U.S. ENVIRONMENTAL PROTECTION AGENCY
OFFICE OF INSPECTOR GENERAL
Catalyst for Improving the Environment
Evaluation Report
EPA Needs to Strengthen
Management Controls Over Its
Travel Authorization Process
Report No. 11-P-0223
May 10, 2011
-------
Report Contributors:
Benjamin Beeson
Bettye Bell-Daniel
Dwayne E. Crawford
Rae Donaldson
Elizabeth Grossman
Bram Hass
Eric Lewis
Ryan Patterson
Johnny Ross
Wendy Wierzbicki
Abbreviations
EPA U.S. Environmental Protection Agency
ES Executive Service
OCFO Office of the Chief Financial Officer
OIG Office of Inspector General
OMB Office of Management and Budget
SES Senior Executive Service
Hotline
To report fraud, waste, or abuse, contact us through one of the following methods:
e-mail: OIG Hotline@epa.gov
phone: 1-888-546-8740
fax: 703-347-8330
online: http://www.epa.gov/oig/hotline.htm
write: EPA Inspector General Hotline
1200 Pennsylvania Avenue NW
Mailcode 8431P (Room N-4330)
Washington, DC 20460
-------
j
\
r4l
U.S. Environmental Protection Agency
Office of Inspector General
At a Glance
11-P-0223
May 10, 2011
Why We Did This Review
The Office of the Inspector
General (OIG) became aware
I that an OIG employee could
authorize his/her own travel
despite not meeting the criteria
to do so under the U.S.
Environmental Protection
Agency's (EPA's) Travel
Policy. Therefore, we sought to
determine whether necessary
control procedures were in place
for the approval of travel
authorizations and routing
changes, and whether the
redelegation of authority for
self-approval of travel was
consistent Agency-wide.
Background
GovTrip is the EPA travel
management system that
provides federal travelers with
completely automated travel
planning and reimbursement
capabilities. The General
Services Administration
authorized the use of GovTrip,
which is a Northrop Grumman
Internet-based system. EPA's
Office of the Chief Financial
Officer manages GovTrip for
EPA.
For further information,
contact our Office of
Congressional, Public Affairs and
Management at (202) 566-2391.
The full report is at:
www.epa.gov/oiq/reports/20117
20110510-11-P-0223.pdf
Catalyst for Improving the Environment
EPA Needs to Strengthen Management
Controls Over Its Travel Authorization Process
What We Found
The EPA travel program lacks sufficient management controls to ensure that
travel documents are properly routed and authorized. Current travel controls do
not prevent prohibited employees from self-authorizing their travel. Also, the
EPA travel system allows unauthorized personnel to self-approve travel, and
does not ensure that GovTrip routing lists are controlled to ensure an
independent review of travel. We did not identify any instances of fraud during
our review. However, the lack of sufficient management controls to ensure that
travel documents are properly routed and authorized leaves the Agency's travel
system vulnerable to fraud, waste, and abuse that may go undetected.
What We Recommend
We recommend that the Chief Financial Officer revise the Agency's current
Delegations Manual to prevent the self-authorization of travel at any level within
the Agency. This revision should require the program and regional offices to
delete outdated routing lists, fix those that are incorrect, and create new routing
lists to match current organizational structures. We also recommend that the
Chief Financial Officer require that personnel not be on routing lists that give
them the authority to authorize travel, and ensure that routing list managers
notify the Cincinnati Financial Management Center when personnel or
organizational changes require routing list changes. We further recommend that
the Chief Financial Officer request that the General Services Administration
change GovTrip to prevent self-authorization of travel and include audit trails to
determine who made changes to routing lists. Finally, we recommend that the
Chief Financial Officer require Agency program and regional offices to assist the
Office of the Chief Financial Officer in developing policy to effectively manage
routing lists, and that computer programs be run monthly to determine whether
travelers are in compliance with policy, and investigate any exceptions.
The Agency's response to our draft report did not specifically state concurrence
or nonconcurrence with our audit findings. We noted that the Agency response
did include an attachment that addressed each of our recommendations, along
with proposed corrective actions and completion milestones.
-------
J UNITED STATES ENVIRONMENTAL PROTECTION AGENCY
S WASHINGTON, D.C. 20460
^
THE INSPECTOR GENERAL
May 10,2011
MEMORANDUM
SUBJECT: EPA Needs to Strengthen Management Controls
Over Its Travel Authorization Process
Report No. ll-P-0223
FROM: Arthur A. Elkins, Jr.
Inspector General
TO: Barbara Bennett
Chief Financial Officer
This is our report on the Office of Inspector General (OIG) evaluation of the U.S. Environmental
Protection Agency's (EPA's) management controls governing travel authorization and the
approval of travel vouchers using the GovTrip travel system. An OIG employee notified OIG
managers that he/she could authorize his/her own travel despite not meeting the criteria to do so
under the Agency's Travel Policy. Subsequently, we evaluated EPA's management controls over
the GovTrip approval and authorization process. Specifically, we wanted to determine whether
these controls are adequate to prevent unauthorized and unapproved travel using the GovTrip
system. This report summarizes the results of our evaluation.
The estimated direct labor for this report is $637,562.
Action Required
In accordance with EPA Manual 2750, you are required to provide a written response to this
report within 90 calendar days. You should include a corrective action plan for agreed-upon
actions, including milestone dates. Your response will be posted on the OIG's public website,
along with our memorandum commenting on your response. Your response should be provided
as an Adobe PDF file that complies with the accessibility requirements of Section 508 of the
Rehabilitation Act of 1973, as amended. The final response should not contain data that you do
not want to be released to the public; if your response contains such data, you should identify the
data for redaction or removal. We have no objections to the further release of this report to the
public. We will post this report to our website at http://www.epa.gov/oig.
