and Organizational
Services is responsible for the management and control of all
OPFs for EPA employees serviced by the Headquarters'
Human Resources Staff.  OPFs are the official repository of the
records, reports of personnel actions, and the documents and
papers required  in connection with these actions effected during
an employee's Federal service. These records provide the basic
source of data about a person's Federal employment while that
person is in the service and after separation.

OHROS has custodial responsibilities for OPFs and is responsible
for ensuring that they maintain them according to the Office of
Personnel Management (OPM) and EPA regulations and policies.
These responsibilities include:

•      Establishing personnel folders and ensuring that
       documents are filed appropriately and in order.

•      Filing and refiling documents into OPFs following
       guidelines established by EPA and OPM.

-------
  Report of the Accuracy of EPA't Personnel «id P^II »
                                                                  El AMF6-1 l-OOOS.*innrK
                                                         fOUOWin8 StandardS established
     Official Personnel
Folders Center (OPFQ
Reduction-in-Force
            ding °nly authorized
                                                                 staff access to the
 •     Completing requests to review, copy, and charge out/in
       folders to authorized personnel.

 •     Retiring or transferring OPFs when an employee
       separates.                             F J

Document maintained in the Center consist of OPFs of all

SS^JLT^ KTViC* by *" *•*!»«• Human
Resources Staff.  Approx,mately 8,000 OPFs are managed by
                                   to demote, separate, or furlough one or more
                          employees because of lack of work, shortage of funds  or
                          reorganization. The cause of a RIF may come from action of
                          £ S '-e PreSidem' the °fflce of M^gement and Budget
                          hL ^    r^ °J ** head °f ** a*en<* or «>me official who
                          has been authorized  to decide. Whatever the source of the

                         SSZSSZ RIF' °ffiCialS °f ^ ^^ must decide ^w to
                         distribute the remaining resources and what parts and programs
                         of the agency to cut, and how much.
                                   , must,first1describe the Kmits within which employees
                             compete with each other for retention of their jobs.  The first
                         him  (compete area) is organizational and geographical
                         Next, the agency identifies the competitive level.  It consists of
                         ^positions in a competitive area in the same grade and series,

                         rtLSf?? '"I"8" ^ ^ «uaUfication requirements, piy
                         ^S,  drrldng C°nditions (an incumbe« of one could
                         successfully perform critical elements of any other

                                   "
                                                      n
                            T                                      ne
                        qualified employee).  The names of all employees in a
                        competitive level are listed on a retention register in the order of
                        the r reiatwe retention standing.  Their relative standing is b^ed
                        on the four factors named in section 3502a of title 5, US Code-

-------
 Report of the Accuracy of EPA's Personnel and Payroll System (EPAYS)
                                      E1AMF6-H-OOOS-6100275
                          •     Tenure of Employment,

                          •     Veteran's Preference,

                          •     Service Computation Date, and

                          •     Performance Appraisal.

                          In the normal order of release from the competitive level, no
                          employee is released unless everyone below him or her on the
                          retention register is released.
SCOPE AND
METHODOLOGY
The audit was performed in accordance with the Governmental
Auditing Standards issued by the Comptroller General of the
United States (1994 revision).  The audit field work was
performed from November 1995 through March 1996 and
included on-site work in the Office of Human Resources
Organizational Services (OHROS) in Headquarters. Our audit
covered management procedures in effect as of December 31,
1995.
Methodology
Evidence Examined
To evaluate the accuracy of information contained in the OPFs as
compared with information contained in EPAYS, we selected a
sample of 416 OPFs from the program offices which make up
headquarters' twelve (12) Assistant Administrators (AAships).
(see Appendix III for methodology). However, as a result of the
OPF Center not being able to timely provide us with 37 OPFs
(see Chapter 3), we were only able to base our review on 379
OPFs.

At the time of this audit, EPA's fiscal 1996 budget had not been
approved, resulting in a limited travel budget. We decided that a
review of the accuracy of EPAYS within headquarters would just
as readily assist the Agency as would a review of selected
regional offices.

To accomplish our objectives, we:

•      Interviewed selected OHROS program office
       team directors and Washington Financial Management
       Center (WFMQ staff;

•      Selected and reviewed a sample of OPFs of headquarters
       employees;

-------
Report of the Accuracy of EPA't Personnel and Payroll System (EPAYS)
                                       E1AMF6-11-OOOS-6100275
                          •      Obtained and reviewed computer printouts (profile),
                                 contract delivery orders, administrative guidance and
                                 procedures, and management control summaries
                                 conducted.

                          Our audit did not include reviews of information
                          contained in regional personnel offices.
FMFIA Review
Internal Controls
Prior Audit
Coverage
The fieldwork performed included tests of only those
management controls and procedures specifically related to the
audit objectives.  The audit included tests of management and
related Federal Manager's Financial Integrity Act (FMFIA)
controls, policies, and procedures specifically related to the audit
objectives.  We reviewed OHROS FMFIA documentation
including: assessable unit assurance letters which summarized
internal/management control reviews (I/MCRs) and alternate
internal/management control reviews (AI/MCRs) from fiscal
1993 to fiscal 1995; and OHROS's event cycle documentation.

We reviewed the internal controls associated with the accuracy of
key data fields within the EPAYS system and the security of the
Official Personnel Folders (OPFs).  The controls we evaluated
included data entry verification,  management information
systems, and operation of the OPF Center.

The internal control weaknesses  noted in our review are discussed
in detail in Chapters 2 through 4 of this report.  Our
recommendations, if implemented, should improve the internal
controls in these areas.

Based on our review, no other issues came to our attention which
we believed were significant enough to warrant expanding the
scope of this audit.

Although the OIG and GAO have issued audit reports concerning
the Agency's information management systems, neither the OIG
nor GAO have issued any audit reports concerning the accuracy
of EPAYS data, security of OPFs, or any issues involving the
Office of Human Resources.

