5 \ 5 Office of Inspector General (3 / REVIEW OF EPA'S AMERICAN EXPRESS CARD PROGRAM AT HEADQUARTERS REPORT NO. EIAMF5-11-0020-6100304 September 26, 1996 ------- Inspector General Division Conducting the Review: Headquarters Audit Division Arlington, Virginia Program Offices Involved: Office of the Chief Financial Officer Office of Administration and Resources Management ------- UNITED STATES ENVIRON MENTAL PROTECTION AGENCY WASHINGTON, D.C. 20460 SEP 2 6 199?; OFFICE OF THE INSPECTOR GENERAL MEMORANDUM Review of EPA's American Express Card Program at Headquarters Audit Report No. El AMF5-1 1-0020-6100304 SUBJECT: FROM: Michael Simmons Deputy Assistant Inspector General for Internal and Performance Audits (2421) TO: Sallyanne Harper Acting Chief Financial Officer (3101) Alvin Pesachowitz Acting Assistant Administrator for Administration and Resources Management (3101) Attached is our final report titled Review of EPA's American Express Card Program at Headquarters. The audit objectives were to evaluate the efficiency and effectiveness of program oversight and identify any weaknesses in its internal controls. This report identifies corrective actions the Office of Inspector General (OIG) recommends involving the American Express Card Program at Headquarters. As such it represents the opinion of the OIG. Final determinations on matters in the report will be made by EPA managers in accordance with established EPA audit resolution procedures. Accordingly, the findings described in this report do not necessarily represent the final EPA position. The response from the Acting Chief Financial Officer (CFO) to our draft report is included as Appendix IV. Our evaluation and comments on the response are included in Chapter 3. Based on the CFO's response and discussions with staff involved, we made appropriate changes to this final report. Further, we believe the corrective actions planned and the milestones indicated are responsive to our recommendations, and we are closing the report in our tracking system upon issuance. Recycledfftecyclable Primed with Soy/Canda Ink on paper tnai contain* *t l«*st SO*, recycled fiber ------- We would like to express our appreciation for the cooperation of your staff during the audit. Should you or your staff have any questions about this report, please contact Edward Gekosky, Divisional Inspector General for Audit, Headquarters Audit Division, or Frances E. Tafer, Audit Manager, at (703) 308-8222. Attachment ------- Review of EPA'sAmerican Express Card Program at Headquarters E1AMF5-11-0020-6100304 EXECUTIVE SUMMARY PURPOSE The American Express (AMEX) Charge Card Program at EPA Headquarters provides a means for employees to pay for their official travel-related expenses. It had never been audited. The program can be subject to fraud and misuse. Agency and Office of Inspector General (OIG) officials were aware of instances of both misuse and fraud, occurring, so we performed an audit to evaluate the efficiency and effectiveness of program oversight and to identify any weaknesses in its internal controls. Specifically, we determined whether program oversight provided reasonable assurance that: • Employees do not obtain improper advances; , t • Employees do not use the government card to make personal purchases; and • Employees do not submit late payments to AMEX. We also analyzed the impact of the two fiscal 1996 furloughs on improper card use. BACKGROUND , EPA implemented the AMEX program on November 30, 1993, replacing Diners Club as the provider of the government-wide travel and transportation charge card. The AMEX program was created as a result of a contract between the General Services Administration (GSA) and the American Express Travel Related Services Company, Inc., which established guidelines for participating agencies and cardholders. The Agency has participated in GSA's Government Travel and Transportation Charge Card Program since 1985. EPA issued its AMEX Program Policies and Procedures on May 2,1994, which defined cardholder eligibility and responsibilities. This document also described program controls and the potential consequences to employees of card abuse/misuse. Oh September 1, 1994, the Agency expanded on the disciplinary actions described in the original policy announcement (Appendix II), making a distinction between personal use of the card and late payment of undisputed charges. Personal use was judged a more serious abuse. The Headquarters Agency Program Coordinator (APC) is responsible for implementing many of the program controls. In addition to her other duties, the Headquarters APC must oversee almost a third of EPA's 13,463 AMEX accounts—more than any of the Agency's other APCs. ------- Review of EPA's American Express Card Program at Headquarters E1AMF5-11-0020-6100304 RESULTS-IN BRIEF Program oversight is generally efficient and effective; however, we identified gaps in the controls that should be closed. Our review of a statistical sample of 270 AMEX card statements projected a statistically insignificant amount of improper card use to all Headquarters accounts. Delinquency, defined as having payments that are 90 days or more late, was not widespread. On the other hand, our review of a judgmental sample of 23 accounts and interviews with 26 supervisors indicated that a few weaknesses in the control system permit some employees to accumulate a substantial amount of personal charges on their accounts. Established controls, such as monthly monitoring of account activity and supervisory notification regarding questionable card use, were not fully implemented. Additionally, necessary information including accurate employee/supervisor locator data, was not always available. PRINCIPAL FINDING Headquarters Program Controls Could Be Improved To Reduce Improper Use of the AMEX. Government Card In evaluating the control environment for the Headquarters AMEX program, we noted that a few of the established controls were riot being fully implemented. We also identified some additional information needed to increase the effectiveness of program oversight at Headquarters. These control weaknesses made it possible for a number of employees to develop patterns of repeated personal use of cards issued solely for the purpose of charging official government travel-related expenses. The monthly statements of the 23 cardholders in our judgmental sample included approximately $64,000 of personal charges over a 16-month period. Three of those cardholders each charged over $7,000 that was not associated with official government travel. In accordance with the guidance, the supervisor's responses were: 1) no disciplinary action/informal counseling, 2) a written reprimand, and 3) a proposed demotion; taking into account the unique circumstances of each case. RECOMMENDATIONS We recommend that the Acting Chief Financial Officer direct the Financial Management Division (FMD)to: • Consistently monitor activity reports on a monthly basis; • Maintain records of the results of that monitoring, such as charges questioned and dates of notification; ------- Review of EPA's American Express Card Program at Headquarters El AMF5-11-0020-6100304 • Work with the Office of Human Resources and Organizational Services (OHROS) to improve the notification process by providing clear, timely notice of their responsibilities to supervisors and establishing a reasonable response time in the notification letter; * Provide all new AMEX applicants with a copy of the program Policies and Procedures; * Continue to issue an annual (at a minimum) reminder about proper card use and the consequences of improper use; and * Inform supervisors that they could request and obtain a list from FMD of cardholders in their organization. We further recommend that the Acting Assistant Administrator for Administration and Resources Management direct OHROS to: » • . Work with FMD to make further guidance available to supervisors in defining appropriate responses to offenses, while coordinating with the Office of General Counsel to pursue including improper use of government charge cards as an example of misuse of government property (or a separate offense) in the Agency's Conduct and Discipline Order; and * • ; Provide FMD access to accurate personnel data to locate cardholders and their supervisors. AGENCY COMMENTS We met with Agency officials on September 19, 1996, to discuss their response to our draft report. They generally agreed with all of our recommendations and provided responsive corrective action plans with milestones for their implementation. They also requested minor changes to the report, which we made, as appropriate. 