July 28, 2022
Investigative Report I2020-0151

The Governor of California
President pro Tempore of the Senate
Speaker of the Assembly
State Capitol
Sacramento, California 95814

Dear Governor and Legislative Leaders:

My office's investigations division identified a fraudulent payroll scheme at the Department of General Services (DGS) that caused the State to pay $185,000 in unearned pay and benefits. We found that for nearly four years, a supervisor conspired with a subordinate custodian and falsified timesheets and training records to make it appear that the custodian was performing full‑time work for the State even though he did not report to work. In return, the custodian shared a portion of his unearned pay with the supervisor. A building manager's supervisory neglect enabled the fraud and led to additional time abuses that we estimate resulted in payments of unearned wages ranging from $52,200 to $98,750.

The complaints that my office investigates are submitted to us in accordance with the California Whistleblower Protection Act, through which the Legislature encourages state employees to report waste, fraud, abuse of authority, or violation of law without fear of retribution and declares that public servants best serve the citizenry when they can act with candor and honesty. The Act also authorizes my office to issue public reports about substantiated allegations when the State Auditor determines that it serves the interests of the State.

When we notify a state agency or authority of a substantiated allegation, the entity must report to my office within 60 days any corrective or disciplinary action it takes in response to our recommendations, and it continues to report monthly thereafter until it has completed corrective action. In May 2022, DGS provided its response, which we have summarized herein.

Respectfully submitted,

MICHAEL S. TILDEN, CPA
Acting California State Auditor

Investigative Results

Results in Brief

From 2016 through 2020, a custodian supervisor (supervisor) who worked for the Department of General Services (DGS) and a custodian who reported to him conspired to carry out an illegal payroll scheme that defrauded the State of $185,000 in unearned pay and benefits. The scheme involved the supervisor falsifying timesheets to make it appear that the custodian was performing full‑time work for the State for nearly four years even though the custodian did not report to work during this period. Each month around payday, the supervisor obtained the custodian’s paycheck and then arranged to meet the custodian off‑site to deliver the unearned paycheck. In exchange, the custodian provided cash payments to the supervisor. When questioned during the investigation, both the supervisor and custodian eventually admitted to perpetrating the fraud.

A former building manager (building manager) who oversaw the supervisor and custodian failed to provide even minimal oversight to the employees for whom he was responsible, enabling them to execute their criminal scheme. His lax oversight also allowed the supervisor and an office technician to engage in additional time abuses that we estimate resulted in payment of unearned wages ranging from about $52,200 to $98,750. Despite receiving multiple complaints of the supervisor’s time and attendance abuse, the building manager failed to take appropriate action to investigate. By neglecting his supervisory duties and failing to cultivate a culture of accountability among his staff, the building manager enabled the improper governmental activities identified in this report to occur, at an estimated cost to the State of $284,000 in improper pay and benefits.

Background

Our office initially received an allegation that the supervisor had engaged in fraud when filling out his own timesheets. We requested DGS’s assistance in December 2020 to investigate the matter. Shortly after receiving our request, DGS staff discovered evidence of possible payroll fraud involving the supervisor and the custodian.

Because of the severity of the possible fraud, DGS forwarded the initial allegation and the newly discovered allegation to the California Department of Justice (DOJ) in January 2021 for criminal investigation. When we learned that DGS had forwarded both matters to DOJ, we requested that DOJ provide us with the status of these investigations in accordance with our statutory authority. DOJ responded by stating it had closed these investigations without providing an explanation for its decision. Our office therefore obtained the investigative materials DOJ had collected and investigated both the initial allegation of timecard fraud and the allegation of payroll fraud.

Payroll fraud typically involves an employee who intentionally makes false claims for compensation to cause an employer to issue unearned payments or other benefits. An employee can perpetrate payroll fraud in various ways, including by fabricating hours on timesheets or by having a coworker clock in and out for the employee. Under state law, payroll fraud perpetrated against a public employer may give rise to prosecution of an employee for multiple, separate violations of the Penal Code, including embezzlement and misappropriation of public funds and falsification of accounts by a public employee. When two or more employees agree to carry out a payroll fraud scheme and one of them commits an overt act toward that end, all of the employees involved may be prosecuted for the crime of conspiracy. Further, all the employees who are part of the agreement can be held legally responsible for the crimes committed by the others during the course of carrying out the scheme, even if they were not directly involved in those specific crimes.

Payroll fraud by a state employee that constitutes a Penal Code violation can have serious consequences for that employee. It can result in a felony conviction, incarceration in state prison, ineligibility to hold public office in the State, and forfeiture of retirement benefits.

