WIXLIB

ursouthwesternMedical CenterExecutive SummaryWe would like to thank the Leave Administration department for the courtesies extended to us and for their cooperation during our audit.Sincerely,Valla F. Wilson, Associate Vice President for Internal Audit, Chief Audit Executive, Interim Chief Compliance & HIPAA Privacy OfficerAudit Team:Melinda Lokey, Director, Internal AuditRobin Irvin, Manager, Internal AuditAngeliki Marko, Supervisor, Internal AuditDelaunda McCown, Senior Auditorcc:Beth Aubry, Supervisor, Leave AdministrationArnim E. Dontes, Executive Vice President, Business AffairsKathryn Flores, Assistant Vice President and Chief Information Officer, University HospitalsDevona Gray, Director, Employee Benefits & Retirement & Wellness ProgramsTrissi Gray, Director, Health System Compliance, Office of ComplianceLeah A. Hurley, J.D., Vice President, Legal AffairsJodi Levy, Assistant Vice President, Administrative SystemsMarc Milstein, Vice President and Chief Information Officer, Information ResourcesHeather Mishra, Associate Vice President, Academic and Administrative Information ResourcesVinod Nair, Director, Revenue Cycle and Business SystemsAngela Sanchez Alonzo, Interim Director, PayrollErin Sine, J.D., Director/Managing Attorney, General Legal ServicesJulie Sirkin, Assistant Vice President, Compensation, Benefits and Human Resource Information Systems (HRIS)Thomas Spencer, Ph.D., Assistant Vice President, IR Operations and Compliance, Academic and Administrative InformationResources19:02 Leave Administration AuditPage 7 of 20

UT SouthwesternMedical CenterDetailed Observations and Action Plans MatrixInstitutional ObservationsObservations in this section are issues identified that are outside the direct controlfor the function under review19:02 Leave Administration AuditPage 8 of 20

UTSouthwesternMedical CenterDetailed Observations and Action Plans MatrixObservationIRecommendationRisk Rating: Medium n1. Improve Controls that Ensure AccurateKronos Time TrackingEmployee home department processes are notadequate and controls are not in place to ensureappropriate Kronos transactions are recorded foremployees with approved FMLA or ParentalLeave, resulting in an increased risk of inaccuraterecords and non-compliance with laws andregulations.Kronos leave time reporting data compared toLeave Administration records identified thefollowing: Inaccurate leave type categories wereselected in Kronos by the employee’s homedepartment timekeeper:o 194 employees have approved ParentalLeave coded in Kronos as FMLA.o 66 employees have approved FMLA Leavecoded in Kronos as Parental Leave.Kronos does not deduct accruals fromemployee VSL (Vacation & Sick Leave)available balances when using the FMLALeave and Parental Leave tracking codes:o This tracking is currently optional and forinformational purposes only.o Departmental timekeepers were nottrained or were unaware of the way toappropriately process Kronos transactions.1. Define departmental Kronostransaction processing requirementsand expected controls that ensureappropriate recording of leave timetransactions.2. Update training and provide refreshereducation to department managersand supervisors, including timekeeperspecific training, on responsibilities forcomplying with leave policies andFederal regulations. Additionally,communicate with leaders to reinforcethese responsibilities to theirdepartments.3. Continue with plan for designing andimplementing a robust leaveadministration system. Evaluatesystem features that strengtheninternal controls and meet LeaveAdministration administrative needs.Ensure that system data integrity andaccuracy complies with federal andstate requirements, and institutionalpolicies.19:02 Leave Administration AuditManagement ResponseManagement Action Plans:1. Evaluation of Kronos leave trackingfeatures is in process and will be used todevelop a project plan for enhancementof Kronos.2. A. We will develop a refresher trainingplan for supervisors and timekeepers.The Kronos training team will conductKronos training for timekeepers. Inaddition, Legal will reinforce duringleader training and the LeaveAdministration team will revise emailcommunications to managersmanaging employees on an approvedleave.B. Training will also be included in thenew Leave Administration systemproject plan.C. Payroll will update the Kronos Cornerintranet resources as necessary.D. Communicate with the leaders toreinforce these responsibilities withintheir department.3. It is imperative that we develop a plan forimplementing a robust leaveadministration system. Cross-functionalcollaboration (e.g., Payroll, InformationResources, Legal) will be included in thenew Leave Administration system projectplan.Page 9 of 20

