>^tDsr^
^ pro^n° office of inspector general
o	I U.S. ENVIRONMENTAL PROTECTION AGENCY
Compliance with the law
EPA's Travel Card Program
at Low Risk for
Unauthorized Purchases
Report No. 17-P-0377	September 6, 2017
0
(/)
UJ
<
1
o
on
D
Q.
I-
Z
>
O
o
(/)
D
-I
<
o
o
oc
o
SlTiartPay 2 United States of America |||jj||^
Supporting your mission If misuse suspected, call (800) xxx-xxxx * ?
U. S. GovernmentTax Exempt
(!¦V?
I
4-
i

£
Valid Thru 12/31/18
JOHN SMITH

-------
Report Contributors:
Doug LaTessa
Patrick Mclntyre
Mike Petscavage
Mary Anne Strasser
Abbreviations
EPA
U.S. Environmental Protection Agency
FMFIA
Federal Managers' Financial Integrity Act
FY
Fiscal Year
OIG
Office of Inspector General
OMB
Office of Management and Budget
U.S.C.
United States Code
Cover photo: A sample government purchase card. (U.S. General Services Administration)
Are you aware of fraud, waste or abuse in an
EPA program?
EPA Inspector General Hotline
1200 Pennsylvania Avenue, NW (2431T)
Washington, DC 20460
(888) 546-8740
(202) 566-2599 (fax)
OIG Hotline@epa.gov
Learn more about our OIG Hotline.
EPA Office of Inspector General
1200 Pennsylvania Avenue, NW (2410T)
Washington, DC 20460
(202) 566-2391
www.epa.gov/oiq
Subscribe to our Email Updates
Follow us on Twitter @EPAoig
Send us your Project Suggestions

-------
^EDSrx
* Q \
U8&J
U.S. Environmental Protection Agency
Office of Inspector General
At a Glance
17-P-0377
September 6, 2017
Why We Did This Audit
The Government Charge Card
Abuse Prevention Act of 2012
requires the Inspector General
of each executive agency with
more than $10 million in travel
card spending to conduct
periodic audits or reviews of
travel card programs to analyze
risks of illegal, improper or
erroneous purchases and
payments.
Our objective was to analyze
the risks of illegal, improper or
erroneous purchases and
payments within the
U.S. Environmental Protection
Agency's (EPA's) travel card
program.
This report addresses the
following:
• Compliance with the law.
EPA's Travel Card Program at Low Risk for
Unauthorized Purchases
What We Found
The EPA travel card program is at low risk for
unauthorized purchases. The EPA should
continue to follow its internal controls and
procedures set forth in its travel policies and
Office of Management and Budget guidance
governing agency travel cards.
On the basis of the results of this risk assessment, the Office of Inspector
General (OIG) will not include a full audit but will include a required risk
assessment of the EPA's travel card program in the OIG's fiscal years 2017-
2018 work plan.
Our assessment
determined that the EPA's
travel card program is at
low risk for unauthorized
purchases.
Send all inquiries to our public
affairs office at (202) 566-2391
or visit www.epa.gov/oia.
Listing of OIG reports.

-------
UNITED STATES ENVIRONMENTAL PROTECTION AGENCY
WASHINGTON, D.C. 20460
THE INSPECTOR GENERAL
September 6, 2017
MEMORANDUM
SUBJECT: EPA's Travel Card Program at Low Risk for Unauthorized Purchases
Report No. 17-P-037"
FROM: Arthur A. Elkins Jr.
TO:
David Bloom, Acting Chief Financial Officer
This is our report on the subject risk assessment conducted by the Office of Inspector General (OIG)
of the U.S. Environmental Protection Agency (EPA). The project number for this risk assessment was
OA-FY17-0157. This report represents the opinion of the OIG and does not necessarily represent the
final EPA position.
This report contains no recommendations and you are not required to respond to this report. However, if
you submit a response, it will be posted on the OIG's public website, along with our memorandum
commenting on your response. Your response should be provided as an Adobe PDF file that complies
with the accessibility requirements of Section 508 of the Rehabilitation Act of 1973, as amended. The
final response should not contain data that you do not want to be released to the public; if your response
contains such data, you should identify the data for redaction or removal along with corresponding
justification.
We will post this report to our website at www.epa.gov/oig.

