>^tDsr^ ^ pro^n° office of inspector general o I U.S. ENVIRONMENTAL PROTECTION AGENCY Compliance with the law EPA's Travel Card Program at Low Risk for Unauthorized Purchases Report No. 17-P-0377 September 6, 2017 0 (/) UJ < 1 o on D Q. I- Z > O o (/) D -I < o o oc o SlTiartPay 2 United States of America |||jj||^ Supporting your mission If misuse suspected, call (800) xxx-xxxx * ? U. S. GovernmentTax Exempt (!¦V? I 4- i £ Valid Thru 12/31/18 JOHN SMITH ------- Report Contributors: Doug LaTessa Patrick Mclntyre Mike Petscavage Mary Anne Strasser Abbreviations EPA U.S. Environmental Protection Agency FMFIA Federal Managers' Financial Integrity Act FY Fiscal Year OIG Office of Inspector General OMB Office of Management and Budget U.S.C. United States Code Cover photo: A sample government purchase card. (U.S. General Services Administration) Are you aware of fraud, waste or abuse in an EPA program? EPA Inspector General Hotline 1200 Pennsylvania Avenue, NW (2431T) Washington, DC 20460 (888) 546-8740 (202) 566-2599 (fax) OIG Hotline@epa.gov Learn more about our OIG Hotline. EPA Office of Inspector General 1200 Pennsylvania Avenue, NW (2410T) Washington, DC 20460 (202) 566-2391 www.epa.gov/oiq Subscribe to our Email Updates Follow us on Twitter @EPAoig Send us your Project Suggestions ------- ^EDSrx * Q \ U8&J U.S. Environmental Protection Agency Office of Inspector General At a Glance 17-P-0377 September 6, 2017 Why We Did This Audit The Government Charge Card Abuse Prevention Act of 2012 requires the Inspector General of each executive agency with more than $10 million in travel card spending to conduct periodic audits or reviews of travel card programs to analyze risks of illegal, improper or erroneous purchases and payments. Our objective was to analyze the risks of illegal, improper or erroneous purchases and payments within the U.S. Environmental Protection Agency's (EPA's) travel card program. This report addresses the following: • Compliance with the law. EPA's Travel Card Program at Low Risk for Unauthorized Purchases What We Found The EPA travel card program is at low risk for unauthorized purchases. The EPA should continue to follow its internal controls and procedures set forth in its travel policies and Office of Management and Budget guidance governing agency travel cards. On the basis of the results of this risk assessment, the Office of Inspector General (OIG) will not include a full audit but will include a required risk assessment of the EPA's travel card program in the OIG's fiscal years 2017- 2018 work plan. Our assessment determined that the EPA's travel card program is at low risk for unauthorized purchases. Send all inquiries to our public affairs office at (202) 566-2391 or visit www.epa.gov/oia. Listing of OIG reports. ------- UNITED STATES ENVIRONMENTAL PROTECTION AGENCY WASHINGTON, D.C. 20460 THE INSPECTOR GENERAL September 6, 2017 MEMORANDUM SUBJECT: EPA's Travel Card Program at Low Risk for Unauthorized Purchases Report No. 17-P-037" FROM: Arthur A. Elkins Jr. TO: David Bloom, Acting Chief Financial Officer This is our report on the subject risk assessment conducted by the Office of Inspector General (OIG) of the U.S. Environmental Protection Agency (EPA). The project number for this risk assessment was OA-FY17-0157. This report represents the opinion of the OIG and does not necessarily represent the final EPA position. This report contains no recommendations and you are not required to respond to this report. However, if you submit a response, it will be posted on the OIG's public website, along with our memorandum commenting on your response. Your response should be provided as an Adobe PDF file that complies with the accessibility requirements of Section 508 of the Rehabilitation Act of 1973, as amended. The final response should not contain data that you do not want to be released to the public; if your response contains such data, you should identify the data for redaction or removal along with corresponding justification. We will post this report to our website at www.epa.gov/oig. ------- EPA's Travel Card Program at Low Risk for Unauthorized Purchases 17-P-0377 Table of C Purpose 1 Background 1 Responsible Offices 2 Scope and Methodology 2 Results of Risk Assessment 3 Conclusion 4 EPA Comments and OIG Evaluation 5 Appendices A Required Internal Controls 6 B Distribution 10 ------- Purpose The Office of Inspector General (OIG) conducted a risk assessment to analyze risks of illegal, improper or erroneous purchases and payments within the U.S. Environmental Protection Agency's (EPA) travel card program. Background The Government Charge Card Abuse Prevention Act of 2012 (Public Law 112-194), enacted October 5, 2012, states: The Inspector General of each executive agency with more than $10,000,000 in travel card spending shall conduct periodic audits or reviews of travel card programs to analyze risks of illegal, improper, or erroneous purchases and payments. OMB M-13-21, issued September 6, 2013, defined "periodic" to be annually, at a minimum. The EPA OIG has issued several reports on travel cards, including the following two recent reports: • On August 24, 2016, the EPA OIG issued Report No. 16-P-0282. EPA Oversight of Travel Cards Needs to Improve. The report found that the EPA did not check travel card bank rebates for accuracy. The report made six recommendations. Four have been implemented, and for the other two, the EPA implemented acceptable alternative corrective actions. • On September 22, 2015, the EPA OIG issued Report No. 15-P-0294. EPA Needs Better Management Controls for Approval of Employee Travel. The report found inadequate or no justification being provided for certain lodging above per diem rates, a lack of trip reports for international travel, vouchers not being submitted within the required timeframe, and travel card refresher training requirements not being in compliance with OMB Circular A-123 requirements. The report made 12 recommendations, and all 12 have been implemented. 