j A *
1®
U.S. ENVIRONMENTAL PROTECTION AGENCY
OFFICE OF INSPECTOR GENERAL
Operating efficiently and effectively
EPA's Purchase Card and
Convenience Check
Program Controls Are Not
Effective for Preventing
Improper Purchases
Report No. 18-P-0232
August 20, 2018

U. S GovwnmtntTu EMmpt
V

-------
Report Contributors:
Eileen Collins
Madeline Mullen
Michael Petscavage
Alexandra Zapata-Torres
Abbreviations
CIGIE
Council of the Inspectors General on Integrity and Efficiency
EPA
U.S. Environmental Protection Agency
FY
Fiscal Year
GAGAS
Generally Accepted Government Auditing Standards
GAO
U.S. Government Accountability Office
OIG
Office of Inspector General
OMB
Office of Management and Budget
PNET
PaymentNet®
Cover Images: Computer, photographic and laboratory accessories are typical items
bought with EPA purchase cards and convenience checks.
(General Services Administration, EPA and EPA OIG images)
Are you aware of fraud, waste or abuse in an
EPA program?
EPA Inspector General Hotline
1200 Pennsylvania Avenue, NW (2431T)
Washington, DC 20460
(888) 546-8740
(202) 566-2599 (fax)
OIG Hotline@epa.gov
Learn more about our OIG Hotline.
EPA Office of Inspector General
1200 Pennsylvania Avenue, NW (2410T)
Washington, DC 20460
(202) 566-2391
www.epa.gov/oiq
Subscribe to our Email Updates
Follow us on Twitter @EPAoig
Send us your Project Suggestions

-------
x-^tD ST/ij.
U.S. Environmental Protection Agency	18-P-0232
i ftA \ Office of Inspector General	August 20,2018
~ SB?*
3 \\|// ?
At a Glance
Why We Did This Project
The U.S. Environmental
Protection Agency's (EPA's)
Office of Inspector (OIG)
conducted this audit after a risk
assessment determined that
the risk was high enough to
warrant an audit.
Our objective was to determine
whether EPA internal controls
over its purchase card and
convenience check program
are adequate to prevent and
detect material illegal, improper
and erroneous purchases.
This report addresses the
following:
• Operating efficiently and
effectively.
EPA's Purchase Card and Convenience Check
Program Controls Are Not Effective for Preventing
Improper Purchases
What We Found
EPA internal controls were not effective. Cardholders,
approving officials, the purchase card team, and EPA
program offices were not providing oversight needed
to achieve compliance with internal controls. Although
cardholders and approving officials must ensure that
each purchase request complies with federal and
agency acquisition and appropriation rules, in most
transactions, they did not.
Ineffective oversight
at the EPA contributed
to improper purchases
totaling $57,017 from
sampled transactions.
Recommendations and Planned Agency Corrective Actions
We made a total of 11 recommendations, including 10 to the Assistant
Administrator for Administration and Resources Management and one to
the Deputy Administrator.
Highlights from the 10 recommendations to the Assistant Administrator for
Administration and Resources Management include requests for the agency
to (1) conduct an assessment and determine how to enhance controls, reduce
confusion and achieve compliance; (2) determine whether adding language
about cardholder and approving official responsibilities to performance standards
would be beneficial and improve compliance; (3) implement preventive controls
that would stop transactions that do not have required approvals or funding;
(4) fully implement and increase the use of detective controls; and (5) issue
guidance regarding penalties for noncompliance and the process for suspending
cardholder privileges due to noncompliance.
One recommendation requested that the EPA Deputy Administrator issue an
agencywide memorandum to emphasize compliance with federal and EPA
requirements for purchase card and convenience check transactions.
The EPA agreed to take corrective actions on all 11 recommendations and
provided planned completion dates. The agency's planned corrective actions and
completion dates meet the intent of the recommendations. All recommendations
are resolved with corrective actions pending.
Send all inquiries to our public
affairs office at (202) 566-2391
or visit www.epa.gov/oia.
Listing of OIG reports.

-------
UNITED STATES ENVIRONMENTAL PROTECTION AGENCY
WASHINGTON, D.C. 20460
THE INSPECTOR GENERAL
August 20, 2018
MEMORANDUM
SUBJECT: EPA's Purchase Card and Convenience Check Program Controls
Are Not Effective for Preventing Improper Purchases
Report No. 18-P-0239
FROM: Arthur A. Elkins Jr.
TO:
Henry Darwin, Acting Deputy Administrator
Donna Vizian, Principal Deputy Assistant Administrator
Office of Administration and Resources Management
This is our report on the subject audit conducted by the Office of Inspector General (OIG) of the
U.S. Environmental Protection Agency (EPA). The project number for this audit was OA-FY18-0045.
This report contains findings that describe the problems the OIG has identified and corrective actions the
OIG recommends. This report represents the opinion of the OIG and does not necessarily represent the
final EPA position. Final determinations on matters in this report will be made by EPA managers in
accordance with established audit resolution procedures.
The Office of the Administrator is responsible for all offices within the EPA, including program
offices that handle purchase card and convenience check transactions. The Office of Acquisition
Management within the EPA's Office of Administration and Resources Management is responsible for
implementing and overseeing the agency's purchase card and convenience check program.
In accordance with EPA Manual 2750, your office provided acceptable corrective actions and milestone
dates in response to OIG recommendations. All recommendations are resolved and no final response to
this report is required. However, if you submit a response, it will be posted on the OIG's website, along
with our memorandum commenting on your response. Your response should be provided as an Adobe
PDF file that complies with the accessibility requirements of Section 508 of the Rehabilitation Act of
1973, as amended. The final response should not contain data that you do not want to be released to the
public; if your response contains such data, you should identify the data for redaction or removal along
with corresponding justification.
We will post this report to our website at www.epa.gov/oig.

