s O \
! 32 *
Kry
PRO^
U.S. ENVIRONMENTAL PROTECTION AGENCY
OFFICE OF INSPECTOR GENERAL
Ineffective Oversight of
Purchase Cards Results in
Inappropriate Purchases
at EPA
Report No. 14-P-0128
March 4, 2014
Supporting yew moilOl
vwx\er\\ 1 ax
Scan this mobile
code to learn more
about the EPA OIG.

-------
Report Contributors:	Catherine B. Allen
Melinda Burks
Eileen Collins
Kimberly Crilly
Janet Kasper
Paula Latham
Madeline Mullen
LaTanya Scott
Abbreviations
CMM
Contracts Management Manual
EPA
U.S. Environmental Protection Agency
FMFIA
Federal Managers' Financial Integrity Act
FY
Fiscal Year
GSA
General Services Administration
OAM
Office of Acquisition Management
OARM
Office of Administration and Resources Management
OIG
Office of Inspector General
OMB
Office of Management and Budget
Cover photo: Government purchase card. (U.S. General Services Administration)
Hotline

Suggestions for Audits or Evaluations
To report fraud, waste or abuse, contact

To make suggestions for audits or evaluations,
us through one of the following methods:

contact us through one of the following methods:
email: OIG Hotline@.epa.qov

email:
OIG WEBCOMMENTSO.eDa.aov
phone: 1-888-546-8740

phone:
1-202-566-2391
fax: 1-202-566-2599

fax:
1-202-566-2599
online: httD://www.eDa.aov/oia/hotline.htm

online:
httD://www.eDa.aov/oia/contact.html#Full Info
write: EPA Inspector General Hotline

write:
EPA Inspector General Hotline
1200 Pennsylvania Avenue, NW


1200 Pennsylvania Avenue, NW
Mailcode 2431T


Mailcode 2431T
Washington, DC 20460


Washington, DC 20460

-------
tfED STAf.
*. U.S. Environmental Protection Agency	14-P-0128
Office of Inspector General	March 4 2014
/ rn

\.o At a Glance
Why We Did This Audit
The Government Charge Card
Abuse Prevention Act of 2012
states the Inspector General is
to conduct periodic
assessments of the agency
purchase card and
convenience check programs
to identify and analyze risks of
illegal, improper or erroneous
purchases and payments.
The Office of Inspector General
(OIG) also looks for categories
of purchases that could be
made by means other than
purchase cards in order to
better aggregate purchases
and obtain lower prices.
In fiscal year 2012, the
U.S. Environmental Protection
Agency's (EPA's) active
cardholders spent more than
$29 million in purchases. The
EPA did not provide effective
oversight to ensure that
purchase card holders and
approving officials complied
with internal control
procedures.
This report addresses the
following EPA theme:
• Embracing EPA as a high
performing organization.
Ineffective Oversight of Purchase Cards
Results in Inappropriate Purchases at EPA
For further information,
contact our public affairs office
at (202) 566-2391.
The full report is at:
www.epa.aov/oia/reports/2014/
20140304-14-P-0128.pdf
The EPA began taking
action to improve the
oversight of purchase
cards and is considering
other improvements.
What We Found
The EPA did not provide effective oversight to
ensure that purchase card holders and approving
officials comply with internal control procedures.
Of $152,602 in transactions we sampled, we found
$79,254 of prohibited, improper and erroneous
purchases. Some of the more egregious purchases
we identified were meals for an awards recognition ceremony and gym
memberships for EPA employees and their families.
Although the Office of Administration and Resources Management's Federal
Managers' Financial Integrity Act 2012 assurance letter stated that the agency
would take corrective actions to correct any identified vulnerabilities, it allowed
offices to skip a recent biennial review and did not require follow-up.
The EPA is analyzing transactions to identify purchases that can be made by
other means to obtain lower prices. The EPA initiated a Business Analysis and
Strategic Sourcing Service Center team to identify efficiencies in contracting to
encourage competition and decrease spending with nonmandatory vendors.
The EPA estimated potential cost savings of 8 percent.
Recommendations and Planned Agency Corrective Actions
We recommend that the EPA implement regular transaction reviews to determine
if the cardholders and approving officials are complying with EPA guidance. The
EPA should provide additional training to the purchase card holders and approving
officials to address issues identified in this report and institute follow-up actions for
the prohibited, improper or erroneous purchases identified in this audit. The EPA
should institute agencywide standard operating procedures, and revise the
Contracts Management Manual to more specifically address purchases such as
gym memberships and gift cards. In addition, the EPA should ensure that biennial
review weaknesses are corrected and change the biennial review process to
ensure that each office conducts uniform reviews, including transaction testing for
every cardholder. The EPA's planned corrective actions address all of the draft
report recommendations. Based on the response to the draft report, one
recommendation was added to the report that the agency will need to address.
Noteworthy Achievements
As we discuss in our audit results, the EPA began taking action to improve the
oversight of purchase cards. The EPA is in the process of considering additional
improvements, including focused transaction reviews to ensure compliance with
EPA policies. In addition, we commend the EPA's strategic sourcing procurement
efforts to obtain quantity discounts.

-------
UNITED STATES ENVIRONMENTAL PROTECTION AGENCY
WASHINGTON, D.C. 20460
THE INSPECTOR GENERAL
March 4, 2014
MEMORANDUM
SUBJECT: Ineffective Oversight of Purchase Cards Results in Inappropriate Purchases at EPA
Report No. 14-P-0128
This is our report on the subject audit conducted by the Office of Inspector General (OIG) of the
U.S. Environmental Protection Agency (EPA). This report contains findings that describe the problems
the OIG has identified and corrective actions the OIG recommends. This report represents the opinion of
the OIG and does not necessarily represent the final EPA position. Final determinations on matters in
this report will be made by EPA managers in accordance with established audit resolution procedures.
The office responsible for implementing most of the recommendations is the Office of Acquisition
Management. The Office of Human Resources is responsible for implementing one of the
recommendations.
Action Required
In accordance with EPA Manual 2750, you are required to provide a written response to this report
within 60 calendar days. You should include planned corrective actions and completion dates for the
unresolved recommendation. Your response will be posted on the OIG's public website, along with our
memorandum commenting on your response. Your response should be provided as an Adobe PDF file
that complies with accessibility requirements of Section 508 of the Rehabilitation Act of 1973, as
amended. The final response should not contain data that you do not want to be released to the public;
if your response contains such data, you should identify the data for redaction or removal along with
corresponding justification. We will post this report to our website at http://www.epa.gov/oig.
If you or your staff have any questions regarding this report, please contact Richard Eyermann,
acting Assistant Inspector General for Audit, at (202) 566-0565 or evermann.richard@epa.gov;
or Janet Kasper, Director, at (312) 886-3059 or kasper.ianet@epa.gov.
FROM:
Arthur A. Elkins Jr.
TO:
Craig Hooks, Assistant Administrator
Office of Administration and Resources Management