17-P-0377 1 ------- Responsible Offices The Office of the Chief Financial Officer is responsible for managing the EPA travel program, including compliance with federal regulations and EPA policy, and monitoring travel program effectiveness. Within the Office of the Chief Financial Officer: • The Office of the Controller issues policies and procedures for official EPA travel (including procedures regarding travel cards), and provides guidance to program offices and regions. • The Cincinnati Finance Center manages the EPA E-GOV Travel Service System, maintains the travel help desk, assists with the E-Gov Travel Service system training when requested; serves as the EPA travel payment office, and pays proper travel claims (e.g., allowable expenses with required receipts) within 30 calendar days of receipt of travel vouchers. Scope and Methodology We conducted this performance audit from March through August 2017 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our conclusions based on our objective. To assess the risk of the EPA's travel card program, we performed the following: • Reviewed applicable laws, OMB guidance, regulations, and EPA travel card policies and procedures. Further details are in Appendix A. • Followed up on prior EPA OIG audit recommendations for the EPA travel card program. • Reviewed the U.S. General Services Administration SmartPay2 Master Contract. • Interviewed EPA staff involved with travel card oversight. • Reviewed management reports that the EPA uses to manage the travel card program. • Reviewed EPA's internal control assessments over the travel card program and the Fiscal Year (FY) 2016 Federal Managers' Financial Integrity Act (FMFIA) Assurance Letter. • Reviewed FY 2016 travel voucher data. 17-P-0377 2 ------- Results of Risk Assessment The EPA travel card program is at low risk for unauthorized purchases. The EPA should continue to follow its internal controls and procedures set forth in its travel policies and OMB's guidance governing agency travel cards. EPA Has Incorporated Required Internal Controls The EPA incorporated the 46 internal controls for travel cards that we identified as being required by the Government Charge Card Abuse Prevention Act of 2012 and OMB Circular A-123, Appendix B - Improving the Management of Government Charge Card Programs. Those 46 internal controls are listed in Appendix A of this report. We noted the following processes to implement some of the 46 controls: • The EPA requires receipts for all expenses over $75. • The EPA runs and reviews quarterly reports for frequent travelers to the same location, and submits irregularities to the Financial Policy and Planning Staff for further review. • The EPA performs verifications and internal reviews, as needed, to ensure that the EPA pays only valid travel expenses. • The EPA conducts random audits on travel vouchers less than $2,500 and audits: (a) all travel vouchers that exceed $2,500, excluding the cost of the airfare; and (b) all travel vouchers prepared for Presidential appointees and employees at the Assistant or Regional Administrator level or higher. Travel Card Contract Per the U.S. General Services Administration Smart Pay2 contract: "Full liability for all charges and fees rests with the individual cardholder" and "The Government shall not be liable for individually billed accounts." Internal Control Assessment and FMFIA Assurance Letter The EPA conducted an internal control assessment of EPA travel in FYs 2014, 2015 and 2016. The FY 2014 assessment reported 15 internal control deficiencies, and recommended corrective actions. The FY 2016 assessment report, Sensitive Payment Areas Internal Control Validation Report - Travel, Payroll, Parking and Transit, reported 14 of 15 corrective actions from the FY 2014 report have been completed, with one corrective action (related to a lack of clarity for appropriate approvals for the EPA executives) still pending completion in FY 2017. The FY 2015 internal control assessment reviewed the following areas: 17-P-0377 3 ------- • Reasonable Accommodations. • Travel Approval Lists. • International Travel. • Above Per Diem. • High Cost>$5,000. • Executive Approval Framework. The EPA's internal control assessment concluded the key travel controls were in place: travel was authorized to the approved temporary duty location, within statutory boundaries, and justified by expense receipts. That internal control assessment also identified five control deficiencies: • Travel reports for international travel were infrequently submitted, and travelers were not held accountable for submitting those reports. • Above per diem lodging requests were not often approved by second line supervisors. • Receipts were not uploaded in the travel voucher. • Second line supervisor approval was not always obtained for travel above $5,000. As a result of internal control reviews, the EPA concluded in its August 19, 2016, FMFIA Assurance Letter that the internal controls within the Office of the Chief Financial Officer are adequate to provide reasonable assurance that the programs, operations, functions and resources are protected against fraud, waste, abuse and mismanagement. Travel Voucher Totals For the first half of FY 2016 (October 1, 2015, through March 31, 2016), there were 21,441 travel vouchers. 