-------
EPA's Purchase Card and Convenience	18-P-0232
Check Program Controls Are Not Effective
for Preventing Improper Purchases
	 Table of C	
Purpose		1
Background		1
Responsible Offices		2
Scope and Methodology		2
Results		4
Purchase Card Users Must Comply with Federal and EPA Requirements		4
EPA Internal Controls Were Not Effective		5
EPA Has Not Implemented Proactive Controls		7
Ineffective Oversight Increases Risk and Results in Improper Purchases		8
Conclusion		9
Recommendations		10
Agency Comments and OIG Evaluation		11
Status of Recommendations and Potential Monetary Benefits		14
Appendices
A Agency Response to Draft Report	 15
B Distribution	 24

-------
Purpose
Our objective was to determine whether U.S. Environmental Protection Agency
(EPA) internal controls over its purchase card and convenience check program are
adequate to prevent and detect material illegal, improper and erroneous
purchases.
Background
The Government Charge Card Abuse Prevention Act of 2012 states the following
about Inspector General responsibilities:
The Inspector General of each executive agency shall—(1) conduct
periodic assessments of the agency purchase card or convenience
check programs to identify and analyze risks of illegal, improper,
or erroneous purchases and payments in order to develop a plan for
using such risk assessments to determine the scope, frequency, and
number of periodic audits of purchase card or convenience check
transactions.
Office of Management and Budget Memorandum M-13-21 determined that, at a
minimum, periodic risk assessments are to be performed on an annual basis.
The EPA's Office of Inspector General (OIG) issued EPA OIG Report No.
14-P-0128. Ineffective Oversight of Purchase Cards Results in Inappropriate
Purchases at EPA, on March 4, 2014. That report was the OIG's first purchase
card report. Of $152,602 in sampled transactions, $79,254 were prohibited,
improper or erroneous purchases. Prohibited purchases included meals for an
awards-recognition ceremony, and gym memberships for EPA employees and
their families. The EPA reported that corrective actions for all seven
recommendations were complete as of December 10, 2014.
On December 20, 2016, we notified the EPA that we would participate in a
Council of the Inspectors General on Integrity and Efficiency (CIGIE) purchase
card cross-cutting project led by the U.S. Department of Agriculture OIG. The
EPA OIG examined purchase card transactions for the first two quarters of fiscal
year (FY) 2017. Those results will be consolidated into a CIGIE report on the
government purchase card initiative.
EPA OIG Report No. 17-P-0113. Risk for EPA's Fiscal Year 2016 Purchase Card
and Convenience Check Program Warrants an Audit, was issued February 14,
2017. In that report, we assessed the risk for the EPA's purchase card and
convenience check program was high enough to warrant an audit because of
noncompliance with existing controls. On October 11, 2017, we notified the EPA
that we were beginning the audit.
18-P-0232
1

-------
Responsible Offices
The Office of the Administrator is responsible for all offices within the EPA,
including program offices that handle purchase card and convenience check
transactions. The Office of Acquisition Management within the EPA's Office of
Administration and Resources Management is responsible for implementing and
overseeing the agency's purchase card and convenience check program. However,
the Office of Acquisition Management does not supervise staff responsible for
purchase card or convenience check transactions within EPA program offices.
Scope and Methodology
We conducted this audit from November 2017 through June 2018, in accordance
with generally accepted government auditing standards (GAGAS), except for
independence standards regarding two of the 75 EPA OIG transactions. Those
standards require that we plan and perform the audit to obtain sufficient,
appropriate evidence to provide a reasonable basis for our findings and conclusions
based on our objectives. We believe that the evidence obtained provides a
reasonable basis for our findings and conclusions based on our objective.
For two of the 75 EPA OIG transactions, we used the GAGAS "conceptual
framework" to identify and evaluate threats to independence, and to apply
safeguards to reduce the threats to an acceptable level. The "conceptual
framework" assists auditors in maintaining independence of mind and in
appearance. We cited noncompliances in each of the two OIG transactions, and
non-purchase cardholders completed the audit work.
The EPA reported 80,917 purchase card transactions and 458 convenience check
transactions totaling $41,175,877 and $241,078, respectively, in FY 2017. These
purchases were made by 1,145 different purchase cardholders and convenience
check account holders. To answer our objective, we reviewed the following
information that includes the applicable law; requirements established by the
U.S. Government Accountability Office (GAO) and the Office of Management
and Budget (OMB); and EPA policy and procedures:
•	Government Charge Card Abuse Prevention Act of 2012.
•	Standards for Internal Control in the Federal Government,
GAO-14-704G, September 2014.
•	Management's Responsibility for Enterprise Risk Management and
Internal Control, OMB Circular A-123, July 15, 2016.
•	Improving the Management of Government Charge Card Programs, OMB
Circular A-123, Appendix B, January 15, 2009.
•	EPA Acquisition Guide, Section 13.3.1, Using the Government-wide
Commercial Purchase Card, December 2015.
•	The EPA's Agency- Wide Purchase Card Standard Operating Procedures
Payment Net (PNET) Purchase Card Automation Process.
18-P-0232
2

