^tDsr^ $ O ® J U.S. ENVIRONMENTAL PROTECTION AGENCY OFFICE OF INSPECTOR GENERAL Operating efficiently and effectively EPA Needs to Increase Oversight of Leave Bank Program to Improve Efficiency and Reduce Risk of Misuse Report No. 17-P-0374 August 28, 2017 Number of Leave Bank Recipients Compared to Leave Bank Balances 2014 2015 2016 ------- Report Contributors: Michael D. Davis Randy Holthaus Lisa Bergman Alexandra Zapata-Torres Abbreviations CFR Code of Federal Regulations DOJ Department of Justice EOUSA Executive Office of the U.S. Attorneys EPA U.S. Environmental Protection Agency FFAS Farm and Foreign Agricultural Services FPPS Federal Personnel Payroll System LBB Leave Bank Board NIH National Institutes of Health OARM Office of Administration and Resources Management OHR Office of Human Resources OIG Office of Inspector General OPM Office of Personnel Management PPL PeoplePlus U.S.C. United States Code USD A U.S. Department of Agriculture VLBP Voluntary Leave Bank Program Cover image: OIG graphic showing the number of leave bank recipients for years 2013-2015 and leave bank starting balances in hours for years 2013-2016. Are you aware of fraud, waste or abuse in an EPA program? EPA Inspector General Hotline 1200 Pennsylvania Avenue, NW (2431T) Washington, DC 20460 (888) 546-8740 (202) 566-2599 (fax) OIG Hotline@epa.gov Learn more about our OIG Hotline. EPA Office of Inspector General 1200 Pennsylvania Avenue, NW (2410T) Washington, DC 20460 (202) 566-2391 www.epa.gov/oiq Subscribe to our Email Updates Follow us on Twitter @EPAoig Send us your Project Suggestions ------- x-^tD SW *. U.S. Environmental Protection Agency 17-P-0374 | \ Hffirp of Insnprtnr ^pnpral August 28,2017 . u.o. CMViiuMiimiiidi nuiei/U \ Office of Inspector General % 5322 J At a Glance Why We Did This Review We conducted this audit to determine whether the U.S. Environmental Protection Agency (EPA) had established and implemented internal controls for the Voluntary Leave Bank Program to prevent and detect fraud, waste and abuse in the program. The EPA established its Voluntary Leave Bank Program, managed by the Office of Administration and Resources Management, in 1988. The leave bank provides assistance to federal employees who would be facing a significant financial hardship due to a medical emergency. Participating employees can receive leave contributions from the leave bank when they have exhausted their accrued leave hours and are experiencing a medical emergency. As of June 30, 2016, the EPA's voluntary leave bank balance was 249,789 hours, which we valued at about $10.8 million. This report addresses the following: • Operating efficiently and effectively. Send all inquiries to our public affairs office at (202) 566-2391 or visit www.epa.gov/oiq. Listing of OIG reports. EPA Needs to Increase Oversight of Leave Bank Program to Improve Efficiency and Reduce Risk of Misuse The stewardship of leave bank resources is vulnerable to fraud, waste and misuse because the EPA has not implemented adequate internal controls. What We Found The EPA did not adequately manage the Voluntary Leave Bank Program to assess the solvency or efficiency of the program, adequately safeguard personal employee information, or minimize the potential for misuse. The EPA did not routinely monitor the bank balance or the bank's solvency. Further, the EPA did not periodically assess whether adjustments were needed to the maximum number of hours that employees could use, or to the minimum number of hours an employee was required to contribute annually. Also, the Leave Bank Board did not routinely assess and verify medical certifications to approve an application and determine how many hours should be provided. Inaccurate timekeeping data incorrectly showed that leave bank recipients used more than the allowed 280 hours per leave year and conflicted with the payroll system. These conditions occurred because the EPA Office of Administration and Resources Management did not develop and implement official policies and procedures to administer the leave bank and govern the actions of the Leave Bank Board. Also, the timekeeping system did not have working controls to prevent employees from entering more than the leave bank hours allowed. As a result, the EPA cannot adequately determine whether the leave bank program is solvent; determine whether the hours in the bank exceed needs; adequately protect against fraud, waste and abuse; or provide supervisors with reliable information to properly verify employees' time. Recommendations and Planned Agency Corrective Actions We recommend that the Assistant Administrator for Administration and Resources Management develop and implement official policies and procedures for administering the program, conduct a risk assessment of the program, and gather and analyze the required Voluntary Leave Bank Program data and provide the results to leave bank managers for use in decision-making. In addition, we recommend that the Assistant Administrator for Administration and Resources Management and the Chief Financial Officer work together to develop and implement a method for supervisors to view real-time data of employee leave bank and leave transfer balances, and issue guidance and train supervisors on the leave bank and leave transfer programs and their roles and responsibilities for approving timesheets of employees using the leave programs. The agency concurred with our six recommendations. The agency has completed corrective actions for three of the recommendations, and we consider the planned corrective actions for the other three recommendations to be acceptable. ------- UNITED STATES ENVIRONMENTAL PROTECTION AGENCY WASHINGTON, D.C. 20460 THE INSPECTOR GENERAL August 28, 2017 MEMORANDUM SUBJECT: EPA Needs to Increase Oversight of Leave Bank Program to Improve Efficiency and Reduce Risk of Misuse Report No. 17-P-0374 This is our report on the subject audit conducted by the Office of Inspector General (OIG) of the U.S. Environmental Protection Agency (EPA). The project number for this audit was OA-FY16-0063. This report contains findings that describe the problems the OIG has identified and corrective actions the OIG recommends. This report represents the opinion of the OIG and does not necessarily represent the final EPA position. Final determinations on matters in this report will be made by EPA managers in accordance with established audit resolution procedures. Action Required In accordance with EPA Manual 2750, you provided acceptable corrective actions and milestone dates for all six of our recommendations. Recommendations 2, 4 and 5 are considered completed and closed. Planned corrective actions for Recommendations 1, 3 and 6 are considered acceptable. As a result, you are not required to provide a written response to this report. However, if you choose to submit a response, it will be posted on the OIG's public website, along with our memorandum commenting on your response. Your response should be provided as an Adobe PDF file that complies with the accessibility requirements of Section 508 of the Rehabilitation Act of 1973, as amended. The final response should not contain data that you do not want to be released to the public; if your response contains such data, you should identify the data for redaction or removal along with corresponding justification. FROM: Arthur A. Elkins Jr. TO: Donna J. Vizian, Acting Assistant Administrator Office of Administration and Resources Management David Bloom, Acting Chief Financial Officer We will post this report to our website at www.epa.gov/oig. ------- EPA Needs to Increase Oversight of Leave Bank Program to Improve Efficiency and Reduce Risk of Misuse 17-P-0374 Table of C Chapters 1 Introduction 1 Purpose 1 Background 1 Responsible Offices 3 Scope and Methodology 3 2 EPA's Leave Bank Not Adequately Managed to Assess Solvency, Safeguard Sensitive Records, or Minimize Potential Misuse 4 EPA LBB Did Not Monitor Solvency of Leave Bank 4 EPA Did Not Always Adequately Safeguard Sensitive Information 8 EPA LBB Did Not Assess or Verify Medical Certifications 10 Recommendations 11 Agency Response and OIG Evaluation 12 3 Reliable Timekeeping Data Needed to Determine Leave Bank Hours Used 13 Federal Standards Related to Timekeeping and Reporting 13 VLBP, Voluntary Leave Transfer Program, and EPA Timekeeping and Payroll Systems 14 Timekeeping Data for Leave Bank Hours Were Inaccurate 14 Conclusion 15 Recommendations 15 Agency Response and OIG Evaluation 