\ Office of Inspector General Report of Audit REVIEW OF THE ACCURACY OF EPA's PAYROLL AND PERSONNEL SYSTEM (EPAYS) D D E1AMF6-11-0005-6100275 August 15, 1996 ------- INSPECTOR GENERAL DIVISION CONDUCTING THE AUDIT: HEADQUARTERS AUDIT DIVISION PROGRAM OFFICE COVERED: OFFICE OF ADMINISTRATION AND RESOURCES MANAGEMENT ------- UNITED STATES ENVIRONMENTAL PROTECTION AGENCY WASHINGTON. D.C. 20460 AUG 15 1996 OFFICE OF "WE. INSPECTOR GENERAL MEMORANDUM SUBJECT: Review of the Accuracy of EPA's Payroll and Personnel System (EPAYS) (Audit Report No. El AMF6-11-0005-6100275) FROM: Michael Simmons Deputy Assistant Inspector General for Internal and Performance Audits (2421) TO: Alvin M. Pesachowitz Acting Assistant Administrator for Administration and Resources Management (3101) Attached is our final report titled Accuracy of EPA*s Payroll and Personnel System fEPAYSt. The primary objectives of our review were to determine whether: (1) EPAYS provides accurate information for Reduction-in-force purposes; and (2) Management control systems are in place to provide reasonable assurance that the relevant EPAYS information is accurate. This report identifies corrective actions the Office of Inspector General (OIG) recommends involving the accuracy of the EPAYS system. As such, it represents the opinion of the OIG. Final determinations on the matters in the report will be made by EPA managers in accordance with established EPA audit resolution procedures. Accordingly, the findings described in this report do not necessarily represent the final EPA position. The response by the Office of Administration and Resources Management (OARM) to our draft report is included as Appendix V. Our evaluation and comments on the response are included throughout the report, as appropriate. Based on OARM's response to the draft report and prior discussions, we made appropriate changes to this final report. Further, we believe that the corrective actions planned and the milestones indicated are responsive to the recommendations in the audit report, and are therefore closing the report in our tracking system upon issuance. We appreciate the cooperation extended to our auditors during this audit. If you or your staff have any questions concerning this report, please contact Edward Gekosky, Divisional Inspector General for Audit, or Frances E. Tafer of my staff, on (703) 308-8222. Attachment cAJ. HtcttttdltticttUt I ink an paper mar ------- ------- ACCURACY OF EPA's PAYROLL AND PERSONNEL SYSTEM (EPAYS) • E1AMF6-11-0005-6100275 ------- Report of the Accuracy of EPA'» Pem>tmel and PayroU System (EPAYS) _ El AMF6-1 l-OOOS-6 100275 TART.F OK EXECUTIVE SUMMARY CHAPTERS 1. INTRODUCTION . . ...... . ............................. 1 PURPOSE ................. . . • ............. . ......... 1 BACKGROUND ...................................... 1 SCOPE AND METHODOLOGY . . . ................. ........ 4 2. OHROS EFFORT IMPROVES ACCURACY OF PERSONNEL INFORMATION MAINTAINED IN EPAYS, BUT MANAGEMENT CONTROLS ARE NEEDED TO MAINTAIN ACCURACY ........... 7 3. CONTROL OVER OFFICIAL PERSONNEL FOLDERS COULD BE IMPROVED .......... . ........... . ...... . .......... 15 4. EPAYS SYSTEM SECURITY COULD BE COMPROMISED ......... 19 r APPENDIX I - ACRONYMS ................................ ...... 21 APPENDK H - OVERVIEW OF A REDUCTION-IN-FORCE ................ 22 APPENDIX ffl - METHODOLOGY ................................. 24 APPENDK IV - OHRQS PERSONNEL OPERATIONS WORKGROUP ........... 26 APPENDK V - AGENCY COMMENTS ......... .............. . ...... 28 APPENDK VI - DISTRIBUTION ....... ..... ........................ 31 ------- Report of the Accuracy of EPA't Peraonnel and Payroll Syrtam (HPAYS) EXECUTIVE SUMMARY EIAMF6-11-0005-6100275 PURPOSE As a result of a potential $2.5 billion (34%) cut by the House of Representatives to the Agency's fiscal 1996 budget, the Agency had to prepare quickly for a reduction-in-force (RTF). In view of this and as a result of several other OIG audits which identified problems associated with the Agency's information management systems, we initiated an audit of EPA's Payroll and Personnel System (EPAYS). EPAYS contains the employees' personnel information which would be used in conducting a RIF (see Appendix II). The emphasis of the audit was to determine whether the personnel information contained in EPAYS was complete and accurate, and whether the system could be used quickly and with confidence during a required RIF, furlough, or other minor or mass personnel action. Specific objectives were to determine whether: 1. EPAYS provides accurate information for RIF purposes; and 2. Management control systems are in place to provide reasonable assurance that the relevant EPAYS information is accurate. BACKGROUND EPAYS is an acronym for the Environmental Protection Agency's integrated Payroll and Personnel System. EPA has used the system since 1970, and has made major modifications to comply with new governmental requirements to provide expanded services and flexibility to EPA employees. EPAYS integrates the functions formally performed independently by the personnel, payroll and timekeeper's offices. EPAYS now automates the tasks which at one time were done manually, and all EPA offices throughout the United States manage their EPAYS tasks (and others) through the Agency's IBM 3090 mainframe computer located at Research Triangle Park (RTP), North Carolina. The Assistant Administrator for Administration and Resources Management (OARM) has responsibility for EPAYS. Within OARM, two offices have the responsibility for entering data into EPAYS. The Office of Human Resources and Organizational Services (OHROS) is responsible for entering employees' personnel information into EPAYS, while the Office of the 11 ------- Report of the Accuracy of EPA'a Personnel and Payroll System (EPAYS) El AMF6-1 l-OOOS-6100275 Comptroller (OC) is responsible for entering employee financial and payroll information into EPAYS. OHROS is also responsible for the management and control of all Official Personnel files (OPFs) for EPA employees serviced by the Headquarters's Human Resources Staff. OPFs are the official repositories of the records, reports of personnel actions, and the documents and papers required concerning actions affected during an employee's federal service. These records provide the basic source of data about a person's employment while in the federal service and after separation. RESULTS. Our audit found that OHROS, since September 1995 has been IN BRIEF expending a considerable amount of time reviewing and cleaning up the OPFs and in making corrections to the personnel information contained in EPAYS. We found that between November 27, 1995 and January 31, 1996, the OHROS review had reduced the number of EPAYS personnel information inaccuracies by more than 65 %. OHROS staff has continued to review OPFs and enter information beyond our computer report date of January 31,1996. We were told by an Agency official, that before a reduction-in-force would be fully executed, each employee's OPF will be checked three times for accuracy, along with a check by the employee. However, we noted that OHROS apparently viewed the accuracy of EPAYS and the currency of the OPFs as a low priority. Although OHROS had conducted at least two reorganizations devoted.to improving customer service and improving the filing of OPFs, it was not until EPA was faced with a potential RIF that OHROS begin a comprehensive review of the OPFs and of the accuracy of the EPAYS information. We found that OHROS had not identified the accuracy or reliability of EPAYS personnel information in any of its FMFIA documentation, had not planned or conducted any quality assurance reviews of the EPAYS system, and had not assigned responsibility for system accuracy in any of its position descriptions for Personnel Management Specialists. We were told by OHROS officials, that the developing and executing of new procedures would not take place until the potential RIF concerns are eliminated. ------- Report of the Accuracy of EPA'i Personnel and Payroll System (EPAYS) El AMF6-1 1.000S-610027S PRINCIPAL FINDINGS OHROS Aware of need for corrections Management Control Reviews of EPAYS Accuracy and Official Personnel Files Not Conducted We summarized below and discussed our principal findings in detail in Chapters 2 through 4 of this report. On September 18, 1995, OHROS sent a memorandum to all Headquarters' employees requesting that they review the attached personnel data profile. OHROS created the profile based on the information in the Agency's automated personnel system (EPAYS) and the employees' official personnel files. Employees were requested to examine all the data elements on the profile and make any corrections necessary, complete the certification