/ £% "t, U.S. ENVIRONMENTAL PROTECTION AGENCY OFFICE OF INSPECTOR GENERAL Operating efficiently and effectively EPA's Purchase Card and Convenience Check Program Merits an Audit in Fiscal Year 2020 Report No. 20-P-0006 October 18, 2019 GSA SmartPay3 United States of America j| Supporting your mission J. S. GovernmentTax Exempt If misuse suspected, call (800) xxx-xxxx * i 1E34 Sb7fl TOIE | 'M 12/31/26 £ JOHN SMITH 3M5b r ------- Report Contributors: Myka Bailey-Sparrow Madeline Mullen Michael Petscavage Abbreviations EPA U.S. Environmental Protection Agency GSA U.S. General Services Administration OIG Office of Inspector General Cover Image: Sample government purchase card. (U.S. General Services Administration) Disclaimer: Use of company or product names in this document does not in any way constitute an endorsement by the EPA OIG. Are you aware of fraud, waste or abuse in an EPA program? EPA Inspector General Hotline 1200 Pennsylvania Avenue, NW (2431T) Washington, D.C. 20460 (888) 546-8740 (202) 566-2599 (fax) OIG Hotline@epa.gov Learn more about our OIG Hotline. EPA Office of Inspector General 1200 Pennsylvania Avenue, NW (2410T) Washington, D.C. 20460 (202) 566-2391 www.epa.gov/oiq Subscribe to our Email Updates Follow us on Twitter @EPAoig Send us your Project Suggestions ------- tfED STAf. U.S. Environmental Protection Agency 20-P-0006 I \ Office of Inspector General October 18,2019 I® I At a Glance Why We Did This Project The Government Charge Card Abuse Prevention Act of 2012 requires the Inspector General of each executive agency to conduct periodic assessments of its agency's purchase card and convenience check program. These assessments: • Identify and analyze the risk of illegal, improper or erroneous purchases and payments. • Provide a basis for determining the scope, frequency and number of audits of purchase card or convenience check transactions. For this fiscal year 2019 risk assessment, our objective was to determine whether the U.S. Environmental Protection Agency (EPA) implemented the corrective actions identified as a result of our fiscal year 2018 audit, EPA's Purchase Card and Convenience Check Program Controls Are Not Effective for Preventing Improper Purchases, Report No. 18-P-0232, issued August 20, 2018. This report addresses the following: • Operating efficiently and effectively. Address inquiries to our public affairs office at (202) 566-2391 or OIG WEBCOMMENTS@epa.gov. EPA's Purchase Card and Convenience Check Program Merits an Audit in Fiscal Year 2020 What We Found The agency certified that it implemented corrective actions—including the establishment of additional internal controls—in response to our fiscal year 2018 audit of the EPA's purchase card and convenience check program. However, some of these internal controls were not in full effect during the EPA's fiscal year 2019 transition to a new commercial purchase assessed that the agency's risk of illegal, improper high enough to merit an audit in fiscal year 2020. A longer-than-expected transition to the EPA's new purchase card contract adversely affected the agency's internal controls over its purchase card and convenience check program. card contract. As a result, we and erroneous purchases is The EPA obtains commercial purchase card services from a contractor bank under the U.S. General Services Administration's SmartPay® Program. Beginning on November 30, 2018, when a new SmartPay contract took effect, the EPA transitioned its purchase cards from the previous contractor bank (J.P. Morgan Chase) to the new contractor bank (Citibank N.A.). Although the card changeover took place on schedule, other parts of the transition took much longer than expected due to issues with implementing Citibank's online purchase card management system, CitiManager®. As a result, EPA cardholders could not upload supporting documentation for transactions until late April 2019, which precluded the agency from performing routine transaction testing to verify compliance with federal and agency acquisition requirements. In addition to the implementation delays, the EPA did not receive needed training on CitiManager bank-generated reports until June 2019. In August 2019, more than 8 months after the transition to the new SmartPay contract, the EPA said that some cardholders and approving officials still could not fully use the CitiManager system. We determined that we need to revisit the corrective actions implemented as a result of our fiscal year 2018 audit because the EPA's transition to the new purchase card contract adversely affected the agency's internal controls. We will therefore conduct a fiscal year 2020 audit of the EPA's purchase card and convenience check program. This report contains no recommendations. We issued a discussion document to the agency on June 25, 2019, and the EPA agreed with proceeding directly to a final report. List of OIG reports ------- ^£DSX s rjQLi \ UNITED STATES ENVIRONMENTAL PROTECTION AGENCY | j? WASHINGTON, D.C. 20460 %S *1 PRO"^ OFFICE OF INSPECTOR GENERAL October 18, 2019 MEMORANDUM SUBJECT: EPA's Purchase Card and Convenience Check Program Merits an Audit in Fiscal Year 2020 Report No. 20-P-0006 /") FROM: Charles J. Sheehan, Acting Inspector General TO: Donna Vizian, Principal Deputy Assistant Administrator Office of Mission Support [yl\faUU I • This is our report on the subject risk assessment