-------
If you or your staff have any questions regarding this report, please contact Wade Najjum,
Assistant Inspector General for Program Evaluation, at (202) 566-0832 or najjum.wade@epa.gov:
or Eric Lewis, Product Line Director, at (202) 566-2664 or lewis.eric@epa.gov.
-------
EPA Needs to Strengthen Management Controls 11 -P-0223
Over Its Travel Authorization Process
Table of Contents
Chapters
1 Introduction 1
Purpose 1
Background 1
Interim Report Previously Issued 3
Noteworthy Achievement 4
Scope and Methodology 4
2 The EPA Travel System Is Vulnerable to Fraud, Waste, and Abuse 6
EPA 1200 Delegations Manual Permits Self-Authorization of Travel 6
EPA Travel Process Does Not Prevent Prohibited Employees From
Self-Authorizing Their Travel 6
Routing List Controls Are Not Effective 10
Conclusions 12
Recommendations 13
Agency Response to Draft Report 13
OIG Evaluation of Agency Response 14
Status of Recommendations and Potential Monetary Benefits 15
Appendices
A Agency Response to Draft Report 16
B Distribution 22
-------
Chapter 1
Introduction
Purpose
The Office of the Inspector General (OIG) evaluated the U.S. Environmental
Protection Agency's (EPA's) management controls over GovTrip and the travel
authorization process when we became aware that an OIG employee could
authorize his or her own travel despite not meeting the criteria to do so under the
Agency's Travel Policy. As such, we sought to determine whether:
Necessary control procedures were in place to help ensure that all travel
authorizations were necessary and in the best interest of the government.
EPA's travel delegation governing the redelegation of authority for self-
approval of travel was carried out consistently Agency-wide.
Program and regional offices had control procedures to help ensure that
supervisors approved all routing changes.
Background
EPA implemented the GovTrip system in September 2008. GovTrip is a Northrop
Grumman Internet-based system that provides federal travelers with travel planning
and reimbursement capabilities. The system allows for the electronic submission of
travel authorizations and travel vouchers for the approval and reimbursement of
government travel. Figure 1 shows procedures for processing travel documents.
Figure 1: Agency procedures for processing travel documents
Travel authorizations
Travel vouchers
Traveler/preparer creates the travel
authorization.
The travel authorization is routed to the
authorizing official who reviews and
stamps the document "authorized."
The travel authorization is routed to an
approver who verifies lines of accounting
and approves the document.
Traveler/preparer creates the travel voucher.
The travel voucher is electronically routed to the
authorizing official who reviews and authorizes
the travel voucher.
The Cincinnati Travel Team approves the
voucher for payment.
Source: GovTrip Supplemental Training Packet.
Travelers and travel preparers use GovTrip to arrange all aspects of transportation,
including submitting a request for and receiving reimbursement after travel.
11-P-0223
-------
Approving officials use GovTrip to monitor and manage all necessary
authorizations, disbursements, and reimbursements. Federal agency travel
administrators use GovTrip to set up and maintain data for organizations, groups,
routing lists, and individual users.
The Office of the Chief Financial Officer's (OCFO's) Cincinnati Financial
Management Center conducts travel reviews on 10 percent of the previous month's
paid vouchers based on statistical sampling of reports run by Northrop Grumman.
However, the Cincinnati Financial Management Center does not perform an
independent assessment of travel authorizations during these reviews; it relies on
the individual program and regional offices to ensure that travel authorizations are
processed correctly before employees travel.
EPA 1200 Delegation Manual
The EPA 1200 Delegations Manual establishes Agency policy governing the
delegation process for Agency management officials to act on behalf of the
Administrator. The Administrator delegates authority to the Assistant
Administrators, Regional Administrators, Associate Administrators, the General
Counsel, Office Directors reporting directly to the Administrator, the Inspector
General, the Administrative Law Judges, and the Environmental Appeals Board.
These officials may redelegate the authority to subordinate levels within their own
organizations.
However, this authority may be redelegated only when allowed in the specific
delegation, and redelegations must be made sequentially from one level to the next
(e.g., Assistant Administrator to Office Director to Division Director, rather than
from the Assistant Administrator directly to a Division Director). Further, the EPA
1200 Delegations Manual states that the original delegate must keep a written
record of all redelegations of authority to the lowest permissible organizational
level or individual exercising the authority. The redelegation of authority does not
excuse the original delegate or interim levels from the responsibility of assuring that
their delegated authorities are exercised appropriately.
Chapter 1-17-A, section 3.h, of the EPA 1200 Delegations Manual states that the
authority to approve one's own domestic travel authorizations and travel vouchers
may only be redelegated to:
The Deputy Chief of Staff in the Office of the Administrator
Office Directors (excluding the Office of the Administrator)
Directors, Office of Administration and Resources Management,
Cincinnati, and Research Triangle Park
Directors of laboratories
Office of Research and Development Laboratory/Center/Office
Directors (or equivalents)
11-P-0223
-------
According to the EPA 1200 Delegations Manual, further redelegation by these
officials is not permitted. Chapter 1-17-B of the EPA 1200 Delegations Manual
states that the lowest level for the self-approval of international travel is Regional
Administrator.