-------
Report of the Accuracy of EPA's Personnel and Payroll System (EPAYS)	El AMF6-11-0005-6100275
                              [This page intentionally left blank]

-------
Report of the Accuracy of EPA's Personnel and Payroll System (EPAYS)	El AMF6-11-0005-6100275

                                 CHAPTER 2

OHROS EFFORT IMPROVES ACCURACY OF PERSONNEL INFORMATION
MAINTAINED IN EPAYS, BUT MANAGEMENT CONTROLS ARE NEEDED TO
MAINTAIN ACCURACY

                         OHROS, since September 1995 and its reorganization on October
                         1, has been expending a considerable amount of time reviewing
                         and cleaning up the Official Personnel files (OPFs) and in
                         making corrections to the personnel information contained in
                         EPAYS. We found that between November 27, 1995 and
                         January 31,1996, the OHROS review had reduced the number of
                         EPAYS personnel information inaccuracies we identified in our
                         sample from 58 out of 379 (15.3%) to 20 out of 379 (5.3%).
                         OHROS staff continued reviewing OPFs and entering information
                         beyond our computer report date of January 31, 1996. We were
                         told by an Agency official, that before a reduction-in-force would
                         be fully executed, each employees' OPF will be checked three
                         times for accuracy, along with a check by the employee.

                         However, we noted that OHROS apparently viewed the accuracy
                         of EPAYS and the currency of the OPFs as a low priority.
                         Although OHROS had conducted at least two reorganizations
                         devoted to improving customer service and improving the filing
                         of OPFs, it was not until EPA was faced with a potential RIF
                         that OHROS begin a comprehensive review of the OPFs and of
                         the accuracy of the EPAYS information. We found that OHROS
                         had not identified the accuracy or reliability of EPAYS personnel
                         information in any of its FMFIA documentation, had not planned
                         or conducted any quality assurance reviews of the EPAYS
                         system, and had not assigned responsibility for system accuracy
                         in any of its position descriptions for Personnel Management
                         Specialists.  We were told by OHROS officials, that the
                         developing and executing of new procedures would hot take place
                         until the potential RIF concerns are eliminated.
BACKGROUND           As a result of the lack of management control reviews and a
                         potential reduction-in-force caused by a reported $2.5 billion
                         (34%) cut by the House of Representatives to the Agency's fiscal
                         1996 budget, the Agency,  in order to prepare for a potential RIF,
                         expended at least $55,300  in overtime costs and countless hours
                         during the regular business day in staff time updating OPF
                         information in EPAYS, correcting errors and omissions, and
                         updating missing information in the official personnel folders.
                         The information contained in EPAYS will be used to generate the

-------
 Report of the Accuracy of EPA's Personnel mid Payroll System (EPAYS)
                                       El AMF6-11-0005-6100275
Management Control
Reviews of the Accuracy
ofEPAYS
Personnel Information
and the Official
Personnel Files
Not Conducted
retention register, which prioritizes EPA staff based on
competitive level, tenure of employment, veteran's preference,
service computation date, and performance appraisal ratings.  We
believe that as a result of the inaccuracies identified in the
EPAYS personnel fields, the Agency would be unable to quickly
and accurately prioritize EPA staff on the retention register.
However, during discussions with OHROS personnel, we were
told that the RIF procedure also requires that all employees on
the retention register would have an additional opportunity to
review their personnel information to verify its accuracy.  Also,
as employees left for new employment or retired, new retention
registers would be compiled.

In accordance with the Integrity Act and OMB Circular A-123,
each executive agency must annually evaluate its system of
internal accounting and administrative controls and .report to
Congress and the President on whether its internal control
systems comply with the goals of the Act.  If systems do not
comply, the agency head must identify material weaknesses and
present plans  for corrective action.

EPA Resources Management Directive 2560 (Internal Control),
section 5 states: All EPA organizations shall develop and
maintain effective systems of internal control over their program
operations and administrative functions.  Also, section 4(h) states
that all EPA managers are responsible for operating effective and
efficient systems of internal control. They must also  evaluate the
control system periodically and take timely corrective actions on
all identified weaknesses.

We reviewed  the fiscal 1993 Office of Human Resources
and Management (OHRM) event cycle documentation
and related annual management control summaries
conducted between fiscal 1993 and 1995. We found that
OHRM  had not identified, as an event cycle, reviews of the
OPFs and accuracy of personnel information contained in
 EPAYS.  We also noted that OHRM had not conducted any
reviews to validate and ensure the accuracy of the data in EPA's
Personnel and Payroll System compared with the information
contained within the Official Personnel Files.

It appears that OHROS considered the accuracy of EPAYS
personnel information to be a low priority. This is based on the
lack of not identifying the accuracy of EPAYS personnel
information, as a potential risk in FMFIA documentation.
                                          8

-------
Report of the Accuracy of EPA'i Personnel and Payroll System (EPAYS)
                                        El AMF6-11-0005-6100275
OHROS Needs to
Implement a Written
Policy on Performance
Ratings Data Entry
Verification
 OMB Circular A-123 Revised, dated August 4, 1986, prescribes
 policies and procedures to be followed by executive departments
 and agencies in establishing, maintaining, evaluating, improving,
 and reporting on internal controls in their program and
 administrative activities.  OMB Circular A-123 Revised, dated
 June 21, 1995, updated the 1986 circular,'and defined
 management controls as the organization, policies, and
 procedures used to reasonably ensure that (1) programs achieve
 their intended results; (2) resources are used consistent with
 agency missions; (3) programs and resources are protected from
 waste, fraud, and mismanagement; (4) laws and regulations are
 followed; and (5) reliable and timely information is obtained,
 maintained, reported and used for decision making.

