2013-08-01
Another interesting question posted recently on the ACL LinkedIn Group:
Does anyone use ADP for their card swipe software/vendor? If so, how are you using ACL to test the data? Any help or guidance of types of tests or any scripts created would be helpful.
Group Member Andrew Monroe, ACL Certified Contractor jumped right in with his response:
At a previous employer we converted over to ADP for Payroll and IT / Finance functions recommended the use of ADP’s time-and-attendance / card swipe system, but factory management chose to go with another product. While implementing the new time-keeping system, management ran the old and new systems in parallel. We were able to compare the input and output of the two systems to identify inequalities using ACL. Very useful. There were about 2,000 people in the factory time keeping system in three shifts, (mostly) 5 days per week, generating between 25,000 and 30,000 records per working day. The tests and scripts were specific to the installation and unique characteristics of labor contracts, so even if I had them to share, they might not fit your circumstance. However, looking for inequalities in a parallel system test is something everyone could use.
We asked Andrew to elaborate on this discussion for a blog post.
Timekeeping systems are the basis for many “hourly” payroll systems. They form one important part of the basic payroll equation: hours times rate equals pay.
Labor contracts generally stipulate work rules that require hourly employees (such as in a factory) to “punch in” when they arrive and “punch out” when they leave their work stations. After the days of pencil and paper, there were paper punch cards that were read by card reader systems. These punch card systems could calculate the total hours worked (departure time minus arrival time), were simple in concept and fairly effective. They could also be defeated if a work-friend punched your card for you on his way into the plant, and again on his way out of the plant (absent any other validation controls).
In recent years, card swipe systems that use magnetically encoded strips have replaced these punch card systems, but their concept is generally the same. At a minimum, the card’s magnetic strip has an employee identification number (or social security number, if it is outdated) encoded on it. A pass at the card reader records the employee number and creates a date-time stamped record within the system. The first pass at the reader in a given day is the person’s time-in, the second will be the time-out. The hours in between result in the time worked. Collect all of these records for a given day and send them over to the payroll system to accumulate all of the hours worked as the basis for payroll checks.
All of this ‘simplicity’ comes with assumptions:
- Card reader location: Where is the card reader in relation to the employee’s workstation? Is it at the front gate of the parking lot, to be read before the employee parks his or her car? Is it at the door to the factory, before the employee may change into their work clothes? Or, is it at the workstation itself, where there may be thousands of them all over a factory building? Finally, what kind of physical controls exist with the use of the badge reader? Is it a strong gate at the door of the factory in which only one person may pass at a time? Or can anyone badge a reader and have it record him in a new job at a new time? Are there any security or supervisory personnel at the reader to enforce company work rules and identify violations?
- Labor Rates and Job Codes: Is there one and only one job code and labor rate for the whole factory? Or, more likely, are there several job codes and several labor rates in use? Lastly, is the factory subject to collective bargaining? In other words, are there labor unions represented in the factory? If so how many? Are there multiple labor agreements (and work rules and job codes and labor rates) in effect in the factory? Finally, is it possible for a worker who is the member of one labor union to work a labor rate / job that is subject to a different labor contract? How does management track and enforce the different rates?
- Work activities: Are there safety meetings that employees are required to attend? Are there other organizational meetings, such as training, safety or charitable activities that are non-productive paid time? Are they recorded differently than the “work” activity codes? (We may get unfavorable cost variances in conversion costs if we don’t). Are they supposed to “badge out” before breaks and meal times? What about labor meetings? Arbitration hearings? What are the specific paid-time activities versus excused, unpaid-time items?
- Attendance: What are the paid, time off activities that are allowed? Time such as vacation, personal, sick, funeral time off may be allowed in certain quantities based on seniority or years of service. What are the requirements for them to be appropriately recorded in the payroll systems (and cost accounting systems)? How are unapproved absences recorded? What are the limits of these absences before job actions are required such as discipline or dismissal? Are there separate systems used to track things like vacation based on seniority in accordance with labor contracts?
- Regular time and Overtime: What are the rules for regular time and overtime? How are these rules enforced? What systems are used to enforce them? What roles does factory management perform in enforcing these rules? Where are there potential conflicts of interest? How are conflicts resolved? What procedures does management perform to validate time worked? How does management enforce work schedules? Are there penalties or disincentives for hourly workers who do not comply with master work schedules?
- Employee Master: How is an employee enrolled for pay and benefits within a company? Who are the people that perform these roles? Is there any separation of duties in these roles to help ensure integrity of the employee master file? Is it possible for phantom employee to be enrolled and paid by the company? What procedures does management perform to periodically validate employee existence?
There are people who are always seeking ways to game the system and obtain some kind of advantage, whether it is free time or extra pay. Both of these items are easily expressed in financial losses to the organization (or company) in terms of hours paid, but not worked. For example:
- Phantom hours: An employee who can exit a facility without “badging out” could possibly be paid regular and overtime hours for an extended period up to, or until, he badges in the next day.
- Buddy badging: An employee who can get a friend to badge-in for them could possibly be paid for hours he did not work, if security measures are lax around entry and exit and or use of badge readers.
- Phantom employees: An unscrupulous supervisor can fire an hourly employee, record fraudulent hours for the former-employee’s work and then divert employee paychecks if there are no periodic employee validation procedures performed.
- Ongrounds Lead time: In a physically large facility, the distances traveled on foot between the parking lot and the workstation can range up to a half a mile or more in some places. The placement of the “badge-in” station can create a lot of variance in time records, depending on work rules and a person’s walking pace. In a three shift work environment, the previous worker may not be able to leave (and badge-out) until replaced by the person doing the work on the next shift (or relived by the supervisor). How are serial offenders of late-arrivals identified?
There are but a few examples of the many tests that auditors and management need to be aware of and test for using ACL. An intimate knowledge labor agreements, work rules, schedules, systems and processes makes for an informed and effective auditor and an excellent audit.
The ACL LinkedIn Group consists of over 4000 audit, finance and risk professionals from all around the world. Are you part of the global community? Join the Group!
(Source: ACL Blog)