111 ------- Review of EPA's American Express Card Program at Headquarters El AMF5-11-0020-6100304 [This page intentionally left blank] IV ------- Review of EPA's American Express Card Program at Headquarters E1AMF5-11-0020-6100304 TABLE OF CONTENTS EXECUTIVE SUMMARY CHAPTERS 1. INTRODUCTION 1 PURPOSE 1 BACKGROUND - 1 SCOPE AND METHODOLOGY : 3 2 EPA ESTABLISHED CONTROLS TO DETER AND DETECT CARD MISUSE .-., 5 3. PROGRAM CONTROLS COULD BE IMPROVED TO REDUCE IMPROPER USE OF THE AMEX CARD 9 APPENDIX I - ABBREVIATIONS 17 APPENDIX II - OFFICE OF THE COMPTROLLER TRANSMITTAL NO. 94-28 19 APPENDIX III - SUMMARY OF ABUSE/MISUSE JUDGMENTAL SAMPLE , : 21 APPENDIX IV - AGENCY'S RESPONSE : 23 APPENDDC V - DISTRIBUTION 31 ------- Review of EPA's American Express Card Program at Headquarters E1AMF5-11-0020-6100304 [This page intentionally left blank] VI ------- 1! Review of EPA's American Express Card Program at Headquarters CHAPTER I E1AMF5-11-0020-6100304 INTRODUCTION PURPOSE The American Express (AMEX) Charge Card Program at EPA Headquarters provides employees with a commercial charge card to pay for official travel-related expenses. Charge card programs, by their nature, are susceptible to fraud and misuse. The EPA AMEX Program had not previously been audited. Agency and Office of Inspector General (OIG) officials became aware of instances of fraud and misuse, so we planned an audit of the AMEX Program at Headquarters. Although the Agency has no liability for employees' improper use of their AMEX cards, such abuse/misuse could tarnish the image of EPA and the public sector as a whole. During the course of our work, members of the House of Representatives and the general public also expressed concern about the level of card abuse/misuse that might be occurring in the Federal government. Therefore, we performed an audit to evaluate the efficiency and effectiveness of program oversight and to identify any weaknesses in the internal controls. Specifically, we determined whether program oversight provided reasonable assurance that: • Employees do not obtain improper advances; • . Employees do not use the government card to make personal purchases; and * Employees do not submit late payments to AMEX. We also analyzed the impact of the two fiscal 1996 furloughs on improper card use. BACKGROUND EPA implemented the AMEX program on November 30, 1993, replacing Diners Club as the provider of the government-wide travel and transportation charge card. The AMEX program was created as a result of a contract between the General Services Administration (GS A) and the American Express Travel Related Services Company, Inc., which established guidelines for participating agencies and cardholders. The Agency has participated in GSA's Government Travel and Transportation Charge Card Program since 1985. The program is intended to reduce the administrative costs associated with travel, simplify payment procedures, and improve services for travelers. Specifically, agencies are able to reduce the amount of outstanding travel advances and cash retained in the imprest fund. Travelers obtain benefits such as accident insurance and access to Automated Teller Machines (ATMs) to withdraw their travel advances, as needed, and 24-hour cardholder assistance centers. EPA pays no per-card interest or finance charges to make these individually-billed accounts available to 1 ------- Review of EPA'a American Express Card Program at Headquarters E1AMF5-11-0020-6100304 employees, but the Agency does reimburse travelers for the 2.75 percent fee AMEX charges for ATM withdrawals. For fiscal year 1995, AMEX paid EPA an estimated "Sponsor Refund" of $191,894, based on Agency-wide charges on the card (excluding ATM-withdrawals and travelers checks), another benefit of the program. GSA administers'the contract with AMEX for charge card services. GSA officials are responsible for deciding whether to exercise each "option year" of the four permitted by the original contract that expired on November 29, 1994, and negotiating any changes to the contract for those periods. The current (second) option year ends on November 29, 1996. The Agency Program Coordinators (APC) is responsible for processing cardholder applications and agreements. The APC should maintain an up-to-date list of individual cardholders' names, addresses, social security numbers, account numbers and telephone numbers. Individual cardholders' responsibilities include using the card only for official travel-related expenses and prompt payment of their AMEX bills. At EPA, there is one APC with general, Agency-wide program oversight responsibilities and another 14 APCs who have specific responsibilities regarding accounts in their geographic locations. Approximately, 13,460 employees across the Agency had AMEX accounts. Almost a third of those (3,990 accounts) belonged to Headquarters employees. Over the first ten months of fiscal year 1995, Headquarters employees charged a total of $6.8 million on their AMEX cards. Total Charges on Headquarters Accounts Ten Months of Fiscal Year 1995 Thousands .$1000 800 Ocl94 NOT 94 Dec 94 . J«n9J Feb95 Mar 95 Apr 95 Miy95 JunPJ Jul95 ------- Review of EPA'a American Express Card Program at Headquarters SCOPE AND METHODOLOGY E1AMF5-11-0020-6100304 Our audit work was performed at EPA Headquarters, primarily in the Washington Financial Management Center (WFMC)/ Financial Management Division (FMD), from June 1995 through June 1996. We reviewed program operations for fiscal year 1995 and the first four months of fiscal 1996. We met with Agency officials, GSA representatives, and the AMEX Government Account Manager for EPA and identified applicable program controls. We included The AMEX Government Program Reference Manual and the GSA Contract Summary as potential sources of program controls. We also reviewed Inspector General Bulletin 95-OM-l that provided additional guidance on appropriate disciplinary actions for OIG supervisors to use if employees have misused/abused their AMEX cards. To evaluate the effectiveness of the program controls, we drew two samples of Headquarters cardholder activity and interviewed selected cardholders' supervisors. The first sample was a random statistical sample of 270 monthly statements from the universe of 11,329 statements for the ten-month period of October 1994 through July 1995, representing all the data that was available for fiscal 1995. The sample size was selected to provide a 95 percent confidence level. To determine whether the charges on the statements were associated with official travel, we searched the Integrated Financial Management System (IFMS) for Travel