 Agencies and individual federal managers must take systematic
 and proactive measures to (1) develop and implement
 appropriate, costreffective management controls for results-
 oriented management; (2) assess the adequacy of management
 controls in federal programs and operations; (3) identify needed
 improvements; (4) take corresponding corrective action; and (5)
 report annually on management controls.

 We were told by several of the Personnel Management
 Specialists that employee performance ratings were processed as
 follows. Program Offices submit Personal Appraisals by
 December 31. A certification form, containing a list of
 individuals within the program office, is included with the
 performance appraisals.  The certification form is a listing of the
 employees in the program office and includes their performance
 ratings.  Performance ratings listed on the certification are
 compared against the actual performance appraisal  for accuracy.
 The certification is then given to a staff assistant for data entry
 into EPAYS of individual performance  ratings. The certification
 along with the edit report received the next day are returned to
 the personnel specialist for verification of correct and accurate
 data entry.  However, we were told that there was  no
 requirement to retain the certification. Then the performance
 appraisals are given to the file room contractor who places the
 appraisals into the individual's official personnel folder.
t
 We requested a copy of the policy, but were told it was not in
 writing. A written policy provides criteria which can be used in
 conducting management control reviews and in measuring
 performance during performance appraisal time. We were able
 to review a 1994 certification form retained by one personnel
 management specialist, and found that 5 out of 148 employees

-------
 Report of tho Accuracy of EPA's Personnel and Payroll System (EPAYS)
                                      El AMF6-11-0005-6100275
                          (3.4%) identified did not have their performance ratings entered
                          into EPAYS.  To establish milestone dates for the timeliness of
                          data entry, we reviewed two memorandums issued by the
                          Director of the Policy and Research Division. Pursuant to the
                          memorandums, performance ratings for 1993 and 1994 should
                          have been entered by January 31 of the following calendar year.
                          In addition, several OHROS Personnel Management staff told us
                          that it was not their responsibility to verify data entry.  Our
                          review of 379 OPFs identified 58 individuals (15.3%) who had
                          performance appraisals in their official personnel folders, but
                          those ratings (for fiscal years 1992 through 1994) were not in
                          EPAYS as of a November 27, 1995 computer report.  There was
                          a total of 75 missing ratings in EPAYS for the 58 individuals as
                          identified in the chart below.

                          We requested  a second EPAYS profile report for January 31,
                          1996. We noted that OHROS had corrected 36 of the 75 (48%)
                          missing ratings.  Based on the January report, OHROS reduced
                          the number of individuals missing information from 58 to 20 out
                          of 379 or 5.3%.
Fiscal Years
1992
1993
1994
Total
Performance Ratings
Missing As of
11/27/95 '
15
22
38
75
Performance Ratings
Missing As of
1/31/96
10
11
17'
38
Performance Ratings
Corrected
5
11
20
36
OHROS Aware of
need for corrections
On September 18, 1995, OHROS sent a memorandum to
all Headquarters' employees requesting that they review the
attached personnel data profile.  OHROS created the profile
based on the information in the Agency's automated personnel
system (EPAYS) and in employees' official personnel files.
Employees were requested to examine all the data elements on
the profile and make any corrections necessary, complete the
certification at the bottom of the profile page and return the
profile sheet (along with any supporting documentation to prove
changes to be made) by September 29, 1995.
             One individual who was listed on the November 27, 1995 EPAYS Report was
             not listed on the January 31, 1996 Report.
                                         10

-------
Report of the Accuracy of EPA's Personnel and Payroll System (EPAYS)	El AMF6-11-0005-6100275
                          Although OHROS has significantly reduced the number of
                          inaccuracies, improvements to its management controls over the
                          verification of data entry are still needed to ensure future
                          accuracy.  Computer reports are available which could assist
                          OHROS in identifying potential missing, inaccurate, or
                          incomplete personnel information.  We are concerned that even
                          though OHROS has conducted a massive effort to review all
                          headquarters OPFs, little attention has been paid to data entry of
                          information supplied by headquarters personnel.  Delaying data
                          entry increases the risk that information will not be entered into
                          EPAYS, resulting in inaccurate employee personnel file
                          information.

                          We were told that the development of management controls
                          would not be considered until all the reviews had been completed
                          and the system was determined to be accurate.  OFF reviews had
                          started in late September 1995 and were continuing through
                          March 1996.  Inaccuracies identified during our field work
                          (November - March) were brought to the attention of the OHROS
                          staff, but controls were still not initiated.  We believe that the
                          instituting of at least controls over the verification and timely data
                          entry of performance ratings received would reduce the amount
                          of time devoted to reviewing OPFs again to verify the accuracy
                          of EPAYS personnel information.

                          OHROS provided a description of the process to be used when
                          conducting a reduction-in-force (see Appendix II). Although the
                          procedure identified will assure that no employee is RIFed
                          without a thorough review, inaccurate information increases
                          employee concerns and the cost and amount of time needed to
                          correct the information and potentially generate a new retention
                          register.

                          As a result of not conducting management control reviews,
                          assigning a low priority to ensuring the accuracy of EPAYS
                          information, and not having a written policy concerning the
                          accuracy of data entry, OHROS has had to spend a considerable
                          amount of staff time and more than $55,000 in overtime to
                          review more than 6,000 official personnel  folders for
                          headquarters personnel and attempt to improve EPAYS data
                          accuracy.  OHROS is depending on these failsafe procedures to
                          catch any inaccuracies, and they do not believe the length of time
                          or cost to attain accuracy is a concern.  However, we believe that
                          the process could be ineffective. For example, if an individual
                          was incorrectly placed on the retention register based on
                                          11

-------
 Report of the Accuracy of EPA's Personnel and Payroll System (EPAYS)
                                      EIAMF6-11.0005-6100275
                          inaccurate performance rating(s), the individual's OPF may or
                          may not be reviewed by OHROS. OHROS would be reviewing
                          only the QPFs of individuals who had received a RIF
                          notification.
OHROS forms
Personnel Operations
Workgroup
RECOMMENDATIONS
After we began our audit, we were told that OHROS had
formed the "personnel operations workgroup" which has been
charged with developing policies and procedures to address the
problem areas identified during the OHROS Official Personnel
Folder (OPF) review.

