Financial Management: Control Weaknesses Increase Risk of Improper Navy
Civilian Payroll Payments (Letter Report, 05/08/95, GAO/AIMD-95-73).

GAO reviewed the Navy's civilian payroll operations, focusing on the:
(1) propriety and accuracy of payments made to civilian personnel; and
(2) vulnerability of the internal control system to prevent fraud and
abuse.

GAO found that: (1) 134 of 225,000 Navy civilians were overpayed a total
of at least $62,500 in 1 year; (2) these overpayments were due to the
Defense Finance and Accounting Service's (DFAS) failure to determine if
individual civilian employees were paid from multiple databases for the
same time period and infrequent reconciliations between civilian payroll
and personnel systems; (3) the Navy's civilian payroll operations are
susceptible to additional improper payments as a result of many
personnel having unrestricted access to payroll data, DFAS inability to
identify database changes, and DFAS maintaining inactive payroll
accounts on the active payroll database; and (4) the rapid consolidation
of civilian payroll accounts into the Defense Civilian Payroll System
could exacerbate control weaknesses if vulnerabilities are not
adequately addressed.

--------------------------- Indexing Terms -----------------------------

 REPORTNUM:  AIMD-95-73
     TITLE:  Financial Management: Control Weaknesses Increase Risk of 
             Improper Navy Civilian Payroll Payments
      DATE:  05/08/95
   SUBJECT:  Naval personnel
             Civilian personnel records
             Payroll records
             Payroll systems
             Overpayments
             Military pay
             Financial management systems
             Internal controls
             Data bases
             Proprietary data
IDENTIFIER:  Defense Civilian Pay System
             Denver (CO)
             Pensacola (FL)
             Charleston (SC)
             Omaha (NE)
             Defense Civilian Personnel Data System
             Uniform Financial Management System
             Uniform Automated Data Processing System
             Joint Financial Management Improvement Program
             
**************************************************************************
* This file contains an ASCII representation of the text of a GAO        *
* report.  Delineations within the text indicating chapter titles,       *
* headings, and bullets are preserved.  Major divisions and subdivisions *
* of the text, such as Chapters, Sections, and Appendixes, are           *
* identified by double and single lines.  The numbers on the right end   *
* of these lines indicate the position of each of the subsections in the *
* document outline.  These numbers do NOT correspond with the page       *
* numbers of the printed product.                                        *
*                                                                        *
* No attempt has been made to display graphic images, although figure    *
* captions are reproduced. Tables are included, but may not resemble     *
* those in the printed version.                                          *
*                                                                        *
* A printed copy of this report may be obtained from the GAO Document    *
* Distribution Facility by calling (202) 512-6000, by faxing your        *
* request to (301) 258-4066, or by writing to P.O. Box 6015,             *
* Gaithersburg, MD 20884-6015. We are unable to accept electronic orders *
* for printed documents at this time.                                    *
**************************************************************************


Cover
================================================================ COVER


Report to the Assistant Secretary of the Navy for Manpower and
Reserve Affairs and the Director of the Defense Finance and
Accounting Service

May 1995

FINANCIAL MANAGEMENT - CONTROL
WEAKNESSES INCREASE RISK OF
IMPROPER NAVY CIVILIAN PAYROLL
PAYMENTS

GAO/AIMD-95-73

Navy Civilian Payroll


Abbreviations
=============================================================== ABBREV

  DCPDS - Defense Civilian Personnel Data System
  DCPS - Defense Civilian Pay System
  DFAS - Defense Finance and Accounting Service
  DOD - Department of Defense

Letter
=============================================================== LETTER


B-258746

May 8, 1995

The Honorable Frederick F.  Y.  Pang
Assistant Secretary of the Navy for
 Manpower and Reserve Affairs

Mr.  Richard F.  Keevey
Director, Defense Finance
 and Accounting Service

As part of our audit of the Navy's fiscal year 1995 financial
operations, we are evaluating the Navy's payroll operations.  This
report presents the results of our review of the operations used to
pay Navy's civilian personnel.  In fiscal year 1993, the Navy
employed approximately 281,000 civilian personnel at a cost of over
$13 billion.  The Department of Defense (DOD) has selected the
Defense Civilian Pay System (DCPS) as the interim standard civilian
payroll system, and estimates that approximately 800,000 Defense
civilians will be paid from DCPS by the end of fiscal year 1996. 