-------
Ineffective Oversight of Purchase Cards
Results in Inappropriate Purchases at EPA
14-P-0128
Table of C
Chapters
1	Introduction		1
Purpose		1
Background		1
Responsible Offices		2
Noteworthy Achievements		2
Scope and Methodology		2
2	Purchase Card Team Did Not Provide Effective Oversight		4
Purchase Card Users Must Comply with Federal and
EPA Requirements		4
EPA Cardholders and Approving Officials Did Not Comply With
Policy and Procedures		5
Ineffective Oversight Contributes to Risks		10
Purchase Card Program Needs Improvement		11
Conclusion		11
Recommendations		12
Agency Comments and OIG Evaluation		12
3	Biennial Reviews Need Improvement		15
Biennial Review Requirements		15
Biennial Reviews Are Not Effective in Identifying and Correcting
Internal Control Weaknesses		15
Internal Control Problems Continue Year After Year		17
Recommendations		17
Agency Comments and OIG Evaluation		17
4	Strategic Sourcing to Gain Better Prices		18
Status of Recommendations and Potential Monetary Benefits		20
Appendices
A Agency's Response to Draft Report	 21
B EPA's Agreed Corrective Actions and Planned Completion Dates	 25
C Distribution	 26

-------
Chapter 1
Introduction
Purpose
The Government Charge Card Abuse Prevention Act of 2012 states the Inspector
General is to conduct periodic assessments of the agency purchase card and
convenience check programs to identify and analyze risks of illegal, improper or
erroneous purchases and payments. The U.S. Environmental Protection Agency's
(EPA's) Office of Inspector General (OIG) conducted an audit of the purchase
cards and convenience checks to determine whether the EPA:
•	Has sufficient controls to identify potentially illegal, improper and
erroneous use of purchase cards.
•	Is analyzing purchase card transactions to identify purchases that could be
made by other means to obtain lower prices.
Background
The government purchase card program was established over 30 years ago to
streamline the federal acquisition processes by providing a low-cost, efficient
vehicle for obtaining goods and services directly from vendors. The General
Services Administration (GSA) administers the governmentwide purchase card
program. GSA contracts with several banks, including J.P. Morgan Chase, the
bank the EPA uses to provide purchase cards to employees.
Office of Management and Budget (OMB) Circular A-123, Appendix B,
Improving the Management of Government Charge Card Programs, established
minimum requirements and best practices for agency purchase card programs. In
addition, Appendix B requires that each agency develop and maintain written
policies and procedures for the appropriate use of government purchase cards.
The Government Charge Card Abuse Prevention Act of 2012 was enacted on
October 5, 2012. It is designed to prevent recurring waste, fraud and abuse of
government charge cards. The law requires agencies to take appropriate personnel
actions for employees who violate purchase card guidelines or make erroneous,
improper or illegal purchases. The law mandates a set of 13 core safeguards and
internal controls each agency should utilize to prevent and detect improper use of
government charge cards. It further instructs the OIG to conduct periodic risk
assessments to determine the scope, frequency and number of periodic audits. The
OIG's analysis or audits should identify:
•	Potentially illegal, improper or erroneous uses of purchase cards.
•	Any patterns of such uses.
14-P-0128
1

-------
® Categories of purchases that could be made by means other than purchase
cards in order to better aggregate purchases and obtain lower prices.
For fiscal year (FY) 2012, the EPA's 1,370 active cardholders transacted more
than $29 million in purchases. In addition, the EPA's 309 convenience check
writers wrote more than 1,000 checks totaling more than $500,000. The EPA had
1,370 active purchase card holders of the 2,071 employees who are assigned
purchase cards. Some employees have cards only for emergency response
purposes. The bank contract provides refunds based on annual net volume of sales
as well as prompt payment, and the EPA estimated that FY 2012 refund dollars
totaled $350,900.
Responsible Offices
The office responsible for implementing most of the recommendations is the
Office of Administration and Resources Management's (OARM's) Office of
Acquisition Management. OARM's Office of Human Resources is responsible for
implementing one of the recommendations.
Noteworthy Achievements
As we discuss in our audit results, the EPA began taking action to improve the
oversight of purchase cards. According to the EPA's purchase card team staff,
some of the actions the EPA has implemented as of August 2013 include review
of monthly bank reports to identify taxes paid on transactions and review of payee
names on convenience checks to look for checks to EPA employees. The EPA is
also in the process of considering other improvements, such as focused
transaction reviews to ensure compliance with EPA policies, uniform standard
operating procedures, and working with human resources on disciplinary actions
for misuse, fraud, and abuse of purchase cards.
Scope and Methodology
We conducted this audit from January 2013 through November 2013, in
accordance with generally accepted government auditing standards issued by the
Comptroller General of the United States. Those standards require that we plan
and perform the audit to obtain sufficient, appropriate evidence to provide a
reasonable basis for our findings and conclusions based on our audit objective.
We believe that the evidence obtained provides a reasonable basis for our findings
and conclusions based on our audit objective.
The purchase card team within the Office of Acquisition Management's (OAM's)
Policy, Training and Oversight Division is responsible for administering the
purchase card program and serves as the liaison between cardholders and the
contracted bank. The team establishes policies and training requirements. They
oversee set up and canceling of accounts and provide ongoing advice to
14-P-0128
2

-------
cardholders and approving officials. In addition, they conduct purchase card
oversight to ensure that the program is operating in accordance with applicable
guidance.
We evaluated the effectiveness of the EPA's internal controls through review of
policies, procedures and biennial reviews as well as transaction testing. We
analyzed the internal control procedures available on the purchase card website
and obtained from the purchase card team. We reviewed reports of declines,
infractions, inactivity, split purchases and separated employees. We reviewed
criteria documents such as OMB A-123 Appendix B, EPA's Contract
Management Manual, and EPA guidance on food and awards.
We evaluated the EPA's purchase card and convenience check internal controls
by interviewing purchase card holders, approvers and management responsible for
oversight. We tested the effectiveness of internal controls through review of
transactions selected from a focused sampling plan. We obtained a spreadsheet of
the 67,000 FY 2012 transactions. Next we reviewed the merchant names and
merchant category codes for atypical transactions and higher risk transaction
groups. Then we randomly selected 69 transactions from the 15 transaction
groups. We did not choose a statistical sample because the Government Charge
Card Abuse Prevention Act of 2012 emphasized identifying cases of illegal,
improper or erroneous purchases. We also selected 11 transactions that seemed
inappropriate because of the name or merchant category codes (such as dance
hall, child care, theater and music). Cardholders, convenience check writers and
approving officials were asked to provide documentation supporting each of the
selected transactions.
We analyzed the FY 2012 biennial reviews to identify the internal controls tested
and how the results were used by management. We also reviewed how the
internal controls were reported in OARM's annual Federal Managers' Financial
Integrity Act (FMFIA) assurance letter to the EPA Administrator. We interviewed
staff who prepared biennial reviews and the FMFIA assurance letter. We
compared the FY 2012 biennial review results to the 2008 biennial review results
and attempted to obtain the FY 2010 results as well.
We analyzed the largest dollar volume vendors from FY 2012 to determine the
top five vendors. Then we interviewed responsible staff to determine actions the
EPA is taking to obtain lower prices.
There were no prior audits impacting the objectives of this assignment.
14-P-0128
3