The Workgroup, formed as a result of the problems found while
OHROS was conducting the OPF review,  has developed an
action plan which identifies responsible individual(s) and
determines milestone dates. We were provided a memorandum
which described some of the areas the action plan addresses (see
appendix IV).

Although we received an explanation of the action plan of the
workgroup, we have not received a copy of the formal
management request to form the workgroup, nor a document
which describes the workgroup's mission, goals and objectives.
We are, therefore, not sure whether the workgroup has
management support for potential recommendations. The effect
of the Human Resources Staff not having a formalized policy for
processing performance appraisals, along with the lack of data
entry verification resulted in  inconsistent reviews of the accuracy
of performance rating information entered into EPAYS.  This has
resulted in the inability of EPAYS to provide management with
an accurate, reliable, and timely RIF report information during
the first half of fiscal 1996.

We recommend that the Acting Assistant Administrator for
Administration and Resources Management:

1.    Require semiannual briefings on the status of the
      implementation of planned quality assurance activities
      until a system is in place and effectively functioning.
              •v,
2.    Require the workgroup to generate a computer report, as
      we did, to identify employees with missing performance
      rating information in EPAYS.
                                         12

-------
Report of the Accuracy of EPA's Personnel and Payroll System (EPAYS)          ElAMF6-11-0005-6100275
AGENCY RESPONSE
                                The agency stated that the Office of Administration and
                                Resources Management (OARM) will require OHROS to
                                establish a system of management controls and quality
                                assurance activities that ensures accuracy of EPAYS data
                                and conduct a briefing on them prior to the beginning of
                                Fiscal 1997.  Further, that OHROS has completed a 100
                                percent review and correction of performance rating
                                information for Fiscal Years 1991 through 1994.  The
                                staff is in the process of reviewing and inputting
                                performance ratings for Fiscal 1995 into EPAYS.  Newly
                                implemented internal controls will ensure these ratings are
                                accurate  in the data base.
                                          13

-------
Report of the Accuracy of EPA's Personnel and Payroll System (EPAYS)          El AMF6-11-0005-6100275
                             [TWs page intentionally left blank]
                                             14

-------
Report of the Accuracy of EPA't Personnel and Payroll System (EPAYS)	El AMF6-11-0005-6100275

                                   CHAPTERS

CONTROL OVER OFFICIAL PERSONNEL FOLDERS COULD BE IMPROVED
                          Over the five months (November 1, 1995 through March 15,
                          1996) of our review, the OFF Center staff had difficulty in the
                          timely retrieval of the OPFs for our review.  We would receive
                          only a portion of the OPFs requested and had to continually
                          request, through the project officer, OPFs not initially provided.
                          We were aware that the personnel specialists were continually
                          reviewing the OPFs and attempted to work with the project
                          officer so as not to disrupt the OPF review process. We were told
                          repeatedly by the OPF Center staff that numerous folders in our
                          review sample (37 out of 379, or 9.8%) were out with the
                          Personnel Management Specialists; and near the completion of
                          our work, we were told it could take several weeks before we
                          could obtain the folders. Based on our review,  we determined
                          that the remaining OPFs would not materially effect our audit
                          objective concerning whether EPAYS provides accurate
                          information for RIF purposes and decided not to continue to wait
                          for the OPFs.  However, we observed a situation where a
                          personnel management specialist, who had requested several
                          OPFs, was told by the OPF Center contractor that the specialist
                          already had the requested OPFs signed out to her. The specialist
                          insisted she had returned the folders earlier.  Further, during a
                          discussion with one of the Human Resources Team Directors,  we
                          were told that the Director also had difficulty in obtaining
                          folders.  We were told by one of the OHROS Team Directors,
                          that OPFs could be rotated among the staff who were responsible
                          for the review, which could result in delays in obtaining folders
                          by Agency employees to review their folders and by the OIG
                          auditors in conducting this audit.

                          Although the OPF Center had developed control procedures over
                          the removal and return of OPFs,  the inability of die personnel
                          management specialist to, within  a reasonable time period, return
                          OPFs causes us some concern over the location of the OPFs
                          within the individual human resources teams. As a result of the
                          ongoing OPF review,  the time constraints which OHROS staff
                          was under, and the findings we had already discussed with the
                          staff, we elected not to require OHROS  to provide the 37 folders.

BACKGROUND          Each Human Resources Staff Team is responsible for servicing
                          specific program offices.  Within each team several personnel
                          specialists are responsible for reviewing personnel actions and

                                         15

-------
Report of the Accuracy of EPA'8 Personnel and Payroll System (EPAYS)	Ei AMF6-1 i-0005-6100275

                          data entry.  During the time of our review, OHROS was
                          conducting a 100 percent review of the OPFs. Their review
                          entailed verifying information contained in the OFF against
                          information contained in various personnel files in EPAYS.  If
                          additional information was needed to be obtained and placed in
                          the individual's OFF, the personnel management specialist would
                          contact the particular individual. Folders would then sometimes
                          be held by the personnel management specialist until the
                          information requested from the individual was received and then
                          placed in the OFF. We observed several personnel management
                          specialists obtaining numerous OPFs from OFF Central files for
                          this and other purposes.

                          The Office of Human Resources Management and Organizational
                          Services (OHROS) is responsible for the management and control
                          of all Official Personnel Files (OFF) for EPA employees serviced
                          by the Headquarters'  Human Resources Staff. OPFs are the
                          official repository of the records, reports of personnel actions,
                          and the documents and papers required concerning these actions
                          effected during an employee's Federal service.  These records
                          provide the basic source of data about a person's Federal
                          employment while in  the service and after separation.

