Audit of Overtime

Final Report

Audit Operations Division
Office of the Chief Audit Executive

May 2013

List of Acronyms

Executive Summary

In accordance with the approved Risk-Based Audit Plan for 2012–2013 to 2014–2015, the Office of the Chief Audit Executive at the Canadian International Development Agency (CIDA) conducted an audit of overtime. The objectives of this audit were to:

• assess CIDA's overtime management control and governance framework against Financial Administration Act (FAA) requirements and Treasury Board (TB) policies, and to assess whether they were applied consistently; and
• identify and document the underlying sources/patterns for paid overtime in the Agency.

 In 2008, Human Resources Branch (HRB) developed CIDA's Overtime Guidelines, establishing a standard approach for the management of overtime. The guidelines also refer CIDA employees to their respective collective agreements and TB's Policy on Terms and Conditions of Employment. Among other requirements, the guidelines specify compliance with a written pre-approval process, the FAA, and established procedures for processing payment requests.

Between 2009–2010 and 2011–2012, the average number of overtime hours claimed at CIDA was 74,650 hours per year, with an average payment (excluding overtime compensated with time in lieu) of $3.1 million per year. The total number of overtime hours decreased by 28 percent over the three-year period, while payments (excluding overtime compensated with time in lieu) decreased by 30 percent in the same period. Data analysis showed that the main reason for the decrease in total overtime was CIDA's reduced role in Afghanistan.

We found that guidelines around the management of overtime exists at CIDA and are understood by employees. In addition, we determined that CIDA's Overtime Guidelines are aligned with FAA requirements and relevant TB policies.

Overtime at CIDA is required to be pre-approved in writing, prior to having incurred the overtime, by the appropriate delegate, and to be approved by an individual with the delegated authority for section 34 of the FAA. We found that these requirements are not complied with consistently.

Overtime payments are not always processed in accordance with relevant TB policies, and although the Compensation and Benefits Division of HRB verifies that overtime claimed has been approved prior to processing payments, they do not conduct any monitoring to ensure that the approvers have the appropriate delegated authority under section 34.

Audit Conclusion

Although CIDA's Overtime Guidelines are aligned with the requirements of the FAA and relevant TB policies, inconsistencies were found in their application. As a result of these inconsistencies, the audit concludes that the management control framework was not operating effectively over the period under examination. This report contains recommendations, which, if implemented, will improve the management control framework for overtime.

Statement of Assurance

In my professional judgment as Chief Audit Executive, this audit was conducted in conformance with the Institute of Internal Auditors' International Standards for Professional Practice of Internal Auditing and with the Internal Auditing Standards for the Government of Canada, as supported by the results of the quality assurance and improvement program. Sufficient and appropriate audit procedures were conducted and evidence was gathered to support the accuracy of the findings and conclusion in this report, and to provide an audit level of assurance. The findings and conclusion are based on a comparison of the conditions, as they existed at the time against pre-established audit criteria that were agreed upon with management, and are only applicable to the entity examined, and for the scope and time period covered by the audit.

Jean Goulet
Chief Audit Executive

1.0 Background

An internal audit of overtime was included in Agency's 2012–2013 to 2014–2015 Risk-Based Audit Plan, as recommended by the Audit Committee and approved by the President on March 16, 2012.

Overtime at CIDA is governed by CIDA's Overtime Guidelines, the FAA, TB collective agreements, and terms and conditions of employment. Overtime is defined as "authorized time worked by a person in excess of the standard daily or weekly hours of work and for which the person may be entitled to compensation pursuant to the provisions of the relevant collective agreement or terms and conditions of employment"^{Footnote 1}.

Overtime worked is to be compensated in accordance with the relevant collective agreement or terms and conditions of employment. As per the TB Directive on Terms and Conditions of Employment, employees are entitled to overtime compensation when they are asked to incur overtime by an individual with the appropriate delegated authority. The expected number of overtime hours is required to be specified and authorized prior to working the overtime hours.