-------
The EPA OIG also participated in the CIGIE cross-cutting project to analyze
government purchase card transactions. We determined that the CIGIE
transactions and methodology should be incorporated into our audit of the
EPA's purchase card and convenience check program.
The CIGIE information technology committee had created weighted algorithms to
determine high-risk transactions. According to CIGIE methodology, the following
categories of transactions merited closer review:
•	Prohibited Merchant Category Codes.
•	Questionable Merchant Category Codes.
•	Cardholder Exceeded Single-Purchase Limit.
•	Split Transaction.
•	Sales Tax Transaction.
•	Holiday Transaction.
•	Weekend Transaction.
•	Unauthorized Third-Party Merchants.
•	Closed Account Activity.
We used these algorithms to identify 23 sample purchase card transactions for
each of the first three quarters of FY 2017.
In addition, we judgmentally selected a sample of six convenience check
transactions for review, each of which was $2,000 or above. As a result, the total
sample was 75 transactions involving 70 cardholders and 67 approving officials,
as shown in Table 1. The value of all sampled transactions was $58,128.26.
Table 1: EPA transactions sampled

1st Qtr.
2nd Qtr.
3rd Qtr.

Transaction type
FY 2017
FY 2017
FY 2017
Total
Purchase card
23
23
23
69
Convenience check
2
2
2
6
Total


75
Source: OIG samples.
Each transaction was reviewed for compliance with 16 EPA policy and procedure
requirements.
We interviewed staff within the Office of Acquisition Management and obtained
documents from PaymentNet® (PNET), the EPA's acquisition system, and
cardholder files. After reviewing sampled transaction documents, we emailed and
interviewed cardholders and approving officials as needed. We also followed up
on the March 2014 EPA OIG audit recommendations for EPA purchase cards.
18-P-0232
3

-------
Results
Purchase Card Users Must Comply with Federal and EPA
Requirements
Relevant law, policy, procedures and
guidance include the following:
•	The Government Charge Card
Abuse Prevention Act of 2012
requires executive agencies to use
"effective systems, techniques and
technologies to prevent or identify
illegal, improper or erroneous
purchases." The act also requires
agencies to have policies about the
number of purchase cards.
•	Standards for Internal Control in
the Federal Government, GAO-14-704G, September 2014, states that:
o Management should use quality information to achieve objectives
and address risks,
o Management should identify and respond to risks for achieving
objectives.
•	Management '.s Responsibility for Enterprise Risk Management and
Internal ControlOMB Circular A-123, July 15, 2016, notes that it is
management's responsibility to continuously monitor, assess and improve
internal control effectiveness. Further, management should identify and
correct control deficiencies.
•	Improving the Management of Government Charge Card Programs, OMB
Circular A-123, Appendix B, January 15, 2009, prescribes policies and
procedures for internal controls to reduce government charge card risks of
fraud, waste and error.
•	The EPA Acquisition Guide, Section 13.3.1, Using the Government-wide
Commercial Purchase Card, December 2015, establishes policy for using
governmentwide commercial purchase cards at the EPA. The guidelines
detail requirements for approvals, special approvals, closer scrutiny,
mandatory sources and strategic sourcing.
•	The EPA's Agency- Wide Purchase Card Standard Operating Procedures
Payment Net (PNET) Purchase Card A utomation Process states that
effective August 1, 2015, all purchase card transactions are required
A computer hard drive is a typical item bought
through one of the sampled purchase card
transactions. (EPA OIG photo)
18-P-0232
4

-------
to be documented in PNET. Failure to document transactions in PNET
results in suspension of purchase card privileges until PNET is updated.
EPA Internal Controls Were Not Effective
Although the EPA implemented numerous internal controls for its purchase card
and convenience check program in response to the 2014 EPA OIG audit report,
we found that the agency's internal controls were not effective to prevent and
detect material illegal, improper or erroneous purchases. Cardholders, approving
officials, the purchase card team, and program offices were not providing
oversight needed to achieve compliance with internal controls.
Although cardholders must ensure that each purchase request complies with
federal and agency acquisition and appropriation rules, in most transactions, they
did not. Approving officials are responsible for ensuring compliance with all
applicable regulations, policies, procedures and special approvals; however, they
often did not. Table 2 notes that each of the 69 purchase card and six convenience
check transactions sampled had at least one noncompliance.
Table 2: Tested transactions
Type
Compliant
Noncompliant
Purchase cards
0
69
Convenience checks
0
6
Source: OIG analysis of tested transactions.
Purchase Card Noncompliances
Numerous noncompliances were noted for each of the FY 2017 quarters
tested. Some transactions did not comply with multiple requirements, as
noted in Table 3.
Table 3: Purchase card noncompliances for 69 transactions
No.
Internal control issues
1st Qtr.
FY 2017
2nd Qtr.
FY 2017
3rd Qtr.
FY 2017
Total
1
Not approved by approving official in
PNET by the 28th of the month.
17
19
15
51
2
All supporting documentation not in
PNET as required.
15
16
12
43
3
Missing justification for not using
mandatory sources.
8
9
10
27
4
Missing third-party verification for
goods received.
6
10
10
26
5
Missing required purchase log.
10
8
8
26
6
Missing/inadequate approving official
approval prior to purchase.
6
7
9
22
7
Purchases were not declined for
blocked merchant category codes.
7
5
8
20
8
Third-party payment processing
procedures were not followed.
7
3
5
15
18-P-0232
5