                          OHROS has custodial responsibilities for OPFs and is responsible
                          for ensuring that they maintain them according to the Office of
                          Personnel Management (OPM) and EPA regulations and  policies.
                          These responsibilities include:

                          •     Establishing personnel folders and ensuring that
                                documents are filed appropriately and in order.

                          •     Filing and refiling documents into OPFs following
                                guidelines established by EPA and OPM.

                          •     Updating labels on OPFs following standards established
                                by EPA.

                          •     Providing only authorized Agency staff access to the
                                OPFs.

                          •     Completing request to review, copy, charge out/in folders
                                to authorized personnel.

                          •     Retiring or transferring OPFs when an employee
                                separates.
                                          16

-------
Report of the Accuracy of EPA's Personnel and Payroll System (EPAYS)
                                       El AMF6-11-0005-6100275
OPM Delegation
CONCLUSION
On September 6, 1995, the Procurement Operations Branch
issued a delivery order against an existing contract to provide
records management support staff so that the demands for
increased service can be met and the timeliness of those services
can be improved, that employees can be assured that documents
are filed in their folder in a timely and accurate manner, and that
authorized personnel can charge out/in personnel folders in an
efficient and timely manner.

The Office of Personnel Management owns the personnel folders
and their contents.  0PM has delegated to the agencies the
authority to maintain these personnel folders. The OPF is a file
containing records and documents related to civilian employment
under title 5 of the U.S. Code.

Agency staff have various uses for OPFs including screening
qualifications, eligibility, and employee's rights and benefits
under pertinent  laws and regulations governing Federal
employment computing length of service, and other information
needed to provide a full range of human resources services.
These records may  be used for personnel research and individual
employees may  also review their OPFs. Therefore, the potential
for OPFs to be  misplaced, misfiled, or lost is a cause for
concern.

While we understand that the personnel management specialists
were conducting an intensive review and attempting to complete
the review by December 1st, we are concerned about the security
and possible misplacement of OPFs.  By holding OPFs until the
full review,  and any requested information,  has been received,
there is ah increased risk that an OPF may be misplaced and
require additional time to locate when requested by the OPF
Center.
RECOMMENDATION
AGENCY COMMENTS
We recommend that the Acting Assistant Administrator for
Administration and Resources Management request that the
OHROS Team Directors work with their staff to ensure that
folders being reviewed for completeness and accuracy be returned
to the OPF Center as timely as possible.

The Agency stated that OHROS Human Resources Staff
Directors recognize the importance of returning OPFs to  the
Center as soon as possible and have stressed this with their staffs.
Additionally, OHROS is initiating a bar-code tracking system for
OPFs that will notify personnel management specialists who have
                                          17

-------
Report of the Accuracy of EPA'a Personnel mid Payroll System (EPAYS)	El AMF6-114)005-6100275

                           exceeded their allotted time for retaining OPFs. Human
                           Resources Staff Directors will be provided the same information
                           to ensure the files are returned to the Center in a timely manner.
                           This system will be in place by the end of September 1996.
                                            18

-------
Report of the Accuracy of EPA't Personnel and Payroll System (EPA YS)

                                   CHAPTER4
                                       El AMF6-11-0005-6100275
              EPAYS SYSTEM SECURITY COULD BE COMPROMISED
Lack of System
Security
We identified that 52.6% (41 out of 78) personnel management
specialists have a supervisory data entry capability. This
capability permits the user to enter and modify information
contained in the personnel data base. We asked about whether
these specialists could access their own files and make changes to
those files. The previous acting Chief of the Systems Support
Staff, said that he knew of no protocol in TAPP/EPAYS which
would prevent an employee with system access from entering
personnel, payroll, or time and attendance (T&A) actions on
themselves.  We also requested the same information from the
Chief of the Client Support Branch of OARM's Enterprise
Systems Division, with the same result.

An individual with the ability to modify their own  files could
result in the individual making changes to specific  data fields
giving them a competitive advantage during a RIF. This ability
is also a weakness in system controls.

We did not identify data entry activity which would have caused
additional audit fieldwork, but the potential for unauthorized
activity requires that a protocol be developed which would
prohibit an individual's access to their own personnel, payroll or
time and attendance files.  We did not review the activities of the
personnel specialists in the regional offices;  however, we
understand that they have the capability of entering both payroll
and personnel information.
BACKGROUND
OMB Circular No. A-130, Transmittal 3, dated February 8,
1996, requires that agencies implement and maintain a computer
systems security program, including the preparation of policies,
standards, and procedures. The circular also implies that
agencies:

       Establish a management control process to assure that
       appropriate administrative, physical, and technical
       safeguards are incorporated into all new applications, and
       into significant modifications to existing applications.
                                          19

-------
 Report of the Accuracy of EPA'» Personnel MM! Payroll System (EPA YS>	El AMF6-11-0005-6100275

                                Conduct periodic audits or reviews of sensitive
                                applications and recertify the adequacy of security
                                safeguards.

                                Establish and manage personnel security policies and
                                procedures to assure an adequate level of security for
                                Federal automated'information systems.  Such policies
                                and procedures shall include requirements for screening
                                all individuals participating in the design, development,
                                operation, or maintenance of sensitive applications as well
                                as those having access to sensitive data.

RECOMMENDATION    We recommend that the Acting Assistant Administrator for
                          Administration and Resources Management require that an
                          automated control be added to EPAYS to prevent an individual
                          from accessing their own file and making changes to that file.