-------
Chapter 2
Purchase Card Team Did Not Provide
Effective Oversight
The EPA did not provide effective oversight to ensure that purchase card holders
and approving officials comply with internal control procedures. Purchase card
users must comply with federal and EPA requirements. The EPA's oversight was
not effective because of inattention to EPA policies by cardholders, approving
officials and the purchase card team. Of $152,602 in transactions we sampled, we
found $79,254 of prohibited, improper and erroneous purchases were not
detected. This lack of compliance indicates a continued risk of prohibited,
improper and erroneous purchases.1 Improved purchase card oversight potentially
saves money by reducing prohibited, improper and erroneous purchases, which
would be especially helpful in the current budget environment.
Purchase Card Users Must Comply With Federal and EPA
Requirements
OMB Circular A-123, Appendix B, Improving the Management of Government
Charge Card Programs, states that agencies should identify specific risks
associated with charge card programs, and implement strict internal controls to
mitigate these risks to the greatest possible extent. The charge card management
plan requires management controls, policies and practices for ensuring
appropriate charge card and convenience check use, oversight of payment
delinquencies, fraud, misuse or abuse.
The EPA's Contracts Management Manual (CMM) establishes policy for the use
of governmentwide commercial purchase cards. The CMM provides guidance in
the following areas:
•	Record Keeping: Cardholders are required to maintain a purchase card
log as well as other supporting documentation, and coordinate with
property officials to ensure that accountable or sensitive personal property
purchases are tracked.
•	Prior Approval: Approval from the approving and funds certifying
officials is required prior to purchase.
•	Independent Receipt Verification: Cardholders shall obtain third party
verification that the item ordered was received.
•	Prohibited Transactions: Transactions using third-party payment
processors and individual employee memberships in professional
organizations are prohibited.
1 In this report, we define improper transactions as purchases that, although intended for government use, are not
permitted by law or government/agency policy.
14-P-0128
4

-------
•	Restricted Transactions: Cardholders are restricted in making certain
purchases. For example, acquisition professionals are needed to make
purchases for orders requiring the cardholder to accept a vendor's terms or
sign a vendor's agreement or contract, public building alteration and
repair, and purchases requiring a statement of work or certain advance
payments.
•	Requires Prior Approval: Some transactions require additional approvals:
o An information management officer signature or email confirmation is
required for electronic and information technology,
o A facilities manager's signature or email confirmation is required
when the purchase includes conference facilities and meeting rooms,
audio-visual equipment, and building alteration and repair,
o A training officer's signature or email confirmation is required for
employee training.2
•	Specific Sources: The CMM lists priority sources that must be used
before purchasing from commercial vendors.
•	Closer Scrutiny Required: Non-monetary awards, light refreshments and
meals, conferences, meeting retreats and other events require closer
scrutiny.
•	Standard Operating Procedures: All approving officials must develop
standard operating procedures but the content is at the discretion of the
approving officials as long as procedures are consistent with federal and
agency policy.
EPA Cardholders and Approving Officials Did Not Comply With
Policy and Procedures
The EPA's oversight was not effective in ensuring that purchase cardholders and
approving officials complied with internal controls. The EPA's internal controls
did not prevent prohibited, improper and erroneous purchases. The EPA staff did
not follow policies on restricted and prohibited transactions and records
maintenance, leading to questions regarding the validity of the purchases.
We found a number of transactions where cardholders, approving officials, the
purchase card team and program offices were not providing oversight. Although
cardholders must evaluate each purchase request to ensure that it complies with
federal and agency acquisition rules, in many transactions, they did not. Although
the approving official is responsible for conducting personal and detailed reviews
of cardholders' transactions to ensure compliance with all applicable regulations,
policy, special approvals and purchase card procedures, the approving official
frequently did not provide the required oversight.
2 Although the CMM does not include conferences in the definition of training, EPA's process for approving
training includes any type of training event including conferences.
14-P-0128
5

-------
Table 1 summarizes top internal control issues from the 80 high risk transactions
we reviewed. No internal control issues were found in three transactions, and the
other transactions averaged two internal control issues, but one had six.
Table 1: Top internal control issues
Ref.
Internal Control Oversight Issues
Number of
transactions
1
Cardholders did not verify receipt
28
2
Cardholders did not obtain prior approval
24
3
Transaction not funded prior to purchase
20
4
Purchase logs not reviewed
14
5
Restricted transactions/missing required approvals
13
6
Required sources not utilized
11
7
Closer scrutiny required but not performed
10
8
Records not maintained
9
9
Prohibited transactions approved
7
Source: OIG analysis of documentation provided by the EPA.
1	- Cardholders Did Not Verify Receipt
In 28 (35 percent) of the 80 sampled transactions, valued at $47,222, cardholders
did not have the required independent third party verification. The CMM requires
third party verification that the ordered item was received. In one transaction, the
cardholder explained that verbal verification was received, but it was not noted.
Several training transactions did not have proof that training was received,
although some verification was provided after we asked for it. Most gift card
recipients were not required to sign for them upon receipt. Cardholders did not
obtain verification for a variety of reasons, including they did not believe it was
applicable or they did not understand the definition of third party verification.
Noncompliance increases the possibility that purchases could be made for
personal use rather than government need. It also increases the risk that the
government is paying for items that were not received.
2	- Cardholders Did Not Obtain Prior Approval
Cardholders placed orders prior to receiving approving official approval for 24
(30 percent) of the 80 sampled transactions, valued at $39,713. The CMM
requires approval prior to purchase unless approving official operating procedures
waive the requirement for certain purchases, such as office supplies. In two
training transactions, cardholders mistakenly stated that approval is not required
since the training officer had approved the training. When approving officials do
not approve purchases in advance, there is a higher risk that purchases will not
comply with EPA guidelines. Approving officials are supposed to determine if
transactions are reasonable and necessary, and their oversight can provide needed
cost savings.
14-P-0128
6

-------
3	- Transactions Not Funded Prior to Purchase
Cardholders did not obtain funding prior to purchase for 20 (25 percent) of the
80 sampled transactions, valued at $41,415. The CMM states that before placing
orders, cardholders must coordinate with the funds certifying official to ensure
funds are available. One cardholder waited until the employee received the
product before requesting the funding. Another cardholder was not aware of this
requirement. Cardholders may believe that funding is only required prior to
payment, not prior to purchase. When cardholders are noncompliant with this
funding requirement, the EPA has a higher risk of improperly obligating
government funds.
4	- Purchase Logs Not Reviewed
Approving officials did not review purchase card logs for 14 (18 percent) of the
80 sampled transactions, valued at $22,402. The CMM requires that approving
officials review and approve cardholders' logs at least quarterly. Approving
officials were inattentive to this requirement. In one transaction, the approving
official incorrectly believed it was unnecessary to perform a quarterly review
because he approved the purchase in advance. Consequently, he was unaware that
the funder and cardholder amended his prior approval to purchase an additional
item. In fact, this was a fraudulent purchase in the amount of $805. When
purchase card logs are not reviewed quarterly, cardholders may change previously
approved purchases and the approving official would not discover potential fraud.
In this budget environment, it is especially important that approving officials
ensure that cardholders are being good stewards of taxpayer dollars.
5	- Restricted Transactions/Missing Required Approvals
In 13 (15 percent) of 80 transactions, valued at $21,465, cardholders did not
follow restricted transaction and approval policies. The CMM identifies certain
transactions as restricted to purchase by acquisition professional cardholders, or
requires approval by a facilities manager, information management officer or
training officer. Cardholders who were not acquisition officials purchased items
that EPA guidance restricts to acquisition professionals. Examples of such
transactions include anything requiring a statement of work, advanced payments,
facilities or technology purchases.
• In three instances, cardholders who were not acquisition professionals
purchased gym memberships that required pre-payment for services
totaling $2,867. Two of those purchases were for family memberships,
and not just the EPA employee. The cardholders were inattentive to the
policy that requires any order requiring advance payment be ordered by
acquisition professional card holders. When cardholders do not involve
acquisition professionals, the government's interest is not protected.
14-P-0128
7

