KPMG, Idaho DOC Report, CCA Audit
Download original document:
This text is machine-read, and may contain errors. Check the original document to verify accuracy.
Idaho Department of Corrections REPORT December 19th, 2013 ADVISORY Contents Introduction and Scope 2 Records/Information Obtained and Methodology 3 Key Findings and Problematic Areas 5 Recommendations/Limitations 8 Third Party Usage Language: The advice, recommendations, work product, and deliverables provided as part of this engagement has been developed for Idaho Department of Corrections management, and are not intended for use by any other party or for any other purpose, and may only be relied upon by Idaho Department of Corrections management and will be so marked. We disclaim any intention or obligation to update or revise the observations whether as a result of new information, future events or otherwise. Should additional documentation or other information become available which impacts upon the observations reached in our deliverables, we reserve the right to amend our observations and summary documents, including deliverables, accordingly. © 2012 KPMG LLP, a Delaware limited liability partnership and the U.S. member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (“KPMG International”), a Swiss entity. All rights reserved. NDPPS 134906 . 1 Introduction and Scope In June of 2013 the Idaho “Department of Corrections” (DOC) issued a Request for Proposal (RFP) to which KPMG responded. The RFP related to conducting detailed forensic data analysis of various data sources related to staffing and time keeping at one of the correctional facilities for which the Idaho DOC has responsibility. This particular facility was being staffed and managed under a contract which the Idaho DOC entered into with the “Corrections Corporation of America” (CCA). CCA provides services to correctional facilities and manages a number of correctional facilities nationwide. The issues surrounding staffing identified by the Idaho DOC were considered potentially problematic. This was confirmed by the report issued to CCA by external counsel (Baker and Donelson) and subsequently provided to DOC which identified discrepancies in time-keeping records and the duty rosters. The discrepancies identified were limited to the areas within the scope of Baker Donelson’s inquiries. Subsequent to the receipt of the report from Baker Donelson and meeting with Baker Donelson the Idaho DOC decided to have an external third party review various time keeping records for a period of 12 months to determine the pervasiveness of the potential problem and to attempt to quantify the time-keeping problems for a 12 month period at the Idaho Correctional Center (ICC) in Kuna, Idaho. Against this background KPMG was selected by the Idaho DOC as the service provider to analyze the data relating to the hours worked at ICC, the correctional facility in question, and to identify any issues or anomalies in that data. KPMG was provided with a variety of records which are detailed in this report, including but not limited to a copy of the report prepared by the law firm Baker and Donelson and the limited analysis prepared by the Idaho DOC. Our objective was to: Compare shift rosters with the time-keeping payroll data and other records as necessary to determine if the actual hours worked by each employee matched what was reported to the Idaho DOC on the shift rosters. If discrepancies existed we were to enumerate them. Based on the initial information provided, there did not appear to be any dispute about the fact that there were discrepancies between the shift rosters and the payroll records and that “mandatory posts” were not always adequately staffed. There was however, no agreement as to the quantum and nature of the discrepancies, between CCA and the Idaho DOC representing the ICC under the terms of the contract. It is against this background that KPMG: Considered the work that was conducted by the Idaho DOC in relation to this matter; Reviewed the data contained in the report prepared by external counsel on behalf of the CCA; and Commenced a review of 12 months of data to determine what if any discrepancies could be reasonably substantiated regarding the staffing at the facility. It should be noted that KPMG initially intended to conduct this analysis electronically and believed the source documents and other materials lent themselves to this approach. Regrettably, it turned out not to be technically feasible. Accordingly KPMG used a manual approach which was slower, more labor intensive and this impacted timing and cost. Additionally, KPMG considered some of the work requirements to be over and above what was initially agreed upon. The Idaho DOC is aware KPMG exceeded the budgeted time and cost for this engagement however completed this engagement to ensure that the DOC can meet its obligations. KPMG is providing this report at the request of the Idaho DOC and despite the aforementioned difficulties, KPMG focused on completing this project as quickly as possible. This report covers the analysis for the 12 month period covering the full 2012 calendar year. Our work was subjected to suitable quality control procedures to ensure consistency and accuracy of our findings. These findings could change if additional information became available post the issuance of this report. 2 Records/Information Obtained and Methodology Records/Information Obtained KPMG had the opportunity to meet with representatives of the Idaho DOC and at this meeting we were provided with the following documentation: “Security Shift Rosters” (Prepared by hand) “ICC Time Detail Reports” (originating from the Kronos system) A limited analysis of data conducted by Representatives of the Idaho DOC A copy of a document prepared by Baker Donelson “Independent Counsel” for CCA titled Internal Investigation of Idaho Correctional Center, Kuna, Idaho A list of employee codes and an employee roster A document indicating which shifts the Idaho DOC considered to be mandatory per the CCA contract Other varied information pertaining to this matter A verbal briefing on the issues and risks as the DOC perceived them A conference call with representatives of Baker Donelson to better understand their scope and process This information was provided to us in both hard copy and in