Office of Management and Budget Circular A-123
Office of Management and Budget (OMB) Circular A-123, Management's
Responsibility for Internal Controls, identifies the three objectives of internal control:
Effectiveness and efficiency of operations
Reliability of financial reporting
Compliance with applicable laws and regulations
Circular A-123 asserts that management is responsible for developing and
maintaining internal control activities to comply with standards for these objectives.
Control activities are the policies and procedures that help ensure that management
directives are carried out. Important to our assignment, segregation of duties is a
control activity that ensures there are separate personnel with authority to authorize
a transaction, process the transaction, and review the transaction.
Federal Agency Travel Administrators Manual
Chapter 5 of the Federal Agency Travel Administrators Manual notes that GovTrip
routing lists should establish the path that travel authorizations and vouchers must
take to get the appropriate authorizations or approvals. In addition to specifying the
workflow, these routing lists designate which individuals have authority to sign off
at each step in the authorization and approval process.
Interim Report Previously Issued
Our preliminary research phase revealed three potential areas of vulnerability
regarding EPA's management controls over the travel authorization process:
1. The EPA travel program, which comprises EPA policies and GovTrip,
lacked necessary control procedures to assure that all travel
authorizations were necessary and in the best interest of the government.
2. The EPA 1200 Delegations Manual allows some officials to self-
authorize their travel. However, current control procedures over the travel
authorization process do not prevent prohibited employees from self-
authorizing their travel. We noted 199 incidents in which travel appeared
to be self-authorized by persons who were not delegated that authority.
3. Poor internal controls allowed personnel to change the routing of travel
authorizations and vouchers without their supervisors' approval or
notification.
11-P-0223
-------
Given the potential significance of the vulnerabilities identified, we issued an
interim report to the Agency, EPA Travel Program Lacks Necessary Controls
(Report No. 10-P-0078, issued March 9, 2010), for information purposes only. We
informed the Agency that we would conduct further field work analysis on these
issues to determine the effectiveness of management controls over the travel
process using the GovTrip system.
Noteworthy Achievement
In response to our interim report, OCFO initiated efforts to update the Agency's
Resource Management Directive Systems 2550B, Travel Manual, with respect to
the self-approval of travel. In February 2011, OCFO requested an Agency-wide
review of proposed updates to the Travel Manual, which called for revisions to the
delegation of authority for chapters 1-17-A, "Domestic Travel"; 1-17-B,
"International Travel"; and 1-17-C, "Domestic Travel and International Travel for
the Office of the Inspector General." These proposed revisions would no longer
allow self-approval of travel authorizations/vouchers and require designation of
alternate approvers for travelers and travel-authorizing officials. The Agency's
response to our draft report indicates that the proposed completion date for these
revisions is July 31, 2011.
Scope and Methodology
We conducted field work analysis from March 2010 through February 2011 at EPA
headquarters in Washington, DC. Out of a universe of 1,248 self-authorized travel
documents,1 we identified 199 incidents of self-authorized travel authorizations and
travel vouchers processed from September 2008 through April 2009 that violated
EPA policy. The methodology used to select these incidents (and subsequent
violations) included whether the name of the authorizer of the travel was the same
as the traveler, and whether the name of the authorizer was the same as the signer of
the transaction. Based on our analysis of these incidents, we determined that there
were 197 violations.2 We followed up on our review of travel taken by Senior
Executive Service (SES) and Executive Service (ES) officials. We reviewed the
travel records of 27 SES/ES officials, which covered 114 instances in which the
officials authorized their own travel authorizations and/or vouchers. Using the EPA
1200 Delegations Manual as criteria, we found that 20 of these SES/ES officials did
not meet the requirements to self-authorize their travel.
1 For the purpose of our review, we only considered the 1,248 travel documents that were self-authorized, and from
that universe we determined the number of reportable violations and concluded that EPA needs to strengthen the
management controls over its travel authorization process.
2 Two of the 199 incidents represented test cases conducted by the OIG prior to preliminary research to determine
whether control procedures over the travel authorization process could prevent the self-authorization of travel by a
manager not authorized to approve their own travel. These tests results were successful and led to the initiation of this
assignment. As such, we did not include these two incidents when determining the overall number of violations
computed during field work analysis (i.e., 197).
11-P-0223
-------
We evaluated the effectiveness of written policies and procedures under the
Agency's travel program. We contacted Agency personnel from each Assistant
Administrator and Regional Administrator office responsible for maintaining the
routing list for persons designated to authorize travel documents. We also contacted
Agency travel managers of the GovTrip system regarding standard procedures for
updating and maintaining these routing lists to ensure that travel documents are
routed to the appropriate Agency officials with the authority to authorize travel.
We also examined the travel authorizations and travel vouchers for the 197
violations identified to determine whether travel was in the best interest of the
Agency. These 197 violations comprised 119 travel authorizations and 78 travel
vouchers, and were chosen based on comparison of the travel authorization with the
travel voucher for the same trip. In analyzing actual travel authorizations and travel
vouchers, we reviewed travel locations, reasons for travel, authorization estimates,
and voucher charges to attempt to identify fraud, waste, or abuse. For 25 selected
staff, we also followed up our review of the files by asking supervisors whether
they believed the specific travel was in the best interest of the government.
We analyzed travel documents to determine whether proper delegation was
provided and that management had approved the travel. We contacted each of the
Agency's Assistant Administrator and Regional Administrator offices to determine
whether the authority for the self-authorization of travel had been redelegated. We
also contacted persons who self-authorized travel and their supervisors3 to
determine whether these authorizations were violations and, if so, whether the
supervisors were aware of these transgressions.