14,009 of those vouchers (65 percent) were for less than $1,000; 7,277 (34 percent) were valued between $1,000 and $4,999, and 155 (1 percent) were equal to or greater than $5,000. Conclusion We consider the EPA's travel card program to be of low risk based on: the 46 travel card controls in place as required by statute and OMB guidance; additional controls identified by auditors; the EPA implementation of corrective actions for most identified deficiencies and progress toward completion of those remaining; the U.S. General Services Administration contract that limits the government's liability of individually billed accounts; agency verification of the effectiveness on internal controls through the agency internal reviews and assessment for the FMFIA Assurance Letter; and the low dollar value of most of the travel vouchers. 17-P-0377 4 ------- EPA Comments and OIG Evaluation We held a meeting with EPA staff on August 2, 2017, to discuss the results of our review. The EPA concurred with our conclusions, and did not have any comments based on a discussion document provided to the agency on July 19, 2017. 17-P-0377 5 ------- Appendix A Required Internal Controls Public Law 112-194, Government Charge Card Abuse Prevention Act of 2012, requires the head of each agency to establish and maintain nine safeguards and internal controls for travel charge cards. OMB Circular A-123, Appendix B, Improving the Management of Government Charge Card Programs, contains numerous internal controls related to government charge card programs, including several types of government charge cards, such as purchase, travel, fleet and integrated cards. For our review, we judgmentally selected 37 OMB internal controls related to the travel card program. Therefore, in total, we selected 46 required travel card internal controls, for which we sought to verify whether the EPA incorporated/established these controls within the agency's policies and procedures. The 46 internal controls are listed below. All 46 of the internal controls listed below are direct quotes. Public Law 112-194, Government Charge Card Abuse Prevention Act of 2012 (nine controls): 1 There is a record in each executive agency of each holder of a travel charge card issued on behalf of the agency for official use, annotated with the limitations on amounts that are applicable to the use of each such card by that travel charge card holder. 2 Rebates and refunds based on prompt payment, sales volume, or other actions by the agency on travel charge card accounts are monitored for accuracy and properly recorded as a receipt of the agency that employs the card holder. 3 Periodic reviews are performed to determine whether each travel charge card holder has a need for the travel charge card. 4 Appropriate training is provided to each travel charge card holder and each official with responsibility for overseeing the use of travel charge cards issued by the executive agency. 5 Each executive agency has specific policies regarding travel charge cards issued for various component organizations and categories of component organizations, the credit limits authorized for various categories of card holders, and categories of employees eligible to be issued travel charge cards, and designs those policies to minimize the financial risk to the Federal Government of the issuance of the travel charge cards and to ensure the integrity of travel charge card holders. 6 Each executive agency has policies to ensure its contractual arrangement with each travel charge card issuing contractor contains a requirement that the creditworthiness of an individual be evaluated before the individual is issued a travel charge card, and that no individual be issued a travel charge card if that individual is found not creditworthy as a result of the evaluation (except that this paragraph shall not preclude issuance of a restricted use, prepaid, declining balance, controlled-spend, or stored value card when the individual lacks a credit history or has a credit score below the minimum credit score established by the Director of the Office of Management and Budget). The Director of the Office of Management and Budget shall establish a minimum credit score for determining the creditworthiness of an 17-P-0377 6 ------- individual based on rigorous statistical analysis of the population of card holders and historical behaviors. Notwithstanding any other provision of law, such evaluation shall include an assessment of an individual's consumer report from a consumer reporting agency as those terms are defined in section 603 of the Fair Credit Reporting Act (15 U.S.C. 1681a). 7 Each executive agency uses effective systems, techniques, and technologies to prevent or identify improper purchases. 8 Each executive agency ensures that the travel charge card of each employee who ceases to be employed by the agency is invalidated immediately upon termination of the employment of the employee (or, in the case of a member of the uniformed services, upon separation or release from active duty or full-time National Guard duty). 9 Each executive agency shall ensure that, where appropriate, travel card payments are issued directly to the travel card-issuing bank for credit to the employee's individual travel card account. OMB Circular A-123, Appendix B, Improving the Management of Government Charge Card Programs (37 controls): 1 Identification of key management officials and their responsibilities for travel card program. These officials will include, but are not limited to, Agency/Organization Program Coordinator (A/OPC), Approving Officials or other equivalent officials, and other accountable/billing officials. 2 Establishment of a process for formal appointment of cardholders and approving officials, where applicable. 3 Implementation of a process to ensure the credit worthiness of new charge card applicants consistent with Chapter 6 of this Guidance. 