SAP is the departmental system that is used by employees and managers to request, approve, and record claims for overtime compensation. HRB oversees the administration of the overtime process and maintains the Human Resource component of the SAP system. The Regional Pay System is the Public Works and Government Services Canada system interface used by CIDA to pay out overtime compensation.

Over the three-year period 2009–2010 to 2011–2012, 1,501 employees requested overtime, resulting in 74,650 hours of claimed overtime with an average payment of $3.1 million per year (excluding time compensated as time in lieu). The average percentage of overtime paid, in the three-year period 2009–2010 to 2011–2012, is 12.5 percent of an employee's salary for those employees who claimed overtime (excluding time compensated as time in lieu).

2.0 Audit Objective, Scope, Approach and Criteria

2.1 Objective

The objectives of this audit were to:

• assess CIDA's overtime management control and governance framework against FAA requirements and TB policies, and to assess whether they were applied consistently; and
• identify and document the underlying sources/patterns for paid overtime in the Agency.

2.2 Scope

The scope of the audit included assessing CIDA's compliance with Agency overtime guidelines, policies, and collective agreements, as well as assessing CIDA's overtime management frameworks and guidelines against relevant legislation. The scope also included indentifying the source and nature of paid overtime hours. While the audit included the review of overtime in all branches, areas of focus included branches that have incurred the largest number of overtime hours during the three-year period 2009–2010 to 2011–2012. Based on data obtained in the planning phase, the top three branches by number of hours of paid overtime are:

• Geographic Programs Branch
• Chief Financial Officer Branch
• Multilateral and Global Programs Branch

The following areas are specifically excluded from the scope of this audit:

• The integrity or accuracy of data generated from CIDA's SAP system.
• Information Technology General Controls (ITGC) related to systems, as these controls would typically be included in the scope of an IT audit. Controls identified in this audit which are system based must be considered in conjunction with ITGC assessments, which are outside of the scope of this audit, when evaluating the ability to rely on their effectiveness.
• Overtime hours compensated as time in lieu.
• Overtime hours incurred but not claimed (paid or time in lieu), and/or overtime hours incurred and informally taken in lieu but not reported.

In identifying the population of overtime claimed, the audit relied on reports generated from SAP. Although the integrity, completeness, and accuracy of this data was outside the scope of the audit, we noted issues with the completeness of SAP reporting, which are discussed in section 3.3 of this report.

2.3 Approach and Methodology

The audit of overtime was conducted in accordance with TB policy, directives, and standards on internal audit, and conforms to the International Standards for the Professional Practice of Internal Auditing of the Institute of Internal Auditors. The audit's scope and testing protocols were determined based on an analysis of risk, and the audit methodology consisted of:

• reviewing the FAA and relevant TB policies, including the Directive on Financial Management of Pay, Directive on Terms and Conditions of Employment and applicable TB collective agreements, and applicable CIDA guidelines;
• conducting interviews with officials from key branches;
• analyzing financial and non-financial data of overtime;
• Sending a questionnaire to a random sample of CIDA employees; and
• reviewing a sample of files of overtime transactions selected randomly from a population of all overtime hours claimed.

The audit team validated key findings with HRB and Chief Financial Officer Branch on the results of the audit prior to finalizing the audit report.

2.4 Audit Criteria

Audit criteria supporting the audit objectives were developed using the results of the risk and internal control assessment and considered Treasury Board Secretariat Core Management Controls. The audit criteria were defined as follows:

• CIDA overtime policies and guidelines, and Treasury Board Secretariat collective agreements are clearly defined and well understood by employees at CIDA.
• Overtime is authorized, recorded, approved, compensated, and monitored in compliance with the FAA and relevant TB policies.

The audit includes a value-added data analysis that identifies underlying sources and patterns for claimed overtime at CIDA (see section 3.3).