We conducted our review in accordance with generally accepted government
auditing standards. Those standards require that we adequately plan for the audit;
properly supervise audit staff; obtain sufficient, appropriate evidence to provide a
reasonable basis for our findings and conclusions; and prepare audit documentation
related to the planning, conducting, and reporting for each audit. We believe that
the evidence obtained provides a reasonable basis for our findings and conclusions
based on our review objectives.
Of the 197 violations, we did not interview all supervisors. Supervisors were selected for interview if their
subordinate had committed multiple violations, if the travel was international, or if the total travel cost was over
$2,000.
11-P-0223
-------
Chapter 2
The EPA Travel System Is Vulnerable to
Fraud, Waste, and Abuse
EPA's travel program lacks the necessary management controls to ensure that travel
documents are properly routed and authorized by appropriate Agency travel
managers as required. OMB Circular A-123 requires control activities that include
policies, procedures, and mechanisms to help ensure that agency objectives are met.
These control procedures include proper segregation of duties (separate personnel
with authority to authorize a transaction, process the transaction, and review the
transaction), and the proper authorization of documentation. The EPA 1200
Delegations Manual gives Assistant Administrators the authority to authorize and
approve their own travel documents and to redelegate that authority to lower levels
within the organization. We identified 197 violations in which persons authorized
their own travel but did not meet the criteria to do so. We did not find that fraud had
occurred in those 197 violations, but the current authorization process is
nonetheless vulnerable to employees using government funds for unauthorized
travel.
EPA 1200 Delegations Manual Permits Self-Authorization of Travel
The EPA 1200 Delegations Manual allows the self-authorization of travel by high-
ranking officials and other designated individuals through proper delegation and
redelegation authority. As a control, the travel vouchers of all political appointees
are fully audited, and monthly audits are conducted on 10 percent of the paid
vouchers to other individuals However, these audits do not include the review of
travel authorizations Rather, the Agency places responsibility for ensuring that
travel authorizations are valid and in the best interest of the government with the
office authorizing travel. We found instances in which Agency personnel authorized
their own travel without meeting the requirements to do so. OMB Circular A-123
states that no single individual should be able to authorize, process, and review a
transaction. We believe the practice of allowing self-authorization of travel should
be discontinued. Because GovTrip is an Internet-based system serving all of EPA,
someone should always be available to independently approve travel.
EPA Travel Process Does Not Prevent Prohibited Employees From
Self-Authorizing Their Travel
The EPA 1200 Delegations Manual allows self-authorization of travel to the level
of Office Director through redelegation. In practice, Agency personnel lower than
the designated level of Office Director/Laboratory Director or equivalent have self-
authorized travel. We identified 197 violations in which travel documents were
11-P-0223
-------
signed by persons who did not meet the designated authorization criteria required
by the Agency's domestic and international travel policies (table 1). Consequently,
we consider these actions to be violations of the EPA 1200 Delegations Manual.
Table 1: Travel violations and corresponding reimbursement
Organizational office
Administrator
Assistant Administrator for International Affairs3
Assistant Administrator for Research and Development
Assistant Administrator for Enforcement and Compliance Assurance
Assistant Administrator for Administration and Resources Management
Assistant Administrator for Air and Radiation
Assistant Administrator for Prevention, Pesticides and Toxic Substances'5
Assistant Administrator for Solid Waste and Emergency Response
Assistant Administrator for Water
Office of Environmental Information
Office of General Counsel
Office of Inspector General
Region 2 New York
Region 3 Philadelphia
Region 4 Atlanta
Region 5 Chicago
Region 6 Dallas
Region 7 Kansas City
Region 10 Seattle
Organization not shown
Total
Number of
violations
1
1
20
49
6
18
4
7
12
2
2
4
1
9
16
18
14
2
7
4
197
Amount
reimbursed
$932.51
707.34
23,213.77
41,252.95
7,328.10
23,142.54
5,210.56
11,135.08
10,107.51
1,095.95
465.39
10,535.17
1,068.84
1,926.37
11,376.76
19,100.64
7,236.64
1,772.88
8,686.12
1,981.12
$188,276.24
Source: OIG analysis.
a Now the Office of International and Tribal Affairs.
b Now the Office of Chemical Safety and Pollution Prevention.
These 197 violations comprised 119 travel authorizations4 and 78 travel vouchers,
and were chosen based on comparison of the travel authorization with the travel
voucher for the same trip. The total amount of $188,276.24 in table 1 represents
reimbursement for travel taken from September 2008 through April 2009. These
violations were committed by travelers representing 83 percent of EPA program
and regional offices. These 197 violations represented about 16 percent of the
1,248 travel documents available for review. The OIG did not identify any instance
of fraud in the review of these 197 violations.
The results of our query yielded 114 vouchers with cost data to match the 119 authorizations. Five authorizations had been
cancelled, but were determined to have been improperly authorized, and therefore are violations under the EPA 1200 Delegations
Manual. These 5 violations are included in our 119 total for travel authorization violations.
11-P-0223
-------
As noted in our interim report, we followed up on our review of travel taken by SES
and ES officials. We reviewed the travel records of 27 SES/ES officials, which
covered 114 instances in which the officials authorized their own travel
authorizations and/or vouchers. However, using the EPA 1200 Delegations Manual
as criteria, we found that 20 of these SES officials did not meet the requirements to
self-authorize their travel. We noted 58 instances of travel by these SES/ES officials
that we determined to be violations of the EPA 1200 Delegations Manual.
