3J \ o T> 2 O * I PftCfl*- U.S. ENVIRONMENTAL PROTECTION AGENCY OFFICE OF INSPECTOR GENERAL Catalyst for Improving the Environment Interim Report EPA Travel Program Lacks Necessary Controls Report No. 10-P-0078 March 9, 2010 ------- Report Contributors: Bettye Bell-Daniel Rae Donaldson Johnny Ross Bram Hass Dwayne E. Crawford Eric Lewis Abbreviations EPA U.S. Environmental Protection Agency ES Excepted Service FDW Financial Data Warehouse OCFO Office of the Chief Financial Officer OIG Office of Inspector General SES Senior Executive Service ------- vitD srAr. \ U.S. Environmental Protection Agency io-p-oo78 March 9, 2010 Iwi • U • O • ^1 I V11 vl 111ICI I LCI I I I UlUl/ll \ Office of Inspector General u! At a Glance Catalyst for Improving the Environment Why We Did This Review The Office of Inspector General (OIG) conducted preliminary research to evaluate the U.S. Environmental Protection Agency's (EPA's) management controls over the GovTrip approval and authorization process. Background EPA travel and delegation policies allow EPA Office Directors, Laboratory Directors, and their equivalents to approve their own travel authorizations and travel payment vouchers. GovTrip is the single EPA travel management system for scheduling, approving, and auditing travel authorizations and travel payments. The General Services Administration is the federal manager for GovTrip and the Office of the Chief Financial Officer (OCFO) manages GovTrip for EPA. For further information, contact our Office of Congressional, Public Affairs and Management at (202) 566-2391. To view the full report, click on the following link: www.epa.qov/oiq/reports/2010/ 20100309-10-P-0078.pdf EPA Travel Program Lacks Necessary Controls What We Found The EPA travel program, which comprises EPA policies and GovTrip, lacks necessary control procedures to assure all travel authorizations were necessary and in the best interest of the government. Additionally, some travelers may approve their own travel without mandatory independent review of travel authorizations prior to travel. As a result, EPA is unnecessarily vulnerable to fraud, waste, and abuse in its travel programs. Our preliminary review covered 949 travel documents extracted from the Financial Data Warehouse covering the period September 2008 to April 2009. Our review of these documents disclosed 199 incidents where travel appeared to be self-approved by persons below the intended responsibilities of "Office Director" (or equivalent). EPA's travel policy states that self-approved travel is not permitted below the level of Office Directors, Laboratory Directors, and their equivalents (presumably Senior Executive Service and Excepted Service personnel). The employees associated with the 199 travel records we analyzed ranged in grade from GS-12 to GS/GM-15. We will review these records during our field work phase for potential violations of the Agency's travel policy. OCFO personnel stated that the data we used from the Financial Data Warehouse were unreliable; however, OCFO urges use of this data in support of Agency financial transactions and thus the Agency's financial statements. We intend to assess the reliability of the GovTrip data in the Financial Data Warehouse as part of our review. Poor internal controls also allow personnel to change the routing chain for travel approval without notifying their supervisor of record. EPA travel policy requires personnel to route travel requests to officials with the authority to authorize their travel. However, personnel can circumvent this requirement by requesting a routing change to the Agency's GovTrip helpdesk, or by making the change electronically through the GovTrip system. Consequently, through collusion or compromise of an approving official's account, an individual could use government funds for unauthorized or personal travel. This interim report is for information only and does not represent any final conclusions or recommendations by the OIG. However, given the potential significance of the areas of vulnerabilities identified, we are providing our preliminary findings for information purposes. ------- #^tDS7X $ \ UNITED STATES ENVIRONMENTAL PROTECTION AGENCY S WASHINGTON, D.C. 20460 OFFICE OF INSPECTOR GENERAL March 9, 2010 MEMORANDUM SUBJECT: EPA Travel Program Lacks Necessary Controls Report No. 10-P-0078 / j S ^ / FROM: Wade T. Najjum uJS '/.'Ms Assistant Inspector General , // Office of Program Evaluation - TO: Barbara Bennett Chief Financial Officer The Office of the Inspector General (OIG) is providing this interim report on the results of our preliminary research regarding the U.S. Environmental Protection Agency's (EPA's) management controls governing travel authorization and the approval of travel vouchers using the GovTrip travel system. OIG managers became aware that an OIG employee acknowledged that the employee could authorize his or her own travel despite not meeting the criteria to do so under