electronic format. We also had the opportunity to hold a conference call with Mr. Shockley, an attorney with Baker Donelson who was responsible for providing CCA with the report referenced above. During our discussions with Mr. Shockley, he explained the methodology utilized by Baker Donelson with respect to their analysis, their scope (i.e. night shifts only and time period) and their initial observations. Our Methodology KPMG designed its manual data analysis approach to optimize the use of the data made available to us. We conducted our work independently of the information and analysis that had previously been conducted by both Baker Donelson on behalf of CCA and by the Idaho DOC. Our results differ from both of the aforementioned entities for a variety of reasons, some of which are noted below. We were of course aware of the Baker Donelson and DOC work and their initial findings but reached an independent conclusion based on the data made available to us. Also KPMG did not limit itself to the same time frame that Baker Donelson reviewed while the Idaho DOC only reviewed a small portion of the data. Based on our discussions with the Idaho DOC and against the background of the Baker Donelson report we determined that the time sheets extracted from the Kronos payroll system called “ICC Time Detail Reports” were the appropriate and effectively only documents to use as a benchmark against which to gauge the “Security Shift Rosters.” The Security Shift Rosters (SSR) were manually prepared documents purporting to set out which individuals manned which posts in the ICC facility. The SSRs were prepared by CCA employees at the direction of their Assistant Chief of Security. As noted previously KPMG initially attempted to conduct this work using electronic analysis of the data and was unsuccessful in achieving this objective. Accordingly, we conducted a detailed manual analysis of all of the SSR’s for the 2012 calendar year, this constituted over 700 detailed time sheets. Our Selection of the Kronos generated ICC time detail reports as the appropriate source documentation against which to gauge the accuracy of the SSRs was discussed with the Idaho DOC and agreed to by them. 3 The ICC’s detailed time reports used to pay the employees of CCA were not subjected to a separate review, and to enable this work to be conducted we made the assumption that the time reflected in these records from the Kronos system was correct. This approach was agreed to by the Idaho DOC and the same assumptions were made by the Idaho DOC and by the law firm of Baker Donelson for the less comprehensive scope of work they completed. KPMG conducted a completeness review of the ICC detail time reports and believes we have a full population of the source documents from the Kronos system. We tested for completeness by taking the total hours from the Kronos system and reconciling these to the database created by KPMG for the daily hours logged. As noted there is a component of judgment contained in this analysis and with the multiple variables for some of the above named scenarios we exercised our judgment in a conservative fashion to arrive at what are considered to be the discrepancies. KPMG used the ICC detail time reports utilized for payroll purposes and extracted from Kronos as the benchmark data. We compared these time sheets on a shift by shift basis to the SSRs. As part of this process we considered the following: Double booking – Individuals who were listed as working more than one shift at a time (January only at this point) False or non-existent names – Individuals whose name(s) did not appear to correlate to a CCA employee (All months) Non-CO employees – Individuals who were not listed as holding a CO position at the time (All months) *NOTE: Per our interview with Gary Shockley Attorney at Baker Donelson these individuals may still be POST certified, but the positions identified to us by IDOC are below Late or Early Start/Absence – Individuals who worked less hours than the shift was required to be staffed, i.e. worked 6.5 hours on an 8hr shift, including shifts not staffed at all (All Months) Other Causes – Other possible ways that a shift might not have been covered (All months) We were also provided with codes for all CO positions that we utilized in conducting our work to determine if the mandated staffing levels at the various posts were being met. The table containing these codes is set out below. CODE 1005 1014 1026 2051 9003 9012 9053 9101 4 Codes for CO’s DESCRIPTION CHIEF OF SECURITY SHIFT SUPERVISOR ASST CHIEF OF SECURITY INVESTIGATOR CORRECTIONAL OFFICER SR CORRECTIONAL OFFICER CORRECTIONAL OFFICER (PRN) ASST SHIFT SUPERVISOR Key Findings and Problematic Areas KPMG is reporting on our findings for the work completed for the full 2012 calendar year, only. The findings contained in this report are based on the data provided to us and analyzed for the period in question and may be impacted as a result of new information or further analysis that is conducted post the date of this report. . Potential Discrepancies Identified Month January February March April May June July August September October November December Grand Total* Double Booking Hours 251 350 450 426 563 289 311 415 401 189 419 432 4,494 Non‐CO's Hours 698 653 568 1,124 809 996 776 774 640 824 450 454 8,766 Late or Early Start/Absence Hours 593 497 866 846 778 1,016 1,351 1,219 802 701 572 623 9,863 Other Hours 128 279 542 49 120 880 81 44 176 99 302 431 3,130 Grand Total 1,670 1,779 2,425 2,444 2,270 3,180 2,519 2,452 2,019 1,813 1,743 1,940 26,253 Legend: Double Booking Hours: Hours attributable to instances where one or more CCA employees were listed as holding multiple posts in a mutually exclusive manner, i.e. they would not have been in both places at the same time. Non-CO’s Hours: Hours attributable to instances where a CCA employee with an employee code other than those contained in the above table titled “Codes for CO’s,” as of the shift date, was identified as working on a mandatory post. Late or Early Start/Absence Hours: Hours attributable to instances where an employee arrived late, left early, was absent, or otherwise failed to work the full duration of hours required for a mandatory post. Other Hours: Hours attributable to other types of instances such as mandatory posts which were