-------
No.
Internal control issues
1st Qtr.
FY 2017
2nd Qtr.
FY 2017
3rd Qtr.
FY 2017
Total
9
Fund availability was not verified prior
to placing the order.
5
7
1
13
10
Sales taxes paid without justification.
2
0
1
3
11
Other (one or fewer instances per
quarter).
3
3
2
8
Source: OIG analysis of tested transactions (23 per quarter).
The following transactions illustrate a variety of noncompliances:
•	$1,100 transaction to purchase a wireless projector. The cardholder
did not obtain information technology approval for the purchase, did
not justify why mandatory sources were not used, did not document
that funds were available, did not obtain third-party verification from
the property utilization officer, and the approving official did not
approve the transaction in PNET by the 28th of the month.
•	$1,347 transaction to purchase computer memory. The cardholder
did not maintain all supporting documentation in PNET, did not
document justification for not using mandatory sources, paid sales
taxes on items purchased and did not document a justification for
paying the sales tax, and did not create and maintain a purchase log
in PNET. In addition, the approving official did not approve the
transaction in PNET by the 28th of the month.
•	$3,125 transaction to purchase laboratory chemicals. The
cardholder not obtain approval from the approving official prior to
placing the order and did not consolidate two similar transactions that
exceeded the single-purchase limit.
•	$1,442 transaction to purchase editing services. Although restricted
to an acquisition professional, the cardholder—not an acquisition
professional—did not comply with mandatory verification steps for
vendors using third-party payment processing services. In addition, the
approving official did not approve the transaction in PNET by the 28th
of the month.
Convenience Check Noncompliances
The six convenience check transactions that we reviewed had similar
noncompliance issues. For example, in three transactions, funding availability
was not verified prior to the cardholder's involvement. Table 4 notes that in
four transactions, not all of the supporting documentation was placed in PNET
as required.
18-P-0232
6

-------
Table 4: Convenience check noncompliances for six transactions
No.
Internal control issues
1st Qtr.
FY 2017
2nd Qtr.
FY 2017
3rd Qtr.
FY 2017
Total
1
Missing approval from an approving official
prior to purchase.
1
2
2
5
2
Not approved by approving official in PNET
by the 28th of the month.
2
2
1
5
3
All supporting documentation not in PNET
as required.
2
1
1
4
4
Fund availability not verified prior to placing
the order.
1
0
2
3
5
Restricted transaction requiring an
acquisition professional.
0
0
2
2
6
Missing third-party verification for goods
received.
0
1
0
1
7
Tax Identification not obtained at time of
purchase.
0
1
0
1
8
Missing required purchase log.
0
1
0
1
9
Unable to determine whether training officer
approval was provided.
0
0
1
1
10
Unable to determine total price of purchase.
0
0
1
1
Source: OIG analysis of tested transactions (two per quarter).
In the case of a $2,000 training transaction,
the dates of purchase, funding and training
approval were unknown. Also, it was a
restricted transaction that should have been
made by an acquisition professional, and the
approving official approved the transaction
late in PNET.
EPA Has Not Implemented Proactive
Controls
Despite the EPA's control efforts, oversight
is weak. The purchase card team, which is
responsible for administering the EPA
purchase card program, does not have enough staff to implement effective
proactive and detective controls. Instances of cardholder noncompliance primarily
resulted from ineffective training and/or a lack of monitoring and control
activities. Also, the EPA does not have a specific policy to address the appropriate
number of cardholders needed to make purchases in compliance with EPA policy
and procedures.
The following transactions note specific causes of noncompliance related to the
purchased goods and services.
Computer accessories like this docking
station are typical items obtained through
one of the sampled purchase card
transactions. (EPA OIG photo)
18-P-0232
7

-------
Goods
•	Computer keyboards. The cardholder did not know that documenting
a justification for not using mandatory sources is required.
•	Laboratory supplies. The cardholder did not know that the vendor
used a third-party payment processing service when the order was
placed.
•	Laboratory supplies. The approving official did not think that PNET
was required and did not know about its relevance to the EPA.
•	Remote garage door opener. The cardholder was not aware that
documenting a justification for not using a mandatory source is
required.
Services
In one training course transaction, the approving official did not approve the
transaction in PNET because the official did not know approval was required
by the 28!il of the month. In another training course transaction, the cardholder
was unaware of the mandatory steps for vendors using third-party payment
processing services, including the process for purchase orders. A third
example involved a training course where the cardholder did not validate the
transaction in PNET to notify the approving official of the need to review and
approve. A fourth example involved a training course and a convenience
check holder who was only involved at the end of the process.
Ineffective Oversight Increases Risk and Results in Improper
Purchases
Ineffective oversight contributes to risks of illegal, improper and erroneous
purchases. Even though the OIG did not identify any fraudulent or illegal
transactions, all sampled transactions were noncompliant with at least one internal
control. Also, none of the 75 reviewed transactions were in complete compliance
with EPA requirements. The total
sample value was $58,128, of which
$57,017 represented improper
transactions.
We defined improper transactions as
purchases that, although intended for
government use, were made contrary
to and despite the EPA's written
purchase guide and procedure
requirements. We did not include as
improper transactions, instances
where post-purchase administrative
Computer keyboards are also common items
obtained through one of the sampled purchase
card transactions. (EPA OIG photo)
18-P-0232
8