Consequently, these violations represent about 51 percent of the 114 instances of
travel we reviewed by SES/ES officials. The OIG did not identify any instance of
fraud in the review of these 58 violations.
We do not believe that any personnel, including SES/ES officials, should be
allowed to authorize or approve their own travel. Self-authorization and approval
prevents intended control procedures under OMB Circular A-123 for the proper
segregation of duties and the proper authorization of documentation. As a result,
EPA's redelegation of authority allowing individuals to self-authorize or approve
travel is a control weakness in the Agency's travel process.
Authorizing Office Is Responsible for Travel
OCFO travel managers stated that designated approvers/authorizers are responsible
for ensuring that travel authorizations are valid and in the best interest of the
government. This statement is consistent with the EPA Travel Manual, which states
that the supervisors are responsible for ensuring that travel is in the best interest of
the government. OCFO travel managers stated that employees have the
responsibility to become familiar with travel policy and procedures and comply
with them. The EPA Travel Manual states that the signature of the authorizing
official signifies that the proposed travel was reviewed and found to be essential to
accomplish the Agency's objectives. We believe that control is lost when
employees can self-authorize travel.
OCFO Returns Some Self-Authorized Travel Vouchers
OCFO travel managers stated that travel vouchers are returned to employees when
the officials discover that an employee self-authorized travel. In this instance, the
vouchers must be re-signed and routed correctly through the appropriate authorizing
officials. These officials also copy the supervisor on the e-mail stating why the
voucher has been returned. In its current format, GovTrip is not capable of
preventing the self-authorization of travel because the system does not have the
capability of distinguishing among the creator, the signer, and the authorizer of a
travel document. As a result, GovTrip cannot be relied on to determine when
improper self-authorizations have occurred. Therefore, OCFO could develop a
report to identify employees who have self-authorized travel. This report could be
used to identify self-authorized travel documents and could be run to serve as a
control to detect improperly self-authorized travel.
11-P-0223
-------
Reviews Are Not Always Effective
In our opinion, OCFO's document review process is not always effective in
determining whether travel was authorized in accordance with the EPA 1200
Delegations Manual. We found 78 instances in which travel vouchers were
processed and paid to individuals who had improperly authorized their own travel
vouchers for payment. In these instances, the travel vouchers were not returned by
OCFO. One employee whose travel voucher was reviewed informed us that she was
never told that she had authorized her own travel or that it was improper. In our
opinion, these reviews are not reliable in determining whether the travel was
authorized in accordance with the EPA 1200 Delegations Manual. OCFO travel
managers stated that only 10 percent of travel vouchers for employees who are not
political appointees are audited, which further increases the likelihood that self-
authorized travel will not be discovered.
Employee Justifications for Self-Authorization Are Not Valid
Employees offered various reasons for self-authorization of travel, but we found
little merit in these justifications. Of the 197 violations identified, we found 108
were committed by multiple violatorspersonnel that had more than one violation.
The Office of Enforcement and Compliance Assurance stood out from the other
EPA offices; its Office of Civil Enforcement, Water Enforcement Division, and
Office of Criminal Enforcement, Forensics and Training, Criminal Investigation
Division, accounted for 44 of the 108 violations committed by multiple violators.
One particular multiple violator from the Office of Enforcement and Compliance
Assurance commented that on one occasion, he self-authorized his own travel so as
not to impede an ongoing investigation. Further, four others stated that they had
discussed their travel with their supervisors, but acknowledged that they were not
given the direct authority to authorize their own travel even though they had done
so. This course of action also does not provide accountability or assurance that
travel was in the best interest of the government.
Finally, we found 10 instances in which individuals stated that they thought their
supervisors had granted them the authority to self-authorize travel. However, there
was no documentation that corroborated the delegation of authority. This course of
action provides no accountability or assurance that travel was in the best interest of
the government.
Supervision Is Not Effective
We found that supervision in these 197 instances was insufficient. We interviewed
and surveyed by questionnaire the 26 supervisors of the employees who improperly
authorized their own travel. For those supervisors who responded, we noted the
following:
11-P-0223
-------
Six supervisors had improperly authorized their own travel.
Seven supervisors responded to our question on whether they would have
authorized the travel in question. These seven supervisors stated they would
have done so.
Twenty-two supervisors responded to our question on whether they were
aware that a person under their supervision had inappropriately authorized
their own travel. These 22 supervisors stated they were not aware of these
improper authorizations.
Routing List Controls Are Not Effective
We found that EPA's travel program lacks the necessary management controls to
ensure that travel documents are properly routed and authorized by appropriate
Agency travel managers as required. Chapter 5 of the GovTrip Federal Agency
Travel Administration User Manual and Training Materials states that GovTrip
routing lists establish the path that travel authorizations and vouchers must take to
get the appropriate authorizations or approvals. Chapter 17-1-A of the EPA 1200
Delegations Manual states that the authority to authorize one's own domestic travel
authorizations and travel vouchers may only be redelegated to the lowest
permissible level of Office Director/Laboratory Director or equivalent. However,
current efforts within the program offices and regions have not successfully ensured
that GovTrip routing lists are controlled to prevent unauthorized personnel below
these redelegated positions from self-authorizing their own travel.
Routing Lists Show Approval Authority and Workflow
The GovTrip Federal Agency Travel Administration User Manual and Training
Materials notes that GovTrip routing lists establish the path that travel
authorizations and vouchers must take to get the appropriate authorizations or
funding approvals. The GovTrip Federal Agency Travel Administration User
Manual and Training Materials also directs that individuals be designated with the
authority to sign off at each step in the authorization and funding approval process.