the Agency's Travel Policy. Subsequently, the OIG conducted preliminary research to evaluate EPA's management controls over the GovTrip approval and authorization process. Specifically, we wanted to determine whether these controls are adequate to prevent unauthorized and unapproved travel using the GovTrip system. We found three potential areas of vulnerability during our preliminary research: • The EPA travel program, which comprises EPA policies and GovTrip, lacks necessary control procedures to assure all travel authorizations were necessary and in the best interest of the government. • Agency implementation of GovTrip allows some individuals authority to authorize their own travel. Of 949 travel documents reviewed since GovTrip was implemented in September 2008, we noted 199 incidents where travel appeared to be self-approved by persons below the intended responsibilities of "Office Director" (or equivalent). • Poor internal controls also allow personnel to change the routing chain for travel approval without notification of their supervisor of record. ------- Given the potential significance of the vulnerabilities identified, we are providing the results of our preliminary review for information purposes only. The OIG has not completed its overall analysis of these issues; therefore, this interim report does not represent any final recommendations or conclusions by the OIG. We plan to conduct further analysis during our field work phase to evaluate whether the Agency has adequate management controls to ensure travel documents are properly routed and authorized through use of the GovTrip system. The estimated cost of this report - calculated by multiplying the project's staff days by the applicable daily full cost billing rates in effect and the time - is $548,603. If you or your staff have any questions regarding this report, please contact me at 202-566-0832 or naiium.wade@epa.gov, or Eric Lewis at 202-566-2664 or lewis.eric@epa.gov. ------- EPA Travel Program Lacks Necessary Controls 10-P-0078 Table of C Purpose 1 Background 1 Scope and Methodology 3 Results of Preliminary Research 3 Conclusion 7 Status of Recommendations and Potential Monetary Benefits 8 Appendix A Distribution 9 ------- 10-P-0078 Purpose The Office of the Inspector General (OIG) conducted preliminary research to evaluate the U.S. Environmental Protection Agency's (EPA's) management controls over the GovTrip approval and authorization process. Specifically, we sought to determine whether these controls are adequate to prevent unauthorized and unapproved travel using the GovTrip system. This interim report is for information purposes and does not include any final recommendations or conclusions by the OIG. Background EPA implemented the GovTrip system in September 2008. GovTrip is a large, complex, distributed computing system that provides federal travelers with completely automated travel planning and reimbursement capabilities. The system allows for the electronic submission of travel authorizations and travel vouchers for the approval and reimbursement of government travel. • Travelers and Travel Preparers use GovTrip to arrange all aspects of transportation, including to submit a request for and receive reimbursement quickly after travel. • Approving Officials use GovTrip to monitor and manage all necessary authorizations, disbursements, and reimbursements. • Federal Agency Travel Administrators use GovTrip to set up and maintain data for organizations, groups, routing lists, and individual users. Common procedures for processing travel authorizations and travel vouchers using the GovTrip system are shown in Figure 1. Figure 1: Agency Procedures for Processing Travel Documents Travel Authorizations Travel Vouchers • Traveler/preparer creates the travel authorization. • The travel authorization is routed to Authorizing Official who reviews and stamps the document "authorized." • Travel authorization routed to Approver who verifies lines of accounting and approves document. • Traveler/preparer creates the travel voucher. • The travel voucher is routed to Authorizing Official who reviews and authorizes the travel voucher. • Cincinnati Travel Team reviews the travel voucher for payment. Source: GovTrip Supplemental Training Packet. When a trip is complete, the federal traveler files a voucher that is electronically routed for approval and sent to the Agency's Finance and Accounting Department. An electronic funds transfer or a check to the traveler completes the process. 