DOD has designated four locations to process DCPS payroll transactions. Three of the locations—Denver, Colorado; Pensacola, Florida; and Charleston, South Carolina—were in operation at the time of our review. The fourth location in Omaha, Nebraska is scheduled to begin processing DCPS transactions in August 1995. DCPS was paying civilian employees from four DCPS databases in December 1993 and was scheduled to increase the number of databases to nine by August 1995. DOD designated the Financial Systems Activity at Pensacola, Florida, as the Central Design Activity responsible for maintaining and updating the payroll system. The Defense Civilian Personnel Data System (DCPDS)—DOD’s standard personnel system—provides DCPS with most essential personnel information needed to pay Navy civilian employees. DCPDS has an automated interface with the payroll system that is designed to automatically transfer personnel information such as employee name, social security number, job grade or step, and salary. The personnel data is entered into the personnel system by individual Navy Human Resource Offices throughout the country. These Human Resource Offices are the responsibility of the Navy’s Assistant Secretary for Manpower and Reserve Affairs. Generally, Navy civilian employee time and attendance data for actual hours worked is entered into DCPS separately by the timekeepers at the employee’s work location. To evaluate the propriety and accuracy of Navy civilian payroll payments, we performed computer analyses of pay records to (1) determine if payments were made only to authorized personnel and (2) identify any payments made in excess of authorized amounts. To determine if payments were being made to authorized personnel, we obtained and compared electronic copies of Navy civilian payroll and personnel records for the pay period ending December 25, 1993. At that time, DCPS was paying about 188,000 Navy civilian personnel. In addition, we reviewed the Uniform Financial Management System in Arlington, Virginia, and the Uniform Automated Data Processing System, in Honolulu, Hawaii, which paid about 28,000 and 9,000 Navy civilians, respectively, at that time. In total, we reviewed the propriety and accuracy of payroll payments made to about 80 percent of the 281,000 civilians employed by the Navy in 1993. To ensure that we had all and only the payroll data for that pay period, we matched the total payroll amounts for each payroll office with their corresponding payroll certification report. To identify potential improper payments or overpayments, we conducted various computer matches and searches to identify Navy civilians who received multiple DCPS payments; were paid without an active personnel record; were paid at a higher rate than authorized; had high annual leave balances and did not use annual leave, sick leave, or compensatory time in 1993; and were paid by both DCPS and other civilian pay systems. To determine if any payments in excess of authorized amounts existed within the universe of the potential overpayments identified through our tests discussed above, we provided DFAS with our test results and requested that DFAS contact Navy Personnel and jointly determine whether any payments were made in excess of authorized amounts. Because they had not yet responded after 4 months, we contacted about 60 Navy Human Resource Offices throughout the country and requested a copy of the official personnel record showing the authorized pay rate for each potentially overpaid Navy civilian. We compared this pay rate to the rate each potentially overpaid Navy civilian was paid to determine which Navy civilians were actually overpaid. To assess the vulnerability of DFAS’ and the Navy’s civilian payroll internal controls to loss of funds from fraud and abuse, we observed payroll processing, reviewed applicable DCPS documentation (including reports, policies, and regulations), and interviewed cognizant DFAS and Navy Personnel officials. We performed our work at the three active DCPS locations in Charleston, South Carolina; Pensacola, Florida; and Denver, Colorado. We also performed work at two payroll processing locations using other payroll systems at the time of our review—the Uniform Financial Management System in Arlington, Virginia, and the Uniform Automated Data Processing System, in Honolulu, Hawaii. In addition, we performed audit work at the DCPS Central Design Activity in Pensacola, Florida; the Navy Civilian Personnel Data System Center in San Antonio, Texas; and Navy Human Resource Offices in Charleston, South Carolina; Pensacola and Jacksonville, Florida; and San Diego, California. Our work was performed between August 1993 and February 1995 in accordance with generally accepted government auditing standards. We obtained oral comments on a draft of this report from cognizant DFAS and Navy Personnel officials. Their views have been incorporated where appropriate and are further discussed in the agency comments section of this report. Our matching tests of 225,000 payroll and associated personnel records to determine the propriety and accuracy of Navy civilian payroll payments disclosed overpayments to 134 Navy civilians, or less than one-tenth of 1 percent of the accounts tested. This is in contrast to the Army where we found improper payroll payments totaling millions of dollars, including payments to “ghost” soldiers and deserters. As shown in table 1, we confirmed overpayments of $62,500 were made to Navy civilians. However, we also found that total overpayments