at the bottom of the profile page, and return the profile sheet (along with any supporting documentation .to prove changes to be made) by September 29, 1995. However, our review of a sample of OPFs and "profiles" received from Agency staff identified a need for OHROS to develop Management Controls to verify that employee personnel information is entered accurately in EPAYS. We reviewed the fiscal 1993 Office of Human Resources Management (OHRM) event cycle1 documentation and related annual management control summaries conducted between fiscal 1993 and 1995. We found that OHRM had not identified, as an event cycle, reviews of the OPFs and accuracy of personnel information contained in EPAYS. We also noted that OHRM had not conducted any reviews to validate and ensure the accuracy of the data in EPAYS compared with the information contained within the OPFs. Because of the lack of management control reviews and a potential reduction-in-force caused by a potential $2.5 billion (34%) cut by the House of Representatives to the Agency's fiscal 1996 budget, the Agency had to expend at least $55,300 in overtime costs and countless hours in Agency staff time correcting system errors and omissions, and updating missing information in the official personnel folders. If the event cycle controls had been in place, the additional Agency staff time expanded might have been reduced. 1 Operations within a program or function are activities that fulfill the mission of the program or function. These are the event cycles. They are the processes followed to perform related activities, create the necessary documentation, and gather and report data. Typical examples of event cycles are: (1) Policy and planning; (2) Program cycles; (3) Admin- istrative cycles (personnel, procurement, budget, etc.); and (4) Assets management. IV ------- Report of the Accuracy of EPA's Personnel and Payroll System (HPAYS) El AMF6-11-0005-6100275 OHROS Needs To Implement A Written Policy On Personnel Actions Data Entry Verification Control Over Official Personnel Folders Needs Improvement To identify management controls established by OHROS, we requested copies of policies, procedures, or guidelines provided to OHROS staff. We interviewed several personnel management specialists to determine procedures used in processing personnel actions. The procedures used by the staff contained a verification process. However, the staff we interviewed also told us that it was not their responsibility to verify data entry. Although verification procedures we discussed with them were consistent among the staff, no written policy existed. As of February 20, 1996, based on our review of 379 folders, we identified that 58 individuals (15.3% of the folders we reviewed) had performance appraisals in their official personnel folders for fiscal years 1991 through 1994, but did not have those ratings entered in EPAYS based on a November 27, 1995 computer report. As a result of the on-going reviews of OPFs conducted by OHROS, we requested a second EPAYS report (January 31, 1996) to determine if OFF information was being updated in EPAYS. Based on the January report, OHROS reduced the number of individuals missing information from 58 to 20 out of 379 or 5.3%. Although OHROS has significantly reduced the number of inaccuracies, improvements to its management controls over the verification of data entry are still needed to ensure the future accuracy of EPAYS. Computer reports are available which could assist OHROS in identifying potentially missing, inaccurate, or incomplete personnel information. Also, OHROS should, at least annually, notify EPA employees of the need to periodically review and update the OPFs. Over the five months (October 30, 1995 through March 15, 1996) of our review, the OPF Center staff had difficulty in the timely retrieval of the OPFs for our review. We would receive only a portion of the OPFs requested and had to continually request, through the project officer, OPFs not initially provided. During our review, we observed a Personnel Management Specialist being told that she already had OPFs signed out to her which she was requesting, but the specialist insisted that she had returned the folders. Further, during a discussion with one of the Human Resources Team Directors, we were told the Director also had difficulty in obtaining folders. Individual staff team members may have had the folders at their desks while awaiting additional information. However, ------- Report of the Accuracy of EPA's Personnel and Payroll System (EPAYS) El AMF6-11-0005-6100275 maintaining the folders at their desks versus the Central fileroom compromises the security of the folders and increases the risk of the folders being misplaced. EPAYS System Security Could Be Compromised RECOMMENDATIONS We noted that 52.6% (41 out of 78) of the personnel management specialists have supervisory data entry capability. This capability permits the user to enter and modify information contained in the personnel data base. We questioned several OHROS staff about whether the personnel management specialists could access their own files and make changes to those files. Two individuals (the Chief of the Client Support Branch and the previous Acting Chief of the Systems Support Staff) said that the system does not prevent access to an individual's own record. One individual, an OHROS staff Team Director, stated that one of his individuals attempted to enter an award into his/her own record but was blocked. We did not identify any data entry activity, while reviewing the EPAYS computer reports, which would have caused additional fieldwork. However, we did not review the activities of the personnel specialists in the regional offices who have the capability of entering both payroll and personnel information. The system should contain a security control which would prohibit an individual from entering information into their own record. Without such a security control, information in the system could be compromised and lead to potential fraudulent activity. Our detailed recommendations are listed following the findings in Chapters 2 through 4. However, in summary, we are recommending that the Acting Assistant Administrator for Administration and Resources Management: 1. Require semiannual briefings on the status of the implementation of planned quality assurance activities until a system is in place and effectively functioning. 2. Require the workgroup to generate a computer report, as we did, to identify employees with missing performance rating information in EPAYS. 3. Request that the OHROS Team Directors work with their staff to ensure that folders being reviewed for completeness and accuracy be returned to the OPF Center as timely as possible. VI ------- Report of the Accuracy of EPA'a Personnel and Payroll System (HPAYS) El AMF6-11-0005-6100275 4. Require that an automated control be added to EPAYS to prevent an individual from accessing their own file and making changes to that file. AGENCY COMMENTS OIG COMMENTS We met with Agency officials on April 4, 1996, to discuss the position papers we provided them so they could preview our potential audit findings. At that meeting, the Agency officials commented on our draft material saying: The thorough manual rechecking they feel is necessary for any RIF listing, or similar iteration which could affect , EPA employees in such an important way, negates auditors* concerns with the accuracy of EPAYS data. Indeed, $55,000 in overtime is a minor cost in comparison with the high amount of effort officials believe must be expended to ensure absolute accuracy of any RIF listing prepared for the Agency. The error rate the OIG auditor found through testing is a low error rate (5%) for a system such as EPAYS2. The agency in its July 24, 1996 response to our draft audit report, agreed with our principal findings and indicated that its Office of Human Resources and Organizational Services (OHROS) has gone beyond our recommendations to ensure the accuracy of EPAYS data (see Appendix V for the full response). We continue to believe much less effort would have had to have been expended on preparing for a potential RIF if management controls had been in place and EPAYS and OPFs had been more accurate. The overtime and during business hours time expended to provide the necessary accuracy for preparation for a potential * RIF would have been much less or even unnecessary. In regard to the error rate, the OIG believes, although it is low, it is significant based on the amount of time which has been and continues to be spent in reviewing OPFs and entering ratings into EPAYS. It reflects two concerns: (1) a lack of management controls in place to verify that information has been accurately At the time we presented