16 Status of Recommendations and Potential Monetary Benefits 17 Appendices A Details on Scope and Methodology 18 B Leave Bank Best Practices of Other Federal Agencies 20 C Agency Response and OIG Evaluation 23 D Distribution 28 ------- Chapter 1 Introduction Purpose We conducted our audit to determine whether the U.S. Environmental Protection Agency (EPA) had established and implemented internal controls for the Voluntary Leave Bank Program (VLBP) to prevent and detect fraud, waste and abuse of the program. The audit focused on whether the EPA managed the VLBP in accordance with regulations to accomplish the program's purpose. Background Legal Authority and Requirements for VLBP Title 5 U.S.C. Chapter 63, Subchapter IV, Voluntary Leave Bank Program, §6362, provides authority to the Office of Personnel Management (OPM) to establish a VLBP. OPM issued specific requirements for how to manage the VLBP in the Code of Federal Regulations (CFR), including that each agency participating "shall. . . [djevelop written policies and procedures for establishing and administering leave banks and leave bank boards [LBBs]."1 The EPA established its VLBP in 1988. The VLBP provides assistance to federal employees who would be facing a significant financial hardship due to a medical emergency. The VLBP accumulates employee contributions of annual leave hours into its leave bank. Employees participating in the VLBP can receive leave contributions from the leave bank when they have exhausted their accrued annual and sick leave hours and are experiencing a medical emergency. As of June 30, 2016, the EPA's voluntary leave bank balance was 249,789 hours, which we valued at about $10.8 million.2 The VLBP law and regulation require agencies to establish an LBB for administering and managing the program. The LBB is responsible for performing the necessary functions relating to the VLBP, such as reviewing and approving employee applications, monitoring leave bank solvency, and monitoring the status of each recipient's case. The LBB must be comprised of three people, with at least one from a labor organization or employee group. 1 Title 5 CFR, Chapter I, Subchapter B, Part 630, Subpart J, Voluntary Leave Bank Program, § 630.1003 (a)(1). 2 The $10.8 million estimate is calculated by using the pay rate per hour of a federal employee in the GS-13 step 1 pay level with a duty station in Washington, D.C., during year 2015 (249,789 hours x $43.52 = $10,870,817). 17-P-0374 1 ------- The EPA VLBP's national program manager is responsible for organizing and disseminating recipient applications to the LBB. Also, the national program manager is responsible for communicating with applicants about whether their applications for leave were approved or denied. In addition, the national program manager is responsible for maintaining VLBP records, including case files. A national program coordinator and leave bank coordinators in the regions and headquarters program offices assist the national program manager and the LBB with these responsibilities. The leave bank balance has increased by about 23 percent over the last few years, from a leave-year starting balance of nearly 206,000 hours in 2013 to over 253,000 hours in 2016. However, while the leave bank balance of hours increased, the number of leave bank recipients3 dropped by about 15 percent, from 321 in 2013 to 273 in 2015, as shown in Figure 1. Figure 1: Number of leave bank recipients (2013-2015) and leave bank starting balances in hours (2013-2016) 2013 2014 2015 2016 EPA OIG graphic. 3 We calculated the number of leave bank recipients for 2013-2015 from the EPA's LBB recipient application logs for those years. We completed gathering data before the 2016 leave year ended and, therefore, are not presenting data for 2016. 17-P-0374 2 ------- Responsible Offices There are two EPA offices with primary responsibility over the issues discussed in this report: • The Office of Administration and Resources Management (OARM) provides national leadership, issues policy, and manages many essential support functions for the EPA, including human resources management. O ARM's Office of Human Resources (OHR) is responsible for the VLBP and manages EPA data in its payroll system—the Federal Personnel Payroll System (FPPS). • The Office of the Chief Financial Officer is responsible for managing and operating the EPA's timekeeping system—PeoplePlus (PPL). Scope and Methodology We conducted our performance audit from March 2016 to June 2017 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. We examined the VLBP's internal controls and other applicable activities for the period January 1, 2013, to December 31, 2016. Key elements of the program that we reviewed were: • Whether the EPA monitored and maintained solvency of the leave bank. • How the EPA approved and denied leave applications. • Whether the EPA maintained and used leave bank records. Appendix A contains a more detailed list of activities we conducted. 17-P-0374 3 ------- Chapter 2 EPA's Leave Bank Not Adequately Managed to Assess Solvency, Safeguard Sensitive Records, or Minimize Potential Misuse The EPA did not adequately manage the VLBP to assess the solvency or efficiency of the program, adequately safeguard personal employee information, or minimize potential misuse. In particular, OARM and LLB did not: • Routinely monitor the leave bank balance or the leave bank's solvency to determine whether the amount of leave in the bank was adequate to meet future obligations or was in excess of needs. • Periodically assess the maximum number of leave hours an employee could use each year to determine when adjustments to the threshold were necessary. • Maintain all required records for managing the program. • Adequately safeguard the records it did maintain. • Assess or verify medical certifications, used as the primary basis for deciding whether to approve an application and determine how many hours should be provided to an employee. This occurred because OARM did not develop and implement official policies and procedures to administer the leave bank and govern actions of the LBB. Also, there have not been any risk assessments or program performance reviews of the program. Without adequate policies, procedures and controls in place, the EPA did not have the necessary information to manage the program and determine whether program goals were being accomplished. Further, the EPA cannot adequately determine whether the leave bank program is solvent; the hours in the bank exceed needs; or that the program is adequately protected against fraud, waste and abuse. EPA LBB Did Not Monitor Solvency of Leave Bank Federal Regulations and Standards Provide for VLBP Management OPM issued 5 CFR, Chapter I, Subchapter B, Part 630, Subpart J, Voluntary Leave Bank Program, to provide agencies with procedures and requirements to manage the VLBP. These requirements include that the agency shall develop 17-P-0374 4 ------- written policies and procedures for establishing and administering leave banks and LBBs.4 In turn, the LBB is to monitor the amount of leave in the bank and the number of recipient applications submitted, and maintain an adequate amount of annual leave in the bank.5 According to 5 CFR § 630.1012, the agency is to maintain records concerning the VLBP administration, to include: (1) The number of leave bank members for each leave year; (2) The number of applications approved for medical emergencies affecting the employee, and the number of applications approved for medical emergencies affecting an employee's family member; (3) The grade or pay level of each leave contributor, and the total amount of annual leave he or she contributed to the bank; (4) The grade or pay level and gender of each recipient, and the total amount of annual leave he or she actually used. ... The U.S. Government Accountability Office's Standards for Internal Control in the Federal Government (November 1999 and September 2014) describes the internal control standards agencies are to use to provide reasonable assurance that the objectives of the agency are being achieved. Some of these standards include: Internal control should provide for an assessment of the risks the agency faces from both external and internal sources. Pertinent information should be identified, recorded and distributed to management and others within the entity in a form and time frame that permits people to perform their duties efficiently and enables them to carry out their internal control responsibilities. Activities need to be established to monitor performance measures and indicators. Managers need to compare actual performance to planned or expected results. 