UTSouthwesternMedical CenterDetailed Observations and Action Plans MatrixObservationIooSupervisors or employees did not validateKronos transactions for accuracy.Procedures for periodically reviewingemployee leave balances forreasonableness were not in place.Recommendation4. Determine quality assurancemonitoring plan and includedepartmental monitoring proceduresthat ensure departments comply withleave policies, provide accurate leavereporting, and process transactions inaccordance with approved leave.5. Implement reconciliation processesthat monitor Kronos leave tracking toleave amounts approved by LeaveAdministration (e.g., FMLA Leave andParental Leave).Management Response4. Kronos monitoring activities will beincluded in the new Leave Administrationsystem project plan.5. Reconciliation processes for monitoringKronos activities will be included in thenew Leave Administration system projectplan.Action Plan Owners:1. Interim Director, PayrollAssistant Vice President, Compensation,Benefits and Human ResourceInformation Systems (HRIS)2. Assistant Vice President, Compensation,Benefits and Human ResourceInformation Systems (HRIS)Assistant Vice President, IR Operationsand Compliance, Academic andAdministrative Information ResourcesInterim Director, Payroll3. Assistant Vice President, Compensation,Benefits and Human ResourceInformation Systems (HRIS)Assistant Vice President, IR Operationsand Compliance, Academic andAdministrative Information Resources19:02 Leave Administration AuditPage 10 of 20

UTSouthwesternMedical CenterDetailed Observations and Action Plans MatrixIObservationRecommendationManagement ResponseDirector/Managing Attorney, GeneralLegal ServicesInterim Director, Payroll4. Assistant Vice President, Compensation,Benefits and Human ResourceInformation Systems (HRIS)Interim Director, Payroll5. Assistant Vice President, Compensation,Benefits and Human ResourceInformation Systems (HRIS)Interim Director, PayrollTarget Completion Dates:1. Identify requirements – August 31, 2019Develop project plan – September 30,20192. a. May 31, 2019b. February 28, 2020, or concurrent withgo-livec. September 30, 20193. February 28, 2020, or concurrent with golive4. February 28, 2020, or concurrent with golive5. February 28, 2020, or concurrent with golive19:02 Leave Administration AuditPage 11 of 20

UT SouthwesternMedical CenterDetailed Observations and Action Plans MatrixLeave AdministrationObservations19:02 Leave Administration AuditPage 12 of 20

UT SouthwesternMedical CenterDetailed Observations and Action Plans MatrixObservationRecommendationManagement ResponseRisk Rating: Medium n2. Enhance Monitoring Processes and Controlsto Ensure Timely FMLA Intermittent orReduced Schedule Tracking ComplianceLeave Administration does not have monitoring orreporting processes in place to identify and followup on missing monthly intermittent or reducedschedule FMLA leave tracking forms. Withoutmonitoring controls and enforcement ofprocedures, employees can abuse FMLAintermittent leave and impact departmentproductivity.Once FMLA Intermittent or Reduced ScheduleLeave is granted for employees, departmentmanagers and employees have a sharedresponsibility to submit to Leave Administrationmonthly tracking forms to report the FMLA daysand hours used. When the hours used are notreported to Leave Administration, it is difficult toprovide an accurate calculation of hoursremaining for FMLA to managers or employees.Until the new, more robust leaveadministration system plannedimplementation is complete, the followingshort term solutions are necessary:1. Implement monitoring processes toconfirm receipt of FMLA MonthlyIntermittent or Reduced ScheduleLeave tracking forms and ensurefollow up process is in place fordepartments and employees who donot comply with monthly submissionrequirements. Ensure hours used areupdated to prevent excess usagebeyond what has been approved.2. Provide routine and consistentreporting of FMLA available andremaining leave balances tosupervisors and employees afterintermittent or reduced schedule leaveis used.Reminders are manually processed by the LeaveAdmin Specialist when the employee is nearingthe approved hours limit. Updates are provided toemployees and supervisors upon request and nomore frequently than once every 30 day period.Management Action Plans:1. In the interim before implementing a newsystem, we will develop a monitoring planand send reminders to departmentleaders and employees until we receivemonthly tracking forms.2. We will evaluate, determine, andimplement the most cost effective methodfor performing the appropriatenotifications once intermittent or reducedschedule leave has been used. Additionaltemporary resources may be needed.Action Plan Owners:Assistant Vice President, Compensation,Benefits and Human Resource InformationSystems (HRIS)Assistant Vice President, AdministrativeSystemsTarget Completion Dates:1. June 30, 2019, dependent on availabletechnical support within InformationResources2. June 30, 2019Monitoring opportunities are largely due to havingmanual processes, lack of an automated systemand limited staffing. Manual follow up trackingwould be more labor intensive.19:02 Leave Administration AuditPage 13 of 20