were actually higher than those we confirmed because some erroneous payments continued for nearly a year. For example, one Navy civilian was paid by DCPS at a rate of $52,217 for 1993, instead of the authorized rate of $47,209. Thus, although the overpayment for the pay period we reviewed was about $190, the total amount overpaid on an annual basis was about $5,000. Because DCPS only keeps payroll records on-line for a 6-month period, and because of the significant amount of resources required to research each overpayment on microfiche, we did not determine the full extent of overpayments associated with the 134 cases we identified. However, the total overpayment amounts are undoubtedly far greater than the amounts shown in table 1. These overpayments were caused, at least in part, because (1) DFAS and Navy Personnel did not reconcile discrepancies between personnel and payroll records and (2) DFAS staff did not compare payments from the various payroll databases to detect unauthorized payments to a single civilian employee. Nonetheless, our examination of payroll records showed that many of the overpayments were identified by DFAS within 6 months of their occurrence. When DFAS detected overpayments, it processed retroactive transactions to change the pay records and to initiate DFAS’ recovery or resolution process. We noted such retroactive adjustments, totaling $50,374, for 45 of the 134 overpaid Navy civilians identified in table 1. As noted previously, we did not determine the extent to which the conditions permitting the specific overpayments we identified resulted in overpayments in other pay periods, nor did we ascertain how DFAS learned of the overpayments for which it initiated retroactive transactions. Instead, in November 1994, we met with cognizant DFAS and Navy Personnel officials and provided them with a comprehensive list of all the overpayments we identified. We requested that they jointly follow up to determine the full extent of overpayments and that DFAS recover these amounts. As of March 1995, DFAS and Navy had not completed their determination of the full extent of overpayments, and as a result had not yet completed necessary recovery actions. Comparisons between the payroll and personnel systems and reconciliations of discrepancies were not routinely done. Specifically, Navy and DFAS compared Navy civilian payroll and personnel files only four times between May 1992 and August 1994. More importantly, discrepancies identified from these comparisons were not resolved because Navy and DFAS had not established procedures for systematic follow-up and correction of identified discrepancies. Had more frequent payroll and personnel comparisons taken place, and any discrepancies systematically researched and their resolution documented, DFAS could have promptly detected and corrected the overpayments we identified. For example, as shown in table 1, we found that DFAS paid 84 civilian employees at a higher pay rate than authorized in their personnel records. These overpayments totaled $5,251 for the one pay period we tested. In addition, table 1 shows that DFAS paid about $7,700 to another 14 individuals who did not have active personnel records. DFAS and Navy Personnel acknowledged that they infrequently reconciled payroll and personnel data. DFAS officials told us that payroll and personnel data reconciliations do occur as part of the conversion process of payroll accounts to DCPS. However, these officials acknowledged that not all discrepancies identified during these reconciliations are researched and resolved prior to the conversion of the payroll account to DCPS. As a result, erroneous information, such as an incorrect pay rates, may be passed from the closing payroll offices to the cognizant receiving DCPS payroll center. The DCPDS/DCPS Payroll Handbook calls for conducting payroll/personnel reconciliations about every 4 months to ensure the accuracy and completeness of the payroll and personnel records. However, DFAS and Navy Personnel officials stated that they had not consistently reconciled differences between payroll and personnel records and pointed out that they did not have procedures to systematically resolve and document the disposition of the discrepancies found during their reconciliations of payroll and personnel records. With the continued rapid consolidation of payroll accounts into the DCPS system, which is discussed later in this report, it is critical that payroll and personnel reconciliations be routinely conducted and that all discrepancies be systematically followed up and resolved. In commenting on this report, DFAS officials told us that they believe the recent addition of edit checks to the electronic interface between DOD’s standard personnel system and DCPS decreased the need for data reconciliation. While not detailing the extent of these changes, DFAS officials told us that DCPS was enhanced to automatically reject and return proposed personnel actions affecting pay if they did not pass recently initiated DCPS edit checks and that this enhancement permitted faster identification of erroneous data. We agree that this improvement in the interface between the personnel and payroll systems could help prevent some of the kinds of overpayments we identified. However, it is unlikely that such edit checks would prevent overpayments arising from Navy civilians receiving multiple DCPS payments or Navy civilians being paid by both DCPS and other payroll systems. In addition, not all personnel information flows