conducted by the Office of Inspector General (OIG) of the U.S. Environmental Protection Agency (EPA). The project number for this risk assessment was OA&E-FY19-0130. This report represents the opinion of the OIG and does not necessarily represent the final EPA position. You are not required to respond to this report because it contains no recommendations. However, if you submit a response, it will be posted on the OIG's website, along with our memorandum commenting on your response. Your response should be provided as an Adobe PDF file that complies with the accessibility requirements of Section 508 of the Rehabilitation Act of 1973, as amended. The final response should not contain data that you do not want to be released to the public; if your response contains such data, you should identify the data for redaction or removal along with corresponding justification. We will post this report to our website at www.epa.gov/oig. ------- EPA's Purchase Card and Convenience Check Program Merits an Audit in Fiscal Year 2020 20-P-0006 Table of C Purpose 1 Background 1 Responsible Offices 2 Scope and Methodology 2 Results of Risk Assessment 3 Status of Corrective Actions from Previous Audit 3 Citibank Transition Issues 4 Training Issues 5 Conclusion 6 EPA Response and OIG Evaluation 6 Appendix A Distribution 7 ------- Purpose Our risk assessment objective was to determine whether the U.S. Environmental Protection Agency (EPA) implemented corrective actions to reduce the potential for illegal, improper or erroneous use of purchase cards and convenience checks.1 Background Enacted on October 5, 2012, the Government Charge Card Abuse Prevention Act of 2012 (Public Law 112-194) requires executive agencies that issue and use purchase cards to establish and maintain safeguards and internal controls for the management of purchase cards. The act requires the Inspector General of each executive agency to: ... conduct periodic assessments of the agency purchase card or convenience check programs to identify and analyze risks of illegal, improper, or erroneous purchases and payments in order to develop a plan for using such risk assessments to determine the scope, frequency, and number of periodic audits of purchase card or convenience check transactions[.] In addition, Federal Acquisition Regulation 13.301(b) requires agencies to establish procedures for the use and control of the governmentwide commercial purchase card. The following federal and EPA documents also address purchase cards and internal controls: • Office of Management and Budget Circular No. A-123, Appendix B, A Risk Management Framework for Government Charge Card Programs, issued August 27, 2019,2 prescribes policies and procedures for internal controls to reduce government charge card risks of fraud, misuse and delinquency. • EPA Acquisition Guide, Subsection 13.3.1, "Using the Government-wide Commercial Purchase Card," issued December 2015, establishes the agency's policy for using governmentwide commercial purchase cards, including verifying that funds are available before purchases are made; obtaining preapproval of purchases from the relevant approving official; obtaining special approval for items, such as information technology equipment; and verifying that purchases are acquired from mandatory or strategic sources. 1 For the purposes of this report, the term purchase cards encompasses convenience checks, which comprise only a small subset of the EPA's purchase card program. 2 The August 27, 2019, appendix revises former Appendix B, Improving the Management of Government Charge Card Programs, dated January 2009. 20-P-0006 1 ------- Purchase card programs streamline purchasing and reduce administrative costs. The EPA obtains commercial purchase card services through a contractor bank under the U.S. General Services Administration's (GSA's) SmartPay® Program. The SmartPay Program provides services to more than 560 federal agencies, organizations and tribal governments, enabling authorized government employees to make purchases in support of their organization's mission. Beginning in 1998, three contracts have been sequentially awarded under the SmartPay Program: the SmartPay Master Contract, the SmartPay 2 Master Contract and the current SmartPay 3 Master Contract. Beginning on November 30, 2018, the GSA—and all agencies, organizations and tribal governments that use the SmartPay Program, including the EPA— transitioned from the SmartPay 2 contract to the SmartPay 3 contract. As part of that transition, all EPA purchase cards were changed from the SmartPay 2 contractor bank (J.P. Morgan Chase) to the SmartPay 3 contractor bank (Citibank N.A.). In addition, the EPA's account management activities shifted to Citibank's online system, CitiManager®. Responsible Offices The Office of the Administrator is responsible for all offices within the EPA, including program offices that handle purchase card transactions. The Office of Acquisition Solutions within the EPA's Office of Mission Support is responsible for implementing and overseeing the EPA's purchase card program. However, the Office of Acquisition Solutions does not supervise staff responsible for purchase card transactions within EPA program offices. Scope and Methodology We conducted this risk assessment from March 2019 through August 2019 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the work to obtain enough, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our objective. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our objective. To answer our objective, we reviewed applicable laws, Office of Management and Budget requirements, and EPA policy and procedures. We conducted interviews with EPA personnel to gain an understanding of the following: • Internal controls used to oversee the purchase card program. • The transition from the SmartPay 2 contract with J.P. Morgan Chase to the SmartPay 3 contract with Citibank. 20-P-0006 2 ------- • Status of corrective actions resulting from a previous Office of Inspector General (OIG) audit, outlined in OIG Report No. 18-P-0232. EPA's Purchase Card and Convenience Check Program Controls Are Not Effective for Preventing Improper Purchases, issued August 20, 2018. We also reviewed the SmartPay 3 contract and conducted an interview with GSA staff to gain an understanding of the delays involved with the transition to the SmartPay 3 contract. We did not test the EPA's controls over purchase card transactions because supporting documentation and bank-generated reports were not available from CitiManager during the transition to the SmartPay 3 contract. Results of Risk Assessment We assessed that the risk of illegal, improper and erroneous purchases due to issues with the SmartPay 3 transition merits an audit of the EPA's purchase card program in fiscal year 2020. While the EPA certified that it implemented the corrective actions identified in OIG Report No. 18-P-0232. including establishing additional internal controls over its purchase card program, some of these internal controls were not in full effect during the SmartPay 3 transition. As a result, we will conduct an audit of purchase card transactions during fiscal year 2020. Status of Corrective Actions from Previous Audit We analyzed the EPA's corrective actions taken in response to a previous OIG audit, EPA's Purchase Card and Convenience Check Program Controls Are Not Effective for Preventing Improper Purchases, Report No. 18-P-0232, issued August 20, 2018. In that audit, we found that the EPA's internal controls over its purchase card program were not effective. Cardholders and approving officials did not verify, as required, that most of the transactions we reviewed complied with federal and agency acquisition and appropriation rules. In our previous report, we made a total of 11 recommendations, and the EPA agreed to take corrective actions on all 11 recommendations. For this assessment, we followed up on these corrective actions. We determined that although the agency certified that all corrective actions were complete, CitiManager transition issues adversely affected some of the EPA's newly established internal controls. Specifically: • Supporting documentation that the EPA uses to verify that transactions comply with federal and agency acquisition requirements could not be uploaded to CitiManager until late April 2019. • Training on bank-generated reports that the EPA could use for oversight purposes—such as delinquency, fraud analytics and transaction reports— was not provided until June 2019. 20-P-0006 3 ------- Citibank Transition Issues The EPA transitioned from SmartPay 2 to SmartPay 3 on November 30, 2018, when EPA purchase cards were changed from J.P. Morgan Chase to Citibank. Although the card changeover took place on schedule, other parts of the transition took much longer than expected due to difficulties with Citibank's internet-based purchase card management system, CitiManager. The SmartPay 3 contract requires that the contractor bank provide, among other things, a system for account access and a variety of reports to assist in effective management. For example, the SmartPay 3 contract requires that the contractor bank provide at least one data mining tool that monitors individual charges and transactions to identify unusual spending patterns and potential misuse, fraud, waste and abuse. The SmartPay 3 contract also requires that the data mining tool be able to identify split purchases,3 purchase attempts at excluded merchants, and purchases made on dates and times outside of normal government spending patterns. In addition, the SmartPay 3 contract requires that the contractor bank generate standard reports (e.g., delinquency, fraud analytics and transaction reports); agencies be able to create ad hoc reports based on program and transaction data elements; and cardholders be able to upload supporting documentation for each transaction at any time. To address these requirements, Citibank offers CitiManager, an online tool used by the EPA's cardholders, approving officials and Office of Acquisition Solutions. In addition to providing agency officials with bank-generated and ad hoc reports and enabling cardholders to upload supporting documentation, CitiManager includes data mining tool services. However, during interviews with EPA staff, we learned that Citibank's CitiManager system was not working as intended for months after the transition. For example, the EPA was not trained on the bank-generated reports that it could use for internal control activities until June 2019. Also, EPA cardholders could not upload supporting documentation to the CitiManager system until late April 2019. As a result, according to the EPA, cardholders had to keep hard copies of supporting documentation, and the EPA was not able to perform routine transaction testing to verify that purchase card transactions complied with the requirements of theEPA Acquisition Guide, subsection 13.3.1. To mitigate and address transition issues, Citibank and the EPA formed a workgroup to facilitate, examine and find solutions to any problems identified with the purchase cards across the EPA's business lines.4 The workgroup met 27 times between July 30, 2018, and February 1, 2019, to discuss various topics, 3 Split purchases occur when a cardholder breaks down a purchase into two or more purchases to circumvent the cardholder's single purchase limit or to avoid approval requirements. 