According to OCFO travel managers, GovTrip requires routing lists to push the
document through the system for appropriate authorization and funding approval.
These routing lists are critical because they structure the electronic review process.
Routing lists are developed by travel coordinators in program offices and by federal
agency travel administrators in the regions. These lists contain the names of those
designated with the authority to sign off at each step in the authorization and
funding approval process, signifying that the proposed travel was reviewed and was
deemed essential to accomplish the Agency's objectives.
OCFO officials stated that GovTrip cannot distinguish between the creator, signer,
and authorizer. Consequently, when routing lists are not updated and properly
maintained, improperly self-authorized travel can be processed through GovTrip.
For example, if employees are granted authorization authority for routing lists that
11-P-0223 10
-------
already include their names as travelers, then they could authorize their own travel.
Similarly, if employees are assigned as backup routing officials for routing lists that
included them before they became backups, then they could authorize their own
travel. We found two main program offices (Office of Water and Office of Solid
Waste and Emergency Response) each with a suboffice5 that has adopted the
practice of ensuring that authorizing officials and backups are not listed within the
groups for which they have authorization authority. Our analysis of these two main
offices revealed violations for improper self-authorization of travel. However, if
routing lists were updated and properly maintained, we believe that this would be a
useful approach in preventing employees from authorizing their own travel
documents.
Employees Can Change Routing Lists
Agency procedures and the GovTrip system allow users to change their routing
without supervisory approval or notification. We conducted two tests to determine
the effectiveness of routing controls. One test involved an OIG employee
submitting an e-mail to the Agency's GovTrip helpdesk requesting a routing list
change to another supervisor. A second test was conducted with an employee using
the GovTrip system to change the employee's designated routing list. In both tests,
the objective was to make the change without notifying the supervisor. Both tests
resulted in personnel successfully changing to another routing list and supervisor
with no notification to the actual supervisors. Ineffective controls over the routing
lists create the following vulnerabilities:
Employees can change to routing lists in which they have authorization
authority and therefore can self-authorize their travel.
Employees can change routing to a supervisor willing to sign for
unauthorized travel with no opportunity for independent review.
We were told by OCFO travel managers that individual program and regional
offices are responsible for maintaining the accuracy of their routing lists, and that
the GovTrip helpdesk personnel cannot ensure that all changes to routing lists are
appropriate because of the frequency with which these types of changes occur.
These travel managers stated that the Agency's Travel Manual is being revised to
include language stipulating that routing changes must be submitted in writing (by
e-mail) to the Cincinnati Financial Management Center by the appropriate routing
list requestor. These travel managers stated that the Cincinnati Financial
Management Center will not accept changes from travelers, and that the appropriate
designated official must provide the updates to Cincinnati Financial Management
Center.
The Office of Site Remediation Enforcement and the Office of Wetlands, Oceans, and Watersheds, respectively.
11-P-0223 11
-------
Program Office Process for Changing Routing Lists Is Unreliable
Currently, program offices rely on designated travel coordinators to update routing
lists. These travel coordinators are required to e-mail the Cincinnati Financial
Management Center with any changes to authorization privileges. Program office
travel coordinators stated that they:
Relied on supervisors or employees to inform them of necessary changes
to routing
Acted on the general guidance provided by the Cincinnati Financial
Management Center
Obtained personnel change information from administrative officers
However, this process is unreliable. As we noted, any employee can e-mail OCFO
staff to request a routing list change, or simply change the routing themselves.
OCFO travel managers stated that GovTrip controls do not provide an audit trail
identifying who made the changes to the routing lists. Consequently, GovTrip does
not have a means to identify personnel who may change routing lists to commit
fraud, waste, or abuse. We believe that these are essential controls and, without
these controls, a serious vulnerability exists.
Regional Offices Have Documented Procedures, but Timeliness Issues
Persist
OCFO allows the regions to have federal agency travel administrators to manage
the routing lists. Federal agency travel administrators reported various levels of
assurance regarding procedures for making routing list changes, including:
The use of specific forms to obtain a supervisor's approval before
making a routing change
The use of Standard Form 52s, which they receive and use to change
routing when needed
The reliance on e-mails from supervisors before a routing list is
changed.
Federal agency travel administrators also expressed concern about not being
notified in a timely manner of personnel changes that would also require changes in
GovTrip routing lists. One travel administrator believed that his ability to get signed
Standard Form 52s in a timely manner to update routing lists was hampered when
personnel processing was assumed by the EPA Shared Service Centers.
Conclusions
Necessary control procedures are not in place to help ensure that all travel
authorizations were necessary and in the best interest of the government. While the
EPA 1200 Delegations Manual allows self-authorization of travel at designated
11-P-0223 12
-------
levels of authority, EPA's current travel controls do not prevent unauthorized travel
by employees who are prohibited from doing so. Consequently, this leaves EPA
travel system vulnerable to fraud, waste, and abuse. Finally, we found that Agency-
wide procedures are needed to help ensure that program and regional supervisors
consistently approve all routing changes. We noted varying or no controls at
program and regional offices regarding this particular issue.