our position papers to Agency officials for their review, we expressed separate individual error rates based on two sample reviews. When the samples were combined, based on the same factors, the combined error rate increased from 5.3 percent to 15.3 percent. Agency officials expressed their opinion on the lower error rate. vii ------- Report of tho Accuracy of EPA'« Personnel and Payroll System (EPAYS) ElAMF6-11-0005-6100275 entered into EPAYS and (2) it increases EPA staffs concern about the accuracy of EPAYS when they discover that information supplied still was not entered into EPAYS. Vlll ------- Report of the Accuracy of EPA'« Personnel and Payroll System (EPAYS) E1AMF6-J1-0005-6100275 [This page intentionally left blank] IX ------- Report of die Accuracy of EPA'f Personnel and Payroll System (EPAYS) El AMF6-11-0005-6100275 PURPOSE CHAPTERl INTRODUCTION As a result of a potential $2.5 billion (34%) cut by the House of Representatives to the Agency's fiscal 1996 budget, the Agency had to prepare quickly for a potential reduction-in-force (RIF). The Agency took preliminary steps to organize a RIF in case the Senate failed to restore some of the agency's funding. It is for this reason, and because several other Office of Inspector General (OIG) and General Accounting Office (GAO) audits had identified problems associated with the Agency's information management systems, that the OIG conducted an audit of the accuracy of the Agency's Personnel and Payroll System (EPAYS). The emphasis of the audit was to determine whether the personnel information contained in EPAYS was complete and accurate and whether the system could be used quickly and with confidence during a required reduction-in-force, furlough, or other minor or mass personnel action. Although the fiscal 1996 budget impasse has recently been resolved, and the Administrator has announced that no RIFs or furloughs will occur during the remainder of fiscal 1996, doubt about the future remains. Congress will soon debate the fiscal 1997 budget. In the near future, EPA may again have to plan for potential RIFs and furloughs. Specific objectives of our review were to determine whether: (1) EPAYS provides accurate information for RIF purposes and (2) management control systems are in place to provide reasonable assurance that the relevant EPAYS information is accurate. BACKGROUND Environmental Protection EPAYS is an acronym for the Environmental Protection Agency '$ Payroll and Personnel System (EPAYS) Agency's integrated Payroll and Personnel System. The Department of the Interior originally developed it and called it DIPS (Departmental Integrated Personal Services System). EPA has used the system since 1970, and since then has made major modifications to comply with new governmental requirements, and has enhanced the system to provide expanded services and flexibility to EPA employees. ------- Report of th« Accuracy of EPA'« Personnel mid Payroll System (EPAYSL E1AMF6-11-0005-6100275 System Responsibility Personnel Management Staff Central Systems Branch The Office of Hitman Resources Management and Organizational Services (OHROS) The Assistant Administrator for Administration and Resources Management (OARM) has the responsibility for EPAYS. Within the Office of Administration and Resources Management (OARM), two offices carry out most of the EPAYS Personnel system functions. • The personnel management staff under the personnel teams conducts personnel data entry, and they are responsible for the Human Resources functions of specific AA ships. The personnel teams are in the Headquarters Operations and Client Services Division of the Office of Human Resources Management. • Monitoring and maintaining the programs and systems are handled by the Central Systems Branch (CSB) in the Enterprise Systems Division (BSD) of the Office of Information Resources Management (OIRM). CSB works very closely with the staff at Research Triangle Park (RTF), North Carolina, who maintain the Agency's mainframe system and share the task of monitoring EPAYS in all its stages. Any change in pay structure, benefits, etc., required of EPA by Congress or other governmental bodies and enhancements to EPAYS requiring program modification, are dealt with by CSB. The Office of Human Resources Management and Organizational Services is responsible for the management and control of all OPFs for EPA employees serviced by the Headquarters' Human Resources Staff. OPFs are the official repository of the records, reports of personnel actions, and the documents and papers required in connection with these actions effected during an employee's Federal service. These records provide the basic source of data about a person's Federal employment while that person is in the service and after separation. OHROS has custodial responsibilities for OPFs and is responsible for ensuring that they maintain them according to the Office of Personnel Management (OPM) and EPA regulations and policies. These responsibilities include: • Establishing personnel folders and ensuring that documents are filed appropriately and in order. • Filing and refiling documents into OPFs following guidelines established by EPA and OPM. ------- Report of the Accuracy of EPA't Personnel «id P^II » El AMF6-1 l-OOOS.*innrK fOUOWin8 StandardS established Official Personnel Folders Center (OPFQ Reduction-in-Force ding °nly authorized staff access to the • Completing requests to review, copy, and charge out/in folders to authorized personnel. • Retiring or transferring OPFs when an employee separates. F J Document maintained in the Center consist of OPFs of all SS^JLT^ KTViC* by *" *•*!»«• Human Resources Staff. Approx,mately 8,000 OPFs are managed by to demote, separate, or furlough one or more employees because of lack of work, shortage of funds or reorganization. The cause of a RIF may come from action of £ S '-e PreSidem' the °fflce of M^gement and Budget hL ^ r^ °J ** head °f ** a*en<* or «>me official who has been authorized to decide. Whatever the source of the SSZSSZ RIF' °ffiCialS °f ^ ^^ must decide ^w to distribute the remaining resources and what parts and programs of the agency to cut, and how much. , must,first1describe the Kmits within which employees compete with each other for retention of their jobs. The first him (compete area) is organizational and geographical Next, the agency identifies the competitive level. It consists of ^positions in a competitive area in the same grade and series, rtLSf?? '"I"8" ^ ^ «uaUfication requirements, piy ^S, drrldng C°nditions (an incumbe« of one could successfully perform critical elements of any other " n T ne qualified employee). The names of all employees in a competitive level are listed on a retention register in the order of the r reiatwe retention standing. Their relative standing is b^ed on the four factors named in section 3502a of title 5, US Code- ------- Report of the Accuracy of EPA's Personnel and Payroll System (EPAYS) E1AMF6-H-OOOS-6100275 • Tenure of Employment, • Veteran's Preference, • Service Computation Date, and • Performance Appraisal. In the normal order of release from the competitive level, no employee is released unless everyone below him or her on the retention register is released. SCOPE AND METHODOLOGY The audit was performed in accordance with the Governmental Auditing Standards issued by the Comptroller General of the United States (1994 revision). The audit field work was performed from November 1995 through March 1996 and included on-site work in the Office of Human Resources Organizational Services (OHROS) in Headquarters. Our audit covered management procedures in effect as of December 31, 1995. Methodology Evidence Examined To evaluate the accuracy of information contained in the OPFs as compared with information contained in EPAYS, we selected a sample of 416 OPFs from the program offices which make up headquarters' twelve (12) Assistant Administrators (AAships). (see Appendix III for methodology). However, as a result of the OPF Center not being able to timely provide us with 37 OPFs (see Chapter 3), we were only able to base our review on 379 OPFs. At the time of this audit, EPA's fiscal 1996 budget had not been approved, resulting in a limited travel budget. We decided that a review of the accuracy of EPAYS within headquarters would just as readily assist the Agency as would a review of selected regional offices. To accomplish our objectives, we: • Interviewed selected OHROS program office team directors and Washington Financial Management Center (WFMQ staff; • Selected and reviewed a sample of OPFs of headquarters employees; ------- Report of the Accuracy of EPA't Personnel and Payroll System (EPAYS) E1AMF6-11-OOOS-6100275 • Obtained and reviewed computer printouts (profile), contract