-------
•	In several transactions, meeting space was purchased without the approval
of an EPA facilities manager or by an acquisition professional cardholder.
One cardholder held a meeting at a nearby hotel and did not know he was
required to seek approval from the EPA facilities manager. The EPA could
have saved over $2,400 if the meeting was held in the nearby government
conference room.
•	In another transaction for booth rental, an acquisition professional was not
involved as required. Neither the cardholder nor the approving official
knew that a contract required an acquisition professional. When
acquisition professionals are not involved, there is a risk that the
government's interests are not protected.
Since the purchase cards are intended for simple, over-the-counter purchases, and
most cardholders are not acquisition professionals, they do not have the training
to properly process orders which require statements of work, specifications,
clauses or indefinite pricing.
6	- Required Sources Not Utilized
In 11 (14 percent) of the 80 sampled transactions, valued at $11,694, for the
purchase of supplies, cardholders and approving officials did not use mandatory
sources and thought that it was optional. The CMM allows cardholders to opt out
of using mandatory sources only under specific circumstances. One cardholder
said the mandatory vendor takes too long to deliver, and another cardholder did
not think that the mandatory source requirement applied. None of the cardholders
documented the need for an alternative vendor over mandatory sources.
Cardholders and approving officials misunderstood the EPA's policy requirement
for using mandatory sources before using a commercial vendor. When
cardholders do not use mandatory sources, the EPA does not obtain the potential
cost savings from strategic sourcing agreements.
7	- Closer Scrutiny Required But Not Performed
Ten (13 percent) of 80 sampled transactions required closer scrutiny and were not
handled appropriately. They were valued at and resulted in cost issues of $12,643.
We found that cardholders and approving officials were not cautious in the
following situations:
•	Inappropriate food purchases were a problem in three transactions. The
CMM advises cardholders and approving officials to be cautious when
placing orders for clothing, entertainment, non-monetary awards and light
refreshments. EPA Order 1900.3 established policy for determining the
circumstances where light refreshments, meals or ethnic food samples may
be purchased using EPA-appropriated funds and defines light refreshments
14-P-0128
8

-------
for award ceremonies. Although light refreshments are defined as those
that do not include portions of food typical of a meal, in one of our
samples, light refreshments included all the elements of a meal for an
awards ceremony. Four different appetizers, chicken tenderloin, fresh
fruit, pasta salad, large cookies, soft drinks and punch were purchased at a
cost of $2,900. Meals are not an allowable expense for an awards
recognition ceremony. Cardholders misinterpreted the food policies. These
funds could have been put to better use, and inadequate oversight put
funds at risk.
• Gift cards were a problem in seven transactions. In one example,
20 American Express gift cards were purchased for $1,588 to provide
on-the-spot awards. There was no third-party verification that any
awardees received the gift cards. Office of Personal Management guidance
states that cash equivalents (including gift certificates and vouchers with a
clear face value) given as awards are generally taxable. The Performance
Management Recognition Handbook states that an item or memento given
as a non-monetary award must demonstrate the employee-employer
relationship (e.g., EPA logo or other appropriate meaning) and must not
have a monetary value either in terms of being converted to cash or in
terms of clearly conveying a sense of cash value. The gift cards did not
meet these requirements. The EPA misinterpreted the policies related to
non-monetary awards. The EPA cardholders and approving officials
understood that gift cards could be used as employee awards because an
EPA attorney supposedly approved it in the past. The gift cards were not
an appropriate use of government funds and funds could have been put to
better use within EPA programs. Continued misapplication of the award
policy will continue this poor accountability and erroneous use of
government funds.
8 - Records Not Maintained
We found that nine (12 percent) of the 80 sampled transactions, valued at
$33,549, were not supported by adequate recordkeeping. Documents supporting
two transactions totaling $26,152 could not be located despite instructions to
maintain supporting documentation. The EPA's policy requires the retention of
documentation for 3 years on a fiscal year basis. Cardholders were not attentive to
this basic requirement. In two cases, the cardholders left their positions and no
arrangements were made to retain the records. In another transaction the
cardholder stated that records were not kept because of privacy concerns. This
lack of documentation increases the risk that purchases could be fraudulent,
improper or abusive.
14-P-0128
9

-------
9 - Prohibited Transactions Approved
In seven (9 percent) of 80 sampled transactions, cardholders and approving
officials made $8,165 in purchases prohibited by the CMM. The CMM prohibits a
number of types of purchases, including any order which is not a necessary expense
of appropriated funds for official government business, use of third party processors
which provide payment processing services for merchants that do not have a
system to accept the credit card, and purchase of individual employee
memberships. One cardholder purchased environmental education DVDs totaling
$500 and used a third party processor because she did not have check writing
privileges. In two other cases, the cardholders did not realize that a third party
processor was used. Another cardholder purchased an individual employee
membership in an academic organization. When the cardholders are inattentive to
CMM policy about prohibited transactions, cardholders can make unnecessary
and inappropriate purchases.
Ineffective Oversight Contributes to Risks
The EPA's oversight was not effective because of inattention to EPA policies by
cardholders, approving officials and the purchase card team. They did not identify
specific risks and implement strict internal controls to mitigate these risks to the
greatest possible extent, as required by OMB.
As part of its oversight, the purchase card team reviewed reports from the
purchase card issuing bank for split purchases, declines and separation reports to
look for erroneous transactions. However, according to the audit liaison of the
Policy, Training and Oversight Division, the purchase card team has not
conducted additional reviews of transactions due to a shortage of staff.
Approving officials wrote their own standard operating procedures, as required by
the CMM. However, some of the standard operating procedures were inconsistent
with federal and EPA policies. For example, one office's procedure classified
lab/testing supplies, furniture and computer purchases as routine. Another office's
policy did not require prior approval by the cardholder's approving official for
training. Until recently, the purchase card team did not receive or review the
standard operating procedures to know if they complied with the EPA's overall
purchase card policies.
Inadequate training contributed to noncompliance with EPA policies. Some
cardholders do not use their purchase cards every year. Consequently, they are
less experienced and unfamiliar with the proper procedures. The requirement for
training only once every 3 years may not be effective in maintaining cardholders'
retention of proper procedures.
14-P-0128
10

-------
Purchase Card Program Needs Improvement
Seventy-five of 80 reviewed transactions were not in compliance with EPA
policies. The total sample value was $152,602, of which $79,254 represented
prohibited, improper and erroneous purchases. These transactions represented
purchases of gym memberships, food, hotel space, and purchases split to stay
under threshold for using the purchase card.
Table 2: The 80 sampled transactions listed by type of transaction and cost issues
Transaction
Type
Sample
Sample
dollar
value
Third party
verification
for training
Closer
scrutiny
Restricted/
approvals
Missing
records
Prohibited
Other3
Total
cost
issues
Fitness
5
$19,735