Recommendations
We recommend that the Chief Financial Officer:
1. Revise the Agency' s current Delegations Manual to prevent the self-
authorization of travel at any level within the Agency. This revision should:
a. Require the program and regional offices to delete outdated
routing lists, fix those that are incorrect, or create new routing
lists that are needed to match current organizational structures.
b. Require that personnel not be on routing lists that give them the
authority to authorize travel.
c. Ensure that routing list managers notify the Cincinnati Financial
Management Center expeditiously and submit appropriate
documentation when personnel or organizational changes require
routing list changes (e.g., adding new employees, changing the
approver for current employees, and making changes relative to
departure or promotion of current employees).
2. Request that the General Services Administration change GovTrip to
prevent self-authorization of travel and include audit trails to determine who
made changes to routing lists.
3. Require Agency program and regional offices to assist OCFO in developing
policy to effectively manage routing lists.
4. Develop scripts to determine whether travelers are in compliance with
policy for managing routing lists, run the scripts monthly, and investigate
exceptions.
Agency Response to Draft Report
The Agency provided its response to our draft report on March 25, 2011. The
Agency's response included its interpretation of what it believed the percentage of
self-authorization violations were relative to the number of travel documents they
indicated were processed during the period of our review. This interpretation was
the Agency's only comment regarding the findings in the report. The Agency
11-P-0223 13
-------
response also included an attachment that addressed each of our recommendations,
along with proposed corrective actions and completion milestones.
OIG Evaluation of Agency Response
We noted that the Agency did not specifically state concurrence or nonconcurrence
with our audit findings. Rather, the Agency determined a violation rate of 0.4 percent
based on comparison of the 197 violations to a total universe of 45,662 travel
documents that the Agency said were processed during the period of our review. The
Agency did not provide documentation of how they arrived at the universe of 45,662
travel documents. Nonetheless, our review efforts were to evaluate EPA's
management controls over GovTrip and the travel authorization process. Our
universe of 1,248 travel documents consisted only of self-authorized travel
documents. These documents were obtained from travel records from the Agency's
Financial Data Warehouse and were certified as accurate by the EPA GovTrip
managers. We added language to the report to clarify that our universe consisted of
1,248 instances of self-authorized travel and 197 instances in which the self-
authorized travel "violated EPA policy." More importantly, our review efforts show
that the 197 violations are evidence that a management control weakness exists that
could allow, or fail to prevent or detect, fraud, waste, or abuse in the Agency's travel
processes or travel system.
The Agency's response to our draft report is in appendix A. In accordance with
EPA Manual 2750, the Agency's final concurrence or nonconcurrence to our
findings and recommendations is due 90 days from the issuance this report.
11-P-0223 14
-------
Status of Recommendations and
Potential Monetary Benefits
RECOMMENDATIONS
Rec.
No.
1
Page
No.
13
Subject
Revise the Agency's current Delegations Manual to
Status1
0
Action Official
Chief Financial Officer
Planned
Completion
Date
07/31/11
POTENTIAL MONETARY
BENEFITS (in SOOOs)
Claimed Agreed-To
Amount Amount
prevent the self-authorization of travel at any level
within the Agency. This revision should:
a. Require the program and regional offices to
delete outdated routing lists, fix those that
are incorrect, or create new routing lists that
are needed to match current organizational
structures.
b. Require that personnel not be on routing
lists that give them the authority to
authorize travel.
c. Ensure that routing list managers notify the
Cincinnati Financial Management Center
expeditiously and submit appropriate
documentation when personnel or
organizational changes require routing list
changes (e.g., adding new employees,
changing the approver for current
employees, and making changes relative to
departure or promotion of current
employees).
13 Request that the General Services Administration
change GovTrip to prevent self-authorization of
travel and include audit trails to determine who
made changes to routing lists.
13 Require Agency program and regional offices to
assist OCFO in developing policy to effectively
manage routing lists.
13 Develop scripts to determine whether travelers are
in compliance with policy for managing routing lists,
run the scripts monthly, and investigate exceptions.
Chief Financial Officer 11/12/13
Chief Financial Officer 07/31/11
Chief Financial Officer 11/12/13
1 0 = recommendation is open with agreed-to corrective actions pending
C = recommendation is closed with all agreed-to actions completed
U = recommendation is undecided with resolution efforts in progress
11-P-0223
15
-------
Appendix A
Agency Response to Draft Report
MEMORANDUM
SUBJECT: Response to the Draft Report: Office of Inspector General Evaluation of EPA's
Travel Authorization Process, Project No. OPE-FY10-0016, dated February 17,
2011
FROM: Barbara J. Bennett
Chief Financial Officer
TO: Arthur A. Elkins, Jr.
Inspector General
Thank you for providing us with the opportunity to comment on and respond to the
findings and recommendations made in the "Draft Report: Office of Inspector General Evaluation
of EPA's Travel Authorization Process." We have reviewed the draft report and wish to correct
information provided in the Scope and Methodology section (page 4) of the report. The report
states that from a universe of 1,248 travel documents, OIG identified 197 incidents of self-
authorized travel authorizations and travel vouchers processed from September 2008 through April
2009. The actual number of travel documents processed during this period was 45,662. The 1,248
figure represents the total number which was self-approved while the 197 incidents represent the
number which did not have the authority for self-approval. Therefore, the percent of documents
self approved by individuals not delegated this authority was 0.4%.
If you have any questions concerning the audit response, please contact Stefan Silzer,
Director, Office of Financial Management, at (202) 564-5389 or Raffael Stein, Director, Office of
Financial Services at (202) 564-5385.