The objectives of our review of Navy's civilian payroll operations
were to determine the propriety and accuracy of payments made and to
evaluate the vulnerability of the system of internal controls relied
on to help prevent fraud and abuse.  The Defense Finance and
Accounting Service (DFAS) is responsible for DCPS and paying Navy
civilian employees based on information provided from Navy Personnel
operations such as new pay accounts and pay rates.  Consequently, it
is critical that both DFAS and Navy work together to establish strong
internal controls that are essential to (1) ensuring accurate service
to Navy's civilian workforce and (2) preventing fraud and abuse. 


   RESULTS IN BRIEF
------------------------------------------------------------ Letter :1

Our tests of 225,000 payroll and associated personnel records for one
pay period identified overpayments to 134 Navy civilians, which
represented less than one-tenth of 1 percent of the accounts tested. 
While we could attribute overpayments of $62,500 to these
individuals, the total amount they were overpaid is likely to be far
greater because some of these erroneous payments continued for nearly
1 year.  The causes of these overpayments, at least in part, were (1)
DFAS did not check to determine if individual civilian employees were
paid from multiple databases for the same time period and (2)
reconciliations between civilian payroll and personnel systems were
infrequent and did not provide for systematic follow-up to
investigate and correct all the discrepancies identified. 

While our tests revealed a very small number of overpayments, we did
find that the civilian payroll operations carried out by DFAS for the
Navy are susceptible to additional improper payments as a result of
(1) granting a large number of payroll processing personnel virtually
unrestricted access to both pay and personnel data, (2) ineffective
audit trails that did not always identify who made changes to DCPS
data, and (3) DFAS maintaining inactive payroll accounts on the
active payroll database.  Unless these vulnerabilities are adequately
addressed, the ongoing rapid consolidation of civilian payroll
accounts into DCPS could exacerbate these control weaknesses. 


   BACKGROUND
------------------------------------------------------------ Letter :2

DOD has designated four locations to process DCPS payroll
transactions.  Three of the locations--Denver, Colorado; Pensacola,
Florida; and Charleston, South Carolina--were in operation at the
time of our review.  The fourth location in Omaha, Nebraska is
scheduled to begin processing DCPS transactions in August 1995.  DCPS
was paying civilian employees from four DCPS databases in December
1993 and was scheduled to increase the number of databases to nine by
August 1995.\1 DOD designated the Financial Systems Activity at
Pensacola, Florida, as the Central Design Activity responsible for
maintaining and updating the payroll system. 

The Defense Civilian Personnel Data System (DCPDS)--DOD's standard
personnel system--provides DCPS with most essential personnel
information needed to pay Navy civilian employees.  DCPDS has an
automated interface with the payroll system that is designed to
automatically transfer personnel information such as employee name,
social security number, job grade or step, and salary.  The personnel
data is entered into the personnel system by individual Navy Human
Resource Offices throughout the country.  These Human Resource
Offices are the responsibility of the Navy's Assistant Secretary for
Manpower and Reserve Affairs.  Generally, Navy civilian employee time
and attendance data for actual hours worked is entered into DCPS
separately by the timekeepers at the employee's work location. 


--------------------
\1 DCPS payroll payments were made from more than one database
because some sites maintained separate databases for distinct groups
of civilian employees.  For example, the Charleston site maintained
one database for shipyard civilian employees and a separate database
for other Navy civilian employees. 