$ 2,867
$14,368


$17,235
Gift certificates
5
8,163

8,163




8,163
Split purchases
3
7,500





$7,500
7,500
Office supplies
17
14,182

500
199


896
1,596
Food
7
4,784

3,980



21
4,001
Hotel
5
11,738


5,908


1,221
7,129
Training
4
6,466


709


7
716
Close to $3,0004
10
52,101


5,930
11,788
3,000
42
20,760
Unusual
merchant code
6
6,551


2,092

3,015

5,107
Automotive
5
7,185





17
17
Charity
4
1,750
350





350
Third party
processor
4
3,357




2,150

2,150
Convenience
checks
5
9,090
1,630

2,900



4,530
Total
80
$152,602
$1,980
$12,643
$20,606
$26,156
$8,165
$9,704
$79,254
Source: OIG analysis of sampled transactions showing source of cost issues.
These transactions were undetected by EPA's cardholders, approving officials and
purchase card team. With ineffective management controls to ensure the
appropriate use of EPA purchase cards, there is a continued risk of prohibited,
improper and erroneous purchases.
Conclusion
In summary, the EPA's oversight did not ensure that purchase card holders and
approving officials complied with internal control procedures. Half of the dollar
value of our sampled transactions contained prohibited, improper or erroneous
purchases. This indicates an ongoing risk. Improved purchase card oversight
3	This category includes split purchases, overcharges, sales tax and lost refunds due to late payment by cardholders.
4	We sampled 10 transactions close to $3,000 because the micro-purchase threshold is $3,000. Purchases over $3,000 should
be handled by acquisition professionals and purchases close to $3,000 could be split purchases.
14-P-0128
11

-------
could save the government money, which would be especially helpful in the
EPA's current budget environment.
Recommendations
We recommend that the Assistant Administrator for Administration and
Resources Management:
1.	Implement regular transaction reviews to determine if the cardholders and
approving officials are complying with EPA guidance.
2.	Institute agencywide standard operating procedures, and ensure that any
deviations comply with guidance.
3.	Provide additional training on the purchase card policy and procedures to
the purchase card holders and approving officials to address the
noncompliance issues identified in this report.
4.	Revise the CMM to more specifically address purchases requiring closer
scrutiny such as gym memberships and gift cards.
4a. Determine whether the purchase of gift cards as awards is an appropriate
use of government funds and make the necessary revisions to EPA
policies to establish appropriate internal controls.
5.	Institute follow-up actions as appropriate to hold individuals accountable
and recover the funds used for the prohibited, improper or erroneous
purchases identified in this audit.
Agency Comments and OIG Evaluation
In its response, OAM agreed with all the recommendations and provided
corrective action plans, with completion dates, to address the recommendation.
OAM also commented on some of the findings and the draft report was revised
where appropriate.
In response to recommendation 1, OAM is planning the following corrective actions.
•	Amend the CMM to address approval and documentation requirements for
purchase card actions procured through EPA's Acquisition System by
warranted contracting officers.
•	Deploy an automated system including an electronic purchase card log.
•	Research, analyze and assess the viability of establishing liaisons in each
of 23 offices to work closely with OAM on managing internal controls and
oversight responsibilities.
14-P-0128
12

-------
•	Assess the viability of increasing data mining through the bank and Visa
to enhance internal controls and oversight.
The agency indicated these corrective actions will be taken by September 30,
2014. When implemented, the agency actions, taken as whole, should address the
recommendation.
OAM agreed with recommendation 2 and plans to develop and distribute draft
standard operating procedures by March 31, 2014, with final procedures
anticipated by December 31, 2014.5 When implemented, the agency actions
should address the recommendation.
In response to recommendation 3, OAM stated it is planning the following
corrective actions.
•	Review the audit findings to ascertain the specific areas of noncompliance.
Develop mini training sessions for all cardholders and approving officials.
Training will be completed by September 30, 2014.
•	Depending on the severity of the violation, cardholder(s) and approving
official(s) deemed to be in violation of agency policy or procedures may
have their authority revoked or suspended pending the completion of the
aforementioned training.
•	Purchase card policy will be revised to include this supplemental training
requirement, as well as the new suspension and revocation implications.
A draft of the revised policy will be completed by September 30, 2014.
•	Purchase card training requirements will be changed from every 3 years to
every 2 years effective January 2014. The CMM revision will be updated
to reflect this change.
When implemented, the agency actions should address the recommendation.
In response to recommendation 4, OAM stated it is planning the following
corrective actions.
•	Revise the CMM and review the audit findings to ascertain the specific
areas requiring closer scrutiny that will be addressed with cardholders and
approving officials. A draft rewrite will be completed by September 30,
2014.
•	Review cardholder supporting documentation and converse with both the
cardholder and approving office concerning the purchase of gym
memberships. Pursue reimbursement to the agency where deemed
appropriate by June 30, 2014.
5 EPA response contained a December 30, 2015 date. However, we confirmed with OAM staff that it is supposed to
be December 30, 2014.
14-P-0128
13

-------
•	Recently blocked 130+ additional Merchant Category Codes to prevent
transactions considered high risk, including codes considered non-
applicable for routine Agency purchase card transactions.
The agency's corrective actions should address the recommendation.
OAM stated that gift card purchases are not a purchase card issue but a process
issue because managers are responsible for executing SF-50 actions, as they
would for any other monetary or time off award, in order to capture this data on
the employee's W-2 form for tax purposes. The OIG was unable to identify this
specific requirement and the response did not address the issues in the report
related to gift cards. Our review found several issues related to the use of a
purchase card to buy gift cards for awards. First, EPA Manual 3130 A2,
Recognition Policies and Procedures Manual, does not specifically address
whether gift cards can be used as informal or formal recognition. Second,
purchase card holders bought multiple quantities of gift cards at the same time but
did not always maintain records of who received the gift cards. Third, Office of
Personal Management tax guidance on awards states gift certificates and vouchers
are cash equivalents and are generally taxable regardless of amounts. The EPA
needs to address each of these issues if it is to continue to allow purchase card
holders to buy gift cards to be used as awards. Recommendation 4a has been
added to address the issues related to gift cards. The EPA will need to provide a
corrective action plan and milestone date for addressing the recommendation
when responding to the final report. The responsible office for this new
recommendation is the Office of Human Resources.
OAM agreed with recommendation 5 and proposed the following corrective
actions.
•	Update the CMM to remove the prohibition against using third party
processors. The draft rewrite of the CMM will be completed by
September 30, 2014. OIG understands that third party processors are now
common and that OAM plans to remove the prohibition from the CMM.
OIG cautions that EPA must then ensure that IRS form 1099s are generated
for individuals who receive third party processor payments for services.
•	Conduct follow-up to hold individuals accountable for other types of
prohibited, improper or erroneous purchases identified in the audit report.
Final written disposition will be completed by June 30, 2014.
When implemented, the agency actions should address the recommendation.
To assist in the resolution of the report and tracking of corrective actions,
appendix B contains a table of the agreed-to corrective actions and planned
completion dates.
14-P-0128
14