through the interface. For example, we noted instances where notices of personnel actions were manually entered into DCPS. Moreover, the reconciliations would be useful for determining the effectiveness of these recently added edit checks. Consequently, we believe that there is a continuing need for data reconciliations between the payroll and personnel systems. As shown in table 1, our audit disclosed that 25 civilian employees were overpaid at least $27,000 because DFAS erroneously paid them from two separate DCPS payroll databases. We found an additional 11 overpayments totaling nearly $22,300 that were caused by payments being processed independently from both DCPS and another payroll system for the same individual. DCPS did not have internal control procedures to determine if multiple payments were made to a single social security number and to ensure that its four databases did not generate undetected erroneous multiple payments to a single individual. DCPS’ vulnerability to erroneous payments from multiple databases is likely to increase because DFAS plans to expand the number of payroll databases from four at the time of our review to nine by the end of fiscal year 1995. In addition to the need for stronger controls to prevent overpayments, DCPS was also vulnerable to improper payments as a result of weaknesses in controls relied on to regulate access to data, document transaction processing, and perform file maintenance. Specifically, DFAS gave most payroll staff unnecessary access to sensitive DCPS data and did not provide for a complete audit trail documenting who made changes to payroll records. In addition, DFAS did not have controls in place to prevent payroll accounts from former employees remaining on the system from being fraudulently reactivated and paid. These internal control weaknesses could result in improper or fraudulent payments. Such internal controls are particularly critical in light of the scope of the ongoing DCPS consolidation effort. DFAS officials have described this as the most aggressive effort ever undertaken in this area, involving the consolidation of about 700,000 accounts from over 350 payroll offices worldwide. They further stated that this effort involved the consolidation of 19 different automated payroll systems and several manual systems operating overseas—all of which they acknowledged were in various states of disrepair. In addition, strong internal controls, including segregating key duties among responsible personnel, are necessary to provide reasonable assurance that assets, such as payroll funds, are safeguarded against loss. Computer access controls, such as those used by DCPS, are intended to permit authorized users to access the system to perform their assigned duties and preclude unauthorized persons from gaining access. However, we found that DFAS unnecessarily granted supervisory access codes to staff that did not have supervisory responsibilities. Supervisory level access, the highest access level DFAS granted to its payroll processing staff, allows individuals to create employee records; enter employee time and attendance data; and change salary amounts, names, and pay destinations. While such access would not enable DFAS payroll processing staff to directly access personnel data in DCPDS, it would enable DFAS staff to add to or modify personnel data—for example, adding employees or modifying pay rates—after transmission to DCPS. To illustrate, a single payroll staff with this access level would be capable of creating and paying a fictitious employee or fraudulently diverting payroll funds to another destination. About 86 percent of the supervisory level access codes at the three DCPS payroll processing locations were granted to nonsupervisors. For example, at the Denver DCPS processing location, 138 staff were granted supervisory level access, including 2 temporary employees, while only 13 had supervisory responsibilities. After our inquiry, Denver officials removed about 20 percent of the supervisory level access codes because the individuals either had left the organization or otherwise should not have had access to the payroll system. However, Denver still had 97 supervisory level access codes granted to nonsupervisors. By granting supervisory level access to payroll processing staff who did not need that level of access, DFAS inappropriately gave the majority of its staff access to both personnel information and time and attendance data. DCPS Security Guidelines Manual states that the system’s design should provide for a separation of duties between payroll clerks in the payroll office. Specifically, a single payroll clerk should not be capable of both creating or changing employee records and entering time and attendance data for the same group of payroll accounts. Further, GAO’s Internal Control Standards state that key duties and responsibilities in authorizing and processing payroll should be separated among individuals. According to DFAS officials, supervisory level access is necessary to perform a wide variety of tasks associated with maintaining payroll operations while converting Navy civilian payroll accounts from their previous payroll systems to DCPS, including the tasks of entering both new pay accounts and time and attendance data. DFAS officials told us that they accepted the increased risk resulting from granting supervisory level access. However, DFAS did not specifically assess whether—and how long—nonsupervisory payroll technicians may need supervisory level access