   SCOPE AND METHODOLOGY
------------------------------------------------------------ Letter :3

To evaluate the propriety and accuracy of Navy civilian payroll
payments, we performed computer analyses of pay records to (1)
determine if payments were made only to authorized personnel and (2)
identify any payments made in excess of authorized amounts.  To
determine if payments were being made to authorized personnel, we
obtained and compared electronic copies of Navy civilian payroll and
personnel records for the pay period ending December 25, 1993.  At
that time, DCPS was paying about 188,000 Navy civilian personnel.  In
addition, we reviewed the Uniform Financial Management System in
Arlington, Virginia, and the Uniform Automated Data Processing
System, in Honolulu, Hawaii, which paid about 28,000 and 9,000 Navy
civilians, respectively, at that time.  In total, we reviewed the
propriety and accuracy of payroll payments made to about 80 percent
of the 281,000 civilians employed by the Navy in 1993. 

To ensure that we had all and only the payroll data for that pay
period, we matched the total payroll amounts for each payroll office
with their corresponding payroll certification report.  To identify
potential improper payments or overpayments, we conducted various
computer matches and searches to identify Navy civilians who

  received multiple DCPS payments;

  were paid without an active personnel record;

  were paid at a higher rate than authorized;

  had high annual leave balances and did not use annual leave, sick
     leave, or compensatory time in 1993; and

  were paid by both DCPS and other civilian pay systems. 

To determine if any payments in excess of authorized amounts existed
within the universe of the potential overpayments identified through
our tests discussed above, we provided DFAS with our test results and
requested that DFAS contact Navy Personnel and jointly determine
whether any payments were made in excess of authorized amounts. 
Because they had not yet responded after 4 months, we contacted about
60 Navy Human Resource Offices throughout the country and requested a
copy of the official personnel record showing the authorized pay rate
for each potentially overpaid Navy civilian.  We compared this pay
rate to the rate each potentially overpaid Navy civilian was paid to
determine which Navy civilians were actually overpaid. 

To assess the vulnerability of DFAS' and the Navy's civilian payroll
internal controls to loss of funds from fraud and abuse, we observed
payroll processing, reviewed applicable DCPS documentation (including
reports, policies, and regulations), and interviewed cognizant DFAS
and Navy Personnel officials. 

We performed our work at the three active DCPS locations in
Charleston, South Carolina; Pensacola, Florida; and Denver, Colorado. 
We also performed work at two payroll processing locations using
other payroll systems at the time of our review--the Uniform
Financial Management System in Arlington, Virginia, and the Uniform
Automated Data Processing System, in Honolulu, Hawaii.  In addition,
we performed audit work at the DCPS Central Design Activity in
Pensacola, Florida; the Navy Civilian Personnel Data System Center in
San Antonio, Texas; and Navy Human Resource Offices in Charleston,
South Carolina; Pensacola and Jacksonville, Florida; and San Diego,
California. 

Our work was performed between August 1993 and February 1995 in
accordance with generally accepted government auditing standards.  We
obtained oral comments on a draft of this report from cognizant DFAS
and Navy Personnel officials.  Their views have been incorporated
where appropriate and are further discussed in the agency comments
section of this report. 


   DFAS MADE FEW OVERPAYMENTS
------------------------------------------------------------ Letter :4

Our matching tests of 225,000 payroll and associated personnel
records to determine the propriety and accuracy of Navy civilian
payroll payments disclosed overpayments to 134 Navy civilians, or
less than one-tenth of 1 percent of the accounts tested.  This is in
contrast to the Army where we found improper payroll payments
totaling millions of dollars, including payments to "ghost" soldiers
and deserters.\2

As shown in table 1, we confirmed overpayments of $62,500 were made
to Navy civilians. 



                           Table 1
           
                   Overpayments Identified

                                           Number of
                                           Employees
Types of Overpayments                       Overpaid  Amount
---------------------------------------  -----------  ------
Navy civilians receiving multiple DCPS            25  $27,27
 payments                                                6\a
Navy civilians paid without an active             14  7,717\
 personnel record                                          b
Navy civilians paid at a higher rate              84  5,251\
 than authorized by personnel                              b
Navy civilians paid by both DCPS and              11  22,264
 other payroll systems                                    \a
============================================================
Total                                            134  $62,50
                                                           8
------------------------------------------------------------
\a This amount represents total identified overpayments, as a result
of duplicate payments to individuals for the pay period tested, and
any overpayments to those individuals for the preceding 6 months. 