-------
requirements (such as placing documents in PNET, starting a purchase log or
obtaining third-party verification after the purchase) were not met. The following
examples of noncompliance were deemed improper:
•	Cardholder did not obtain pre-approval.
•	Cardholder did not obtain funding in advance.
•	Cardholder did not use mandatory or strategic sources.
•	Cardholder did not follow steps for third-party processors.
•	Cardholder split transactions that would have exceeded the micro-
purchase level.
•	Purchase was not made by an acquisition professional cardholder as
required.
•	Special approval by an Information Management Officer was not obtained
for information technology equipment purchases.
•	Merchant Category Code blocking did not work.
The total dollar amounts for improper purchase card and convenience check
transactions are found in Table 5.
Table 5: Dollar value of improper purchases by quarter
FY 2017
Improper purchase
quarter
amounts
1st Qtr.
$16,858.37
2nd Qtr.
18,315.77
3rd Qtr.
21,843.22
Total
$57,017.36
Source: OIG analysis of tested purchase card and convenience
check transactions.
Conclusion
In response to our discussion document, the
EPA agreed with and committed to several
actions summarized in the 11 recommendations
that accompany this report.
The EPA also completed several actions.
The agency issued "Flash Notices" during
January 2018 and April 2018 to cardholders
and approving officials to remind them that
they are required to consider the available
EPA-mandated, strategic-sourcing contracts
and mandatory sources. The agency provided
training on purchase card requirements to the
Office of Acquisition leadership in April 2018.
In addition, the agency developed draft purchase card
training slides to address issues identified in this audit.
Laboratory supplies are typical items obtained
through one of the sampled purchase card
transactions, (EPA OIG photo)
18-P-0232
9

-------
Recommendations
We recommend that the Assistant Administrator for Administration and
Resources Management:
1.	Conduct an assessment and determine how to enhance controls, reduce
confusion and achieve compliance.
2.	Determine whether adding language about cardholder and approving
official responsibilities to performance standards would be beneficial and
improve compliance.
3.	Implement preventive controls that would stop transactions that do not
have required approvals or funding.
4.	Fully implement and increase the use of detective controls, such as regular
transaction reviews for purchase card and convenience check compliance.
5.	Issue guidance regarding penalties for noncompliance and the process for
suspending cardholder privileges due to noncompliance.
6.	Revise guidance for strategic and mandatory sources to provide a simple
road map for programs, cardholders and approving officials.
7.	Enforce the requirement for convenience check account holders and their
approving officials to be involved in convenience check transactions from
the beginning of the order process.
8.	Provide detailed training on EPA purchase card guidance, policy and
expectations to cardholders and approving officials.
9.	Take steps to rectify purchases made without prior funding approval.
10.	Implement a policy regarding the appropriate number and categories of
purchase cardholders.
We recommend that the Deputy Administrator:
11.	Issue an agencywide memorandum to emphasize compliance with federal
and EPA requirements for purchase card and convenience check
transactions.
18-P-0232
10

-------
Agency Comments and OIG Evaluation
In its response to our draft report, the EPA concurred with all 11
recommendations and provided acceptable high-level corrective actions with
estimated completion dates.
In response to Recommendation 1, which recommended that the EPA conduct an
assessment and determine how to enhance controls, the Office of Administration
and Resources Management will establish a work group to conduct an assessment
and brainstorm how to enhance controls, reduce confusion and achieve compliance.
Within the same timeframe, the EPA will issue a memorandum to resource officials
requiring them to enhance controls and achieve compliance. The agency's response
meets the intent of Recommendation 1.
For Recommendation 2, we recommended that the EPA determine whether it
would be beneficial to add language about cardholder and approving official
responsibilities to performance standards. The EPA referred to existing EPA
Acquisition Guide language to include purchase card responsibilities in
performance appraisals. The EPA stated that within 30 days of the response, the
agency's purchase card team will issue a reminder E-Blast notice regarding the
existing EPA Acquisition Guide language. The agency's response meets the intent
of Recommendation 2.
In response to Recommendation 3, which recommended that the EPA implement
preventive controls, the EPA stated that the agency will address corrective actions
through the work group formed in response to Recommendation 1. With the
Office of Administration and Resources Management's work group assessment,
and the implementation of preventive controls that will stop transactions from
occurring without required approvals or funding, the planned corrective actions
meet the intent of the Recommendation 3.
For Recommendations 1, 2 and 3, the EPA provided an estimated completion date
of October 5, 2018.
In response to Recommendation 4, which recommended that the EPA implement
detective controls, the agency stated that the Office of Acquisition Management
will increase transaction reviews for purchase card and convenience check
compliance. Also, the Office of Acquisition Management is hiring additional staff
and will be able to increase review frequency. The agency's response meets the
intent of Recommendation 4. The EPA provided an estimated completion date of
September 30, 2018.
For Recommendation 5, we recommended that the EPA issue guidance regarding
penalties for noncompliance. The EPA referred to guidance related to cardholder
noncompliance and abuse, and stated that the Office of Administration and
Resources Management will explore revisions to the EPA Acquisition Guide for
18-P-0232
11