AGENCY COMMENTS   OHROS will work with the Office of Information Resources
                          Management (OIRM) to explore the feasibility of incorporating
                         . such  a control into the EPAYS system. The analysis will be
                          completed by the end of September 1996.
                                         20

-------
Report of the Accuracy of EPA'» Personnel and Payroll System CEP AYS)
E1AMF6-11-0005-6100275
                                          Appendix I
                                          Page 1 of 1
                          ACRONYMS
ASD      ADMINISTRATIVE SYSTEMS DIVISION
ASSB     APPLICATIONS SOFTWARE BRANCH
DOPS     DEPARTMENTAL INTEGRATED PERSONAL SERVICES SYSTEM
EOD      ENTRY ON DUTY
EPA      ENVIRONMENTAL PROTECTION AGENCY
EPAYS    EPA'S PAYROLL AND PERSONNEL SYSTEM
FMFIA    FEDERAL MANAGER'S FINANCIAL INTEGRITY ACT
I/MCR    INTERNAL/MANAGEMENT CONTROL REVIEWS
MCP      MANAGEMENT CONTROL PLANS
OAR      OFFICE OF AIR AND RADIATION
OARM    OFFICE OF ADMINISTRATION AND RESOURCES MANAGEMENT
OECA     OFFICE OF ENFORCEMENT AND COMPLIANCE ASSURANCE
OGC      OFFICE OF GENERAL COUNSEL
OHRM    OFFICE OF HUMAN RESOURCES MANAGEMENT
OHROS    OFFICE OF HUMAN RESOURCES MANAGEMENT AND
         ORGANIZATIONAL SERVICES
OIA      OFFICE OF INTERNATIONAL ACTIVITIES
OIG      OFFICE OF INSPECTOR GENERAL
OIRM     OFFICE OF INFORMATION RESOURCES MANAGEMENT
OPF      OFFICIAL PERSONNEL FILES
OPFC     OFFICIAL PERSONNEL FOLDERS CENTER
OPM      OFFICE OF PERSONNEL MANAGEMENT
OPPE     OFFICE POLICY, PLANNING AND EVALUATION
OPPTS    OFFICE OF PREVENTION, PESTICIDES, AND TOXIC SUBSTANCES
ORD      OFFICE OF RESEARCH DEVELOPMENT
OSWER    OFFICE OF SOLID WASTE AND EMERGENCY RESPONSE
OW      OFFICE OF WATER
RIF      REDUCTION-IN-FORCE
RTP      RESEARCH TRIANGLE PARK, NORTH CAROLINA
T&A      TIME AND ATTENDANCE
TAP?     TIME AND ATTENDANCE PAYROLL
WFMC    WASHINGTON FINANCIAL MANAGEMENT CENTER
                              21

-------
Report of the Accuracy of EPA'g Personnel and Payroll System (EPAYS)	El AMF6-11-0005-6100275

                                                                       Appendix n
                                                                         . Page 1 of 2
                      OVERVIEW OF A REDUCTION-IN-FORCE

                          OHROS provided the following as the process used to conduct
                          a Reduction-in-Force:

                                 Set the ground rules for the RIF (use of vacancies, cut-off
                                 date for performance ratings, waivers, etc.).

                                 Review-recheck-have ready references available (current
                                 RIF regulations, pay setting guides, severance pay
                                 formula, representative rate charts, pay tables, etc.)

                                 Establish-review-rccheck competitive level definitions to
                                 be sure they are complete and correct.

                                 Establish the effective date of the RIF.

                                 Verify that each employee is in the correct competitive
                                 level.

                                 Have OPF's for affected orgamzation(s) available and
                                 complete a review of pertinent RIF- related information
                                 (correctness of employees  title, series, grade, service
                                 computation date, retention sub-group, last three
                                 performance ratings, positions held, experience, training,
                                 etc.).

                                 Encourage/provide for employees review of "personal"
                                 information that is used in the RIF process (service
                                 computation date, performance ratings, experience on
                                 record review of all information in their OFF).

                                 Review employee job descriptions for accuracy.

                                 Prepare retention registers for the organizations^)
                                 affected.  Review and recheck the information.

                                 Identify positions to be abolished and identify affected
                                 employees.

                                 Review qualifications of affected employees.
                                         22

-------
Report of the Accuracy of EPA't Personnel and Payroll System (EPAYS)	El AMF6-11-0005-6100275

                                                                        Appendix H
                                                                            Page 2 of 2

                          In using an automated RIF processing system, input necessary
                          information. Generate reports, review and correct data elements
                          as necessary.

                          AutoRIF is an automated RIF processing application that EPA
                          will be using.  It uses data from EPAYS and information input
                          from the OPF to assist the human resources office (HRO) in
                          processing RIF actions.

                          AutoRIF assists the HRO to keep track of employees affected by
                          the RIF, the actions taken, qualification determinations made etc.

                          AutoRIF processes the RIF, develops retention registers,
                          processes employee's bump and retreat lights, and generates RIF
                          letters.

                          AutoRIF processes the additional iterations that may be necessary
                          in conducting the RIF based on employees resigning, retiring
                          during the course of the RIF.

                          The RIF is re-run and new offers are made to employees as
                          other employees decline RIF offers, resign from the Agency,
                          retire, etc.

                                 Check and re-check the automated decisions made through
                                 AutoRIF,

                                 Re-check displaced employees data and qualifications for
                                 placement.

                                 Issue RIF notices to employees.  Explain RIF decisions to
                                 employees.

                                 Issue updated RIF notices to employees as a result of
                                 additional iterations of the RIF process (based on
                                 employees resigning, retiring, declining RIF offers).

                                 Provide counseling to interested employees (career,  out
                                 placement, retirement,  etc.)

                                 Provide out placement and job referral services.

                                 Address appeals.