\b The amount represents the difference between amounts paid and
amounts authorized for the pay period we tested.  We did not
calculate the cumulative effect of these differences over the time
period that the error actually existed.  However, according to
information in the personnel records, some overpayments continued for
nearly 1 year.  Accordingly, the total amount overpaid was higher. 

However, we also found that total overpayments were actually higher
than those we confirmed because some erroneous payments continued for
nearly a year.  For example, one Navy civilian was paid by DCPS at a
rate of $52,217 for 1993, instead of the authorized rate of $47,209. 
Thus, although the overpayment for the pay period we reviewed was
about $190, the total amount overpaid on an annual basis was about
$5,000.  Because DCPS only keeps payroll records on-line for a
6-month period, and because of the significant amount of resources
required to research each overpayment on microfiche, we did not
determine the full extent of overpayments associated with the 134
cases we identified.  However, the total overpayment amounts are
undoubtedly far greater than the amounts shown in table 1. 

These overpayments were caused, at least in part, because (1) DFAS
and Navy Personnel did not reconcile discrepancies between personnel
and payroll records and (2) DFAS staff did not compare payments from
the various payroll databases to detect unauthorized payments to a
single civilian employee. 

Nonetheless, our examination of payroll records showed that many of
the overpayments were identified by DFAS within 6 months of their
occurrence.  When DFAS detected overpayments, it processed
retroactive transactions to change the pay records and to initiate
DFAS' recovery or resolution process.  We noted such retroactive
adjustments, totaling $50,374, for 45 of the 134 overpaid Navy
civilians identified in table 1.  As noted previously, we did not
determine the extent to which the conditions permitting the specific
overpayments we identified resulted in overpayments in other pay
periods, nor did we ascertain how DFAS learned of the overpayments
for which it initiated retroactive transactions. 

Instead, in November 1994, we met with cognizant DFAS and Navy
Personnel officials and provided them with a comprehensive list of
all the overpayments we identified.  We requested that they jointly
follow up to determine the full extent of overpayments and that DFAS
recover these amounts.  As of March 1995, DFAS and Navy had not
completed their determination of the full extent of overpayments, and
as a result had not yet completed necessary recovery actions. 


--------------------
\2 Financial Management:  Defense's System for Army Military Payroll
Is Unreliable (GAO/AIMD-93-32, September 30, 1993). 


      RECONCILIATIONS BETWEEN
      PERSONNEL AND PAYROLL
      INADEQUATE
---------------------------------------------------------- Letter :4.1

Comparisons between the payroll and personnel systems and
reconciliations of discrepancies were not routinely done. 
Specifically, Navy and DFAS compared Navy civilian payroll and
personnel files only four times between May 1992 and August 1994. 
More importantly, discrepancies identified from these comparisons
were not resolved because Navy and DFAS had not established
procedures for systematic follow-up and correction of identified
discrepancies.  Had more frequent payroll and personnel comparisons
taken place, and any discrepancies systematically researched and
their resolution documented, DFAS could have promptly detected and
corrected the overpayments we identified. 

For example, as shown in table 1, we found that DFAS paid 84 civilian
employees at a higher pay rate than authorized in their personnel
records.  These overpayments totaled $5,251 for the one pay period we
tested.  In addition, table 1 shows that DFAS paid about $7,700 to
another 14 individuals who did not have active personnel records. 