4 5 CFR § 630.1003 (a)(1). 5 5 CFR § 630.1003(d). 17-P-0374 5 ------- LBB Did Not Monitor Leave Bank Balance and EPA Managers Did Not Maintain Required Records to Assess Performance or Solvency The LBB did not routinely monitor the bank balance or the bank's solvency to determine whether the amount of leave was adequate to meet future obligations. Although the board informally discussed the bank's balance on an ad hoc basis, the board did not regularly monitor the balance of leave hours in the bank, document these bank balance discussions, or perform any measurements or calculations to assess the solvency or adequacy of the bank balance for future use and demands. In addition, the program staff did not maintain the information required by 5 CFR § 630.1012 for the VLBP listed in the previous section. All the required data elements were available except for the gender of each recipient. However, the data was accessible in raw form that was not useful for assessing the current or future needs or the leave bank's solvency. For the required data elements to be useful, VLBP managers should gather the data elements, summarize and analyze the results, and present the data to the LBB for consideration. According to two of the LBB members, the total number of hours allowable to recipients per year increased over the last several years, from 240 hours to the current 280 hours. OHR staff provided two OHR Director's memorandums announcing that the maximum leave bank hours allowed per year were increased. The first memo, issued in September 2009, announced an increase from 200 to 240. The second memo, issued in May 2011, announced the maximum hours increase from 240 to 280. However, OARM had no documentation to show why and how these decisions for change were made. The EPA's authorized full-time employee levels decreased by nearly 2,000 (11 percent) from 17,359 in 2011 to 15,376 in 2016. Conversely, the leave bank balance increased about 23 percent from 2013 to 2016,6 even while the maximum allowable hours provided to recipients increased to 280 hours per recipient. The leave year starting balance in 2013 was nearly 206,000 hours; in 2016, the balance had risen to over 253,000. Figure 2 provides details. 6 OARM was unable to provide us with the leave bank starting balances for years 2011 or 2012. 17-P-0374 6 ------- Figure 2: Number of full-time employees (2011-2016) and leave bank starting balances in hours (2013-2016) 2011 2012 2013 2014 2015 2016 EPA OIG graphic. In 2016, the EPA had 15,376 authorized full-time positions and about 8,200 leave bank members. According to the LBB members, the leave bank balance has increased over recent years and, as of June 30, 2016, contained 249,789 hours of annual leave valued at about $10.8 million for possible use by leave bank recipients. We compared the EPA VLBP practices with practices at similar federal agencies with a VLBP. According to the U.S. National Institutes of Health (NIH) VLBP Program Manager, the NIH in 2016 had about 17,500 employees and 6,100 leave bank members, yet its leave bank balance was around 110,000 hours. While the two agencies are similar in size, the EPA leave bank balance may have been disproportionately larger than necessary to support recipient needs. Further, the NIH allows up to 720 hours from the leave bank per recipient per year— 480 hours for personal medical emergencies and 240 hours for family member medical emergencies. The NIH LBB also has the authority to make changes to how many hours a member must contribute to its bank each year, and how many total hours are provided per year to recipients. While the EPA LBB can recommend changes to the VLBP, the Assistant Administrator for OARM is the decision authority. See Appendix B for more information about other federal agencies' VLBP management best practices. EPA management did not provide sufficient internal controls for the VLBP. Although basic informal guidance was posted on the OHR website, OARM did not develop and implement official policies and procedures to manage the leave bank and govern the actions of the LBB. Also, OHR managers stated that there have not been any risk assessments or program performance reviews of the VLBP. 17-P-0374 7 ------- OHR managers and LBB members identified a lack of staff and high turnover of staff and managers as challenges to managing the VLBP. The national program coordinator is the only OHR staff member dedicated to working on the VLBP. Further, the national program coordinator and the supervisor position (Director of the OHR Diversity Recruitment & Employee Services Division) have been filled using temporarily assigned personnel from other OHR or OARM positions. The national program coordinator position was filled by temporary assignment from October 2015 through December 2016 and the director position was assigned to three managers, one permanent and two temporary, in under 2 years. On a positive note, the director position was filled with a permanently assigned manager in October 2016. However, since the director served as one of the three LBB members, the turnover in that position impacted management of the LBB and the VLBP overall. Also, one LBB member has served for more than 8 consecutive years—6 years longer than the 2-year term identified by EPA guidance on the leave bank website. Actions Taken as a Result of Our Audit During the course of this audit, OHR personnel assessed the adequacy of VLBP resources and staffing as we proposed in our discussion document. As a result, OHR designated one additional permanent staff member to serve as a second VLBP national program manager. This action took effect in January 2017, and OHR provided support that verified the personnel action. Conclusion Without policies and procedures or the data provided by risk assessments, performance reviews and other monitoring, OHR managers and LBB members do not have the information to govern the program or determine whether program goals are accomplished. These internal controls and the data provide management the tools to properly protect the leave bank assets (i.e., hours) and prevent fraud, waste or abuse. The LBB did not assess whether the bank balance was appropriate and adequate for future needs. In addition, the LBB did not consider the historical balance and use information to determine whether the contributions and allowed hours per year were appropriate. As a result, the required voluntary contribution for leave bank members and the maximum hours allowed annually for recipients may not be appropriate. EPA Did Not Always Adequately Safeguard Sensitive Information EPA Records Management for Leave Bank EPA Records Management Policy, CIO 2155.3 (February 10, 2015), states: EPA records must be maintained in an appropriate manner, captured and organized to ensure timely search and retrieval for 17-P-0374 8 ------- internal Agency use as well as for responses to outside inquiries. Sensitive records ... must be maintained with restricted access in accordance with statutory and regulatory requirements.7 Also, the policy requires records to be maintained "so they can be accessed [only] by staff with a need to know the information for appropri ate business reasons." Records must be secured "to protect the legal and financial rights of the government and persons affected by government activities." According to the EPA's General Records Schedule 0565, leave bank records are to be destroyed 1 year after the end of the year in which the file is closed. Leave Bank Case Files Left Unsecured According to the EPA's former VLBP national program manager, who retired in the fall of 2015, cabinets in which leave bank case files were stored were not locked. During our site visit to the OHR in April 2016, we observed about 100 recipient case files that were left outside the file cabinets and on a desk inside an unoccupied office cubicle. The case files were left out at the end of the work day on a Thursday evening and the national leave bank coordinator was not due back to the office until the following Monday. It appears that these recipient case files were left out and unlocked over a weekend period. Also, we observed multiple case files labeled 2013 among those that were out of the cabinets. The VLBP staff stated that this instance of case files not being stored in a locked cabinet was a single occurrence and the records are now always locked up. At the time of our site visit, the national leave bank coordinator was the only staff dedicated, full-time, to the VLBP. Processing the recipient applications and preparing for the LBB meetings were the highest priorities. Regarding the 2013 case files still on hand, the national leave bank coordinator explained that she had not yet had the time to sort out the older files for di sposal, as she focused on higher-priority leave bank activities. OHR cubicle with leave bank case files in EPA headquarters, April 2016. (EPA OIG photo) 7 Medical information associated with individuals, such as medical conditions and medical certifications, are sensitive information. 