                                          23

-------
Report of the Accuracy of EPA's Personnel and Payroll System (EPA YS)  	El AMF6-11-0005-6100275

                                                                     Appendix in
                                                                         Page 1 of 2

                                 METHODOLOGY

                         To determine our sample size of OPFs to review, based on the
                         objectives of our review and the impact of a potential RIP on the
                         Agency, we wanted a high confidence level in which to assure
                         ourselves of the accuracy of the information to be used in
                         conducting the RIF. We, therefore, selected our sample size by
                         using a 95 percent confidence level and a maximum error rate of
                         5 percent.  This resulted in a sample of 363 OPFs based on 6,306
                         individuals. The 6,306 universe of individuals was determined
                         by reviewing a computer listing of headquarters employees
                         serviced by OHROS as of October 14, 1995. We initially selected
                         every 15th name on the listing for our OPF review.

                         In addition, we also reviewed a November  27, 1995 computer
                         report and identified 910 headquarters employees who were
                         missing either one or more performance ratings (indicated by an
                         "x" in the year missing a rating), and who had been at EPA since
                         the 1991 rating period. From the November 27th list, we
                         judgementally selected an additional 53 headquarters employees
                         for our review.

                         We anticipated using the OPF sample to project the results of the
                         testing to the universe as a whole. However, as we were
                         requesting the project officer to have the contractor pull our
                         selected OPFs, we were told that the OIG's Financial Audit
                         Division (FAD) had already started to pull  OPFs as part of their
                         Chief Financial Officers (CFO) Audit.  We were asked by  the
                         project officer if we could use the OPFs being pulled for FAD as
                         part of our sample, which would help OHROS by reducing the
                         amount of time needed to search for and pull some of our
                         requested OPFs.

                         In order to work cooperatively with OHROS and use OPFs
                         already obtained for another OIG audit, we agreed to review 64
                         of the OPFs selected by FAD as part of our OPF sample. FAD's
                         OPF sample selection technique was based  on dollar-unit
                         sampling which is a form of variable sampling.  Our initial
                         sampling method was based on attribute sampling.  By combining
                         these two methods of sampling, we are unable to statistically
                         project our testing on the universe as a whole. Considering the
                         enormous pressure OHROS was under to ready EPAYS for a RIF
                         and our desire to work cooperatively with them, we believe this

                                        24

-------
Report of the Accuracy of EPA'i Personnel and Payroll System (HPAYS)
El AMF6-11-0005-6100275
                                                                       Appendix III
                                                                            Page 2 of 2

                           modification to sampling methodology was justified.  The results
                           of our sample are representative of the accuracy of EPAYS,
                           though they are not statistically projectable.

                           We analyzed each OPF to determine if the information contained
                           in the file was entered into EPAYS. Our universe is shown below
                           in table 1.
^S:-S-SS;--<>i|^*':^-.. ;5S:';- :'•
11 by Program Office •^•-- • '
IKr. ' :: ; . Table 1 " :"""
AAShip
100-
Administration
210 - OPPE
220 - OECA
230 - OGC
240 - OIG
260 - OIA
300 - OARM
400 -OW
500 - OSWER
600 - Air Radiation
700 - OPPTS
800 - ORD
Total
Universe
750
301
600
180
179
67
956
557
632
500
1,295
289
6,306
                                          25

-------
                     P«*»onnel «nd P^U System REPAYS)	El AMF6-11-0005 4100275

                                                         Appendix IV
                                                            Page 1 of 2

                            APR I 9 1996
MEMORANDUM

SUBJECT:  OIG Review — Accuracy of EPAYS Payroll and
          Personnel System Data
          Dave Boyce
     During your discussion with Daiva Balkus and  the  Human
Resources Staff Directors regarding your review of the accuracy
of EPAYS oavroll and personnel system data,  we agreed  to forward
you"'additional ififoritiation "regaTratiTg th"e~ CHfcOS Personnel
Operations Workgroup.
                    «
     The following information is submitted:

o    The Personnel Operations Workgroup, comprised of  senior
     level personnel specialists from each  Human Resources Staff,
     was formed to analyze personnel data issues identified
     during the OHROS-initiated review of Official Personnel
     Folders (OPFs) and to determine a strategy to resolve these
     issues,  it was recognized that OHROS  needed  to institute a
     comprehensive, systemic approach to assuring  personnel data
     quality.  The Workgroup developed an action plan  which
     identified responsible individual(s) and determined
     milestone dates.  Currently, th« action plan  is being
     implemented.

o    The action plan addresses the following areas:

     1.   Guidance/Tools

               Assure all Staff members have up-to-date guidance
               and tools.
               Provide general overview and specific in-house
               training sessions regarding  the guidance and
               tools.
               Implement LAN based support  systems for guidance
               and tools to facilitate Staff member use, i.e.,
               competitive level definitions and 'codes and
               service computation date calculation software.


                                    26

-------
Report of the Accuracy of EPA'a Personnel and Payroll System (EPAYS) _ El AMF6-1 1-0005-6100275

                                                       Appendix IV
                           -2-                            Page 2 of 2

  2.    Quality  Review/Control

            Conduct  test of a Coding Guide for Personnel
            Actions  used by Team Vegas to determine
            applicability to Human Resources Staff functions
            Ensure the accuracy of data and that OPFs  remain
            current  by conducting random samplings of  OPFs and
            internal reviews of TAPP/EPAYS data input.
            Require  a second-level review on all personnel
            actions  being processed and a signature by an
            authorized Staff member on all SF~50s.
            Develop  written standard operating -procedures
            (SOPs) for the operations handled by the Human
            Resources Staffs,  including retention of
            performance rating and award certification
            reports.