UT SouthwesternMedical CenterDetailed Observations and Action Plans MatrixIObservationRisk Rating: Medium n3. Enforce Policy for Return To WorkAuthorization SubmissionsInstances occurred where employees havereturned to work from approved FMLA leave fortheir own serious health condition withoutproviding the required return to workauthorization. Returning to work withoutsubmitting medical clearance increases risk to theemployee and the institution if an employee isunable to perform duties safely.The Family and Medical Leave Policy (EMP-256)requires employees and supervisors/managers toprovide both department manager and LeaveAdministration an anticipated return to work date.The “Supervisors Guide to Managing FMLA”includes a requirement to provide LeaveAdministration with authorizations from a medicalprovider that allows employees to return to workafter taking leave for their own serious healthcondition.Monitoring and follow up is not in place andsystem controls are not available to notify LeaveAdministration when approved time is near theend of the period to ensure appropriatedocumentation is obtained when employeesreturn to work after taking leave for their ownserious health condition. Often times, employeesreturn to work early without notifying LeaveAdministration and departments do not require arelease from the medical provider authorizingearly return.Recommendation1. Revise communication to supervisorsto include clear responsibility that thedepartment needs to monitor andensure a return to work authorization isreceived from all employees returningfrom a block of FMLA leave for theirown serious health condition.2. During the design phase of the newsystem, establish the appropriatecommunication method for requestingreturn to work authorizations andnotifications to Leave Administration.3. Update training to timekeepers,supervisors, and managers to includeLeave Administration requirements fordepartments and employees.Management ResponseManagement Action Plans:1. We will program automated notices thatgo out to employees and supervisors.2. We will send communications todepartments as a reminder of theprocedures to follow prior to the return towork date and clearly state departmentsshould not allow employees to return untilthey follow the proper process.3. We will include the HR Essentials trainingprogram in Taleo course assignments forall leaders.Action Plan Owners:1 - 3. Assistant Vice President,Compensation, Benefits and HumanResource Information Systems (HRIS)3. Assistant Vice President, IR Operationsand Compliance, Academic andAdministrative Information ResourcesTarget Completion Dates:1. June 30, 2019, dependent on availabletechnical support within InformationResources2. June 30, 20193. June 30, 201919:02 Leave Administration AuditPage 14 of 20

UT SouthwesternMedical CenterDetailed Observations and Action Plans MatrixIObservationRecommendationRisk Rating: Low n4. Establish and Implement Timelines for AllLeave TypesParental and Leave Without Pay requests do nothave established timeline expectations. Responsetimes for review and approval of these leavetypes, that are not subject to federal regulations,are on average 18 days, and significantly higherthan other leave types that have federal regulationresponse timeframes such as FMLA (e.g., 5days).Although Parental and Leave Without Payaccounts for 1% of the Leave types, withoutestablished response timelines delays maynegatively affect benefit decisions and may resultin employee dissatisfaction.Management ResponseManagement Action Plans:1. Establish formal timelines andimplement response metrics for allleave types.1. We will define formal response timelinesfor Parental Leave and Leave WithoutPay.2. Update policies including departmentrequirements for established timelines.2. In the policy re-write, defined responsetimelines will be included.3. Develop monitoring processes toensure Leave Administration isresponding timely to leave requests inaccordance with established timelinesand in compliance with departmentpolicy.3. Utilizing information tracked in Oracle andOnBase, provide periodic reporting ofactual response time to defined timelines.Within the new Leave Administrationsystem, procedures to monitor responsetimeliness will be established andimplemented.Action Plan Owners:1. Assistant Vice President, Compensation,Benefits and Human ResourceInformation Systems (HRIS)2. Assistant Vice President, Compensation,Benefits and Human ResourceInformation Systems (HRIS)Director/Managing Attorney, GeneralLegal Services3. Assistant Vice President, AdministrativeSystems19:02 Leave Administration AuditPage 15 of 20