DFAS and Navy Personnel acknowledged that they infrequently
reconciled payroll and personnel data.  DFAS officials told us that
payroll and personnel data reconciliations do occur as part of the
conversion process of payroll accounts to DCPS.  However, these
officials acknowledged that not all discrepancies identified during
these reconciliations are researched and resolved prior to the
conversion of the payroll account to DCPS.  As a result, erroneous
information, such as an incorrect pay rates, may be passed from the
closing payroll offices to the cognizant receiving DCPS payroll
center. 

The DCPDS/DCPS Payroll Handbook calls for conducting
payroll/personnel reconciliations about every 4 months to ensure the
accuracy and completeness of the payroll and personnel records. 
However, DFAS and Navy Personnel officials stated that they had not
consistently reconciled differences between payroll and personnel
records and pointed out that they did not have procedures to
systematically resolve and document the disposition of the
discrepancies found during their reconciliations of payroll and
personnel records.  With the continued rapid consolidation of payroll
accounts into the DCPS system, which is discussed later in this
report, it is critical that payroll and personnel reconciliations be
routinely conducted and that all discrepancies be systematically
followed up and resolved. 

In commenting on this report, DFAS officials told us that they
believe the recent addition of edit checks to the electronic
interface between DOD's standard personnel system and DCPS decreased
the need for data reconciliation.  While not detailing the extent of
these changes, DFAS officials told us that DCPS was enhanced to
automatically reject and return proposed personnel actions affecting
pay if they did not pass recently initiated DCPS edit checks and that
this enhancement permitted faster identification of erroneous data. 

We agree that this improvement in the interface between the personnel
and payroll systems could help prevent some of the kinds of
overpayments we identified.  However, it is unlikely that such edit
checks would prevent overpayments arising from Navy civilians
receiving multiple DCPS payments or Navy civilians being paid by both
DCPS and other payroll systems.  In addition, not all personnel
information flows through the interface.  For example, we noted
instances where notices of personnel actions were manually entered
into DCPS.  Moreover, the reconciliations would be useful for
determining the effectiveness of these recently added edit checks. 
Consequently, we believe that there is a continuing need for data
reconciliations between the payroll and personnel systems. 


      DCPS DOES NOT TEST FOR
      MULTIPLE PAYMENTS
---------------------------------------------------------- Letter :4.2

As shown in table 1, our audit disclosed that 25 civilian employees
were overpaid at least $27,000 because DFAS erroneously paid them
from two separate DCPS payroll databases.  We found an additional 11
overpayments totaling nearly $22,300 that were caused by payments
being processed independently from both DCPS and another payroll
system for the same individual.  DCPS did not have internal control
procedures to determine if multiple payments were made to a single
social security number and to ensure that its four databases did not
generate undetected erroneous multiple payments to a single
individual.  DCPS' vulnerability to erroneous payments from multiple
databases is likely to increase because DFAS plans to expand the
number of payroll databases from four at the time of our review to
nine by the end of fiscal year 1995. 


   CONTROL WEAKNESSES LEAVE DCPS
   VULNERABLE TO IMPROPER PAYMENTS
------------------------------------------------------------ Letter :5

In addition to the need for stronger controls to prevent
overpayments, DCPS was also vulnerable to improper payments as a
result of weaknesses in controls relied on to regulate access to
data, document transaction processing, and perform file maintenance. 
Specifically, DFAS gave most payroll staff unnecessary access to
sensitive DCPS data and did not provide for a complete audit trail
documenting who made changes to payroll records.  In addition, DFAS
did not have controls in place to prevent payroll accounts from
former employees remaining on the system from being fraudulently
reactivated and paid.  These internal control weaknesses could result
in improper or fraudulent payments. 

Such internal controls are particularly critical in light of the
scope of the ongoing DCPS consolidation effort.  DFAS officials have
described this as the most aggressive effort ever undertaken in this
area, involving the consolidation of about 700,000 accounts from over
350 payroll offices worldwide.  They further stated that this effort
involved the consolidation of 19 different automated payroll systems
and several manual systems operating overseas--all of which they
acknowledged were in various states of disrepair.  In addition,
strong internal controls, including segregating key duties among
responsible personnel, are necessary to provide reasonable assurance
that assets, such as payroll funds, are safeguarded against loss. 