Authorizations (TAs). When we could not identify any related TA, we asked the APC for any information she might have on the propriety of the charges. While reviewing the account activity reports for our first sample, we noted several other accounts that displayed patterns of repeated questionable transactions on the monthly statements. We were aware of an OIG investigation regarding an employee's use of false identification to establish multiple AMEX accounts and charge thousands of dollars for personal goods and services to those accounts. We avoided these accounts when we drew a second, judgmental sample of 28 accounts to review for an extended period to illustrate problem use we believed was occurring. We reviewed the monthly statements of these 28 accounts for the first ten months of fiscal year 1995; eliminating three accounts because they each contained only one questionable transaction and another two accounts because they were included in our statistical sample. We further extended the review period for the remaining 23 accounts to include the last two months of fiscal year 1995 and the first four months of fiscal 1996 to identify any effect of the two Agency furloughs on misuse patterns. We also reviewed ten accounts with improper charge(s) from the statistical sample for an extended six month period to determine whether any of those cardholders repeated their offenses. We interviewed 26 supervisors of cardholders with repeated improper transactions to determine whether they were notified about their employees' misuse, and if so, what were their responses. Twenty-three of the individuals were cardholders from the judgmental sample and three were cardholders from the statistical sample whose account activity reports indicated that they made ------- Review of EPA'a American Express Card Program at Headquarters E1AMF5-H-0020-6100304 additional improper charges. We also requested supervisors' overall opinions of the AMEX program. While there was no prior audit coverage of this program, we reviewed the results of related work. That work included a U.S. General Accounting Office audit of the Diners Club program at several federal agencies, an audit of the U.S. Information Agency's AMEX program, as well as OIG Hotline cases and recent fraud investigation. We conducted our audit in accordance with the Government Auditing Standards (1994 Revision) issued by the Comptroller General of the United States. We included tests of program management controls (See Chapter 2 for our assessment of the control environment.). We did not evaluate the validity of the DFMS data used to indicate whether charges were questionable because we did not rely on that exclusively to make our final determination on the propriety of the transactions. No other significant issues came to our attention that warranted fiurther review. ------- 1 Review of EPA's American Eipress Card Program at Headquarters E1AMF5-11-0020-6100304 CHAPTER 2 EPA ESTABLISHED CONTROLS TO DETER DETECT CARD MISUSE EPA established controls that generally provide effective oversight for the AMEX program at Headquarters. Program officials, while placing emphasis on customer service and making the AMEX program "user-friendly," responded with appropriate action when problems were brought to their attention. When program controls are implemented as designed, there is little risk of card misuse remaining undeterred or undetected. EPA issued its AMEX Program Policies and Procedures on May 2, 1994, which defined cardholder eligibility and responsibilities. This document also described program controls and the potential consequences of card abuse/misuse. On September 1,1994, the Agency expanded on the disciplinary actions described in the original Policy Announcement (Appendix II), making a distinction between personal use of the card and late payment of undisputed charges. Personal use of the card was judged a more serious abuse. Eligibility Individuals are eligible to apply for the card if they are: 1) EPA employees or Commissioned Officers, or other Federal employees on long-term , assignments to EPA, and (emphasis added) 2) frequent travelers; i.e., expected (by their supervisors) to travel two or more times a year. Responsibilities Employees are responsible for: 1) Completing the application properly (which includes agreeing to the terms and conditions of the program); 2) . Safeguarding the card; 3) Using the card according to the terms and conditions of the program; 4) Paving their bills upon receipt; 5) Submitting their travel vouchers within five workdays after completion of the trip; and 6) Adhering to the highest ethical standards and promoting the best interests of the Agency (This includes proper use of government property and prompt payment of debts.). APCs are responsible for: 1) Reviewing, completing the Agency portion of, and forwarding the application to AMEX; 2) Providing applicants with program policies and procedures; 3) Performing a monthly review of a sample of account activity; 4) Contacting supervisors of employees with questionable/problematic card use; ------- Review of EPA's American Eipress Card Program at Headquarters E1AMFS-11-0020-6100304 5) Providing as much assistance as possible to AMEX collection efforts in cases of delinquent accounts; and 6) Requesting that employees who misuse/abuse their cards lose their charging privileges, if appropriate. The Headquarters APC, a section chief in the WFMC, described her monitoring practices as judgmental reviews of the account activity reports—looking for questionable activity such as local retail/restaurant charges or isolated ATM withdrawals (without any associated travel-related transactions; i.e., transportation or hotel, etc.) and following up on accounts with previously identified problems. She reviews the IFMS data to identify any TAs that could be associated with the transactions and contacts cardholders when no TAs appear related to obtain information to validate the charges. If the cardholders do not provide sufficient documentation, the APC told . us that she contacts them a second time sending carbon copies of the requests for information to their supervisors. The APC also provides notices to cardholders and their supervisors on delinquent accounts. Supervisors are responsible for taking or recommending appropriate action to respond to conduct and discipline offenses. In regard to personal use of AMEX cards, responses ranging from written reprimands to removals are suggested. For delinquent payments, optional responses range from oral admonishments to removals. ATM Limitations Cardholders' access to ATMs is solely for the purpose of obtaining their travel advances. Employees may take their authorized advances up to three calendar days prior to departure or during the trip. The authorized amount is calculated by multiplying $15 by the number of days for the trip and adding 80 percent of the approved incidental costs. EPA also has an Agency-wide limit established with AMEX on the total amount a cardholder can withdraw per day and per week. Additional Controls As a result of the previously mentioned OIG investigation of fraud and misuse of the card at Headquarters, WFMC reduced employee access to card applications and identified the APC's fax machine as the one authorized to transmit them to AMEX. The APC requested and obtained, in December 1994, a "retail block" on purchases made at certain types of establishments for Headquarters accounts. Additionally, AMEX and other creditors gained the right to garnish federal wages for outstanding debt with the Hatch Act amendments that became effective January 1, 1995. In February