-------
EPA's Travel Card Program at Low Risk for
Unauthorized Purchases
17-P-0377
Table of C
Purpose		1
Background		1
Responsible Offices		2
Scope and Methodology		2
Results of Risk Assessment		3
Conclusion		4
EPA Comments and OIG Evaluation		5
Appendices
A Required Internal Controls	 6
B Distribution	 10

-------
Purpose
The Office of Inspector General (OIG) conducted a risk assessment to analyze
risks of illegal, improper or erroneous purchases and payments within the
U.S. Environmental Protection Agency's (EPA) travel card program.
Background
The Government Charge Card Abuse Prevention Act of 2012 (Public Law
112-194), enacted October 5, 2012, states:
The Inspector General of each executive agency with more than
$10,000,000 in travel card spending shall conduct periodic audits
or reviews of travel card programs to analyze risks of illegal,
improper, or erroneous purchases and payments.
OMB M-13-21, issued September 6, 2013, defined "periodic" to be annually, at a
minimum.
The EPA OIG has issued several reports on travel cards, including the following
two recent reports:
•	On August 24, 2016, the EPA OIG issued Report No. 16-P-0282.
EPA Oversight of Travel Cards Needs to Improve. The report found that
the EPA did not check travel card bank rebates for accuracy. The report
made six recommendations. Four have been implemented, and for the
other two, the EPA implemented acceptable alternative corrective actions.
•	On September 22, 2015, the EPA OIG issued Report No. 15-P-0294.
EPA Needs Better Management Controls for Approval of Employee Travel.
The report found inadequate or no justification being provided for certain
lodging above per diem rates, a lack of trip reports for international travel,
vouchers not being submitted within the required timeframe, and travel card
refresher training requirements not being in compliance with OMB Circular
A-123 requirements. The report made 12 recommendations, and all 12 have
been implemented.
17-P-0377
1

-------
Responsible Offices
The Office of the Chief Financial Officer is responsible for managing the EPA
travel program, including compliance with federal regulations and EPA policy,
and monitoring travel program effectiveness. Within the Office of the Chief
Financial Officer:
•	The Office of the Controller issues policies and procedures for official
EPA travel (including procedures regarding travel cards), and provides
guidance to program offices and regions.
•	The Cincinnati Finance Center manages the EPA E-GOV Travel Service
System, maintains the travel help desk, assists with the E-Gov Travel
Service system training when requested; serves as the EPA travel payment
office, and pays proper travel claims (e.g., allowable expenses with
required receipts) within 30 calendar days of receipt of travel vouchers.
Scope and Methodology
We conducted this performance audit from March through August 2017 in
accordance with generally accepted government auditing standards. Those
standards require that we plan and perform the audit to obtain sufficient,
appropriate evidence to provide a reasonable basis for our findings and
conclusions based on our audit objectives. We believe that the evidence obtained
provides a reasonable basis for our conclusions based on our objective.
To assess the risk of the EPA's travel card program, we performed the following:
•	Reviewed applicable laws, OMB guidance, regulations, and EPA travel
card policies and procedures. Further details are in Appendix A.
•	Followed up on prior EPA OIG audit recommendations for the EPA travel
card program.
•	Reviewed the U.S. General Services Administration SmartPay2 Master
Contract.
•	Interviewed EPA staff involved with travel card oversight.
•	Reviewed management reports that the EPA uses to manage the travel card
program.
•	Reviewed EPA's internal control assessments over the travel card program
and the Fiscal Year (FY) 2016 Federal Managers' Financial Integrity Act
(FMFIA) Assurance Letter.
•	Reviewed FY 2016 travel voucher data.
17-P-0377
2