delivery orders, administrative guidance and procedures, and management control summaries conducted. Our audit did not include reviews of information contained in regional personnel offices. FMFIA Review Internal Controls Prior Audit Coverage The fieldwork performed included tests of only those management controls and procedures specifically related to the audit objectives. The audit included tests of management and related Federal Manager's Financial Integrity Act (FMFIA) controls, policies, and procedures specifically related to the audit objectives. We reviewed OHROS FMFIA documentation including: assessable unit assurance letters which summarized internal/management control reviews (I/MCRs) and alternate internal/management control reviews (AI/MCRs) from fiscal 1993 to fiscal 1995; and OHROS's event cycle documentation. We reviewed the internal controls associated with the accuracy of key data fields within the EPAYS system and the security of the Official Personnel Folders (OPFs). The controls we evaluated included data entry verification, management information systems, and operation of the OPF Center. The internal control weaknesses noted in our review are discussed in detail in Chapters 2 through 4 of this report. Our recommendations, if implemented, should improve the internal controls in these areas. Based on our review, no other issues came to our attention which we believed were significant enough to warrant expanding the scope of this audit. Although the OIG and GAO have issued audit reports concerning the Agency's information management systems, neither the OIG nor GAO have issued any audit reports concerning the accuracy of EPAYS data, security of OPFs, or any issues involving the Office of Human Resources. ------- Report of the Accuracy of EPA's Personnel and Payroll System (EPAYS) El AMF6-11-0005-6100275 [This page intentionally left blank] ------- Report of the Accuracy of EPA's Personnel and Payroll System (EPAYS) El AMF6-11-0005-6100275 CHAPTER 2 OHROS EFFORT IMPROVES ACCURACY OF PERSONNEL INFORMATION MAINTAINED IN EPAYS, BUT MANAGEMENT CONTROLS ARE NEEDED TO MAINTAIN ACCURACY OHROS, since September 1995 and its reorganization on October 1, has been expending a considerable amount of time reviewing and cleaning up the Official Personnel files (OPFs) and in making corrections to the personnel information contained in EPAYS. We found that between November 27, 1995 and January 31,1996, the OHROS review had reduced the number of EPAYS personnel information inaccuracies we identified in our sample from 58 out of 379 (15.3%) to 20 out of 379 (5.3%). OHROS staff continued reviewing OPFs and entering information beyond our computer report date of January 31, 1996. We were told by an Agency official, that before a reduction-in-force would be fully executed, each employees' OPF will be checked three times for accuracy, along with a check by the employee. However, we noted that OHROS apparently viewed the accuracy of EPAYS and the currency of the OPFs as a low priority. Although OHROS had conducted at least two reorganizations devoted to improving customer service and improving the filing of OPFs, it was not until EPA was faced with a potential RIF that OHROS begin a comprehensive review of the OPFs and of the accuracy of the EPAYS information. We found that OHROS had not identified the accuracy or reliability of EPAYS personnel information in any of its FMFIA documentation, had not planned or conducted any quality assurance reviews of the EPAYS system, and had not assigned responsibility for system accuracy in any of its position descriptions for Personnel Management Specialists. We were told by OHROS officials, that the developing and executing of new procedures would hot take place until the potential RIF concerns are eliminated. BACKGROUND As a result of the lack of management control reviews and a potential reduction-in-force caused by a reported $2.5 billion (34%) cut by the House of Representatives to the Agency's fiscal 1996 budget, the Agency, in order to prepare for a potential RIF, expended at least $55,300 in overtime costs and countless hours during the regular business day in staff time updating OPF information in EPAYS, correcting errors and omissions, and updating missing information in the official personnel folders. The information contained in EPAYS will be used to generate the ------- Report of the Accuracy of EPA's Personnel mid Payroll System (EPAYS) El AMF6-11-0005-6100275 Management Control Reviews of the Accuracy ofEPAYS Personnel Information and the Official Personnel Files Not Conducted retention register, which prioritizes EPA staff based on competitive level, tenure of employment, veteran's preference, service computation date, and performance appraisal ratings. We believe that as a result of the inaccuracies identified in the EPAYS personnel fields, the Agency would be unable to quickly and accurately prioritize EPA staff on the retention register. However, during discussions with OHROS personnel, we were told that the RIF procedure also requires that all employees on the retention register would have an additional opportunity to review their personnel information to verify its accuracy. Also, as employees left for new employment or retired, new retention registers would be compiled. In accordance with the Integrity Act and OMB Circular A-123, each executive agency must annually evaluate its system of internal accounting and administrative controls and .report to Congress and the President on whether its internal control systems comply with the goals of the Act. If systems do not comply, the agency head must identify material weaknesses and present plans for corrective action. EPA Resources Management Directive 2560 (Internal Control), section 5 states: All EPA organizations shall develop and maintain effective systems of internal control over their program operations and administrative functions. Also, section 4(h) states that all EPA managers are responsible for operating effective and efficient systems of internal control. They must also evaluate the control system periodically and take timely corrective actions on all identified weaknesses. We reviewed the fiscal 1993 Office of Human Resources and Management (OHRM) event cycle documentation and related annual management control summaries conducted between fiscal 1993 and 1995. We found that OHRM had not identified, as an event cycle, reviews of the OPFs and accuracy of personnel information contained in EPAYS. We also noted that OHRM had not conducted any reviews to validate and ensure the accuracy of the data in EPA's Personnel and Payroll System compared with the information contained within the Official Personnel Files. It appears that OHROS considered the accuracy of EPAYS personnel information to be a low priority. This is based on the lack of not identifying the accuracy of EPAYS personnel information, as a potential risk in FMFIA documentation. 8 ------- Report of the Accuracy of EPA'i Personnel and Payroll System (EPAYS) El AMF6-11-0005-6100275 OHROS Needs to Implement a Written Policy on Performance Ratings Data Entry Verification OMB Circular A-123 Revised, dated August 4, 1986, prescribes policies and procedures to be followed by executive departments and agencies in establishing, maintaining, evaluating, improving, and reporting on internal controls in their program and administrative activities. OMB Circular A-123 Revised, dated June 21, 1995, updated the 1986 circular,'and defined management controls as the organization, policies, and procedures used to reasonably ensure that (1) programs achieve their intended results; (2) resources are used consistent with agency missions; (3) programs and resources are protected from waste, fraud, and mismanagement; (4) laws and regulations are followed; and (5) reliable and timely information is obtained, maintained, reported and used for decision making. Agencies and individual federal managers must take systematic and proactive measures to (1) develop and implement appropriate, costreffective management controls for results- oriented management; (2) assess the adequacy of management controls in federal programs and operations; (3) identify needed improvements; (4) take corresponding corrective action; and (5) report annually on management controls. We were told by several of the Personnel Management Specialists that employee performance ratings were processed as follows. Program Offices submit Personal Appraisals by December 31. A certification form, containing a list of individuals within the program office, is included with the performance appraisals. The certification form is a listing of the employees in the program office and includes their performance ratings. Performance ratings listed on the