3.0 Main Audit Findings and Recommendations

3.1 Overtime Governance Framework

CIDA has developed corporate guidelines for the management of overtime, including CIDA's Overtime Guidelines, Management and Approval Process of Overtime for Employees on Assignment in the Field, Travelling Time and Overtime Worked for an Employee on a Mission, Definitions Related to Overtime, and Questions and Answers on Overtime. These guidelines apply to employees who are eligible for overtime, and document the requirements, processes, and roles and responsibilities for requesting, approving, compensating, and monitoring overtime. Overtime at CIDA must be in compliance with CIDA guidelines, as well as TB policies and collective agreements.

In addition to referring to the appropriate TB legislation, CIDA's Overtime Guidelines are aligned with the FAA, which defines the requirements for those claiming, authorizing, approving, and compensating overtime. An assessment and comparison of CIDA's Overtime Guidelines against the FAA was performed to validate that authorization, recording, approval, compensation, and monitoring requirements are aligned. CIDA's Overtime Guidelines were found to be aligned with the requirements in the FAA regarding section 32, Control of commitments; section 34, Payment for work, goods or services; and section 33, Requisitions.

Interviews with CIDA management, as well as questionnaire results from employees who have approved overtime within the past three years, confirm that policies and guidelines on overtime are clear, easily understood, and easily accessible.

We found that although interviews and questionnaire results indicated overtime guidelines are clear and easily understood, they confirmed that overtime is being taken and compensated informally, contrary to guidelines. The questionnaire revealed that 58 percent of respondents have informally approved overtime between 2009–2010 and 2011–2012. This confirms the results from interviewees, who stated that informal approval of overtime exists at CIDA. Interviewees also stated that informal overtime generally occurs with small numbers of overtime hours; however, since informal overtime is not documented or tracked, the quantification of that volume is not reportable or verifiable.

3.2 Financial Accountability Controls

CIDA is required to adhere to the financial controls specified in the FAA. Relevant to the scope of this audit are sections 32, 33, and 34 of the FAA, as well as the TB's Guideline on Common Financial Management Business Process for Pay Administration,which defines the application of sections 32, 33, and 34 of the FAA in the overtime process.

CIDA's Overtime Guidelines were assessed against FAA requirements, and were found to be appropriately aligned; therefore, reference in this report to the financial requirements as specified in CIDA's Overtime Guidelines covers FAA requirements.

Commitment Control (FAA, section 32)

CIDA's Overtime Guidelines require overtime to be "approved in writing, in advance, by the delegated level of management in accordance with the Table of Human Resource Management Authorities and the Delegation Document of Financial Authorities."^{Footnote 2}

Pre-approving overtime can be documented in various forms such as an email, an internal memorandum, or a travel authorization form. For employees who are in the field without access to SAP, overtime is requested, pre-approved, and approved by the appropriate delegate in the field, by completing a hard-copy overtime form. This overtime form is sent to HRB in order to record the approval of overtime on the manager's behalf in SAP.

In our review of 75 overtime transactions, we found 68 transactions did not have appropriate supporting evidence for written approval prior to incurring overtime as required by CIDA's Overtime Guidelines. This includes 26 transactions from employees in the field and 42 transactions from employees at headquarters.

Questionnaire results indicate that 53 percent of respondents who approved overtime between 2009–2010 to 2011–2012 did not provide written approval in advance of overtime being incurred. These findings are consistent with interviews with management at CIDA, which confirm that when overtime is pre-approved, it is commonly done verbally rather than in writing.

Certification and Verification (FAA, section 34)

CIDA's Overtime Guidelines states that "In accordance with clause 34 of the Financial Administration Act (FAA), the manager confirms that overtime information contained on the Recorded Overtime Reports is accurate and that employees did work the recorded overtime."^{Footnote 3} The guideline requires that branches "submit the monthly Recorded Overtime Reports signed by managers as per clause 34 of the FAA to the Compensation and Benefits Section of the Human Resources Branch," and that the Compensation and Benefits Section "return to the responsible branch all non-compliant requests, particularly where Recorded Overtime Reports are not signed by management as per clause 34 of the FAA, for corrections to be made."^{Footnote 4} We determined that the monthly Recorded Overtime Reports are not being completed, sent or reviewed, as required by the guidelines.