-------
Results of Risk Assessment
The EPA travel card program is at low risk for unauthorized purchases. The EPA
should continue to follow its internal controls and procedures set forth in its travel
policies and OMB's guidance governing agency travel cards.
EPA Has Incorporated Required Internal Controls
The EPA incorporated the 46 internal controls for travel cards that we identified
as being required by the Government Charge Card Abuse Prevention Act of 2012
and OMB Circular A-123, Appendix B - Improving the Management of
Government Charge Card Programs. Those 46 internal controls are listed in
Appendix A of this report. We noted the following processes to implement some
of the 46 controls:
•	The EPA requires receipts for all expenses over $75.
•	The EPA runs and reviews quarterly reports for frequent travelers to the
same location, and submits irregularities to the Financial Policy and
Planning Staff for further review.
•	The EPA performs verifications and internal reviews, as needed, to ensure
that the EPA pays only valid travel expenses.
•	The EPA conducts random audits on travel vouchers less than $2,500 and
audits: (a) all travel vouchers that exceed $2,500, excluding the cost of the
airfare; and (b) all travel vouchers prepared for Presidential appointees and
employees at the Assistant or Regional Administrator level or higher.
Travel Card Contract
Per the U.S. General Services Administration Smart Pay2 contract: "Full liability
for all charges and fees rests with the individual cardholder" and "The
Government shall not be liable for individually billed accounts."
Internal Control Assessment and FMFIA Assurance Letter
The EPA conducted an internal control assessment of EPA travel in FYs 2014,
2015 and 2016. The FY 2014 assessment reported 15 internal control deficiencies,
and recommended corrective actions. The FY 2016 assessment report, Sensitive
Payment Areas Internal Control Validation Report - Travel, Payroll, Parking and
Transit, reported 14 of 15 corrective actions from the FY 2014 report have been
completed, with one corrective action (related to a lack of clarity for appropriate
approvals for the EPA executives) still pending completion in FY 2017. The
FY 2015 internal control assessment reviewed the following areas:
17-P-0377
3

-------
•	Reasonable Accommodations.
•	Travel Approval Lists.
•	International Travel.
•	Above Per Diem.
•	High Cost>$5,000.
•	Executive Approval Framework.
The EPA's internal control assessment concluded the key travel controls were in
place: travel was authorized to the approved temporary duty location, within
statutory boundaries, and justified by expense receipts. That internal control
assessment also identified five control deficiencies:
•	Travel reports for international travel were infrequently submitted, and
travelers were not held accountable for submitting those reports.
•	Above per diem lodging requests were not often approved by second line
supervisors.
•	Receipts were not uploaded in the travel voucher.
•	Second line supervisor approval was not always obtained for travel above
$5,000.
As a result of internal control reviews, the EPA concluded in its August 19, 2016,
FMFIA Assurance Letter that the internal controls within the Office of the Chief
Financial Officer are adequate to provide reasonable assurance that the programs,
operations, functions and resources are protected against fraud, waste, abuse and
mismanagement.
Travel Voucher Totals
For the first half of FY 2016 (October 1, 2015, through March 31, 2016), there
were 21,441 travel vouchers. 14,009 of those vouchers (65 percent) were for less
than $1,000; 7,277 (34 percent) were valued between $1,000 and $4,999, and
155 (1 percent) were equal to or greater than $5,000.
Conclusion
We consider the EPA's travel card program to be of low risk based on: the 46
travel card controls in place as required by statute and OMB guidance; additional
controls identified by auditors; the EPA implementation of corrective actions for
most identified deficiencies and progress toward completion of those remaining;
the U.S. General Services Administration contract that limits the government's
liability of individually billed accounts; agency verification of the effectiveness
on internal controls through the agency internal reviews and assessment for the
FMFIA Assurance Letter; and the low dollar value of most of the travel vouchers.
17-P-0377
4

-------
EPA Comments and OIG Evaluation
We held a meeting with EPA staff on August 2, 2017, to discuss the results of our
review. The EPA concurred with our conclusions, and did not have any comments
based on a discussion document provided to the agency on July 19, 2017.
17-P-0377
5