of that year, WFMC issued a Money Expre$$ bulletin to EPA employees which informed its customers of the establishment of the retail block and noted potential consequences of improper use of AMEX cards. Another Money Expre$$, in July 1995, highlighted the advantages and obligations associated with AMEX card use. ------- Review of EPA's American Eipre»« Card Program at Headquarter! E1AMF5-11-0020-6100304 Projected Rate of Improper Card Use Low The results of reviewing our random statistical sample of 270 monthly account statements indicated that program controls are generally effective because the positive results are projectable to the universe of Headquarters accounts for the time period reviewed. We found that ten statements of the 270 included a total of $2,820 of charges that we could not associate with official government travel. These statements included transactions such as ATM withdrawals and charges at local restaurants and stores. We used the resulting rate of improper charges to project the total number of statements with improper charges and the total Headquarters improper charges over the ten-month review period. Our projection was that 181 statements would include $109,390 of personal charges (at the 95 percent confidence level) of the total $6.8 million charged on the 11,329 statements over the review period. The improper charges we projected were not statistically significant; i.e., the overall rate of improper use of Headquarters accounts was low, 1.6 percent. i. One of the cases in our judgmental sample is an illustration of how effective the established controls can be when properly implemented. An employee made purchases at local retail establishments, totaling a little more than $100. Soon after the charges appeared in the monthly account activity report, the APC notified the employee and the employee's supervisor about the impropriety of these charges. The supervisor discussed proper use of the card with the employee, and no additional questionable charges have appeared on this account thereafter. The employee promptly paid the bill for these charges. Delinquency was also not widespread. We noted untimely payments, payments overdue by 90 days or more, on six of the 270 statements in our statistical sample, 2.2 percent. .Only one of those was a statement that also included improper transactions. More Favorable Opinions about Program than Adverse We interviewed 26 cardholders' supervisors, most of whom were also cardholders. More often than not, they believed the program's advantages, such as convenience for the traveler, reduction in the Agency's administrative costs, arid wide acceptance, outweighed its disadvantages; e.g., additional personal responsibility and a system that is more oriented toward domestic travel rather than international travel. Supervisors favored program features such as ATM access for travel advances and ease of record-keeping because so many of a traveler's expenses can be charged to this one account. However, even supervisors with favorable opinions of the program offered suggestions for improvement. Some requested additional guidance, such as OIG Bulletin 95-OM- 1, to more clearly define appropriate responses to offenses. A few supervisors suggested a more limited distribution of cards; i.e., a higher number of expected trips per year to be eligible to participate in the program. ------- Review of EPA'a American Express Card Program at Headquarters E1AMF5-11-0020-6100304 Conclusions Program oversight was generally effective. As noted above, the rate of personal use of Headquarters AMEX accounts was low and employees generally paid their bills in a timely manner. We could not identify a relationship between personal use of AMEX cards and delinquency. Many of the supervisors we spoke with had favorable opinions of the program. As the case from our judgmental sample illustrated, when controls were fully implemented and necessary information available, there was little risk that card misuse would be undetected or undeterred. Our judgmental sample, however, also included several examples of problems that occur when the control system does not operate as devised. ------- Review of EPA's American Express Card Program at Headquarters E1AMF5-11-0020-6100304 CHAPTER 3 PROGRAM CONTROLS COULD BE IMPROVED TO REDUCE IMPROPER USE OF THE AMEX CARD Established Controls Not Fully Implemented While we believe the controls in place provide effective oversight when implemented as established, we identified controls that were not fully implemented. For instance, the APC told us that she did not monitor activity reports for four months during our review period because she was working with the OIG on its fraud investigation. However, only three of the 23 employees in our judgmental sample confined their personal use of their AMEX cards to one month. The remaining 20 repeat offenders misused their cards over .several months before their supervisors were notified. Furthermore, some supervisors of these employees were not notified at all. Ineligible Employees Participate in Program Some cardholders in our judgmental sample did not meet the "frequent traveler" eligibility standard. When we met with cardholders' supervisors, at times, they indicated that their employees were not expected to travel at all. Others could attribute their employees' having cards to their going on one office-related trip or having been considered for responsibilities which would have involved travel. Additionally, the APC identified employees with cards who should not have had them due to problems with their use of their Diners Club cards. One of the employees we eliminated from our judgmental sample, because that account was included in our statistical sample, was such an individual. The supervisor had recommended action in response to Diners Club problems and was recently informed about the employee's repeated AMEX card misuse. Notices to Supervisors Sometimes Untimely Most of the 26 supervisors we interviewed were not notified at the onset of their employees' AMEX problems. Sixteen said that they were notified about their employees' AMEX abuse/misuse. But, even though almost all of these employees' problems began before June 1995, only two of the 16 notified could recall receiving any notice before November 1995, the month in which we met with program officials to discuss the preliminary results of our sampling. Six of the 16 notified supervisors told us they received their information after January 1996. Another four said they weire notified in December 1995. The remaining four remembered being notified in November 1995 or some time in the fall of that year. Finally, ten supervisors said they had no knowledge of their employees' misuse until the employees had informed them (2) or we contacted them (8). ------- Review of EPA's American Express Card Program at Headquarters E1AMF5-11-0020-6100304 Untimely Notifications to Supervisors Notified 12/95 15.2% After 11/95 15.2% Notified 1/96 23.2% Before 11/95 8.1% \ Not Notified 38.4% Information Gaps Weaken Systenr In addition to the incomplete implementation of the established controls; our audit identified a few weaknesses that reduce the effectiveness of the oversight of the program. The APC sometimes had difficulty identifying cardholders' supervisors because available personnel data did not accurately reflect employees' organization codes. Also, the APC did not maintain complete records of the results of her monitoring. We could not identify whether or when employees or their supervisors were notified. Thus, most of the cases in our sample were considered first offenses. However, one case was officially a second offense (The employee had been disciplined for improper-Diners Club card use, as noted above.). When the supervisor consulted with OHROS to obtain advice on how to propose appropriate disciplinary action, OHROS officials informed her that they had no second card-misuse offenses with which to compare this case and provided sample discipline proposals that were ten years old for offenses not related to credit card misuse. 