-------
additional actions that could be taken against noncompliant cardholders and
approving officials. The Office of Administration and Resources Management
committed in a separate email response to include the additional actions in the EPA
Acquisition Guide. The agency's response meets the intent of Recommendation 5.
The EPA provided an estimated completion date of October 5, 2018.
Recommendation 6 involved a request for the EPA to revise its guidance for
strategic and mandatory sources. The EPA responded that it issued reminders about
strategic sourcing on January 11 and April 11, 2018. Also, the EPA referred to
recent EPA Acquisition Guide changes regarding strategic sources, and stated that
the Office of Administration and Resources Management will add information on
"Priorities for Use of Mandatory Government Sources and Use of Other Mandatory
Sources" to training and guidance materials. The agency's response meets the
intent of Recommendation 6. The EPA provided an estimated completion date of
December 31, 2018.
For Recommendation 7, we recommended that the EPA enforce the requirement
that convenience check account holders and approving officials be involved from
the beginning of the order process. The EPA responded that the purchase card team
will send out an E-Blast notice and revise the supplemental training to include a
dedicated segment for convenience check requirements and internal controls. All
cardholders, convenience check writers and approving officials will be required to
complete the training in the 1st quarter of FY 2019. In conjunction with the Office
of Acquisition Management's increased transaction compliance reviews noted in
Recommendation 4, we determined that the intent of Recommendation 7 has been
met.
Recommendation 8 asked the EPA to provide detailed training on EPA purchase
card guidance, policy and expectations to cardholders and approving officials. The
purchase card team began to revise the supplemental training to address training
issues raised in the report. All cardholders and approving officials will be required
to complete the training in the 1st quarter of FY 2019. The agency's response meets
the intent of Recommendation 8.
For Recommendations 7 and 8, the EPA provided an estimated completion date of
October 5, 2018, for communication; and December 31, 2018, for completion of
the training.
In response to Recommendation 9, which recommended that the EPA take steps
to rectify purchases made without prior funding approval, the EPA agreed to
investigate transactions with funds availability issues and take appropriate actions.
The agency's response meets the intent of Recommendation 9.
For Recommendation 10, we asked the EPA to implement a policy for the
appropriate number and categories of purchase cardholders. The EPA agreed to
analyze the number of cardholders to determine the appropriateness for the number
18-P-0232
12

-------
of transactions in each office. The Office of Administration and Resources
Management committed to implement a policy or guidance. The agency's response
meets the intent of Recommendation 10.
For Recommendations 9 and 10, the EPA provided an estimated completion date
of December 31, 2018.
Recommendation 11 involved a request for the EPA to issue an agencywide
memorandum to emphasize compliance. The EPA stated that the Deputy
Administrator will issue a memorandum to senior leaders to emphasize compliance
with federal and EPA requirements for purchase card and convenience check
transactions. The agency's response meets the intent of Recommendation 11.
The EPA provided an anticipated completion date of September 30, 2018.
18-P-0232
13

-------
Status of Recommendations and
Potential Monetary Benefits
RECOMMENDATIONS
Rec.
No.
Page
No.
Subject
Status1
Action Official
Planned
Completion
Date
Potential
Monetary
Benefits
(in $000s)
1
10
Conduct an assessment and determine how to enhance controls,
reduce confusion and achieve compliance.
R
Assistant Administrator for
Administration and
Resources Management
10/5/18

2
10
Determine whether adding language about cardholder and
approving official responsibilities to performance standards
would be beneficial and improve compliance.
R
Assistant Administrator for
Administration and
Resources Management
10/5/18

3
10
Implement preventive controls that would stop transactions that
do not have required approvals or funding.
R
Assistant Administrator for
Administration and
Resources Management
10/5/18

4
10
Fully implement and increase the use of detective controls, such
as regular transaction reviews for purchase card and
convenience check compliance.
R
Assistant Administrator for
Administration and
Resources Management
9/30/18

5
10
Issue guidance regarding penalties for noncompliance and the
process for suspending cardholder privileges due to
noncompliance.
R
Assistant Administrator for
Administration and
Resources Management
10/5/18

6
10
Revise guidance for strategic and mandatory sources to provide
a simple road map for programs, cardholders and approving
officials.
R
Assistant Administrator for
Administration and
Resources Management
12/31/18

7
10
Enforce the requirement for convenience check account holders
and their approving officials to be involved in convenience check
transactions from the beginning of the order process.
R
Assistant Administrator for
Administration and
Resources Management
12/31/18

8
10
Provide detailed training on EPA purchase card guidance, policy
and expectations to cardholders and approving officials.
R
Assistant Administrator for
Administration and
Resources Management
12/31/18

9
10
Take steps to rectify purchases made without prior funding
approval.
R
Assistant Administrator for
Administration and
Resources Management
12/31/18

10
10
Implement a policy regarding the appropriate number and
categories of purchase cardholders.
R
Assistant Administrator for
Administration and
Resources Management
12/31/18

11
10
Issue an agencywide memorandum to emphasize compliance
with federal and EPA requirements for purchase card and
convenience check transactions.
R
Deputy Administrator
9/30/18
$15Z
* The potential monetary benefits amount represents the amount of improper purchases we found extrapolated for 2 years.


1 C = Corrective action completed.
R = Recommendation resolved with corrective action pending.
U = Recommendation unresolved with resolution efforts in progress.
18-P-0232	14

-------
Appendix A
Agency Response to Draft Report
JUL 13-2018
MEMORANDUM
SUBJECT: Revision to Agency Response to Office of Inspector General Draft Report No.
OA-FY18-0045 "EPA Needs to Improve Oversight of Its Purchase Card and
Convenience Check Program," dated June 5, 2018
FROM: Donna J. Vizian, Principal Deputy Assistant Administrator
TO:	Michael Petscavage, Director
Contract and Assistance Agreement Directorate
Office of Audit and Evaluation
Thank you for the opportunity to respond to the issues and recommendations in the subject audit
report. For those report recommendations which the agency agrees, we have provided high-level
intended corrective actions and estimated completion dates. For those report recommendations
which the agency does not agree, we have explained our position and/or proposed alternatives to
recommendations. For recommendation 11, the Deputy Administrator will issue a memo to
agency senior leaders emphasizing compliance with federal and EPA requirements for purchase
card and convenience check transactions.
If you have any questions for the Office of Administration and Resources Management regarding
this response, please contact Celia M. Vaughn, Chief of Staff, Office of Acquisition
Management, at (202) 564-1047.
Attachment
cc: John Showman
Kimberly Patrick
Pam Legare
Celia Vaughn
Raoul D. Scott, Jr.
Michael Petscavage
Eileen Collins
Madeline Mullen
Alexandra Zapata-Torres
Marian Cooper
Lauren Lemley
Bobbie Trent
18-P-0232
15