A Supervisor and Custodian Worked Together to Defraud the State of Nearly Four Years of Unearned Salary and Benefits

In November 2016, DGS appointed the custodian to his position. The supervisor was the hiring manager for the recruitment and was primarily responsible for all key aspects of the recruitment process. Together with the building manager, to whom the supervisor reported, the supervisor reviewed and scored all submitted applications, interviewed prospective candidates, and ultimately selected the custodian for appointment. Although the supervisor had worked with the custodian from 2012 to 2014 at another state agency, the supervisor did not disclose this fact to the other hiring panelist. The supervisor told investigators that he did not hire the custodian with the intent to defraud the State; however, the supervisor and custodian initiated their payroll fraud scheme shortly after the custodian was hired.

From December 2016 until the custodian resigned from DGS around August 2020, the supervisor and custodian defrauded the State of $142,000 in monthly salary payments and $43,000 in benefits, bringing their total theft to approximately $185,000. As Figure 1 shows, the custodian stopped coming into work about one month after he started in his position. Investigators found no documentary evidence that the supervisor took any formal corrective action to address the custodian’s absences, despite the custodian’s failure to perform his assigned duties after December 2016. Instead of proceeding with any corrective action, the supervisor discussed the payroll scheme with the custodian. After agreeing to carry out the payroll scheme, the supervisor filled out, approved, and submitted the custodian’s fraudulent timesheets to falsely represent that the custodian had worked his regular shifts. The supervisor then personally delivered the custodian’s paychecks to him until about August 2020. In return, the custodian paid the supervisor a portion of each delivered paycheck.

Figure 1

The Supervisor and Custodian Committed Payroll Fraud

When we questioned the supervisor, he initially denied that he had engaged in fraud. The supervisor first claimed that the custodian was “always” at work and that he “saw [the custodian] every day.” However, after we described the significant amount of evidence supporting that the custodian had stopped working in December 2016, the supervisor admitted to falsifying and approving the custodian’s timesheets for several years. The supervisor also stated that he delivered the custodian’s paychecks to the custodian and that he had accepted multiple cash payments from the custodian in exchange for enabling the scheme.

The supervisor described the origin of the scheme as unintentional. He stated that he notified the building manager when the custodian first began to call out sick but claimed that the building manager instructed him to continue paying the custodian with the expectation that the custodian would make up any missed time later. The supervisor acknowledged that he should have notified the building manager when the custodian continued to be absent but admitted that he chose not to so he could keep collecting kickbacks from the custodian.

When interviewed, the supervisor attempted to minimize the lengths to which he went to conceal the custodian’s absence. For instance, the supervisor denied making any special effort to pick up the unearned paychecks issued to the custodian each month. However, many witnesses noted that the supervisor was careful to intercept and distribute the paychecks personally each month, even going so far as to come to work on his scheduled days off to distribute paychecks to custodial staff. Witnesses shared that when another DGS employee picked up the checks from the mailroom before the supervisor on one occasion, the supervisor became irate and yelled at the employee to never do so again. In addition, the supervisor claimed that he never falsified training documentation for the custodian. However, our investigation found that the supervisor forged the custodian’s signature on multiple training attendance rosters and falsely attested to DGS staff that the custodian had attended a required training.

The custodian also initially denied the allegations when questioned, claiming that he had performed other tasks for the supervisor in exchange for continuing to collect his paycheck. However, after learning that the supervisor had confessed, the custodian admitted that the only work he did from December 2016 through August 2020 consisted of delivering documents two or three times to DGS’s headquarters in Sacramento.

Both the custodian and the supervisor asserted that the other received the majority of the unearned pay, but neither claim is credible. The custodian told investigators that the supervisor approached him with the scheme and that he regularly gave the supervisor about $1,300, more than half of his monthly paycheck. Further, the custodian claimed that his participation in the scheme lasted for only about one year and that he did not receive any paychecks after that point. We did not find this last claim credible because all but two of the 46 paychecks we reviewed bore an endorsement signature that strongly resembled the custodian’s, supporting that he personally endorsed nearly all of the paychecks during the four‑year span in question. In contrast, the supervisor claimed that he received up to $300 in cash from the custodian on about 15 occasions, for a total of at most $4,500 (about three percent) of the $142,000 DGS paid to the custodian. However, the supervisor was not truthful in response to other questions, denied participating in the fraud when we initially asked him about the payments, and admitted that he kept the scheme going to continue receiving a portion of the custodian’s paycheck. Given the supervisor’s lack of credibility, we believe that the custodian most likely paid the supervisor about $1,300 every month from December 2016 through August 2020 and kept the remainder.