10 ------- Review of EPA'a American Express Card Program at Headquarters E1AMFS-11-0020-6100304 Other supervisors also needed additional information to respond to employees' misuse. For example, some supervisors told us that they were not always aware of which of their employees had cards, particularly in cases of reorganizations when previous supervisors may have approved applications. Some supervisors and cardholders were unclear about their AMEX responsibilities. Some of them said that they were not aware of the Agency's Policies and Procedures. Others thought that additional guidance/clarification was necessary to define issues such as what constitutes a "first offense," or perhaps dollar amounts to indicate where in the range of permissible responses a particular offense fit. One supervisor stated that the notice she received led her to believe her employee's problems were being resolved by the OIG. Another said that the OIG was mentioned in their notification as well. We explained that supervisors are responsible for recommending or taking appropriate disciplinary action. Offenders Incurred Thousands of Dollars of Personal Charges The 23 accounts in our judgmental sample, over the 16-month review period, amassed improper charges that totaled almost $64,000. One fifth of those improper transactions were personal charges frequently made at locations such as: local stores, restaurants, and rental car agencies. The majority of the $64,000 of improper charges were ATM withdrawals and the related fees. $64,000 in Improper Charges from Judgmental Sample ATM Withdrawals 79.6% Other Charges 20.4% 11 ------- Review of EPA's American Eipress Card Program at Headquarters E1AMF5-U-0020-6100304 Employees who withdrew cash from ATMs without authorization obtained unapproved interest- free loans. Three individuals each charged more than $7000 for personal use. See Appendix III for a summary description of the improper charges on these 23 accounts. Furlough Misuse Substantial The APC observed a higher level of improper card use early in fiscal 1996 and an increase in delinquency. We found that individuals in our judgmental sample charged $9,463 that could not be associated with government travel during this period. Two of the cardholders with improper transactions in our statistical sample improperly charged an additional $6,878 over the same four months, which we did not include in our projection, but believe is noteworthy. Delinquency/Cancellation i Eleven of the 23 accounts in our judgmental sample were delinquent during the 16-month review period. However, we could not establish a relationship between delinquency and misuse because abuse does not necessarily result in delinquency. By the end of the review period, eight of the accounts in this sample were canceled. Seven of those accounts had been delinquent at least once during the review period. FMD officials noted that additional accounts from the sample had since been canceled, bringing the total to fifteen. They also informed us that almost all of the outstanding charges on these accounts have now been paid to AMEX. As of June 1996, according to FMD, approximately $2,900 of the $64,000 in improper charges were still due to AMEX. Supervisory Responses to Misuse The supervisors responded to their employees' improper use of their AMEX cards in a variety of ways, as allowed by the established guidance. Thirteen of the 26, half of them, had taken or planned to take disciplinary action. Six of the remaining 13 supervisors planned or provided informal counseling/guidance to .their employees. The disciplinary actions ranged from reprimands (oral and written) to one proposed demotion. Some supervisors took no action. The supervisors offered a number of explanations for their chosen responses. Many of the supervisors discussed the charges with the employees who often apologized and admitted guilt. The supervisor who proposed removing an employee did so primarily in response to the employee's extended absence without leave, the AMEX abuse was more of a secondary offense, supporting the request for removal. The supervisor of an employee who made unauthorized ATM withdrawals, totaling over $9000 in 11 of the first 14 months of our review, proposed the most stringent response for card misuse. The supervisor, whose predecessor was notified in the 14th month (November 1995), had several 12 ------- Review of EPA's American Express Card Program at Headquarters El AMF5-11-0020-6100304 issues to take into account when proposing disciplinary action. The employee was in a position of financial responsibility and received the card in conjunction with a promotion into a position with expected travel that did not materialize. The employee provided inaccurate information to the APC when asked to document authorization for questionable charges. The employee's misuse began prior to the scope of our review-from the first month the account existed, continuing until a supervisor was notified more than a year later. The current supervisor proposed a demotion to the employee's previous grade. The supervisor of the employee with the highest amount of card abuse that we found, over $11,000 of unauthorized ATM withdrawals and fees, responded with a less stringent approach. She said that she had not received any notice during the year the charges accumulated, and took into consideration the employee's good performance record and personal health/financial problems, when she decided to issue a written reprimand. The employee acknowledged the AMEX abuse, paid all of the charges and said that it would not happen again. This employee's account had been delinquent and was canceled. : In another example, a former supervisor, one who was not informed about her employee's misuse, which at that time exceeded $2000, planned no action because she no longer worked for the same organization as the cardholder. She said that the employee did not travel much, so even though she believed the employee was highly ethical, she would have probably requested cancellation of this account had she known of the abuse when she supervised the cardholder. Supervisors exercised almost the entire range of options of responses to employees' AMEX abuse suggested in the Agency guidance. Conclusions The exceptions noted above weaken the generally effective oversight of the AMEX Program at Headquarters. Employees at Headquarters or any other EPA location should not be permitted to privately benefit from their public positions. The cases we reviewed illustrate that when the program control system does not operate as designed and necessary information is not available, employees have been able to repeatedly use cards issued to charge official travel-related expenses for personal purposes. Again, we could identify no relationship between delinquency and personal use of the AMEX card; concerns about the Agency's budget and the two furloughs may have increased the number of instances of both offenses. When officials fully implement program controls and have the information they need, program oversight does provide reasonable assurance that employees are not abusing/misusing their AMEX cards. Our judgmental