during the period of DCPS consolidation. We believe that the increased risk associated with the large scope of the ongoing DCPS conversion process—which DFAS officials informed us is not scheduled for completion until March 1997—necessitates strong access controls. DFAS officials acknowledged that they needed to identify the appropriate number of staff who should have supervisory access at this time. DCPS’ audit trail contains incomplete information for identifying who was responsible for changing certain types of DCPS data. Lacking such audit trail capability leaves DCPS vulnerable to undetected fraudulent payments. Specifically, DCPS routinely recorded only the identity of the payroll clerk last accessing the payroll account, regardless of whether or not this person made any changes. However, to ensure effective control over changes in personnel data affecting pay, such as name, address, pay destination, and salary amounts, it is critical that DCPS have a complete audit trail identifying the payroll clerk responsible for each change, not merely the payroll clerk last accessing the system. In addition, retroactive transactions to correct or update previous payroll payments did not carry any payroll clerk identification. Audit trails identifying which payroll clerk initiated a change in DCPS data are necessary to document the responsibility for the sequence of events followed in processing a transaction. According to Joint Financial Management Improvement Program requirements, computer systems must provide audit trails to trace transactions from source documents, through successive levels of summarization, to the financial statements and from the financial statements to the source. Guidelines for Security of Computer Applications, Federal Information Processing Standards 73, states that computer system users should be uniquely identified so that they can be held responsible for their activities—it is usually not enough to verify that a user is one of a group of authorized users. It is difficult to detect security breaches unless there is a record of system events which can be analyzed, including information on who accessed the system, what was accessed, and what actions were performed. DCPS is currently incapable of providing a complete audit trail with this level of detail. For example, when DFAS officials in Denver were informed by a civilian that he was overpaid $1,000 in January 1993, DFAS was able to determine that an erroneous change had been made to this employee’s account, but DFAS could not determine which payroll clerk initiated the change in DCPS. The need for a well-documented audit trail is particularly important because, as discussed previously, most personnel have supervisory level access allowing them to access and change all records on a DCPS database. DFAS officials acknowledged the necessity and importance of audit trails. However, they informed us that they have not yet determined a specific course of action on how best to establish a comprehensive audit trail in a cost-efficient manner. The Navy’s civilian payroll was also at risk of fraud and abuse because many payroll accounts of former employees, who should no longer receive pay checks—called inactive payroll accounts—remained on the system. As of December 1993, DCPS had about 40,000 inactive payroll accounts on the system and no controls to prevent these accounts from being reactivated for fraudulent payments. Inactive payroll accounts may be reactivated by anyone with supervisory level access, which as discussed previously is the majority of the payroll clerks, by changing one code in DCPS. Because of the large number of staff with supervisory level access to the payroll system and the incomplete audit trail discussed previously, the risk that these accounts can be fraudulently reactivated is increased. DFAS officials stated that the inactive payroll accounts were maintained on the system until they prepared the W-2 tax information and made all necessary corrections to an employee’s payroll account. Once this process was complete, the inactive payroll files were to be purged from the system in July of the year the W-2s were created. Thus, an inactive payroll record could remain on DCPS for up to 19 months. Compounding this vulnerability, in July 1993, the DCPS Central Design Activity, did not purge the inactive payroll accounts from DCPS, which DFAS officials said accounted for the high number of inactive payroll records found during our testing at the end of December 1993. We agree that DFAS needs to maintain information on inactive accounts to prepare W-2s and make necessary corrections to payroll accounts. However, given the current unstable control environment associated with the ongoing unprecedented DCPS consolidation, we believe that information on inactive accounts should not remain on the active database. This risk can be significantly reduced if payroll accounts of former employees are removed from the active payroll system and placed in a separate database, with appropriately restricted access. Our testing identified insignificant overpayments in relation to the number and dollar amounts of payroll payments made to Navy civilians. However, we did identify internal control vulnerabilities which, if exploited, could permit additional improper civilian payroll payments to occur and not be readily detected. Strengthening DFAS and Navy procedures to restrict access to payroll and personnel data and modifying the DCPS system to provide a reliable audit trail would both