17-P-0374 9 ------- Conclusion Due to sensitive information not being properly safeguarded, employees who participate in the leave bank program were at an increased risk of personal and sensitive medical information being obtained by parties that should not have access to such information. EPA LBB Did Not Assess or Verify Medical Certifications Federal Regulations, Standards and Best Practices for VLBP Medical Certifications Title 5 CFR Chapter I, Subpart J, § 630.1006(c)(3), requires recipient applications to include a certification from one or more physicians, or other appropriate experts, with respect to the medical emergency, if the LBB so requires. The EPA's LBB requires this certification. The U.S. Government Accountability Office's Standards for Internal Control in the Federal Government states, "Internal control should be designed to provide reasonable assurance regarding prevention of or prompt detection of unauthorized acquisition, use, or disposition of an agency's assets." It further states: Control activities are an integral part of... accountability for stewardship of government resources and achieving effective results. Control activities ... include a wide range of diverse activities such as approvals, ... verifications, reconciliations, ... and the creation and maintenance of related records. ... The NIH's VLBP managers have implemented best management practices to verify the validity and reliability of recipients' medical certifications. This is done by using an independent medical advisor, relying on medical guidelines resources, and allowing NIH employees to voluntarily allow NIH VLBP managers to discuss medical information with certifying doctors. Appendix B provides more information about other federal agencies' VLBP management best practices. Guidance and Tools Needed to Help Assess Medical Certifications The EPA LBB relies on the medical certifications that applicants submit without assessing or verifying the validity and reliability of the certification. The medical certifications provide key information to enable the LBB to determine such matters as the length of time the emergency leave should cover and the required number of emergency leave hours to provide a recipient. The LBB members accept the medical certificate information without comparing other sources of information and do not possess the medical expertise necessary to determine whether the information is reasonable. Although LBB members stated that they have discussed unfamiliar medical situations amongst themselves and have in the 17-P-0374 10 ------- past performed some research of specific cases, these evaluations occurred on an ad hoc basis and were not documented. The EPA has not developed official policies and procedures to govern the LBB applicant review and approval process, including verification of medical certifications. Also, the LBB has not routinely used any mechanisms or tools to assess or verify the validity and reliability of medical certifications, such as using reliable medical guidelines resources, using an independent medical advisor, or developing forms for obtaining an employee's voluntary authorization of medical disclosure. Conclusion The stewardship of about $10.8 million in leave bank resources is at an increased risk of fraud, waste and abuse because the EPA has not implemented adequate internal controls to verify the validity and reliability of recipients' medical certifications. Without proper assessment or verification of certifications, the LBB could approve an application for leave bank hours that should not be approved. Recommendations We recommend that the Assistant Administrator for Administration and Resources Management: 1. Develop and implement official policies and procedures to administer the Voluntary Leave Bank Program, to include: a. Governing the Leave Bank Board's decision-making, including documenting those decisions. b. Requiring Office of Administration and Resources Management staff to conduct annual trend analyses of recent years' data to assess the bank's solvency and identify any appropriate adjustments to hours allowed to be drawn or minimum required to be contributed by members. c. Rotating the Leave Bank Board members to adequately staff the board for appropriate amounts of time. d. Requiring the Office of Human Resources to prepare and submit an annual report on program performance and activity. e. Establishing adequate controls for assessing and verifying the validity of medical certifications, to include researching best practices and tools used by other federal agencies. 17-P-0374 11 ------- f. Requiring leave bank staff to annually assess, identify and dispose of records that meet disposal criteria. 2. Conduct a risk assessment of the Voluntary Leave Bank Program to identify program weaknesses and vulnerabilities, and develop additional internal controls as needed. 3. Starting with leave year 2016 and on an annual basis thereafter, gather and analyze the required Voluntary Leave Bank Program data and provide the results to the Leave Bank Board and leave bank managers for use in decision-making. 4. Train Voluntary Leave Bank Program staff on the records management policy and the requirements for case files and records retention. Agency Response and OIG Evaluation OARM agreed with our recommendations and provided corrective actions and estimated completion dates that meet the intent of the recommendations. OARM also provided additional attachments as support for the corrective actions they have completed. To address Recommendation 2, OARM conducted a VLBP risk assessment and finalized its Risk Assessment Plan in June 2017. To address Recommendation 4, OHR trained the VLBP staff on records management in February 2017, and on June 7, 2017, issued a memorandum to VLBP managers reminding them to adhere to the EPA's records management policy for maintaining case files and records retention. As a result, Recommendations 2 and 4 are considered completed. To address Recommendation 1, OHR completed VLBP management benchmarking with other federal agencies, and is using the results to develop and implement official policies and procedures for administering the EPA's VLBP. OARM indicated it plans to implement official policies and procedures for non-bargaining unit employees and notify the national unions regarding proposed policies and procedures for bargaining unit employees by March 15, 2018. Planned corrective actions for Recommendation 1 are considered acceptable. To address Recommendation 3, OHR indicated it plans to gather and analyze the required data, at least annually, so that OHR VLBP managers and the EPA's LBB can use the analyses results in decision-making. OHR estimated completing these corrective actions by December 2017. Planned corrective actions for Recommendation 3 are considered acceptable. The agency's detailed response is in Appendix C. 17-P-0374 12 ------- Chapter 3 Reliable Timekeeping Data Needed to Determine Leave Bank Hours Used Inaccurate timekeeping data incorrectly showed that leave bank recipients used more than the allowed 280 hours per leave year,8 and conflicted with data in the payroll system. Federal internal control standards require that supervisors have reliable information to perform their duties efficiently. The inaccurate timekeeping occurred because the timekeeping system did not have working controls to prevent employees from entering more leave bank hours than allowed. Supervisors and other EPA staff were unable to properly manage time and attendance because the system contained conflicting data. As a result, supervisors cannot properly verify employees' time and prevent fraud. Federal Standards Related to Timekeeping and Reporting The U.S. Government