sample identified weaknesses in the control system, as implemented, that allow the problems described above to occur, During the course of the audit, we noted steps taken after our review period which we believe will help strengthen the control environment of the program. The reminders about AMEX restrictions such as the Comptroller's March and April 1996 memoranda should increase cardholders' and 13 . ------- Review of EPA'a American Express Card Program at Headquarters E1AMF5-11-0020-6100304 supervisors' level of awareness of their responsibilities. We were told that an effort was under way to enhance coordination between FMD and OHROS; this could make some of the necessary information more readily available to program officials. The implementation of the Local Area Network (LAN) should make it easier for the APC to locate and contact cardholders and their supervisors, in addition to improving her ability to maintain records of those contacts. AMEX, the organization with the risk of financial loss when program controls fail, recently added theft/fraud prevention measures to its card issuance procedures. Still, we believe additional adjustments to current policies and practices are necessary to provide reasonable assurance that employees are not committing AMEX-related offenses. Our review appeared to be the impetus for notifying some of the supervisors of employees with long-term, substantial personal use of their cards. Timely review of questionable transactions and supervisor notification were key controls requiring consistent implementation to prevent repeated abuse of AMEX cards. RECOMMENDATIONS In order to improve consistent, timely oversight and reduce participants' misuse of the American Express Card Program at EPA Headquarters, we recommend that the Acting Chief Financial Officer direct the FMD to: • Consistently monitor activity reports on a monthly basis; * Maintain records of the results of monitoring, so contact with cardholders/supervisors is documented; • Work with OHROS to improve the notification process to provide clear, timely notice to supervisors of their responsibilities and establish a reasonable response time in the notification letter; • Provide all new AMEX applicants a copy of the program Policies and Procedures; • Continue to issue periodic reminders or Money ExpreSS bulletins about proper card use and the consequences of improper use at least once a year; and • Inform supervisors that they could request and obtain a list from FMD of cardholder in their organization. We also recommend that the Acting Assistant Administrator for Administration and Resources Management direct the OHROS to: • Work with FMD to make further guidance available to supervisors in defining appropriate responses to offenses, while coordinating with the Office of General Counsel to pursue . 14 ------- 1 Review of EPA's American Express Card Program at Headquarters E1AMFS-11-0020-6100304 including improper use of government charge cards as an example of misuse of government property (or a separate offense) in the Agency's Conduct and Discipline Order; and • Provide FMD access to accurate personnel data to locate cardholders and their supervisors. AGENCY COMMENTS AND PIG EVALUATION The Agency generally agreed with all of our recommendations and provided responsive corrective action plans with milestones to implement them. We met with Agency officials on September 19, 1996, to discuss their comments'and our analysis of them. As a result, the draft recommendation for OHROS to expand or clarify program Policies and Procedures to provide further guidance to supervisors was incorporated into the final recommendations on improving notification and including improper credit card use in the Conduct and Discipline Order. We noted that the Agency has included the program Policies and Procedures on the LAN, and we deleted the reference to such action in the fourth recommendation to provide that information to all applicants, as required. We also made minor changes to the report as appropriate. 15 ------- Review of EPA's American Express Card Program at Headquarters E1AMFS-11-0020-6100304 [This page intentionally left blank] 16 ------- •1 Review of EPA's American Express Card Program at Headquarters E1AMF5-U-0020-6100304 APPENDIX I Abbreviations: AMEX APC ATMs EPA FMD GSA IFMS LAN OGC OHROS OIG TAs WFMC American Express Travel Related Services Co., Inc. Agency Program Coordinator Automated Teller Machines Environmental Protection Agency Financial Management Division ' General Services Administration Integrated Financial Management System Local Area Network (computerized communication system) Office of General Counsel Office of Human Resources and Organizational Services Office of Inspector General Travel Authorizations Washington Financial Management Center 17 ------- Review of EPA'a American Eipresa Card Program at Headquarters E1AMFS-11-0020-4100304 [This page intentionally left blank] 18 ------- Review of EPA'a American Express Card Program at Headquarters E1AMF5-11-0020-6100304 APPENDIX II U.S. ENVIRONMENTAL PROTECTION AGENCY FINANCIAL MANAGEMENT DIVISION Office of The Comptroller Transmittal No. 94-28 SEP 1 1994 MEMORANDUM SUBJECT: Appropriate Disciplinary Actions for American Express Government Transportation Program Abuse/Misuse FROM: Jack Shipley, Director/s/ Financial Management Division (3 303F) TO: Financial Management Officers TRIP Committee Members This Transmittal expands on the disciplinary actions described in Office of the Comptroller Policy Announcement (PA) No. 94-04, dated May 2,1994, "American Express Government Transportation Program." As stated in the PA, there are certain disciplinary actions associated with abuse and misuse of the contractor-issued government charge card while on official travel. The definitions are expanded as such: * For charges other than official travel expenses on the contractor-issued government charge card or obtaining Automatic Teller Machine (ATM) cash advances unrelated to official travel, the following actions may be taken; 1 st Offense'- written reprimand to removal 2nd Offense - 5-day suspension to removal 3rd Offense -14-day suspension^ removal • For delinquent payments on undisputed charges reported on the employee's individual card billing; 1st Offense - oral admonishment to written reprimand 2nd Offense - written reprimand to 5-day suspension 3rd Offense - 5-day suspension to removal Individuals participating in the Government Charge Card Program must adhere to Agency Policy without exception. For detailed policy on the proper use of the charge card, refer to the aforementioned PA. FISCAL POLICIES AND PROCEDURES BRANCH 19 ------- Review of EPA's American Express Card Program at Headquarters EJAMFS-11-0020-6100304 [This page intentionally left blank.] 20 ------- 1 Review of EPA's American Express Card Program at Headquarters E1AMFS-11-0020-^100304 APPENDIX III Summary of Abuse/Misuse Judgmental Sample EMPLOYEE A . B C D E F G H- I J K L M N 0 P Q R s T U V W TOTALS ATM WITHDRAWALS $1,911.35 $6,627.36 $1,808.40 $2,938.64 $822.00 $482.92 $1,828.95 $1,058.31 $2,322.15 $9,720.09 $1,211.35 ' $2,743.42 $2,362.96 $2,321.86 $11,549.10 $1,130.21 $50,839.07 OTHER CHARGES $1,291.14 $302.50 $101.44 . $628.00 $191.90 $199.55 $2,989.54 $929.58 $272.15 $110.73 $1,522.08 $112.43 $1,505.29 $91.69 $224.27 $1,025:92 $1,550.11 $13,048.32 TOTALS $1,911.35 $7,918.50 $2,110.90 $2,938.64 $923.44 $482.92 $2,456'95 $1,250.21 $199.55 $2,989.54 $2,322.15 $929.58 $9,992.24 -$110.73 $2,733.43 $112.43 $4,248.71 . $2,454.65 $2,546.13 $11,549.10 $1,130.21 $1,025.92 $1,550.11 $63,887.39 ACTION TAKEN Written Reprimand Informal Counseling Written Reprimand Hone Proposed Removal* Undecided** None None None Written Reprimand Written Reprimand Informal Counseling Proposed Demotion Informal Counseling None None Letter on File Informal Counseling Informal Counseling Written Reprimand Informal Counseling Written Reprimand Written Reprimand * Proposed removal is in response to an unrelated offense ** Supervisor had not yet decided what action to take. 21 ------- Review of EPA's American Express Card Program at Headquarters El AMFS-11-0020-6100304 [This page intentionally left blank.] 