-------
Chapter 3
Biennial Reviews Need Improvement
Although OARM's FY 2012 FMFIA assurance letter stated that it would take
corrective actions to correct any identified vulnerabilities and improper use of the
purchase card, it did not complete the required 2010 biennial review and did not
ensure that corrective actions were taken on vulnerabilities identified during the
2008 biennial review. Federal and EPA policy require, at a minimum, a review
every 24 months. The purchase card team allowed offices to skip the 2010
biennial review and did not require follow-up to correct internal control
weaknesses noted in prior years' reviews because they did not believe they had
the authority to do so. Because the EPA's purchase card biennial reviews were not
effective in identifying and correcting internal control weaknesses within program
and regional offices, the same problems continued from 2008.
Biennial Review Requirements
The EPA's Purchase Card Review Program memorandum dated June 28, 2004,
stated:
There has been no Agency consistency in how program oversight
reviews are conducted, and no centralized effort to capture and
review the reports for systemic issues. The agency needs a formal,
centralized purchase card oversight program that involves OAM
and EPA program offices or regions that use the purchase card.
As a result of the memorandum, the CMM was updated to improve oversight
consistency. The CMM assigns responsibility for the overall implementation,
quality, and consistency of the purchase card program to the purchase card team.
At least once every 24 months, program organizations shall conduct a review to
ensure compliance with agency and federal policies. Program offices and regions
decide when to schedule reviews, but reviews must be conducted at a minimum
every 24 months. The review must encompass a sampling of transactions from
each of the cardholders under the approving official. Program and regional offices
shall provide the results of their reviews to the purchase card team, and the offices
should perform required follow-up or corrective actions as needed.
Biennial Reviews Are Not Effective in Identifying and Correcting
Internal Control Weaknesses
The EPA's oversight was not effective in ensuring that biennial reviews were
performed as required. The EPA was also not effective in ensuring consistency,
and the FMFIA assurance letter was inaccurate.
14-P-0128
15

-------
We were told that half of the program offices did not conduct a biennial review in
2010 as required. No consequences occurred. The CMM required biennial
reviews, but the purchase card team allowed offices to skip the 2010 biennial
review and did not follow up on previous weaknesses. The purchase card team did
not believe they had the authority to demand performance of the biennial reviews.
Since the biennial review process was not followed, corrective actions and
improved internal controls did not occur and weaknesses continued from 2008
onward. Table 3 shows that the same internal control weaknesses that occurred in
2008 continued to occur in 2012.
Table 3: Comparison of weaknesses reported in 2008 and 2012 biennial reviews
Internal control weakness
2008
biennial review
2012
biennial review
Missing third party verification of receipt
X
X
Supporting documentation not adequate
X
X
Standard operating procedure difficulties
X
X
Purchase card logs not complete
X
X
Cost allocations take more than 10 days
X
X
Not approved before funds committed
X
X
Did not use mandatory sources as required
X
X
Source: OIG analysis of the EPA's 2008 biennial review consolidated report and the
2012 biennial reviews.
The quality of the biennial reviews was inconsistent among the programs and
regional offices. We noted differences in whether responsible staff:
•	Use purchase card team guidance to perform the biennial reviews.
•	Observe and report additional risk factors noted during the review.
•	Plan the review in advance and assign support staff.
•	Test transactions of all cardholders.
These differences resulted in biennial reviews that were inconsistent and did not
allow the purchase card team to compare the internal controls in the program and
regional offices. The EPA provided inadequate guidance to promote consistency
in the biennial reviews. When quality is inconsistent, there is no way to compare
results for systemic issues and take corrective actions.
The August 17, 2012, FMFIA assurance letter issued by OARM to the EPA
Administrator stated OARM will correct any identified vulnerabilities and
improper use of the purchase card. At the time of the letter, neither the 2010 nor
the 2012 reviews had been completed. FMFIA requires the OARM program
office to attest to the soundness of its internal control procedures annually. The
assurance letter staff were not aware that the required 2010 biennial review had
not been performed. Also, they stated that the OARM letter only applied to
purchases made by OARM cardholders. When assurance letters do not provide
accurate status of internal control risks, the integrity of the FMFIA process and
14-P-0128
16

-------
the adequacy of its internal controls to prevent fraud, waste and abuse are called
into question.
Internal Control Problems Continue Year After Year
Because the EPA's purchase card biennial reviews are not effective in identifying
and correcting internal control weaknesses, the same problems continue year after
year. Also, if management is not aware of the extent of the problems, the risk
cannot be mitigated. Since the biennial review process was not used as required in
the CMM to improve the EPA's compliance with agency and federal policies,
corrective actions did not occur and weaknesses continued from 2008. In light of
the current budget situation, the purchase card team should provide adequate
internal control oversight to protect funds from unreasonable expenditures.
Recommendations
We recommend that the Assistant Administrator for Administration and
Resources Management:
6.	Ensure biennial review weaknesses are corrected by each office's
management and correctly reported in OARM's assurance letter.
7.	Change the biennial review process to ensure that each office conducts
uniform reviews including transaction testing for every cardholder.
Agency Comments and OIG Evaluation
In response to recommendation 6, OAM agreed with our recommendation and is
in the process of integrating purchase card oversight into the performance
measurement and management program in order to ensure review results are
correctly reported in OARM's assurance letter. This will be completed by
September 30, 2014. When implemented, the agency actions should address the
recommendation.
In response to recommendation 7, OAM agreed with our recommendation and
will include organizational self assessments and peer reviews under the contract
management assessment program. This will be completed by September 30, 2014.
When implemented, the agency actions should address the recommendation.
To assist in the resolution of the report and tracking of corrective actions,
appendix B contains a table of the agreed-to corrective actions and planned
completion dates.
14-P-0128
17

-------
Chapter 4
Strategic Sourcing to Gain Better Prices
The EPA is analyzing efficiencies in contracting, including purchase card
transactions to identify purchases that can be made by other means to obtain
lower prices. OMB suggests program managers should be aware of any
agencywide or multi-agencywide contracts that will yield better pricing and
ensure that cardholders are aware of agency policies for using these contracts.
The EPA just recently began its strategic sourcing efforts and is currently
focusing on information technology and lab supplies. The EPA's Business
Analysis and Strategic Sourcing Service Center staff stated that increases in
strategic sourcing agreements will result in potential cost savings of 8 percent.
OMB Circular A-123, Appendix B, aims to improve the management of
government charge card programs and suggests purchase card program managers
should be aware of any agencywide or multi-agencywide contracts that will yield
better pricing, and ensure that cardholders are aware of agency policies for using
these contracts. For example, agencies should minimize the number of small
orders from schedule contracts and consider a more strategic approach to buying
certain commodities. Lastly, agencies should review and analyze purchase card
spending patterns and levels for opportunities to negotiate discounts, improve the
buying process and increase savings based on volume.
The EPA initiated a Business Analysis and Strategic Sourcing Service Center
team to identify efficiencies in contracting in October 2012. Strategic sourcing
critically analyzes an organization's spending patterns to better leverage its
purchasing power, reduce cost and improve management of commonly purchased
goods and services. The new team is pursuing strategic sourcing opportunities
ranging from laboratory supplies to information technology services, which could
potentially save up to $60 million in annual costs or avoided costs.
We aggregated the purchase card transactions in FY 2012 by vendor and
identified the top five purchase card vendors. The top four vendors are laboratory,
office and computer suppliers. The EPA already had contracts with two of those
vendors and is currently pursuing competitive blanket purchase agreements with
two other vendors. Table 4 shows transaction and dollar volumes for the top five
vendors.
14-P-0128
18