Accountability Office's Standards for Internal Control in the Federal Government states, "Internal control should be designed to provide reasonable assurance regarding prevention of or prompt detection of unauthorized acquisition, use, or disposition of an agency's assets." It further states: Control activities are an integral part of... accountability for stewardship of government resources and achieving effective results. Control activities ... include a wide range of diverse activities such as approvals, ... verifications, reconciliations, ... and the creation and maintenance of related records. ... Information should be recorded and communicated to management and others within the entity who need it and in a form and within a time frame that enables them to carry out their internal controls and other responsibilities. For an entity to run and control its operations, it must have relevant, reliable, and timely communications relating to internal as well as external events. ... Pertinent information should be 8 During the time period covered by our review, OARM used the leave year as the year of measure for the hours allowed annually. In January 2017, OARM revised the year of measure to the taxable year. 17-P-0374 13 ------- identified, captured, and distributed in a form and time frame that permits people to perform their duties efficiently. VLBP, Voluntary Leave Transfer Program, and EPA Timekeeping and Payroll Systems The EPA VLBP website guidance allowed an employee to use up to 280 leave bank hours per leave year for qualified periods of medical emergency. Once approved by the LBB, the national program coordinator enters the approved leave bank hours into the timekeeping system and the payroll system to make the hours available to the leave bank recipient. The EPA also has a Voluntary Leave Transfer Program that provides the opportunity for an employee who has exhausted his/her paid leave due to a medical emergency to receive annual leave donated by other federal employees. The leave transfer program is separate from, but similar to, the VLBP, as it was designed to assist employees who are or will be facing a significant financial hardship due to a medical emergency. The main differences in these separate programs are that the VLBP requires membership and provides "banked" hours, while the leave transfer program does not require membership and leave donated from employees goes directly to a specific leave recipient. VLBP members may receive leave from the leave transfer program or simultaneously with VLBP hours. We did not audit the leave transfer program, but learned about how the two programs may overlap when the VLBP recipient uses both. PPL is the EPA timekeeping system, and the FPPS is the EPA payroll system of record. The U.S. Department of the Interior's Interior Business Center hosts FPPS and allows the EPA and other federal agencies to use it to generate payroll; the system interfaces with PPL. EPA employees enter their time and attendance data—and timekeepers review and supervisors review and approve data—in PPL. The PPL data is transmitted to FPPS, and that system generates the payroll. PPL has time reporting codes for the various types of leave that employees may use. PPL sums the types of leave hours used by these codes. OHR managers reported that when an employee receives leave from both the VLBP and the leave transfer program during the same pay periods, the FPPS will apply donated leave hours first until exhausted. Then FPPS applies the VLBP hours that are available. This occurs regardless of how the PPL time reporting codes are entered. Timekeeping Data for Leave Bank Hours Were Inaccurate The PPL data for 75 VLBP recipients during 2014 and 2015 (three recipients had over 280 hours in both years, for a total of 78 over-hour cases) showed that these recipients used more than the 280 hours allowed per leave year. In one case, the PPL data for a recipient showed 791.5 total hours (511.5 hours above the maximum limit). About 23 percent of the 78 leave bank over-hours cases showed 17-P-0374 14 ------- 400 or more leave bank hours used (i.e., 120 or more hours above the 280-hour limit) in a single leave year. OHR managers stated the PPL data was incorrect and that FPPS controls prevent employees from receiving more than the allowed 280 hours per year. They pointed out that when a leave bank recipient also has received donated leave through the leave transfer program, the FPPS system draws first from the donated leave balance before using any leave bank hours. Once the donated leave is exhausted, FPPS then applies the leave bank hours up to 280 but no more. OHR further explained that manual time card corrections in PPL may result in additional differences between the two systems' data. We analyzed FPPS data for a sample of the 75 employees and confirmed that none received more than 280 leave bank hours in a leave year. OHR reinforced that FPPS is the official system of record and that system's data is to be relied upon. OHR personnel noted, however, that they cannot make improvements to PPL because the Office of the Chief Financial Officer manages that system. Leave bank recipients' supervisors relied on PPL system controls to limit leave bank hours and could not easily track the hours that recipients input to verify that employees were not using more than the 280-hour limit. Supervisors said they could not view the number of leave bank hours or leave transfer hours an employee used. They also seemed not to know how the leave bank program works. Supervisors need training on the VLBP and leave transfer programs, and tools for how to manage or monitor the hours. Conclusion The PPL system did not have working controls that limit the number of leave bank hours a recipient can input or enter to the 280 hours allowed. The conflicting timekeeping and payroll data did not provide employees, their supervisors and other applicable EPA staff with accurate data to properly manage time and attendance, leave bank hours, or leave transfer hours. As a result, the supervisors cannot properly verify employees' time and prevent fraud. Recommendations We recommend that the Assistant Administrator for Administration and Resources Management and the Chief Financial Officer work together to: 5. Develop and implement a method for supervisors to view real-time data of employee leave bank and leave transfer balances in PeoplePlus and the Federal Personnel Payroll System. 6. Issue guidance to, and train, supervisors on the leave bank and leave transfer programs and their roles and responsibilities for approving and attesting timesheets of employees using the leave programs. 17-P-0374 15 ------- Agency Response and OIG Evaluation OARM and the Office of the Chief Financial Officer agreed with our recommendations and provided corrective actions and estimated completion dates that meet the intent of the recommendations. To address Recommendation 5, the Office of the Chief Financial Officer made changes in the PPL system, and OHR changed VLBP (and leave transfer) input processes that result in the leave bank data feeding from FPPS into PPL (occurs nightly). The agency response also identified that while leave information is in PPL, supervisors and PPL coordinators may gain access to the most recent official leave balance information for their employees by requesting access to the Interior Business Center's Datamart (from OARM) to run a leave balance report. As a result of actions taken, Recommendation 5 is considered completed. To address Recommendation 6, OARM and Office of the Chief Financial Officer indicated that they are collaborating to issue guidance and create and provide supervisory training on the leave bank and leave transfer programs, as well as roles and responsibilities for approving and attesting employees' timesheets. Completion is expected by December 2017. Planned corrective actions for Recommendation 6 are considered acceptable. The agency's detailed response is in Appendix C. 17-P-0374 16 ------- Status of Recommendations and Potential Monetary Benefits RECOMMENDATIONS Potential Planned Monetary Rec. Page Completion Benefits No. No. Subject Status1 Action Official Date (In $000s) R Assistant Administrator for 3/15/18 Administration and Resources Management b. Requiring Office of Administration and Resources Management staff to conduct annual trend analyses of recent years' data to assess the bank's solvency and identify any appropriate adjustments to hours allowed to be drawn or minimum to be contributed by members. c. Rotating the Leave Bank Board members to adequately staff the board for appropriate amounts of time. d. Requiring the Office of Human Resources to prepare and submit an annual report on program performance and activity. e. Establishing adequate controls for assessing and verifying the validity of medical certifications, to include researching best practices and tools used by other federal agencies. f. Requiring leave bank staff to annually assess, identify and dispose of records that meet disposal criteria. 