Section 34 of the FAA is currently performed and evidenced through managers' approval of overtime in the SAP system for each individual claim. This was validated through discussion with key stakeholders.

The TB's Directive on Electronic Authentication and Authorization of Financial Transactions states that the "Integrity of electronic financial transactions implies that transactions, and the related electronic authentications and authorizations, are safeguarded against unauthorized access, authority or disclosure, repudiation, destruction, removal, modification, misuse, incompleteness, and inaccuracy. It includes ensuring that the electronic authorization is unique for each individual, that the authorizer can be identified, that authorization integrity is maintained to ensure the accountability and protection of the person assuming responsibility, and in cases where electronic delegation matrices are used, that the integrity of the matrices is also preserved."^{Footnote 5} Based on these requirements, SAP does not currently meet the standards for electronic authentication and authorization of financial transactions.

When employees enter claimed overtime in SAP, it is forwarded for approval to a manager/supervisor based on the reporting hierarchy of the individual. SAP does not identify if that manager/supervisor has the appropriate delegation of authority for section 34. Managers/supervisors who do not have appropriate authority are expected to delegate to someone who does; however, interviews indicated that they are not always aware of this requirement. Therefore, SAP does not currently ensure that transactions are safeguarded against unauthorized authority and that electronic delegation matrices are used. Therefore, approvals provided in the SAP system do not provide sufficient support for the execution of section 34.

Of the 75 overtime transactions reviewed, we identified 14 transactions in which section 34 approval was performed by individuals who did not have the proper delegated authority. In addition, we noted 26 transactions from employees in the field, who do not have access to SAP, where overtime is approved on a hard copy form. These forms are not always retained in the personnel file, and the approver could not always be identified on the form. Therefore, evidence of adherence to section 34 is not available for those employees.

Since SAP does not provide the appropriate controls to ensure overtime claimed is being approved by the appropriate individual with delegated authority for section 34 of the FAA, a compensating control is expected to have been put in place to mitigate the risk of inappropriate approval. Monitoring of compliance with section 34 of the FAA does not currently take place. The Compensation and Benefits Division of HRB validates that approval is provided prior to processing the payment; however, no control is performed to validate that the approver has the required delegated authority for section 34 of the FAA for the salary fund.

Charge against appropriation (FAA, section 33)

Overtime payments are required to be processed in accordance with the TB Directive on Financial Management of Pay Administration, which includes accounting processes, signing authorities, and segregation of duties. The requirements are stated as follows:

• 6.1.3  Verifying that all persons with delegated signing authorities for pay transactions have successfully completed required training and understand the responsibilities associated with the delegated authority
• 6.1.5  Ensuring that the controls relating to all pay administration are identified, understood and applied
• 6.1.6  Ensuring the proper administration of sections 33 and 34 of the Financial Administration Act for all pay administration disbursements
• 6.1.7  Ensuring effective controls (e.g. accuracy, completeness, timeliness, authorization) are in place for all processes and systems that support pay administration^{Footnote 6}

In 2009–2010 and 2010–2011, there was insufficient evidence in 26 of the 75 transactions reviewed to identify the employee performing section 33 approval. This was remedied in 2011–2012, and the employee approving under section 33 was identifiable in each of the transactions reviewed. We found that for 15 of the 49 transactions in which the identity of the individual who approved under section 33 could be determined, section 33 approval was performed by an employee who did not have the appropriate delegated authority.

Based on discussions with HR management, employees with section 33 delegated authority have shared their access codes with employees within the Compensation and Benefits Division of HRB who do not have the delegated authority for section 33. This is normally done to avoid any delays in section 33 approval when employees with delegated authorities are on leave.

Recommendation 1:

The Director General of HRB, in consultation with the Chief Financial Officer (CFO), should ensure that overtime is appropriately authorized, approved, and paid, and that supporting documentation is maintained.

Recommendation 2:

The Director General of HRB should put in place appropriate measures to ensure that access codes to approve section 33 are not shared by employees within the Compensation and Benefits Division of HRB.