-------
Table 4: Top Purchase Card Vendors in FY 2012
Merchant
Number of
transactions
Dollar amount
Current contract actions
Vendor A
1,459
$1,383,359
Pursuing blanket purchase agreement
Vendor B
2,803
1,231,321
Currently has a contract
Vendor C
2,075
930,370
Pursuing blanket purchase agreement
Vendor D
399
411,823
Currently has a contract
Vendor E
2,257
367,068
Nothing at this time
Source: OIG analysis of purchase card top vendors.
The EPA's efforts to find additional cost savings may be realized in new strategic
sourcing agreements. The EPA believes its efforts to pursue strategic sourcing
agreements will result in the following:
•	Increased strategic sourcing agreements may decrease spending with
nonmandatory vendors.
•	New contracts established with multiple vendors will further promote
competition and best pricing alternatives.
•	Streamlining purchase opportunities will save costs, time and effort spent
on purchases.
The EPA estimated potential cost savings of 8 percent.
In light of the EPA's strategic sourcing procurement efforts to obtain quantity
discounts, we have no recommendation.
14-P-0128
19

-------
Status of Recommendations and
Potential Monetary Benefits
RECOMMENDATIONS
POTENTIAL MONETARY
BENEFITS (In $000s)
Rec.
No.
Page
No.
Subject
Status1
Action Official
1	12 Implement regular transaction reviews to
determine if the cardholders and approving
officials are complying with EPA guidance.
2	12 Institute agencywide standard operating
procedures, and ensure that any deviations
comply with guidance.
3	12 Provide additional training on the purchase
card policy and procedures to the purchase
card holders and approving officials to address
the noncompliance issues identified in this
report.
4	12 Revise the CMM to more specially address
purchases requiring closer scrutiny such as
gym memberships and gift cards.
4a 12 Determine whether the purchase of gift cards
as awards is an appropriate use of government
funds and make the necessary revisions to
EPA policies to establish appropriate internal
controls.
5	12 Institute follow-up actions as appropriate to
hold individuals accountable and recover the
funds used for the prohibited, improper or
erroneous purchases identified in this audit.
6	17 Ensure biennial review weaknesses are
corrected by each office's management and
correctly reported in OARM's assurance letter.
7	17 Change the biennial review process to ensure
that each office conducts uniform reviews
including transaction testing for every
cardholder.
Planned
Completion
Date
Claimed
Amount
Ag reed-To
Amount
Assistant Administrator
for Administration and
Resources Management
Assistant Administrator
for Administration and
Resources Management
Assistant Administrator
for Administration and
Resources Management
Assistant Administrator
for Administration and
Resources Management
Assistant Administrator
for Administration and
Resources Management
Assistant Administrator
for Administration and
Resources Management
Assistant Administrator
for Administration and
Resources Management
Assistant Administrator
for Administration and
Resources Management
09/30/2014
12/31/2014
09/30/2014
09/30/2014
06/30/2014
09/30/2014
09/30/2014
$79
$79
O = Recommendation is open with agreed-to corrective actions pending.
C = Recommendation is closed with all agreed-to actions completed.
U = Recommendation is unresolved with resolution efforts in progress.
14-P-0128	20

-------
Appendix A
Agency's Response to Draft Report
UNITED STATES ENVIRONMENTAL PROTECTION AGENCY
WASHINGTON, D.C. 20460
OFFICE OF
ADMINISTRATION
AND RESOURCES
MANAGEMENT
JAN 24 2014
MEMORANDUM
SUBJECT: Response to Draft Audit Report OA-FY13-0116: EPA Needs to Improve
Purchase Card Oversight
FROM: Craig E. Hooks, Assistant Administrator
Office of Administration and Resources Management
TO:	Janet Kasper, Director
Contracts and Assistance Agreements Audits
OAM has reviewed Draft OIG audit OA-FY13-0116, and provides the following discussion and
information in response to audit findings and recommendations.
Response to Recommendations
Recommendation 1: Implement regular transaction reviews to determine if the cardholders and
approving officials are complying with EPA guidance.
OAM Response: OAM agrees with this recommendation, but takes exception to the report
finding that Contracting Officers (CO's) did not get Approving Official (AO) approval before
making a purchase (page 11 section 1 - Cardholders Did Not Obtain Prior Approval). Warranted
contracting officers are not subject to the same requirements as programmatic cardholders. COs
receive requisitions through EPA Acquisition System, which includes programmatic approvals
and validates the requirement. As a result, the EAS purchase request record fully complies with
purchase card approval and documentation policies. Having explained this situation, OAM
agrees that CMM Chapter 13.3 does not differentiate between documentation requirements for
CO's versus program office cardholders. Consequently, the rewrite of CMM Chapter 13.3
"Using the Government-wide Commercial Purchase Card" will address approval and
documentation requirements for purchase card actions being procured through EAS by warranted
contracting officers for programmatic clients. A draft rewrite will be completed by September
30, 2014.
With regard to approval and documentation requirements for all other cardholders, OAM will
take the following corrective actions by September 30, 2014:
14-P-0128
21

-------
•	Deploy an automated system including an electronic purchase card log with a
requirement to document ALL purchase card transactions Agency-wide. The system will
ensure documented evidence of electronic approvals and provide a record of all purchases
made with purchase cards and/or convenience checks.
•	Within each cognizant contracting organization, research, analyze and assess the viability
of establishing Organization Program Coordinator (OPC) liaisons in each of EPA's 23
offices. These individuals will work closely with OAM on managing internal controls
and oversight responsibilities within their respective programs or regional offices.
•	Assess the viability of increasing data mining reporting through the bank and Visa to
enhance internal controls and oversight.
Recommendation 2: Institute Agency-wide standard operating procedures, and ensure that any
deviations comply with guidance.
OAM Response: OAM agrees with this recommendation and will develop and distribute draft
standard operating procedures by March 31, 2014, with a final SOP anticipated by December 31,
2015.
Recommendation 3: Provide additional training on purchase card policy and procedures to
purchase cardholders and approving officials to address the non-compliance issues identified in
this report.
OAM Response: OAM agrees with this recommendation and will review the audit findings to
ascertain the specific areas of non compliance that need to be addressed with cardholders and
approving officials.
For areas of non-compliance identified, OAM will develop mini training sessions that will be
offered to all cardholder and approving officials on those subjects. These mini training sessions
will be in addition to the mandated (required) training that cardholders and approving officials
must successfully complete to obtain/maintain a purchase card, convenience check and/or
approving official authority. Training will be completed by September 30, 2014.
Depending on the severity of the violation, cardholder(s) and approving official(s) deemed to be
in violation of Agency policy and/or procedures may have their authority revoked, or suspended
pending the completion of the aforementioned training. Should a cardholder or approving official
fail to complete a required mini training session, the purchase card team will have the sole
discretion to suspend or revoke his/her purchase card, convenience check, and/or approving
official privileges. Purchase card policy will be revised to include this supplemental training
requirement, as well as the new suspension and revocation implications.
Furthermore, purchase card training requirements will be changed from every three years to
every two years for all cardholders and approving officials effective January 2014. Accordingly,
the revision to CMM 13.3 currently being vetted for comment will be updated to reflect this
change in training requirements.
14-P-0128
22