4 Description of agency training requirements. 5 Management controls, policies, and practices for ensuring appropriate travel charge card and convenience check usage and oversight of payment delinquencies, fraud, misuse, or abuse. 6 Establishment of appropriate authorization controls. 7 Explanation of how available reports and data are used for monitoring delinquency, misuse, performance metrics, spend analysis, and other relevant transactions and program management issues. 8 Documentation and record retention requirements. 9 Recovery of charge cards and other documentation when employees terminate employment, and if applicable, when an employee moves to a different organization. 10 Description of how the agency will ensure the ongoing effectiveness of the actions taken pursuant to this Guidance including, but not limited to, evaluating the effectiveness of training (Chapter 3), risk management controls (Chapters 4 and 6), refund management controls (Chapter 7), strategic sourcing policies (Chapter 8), and tax recovery efforts (Chapter 11). 11 All program participants must be trained prior to appointment. 12 All program participants must take refresher training, at a minimum, every 3 years. 17-P-0377 7 ------- 13 All program participants must certify that they have received the training, understand the regulations and procedures, and know the consequences of inappropriate actions. 14 Copies of all training certificates must be maintained pursuant to U.S. National Archives and Records Administration (NARA) requirements, General Records Schedule 1. Item 10a. 15 Implementing the appropriate controls to ensure compliance with Federal laws, agency regulations, and for monitoring program effectiveness. 16 Ensuring that any risk management policies and practices established in the agency's travel card management plan are carried out effectively and that the charge card management plan is updated with enhanced risk management policies and practices, as applicable. 17 Reviewing available data ... to detect instances of delinquency, fraud, and misuse and identify trends and outliers in relevant indicators of charge card program performance. 18 Maintaining a policy that ensures that administrative and/or disciplinary actions are initiated in the event cardholders or other program participants fail to meet their responsibilities with respect to appropriate use and timely payment of the charge card.... 19 Communicating the agency's policy with respect to administrative and/or disciplinary actions to cardholders, and other program participants, including when referral to an agency Office of Inspector General is appropriate and/or required. 20 Closely monitor delinquency reports from charge card vendors. 21 Contact the delinquent cardholder promptly to ensure payment is made or to obtain a remediation plan. 22 Formally notify the cardholder that delinquency in payment may result in disciplinary action. 23 Incorporate all controls, practices and procedures related to individually billed account delinquencies into the agency's charge card management plan, consistent with Section 2.3 of this Guidance. 24 Implement split disbursement and salary offset procedures for travel charge card programs. ... Split disbursement is the process of dividing a travel voucher reimbursement between the charge card vendor and traveler. The balance owed to each is sent directly to the applicable party. 25 Develop policies and procedures to mitigate risks associated with the travel charge card programs. 26 Develop and impose disciplinary action deemed appropriate by the agency in cases of charge card misuse. 27 Implement proper training for cardholders, approving officials, and all other staff involved in using charge cards consistent with Chapter 3 of this Guidance. 28 Review charge card statements and account activity reports to identify questionable or suspicious transactions. 29 Review ATM cash withdrawals for reasonableness and association with official travel, 30 Contact employees to inquire about questionable or suspicious transactions. 31 Initiate administrative and/or disciplinary actions for each occurrence of charge card misuse .... 17-P-0377 8 ------- 32 Incorporate all controls, practices and procedures related to charge card misuse into the agency's charge card management plan, consistent with Section 2.3 of this Guidance. 33 Implement strict internal controls that mitigate charge card risks to the great extent possible. 34 Perform periodic reviews of spending and transaction limits to ensure appropriateness. 35 Conduct internal charge card program reviews on a regular basis to ensure internal control mechanisms are adequate. 36 Deactivate travel charge cards during periods of non-travel status. 37 Keep current on new and innovative solutions to detect and prevent misuse and fraud, such as; • Data mining; • Blocking card use for high risk merchant category codes; • More restrictive spending limits during expected periods of inactivity; • Periodic review of cardholder accounts for continued necessity; and • Establishing a control to ensure that card accounts are canceled when the employee retires or leaves the agency. 17-P-0377 9 ------- Distribution The Administrator Chief of Staff Chief of Staff for Operations Deputy Chief of Staff for Operations Chief Financial Officer Associate Chief Financial Officer Controller, Office of the Controller, Office of the Chief Financial Officer Agency Follow-Up Coordinator General Counsel Associate Administrator for Congressional and Intergovernmental Relations Associate Administrator for Public Affairs Audit Follow-Up Coordinator, Office of the Administrator Audit Follow-Up Coordinator, Office of the Chief Financial Officer 17-P-0377 ------- |