3.3 Sources and Patterns of Overtime

To provide CIDA management with the sources and patterns of overtime claimed during the three-year period under audit (2009–2010 to 2011–2012), analysis was performed on SAP-generated data.

Total hours

The total number of overtime hours claimed at CIDA decreased by 28.8 percent from 81,207 hours in 2009–2010 to 57,753 hours in 2011–2012. This is mainly due to the reduced role of CIDA in Afghanistan, which resulted in a decrease of 61 percent from 2010–2011 to 2011–2012 in the number of claimed overtime hours by employees in the former Afghanistan Task Force. (This unit no longer exists: it is now referred to as Europe, Middle East, Maghreb, Afghanistan and Pakistan Directorate).

Overtime by nature of remuneration

During the period 2009–2010 to 2011–2012 the number of overtime hours claimed for monetary compensation decreased; however, the number of overtime hours claimed in time in lieu increased. As per interviews conducted with CIDA management, this may be the result of reduced budgets and attempts to reduce the cost of overtime by compensating overtime through time in lieu as opposed to monetary payments. Although there has been a trend toward taking overtime as time in lieu, interviewees stated that the time claimed is not usually taken off in a timely manner, which leads to large payouts at the end of the respective collective agreement payout dates.

Overtime by type

Overtime could be incurred as time taken while travelling, callback time, standby time, and supplementary hours worked. Throughout the period under examination, we identified the majority of overtime hours claimed was incurred from supplementary hours worked and long-distance travelling. This is mainly driven by program delivery and travel required in branches.

According to interviewees, it is challenging to decrease the number of overtime hours claimed through travel as there are many factors to be taken into consideration, such as the cost of travel, availability of flight, and length of flight, along with the number of overtime hours incurred. Interviewees also informed us that unforeseen meetings and evening events that take place abroad generally allow for overtime; however, it is difficult to plan for and monitor those events.

System limitations

As mentioned in the scope section of this report, the data analysis was performed on information generated from CIDA's SAP system. In reviewing the data, inconsistencies were identified, and we were unable to reconcile the following overtime reports:

• Total overtime claimed – sum total of the three reports below
• Sub-report 1 – Overtime paid through payroll function
• Sub-report 2 – Overtime compensated as time in lieu through vacation/leave function
• Sub-report 3 – Outstanding time in lieu paid out through payroll function

Inconsistencies include individuals identified in the sub-reports who were not included in the "Total overtime claimed" report. There were also inconsistencies between the list of individuals in the "Total overtime claimed" report and the three sub-reports.

Although reasonable explanations may exist for the inconsistencies, we were unable to reconcile these reports within the time frame of the audit, which may indicate issues with the underlying report specifications.

Recommendation 3:

The Director General of HRB should undertake a review of the overtime reports generated by SAP to ensure that they are complete and accurate.

Appendix A: List of Recommendations and Management Response and Action Plan

Recommendation 1

The Director General of HRB, in consultation with the CFO, should ensure that overtime is appropriately authorized, approved and paid, and that supporting documentation is maintained.

Responsibility

Director General, HRB

Management Response and Action Plan

We agree with the recommendation, and HRB will review the overtime guidelines to ensure a clarification on the various roles and that the process required is respected.

Target Date

Complete

Recommendation 2

The Director General of HRB should put in place appropriate measures to ensure that access codes to approve section 33 are not shared by employees within the Compensation and Benefits Division of HRB.

Responsibility

Director General, HRB

Management Response and Action Plan

We agree with the recommendation and HRB will undertake actions to ensure that only those with the appropriate delegation of authority approve under section 33.

Target Date

Complete

Recommendation 3

The Director General of HRB should undertake a review of the overtime reports generated by SAP to ensure that they are complete and accurate.

Responsibility

Director General, HRB

Management Response and Action Plan

We agree with the recommendation, and a review of all SAP HR Reports on Overtime will be conducted between May - July 2013 with the Business Process Owner (Manager, Workplace Services), and appropriate updates made and implemented within the SAP HR system, as required.

Target Date

Complete