-------
Recommendation 4: Revise the CMM to more specifically address purchases requiring closer
scrutiny such as gym memberships and gift cards.
OAM Response: OAM agrees with the recommendation that questionable purchases be subject
to closer scrutiny in the revised CMM. Further, OAM will review the audit findings to ascertain
the specific areas requiring closer scrutiny that will be addressed with cardholders and approving
officials. OAM will review cardholder supporting documentation and converse with both the
cardholder and approving office concerning the purchase of gym memberships and pursue
reimbursement to the Agency where deemed appropriate by June 30, 2014.
In regards to gift card purchases, we do not consider this a purchase card issue, rather, we
consider it a process issue. When managers issue gift cards, they are responsible for executing
SF50 actions, as they would for any other monetary or time off award, in order to capture this
data on the employee's W-2 form for tax purposes.
OAM also placed a block on 130+ additional EPA Agency-wide Merchant Category Codes
(MCC) to prevent transactions considered high risk, including codes considered non-applicable
for routine Agency purchase card transactions. These transactions will be declined at the point of
sale. For blocked transactions, cardholders will be required to contact the Purchase Card Team
to discuss and provide written supporting documentation for the proposed transaction which is
reviewed by a team member. In this scenario, determinations on whether to proceed with the
purchase will be subject to closer review and scrutiny by a purchase card team member.
Recommendation 5: Institute follow-up actions as appropriate to hold individuals accountable
and recover funds used for prohibited, improper or erroneous purchases identified in this audit.
OAM Response: OAM agrees with this recommendation, but takes exception to the report
finding regarding prohibited transactions involving third party processors (page 10). As a result
of changing market conditions and best practices, OAM acknowledges CMM Chapter 13.3
contains obsolete guidance on this subject. Accordingly, the prohibition against using third party
processors will be removed in the upcoming CMM policy rewrite.
With regard to holding individuals accountable for other types of prohibited, improper or
erroneous purchases, OAM will conduct follow-up communications with individuals identified
in the OIG draft report with a copy to the individual's approving official and branch chief. These
communications will require that final written disposition of the questionable action(s) be
provided to the respective program division director. Dispositions will be completed by June 30,
2014
Recommendation 6: Ensure biennial review weaknesses are corrected by each office's
management and correctly reported in OARM's assurance letter.
OAM Response: OAM agrees with this recommendation and is in the process of integrating
purchase card oversight into the performance measurement and management program (PMMP),
in order to ensure review results are correctly reported in OARM's assurance letter. This
integration and implementation will be completed by September 30, 2014.
14-P-0128
23

-------
Recommendation 7: Change the biennial review process to ensure that each office conducts
uniform reviews including transaction testing for every cardholder.
OAM Response: OAM agrees with these recommendations and is in the process of integrating
purchase card oversight into the performance measurement and management program, to include
reviews as part of the organizational self assessments and peer reviews under the PMMP's
contract management assessment program. This integration and implementation will be
completed by September 30, 2014.
Having provided the above corrective actions in response to the OIG recommendations in the
subject audit, OAM also intends to implement a pilot program for an automated purchase card
system during FY14. The system will serve as the official cardholder electronic record including
supporting documents and receipts, and will enhance internal program controls and oversight by
allowing virtual program oversight audits of transaction records.
If you have any questions, please contact John Bashista, director, Office of Acquisition
Management at (202) 564-4310.
Attachment
cc:
Madeline Mullen
Nanci Gelb
John Bashista
Thomas Dussault
Lisa Maass
Ronda Boatright
John Showman
Steve Blankenship
Brandon McDowell
14-P-0128
24

-------
Appendix B
EPA's Agreed Corrective Actions and
Planned Completion Dates
No.
Corrective action(s)
Com p. Date
1
Amend the CMM to address approval and documentation requirements for
purchase card actions procured through EPA's Acquisition System by warranted
contracting officers.
09/30/14
2
Deploy an automated system including an electronic purchase card log.
09/30/14
3
Research, analyze and assess the viability of establishing liaisons in each of 23
offices to work closely with OAM on managing internal controls and oversight
responsibilities
09/30/14
4
Assess the viability of increasing data mining through the bank and Visa to
enhance internal controls and oversight.
09/30/14
5
Draft agency wide standard operating procedures for purchase cards.
Draft
03/31/14
Final
12/31/14
6
Review the audit findings to ascertain the specific areas of noncompliance.
Develop mini training sessions for all cardholders and approving officials.
09/30/14
7
Depending on the severity of the violation, cardholders) and approving official(s)
deemed to be in violation of agency policy or procedures may have their authority
revoked or suspended pending the completion of the aforementioned training.
09/30/14
8
Purchase card policy will be revised to include this supplemental training
requirement, as well as the new suspension and revocation implications.
Draft
09/30/14
9
Purchase card training requirements will be changed from every 3years to every
2 years effective January 2014.
completed
10
Revise the CMM so questionable purchases are subject to closer scrutiny and
review the audit findings to ascertain the specific areas requiring closer scrutiny.
Draft
09/30/14
11
Review cardholder supporting documentation and converse with both the
cardholder and approving office concerning the purchase of gym memberships.
Pursue reimbursement to the agency where deemed appropriate.
06/30/14
12
Blocked 130+ additional Merchant Category Codes to prevent transactions
considered high risk, including codes considered non-applicable for routine agency
purchase card transactions.
Completed
12/10/13
13
Update the CMM to remove the prohibition against using third party processors.
Draft
09/30/14
14
Conduct follow-up to hold individuals accountable for other types of prohibited,
improper or erroneous purchases identified in the audit report. Final written
disposition of the questionable action(s) will be provided to the respective program
division director.
06/30/14
15
Integrate purchase card oversight into the performance measurement and
management program in order to ensure review results are correctly reported in
OARM's assurance letter.
09/30/14
16
Include organizational self assessments and peer reviews under the contract
management assessment program.
09/30/14
Source: OIG analysis of EPA's January 24, 2014 response and related communication.
14-P-0128
25

-------
Appendix C
Distribution
Office of the Administrator
Assistant Administrator for Administration and Resources Management
Agency Follow-Up Official (the CFO)
Agency Follow-Up Coordinator
General Counsel
Associate Administrator for Congressional and Intergovernmental Relations
Associate Administrator for External Affairs and Environmental Education
Principal Deputy Assistant Administrator, Office of Research and Development
Principal Deputy Assistant Administrator, Office of Administration and Resources Management
Director, Grants and Interagency Agreements Management Division,
Office of Administration and Resources Management
Director, Office of Acquisition Management, Office of Administration and Resources Management
Director, Office of Policy and Resource Management, Office of Administration and
Resources Management
Director, Office of Human Resources, Office of Administration and Resources Management
Deputy Director, Office of Policy and Resource Management, Office of Administration and
Resources Management
Audit Follow-Up Coordinator, Office of Administration and Resources Management
Audit Follow-Up Coordinator, Office of Acquisition Management, Office of Administration and
Resources Management
Audit Follow-Up Coordinator, Office of Policy and Resource Management,
Office of Administration and Resources Management
14-P-0128
26

-------