4 EPA convenience checks, travel cards and fleet cards were also discussed during the workgroup meetings. 20-P-0006 4 ------- including the transfer of the master file5 to Citibank, training, card delivery and access to CitiManager. In addition, the GSA coordinated interagency meetings to address concerns about the transition to Citibank. As of June 18, 2019, the EPA considered the transition to CitiManager to be only partially complete, providing us with the following updates: • Citibank notified the EPA in late April that cardholders could finally upload supporting documents for all future transactions to CitiManager. In addition, cardholders could retroactively upload supporting documents for transactions made from February 2019 through April 2019. However, cardholders could not retroactively upload documents supporting transactions from November 30, 2018, through January 2019. • The EPA began accessing ad hoc reports from CitiManager in March 2019 and received training on CitiManager bank-generated reports in June 2019. • Regular reviews of cardholder transactions were expected to resume in August 2019 with a review of July 2019 transactions. The EPA noted that although it did not conduct regular reviews during the transition period, it did review documentation for any transactions that were declined and protested by cardholders due to Merchant Category Code blocking.6 On August 20, 2019, more than 8 months after the transition to the SmartPay 3 contract, the EPA reported that some cardholders and approving officials still could not fully use the CitiManager system. Training Issues The EPA said that the Office of Acquisition Solutions finally received needed training on CitiManager reporting tools on June 5, 2019, more than 6 months after the transition. In addition, Citibank began providing training for EPA approving officials on June 20, 2019, and the EPA requested more training sessions for approving officials. The EPA developed its own online training for cardholders because Citibank does not provide training to cardholders. Citibank did provide a recorded presentation for this internal training. The EPA training for cardholders was launched during the week of June 23, 2019. In addition, on June 25, 2019, the EPA distributed Citibank's CitiManager Transaction Management User Guide: Cardholder End- to-End User Guide as a reference guide for cardholders. The agency also issued a 5 The master file contains information such as account numbers, cardholder information and account expiration dates. 6 The SmartPay 3 Master Contract defines Merchant Category Codes as the four-digit codes used to identify the types of business that merchants conduct (e.g., gas stations, restaurants or airlines). The agency can block transactions to businesses with certain codes to prevent transactions that are considered high risk. 20-P-0006 5 ------- new EPA Agency-Wide Standard Operating Procedures document for CitiManager on August 21, 2019. Conclusion The EPA's transition to the SmartPay 3 contract adversely affected the agency's internal controls over its purchase card transactions, including some recently implemented controls. As a result, there is increased risk for illegal, improper or erroneous use of purchase cards. Consequently, we will conduct an audit of the EPA's purchase card program in fiscal year 2020. EPA Response and OIG Evaluation On June 25, 2019, we issued a discussion document presenting our results to the agency for its review. In addition, we met with the agency on July 3, 2019, to discuss the results. The EPA agreed with proceeding directly to a final report. 20-P-0006 6 ------- Appendix A Distribution The Administrator Assistant Deputy Administrator Associate Deputy Administrator Chief of Staff Deputy Chief of Staff Assistant Administrator for Mission Support Agency Follow-Up Official (the CFO) Agency Follow-Up Coordinator General Counsel Associate Administrator for Congressional and Intergovernmental Relations Associate Administrator for Public Affairs Principal Deputy Assistant Administrator for Mission Support Associate Deputy Assistant Administrator for Mission Support Deputy Assistant Administrator for Administration and Resources Management, Office of Mission Support Director, Office of Continuous Improvement, Office of the Administrator Director, Office of Acquisition Solutions, Office of Mission Support Director, Office of Resources and Business Operations, Office of Mission Support Audit Follow-Up Coordinator, Office of the Administrator Audit Follow-Up Coordinator, Office of Mission Support Audit Follow-Up Coordinator, Office of Acquisition Solutions, Office of Mission Support 20-P-0006 7 ------- |