22 ------- Review of £PA*» American Express Card Program at Headquarters E1AMF5-11-0020-6100304 APPENDIX IV Page 1 of7 UNITED STATES ENVIRONMENTAL PROTECTION AGENCY WASHINGTON, D.C. 20460 1 6 SEP 1996 MEMORANDUM SUBJECT: FROM: TO: Response to the Draft Report No. E1AMF5-11-0020: Review of EPA's American Express Card Program at Headquarters Sallyanne Harp Acting Chief ^manciai Officer Michael Simmons Deputy Assistant Inspector Genera! for Internal and Performance Audits (2421) Thank you for providing us an opportunity to comment on this.draft audit report. Attachment A contains the Agency's consolidated response to the report's recommendations. Attachment B contains our specific comments on the report's findings and conclusions. We agree in principle with the draft audit report's recommendations, and my staff has already begun to take appropriate actions to resolve these issues. If you have any questions regarding our response, please contact Jack Shipley, Director, Financial Management Division at 260-5097. Attachments • . • cc: John O'Brien (3634) Dave O'Connor(3610) Joe Dillon (3303F) Ron Bachand (3303F) Debra Bennett (3303) 23 Recyclcd/Recyclab te Printed with SayfOnola mti on paper tna contains at lean 50% recycled tlbe> ------- Review of EPA'j American Expresi Card Program at Headquarters E1AMFS-11-0020-6100304 APPENDIX IV Page 2 of 7 ATTACHMENT A RESPONSE TO RECOMMENDATIONS DRAFT AUDIT REPORT E1AMF5-11-0020: I REVIEW OF EPA'S AMERICAN EXPRESS QARD PROGRAM AT HEADQUARTERS The following represents the Chief Financial Officer (CFO) and Office of Administration and Resources Management's (OARM) consolidated response to recommendations in the draft ' •audit report of the Review of EPA's American Express Card Program at Headquarters. We have grouped our responses to the recommendations as they appear in the report. RECOMMENDATIONS/RESPONSE 1.1 Recommend that the Acting Chief Financial Officer direct the FMD to consistently monitor activity reports on a monthly basis. We agree in principle with this recommendation. The Washington Financial Management Center (WFMC) has consistently performed monthly statistical sampling of frequent travelers in accordance with agency policy. However, the OIG wrote this recommendation because WFMC did not transmit any activity report letters during the period of December 1994 through March 1995, It is important to note that the reason WFMC did not transmit any activity report letters during this period was because the OIG specifically requested them not to do so. This was due to a fraud investigation that the OIG was conducting at the time. Otherwise, WFMC would have performed their normal monthly statistical sampling of frequent travelers. WFMC will continue, as usual, to consistently monitor and maintain records of charges questioned and dates of notification to the travelers. No further action is required. 1.2 Recommend that the Acting Chief Financial Officer direct the FMD to maintain records of the results of monitoring, so contact with cardholders/supervisors is' documented. We agree with this recommendation, Although current agency policy does not require this procedure, we have implemented an internal monitoring system to assist in identifying employees that were contacted. We will continue our current process of annotating the AMEX report to show the dates of communications with Agency employees.. Also, now that most EPA offices have electronic mail, we have been able to communicate with more employees/supervisors. This has enabled us to document our communications more effectively and efficiently. 24 ------- Review of EPA's American Express Card Program at Headquarters ELAMF5-11-0020-6100304 APPENDIX IV Page 3 of 7 Corrective Action - Maintain records of employees contacted. Target Date Ongoing 1.3 Recommend that the Acting Chief Financial Officer direct the FMD to work with OHROS to improve the notification process to provide clear, timely notice to supervisors; by establishing a reasonable response time in the notification letter. * v We agree in principle with this recommendation. Although Agency policy only requires the Financial Management Office (FMO) to notify an employee and the supervisor when an abuse has been identified, we have initiated discussions between FMD and representatives of our HQ Human Resources Service Staffs to improve the notification and follow-up process. To improve the notification and follow-up process we will require the joint coordination and cooperation of such interested parties as supervisors, unions, and the Human Resource staff. Meetings will also be held to determine the most appropriate use of employee data in HP AYS and whether a method of electronic notification can be developed for general use. It is expected that improvements to the notification process should be completed by around the middle of December 1996. Corrective Action - Complete development of the notification process. Target Date 12/15/96 1.4 Recommend that the Acting Chief Financial Officer direct the FMD to provide all new AMEX applicants a copy of the program Policies and Procedures, perhaps . making the information available on LAN. We agree with this recommendation. Procedures are already available for AMEX applicants on the LAN in SAGE - FMD's electronic retrieval system. WFMC will also continue ' to make hardcopies available to applicants through our Customer Assistance Office. Lastly, all new AMEX applicants in HQs now sign a Memorandum of Understanding (MOU) specifying that the AMEX card is only to be used for official business. In view of these measures, we do not believe further action is required at this time. 2 25 ------- Review of EPA's American Express Card Program at Headquarters E1AMF5-I1-0020-6100304 1.5 APPENDIX IV Page 4 of7 Recommend that the Acting Chief Financial Officer direct the FMD to continue to issue periodic reminders or Money ExpreSS bulletins about proper card use and the consequences of improper use at least once a year. We agree with this recommendation. We will continue to issue periodic reminders through Money ExpreSS, Travel Training, FMD Newsletters and other appropriate communication mechanisms. Corrective Action' - Issue bulletins on the proper use of the AMEX card. , Target Pate Ongoing 1.6 Recommend that the Acting Chief Financial Officer direct the FMD to inform supervisors that they could request and obtain a list from FMD of cardholders in their organization. We agree with this recommendation. We have been doing this on a case-by-case basis and will continue to offer this service when requested. However, currently we do not have a standard AMEX report sorted by organization. We will not be able to provide supervisors with such a . report in a timely manner until we redesign the current report, and are able to track employees who change positions within EPA. We anticipate having a report of this type available by September 30, 1997. Corrective Action - Redesign cardholders report by organization. Target Date 09/30/97 2.1 Recommend that the Acting Assistant Administrator for Administration