1 11 Develop and implement official policies and procedures to administer the Voluntary Leave Bank Program, to include: a. Governing the Leave Bank Board's decision-making, including documenting those decisions. 12 Conduct a risk assessment of the Voluntary Leave Bank Program to identify program weaknesses and vulnerabilities, and develop additional internal controls as needed. 12 Starting with leave year 2016 and on an annual basis thereafter, gather and analyze the required Voluntary Leave Bank Program data and provide the results to the Leave Bank Board and leave bank managers for use in decision-making. 12 Train Voluntary Leave Bank Program staff on the records management policy and the requirements for case files and records retention. 15 Develop and implement a method for supervisors to view real- time data of employee leave bank and leave transfer balances in PeoplePlus and the Federal Personnel Payroll System. Assistant Administrator for 6/26/17 Administration and Resources Management Assistant Administrator for 12/29/17 Administration and Resources Management Assistant Administrator for 6/7/17 Administration and Resources Management Assistant Administrator for 6/18/17 Administration and Resources Management and Chief Financial Officer 15 Issue guidance to, and train, supervisors on the leave bank and leave transfer programs and their roles and responsibilities for approving and attesting timesheets of employees using the leave programs. Assistant Administrator for Administration and Resources Management and Chief Financial Officer 12/29/17 1 C = Corrective action completed. R = Recommendation resolved with corrective action pending. U = Recommendation unresolved with resolution efforts in progress. 17-P-0374 17 ------- Appendix A Details on Scope and Methodology To obtain an understanding of the internal controls for leave bank processes, we reviewed the following criteria documents: • Federal Employees Leave Sharing Act of 1988, Subchapter IV, Voluntary Leave Bank Program, § 6361-6373. • Title 5 CFR, Chapter I, Subchapter B, Part 630, Subpart J, Voluntary Leave Bank Program. • Presidential Memorandum of January 15, 2015, Modernizing Federal Leave Policies for Childbirth, Adoption, and Foster Care To Recruit and Retain Talent and Improve Productivity. • U.S. Office of Personnel Management Guidance: o Fact Sheet: Voluntary Leave Bank Program. o Handbook on Leave and Workplace Flexibilities for Childbirth, Adoption, and Foster Care. • U.S. Government Accountability Office's Standards for Internal Control in the Federal Government, November 1999 (applicable to fiscal years 2000 through 2015) and September 2014 (applicable to fiscal year 2016 and forward). • Office of Management and Budget Circular A-123, Management's Responsibility for Internal Control, December 21, 2004. • Memorandum of Understanding, EPA Leave Bank Program. • 44 U. S. C. Chapter 31, Records Management by Federal Agencies, 2011. • 44 U.S.C. Chapter 33, Disposal of Records, 2008. • EPA's Records Management Policy, February 10, 2015. • EPA Records Schedule 0565, Donated Leave Program Case Files, December 31, 2013. • EPA's Voluntary Leave Bank Program Guidance. To determine whether the EPA managed the VLBP in accordance with applicable laws, regulations and guidance, we performed the following tasks: • Identified, gathered and analyzed applicable criteria related to requirements for the VLBP. • Used the criteria to evaluate the VLBP's internal and management controls for preventing and detecting fraud, waste and abuse. • Performed a literature search to review and summarize previous audits, evaluations, other reports and articles that were relevant to this audit. • Obtained and assessed leave bank data from the EPA time and attendance PPL and payroll FPPS systems for employees participating in the VLBP. • Conducted a site visit to OHR offices in Washington, D.C., where we interviewed VLBP managers, staff and LBB members; performed reviews of case files for a judgmental sample of 28 leave bank recipients (based on EPA offices with a high number of leave 17-P-0374 18 ------- bank recipients and the recipients with the most leave bank hours received); obtained PPL and FPPS walk-throughs; and observed the VLBP case files and storage location. • Analyzed recipient data from PPL and FPPS to identify those employees who may have received leave bank hours over the maximum 280 hours allowed per leave year. • Obtained PPL time card data for a judgmental sample of eight VLBP recipients with over 280 hours (based on high leave bank hours received) to assess leave used by pay period in 2014 and 2015 and determine the applicable supervisors/approving officials. • Interviewed five VLBP recipients' supervisors for information on their roles, and the processes they use related to time card reporting. • Reviewed VLBP records, including internal performance reports for the program, such as data on leave bank balances, leave bank members, and leave bank withdrawals. • Reviewed individual VLBP recipient case files, including applications, medical certifications, leave balances, and LBB decisions. In reviewing medical certifications, we searched online for the medical practitioners' names, addresses and current licensing. • Examined the approval process for leave bank applicants. • Interviewed VLBP staff, including LBB members, the VLBP national program manager, and two regional coordinators, to obtain information on the processes the EPA used to manage the VLBP and safeguard resources. To obtain information about best practices used by other federal agencies for managing VLBPs, we interviewed personnel and reviewed documentation from three other federal agencies: • U.S. National Institutes of Health. • U.S. Department of Justice. • U.S. Department of Agriculture's Farm Service Agency. 17-P-0374 19 ------- Appendix B Leave Bank Best Practices of Other Federal Agencies We contacted three other federal agencies operating VLBPs and gathered information from the managing personnel about practices and tools used to achieve efficiency and effectiveness of their respective programs. The three agencies we contacted were the: • U.S. National Institutes of Health (NIH). • U.S. Department of Justice's (DOJ's) Executive Office of the U.S. Attorneys (EOUSA). • U.S. Department of Agriculture's (USDA's) Farm and Foreign Agricultural Services (FFAS). The NIH and DOJ's EOUSA had relatively comparable numbers of employees in 2016, with about 17,500 and 16,000, respectively; the EPA had about 15,300 employees in 2016. The USDA's FFAS was much smaller, with about 1,700 employees in 2016. Although NIH seemed to have the most robust and proactive management practices, each of the three agencies used practices to manage their VLBP that EPA did not. We compared the practices of the three agencies to those the EPA uses to identify best practices at other agencies that the EPA could implement to improve how it manages its leave bank. National Institutes of Health The VLBP program manager provided details on how the NIH leave bank is managed. In May 2016, the NIH had about 17,500 employees, 6,100 leave bank members, and 110,000 leave hours in the bank. The NIH allows each leave bank recipient to receive up to 720 hours per year— 480 hours for personal medical emergencies and 240 hours for family member medical emergencies. Below are NIH best practices regarding the program management structure and controls to process and review recipient applications and medical certifications. • The NIH VLBP Management Structure: •S The program has a detailed set of written procedures for managing its program. ¦S The LBB consists of three permanent members and three alternate members. The LBB has the authority to determine the number of hours allowed to recipients each year, the number of hours that members must contribute, and the number of hours that can be donated. •S The LBB delegated the daily VLBP operations, such as the review and approval of leave bank recipient applications, to the VLBP staff. •S VLBP staff include a full-time program manager and two contractor case managers. Leave bank staff review applications daily instead of every 2 weeks as the EPA does. •S VLBP staff use a share point site to track all recipient cases. The LBB has access to the data in the share point and can see the status of recipients at any given time. The LBB can directly pull reports from the share point, as needed or desired. 