certification are compared against the actual performance appraisal for accuracy. The certification is then given to a staff assistant for data entry into EPAYS of individual performance ratings. The certification along with the edit report received the next day are returned to the personnel specialist for verification of correct and accurate data entry. However, we were told that there was no requirement to retain the certification. Then the performance appraisals are given to the file room contractor who places the appraisals into the individual's official personnel folder. t We requested a copy of the policy, but were told it was not in writing. A written policy provides criteria which can be used in conducting management control reviews and in measuring performance during performance appraisal time. We were able to review a 1994 certification form retained by one personnel management specialist, and found that 5 out of 148 employees ------- Report of tho Accuracy of EPA's Personnel and Payroll System (EPAYS) El AMF6-11-0005-6100275 (3.4%) identified did not have their performance ratings entered into EPAYS. To establish milestone dates for the timeliness of data entry, we reviewed two memorandums issued by the Director of the Policy and Research Division. Pursuant to the memorandums, performance ratings for 1993 and 1994 should have been entered by January 31 of the following calendar year. In addition, several OHROS Personnel Management staff told us that it was not their responsibility to verify data entry. Our review of 379 OPFs identified 58 individuals (15.3%) who had performance appraisals in their official personnel folders, but those ratings (for fiscal years 1992 through 1994) were not in EPAYS as of a November 27, 1995 computer report. There was a total of 75 missing ratings in EPAYS for the 58 individuals as identified in the chart below. We requested a second EPAYS profile report for January 31, 1996. We noted that OHROS had corrected 36 of the 75 (48%) missing ratings. Based on the January report, OHROS reduced the number of individuals missing information from 58 to 20 out of 379 or 5.3%. Fiscal Years 1992 1993 1994 Total Performance Ratings Missing As of 11/27/95 ' 15 22 38 75 Performance Ratings Missing As of 1/31/96 10 11 17' 38 Performance Ratings Corrected 5 11 20 36 OHROS Aware of need for corrections On September 18, 1995, OHROS sent a memorandum to all Headquarters' employees requesting that they review the attached personnel data profile. OHROS created the profile based on the information in the Agency's automated personnel system (EPAYS) and in employees' official personnel files. Employees were requested to examine all the data elements on the profile and make any corrections necessary, complete the certification at the bottom of the profile page and return the profile sheet (along with any supporting documentation to prove changes to be made) by September 29, 1995. One individual who was listed on the November 27, 1995 EPAYS Report was not listed on the January 31, 1996 Report. 10 ------- Report of the Accuracy of EPA's Personnel and Payroll System (EPAYS) El AMF6-11-0005-6100275 Although OHROS has significantly reduced the number of inaccuracies, improvements to its management controls over the verification of data entry are still needed to ensure future accuracy. Computer reports are available which could assist OHROS in identifying potential missing, inaccurate, or incomplete personnel information. We are concerned that even though OHROS has conducted a massive effort to review all headquarters OPFs, little attention has been paid to data entry of information supplied by headquarters personnel. Delaying data entry increases the risk that information will not be entered into EPAYS, resulting in inaccurate employee personnel file information. We were told that the development of management controls would not be considered until all the reviews had been completed and the system was determined to be accurate. OFF reviews had started in late September 1995 and were continuing through March 1996. Inaccuracies identified during our field work (November - March) were brought to the attention of the OHROS staff, but controls were still not initiated. We believe that the instituting of at least controls over the verification and timely data entry of performance ratings received would reduce the amount of time devoted to reviewing OPFs again to verify the accuracy of EPAYS personnel information. OHROS provided a description of the process to be used when conducting a reduction-in-force (see Appendix II). Although the procedure identified will assure that no employee is RIFed without a thorough review, inaccurate information increases employee concerns and the cost and amount of time needed to correct the information and potentially generate a new retention register. As a result of not conducting management control reviews, assigning a low priority to ensuring the accuracy of EPAYS information, and not having a written policy concerning the accuracy of data entry, OHROS has had to spend a considerable amount of staff time and more than $55,000 in overtime to review more than 6,000 official personnel folders for headquarters personnel and attempt to improve EPAYS data accuracy. OHROS is depending on these failsafe procedures to catch any inaccuracies, and they do not believe the length of time or cost to attain accuracy is a concern. However, we believe that the process could be ineffective. For example, if an individual was incorrectly placed on the retention register based on 11 ------- Report of the Accuracy of EPA's Personnel and Payroll System (EPAYS) EIAMF6-11.0005-6100275 inaccurate performance rating(s), the individual's OPF may or may not be reviewed by OHROS. OHROS would be reviewing only the QPFs of individuals who had received a RIF notification. OHROS forms Personnel Operations Workgroup RECOMMENDATIONS After we began our audit, we were told that OHROS had formed the "personnel operations workgroup" which has been charged with developing policies and procedures to address the problem areas identified during the OHROS Official Personnel Folder (OPF) review. The Workgroup, formed as a result of the problems found while OHROS was conducting the OPF review, has developed an action plan which identifies responsible individual(s) and determines milestone dates. We were provided a memorandum which described some of the areas the action plan addresses (see appendix IV). Although we received an explanation of the action plan of the workgroup, we have not received a copy of the formal management request to form the workgroup, nor a document which describes the workgroup's mission, goals and objectives. We are, therefore, not sure whether the workgroup has management support for potential recommendations. The effect of the Human Resources Staff not having a formalized policy for processing performance appraisals, along with the lack of data entry verification resulted in inconsistent reviews of the accuracy of performance rating information entered into EPAYS. This has resulted in the inability of EPAYS to provide management with an accurate, reliable, and timely RIF report information during the first half of fiscal 1996. We recommend that the Acting Assistant Administrator for Administration and Resources Management: 1. Require semiannual briefings on the status of the implementation of planned quality assurance activities until a system is in place and effectively functioning. •v, 2. Require the workgroup to generate a computer report, as we did, to identify employees with missing performance rating information in EPAYS. 