-------
Attachment
AGENCY'S RESPONSE TO REPORT RECOMMENDATIONS
No.
Recommendation
Assigned to:
High-Level Intended
Corrective Actions
Estimated
Completion by
Quarter and FY
1
Conduct an
assessment and
determine how to
enhance controls,
reduce confusion
and achieve
compliance.
OARM
OARM/OAM concurs with
the recommendation. Within
the next 90 days from this
response, OARM will
establish a work group
consisting of representatives
from the OAM/Purchase
Card Team, Card Holders,
and Approving Officials to
conduct an assessment on
the information from this
audit and brainstorm how to
enhance controls, reduce
confusion, and achieve
compliance with existing
federal and agency purchase
card regulations and
guidance documents. Within
the same time period, and
using the results from the
work group, OARM will
issue a formal memorandum
to the Senior Resource
Officials (SROs) and Junior
Resource Officials (JROs)
requiring them to enhance
more control, reduce
confusion, and achieve
compliance. As the controls
are in place, it is the
responsibility of the
Cardholder (CH) to carry
them out along with the
Approving Official (AO).
October 5, 2018
2
Determine whether
adding language
about cardholder and
approving official
responsibilities to
OARM
OARM/OAM concurs with
the recommendation and
OAM has already taken
action. OAM has performed
an assessment of whether or
October 5, 2018
for the
communication
18-P-0232
16

-------
No.
Recommendation
Assigned to:
High-Level Intended
Corrective Actions
Estimated
Completion by
Quarter and FY

performance
standards would be
beneficial and
improve compliance.

not adding language related
to card holder and approving
official responsibilities to
their performance standards
would be beneficial and
improve compliance. As a
result, EPAAG 13.3.1.6
(e)(6)(ii), states that "OAM
strongly recommends that
CHs have an element in their
performance appraisals
covering their purchase card
responsibilities so they can
be evaluated on their
performance in using the
card". However, to further
emphasize the point, within
30 days of this response,
OAM's Purchase Card Team
(PCT) will issue a reminder
E-Blast Notice to the SROs,
the JROs, and AOs
regarding the existing
EPAAG recommendation.
We will suggest some
elements
cardholder supervisors may
include in a cardholder's
performance standards for
the upcoming fiscal year.

3
Implement
preventive controls
that would stop
transactions that do
not have required
approvals or
funding.
OARM
This issue will be addressed
in the response to
recommendation #1 above
within 90 days of this
response
October 5, 2018
4
Fully implement and
increase the use of
detective controls,
such as regular
transaction reviews
for purchase card
OARM
OARM concurs with the
recommendations. OAM
will increase the conduct of
transaction reviews for
purchase card and
convenience check
September 30,
2018
18-P-0232
17

-------
No.
Recommendation
Assigned to:
High-Level Intended
Corrective Actions
Estimated
Completion by
Quarter and FY

and convenience
check compliance.

compliance. Also, OAM is
currently in the process of
hiring additional support/
resources for various
functions including the
Purchase Card Program.
Once the new hires are on
board and have been trained,
OARM will be able to
further increase transaction
review frequency.

5
Issue guidance
regarding penalties
for noncompliance
and the process for
suspending
cardholder
privileges due to
noncompliance.
OARM
OARM concurs with the
recommendation and already
has guidance that addresses
the penalties for
noncompliance in EPAAG
13.3.1.17 (a)(1), (2), (3), &
(4). These four paragraphs
are very specific as to the
potential actions that can be
taken against the card holder
for noncompliance and
abuse. In addition, OARM
has already included in the
revised Purchase Card
Supplemental Training
information regarding
penalties for noncompliance
and the process for
suspension of card holder
privileges due to
noncompliance. To bring
additional awareness of this
issue to the purchase card
community, OARM will
explore revision(s) to the
language in EPAAG to
address and will include
potential additional actions
that could be taken against a
card holder or approving
official for noncompliance
and/or abuse.
October 5, 2018
18-P-0232
18

-------
No.
Recommendation
Assigned to:
High-Level Intended
Corrective Actions
Estimated
Completion by
Quarter and FY
6
Revise guidance for
strategic and
mandatory sources
to provide a simple
road map for
programs,
cardholders and
approving officials.
OARM
OARM/OAM concurs with
the recommendation. On
January 11, 2018, OAM sent
out a Purchase Card Program
reminder that cardholders are
required to consider the
available EPA-mandated
strategic sourcing contracts
prior to using vendors such
as AMAZON, and that
waiver submission is
required if a cardholder
believes that another source
is in the best interest of EPA.
Again, on April 11. 2018,
OAM issued an E-Blast
Notice to the purchase card
community to remind them
of the same. In addition, the
E-Blast provided clear
instructions regarding waiver
requests which are submitted
to the Business Analysis and
Strategic Sourcing Branch
for approval or disapproval.
Most recently, on May 24,
2018, OARM released
EPAAG Change Notice No.
18-03 announcing revision
to
EPAAG Subsection 8.0.100
Mandatory Requirements for
Use of Common Contract
Solutions Agency policy
regarding the required use of
Common Contract Solutions,
formerly titled
"Requirements for Use of
Strategic Sourced
Solutions".
These changes were made to
make it easier to comply