      EXCESSIVE LEVELS OF ACCESS
      GRANTED
---------------------------------------------------------- Letter :5.1

Computer access controls, such as those used by DCPS, are intended to
permit authorized users to access the system to perform their
assigned duties and preclude unauthorized persons from gaining
access.  However, we found that DFAS unnecessarily granted
supervisory access codes to staff that did not have supervisory
responsibilities.  Supervisory level access, the highest access level
DFAS granted to its payroll processing staff, allows individuals to
create employee records; enter employee time and attendance data; and
change salary amounts, names, and pay destinations.  While such
access would not enable DFAS payroll processing staff to directly
access personnel data in DCPDS, it would enable DFAS staff to add to
or modify personnel data--for example, adding employees or modifying
pay rates--after transmission to DCPS. 

To illustrate, a single payroll staff with this access level would be
capable of creating and paying a fictitious employee or fraudulently
diverting payroll funds to another destination. 

About 86 percent of the supervisory level access codes at the three
DCPS payroll processing locations were granted to nonsupervisors. 
For example, at the Denver DCPS processing location, 138 staff were
granted supervisory level access, including 2 temporary employees,
while only 13 had supervisory responsibilities.  After our inquiry,
Denver officials removed about 20 percent of the supervisory level
access codes because the individuals either had left the organization
or otherwise should not have had access to the payroll system. 
However, Denver still had 97 supervisory level access codes granted
to nonsupervisors. 

By granting supervisory level access to payroll processing staff who
did not need that level of access, DFAS inappropriately gave the
majority of its staff access to both personnel information and time
and attendance data.  DCPS Security Guidelines Manual states that the
system's design should provide for a separation of duties between
payroll clerks in the payroll office.  Specifically, a single payroll
clerk should not be capable of both creating or changing employee
records and entering time and attendance data for the same group of
payroll accounts.  Further, GAO's Internal Control Standards\3 state
that key duties and responsibilities in authorizing and processing
payroll should be separated among individuals. 

According to DFAS officials, supervisory level access is necessary to
perform a wide variety of tasks associated with maintaining payroll
operations while converting Navy civilian payroll accounts from their
previous payroll systems to DCPS, including the tasks of entering
both new pay accounts and time and attendance data.  DFAS officials
told us that they accepted the increased risk resulting from granting
supervisory level access. 

However, DFAS did not specifically assess whether--and how
long--nonsupervisory payroll technicians may need supervisory level
access during the period of DCPS consolidation.  We believe that the
increased risk associated with the large scope of the ongoing DCPS
conversion process--which DFAS officials informed us is not scheduled
for completion until March 1997--necessitates strong access controls. 
DFAS officials acknowledged that they needed to identify the
appropriate number of staff who should have supervisory access at
this time. 


--------------------
\3 Standards For Internal Controls In The Federal Government, 1983. 
Under the Federal Managers Financial Integrity Act, 31 U.S.C. 
3512(c), agencies are to establish their system of internal controls
consistent with these standards. 


      DCPS AUDIT TRAIL IS
      INCOMPLETE
---------------------------------------------------------- Letter :5.2

DCPS' audit trail contains incomplete information for identifying who
was responsible for changing certain types of DCPS data.  Lacking
such audit trail capability leaves DCPS vulnerable to undetected
fraudulent payments.  Specifically, DCPS routinely recorded only the
identity of the payroll clerk last accessing the payroll account,
regardless of whether or not this person made any changes.  However,
to ensure effective control over changes in personnel data affecting
pay, such as name, address, pay destination, and salary amounts, it
is critical that DCPS have a complete audit trail identifying the
payroll clerk responsible for each change, not merely the payroll
clerk last accessing the system.  In addition, retroactive
transactions\4 to correct or update previous payroll payments did not
carry any payroll clerk identification. 