and Resources Management direct the OHROS to clarify or expand program Policies and Procedures to provide further guidance to supervisors in defining 'appropriate responses to offenses. We agree in principle with this recommendation. Currently, it is our practice to have both the OHROS and Headquarters AMEX Program staff perform ongoing reviews of their policies and procedures on potential disciplinary situations. This enables our staffs to clarify, if necessary, and to ensure that our supervisors have the most up-to-date information available. However, it is our belief that significant improvements in supervisory disciplinary actions can be achieved through a stronger management approach rather than just the clarification or expansion of existing policy or program directives. OHROS has discussed with FMD representatives and Headquarters and Regional Human Resource staffs how to best deal with individuals who have misused their AMEX credit card. The Agency's first-line supervisors 3 26 ------- Reviewof EPA's American Eipre» Card Program at Headquarters E1AMF5-11-0020-6100304 APPENDIX IV Page 5 of7 generally invoke formal disciplinary actions as a last, not a first, resort to solve conduct problems. It is our belief that each instance of AMEX misuse should be evaluated on an individual basis and that line supervisors should receive clear direction and support from their senior management (AA/RA, second line supervisors, local AMEX Program staff, Senior Resource Official, Human Resource staff) on how to properly apply disciplinary action. Corrective Action Target Pate - Clarify or expand policies/procedures on disciplinary action Ongoing for AMEX credit card misuse. 2.2 Recommend that the Acting Assistant Administrator Tor Administration and Resources Management direct OHROS to work with the Office of General Counsel to include improper use of government charge cards as an example of misuse of government property (or a separate offense) in the Conduct and Discipline Order. We agree in principle with this recommendation. On September 1, 1994, the Office of the Comptroller issued a memorandum addressing misuse and abuse of the AMEX credit card. This memorandum included specific guidance for dealing with first, second and later offenses for credit card misuse. We are currently reviewing this guidance to determine how it can be most effectively applied, including its incorporation into EPA's Conduct and Discipline Order. Any change to the Order will have to involve coordination with management and negotiation with the unions. Corrective Action Target Date - Complete review of the guidance and decide whether a change 12/15/96 to the Conduct and Discipline Order is necessary. 2.3 Recommend that the Acting Assistant Administrator for Administration and Resources Management direct OHROS to provide FMD access to accurate personnel data to locate cardholders and their supervisors. We agree with the recommendation. Discussions are currently under way between FMD and the Headquarters Human Resources Staff Directors to determine the best method for providing FMD with accurate data on the organizational location of cardholders. Implementation of this recommendation will depend upon the alignment of various computer protocols, data bases, and access procedures. Corrective Action - Begin implementation of better methods for providing FMD with employee organization location and their supervisor's name. 4 27 Target Date 10/30/96 ------- Review of EPA's American EipreM Card Program at Headquarters E1AMF5-11-0020-6100304 APPENDIX IV Page 6 of 7 ATTACHMENT B SPECIFIC COMMENTS RAISED IN THE DRAFT AUDIT REPORT E1AMF5-11-0020: REVIEW OF EPA'S AMERICAN EXPRESS CARD PROGRAM AT HEADQUARTERS . . ~f z The following represents the Chief Financial Officer (CFO) and Office of Administration and Resources Management's (OARM) consolidated specific comments to the draft audit report of the Review of EPA's American Express Card Program at Headquarters. We have cited the parts of the report that we have taken exception to by page and paragraph. Specific Comments pl^jl "Office of Inspector General (OIG) officials became aware of instances of fraud and misuse, so we planned an audit of the AMEX Program at Headquarters." This is not entirely accurate. The OIG became aware of these instances because WFMC reported these cases to the OIG. The OIG should mention this fact in their report. plfll "During the course of our work, members of the House of Representatives and the 'general public also expressed concern about the level of card abuse/misuse that might be occurring." Please change this sentence to read, "During the course of our work, members of the House of Representatives and the general public also expressed concern about the level of card abuse/misuse that might be occurring in the Federal government." p2^|2 "They should maintain an up-to-date list..." Please change this statement to read, "AMEX should maintain an up-to-date list..." since it is the employee's responsibility to inform AMEX of any change of phone numbers/addresses. p2p "Approximately, 6,800 employees across the Agency...Over half of those (3,990 accounts) belong to Headquarters employees." This information is inaccurate. Throughout the report the number of Agency-wide AMEX accounts is listed as 6,800. The actual Agency number is 13,000+. Secondly, there are 4781 Headquarters employee accounts, not 3,990. Please make the appropriate corrections. p9|2 "Some cardholders in our judgmental sample..." pi IHI "Some of them said that..." 28 ------- Review of EPA's American Express Card Program at Headquarters EIAMFS-11-0020-6100304 APPENDIX IV Page 7 of7 We would like to see more definite numbers when referring to cardholders and supervisors in this report. This terminology is used at least two more times in the same Chapter.- p!2p "Eleven of the 23 accounts in our judgmental sample... By the end of the review period, eight of the accounts in this sample were canceled." This is not accurate. Currently, 15 of the 23 judgmental accounts in the sample have been canceled. This shpuld be mentioned in the report. 2 29 ------- Review of EPA's American Express Card Program at Headquarters ElAMFS-t t-0020-6100304 [This page intentionally left blank] 30 ------- Review of EPA's American Eipress Card Program at Headquarters E1AMF5-11-0020-6100304 APPENDIX V Page 1 of2 REPORT DISTRIBUTION Office of Inspector General Inspector General (2410) Deputy Inspector General (2410) Headquarters Offices Director, Financial Management Division (3303F) Director, Office of Human Resources and Organizational Services (3601) Deputy Director, Financial Management Division (3303F) Chief, Fiscal Policies and Procedures Branch (3303F) Chief, Washington Financial Management Center (3303) Principal Deputy General Counsel (2311) Marian Cooper (3301) BeraieDavis(3102) Leigh B. Diggs (3642) John O'Brien (3634) Larry Achter (3303F) Sun Wong (3303F) Krista Wright (3303) Judi Doucette (3303) 31 ------- Review of EPA's American Express Card Program at Headquarters Assistant Administrator for Air and Radiation (6101) Assistant Administrator for Enforcement and Compliance Assuratfce (2201) Assistant Administrator for International Activities (2610) Assistant Administrator for Policy, Planning, and Evaluation (2111) Assistant Administrator for Prevention, Pesticides, and Toxic Substances (7101) Assistant Administrator for Research and Development (8101) Assistant Administrator for Solid Waste and Emergency • Response (5101) Assistant Administrator for Water (4101) Headquarters Library (3304) E1AMF5-11-0020-6100304 APPENDIX V Page 2 of 2 32 ------- |