County auditor flags gaps in HR payroll controls, recommends 20 fixes

Salt Lake County Auditor Chris Harding told the County Council on March 11 that an audit of countywide payroll responsibilities found weaknesses in background-check practices, access controls to employee records, controls over service awards and inconsistencies in lump-sum pay calculations.

The audit covered Sept. 1, 2021, through Aug. 31, 2022, and resulted in 20 recommendations. Harding said the audit report has been posted to the auditor’s office website and the county’s Human Resources department has agreed to the recommendations and begun implementation work.

“The things we’re looking for are to make sure that internal controls are there, that they’re happening, that, as management, those charged with governance, that we’re following the policies and procedures,” Harding said during his presentation.

Auditors described several primary concerns: inconsistent background-check records across agencies, payroll administrators with excessive system access, insecure physical storage of personnel records, duplicate service-award payments and gaps in documentation and verification for lump-sum payments.

Pete Buschah, senior internal auditor, said payroll administrators had read-and-write access to sensitive fields in PeopleSoft — including Social Security numbers and bank-account details — which raises risk of unauthorized changes or fraud. He also noted a key left on top of a filing cabinet containing sensitive employee information in a room accessible to county facilities and janitorial staff.

“Payroll administrators are responsible for calculating employee hours, deductions, and adjustments on paychecks; this access poses significant risks such as unauthorized changes to payroll,” Buschah said.

The audit team found 12 employees received duplicate service-award payments across two pay periods totaling $1,650, and they identified four employees who were eligible for a 1% lump-sum payment but had gaps in documentation or delayed payments; three later received payment and the fourth was ineligible because the employee did not return from leave.

Auditors recommended HR strengthen and standardize policies (including background checks, offboarding and award documentation), limit PeopleSoft access to job-needed permissions and segregate duties, secure physical personnel records (including key control), develop standardized documentation and independent verification for lump-sum and merit payments, and establish monitoring to prevent and recover duplicate awards.

Abigail Dalton, an internal auditor on the team, summarized the recommended controls and the follow-up process: HR agreed to all 20 recommendations and the auditor’s office will follow up no earlier than six months and again no earlier than one year to assess implementation progress.

Councilmember Angela Romero commended the audit team for the work and clarity of presentation.

The audit’s findings do not allege fraud; they describe control weaknesses and documentation gaps and recommend corrective actions. The County Auditor’s office will return with follow-up reports on the status of the 20 recommendations.