-------
Appendix A
Required Internal Controls
Public Law 112-194, Government Charge Card Abuse Prevention Act of 2012, requires the head
of each agency to establish and maintain nine safeguards and internal controls for travel charge
cards. OMB Circular A-123, Appendix B, Improving the Management of Government Charge
Card Programs, contains numerous internal controls related to government charge card
programs, including several types of government charge cards, such as purchase, travel, fleet and
integrated cards. For our review, we judgmentally selected 37 OMB internal controls related to
the travel card program. Therefore, in total, we selected 46 required travel card internal controls,
for which we sought to verify whether the EPA incorporated/established these controls within
the agency's policies and procedures. The 46 internal controls are listed below. All 46 of the
internal controls listed below are direct quotes.
Public Law 112-194, Government Charge Card Abuse Prevention Act of 2012 (nine controls):
1	There is a record in each executive agency of each holder of a travel charge card
issued on behalf of the agency for official use, annotated with the limitations on
amounts that are applicable to the use of each such card by that travel charge card
holder.
2	Rebates and refunds based on prompt payment, sales volume, or other actions by the
agency on travel charge card accounts are monitored for accuracy and properly
recorded as a receipt of the agency that employs the card holder.
3	Periodic reviews are performed to determine whether each travel charge card holder
has a need for the travel charge card.
4	Appropriate training is provided to each travel charge card holder and each official
with responsibility for overseeing the use of travel charge cards issued by the
executive agency.
5	Each executive agency has specific policies regarding travel charge cards issued for
various component organizations and categories of component organizations, the
credit limits authorized for various categories of card holders, and categories of
employees eligible to be issued travel charge cards, and designs those policies to
minimize the financial risk to the Federal Government of the issuance of the travel
charge cards and to ensure the integrity of travel charge card holders.
6	Each executive agency has policies to ensure its contractual arrangement with each
travel charge card issuing contractor contains a requirement that the creditworthiness
of an individual be evaluated before the individual is issued a travel charge card, and
that no individual be issued a travel charge card if that individual is found not
creditworthy as a result of the evaluation (except that this paragraph shall not
preclude issuance of a restricted use, prepaid, declining balance, controlled-spend, or
stored value card when the individual lacks a credit history or has a credit score
below the minimum credit score established by the Director of the Office of
Management and Budget). The Director of the Office of Management and Budget
shall establish a minimum credit score for determining the creditworthiness of an
17-P-0377
6

-------
individual based on rigorous statistical analysis of the population of card holders and
historical behaviors. Notwithstanding any other provision of law, such evaluation
shall include an assessment of an individual's consumer report from a consumer
reporting agency as those terms are defined in section 603 of the Fair Credit
Reporting Act (15 U.S.C. 1681a).
7	Each executive agency uses effective systems, techniques, and technologies to
prevent or identify improper purchases.
8	Each executive agency ensures that the travel charge card of each employee who
ceases to be employed by the agency is invalidated immediately upon termination of
the employment of the employee (or, in the case of a member of the uniformed
services, upon separation or release from active duty or full-time National Guard
duty).
9	Each executive agency shall ensure that, where appropriate, travel card payments are
issued directly to the travel card-issuing bank for credit to the employee's individual
travel card account.
OMB Circular A-123, Appendix B, Improving the Management of Government Charge Card
Programs (37 controls):
1	Identification of key management officials and their responsibilities for travel card
program. These officials will include, but are not limited to, Agency/Organization
Program Coordinator (A/OPC), Approving Officials or other equivalent officials, and
other accountable/billing officials.
2	Establishment of a process for formal appointment of cardholders and approving
officials, where applicable.
3	Implementation of a process to ensure the credit worthiness of new charge card
applicants consistent with Chapter 6 of this Guidance.
4	Description of agency training requirements.
5	Management controls, policies, and practices for ensuring appropriate travel charge
card and convenience check usage and oversight of payment delinquencies, fraud,
misuse, or abuse.
6	Establishment of appropriate authorization controls.
7	Explanation of how available reports and data are used for monitoring delinquency,
misuse, performance metrics, spend analysis, and other relevant transactions and
program management issues.
8	Documentation and record retention requirements.
9	Recovery of charge cards and other documentation when employees terminate
employment, and if applicable, when an employee moves to a different organization.
10	Description of how the agency will ensure the ongoing effectiveness of the actions
taken pursuant to this Guidance including, but not limited to, evaluating the
effectiveness of training (Chapter 3), risk management controls (Chapters 4 and 6),
refund management controls (Chapter 7), strategic sourcing policies (Chapter 8), and
tax recovery efforts (Chapter 11).
11	All program participants must be trained prior to appointment.
12	All program participants must take refresher training, at a minimum, every 3 years.
17-P-0377
7