17-P-0374 20 ------- ~ ~ ~ VLBP staff evaluate program effectiveness by surveying leave bank members, tracking the timeliness of recipient application processing, and developing statistical reports about the number of members and recipients over time. (See Figure 3 for the 2015 At A Glance slide used in February 2016 by the N1H VLBP program manager as part of a larger presentation on leave bank data and program performance information to the NIH LBB.) VLBP staff use the data to prepare program reports presented and discussed during quarterly meetings with the LBB. Although assessing the leave bank balance and solvency is not included in the detailed written procedures, VLBP staff and the LBB discuss the balance each year and consider past trends, such as the hours deposited in the bank and hours allocated to recipients. The LBB makes decisions based on those historical trends. Figure 3: The 2015 At A Glance slide 2015 At A Glance r 1 New Employee Enrollment: 47% l. J 1 r 1 Cases Processed: 440 2014: 342 L Individual Recipients: 282 2014: 224 r ^ Hours Distributed: 25,616 2014: 41,039 Ave. Hours Distributed Per Recipient: 91 2014: 183 LB Balance at End of Year: 82,180 Hours 2014: 45,393 ~ National Institutes of Health Crttc of Mfinaoemau Offtos of Human Resources NIH graphic, used at the NIH LBB meeting held in February 2016. The NIH Leave Bank Controls to Verify Medical Certifications: S VLBP staff contact doctors referenced in medical certification forms to verify that they indeed completed the form and signed it. S VLBP staff use an MD Guidelines database to determine whether the information presented on the medical certification form is reasonable. S VLBP staff have an authorization for disclosure form that employees may sign that authorizes the NIL! VLBP staff to discuss the content of the medical certification with doctors. S When necessary, VLBP staff use an outside Federal Occupational Health (part of the U.S. Department of Health and Human Services) consultant to gather an expert medical opinion of the medical emergency. This consultant can also contact doctors to discuss medical certifications. 17-P-0374 21 ------- Department of Justice/Executive Office of the U.S. Attorneys The DOJ/EOUSA's VLBP coordinator provided details on how that leave bank is managed, and on operating procedures and guidance. In 2016, the EOUSA had about 16,000 employees, the leave bank members numbered about 2,300, and leave hours fluctuated from 5,000 to 7,000. The EOUSA allows up to 160 hours from the leave bank per recipient per year for personal or family member medical emergencies. Below are DOJ best practices regarding the program management structure and controls to process and review recipient applications and medical certifications. • DOJ procedures establish that its LBB will consist of three members, and they can designate alternate board members, when available. • The LBB has the authority to set the maximum number of leave hours allowed to recipients per year and to adjust the maximum hours allowed when needed. • The LBB delegated daily operations to the VLBP administrator. These routine operations included processing and approving membership applications, reviewing and approving recipient applications when all the leave bank criteria are met, and denying recipient applications when criteria are not met. • The LBB delegated approval authority to the VLBP administrator for recipients of routine, non-elective medical emergencies such as childbirth or routine surgical procedures having a standard recuperation period, and extensions on previously-approved cases with proper medical documentation. • VLBP staff use online resources, such as webMD and the Mayo Clinic website, and perform internet searches to gain an understanding of medications and medical procedures. • DOJ VLBP staff work with their General Counsel, as needed, on cases with potentially sensitive issues, to prevent discrimination complaints. U.S. Department of Agriculture/Farm and Foreign Agricultural Services The USDA's FFAS VLBP manager provided details on how the FFAS leave bank is managed, and on operating procedures and guidance. FFAS consists of three smaller agencies, each having a separate balance of hours within the one leave bank. The VLBP manager has the authority to move the leave hours between the three agency banks as needed. The FFAS component is very small in comparison to the EPA. In June 2016, the VLBP manager estimated the total employees at about 1,700. The leave bank for one of the three component agencies had only 14 members and a starting balance of about 2,850 leave hours. The FFAS allows up to 160 hours from the leave bank per recipient per year for personal or family member medical emergencies. Below are FFAS best practices regarding the program management structure and controls to process and review recipient applications and medical certifications. • The FFAS VLBP offers a new member summer enrollment period. • The LBB has the authority to grant exceptions to donor limitations. • The LBB may request a second opinion from a medical expert or physician. If they do, the medical charges are paid by the agency. • The VLBP Frequently Asked Questions document contains an official "Notice" that states that falsifying or altering any government or medical document(s) can lead to disciplinary action, including suspension from work or termination of employment. 17-P-0374 22 ------- Appendix C Agency Response and OIG Evaluation [June 30, 2017] MEMORANDUM SUBJECT: Management Response to Office of Inspector General Draft Report, "EPA Needs to Increase Oversight of Leave Bank Program to Improve Efficiency and Reduce Risk of Misuse" (Project OA-FY16-0063) FROM: Donna J. Vizian, Acting Assistant Administrator//signed// Office of Administration and Resources Management David A. Bloom, Acting Chief Financial Officer//signed// Office of the Chief Financial Officer TO: Arthur A. Elkins, Jr., Inspector General Thank you for the opportunity to review and comment on the findings and recommendations in the draft report for the subject audit. The U.S. Environmental Protection Agency's Office of Inspector General conducted this audit to determine if the EPA had established and implemented internal controls for the Voluntary Leave Bank Program to prevent and detect fraud, waste and abuse of the program. The agency concurs with all six recommendations. Attachment 1 is our response to each recommendation, including the intended corrective action and estimated completion date for each recommendation. Also attached are the agency's Voluntary Leave Bank Program Benchmark Report (Attachment 2), a Risk Management Plan (Attachment 3), OHR's June 7, 2017, memorandum regarding EPAs records management policy for the VLBP (Attachment 4), and draft Risk Assessment Worksheet Instructions (Attachment 5). The Office of Administration and Resources Management, which manages the VLBP, requests closure of recommendations 2, 4 and 5. OARM VLBP staff were trained on records management in February 2017, OARM completed a risk assessment of the VLBP, and the Office of the Chief Financial Officer implemented changes to PeoplePlus to improve the leave bank process in June 2017. The EPA appreciates the work of the OIG in planning and conducting this audit. If you have questions regarding this response, please contact Ms. Linda Gray, Director, Office of Human Resources, at (202) 564-4606 or Grav.Linda@epa.gov. 17-P-0374 23 ------- Attachments 1. EPA Response to OIG Report 2. EPA Voluntary Leave Bank Program Benchmark Report 3. Risk Management Plan 4. OHR Memorandum to VLBP Managers, dated June 7, 2017 5. Draft Risk Assessment Worksheet Instructions cc: John Showman Howard Osborne Linda Gray Quentin Jones Wesley Carpenter Lynnann Hitchens Marian Cooper Matthew Bell Lauren Lemley Bobbie Trent Benita Deane Bisa Cunningham Debbi Hart Krysti Corbett Cheri Hembrey 17-P-0374 24 ------- Attachment 1, EPA Response to OIG Report EPA Response