12 ------- Report of the Accuracy of EPA's Personnel and Payroll System (EPAYS) ElAMF6-11-0005-6100275 AGENCY RESPONSE The agency stated that the Office of Administration and Resources Management (OARM) will require OHROS to establish a system of management controls and quality assurance activities that ensures accuracy of EPAYS data and conduct a briefing on them prior to the beginning of Fiscal 1997. Further, that OHROS has completed a 100 percent review and correction of performance rating information for Fiscal Years 1991 through 1994. The staff is in the process of reviewing and inputting performance ratings for Fiscal 1995 into EPAYS. Newly implemented internal controls will ensure these ratings are accurate in the data base. 13 ------- Report of the Accuracy of EPA's Personnel and Payroll System (EPAYS) El AMF6-11-0005-6100275 [TWs page intentionally left blank] 14 ------- Report of the Accuracy of EPA't Personnel and Payroll System (EPAYS) El AMF6-11-0005-6100275 CHAPTERS CONTROL OVER OFFICIAL PERSONNEL FOLDERS COULD BE IMPROVED Over the five months (November 1, 1995 through March 15, 1996) of our review, the OFF Center staff had difficulty in the timely retrieval of the OPFs for our review. We would receive only a portion of the OPFs requested and had to continually request, through the project officer, OPFs not initially provided. We were aware that the personnel specialists were continually reviewing the OPFs and attempted to work with the project officer so as not to disrupt the OPF review process. We were told repeatedly by the OPF Center staff that numerous folders in our review sample (37 out of 379, or 9.8%) were out with the Personnel Management Specialists; and near the completion of our work, we were told it could take several weeks before we could obtain the folders. Based on our review, we determined that the remaining OPFs would not materially effect our audit objective concerning whether EPAYS provides accurate information for RIF purposes and decided not to continue to wait for the OPFs. However, we observed a situation where a personnel management specialist, who had requested several OPFs, was told by the OPF Center contractor that the specialist already had the requested OPFs signed out to her. The specialist insisted she had returned the folders earlier. Further, during a discussion with one of the Human Resources Team Directors, we were told that the Director also had difficulty in obtaining folders. We were told by one of the OHROS Team Directors, that OPFs could be rotated among the staff who were responsible for the review, which could result in delays in obtaining folders by Agency employees to review their folders and by the OIG auditors in conducting this audit. Although the OPF Center had developed control procedures over the removal and return of OPFs, the inability of die personnel management specialist to, within a reasonable time period, return OPFs causes us some concern over the location of the OPFs within the individual human resources teams. As a result of the ongoing OPF review, the time constraints which OHROS staff was under, and the findings we had already discussed with the staff, we elected not to require OHROS to provide the 37 folders. BACKGROUND Each Human Resources Staff Team is responsible for servicing specific program offices. Within each team several personnel specialists are responsible for reviewing personnel actions and 15 ------- Report of the Accuracy of EPA'8 Personnel and Payroll System (EPAYS) Ei AMF6-1 i-0005-6100275 data entry. During the time of our review, OHROS was conducting a 100 percent review of the OPFs. Their review entailed verifying information contained in the OFF against information contained in various personnel files in EPAYS. If additional information was needed to be obtained and placed in the individual's OFF, the personnel management specialist would contact the particular individual. Folders would then sometimes be held by the personnel management specialist until the information requested from the individual was received and then placed in the OFF. We observed several personnel management specialists obtaining numerous OPFs from OFF Central files for this and other purposes. The Office of Human Resources Management and Organizational Services (OHROS) is responsible for the management and control of all Official Personnel Files (OFF) for EPA employees serviced by the Headquarters' Human Resources Staff. OPFs are the official repository of the records, reports of personnel actions, and the documents and papers required concerning these actions effected during an employee's Federal service. These records provide the basic source of data about a person's Federal employment while in the service and after separation. OHROS has custodial responsibilities for OPFs and is responsible for ensuring that they maintain them according to the Office of Personnel Management (OPM) and EPA regulations and policies. These responsibilities include: • Establishing personnel folders and ensuring that documents are filed appropriately and in order. • Filing and refiling documents into OPFs following guidelines established by EPA and OPM. • Updating labels on OPFs following standards established by EPA. • Providing only authorized Agency staff access to the OPFs. • Completing request to review, copy, charge out/in folders to authorized personnel. • Retiring or transferring OPFs when an employee separates. 16 ------- Report of the Accuracy of EPA's Personnel and Payroll System (EPAYS) El AMF6-11-0005-6100275 OPM Delegation CONCLUSION On September 6, 1995, the Procurement Operations Branch issued a delivery order against an existing contract to provide records management support staff so that the demands for increased service can be met and the timeliness of those services can be improved, that employees can be assured that documents are filed in their folder in a timely and accurate manner, and that authorized personnel can charge out/in personnel folders in an efficient and timely manner. The Office of Personnel Management owns the personnel folders and their contents. 0PM has delegated to the agencies the authority to maintain these personnel folders. The OPF is a file containing records and documents related to civilian employment under title 5 of the U.S. Code. Agency staff have various uses for OPFs including screening qualifications, eligibility, and employee's rights and benefits under pertinent laws and regulations governing Federal employment computing length of service, and other information needed to provide a full range of human resources services. These records may be used for personnel research and individual employees may also review their OPFs. Therefore, the potential for OPFs to be misplaced, misfiled, or lost is a cause for concern. While we understand that the personnel management specialists were conducting an intensive review and attempting to complete the review by December 1st, we are concerned about the security and possible misplacement of OPFs. By holding OPFs until the full review, and any requested information, has been received, there is ah increased risk that an OPF may be misplaced and require additional time to locate when requested by the OPF Center. RECOMMENDATION AGENCY COMMENTS We recommend that the Acting Assistant Administrator for Administration and Resources Management request that the OHROS Team Directors work with their staff to ensure that folders being reviewed for completeness and accuracy be returned to the OPF Center as timely as possible. The Agency stated that OHROS Human Resources Staff Directors recognize the importance of returning OPFs to the Center as soon as possible and have stressed this with their staffs. Additionally, OHROS is initiating a bar-code tracking system for OPFs that will notify personnel management specialists who have 17 ------- Report of the Accuracy of EPA'a Personnel mid Payroll System (EPAYS) El AMF6-114)005-6100275 exceeded their allotted time for retaining OPFs. Human Resources Staff Directors will be provided the same information to ensure the files are returned to the Center in a timely manner. This system will be in place by the end of September 1996. 18 ------- Report of the Accuracy of EPA't Personnel and Payroll System (EPA YS) CHAPTER4 El AMF6-11-0005-6100275 EPAYS SYSTEM SECURITY COULD BE COMPROMISED Lack of System Security We identified that 52.6% (41 out of 78) personnel management specialists have a supervisory data entry capability. This capability permits the user to enter and modify information contained in the personnel data base. We asked about whether these specialists could access their own files and make changes to those files. The previous acting Chief of the Systems Support Staff, said that he knew of no protocol in TAPP/EPAYS which would prevent an employee with system access from entering personnel, payroll, or time and attendance (T&A) actions on themselves. We also requested the same information from the Chief of the Client Support Branch of OARM's Enterprise Systems Division, with the same result. An individual with the ability to modify their own files could result in the individual making changes to specific data fields giving them a competitive advantage during a RIF. This ability is also a weakness in system controls. We did not identify data entry activity which would have caused additional audit fieldwork, but the potential for unauthorized activity requires that a protocol be developed which would prohibit an individual's access to their own personnel, payroll or time and attendance files. We did not review the activities of the personnel specialists in the regional offices; however, we understand that they have the capability of entering both payroll and personnel information. BACKGROUND OMB Circular No. A-130, Transmittal 3, dated February 8, 1996, requires that agencies implement and maintain a computer systems security program, including the preparation of policies, standards, and procedures. The circular also implies that agencies: Establish a management control process to assure that appropriate administrative, physical, and technical safeguards are incorporated into all new applications, and into significant modifications to existing applications. 