Audit trails identifying which payroll clerk initiated a change in
DCPS data are necessary to document the responsibility for the
sequence of events followed in processing a transaction.  According
to Joint Financial Management Improvement Program requirements,\5
computer systems must provide audit trails to trace transactions from
source documents, through successive levels of summarization, to the
financial statements and from the financial statements to the source. 
Guidelines for Security of Computer Applications, Federal Information
Processing Standards 73, states that computer system users should be
uniquely identified so that they can be held responsible for their
activities--it is usually not enough to verify that a user is one of
a group of authorized users.  It is difficult to detect security
breaches unless there is a record of system events which can be
analyzed, including information on who accessed the system, what was
accessed, and what actions were performed. 

DCPS is currently incapable of providing a complete audit trail with
this level of detail.  For example, when DFAS officials in Denver
were informed by a civilian that he was overpaid $1,000 in January
1993, DFAS was able to determine that an erroneous change had been
made to this employee's account, but DFAS could not determine which
payroll clerk initiated the change in DCPS.  The need for a
well-documented audit trail is particularly important because, as
discussed previously, most personnel have supervisory level access
allowing them to access and change all records on a DCPS database. 
DFAS officials acknowledged the necessity and importance of audit
trails.  However, they informed us that they have not yet determined
a specific course of action on how best to establish a comprehensive
audit trail in a cost- efficient manner. 


--------------------
\4 Retroactive transactions are changes made to previous pay periods. 
For example, a retroactive transaction adding hours worked to a
previous pay period would result in the payment for those hours in
the pay period the transaction was processed. 

\5 Federal Financial Management Systems:  Core Financial System
Requirements (Joint Financial Management Improvement Program, January
1988). 


      INACTIVE PAYROLL ACCOUNTS
      REMAIN ON DCPS
---------------------------------------------------------- Letter :5.3

The Navy's civilian payroll was also at risk of fraud and abuse
because many payroll accounts of former employees, who should no
longer receive pay checks--called inactive payroll accounts--remained
on the system.  As of December 1993, DCPS had about 40,000 inactive
payroll accounts on the system and no controls to prevent these
accounts from being reactivated for fraudulent payments.  Inactive
payroll accounts may be reactivated by anyone with supervisory level
access, which as discussed previously is the majority of the payroll
clerks, by changing one code in DCPS.  Because of the large number of
staff with supervisory level access to the payroll system and the
incomplete audit trail discussed previously, the risk that these
accounts can be fraudulently reactivated is increased. 

DFAS officials stated that the inactive payroll accounts were
maintained on the system until they prepared the W-2 tax information
and made all necessary corrections to an employee's payroll account. 
Once this process was complete, the inactive payroll files were to be
purged from the system in July of the year the W-2s were created. 
Thus, an inactive payroll record could remain on DCPS for up to 19
months.  Compounding this vulnerability, in July 1993, the DCPS
Central Design Activity, did not purge the inactive payroll accounts
from DCPS, which DFAS officials said accounted for the high number of
inactive payroll records found during our testing at the end of
December 1993.  We agree that DFAS needs to maintain information on
inactive accounts to prepare W-2s and make necessary corrections to
payroll accounts.  However, given the current unstable control
environment associated with the ongoing unprecedented DCPS
consolidation, we believe that information on inactive accounts
should not remain on the active database.  This risk can be
significantly reduced if payroll accounts of former employees are
removed from the active payroll system and placed in a separate
database, with appropriately restricted access. 


   CONCLUSION
------------------------------------------------------------ Letter :6

Our testing identified insignificant overpayments in relation to the
number and dollar amounts of payroll payments made to Navy civilians. 
However, we did identify internal control vulnerabilities which, if
exploited, could permit additional improper civilian payroll payments
to occur and not be readily detected.  Strengthening DFAS and Navy
procedures to restrict access to payroll and personnel data and
modifying the DCPS system to provide a reliable audit trail would
both help prevent fraudulent payments and detect overpayments when
they occur. 