UT SouthwesternMedical CenterDetailed Observations and Action Plans MatrixIObservationRecommendationManagement ResponseTarget Completion Dates:1. Completed2. April 30, 20193. April 30, 2019, dependent on availabletechnical support within InformationResources19:02 Leave Administration AuditPage 16 of 20

UT SouthwesternMedical CenterAppendix A – Risk Classifications and DefinitionsAs you review each observation within the Detailed Observations and Action Plans Matrix of this report, please note that we have included a colorcoded depiction as to the perceived degree of risk represented by each of the observations identified during our review. The following chart isintended to provide information with respect to the applicable definitions and terms utilized as part of our risk ranking process:Degree of Risk and Priority of ActionRisk Definition- Thedegree of risk that existsbased upon the identifieddeficiency combined withthe subsequent priority ofaction to be undertaken bymanagement.PriorityAn issue identified by Internal Audit that, if not addressed immediately, has a highprobability to directly impact achievement of a strategic or important operationalobjective of a UT institution or the UT System as a whole.HighA finding identified by Internal Audit that is considered to have a high probabilityof adverse effects to the UT institution either as a whole or to a significantcollege/school/unit level. As such, immediate action is required by managementin order to address the noted concern and reduce risks to the organization.MediumA finding identified by Internal Audit that is considered to have a mediumprobability of adverse effects to the UT institution either as a whole or to acollege/school/unit level. As such, action is needed by management in order toaddress the noted concern and reduce the risk to a more desirable level.LowA finding identified by Internal Audit that is considered to have minimal probabilityof adverse effects to the UT institution either as a whole or to a college/school/unitlevel. As such, action should be taken by management to address the notedconcern and reduce risks to the organization.It is important to note that considerable professional judgment is required in determining the overall ratings presented on the subsequentpages of this report. Accordingly, others could evaluate the results differently and draw different conclusions. It is also important to note thatthis report provides management with information about the condition of risks and internal controls at one point in time. Future changes inenvironmental factors and actions by personnel may significantly and adversely impact these risks and controls in ways that this report didnot and cannot anticipate.19:02 Leave Administration AuditPage 17 of 20

ursouthwesternMedical CenterAppendix B – Leave Institutional Systematic ProcessingThe following diagram depicts the systematic processing tools utilized for employee leave.Leave Tracking System- Developed to track and manage keyLeave Administration data relating toleave recordsHR Module System- Utilized to verify the eligibility criteriafor employees requesting leavetEnterprise Content ManagementSystemWorkforce Management System- Utilized to manage Leavedocumentation and track sent andreceived correspondence- Time keeping activities are recordedin Kronos and transmitted toPeopleSoft HCM to update payroll andleave accruals19:02 Leave Administration AuditPage 18 of 20

ursouthwesternMedical CenterAppendix C – Leave Type Volume TrendingLeave type volume trending from January 2018 through January 2019 indicates continued growth in the number of leave requests thatare processed and managed each month by the Leave Administration team.Leave Type Volume TrendingCalendar Year 2018 through January 2019300025002000150010005000-January 2018February2018March 2018April 2018 Catastrophic Sick leave FMLAMay 2018June 2018 FMLA IntermittentJuly 2018--I-August 2018 September October 2018 November20182018 NON-PAID LEAVE PARENTAL LEAVE19:02 Leave Administration Audit-December January 20192018 SICK LEAVE DONATIONSPage 19 of 20

ursouthwesternMedic

Family and Medical Leave Act (FMLA) The FMLA is a Federal law that requires UT Southwestern to provide FMLA leave to eligible employees for medical, family, and military qualifying reasons. Employees are entitled to take up to 12 workweeks (26 for certain military reasons) of job-protected, unpaid leave in any 12-month leave year. The FMLA also .