Attachment
cc: Maryann Froehlich
Wade Najjum
Joshua Baylson
Elizabeth Grossman
Eric Lewis
Stefan Silzer
Raffael Stein
Susan Dax
Melvin Visnick
Jeanne Conklin
11-P-0223 16
-------
Jim Wood
Dale Miller
Deborah Vanselow
Sara Floyd
Khari Nelson
Sandy Dickens
Janice Kern
Benjamin Bee son
Bettye Bell-Daniel
Dwayne E. Crawford
Rae Donaldson
Bram Hass
Ryan Patterson
Johnny Ross
Wendy Wierzbicki
11-P-0223 17
-------
Attachment
OCFO's Response to OIG Draft Report
"Office of Inspector General Evaluation of EPA 's Travel Authorization Process"
Project No. OPE-FY10-0016, dated February 17, 2011
Rec.
No.
1.
OIG Recommendation
Revise the Agency's current
delegations manual to
prevent the self-authorization
of travel at any level within
the Agency. This revision
should:
a. Require the program and
regional offices to delete
outdated routing lists, fix
those that are incorrect,
or create new routing
lists that are needed to
match current
organizational structures.
b. Require that personnel
not be on routing lists
that give them the
authority to authorize
travel.
Action
Official(s)
OCFO/Office of
Financial
Management
(OFM)
OFM
OFM
Proposed Corrective
Action
1 . 1 The revised Official
Travel Policy Manual,
Section III. Delegations of
Authority 1-17-A, 17-B,
and 17-C, states no self-
authorization of travel at
any level within the
Agency. The manual is
currently in the Agency's
Directives Clearance
Review with comments
due back April 1,2011.
We anticipate issuance by
July 2011.
1.1. a. The revised
Official Travel Policy
Manual, Section IV.
Responsibilities, requires
program and regional
offices to maintain routing
lists, send official changes
to Cincinnati Finance
Center (CFC) and request
changes from appropriate
supervisors or authorizing
officials.
1 . 1 .b. The revised Official
Travel Policy Manual,
Section IV.
Responsibilities, states
CFC will not accept
routing changes from
employees (travelers).
Proposed
Completion
Date
7/31/2011
7/31/2011
7/31/2011
11-P-0223
18
-------
Rec.
No.
2.
OIG Recommendation
c. Ensure that routing list
managers notify the
Cincinnati Financial
Management Center
expeditiously and submit
appropriate
documentation when
personnel or
organizational changes
require routing list
changes (e.g., adding
new employees,
changing the approver
for current employees,
and making changes
relative to departure or
promotion of current
employees).
Request that General
Services Administration
change GovTrip to prevent
self-authorization of travel
and include audit trails to
determine who made
changes to routing lists.
Action
Official(s)
OFM
Office of
Financial
Services (OFS)
Proposed Corrective
Action
Section III. The
Delegations of Authority
states alternate designated
individuals must authorize
or approve travel for
travel authorizing
officials. Additionally, in
collaboration with CFC,
each program office and
region should supplement
these guidelines, as
needed, to comply with
internal controls and
segregation of duties.
l.l.c. The revised
Official Travel Policy
Manual, Section IV.
Responsibilities, informs
CFC that appropriate
designated officials for
employees must provide
updates - approvers for
new employees, new
approver for current
employees, and removal
of an approver no longer
with the office or no
longer an employee. The
updates require a
signature, date, and
submission in portable
document format (PDF)
via e-mail to CFC.
2.1 The current contract
with GovTrip expires on
November 12, 2013.
However, EPA will most
likely transition to a new
service provider prior to
this deadline. A routing
Proposed
Completion
Date
7/31/2011
Before
11/12/2013
11-P-0223
19
-------
Rec.
No.
3.
4.
OIG Recommendation
Require Agency program
and regional offices to assist
OCFO in developing policy
to effectively manage routing
lists.
Develop scripts to determine
whether travelers are in
compliance with policy for
managing routing lists, run
the scripts monthly, and
investigate exceptions.
Action
Official(s)
OFM
OFS
Proposed Corrective
Action
list audit trail is one of the
requirements under the E-
Gov Travel Service 2
(ETS2) contact. At this
time, OCFO sees updating
GovTrip with the addition
of a routing list audit table
as cost prohibitive.
Furthermore, since not all
agencies use GovTrip in
the same manner as EPA,
a change to prevent self-
authorization is not
feasible. OFCO believes
that this control will be
captured when the routing
lists are updated for
compliance with
recommendations la, b,
and c.
3 . 1 The revised Official
Travel Policy Manual,
Section IV.
Responsibilities - CFC,
states in collaboration
with CFC, program
offices and regions should
supplement these
guidelines, as needed, to
comply with internal
controls and separation of
duties.
4. 1 The routing list audit
table in the ETS2 product
will allow OCFO to run a
list of changes that
occurred during the
reporting period. OCFO
would then be able to
Proposed
Completion
Date
7/31/2011
Before
11/12/2013
11-P-0223
20
-------
Rec.
No.
OIG Recommendation
Action
Official(s)
Proposed Corrective
Action
compare the list to the
requests received for the
same period and
investigate exceptions. In
the meantime, OCFO has
developed a report that
provides a list of vouchers
where the traveler's name
and the authorizer are the
same. CFC will run this
report monthly and
require additional
documentation from any
exceptions it produces.
Proposed
Completion
Date
11-P-0223
21
-------
Appendix B
Distribution
Office of the Administrator
Chief Financial Officer
Agency Followup Coordinator
General Counsel
Associate Administrator for Congressional and Intergovernmental Relations
Associate Administrator for External Affairs and Environmental Education
Audit Followup Coordinator, Office of the Chief Financial Officer
11-P-0223 22
------- |