With the ongoing rapid consolidation of DOD civilian payroll accounts
into the DCPS system that is not scheduled to be completed until
early 1997, it is critical that top management devote attention and
priority to correcting existing control vulnerabilities as soon as
possible.  In addition, effectively researching and documenting the
correction of discrepancies identified through a payroll and
personnel record comparison will require the concerted cooperative
effort of both cognizant Navy and DFAS officials for personnel and
payroll record accuracy, respectively. 


   RECOMMENDATIONS
------------------------------------------------------------ Letter :7

We recommend that the Assistant Secretary of the Navy for Manpower
and Reserve Affairs, and the Director of the Defense Finance and
Accounting Service direct appropriate officials to: 

  Complete follow-up on the 134 overpaid employees we identified and
     referred to DFAS and Navy Personnel officials to determine the
     full extent of overpayment, collect amounts due, and identify
     and correct systemic causes of the overpayments. 

  Conduct payroll/personnel reconciliations every 4 months, as called
     for by the DCPDS/DCPS Payroll Handbook, and establish a
     requirement for timely systematic follow-up, including research,
     correction, and documentation of all discrepancies. 

We recommend that the Director of DFAS: 

  Establish and implement detailed automated procedures documented in
     the Defense Civilian Pay System Users Manual to detect and
     correct any unauthorized multiple payments to a single social
     security number. 

  Assess, on a case-by-case basis, the extent to which nonsupervisory
     payroll technicians need supervisory level access, and, if so,
     grant such access for as limited a period as possible. 

  Require the DCPS Central Design Activity to develop an audit trail
     in DCPS that marks all transactions with a user identification
     that cannot be overwritten. 

  Remove current inactive payroll records from the active payroll
     system and place these records in a separate database, with
     restricted access. 

  Establish and implement detailed written procedures to remove all
     future inactive payroll accounts from the active payroll system,
     and place these records in a separate database, with restricted
     access. 


   AGENCY COMMENTS
------------------------------------------------------------ Letter :8

DFAS and Navy Personnel officials generally agreed with our
recommendations.  However, DFAS officials expressed concern that we
did not sufficiently recognize the extenuating circumstances brought
about by the ongoing rapid consolidation of DCPS processing
locations.  We believe that the changes DCPS is undergoing warrant
adequate controls to ensure that risks associated with such changes
are sufficiently mitigated.  Given the increased risk associated with
the changing environment in which DCPS currently operates, we
continue to believe that the findings and recommendations in our
report are appropriate. 


---------------------------------------------------------- Letter :8.1

We are sending copies of this report to the Secretary of the Navy;
the Chief Financial Officer of the Department of Defense; the
Assistant Secretary of the Navy for Financial Management; the
Director of the Office of Management and Budget; and to the Chairmen
and Ranking Minority Members of the House and Senate Armed Services
Committees, the Senate Committee on Governmental Affairs, the House
Committee on Government Reform and Oversight, and the House and
Senate Committees on Appropriations. 

This report was prepared under my direction and I may be reached at
(202)512-9095 if you have any questions concerning this report. 
Major contributors to this report are listed in appendix I. 

David M.  Connor
Director, Defense Financial Audits


MAJOR CONTRIBUTORS TO THIS REPORT
=========================================================== Appendix I


   ACCOUNTING AND INFORMATION
   MANAGEMENT DIVISION,
   WASHINGTON, D.C. 
--------------------------------------------------------- Appendix I:1

Geoffrey Frank, Assistant Director
Daniel Blair, Auditor-in-Charge
West Coile, Auditor


   ATLANTA REGIONAL OFFICE
--------------------------------------------------------- Appendix I:2

William J.  Cordrey, Senior Auditor
Marshall Hamlett, Evaluator


   DENVER REGIONAL OFFICE
--------------------------------------------------------- Appendix I:3

George Lorenzen, Senior Evaluator
John Spence, Senior Evaluator


   FAR EAST OFFICE
--------------------------------------------------------- Appendix I:4

Diane Handley, Senior Evaluator