19 ------- Report of the Accuracy of EPA'» Personnel MM! Payroll System (EPA YS> El AMF6-11-0005-6100275 Conduct periodic audits or reviews of sensitive applications and recertify the adequacy of security safeguards. Establish and manage personnel security policies and procedures to assure an adequate level of security for Federal automated'information systems. Such policies and procedures shall include requirements for screening all individuals participating in the design, development, operation, or maintenance of sensitive applications as well as those having access to sensitive data. RECOMMENDATION We recommend that the Acting Assistant Administrator for Administration and Resources Management require that an automated control be added to EPAYS to prevent an individual from accessing their own file and making changes to that file. AGENCY COMMENTS OHROS will work with the Office of Information Resources Management (OIRM) to explore the feasibility of incorporating . such a control into the EPAYS system. The analysis will be completed by the end of September 1996. 20 ------- Report of the Accuracy of EPA'» Personnel and Payroll System CEP AYS) E1AMF6-11-0005-6100275 Appendix I Page 1 of 1 ACRONYMS ASD ADMINISTRATIVE SYSTEMS DIVISION ASSB APPLICATIONS SOFTWARE BRANCH DOPS DEPARTMENTAL INTEGRATED PERSONAL SERVICES SYSTEM EOD ENTRY ON DUTY EPA ENVIRONMENTAL PROTECTION AGENCY EPAYS EPA'S PAYROLL AND PERSONNEL SYSTEM FMFIA FEDERAL MANAGER'S FINANCIAL INTEGRITY ACT I/MCR INTERNAL/MANAGEMENT CONTROL REVIEWS MCP MANAGEMENT CONTROL PLANS OAR OFFICE OF AIR AND RADIATION OARM OFFICE OF ADMINISTRATION AND RESOURCES MANAGEMENT OECA OFFICE OF ENFORCEMENT AND COMPLIANCE ASSURANCE OGC OFFICE OF GENERAL COUNSEL OHRM OFFICE OF HUMAN RESOURCES MANAGEMENT OHROS OFFICE OF HUMAN RESOURCES MANAGEMENT AND ORGANIZATIONAL SERVICES OIA OFFICE OF INTERNATIONAL ACTIVITIES OIG OFFICE OF INSPECTOR GENERAL OIRM OFFICE OF INFORMATION RESOURCES MANAGEMENT OPF OFFICIAL PERSONNEL FILES OPFC OFFICIAL PERSONNEL FOLDERS CENTER OPM OFFICE OF PERSONNEL MANAGEMENT OPPE OFFICE POLICY, PLANNING AND EVALUATION OPPTS OFFICE OF PREVENTION, PESTICIDES, AND TOXIC SUBSTANCES ORD OFFICE OF RESEARCH DEVELOPMENT OSWER OFFICE OF SOLID WASTE AND EMERGENCY RESPONSE OW OFFICE OF WATER RIF REDUCTION-IN-FORCE RTP RESEARCH TRIANGLE PARK, NORTH CAROLINA T&A TIME AND ATTENDANCE TAP? TIME AND ATTENDANCE PAYROLL WFMC WASHINGTON FINANCIAL MANAGEMENT CENTER 21 ------- Report of the Accuracy of EPA'g Personnel and Payroll System (EPAYS) El AMF6-11-0005-6100275 Appendix n . Page 1 of 2 OVERVIEW OF A REDUCTION-IN-FORCE OHROS provided the following as the process used to conduct a Reduction-in-Force: Set the ground rules for the RIF (use of vacancies, cut-off date for performance ratings, waivers, etc.). Review-recheck-have ready references available (current RIF regulations, pay setting guides, severance pay formula, representative rate charts, pay tables, etc.) Establish-review-rccheck competitive level definitions to be sure they are complete and correct. Establish the effective date of the RIF. Verify that each employee is in the correct competitive level. Have OPF's for affected orgamzation(s) available and complete a review of pertinent RIF- related information (correctness of employees title, series, grade, service computation date, retention sub-group, last three performance ratings, positions held, experience, training, etc.). Encourage/provide for employees review of "personal" information that is used in the RIF process (service computation date, performance ratings, experience on record review of all information in their OFF). Review employee job descriptions for accuracy. Prepare retention registers for the organizations^) affected. Review and recheck the information. Identify positions to be abolished and identify affected employees. Review qualifications of affected employees. 22 ------- Report of the Accuracy of EPA't Personnel and Payroll System (EPAYS) El AMF6-11-0005-6100275 Appendix H Page 2 of 2 In using an automated RIF processing system, input necessary information. Generate reports, review and correct data elements as necessary. AutoRIF is an automated RIF processing application that EPA will be using. It uses data from EPAYS and information input from the OPF to assist the human resources office (HRO) in processing RIF actions. AutoRIF assists the HRO to keep track of employees affected by the RIF, the actions taken, qualification determinations made etc. AutoRIF processes the RIF, develops retention registers, processes employee's bump and retreat lights, and generates RIF letters. AutoRIF processes the additional iterations that may be necessary in conducting the RIF based on employees resigning, retiring during the course of the RIF. The RIF is re-run and new offers are made to employees as other employees decline RIF offers, resign from the Agency, retire, etc. Check and re-check the automated decisions made through AutoRIF, Re-check displaced employees data and qualifications for placement. Issue RIF notices to employees. Explain RIF decisions to employees. Issue updated RIF notices to employees as a result of additional iterations of the RIF process (based on employees resigning, retiring, declining RIF offers). Provide counseling to interested employees (career, out placement, retirement, etc.) Provide out placement and job referral services. Address appeals. 23 ------- Report of the Accuracy of EPA's Personnel and Payroll System (EPA YS) El AMF6-11-0005-6100275 Appendix in Page 1 of 2 METHODOLOGY To determine our sample size of OPFs to review, based on the objectives of our review and the impact of a potential RIP on the Agency, we wanted a high confidence level in which to assure ourselves of the accuracy of the information to be used in conducting the RIF. We, therefore, selected our sample size by using a 95 percent confidence level and a maximum error rate of 5 percent. This resulted in a sample of 363 OPFs based on 6,306 individuals. The 6,306 universe of individuals was determined by reviewing a computer listing of headquarters employees serviced by OHROS as of October 14, 1995. We initially selected every 15th name on the listing for our OPF review. In addition, we also reviewed a November 27, 1995 computer report and identified 910 headquarters employees who were missing either one or more performance ratings (indicated by an "x" in the year missing a rating), and who had been at EPA since the 1991 rating period. From the November 27th list, we judgementally selected an additional 53 headquarters employees for our review. We anticipated using the OPF sample to project the results of the testing to the universe as a whole. However, as we were requesting the project officer to have the contractor pull our selected OPFs, we were told that the OIG's Financial Audit Division (FAD) had already started to pull OPFs as part of their Chief Financial Officers (CFO) Audit. We were asked by the project officer if we could use the OPFs being pulled for FAD as part of our sample, which would help OHROS by reducing the amount of time needed to search for and pull some of our requested OPFs. In order to work cooperatively with OHROS and use OPFs already obtained for another OIG audit, we agreed to review 64 of the OPFs selected by FAD as part of our OPF sample. FAD's OPF sample selection technique was based on dollar-unit sampling which is a form of variable sampling. Our initial sampling method was based on attribute sampling. By combining these two methods of sampling, we are unable to statistically project our testing on the universe as a whole. Considering the enormous pressure OHROS was under to ready EPAYS for a RIF and our desire to work cooperatively with them, we believe this 24 ------- Report of the Accuracy of EPA'i Personnel and Payroll System (HPAYS) El AMF6-11-0005-6100275 Appendix III Page 2 of 2 modification to sampling methodology was justified. The results of our sample are representative of the accuracy of EPAYS, though they are not statistically projectable. We analyzed each OPF to determine if the information contained in the file was entered into EPAYS. Our universe is shown below in table 1. ^S:-S-SS;--<>i|^*':^-.. ;5S:';- :'• 11 by Program Office •^•-- • ' IKr. ' :: ; . Table 1 " :""" AAShip 100- Administration 210 - OPPE 220 - OECA 230 - OGC 240 - OIG 260 - OIA 300 - OARM 400 -OW 500 - OSWER 600 - Air Radiation 700 - OPPTS 800 - ORD Total Universe 750 301 600 180 179 67 956 557 632 500 1,295 289 6,306 25 ------- P«*»onnel «nd P^U System REPAYS) El AMF6-11-0005 4100275 Appendix IV Page 1 of 2 APR I 9 1996 MEMORANDUM SUBJECT: OIG Review — Accuracy of EPAYS Payroll and Personnel System Data Dave Boyce During your discussion with Daiva Balkus and the Human Resources Staff Directors regarding your review of the accuracy of EPAYS oavroll and personnel system data, we agreed to forward you"'additional ififoritiation "regaTratiTg th"e~ CHfcOS Personnel Operations Workgroup. « The following information is submitted: o The Personnel Operations Workgroup, comprised of senior level personnel specialists from each Human Resources Staff, was formed to analyze personnel data issues identified during the OHROS-initiated review of Official Personnel Folders (OPFs) and to determine a strategy to resolve these issues, it was recognized that OHROS needed to institute a comprehensive, systemic approach to assuring personnel data quality. The Workgroup developed an action plan which identified responsible individual(s) and determined milestone dates. Currently, th« action plan is being implemented. o The action plan addresses the following areas: 1. Guidance/Tools Assure all Staff members have up-to-date guidance and tools. Provide general overview and specific in-house training sessions regarding the guidance and tools. Implement LAN based support systems for guidance and tools to facilitate Staff member use, i.e., competitive level definitions and 'codes and service computation date calculation software. 26 ------- Report of the Accuracy of EPA'a Personnel and Payroll System (EPAYS) _ El AMF6-1 1-0005-6100275 Appendix IV -2- Page 2 of 2 2. Quality Review/Control Conduct test of a Coding Guide for Personnel Actions used by Team Vegas to determine applicability to Human Resources Staff functions Ensure the accuracy of data and that OPFs remain current by conducting random samplings of OPFs and internal reviews of TAPP/EPAYS data input. Require a second-level review on all personnel actions being processed and a signature by an authorized Staff member on all SF~50s. Develop written standard operating -procedures (SOPs) for the operations handled by the Human Resources Staffs, including retention of performance rating and award certification reports. 3. Long-Term System Controls — Work with the Office of Information Resources Management (OIRM) to improve the personnel action edit process and the. print quality for SF-50s. — Develop formal systems for improvement of internal controls, e.g., annual sampling of OFF data and evaluations of specific personnel processes and personnel action processing, Engage in streamlining and process improvement aUtoaation of Personnel systems, Should you have any questions, please call me on 260-2012. 27 ------- Report of tho Accuracy of EPA'* Personnel and Payroll System (EPAYS) El AMF6-11-0005-6100275 Appendix V UNITED STATES ENVIRONMENTAL PROTECTION AGENCY page j Qf 3 WASHINGTON, D.C. 20460 JUL 24(996 OFFICE OF ADMINISTRATION AND RESOURCES MANAGEMENT MEMORANDUM SUBJECT: FROM: TO: DjtfrVReport aCChfe^ccuracy^of EPA's PS y$tot> sachowitz Acting Assistant Administrator Michael D. Simmons Deputy Assistant Inspector General For Internal and Performance Audits (2421) Personnel System (EPAYS) This is in response to your draft audit report regarding the accuracy of EPA's Payroll and Personnel System (EPAYS\ The Office of Administration and Resources Management (OARM) agrees with your principal f ndings, and we have every intention of forcefully dealing with your recommendations. In fact, he Office of Human Resources and Organizational Services (OHROS) has gone beyond your recommendations to ensure the accuracy of EPAYS data. Specifically, the following corrective actions have been taken or planned based on the report's recommendations: 1. Require semiannual briefings on the status of the implementation of planned quality assurance activities until a system is in place and effectively functioning. Planned Corrective Action: OARM will require OHROS to establish a system of management controls and quality assurance activities that ensures accuracy of EPAYS data and conduct a briefing on them prior to the beginning of Fiscal 1997. 2. Require the workgroup to generate a computer report, as the OIG did, to identify employees with missing performance rating information in EPAYS. Corrective Action: OHROS has completed a 100 percent review and correction of performance rating information for Fiscal Years 1991 through 1994. The staff is in the process of reviewing and inputting performance ratings for Fiscal 1995 into EPAYS. Newly implemented intenal controls, as described below, will ensure these ratings are accurate in the data base. 28 ------- Report of the Accuracy of EPA's Personnel and Payroll System (EPAYS) El AMF6-1 l-OOOS-6100275 Appendix V Page 2 of 3 -2- 3. Request that the OHROS Team Directors work with their staff to ensure that folders being reviewed for completeness and accuracy be returned to the OFF Center as timely as possible. Corrective Action: The OHROS Human Resources Staff Directors recognize the importance of returning OPFs to the Center as soon as possible and have stressed this with their staffs. Additionally, OHROS is initiating a bar-code tracking system for OPFs that will notify personnel management specialists who have exceeded their allotted time for retaining OPFs. Human Resources Staff Directors will be provided the same information to ensure the files are returned to the Center in a timely manner. This system will be in place by the end of September 1996. 4. Require that an automated control be added to EPAYS to prevent an individual from accessing their own file and making changes to that file. Planned Corrective Action: OHROS will work with the Office of Information Resources Management (OIRM) to. explore the feasibility of incorporating such a control into the EPAYS system. The analysis will be completed by the end of September 1996 ' In addition to our responses to your helpful recommendations, OHROS has gone well beyond them to ensure the accuracy of EPAYS data: -In February 1996 OHROS issued an updated profile to all Headquarters employees asking them to again review the accuracy of their personal data elements. OHROS addressed all employees' remaining concerns regarding this information. -OHROS has implemented an effective Standing Operating Procedure (SOP) that requires a second-level review of all personnel transactions prior to inputting into EPAYS. To ensure accountability, personnel management specialists are signing their SF-50s, Notification of Personnel Action. -Fiscal 1995 Performance Ratings are being 100% inventoried, checked for accuracy, input into EPAYS, and re-checked prior to filing. -Competitive Levels have been established and assigned for all Headquarters employees. We have implemented an internal control system that requires prior approval •of the Competitive Level Committee of any new competitive level. -Standard Operating Procedures will be developed by the end of September 1996 to ensure consistency and compliance with appropriate regulations. 29 . ------- Report of the Accuracy of EPA'a Personnel and Payroll System (EPAYS) El AMF6-11-0005-6100275 Appendix V Page 3 of 3 .3- Again, we are pleased to have an outside evaluation of the accuracy of EPAYS data. We are well aware of the seriousness of this information and its effect on the careers of EPA employees. OHROS is putting forth a considerable amount of effort to ensure the accuracy of the data, and I have complete confidence they will be successful. Should you have any questions about this response, please contact David J. O'Connor, Director, Office of Human Resources and Organizational Services, at 260-4467, 30 ------- Report of the Accuracy of EPA'» Personnel and Payroll System (EPAYS) _ El AMF6-1 1-0005-6100275 Appendix VI Page 1 of 1 IWSTRfRf mON Office of Inspector General Inspector General (2410) Deputy Inspector General (2410) Headquarters Office Acting Assistant Administrator for Administration and Resources Management (3101) Director, Office of Human Resources and Organizational Services (3610) Agency Follow-up Coordinator, Office of Administration and Resources Management, Attn: Director, Program and Policy Coordinator Office (3 1 02) Headquarters Library (3304) Regional Offices Regional Administrator, Region 1 Regional Administrator, Region 2 Regional Administrator, Region 3 Regional Administrator, Region 4 Regional Administrator, Region 5 Regional Administrator, Region 6 Regional Administrator, Region 7 Regional Administrator, Region 8 Regional Administrator, Region 9 Regional Administrator, Region 10 31 ------- ------- |