By planning and carrying out the fraudulent payroll scheme together, the supervisor and custodian very likely engaged in a criminal conspiracy. They also appear to have violated sections of the Penal Code that prohibit the embezzlement and misappropriation of public funds and the falsification of accounts by a public employee, which can include falsification of timesheets.

In December 2020, DGS hired a new manager who was responsible for overseeing all DGS staff within the building. When he conducted a review of outstanding personnel actions, he found documentation related to the custodian’s resignation in late August 2020. He asked his subordinates about the custodian and found that no one was familiar with him. Even the on‑site office technician who processed the custodian’s separation documents claimed she did not know the custodian. After reviewing the custodian’s physical punch cards and electronic keycard records, the new manager learned that his last physical presence in the DGS building was mid‑December 2016. Once the new manager discovered that the custodian had not come to work for nearly four years, he immediately escalated the matter to DGS’s headquarters.

A Building Manager’s Neglect of His Duties Enabled the Payroll Fraud Scheme

For a number of reasons, the former building manager who directly supervised the supervisor should have noticed the custodian’s absence from among the modest crew of about 20 employees he oversaw. First, the building manager was part of the hiring panel that interviewed and subsequently hired the custodian. Second, the custodian’s name was regularly included on office‑related documents, such as employee directories, training rosters, and officewide emails. Third, the building manager’s assigned hours required him to be present at the building at the same time the custodian should have been working. Had the building manager exerted even minimal effort in executing his duties as a supervisor to ensure accurate time and attendance records, he would have noticed that the custodian was absent. His superiors at DGS’s headquarters echoed this sentiment, noting that had the building manager performed his duties, the fraud would likely have been caught in a few months.

Instead, the building manager’s neglect provided the supervisor with the opportunity to execute the scheme for an extended period. When investigators informed the building manager that the custodian had allegedly stopped coming to work in 2016 even though he did not resign until nearly four years later, the building manager laughed and said that something like that very well might have happened. As we previously indicated, the supervisor claimed that he notified the building manager of the custodian’s absence and that the building manager instructed him to allow the custodian to make up the time; however, the building manager denied doing so. Nevertheless, the building manager should have recognized that an employee whom he hired was never present at work even if the supervisor did not inform him of the custodian’s absences.

The Building Manager’s Inadequate Oversight Allowed Employees to Commit Additional Attendance Abuses

The building manager also failed to adequately supervise his direct subordinates, which allowed them to collect pay from the State for thousands of hours that they did not work. Specifically, the supervisor failed to account for about 1,350 hours, valued at $29,600, from January 2019 through his resignation in October 2020. Similarly, an office technician who reported to the building manager failed to account for about 1,120 hours, valued at $22,600, from January 2019 through August 2021. These failures, when considered with the supervisor's and custodian’s fraud, point to gross misconduct on the part of the building manager.

The building manager’s failure to monitor the supervisor’s attendance allowed the supervisor to be paid for time he did not work. DGS required the supervisor to work a typical schedule: eight hours per day, five days per week. As an hourly employee, the supervisor should have charged leave for any length of absence. However, keycard records show that from January 2019 through October 2020, the supervisor averaged just 5 hours and 32 minutes of work per day, or about 69 percent of his assigned work hours. The supervisor stated that the building manager allowed him to come and go as he pleased, and other witnesses confirmed that the building manager allowed the supervisor to have a “relaxed” schedule. When asked about the supervisor’s hours, the building manager denied granting him this sort of flexibility and said that he expected staff to charge leave if they left early. Regardless of his stated expectation, the building manager was responsible for ensuring that the supervisor worked the required number of hours and that his timesheet matched the actual hours he worked.

In addition, the building manager failed to notice many days when the supervisor claimed to work but was absent for the entire day. As Figure 2 shows, the supervisor claimed to have worked full days on at least 75 occasions, despite the lack of any evidence that he even entered the building. For example, on one day in April 2020, the supervisor emailed the building manager and informed him he would not be in the office because of illness. Keycard records corroborate that he did not access the building on that day. However, the supervisor claimed on his timesheet to have worked a full day. We found numerous similar instances throughout the time period we reviewed.