to the OIG's Draft Report No. OA-FY16-0063 "EPA Needs to Increase Oversight of Leave Bank Program to Improve Efficiency and Reduce Risk of Misuse" No. OIG Recommendations Planned Corrective Action Estimated Completion 1 Develop and implement official policies and procedures to administer the Voluntary Leave Bank Program, to include: a. Governing the Leave Bank Board's decision making, including documenting those decisions. b. Requiring Office of Administration and Resources Management staff to conduct annual trend analysis of recent years' data to assess the bank's solvency and identity any appropriate adjustments to hours allowed to be drawn or required to be contributed by members. c. Rotating the Leave Bank Board members to adequately staff the board for appropriate amounts of time. d. Requiring the Office of Human Resources to prepare and submit an annual report on program performance and activity. e. Establishing adequate controls for assessing and verifying the validity of medical certifications, to include researching best practices and tools used by other federal agencies. f. Requiring VLBP staff to annually assess, identity and dispose of records that meet disposal criteria. Concur. By March 15, 2018, OARM will implement official policies and procedures for non- bargaining unit employees and notify the national unions regarding proposed policies and procedures for bargaining unit employees. Unfortunately, we cannot put a timeframe on completion of union negotiations/implementation. In May 2017, the Office of Human Resources completed benchmarking with other federal agencies, including reviewing the policies and procedures for the voluntary leave bank programs of those agencies. OHR is utilizing the results of the benchmarking to develop and implement official policies and procedures for administering the U.S. Environmental Protection Agency's VLBP. The policies and procedures will: a) govern the LBB's decision making, including documenting those decisions; b) require VLBP staff to conduct annual trend analysis of VLBP data to assess the bank's solvency and to identify any appropriate adjustment to hours to be withdrawn or contributed; c) rotate the LBB; d) require VLBP staff to prepare and submit an annual report on program performance and activity; e) establish adequate controls for assessing and verifying the validity of medical certifications; and f) require VLBP staff to annually assess, identify and dispose of records that meet disposal criteria. Attachment 2 is a summary of OHR's benchmarking for the OIG's information. March 15, 2018 2 Conduct a risk assessment of the VLBP to identity program weaknesses and vulnerabilities, and develop additional internal controls as needed. Concur. In June 2017, OHR finalized a risk assessment of the VLBP. The risk assessment involved the identification and analysis of relevant risks, assessment of the likelihood of occurrence, and determination of what actions the VLBP has taken or will take to manage the risks to ensure the Completed 17-P-0374 25 ------- effectiveness of program internal controls in addressing program risks. Attachment 3 is a copy of the completed Risk Assessment Plan. 3 Starting with leave year 2016 and on an annual basis thereafter, gather and analyze the VLBP data and provide the results to the LBB and VLBP managers for use in decision making. Concur. At least annually, OHR will gather and analyze the following data required by Title 5 of the Code of Federal Regulations, Section 630, Subpart J: (1) the number of leave bank members for each leave year; (2) the number of applications approved for medical emergencies affecting the employee and the number of applications approved for medical emergencies affecting an employee's family member; (3) the grade of each leave contributor and the total amount of annual leave the employee contributed to the bank; and (4) the grade and gender of each leave recipient and the total amount of annual leave employee actually used. OHR VLBP managers and the EPA's LBB will use the results of the analysis in decision making as outlined in the VLBP policies and procedures. December 29, 2017 4 Train VLBP staff on the records management policy and the requirements for case file and records retention. Concur. The VLBP staff received records management training on February 22, 2017. Additionally, on June 7, 2017, OHR issued a memorandum to VLBP managers reminding them to adhere to the EPA's records management policy for maintaining case files and records retention. The memorandum also includes a requirement for the VLBP managers to retain VLBP case files in a confidential manner, identifies the time frame for retaining and destroying files, and requires that all files currently retained beyond the minimum retention period be immediately destroyed after they are no longer in use. Attachment 4 is a copy of OHR's memorandum. Completed 5 Develop and implement a method for supervisors to view real-time data of employee leave bank and leave transfer balances in PeoplePlus and the Federal Personnel and Payroll System. Concur. Effective June 18, 2017, The Office of the Chief Financial Officer implemented changes to PeoplePlus, the agency's time and attendance system, to improve the leave bank process. The implemented changes eliminated OHR's usage of the PeoplePlus HR module and the accrual pages. Once a leave bank member's application is approved and the hours are awarded, the leave bank coordinator enrolls the leave bank recipient in a leave bank or leave share emergency/occurrence in FPPS. The leave bank coordinator inputs the employee's name, employee ID, emergency type/occurrence (IBC field), emergency start date, and leave bank hour awards. With the new process, the employee's name, employee ID, emergency start date and emergency type/occurrence is transferred to PeoplePlus on a nightly basis. The transfer information is populated into PeoplePlus and grants the leave bank recipient access to all leave bank/leave share time reporting codes. The VLBP's staff provides the leave bank recipient with detailed instructions regarding which codes to use Completed 17-P-0374 26 ------- for each emergency occurrence. Once the VLBP's staff is informed that the medical emergency is over, they input the end date into FPPS to close the leave bank occurrence. When the end date is inputted into FPPS, the nightly transfer will update the data and populate the same information to PeoplePlus after which all leave bank codes are deactivated for the leave bank/leave share recipient. FPPS is the official repository for all leave. Employees have access to their Leave and Earning Statements via Employee Express. While leave information is available in PeoplePlus, supervisors and PeoplePlus coordinators may gain access to the most recent official leave balance information for their employees by requesting access to the IBC Datamart (from OARM) to run a leave balance report. 6 Issue guidance to, and train, supervisors on the leave bank and leave transfer programs and their roles and responsibilities for approving and attesting timesheets of employees using the leave programs. Concur. OARM and OCFO are collaborating to issue guidance. Create and provide supervisory training to on the leave bank and leave transfer programs and their roles and responsibilities for approving and attesting employees' timesheets. December 29, 2017 17-P-0374 27 ------- Appendix D Distribution The Administrator Chief of Staff Chief of Staff for Operations Deputy Chief of Staff for Operations Assistant Administrator for Administration and Resources Management Chief Financial Officer Agency Follow-Up Coordinator General Counsel Associate Administrator for Congressional and Intergovernmental Relations Associate Administrator for Public Affairs Associate Chief Financial Officer Deputy Assistant Administrator for Administration and Resources Management Director, Office of Human Resources, Office of Administration and Resources Management Deputy Director, Office of Human Resources, Office of Administration and Resources Management Director, Office of Technology Solutions, Office of the Chief Financial Officer Audit Follow-Up Coordinator, Office of the Administrator Audit Follow-Up Coordinator, Office of Administration and Resources Management Audit Follow-Up Coordinator, Office of the Chief Financial Officer Audit Follow-Up Coordinator, Office of Human Resources, Office of Administration and Resources Management 17-P-0374 28 ------- |