18-P-0232
19

-------
No.
Recommendation
Assigned to:
High-Level Intended
Corrective Actions
Estimated
Completion by
Quarter and FY



with the policy and clarify
the procedures.
0ARM/OAM will also add
information on Priorities for
Use of Mandatory
Government Sources and
Use of Other Mandatory
Sources to training and
guidance materials.
December 31,
2018
7
Enforce the
requirement for
convenience check
account holders and
their approving
officials to be
involved in
convenience check
transactions from
the beginning of the
order process.
OARM
OARM/OAM concurs with
the recommendation. The
PCT will prepare and send
out an E-Blast Notice to the
purchase card community
informing check writers and
approving officials that in
order for a convenience
check to be used, they must
be involved at the
beginning/planning phase of
the ordering process and not
at the end. To address the
concerns raised in the audit
and achieve compliance with
internal controls, the revised
Purchase Card Supplemental
Training Course will include
a dedicated instructional
segment that emphasizes
convenience check writing
requirements and internal
controls. Also, OAM
discussed this finding during
the OAM Leadership
meeting in April 2018 for
the managers to remind
cardholders who are on their
staff about this requirement.
OAM will require ALL
C ardhol der s/conveni ence
October 5, 2018
for the
communication
18-P-0232
20

-------
No.
Recommendation
Assigned to:
High-Level Intended
Corrective Actions
Estimated
Completion by
Quarter and FY



check account holders and
Approving Officials to
complete the updated
Purchase Card Supplemental
Course in FY-2019, 1st
quarter.
December 31,
2018 (for CH&
AO to complete
the training
8
Provide detailed
training on EPA
purchase card
guidance, policy and
expectations to
cardholders and
approving officials.
OARM
OARM/OAM concurs with
the recommendation. As a
result of this draft audit, the
OARM has proactively
started revising the Purchase
Card Supplemental Training
Course to address training
issues raised in the report.
OAM expects to finalize this
training by August 2018.
The training course will be
available on the EPA
Skillport site. This training
will also be available live as
part of the OAM Acquisition
Workforce Training Plan and
Course Catalog.
OAM will also require all
Cardholders and Approving
Officials to complete the
updated Purchase Card
Supplemental Course in FY-
2019, 1st quarter.
October 5, 2018
December 31,
2018 (for CH&
AO to complete
the training
9
Take steps to rectify
purchases made
without prior
funding approval.
OARM
OARM/OAM concurs with
the recommendation.
For the thirteen (13)
incidents of purchase card
and three (3) incidents of
convenience check internal
control lapses, OAM would
need to identify the exact
transactions, and further
investigate the facts and
circumstances of the
purchases (e.g., whether or

18-P-0232
21

-------
No.
Recommendation
Assigned to:
High-Level Intended
Corrective Actions
Estimated
Completion by
Quarter and FY



not funds were in fact
available or whether vendors
were paid) in order to take
appropriate action.
EPAAG 13.3.1.15 Financial
Issues Related to Purchase
Card, item (a) states that the
before placing orders,
cardholders must coordinate
with their Funds Control
Officer (FCO) to ensure
funds are available. EPAAG
13.3.1.6 (d) states that FCOs
are to certify to the
availability of funds, ensure
that the financial transaction
complies with agency
financial policy and
procedures, and that all of
the accounting data is
accurate and complete.
However, it also states that
the method for funding
purchase card orders will
vary according to established
office procedures, and that
any method is acceptable as
long as the cardholder
ensures funds are available
before making a purchase.
OAM agrees to conduct fact-
finding and investigation on
the transactions cited with
funds availability
verification issues and take
the appropriate action(s)
deemed necessary.
December 31,
2018
10
Implement a policy
regarding the
OARM
OARM/OAM concurs with
this recommendation and
will analyze the number of
December 31,
2018
18-P-0232
22

-------
No.
Recommendation
Assigned to:
High-Level Intended
Corrective Actions
Estimated
Completion by
Quarter and FY

appropriate number
and categories of
purchase
cardholders.

cardholders per program
office to determine if it is
appropriate and in
proportion to the recorded
number of purchase card
transactions for that office,
and will implement a policy
or guidance.

11
Issue an agencywide
memorandum to
emphasize
compliance with
federal and EPA
requirements for
purchase card and
convenience check
transactions.
OA,
Deputy
Administrator
The Deputy Administrator
will issue a memo to agency
senior leaders emphasizing
compliance with federal and
EPA requirements for
purchase card and
convenience check
transactions.
September 30,
2018
18-P-0232
23

-------
Appendix B
Distribution
The Administrator
Deputy Administrator
Special Advisor, Office of the Administrator
Chief of Staff
Assistant Administrator for Administration and Resources Management
Agency Follow-Up Official (the CFO)
Agency Follow-Up Coordinator
General Counsel
Associate Administrator for Congressional and Intergovernmental Relations
Associate Administrator for Public Affairs
Principal Deputy Assistant Administrator for Administration and Resources Management
Deputy Assistant Administrator for Administration and Resources Management
Principal Deputy General Counsel
Director, Office of Acquisition Management, Office of Administration and Resources
Management
Director, Office of Resources, Operations and Management, Office of Administration and
Resources Management
Director, Alternative Dispute Resolution Law Office, Office of General Counsel
Director, Conflict Prevention and Resolution Center, Office of General Counsel
Deputy Director, Office of Resources, Operations and Management, Office of Administration
and Resources Management
Audit Follow-Up Coordinator, Office of the Administrator
Audit Follow-Up Coordinator, Office of Administration and Resources Management
Audit Follow-Up Coordinator, Office of Acquisition Management, Office of Administration and
Resources Management
Audit Follow-Up Coordinator, Office of General Counsel
18-P-0232
24

-------