not identified on a Security Staff Roster. As noted we have now completed our review of the data for the time period beginning on January 1 of 2012 and finishing on December 31 of 2012. We note that the discrepancies found during the course of our review and listed in the table above seems to indicate that the problems with discrepancies were at a minimum occurring in January of the 2012 year and continued through the year including December of the 2012 year. The discrepancies appeared to peak in June of 2012. (See chart below) The results of limited select portions of this analysis would appear to be subject to challenge in certain cases because at varying levels they require assumptions that cannot be tested or validated with another independent data source. Having said that, we consider it reasonable, i.e. more likely than not, that a portion of those hours would correlate with posts not being filled as would be required under the terms of the existing contract, only those have been included in the table above. Additionally, when planning and 5 executing our work we utilized a conservative approach in determining whether to include certain discrepancies in the overall totals and for those instances where there was an inability to ascertain with any level of certainty the manning of a post, a double booking or other discrepancies we did not include those hours as a discrepancy. Utilizing this conservative approach we determined that over the 12 month period under review there was a discrepancy of over 26,000 hours attributable to a variety of issues. Certain discrepancies are fairly straight forward, for example late or early/start absences, while others were significantly more complicated to identify and analyze. Hours 3,500 3,000 2,500 2,000 1,500 1,000 500 0 As a result of our conservative approach it is possible that our analysis understates the number of hours that could potentially be identified as unstaffed using the criteria provided to us by the Idaho DOC. However, our work does demonstrate that the problems identified were occurring during the full period of time we reviewed. Additionally, our work was more comprehensive than that of Baker Donelson who only looked and limited time periods and excluded day shifts. With respect to the work conducted by the Idaho DOC we utilized a more conservative approach in determining the discrepancies which were computed for only one week in June. It should be noted that the representative for the law firm Baker Donelson claimed that just because a CCA employee does not have a job code as contained in the table “Codes for CO’s” does not mean that person is not a POST-certified corrections officer. This issue could potentially impact the number of hours in question for part of the analysis but, would still leave a significant amount of hours as a discrepancy. It should be noted that due to the unreliability of the Security Shift Rosters and the lack of other corroborative information we would have difficulty coming up with a definitive number of hours related to that one particular fact pattern. In short it would be an assertion that would be hard to prove or disprove. . Baker Donelson Report Findings While we have not reviewed the detailed work conducted by Baker Donelson and we acknowledge their scope was different than ours. We additionally note the following: 6 Baker Donelson looked at the night shift only and did not consider issues during the day. We acknowledge based on our work to date that the night shift revealed a larger number of discrepancies, although the day shift also had issues. The issues we located in the day shift are included in our totals. 7 Baker Donaldson only reviewed a limited amount of months and for example did not review the first three months of the year. We located discrepancies in those first three months. Solely as a result of our analysis including hour discrepancies for both the day and the night shifts, as opposed to only the night shifts the hour discrepancies reported by KPMG are higher and more reflective of the actual circumstances. We do note that for the months of June and October, which both Baker Donelson and KPMG analyzed, there is a significant difference in the number of hours noted as being unaccounted for. This may be attributable to some of the factors listed above. However, as we have not reviewed the detailed Baker and Donelson time sheet analysis we cannot comment on that conclusively. Recommendations/Limitations KPMG completed the review for January 2012 through December of 2012 and conducted suitable quality control procedures over the analysis conducted for each month. This report is our final report and completes the tasks were requested to conduct by the DOC including those items we consider to have been in addition to what was initially agreed upon. Please note KPMG was not engaged to perform an audit, attestation, review, or compilation of financial statements or financial information, as those terms are understood and defined by professional guidance promulgated by applicable accounting principles, such as the American Institute of Certified Public Accountants (“AICPA”) and, accordingly it expresses no opinion or other form of assurance on the financial statements or financial information of the Idaho DOC. Any terminology used in this report, such as the term “independent”, is to be understood as such term is used in the content of normal usage and not as such term is defined by the AICPA or other local regulatory authorities in connection with, among other things, audits, reviews, compilations or other attestation services rendered by Certified Public Accountants. Based on the work conducted and our subsequent findings we recommend that the Idaho DOC consider the following: Consider the number of hours for which the discrepancy was calculated and determine the course of action the DOC might contemplate taking with respect to resolving the issues the discrepancies have raised. Idaho DOC should consider the need to review periods prior to January 2012 and post December 2012 to determine if there are additional discrepancies that they may need to resolve. Consider developing suitable “dashboards” and protocols to allow for better oversight of third party service providers and to enable the identification of improper documentation sooner. 8