help prevent fraudulent payments and detect overpayments when they occur. With the ongoing rapid consolidation of DOD civilian payroll accounts into the DCPS system that is not scheduled to be completed until early 1997, it is critical that top management devote attention and priority to correcting existing control vulnerabilities as soon as possible. In addition, effectively researching and documenting the correction of discrepancies identified through a payroll and personnel record comparison will require the concerted cooperative effort of both cognizant Navy and DFAS officials for personnel and payroll record accuracy, respectively. We recommend that the Assistant Secretary of the Navy for Manpower and Reserve Affairs, and the Director of the Defense Finance and Accounting Service direct appropriate officials to: Complete follow-up on the 134 overpaid employees we identified and referred to DFAS and Navy Personnel officials to determine the full extent of overpayment, collect amounts due, and identify and correct systemic causes of the overpayments. Conduct payroll/personnel reconciliations every 4 months, as called for by the DCPDS/DCPS Payroll Handbook, and establish a requirement for timely systematic follow-up, including research, correction, and documentation of all discrepancies. We recommend that the Director of DFAS: Establish and implement detailed automated procedures documented in the Defense Civilian Pay System Users Manual to detect and correct any unauthorized multiple payments to a single social security number. Assess, on a case-by-case basis, the extent to which nonsupervisory payroll technicians need supervisory level access, and, if so, grant such access for as limited a period as possible. Require the DCPS Central Design Activity to develop an audit trail in DCPS that marks all transactions with a user identification that cannot be overwritten. Remove current inactive payroll records from the active payroll system and place these records in a separate database, with restricted access. Establish and implement detailed written procedures to remove all future inactive payroll accounts from the active payroll system, and place these records in a separate database, with restricted access. DFAS and Navy Personnel officials generally agreed with our recommendations. However, DFAS officials expressed concern that we did not sufficiently recognize the extenuating circumstances brought about by the ongoing rapid consolidation of DCPS processing locations. We believe that the changes DCPS is undergoing warrant adequate controls to ensure that risks associated with such changes are sufficiently mitigated. Given the increased risk associated with the changing environment in which DCPS currently operates, we continue to believe that the findings and recommendations in our report are appropriate. We are sending copies of this report to the Secretary of the Navy; the Chief Financial Officer of the Department of Defense; the Assistant Secretary of the Navy for Financial Management; the Director of the Office of Management and Budget; and to the Chairmen and Ranking Minority Members of the House and Senate Armed Services Committees, the Senate Committee on Governmental Affairs, the House Committee on Government Reform and Oversight, and the House and Senate Committees on Appropriations. This report was prepared under my direction and I may be reached at (202)512-9095 if you have any questions concerning this report. Major contributors to this report are listed in appendix I. Diane Handley, Senior Evaluator The first copy of each GAO report and testimony is free. Additional copies are $2 each. Orders should be sent to the following address, accompanied by a check or money order made out to the Superintendent of Documents, when necessary. Orders for 100 or more copies to be mailed to a single address are discounted 25 percent. U.S. General Accounting Office P.O. Box 6015 Gaithersburg, MD 20884-6015 Room 1100 700 4th St. NW (corner of 4th and G Sts. NW) U.S. General Accounting Office Washington, DC Orders may also be placed by calling (202) 512-6000 or by using fax number (301) 258-4066, or TDD (301) 413-0006. Each day, GAO issues a list of newly available reports and testimony. To receive facsimile copies of the daily list or any list from the past 30 days, please call (301) 258-4097 using a touchtone phone. A recorded menu will provide information on how to obtain these lists.

Summary: GAO reviewed the Navy's civilian payroll operations, focusing on the: (1) propriety and accuracy of payments made to civilian personnel; and (2) vulnerability of the internal control system to prevent fraud and abuse. GAO found that: (1) 134 of 225,000 Navy civilians were overpaid a total of at least $62,500 in 1 year; (2) these overpayments were due to the Defense Finance and Accounting Service's (DFAS) failure to determine if individual civilian employees were paid from multiple databases for the same time period and infrequent reconciliations between civilian payroll and personnel systems; (3) the Navy's civilian payroll operations are susceptible to additional improper payments as a result of many personnel having unrestricted access to payroll data, DFAS inability to identify database changes, and DFAS maintenance of inactive payroll accounts on the active payroll database; and (4) the rapid consolidation of civilian payroll accounts into the Defense Civilian Payroll System could exacerbate control weaknesses if vulnerabilities are not adequately addressed.