-------
13	All program participants must certify that they have received the training, understand
the regulations and procedures, and know the consequences of inappropriate actions.
14	Copies of all training certificates must be maintained pursuant to U.S. National
Archives and Records Administration (NARA) requirements, General Records
Schedule 1. Item 10a.
15	Implementing the appropriate controls to ensure compliance with Federal
laws, agency regulations, and for monitoring program effectiveness.
16	Ensuring that any risk management policies and practices established in the agency's
travel card management plan are carried out effectively and that the charge card
management plan is updated with enhanced risk management policies and practices,
as applicable.
17	Reviewing available data ... to detect instances of delinquency, fraud, and misuse
and identify trends and outliers in relevant indicators of charge card program
performance.
18	Maintaining a policy that ensures that administrative and/or disciplinary actions are
initiated in the event cardholders or other program participants fail to meet their
responsibilities with respect to appropriate use and timely payment of the charge
card....
19	Communicating the agency's policy with respect to administrative and/or disciplinary
actions to cardholders, and other program participants, including when referral to an
agency Office of Inspector General is appropriate and/or required.
20	Closely monitor delinquency reports from charge card vendors.
21	Contact the delinquent cardholder promptly to ensure payment is made or to obtain a
remediation plan.
22	Formally notify the cardholder that delinquency in payment may result in disciplinary
action.
23	Incorporate all controls, practices and procedures related to individually billed
account delinquencies into the agency's charge card management plan, consistent
with Section 2.3 of this Guidance.
24	Implement split disbursement and salary offset procedures for travel charge card
programs. ... Split disbursement is the process of dividing a travel voucher
reimbursement between the charge card vendor and traveler. The balance owed to
each is sent directly to the applicable party.
25	Develop policies and procedures to mitigate risks associated with the travel charge
card programs.
26	Develop and impose disciplinary action deemed appropriate by the agency in cases of
charge card misuse.
27	Implement proper training for cardholders, approving officials, and all other staff
involved in using charge cards consistent with Chapter 3 of this Guidance.
28	Review charge card statements and account activity reports to identify questionable
or suspicious transactions.
29	Review ATM cash withdrawals for reasonableness and association with official travel,
30	Contact employees to inquire about questionable or suspicious transactions.
31	Initiate administrative and/or disciplinary actions for each occurrence of charge card
misuse ....
17-P-0377
8

-------
32	Incorporate all controls, practices and procedures related to charge card misuse into
the agency's charge card management plan, consistent with Section 2.3 of this
Guidance.
33	Implement strict internal controls that mitigate charge card risks to the great extent
possible.
34	Perform periodic reviews of spending and transaction limits to ensure
appropriateness.
35	Conduct internal charge card program reviews on a regular basis to ensure internal
control mechanisms are adequate.
36	Deactivate travel charge cards during periods of non-travel status.
37	Keep current on new and innovative solutions to detect and prevent misuse and fraud,
such as;
•	Data mining;
•	Blocking card use for high risk merchant category codes;
•	More restrictive spending limits during expected periods of inactivity;
•	Periodic review of cardholder accounts for continued necessity; and
•	Establishing a control to ensure that card accounts are canceled when the
employee retires or leaves the agency.
17-P-0377
9

-------
Distribution
The Administrator
Chief of Staff
Chief of Staff for Operations
Deputy Chief of Staff for Operations
Chief Financial Officer
Associate Chief Financial Officer
Controller, Office of the Controller, Office of the Chief Financial Officer
Agency Follow-Up Coordinator
General Counsel
Associate Administrator for Congressional and Intergovernmental Relations
Associate Administrator for Public Affairs
Audit Follow-Up Coordinator, Office of the Administrator
Audit Follow-Up Coordinator, Office of the Chief Financial Officer
17-P-0377

-------