  3.    Long-Term  System Controls

       —    Work  with the  Office  of Information Resources
            Management (OIRM)  to  improve the personnel action
            edit  process and the. print quality for SF-50s.
       —    Develop  formal systems for improvement of internal
            controls,  e.g.,  annual sampling of OFF data and
            evaluations of specific personnel processes and
            personnel action processing,
            Engage in streamlining and process improvement
                              aUtoaation of Personnel systems,
 Should you have any questions, please  call  me on 260-2012.
                                27

-------
Report of tho Accuracy of EPA'* Personnel and Payroll System (EPAYS)
                                                                El AMF6-11-0005-6100275
                                                                      Appendix V
               UNITED STATES ENVIRONMENTAL PROTECTION AGENCY         page j Qf 3
                            WASHINGTON, D.C. 20460
                                       JUL  24(996
                                                                        OFFICE OF
                                                                      ADMINISTRATION
                                                                      AND RESOURCES
                                                                      MANAGEMENT
MEMORANDUM
SUBJECT:

FROM:


TO:
DjtfrVReport aCChfe^ccuracy^of EPA's PS
          y$tot>
          sachowitz
Acting Assistant Administrator

Michael D. Simmons
Deputy Assistant Inspector General
 For Internal and Performance Audits (2421)
                                                       Personnel System (EPAYS)
      This is in response to your draft audit report regarding the accuracy of EPA's Payroll and
Personnel System (EPAYS\ The Office of Administration and Resources Management (OARM)
agrees with your principal f ndings, and we have every intention of forcefully dealing with your
recommendations. In fact, he Office of Human Resources and Organizational Services
(OHROS) has gone beyond your recommendations to ensure the accuracy of EPAYS data.

      Specifically, the following corrective actions have been taken or planned based on the
report's recommendations:

      1. Require semiannual briefings on the status of the implementation of planned quality
assurance activities until a system is in place and effectively functioning.

             Planned Corrective Action: OARM will require OHROS to establish a system of
      management controls and quality assurance activities that ensures accuracy of EPAYS
      data and conduct a briefing on them prior to the beginning of Fiscal 1997.

      2. Require the workgroup to generate a computer report, as the OIG did, to identify
employees with missing performance rating information in EPAYS.

             Corrective  Action: OHROS has completed a 100 percent review and correction of
      performance rating information for Fiscal Years 1991 through 1994.  The staff is in the
      process of reviewing and inputting performance ratings for Fiscal 1995 into  EPAYS.
      Newly implemented intenal controls, as described below, will ensure these ratings are
      accurate in the data base.
                                         28

-------
  Report of the Accuracy of EPA's Personnel and Payroll System (EPAYS)	El AMF6-1 l-OOOS-6100275

                                                                          Appendix V
                                                                             Page 2 of 3

                                         -2-

       3. Request that the OHROS Team Directors work with their staff to ensure that folders
being reviewed for completeness and accuracy be returned to the OFF Center as timely as
possible.

             Corrective Action: The OHROS Human Resources Staff Directors recognize the
       importance of returning OPFs to the Center as soon as possible and have stressed this
       with their staffs. Additionally, OHROS is initiating a bar-code tracking system for OPFs
       that will notify personnel management specialists who have exceeded their allotted time
       for retaining OPFs.  Human Resources Staff Directors will be provided the same
       information to ensure the files are returned to the Center in a timely manner.  This
       system will be in place by the end of September  1996.

       4. Require that an automated control be added to EPAYS to prevent an individual from
accessing their own file and making changes to that file.

             Planned Corrective Action: OHROS will work with the Office of Information
       Resources Management (OIRM) to. explore the feasibility of incorporating such a control
       into the EPAYS system.  The analysis will be completed by the end of September 1996  '

       In addition to our responses to your helpful recommendations, OHROS has gone well
beyond them to ensure  the accuracy of EPAYS data:

             -In February 1996 OHROS issued an updated profile to all Headquarters
       employees asking them to again review the accuracy of their personal data elements.
       OHROS addressed all employees' remaining concerns regarding this information.

             -OHROS has implemented an effective Standing Operating Procedure (SOP) that
       requires a second-level review of all personnel transactions prior to inputting into
       EPAYS. To ensure  accountability, personnel management specialists are signing their
       SF-50s, Notification of Personnel Action.

             -Fiscal 1995  Performance Ratings are being 100% inventoried, checked for
       accuracy,  input  into  EPAYS, and re-checked prior to filing.

             -Competitive Levels have been established and assigned for all Headquarters
       employees. We have implemented an internal control  system that requires prior approval
      •of the Competitive Level Committee of any new competitive level.

             -Standard Operating Procedures will be developed by the end of September 1996
       to ensure consistency and compliance with appropriate regulations.


                                           29                              .

-------
 Report of the Accuracy of EPA'a Personnel and Payroll System (EPAYS)	El AMF6-11-0005-6100275

                                                                          Appendix V
                                                                             Page 3 of 3
                                          .3-

       Again, we are pleased to have an outside evaluation of the accuracy of EPAYS data. We
are well aware of the seriousness of this information and its effect on the careers of EPA
employees. OHROS is putting forth a considerable amount of effort to ensure the accuracy of
the data, and I have complete confidence they will be successful.

       Should you have any questions about this response, please contact David J. O'Connor,
Director, Office of Human Resources and Organizational Services, at 260-4467,
                                            30

-------
Report of the Accuracy of EPA'» Personnel and Payroll System (EPAYS) _ El AMF6-1 1-0005-6100275

                                                                       Appendix VI
                                                                           Page 1 of 1
                                       IWSTRfRf mON

Office of Inspector General

       Inspector General (2410)

       Deputy Inspector General (2410)


Headquarters Office

       Acting Assistant Administrator for
        Administration and Resources Management (3101)

       Director, Office of Human Resources and Organizational Services (3610)

       Agency Follow-up Coordinator, Office of Administration
        and Resources Management, Attn: Director, Program and
        Policy Coordinator Office (3 1 02)

       Headquarters Library (3304)

Regional Offices

       Regional Administrator, Region 1

       Regional Administrator, Region 2

       Regional Administrator, Region 3

       Regional Administrator, Region 4

       Regional Administrator, Region 5

       Regional Administrator, Region 6

       Regional Administrator, Region 7

       Regional Administrator, Region 8

       Regional Administrator, Region 9

       Regional Administrator, Region 10

                                          31

-------

-------