Figure 2

The Supervisor Failed to Account for Approximately 75 Whole Day Absences

The building manager’s lax oversight resulted in 1,350 unaccounted work hours during the period we reviewed. As a result of these hours, the supervisor received $29,600 for hours he did not work, as Figure 3 illustrates. Moreover, although our investigation focused on the supervisor’s attendance dating back to January 2019, multiple witnesses told us his pattern of time abuse existed for a number of prior years. If the supervisor consistently worked about 69 percent of his assigned work hours from the time DGS hired him, he likely received an additional $27,400 in unearned salary from 2016 through 2018.

Figure 3

The Supervisor Engaged in Consistent Time and Attendance Abuse

Even after receiving multiple complaints regarding the supervisor’s attendance, the building manager failed to take sufficient action. For example, the tenant of the building—which pays for custodial services through a lease agreement with DGS—complained about the supervisor’s attendance in 2018 and 2019. The tenant specifically told the building manager that keycard records for a four‑month period showed that the supervisor worked fewer than four hours on more than half of the days he was present. The tenant also noted that the supervisor scanned his keycard on only 45 days of the 74 days reviewed, leaving 29 days on which he likely did not work at all.

When we asked the building manager what he did in response to these complaints, he said that he “talked to all the people concerned” and concluded that the allegations were unfounded. However, the building manager told us that he did not talk to the tenant that had made the allegations or review the keycard records in question. Instead, the building manager called a meeting with his custodial staff and instructed them not to question the supervisor’s attendance and to stop speaking with the tenant regarding the supervisor’s time abuse.

In addition to enabling the supervisor’s excessive and habitual time abuse, the building manager also allowed the supervisor to receive a monthly night shift bonus that he did not deserve. From January 2019 through August 2020, the supervisor improperly received a night shift bonus that totaled about $1,835 because he was hired to work from 3 p.m. to 11:30 p.m. To qualify for the night shift bonus, an employee has to regularly work shifts when four or more hours fall between 6 p.m. and 6 a.m. However, keycard records from this period show that the supervisor typically worked from 9:41 a.m. to 3:43 p.m., with the latest keycard exit occurring around 6:45 p.m. Consequently, the supervisor did not meet the requirements for the night shift bonus. When investigators informed the supervisor of the requirements for the bonus, he agreed that he should not have received it. Because the building manager was responsible for signing off on all of the supervisor’s timesheets and any accompanying bonuses his timesheets supported, he was responsible for ensuring that the supervisor did not receive a bonus to which he was not entitled.

The building manager also failed to notice significant time abuse by an office technician whom he directly supervised. The office technician—who served as the attendance clerk for the unit—was required to work a schedule of eight hours per day, five days per week. However, keycard records show that from January 2019 through August 2021, she averaged just 5 hours and 42 minutes of work per day, or 71 percent of her assigned work hours, and that she typically left the office by 3 p.m. Figure 4 outlines the office technician’s time abuse. Further, on at least 20 days, the office technician did not show up to work at all but still claimed to have worked a full day. The office technician admitted that she might have failed to charge leave when leaving work early but asserted that the building manager allowed her to do so. The building manager denied allowing her to take time off without accounting for the hours, but his failure to ensure that she worked her full schedule directly led the State to pay her an estimated $22,600 for 1,120 hours she did not work over this period.

Figure 4

The Office Technician Engaged in Time and Attendance Abuse

The building manager claimed that he was unaware of the office technician’s attendance issues, but evidence indicated otherwise. First, when questioned by investigators, he readily admitted that attendance abuse by the office technician was possible but attempted to absolve himself of responsibility by saying that he did not see her leave because he worked an earlier schedule. His official schedule was from 8 a.m. to 5 p.m., but he claimed to work from 6 a.m. to 3:30 p.m. However, even if he worked the latter schedule, he should have noticed the office technician’s early departures at 3 p.m. Second, although the building manager told investigators that he had not received any complaints about the office technician’s attendance and that “things got done,” witnesses told us that they had expressed concerns about the office technician’s work to the building manager. Finally, we found emails starting in July 2018 in which he asked other staff to keep track of the office technician’s attendance and report back to him, showing that he suspected she was not working her full hours. Taken together, the evidence supports that not only was he aware of the office technician’s attendance issues but that he chose not to take corrective or disciplinary action to address them.

Although our investigation focused on the office technician’s attendance since January 2019, her pattern of time abuse likely began earlier. In fact, multiple witnesses told us that the office technician’s attendance abuses had been ongoing. If the pattern of time abuse we identified existed during her earlier years at DGS, the office technician likely worked about 71 percent of her assigned work hours and received an additional $19,150 in unearned salary from 2017 through 2018.