1 ------- 10-P-0078 EPA Delegations Manual EPA 1200 Delegations Manual establishes Agency policy governing the delegation process for Agency management officials to act on behalf of the Administrator. According to this policy, authority may be re-delegated only when allowed in the specific delegation, and re-delegations must be made sequentially from one level to the next (e.g., Assistant Administrator to Office Director to Division Director, rather than from the Assistant Administrator directly to a Division Director). Further, the policy states that the original delegate must keep a written record of all re-delegations of authority to the lowest permissible organizational level or individual exercising the authority. However, the re-delegation of authority does not exonerate the original delegate or interim levels from responsibility or accountability. EPA Travel Policy EPA's 1200 Delegations Manual establishes the authority for the authorization and approval of both domestic and international travel and certain travel-related activities. Chapter 1-17-A (domestic travel), Part l.n, establishes the authority for the authorization and approval of one's own travel authorizations and travel vouchers. Such authority is delegated to the Deputy Administrator, Chief of Staff, Assistant Administrators, Deputy Chief of Staff, Chief Financial Officer, General Counsel, Inspector General, and Regional Administrators. Under Chapter 1-17-A, authority granted under Part l.n may only be re-delegated to: • The Deputy Chief of Staff in the Office of the Administrator • Office Directors (excluding the Office of the Administrator) • Directors, Office of Administration and Resources Management, Cincinnati and Research Triangle Park • Directors of Laboratories • Office of Research and Development Laboratory/Center/Office Directors (or equivalents) According to EPA's travel policy, further re-delegation by these officials is not permitted. Office of Management and Budget Circular A-123 Office of Management and Budget Circular A-123, Management's Responsibility for Internal Control, states that control activities are the policies and procedures that help ensure that management directives are carried out and that management's assertions in its financial reporting are valid. Management's assertions should include an understanding of the control activities applicable at the entity level, such as segregation of duties.1 1 Office of Management and Budget Circular No. A-123, Section III, Part B.3 - Control Environment, revised December 21, 2004. 2 ------- 10-P-0078 Segregation of duties is a control activity that ensures there are separate personnel with authority to authorize a transaction, process the transaction, and review the transaction. Scope and Methodology We conducted our review in accordance with generally accepted government auditing standards. Those standards require that we adequately plan for the audit; properly supervise audit staff; obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions; and prepare audit documentation related to the planning, conducting, and reporting for each audit. We believe that the evidence obtained to date provides a reasonable basis for the information being reported based on the purpose of our review. We conducted preliminary research from March 2009 through March 2010, during which time we analyzed EPA travel data extracted from the Agency's Financial Data Warehouse (FDW) maintained by the Office of the Chief Financial Officer (OCFO). These data represented 949 travel documents processed by EPA using the GovTrip system. We analyzed travel records that met the following criteria: • Transactions processed from September 2008 to April 2009. • Name of authorizer on transaction equaled name of traveler. • Name of authorizer on transaction equaled name of signer. We analyzed travel data, downloaded from the FDW on May 19, 2009, that represented travelers who authorized their own travel documents. According to policy, the re-delegation of this authority for these records should have been done sequentially and to the lowest organizational level of Office Directors, Laboratory Directors, and their equivalents. We also analyzed travel data, downloaded on July 22, 2009, to determine whether there was any information overlap since May 19, 2009. We determined there were no differences in the results of analysis performed between these two periods. Results of Preliminary Research The results of our preliminary research analysis showed the following: • The EPA travel program, which comprises EPA policies and GovTrip, lacks necessary control procedures to assure all travel authorizations were necessary and in the best interest of the government. For instance, EPA's current domestic travel policy allows some travelers the authority to approve their own travel without mandatory independent review of travel authorizations or travel vouchers. As a result, EPA is unnecessarily vulnerable to fraud, waste, and abuse in its travel programs. • Of the 949 travel documents reviewed, we found 199 incidents where travel appeared to be self-approved by persons below the intended responsibilities of "Office Director" (or equivalent). EPA's travel policy states that self-approved 3 ------- 10-P-0078 travel is not permitted below the level of Office Directors, Laboratory Directors, and their equivalents (presumably grade level of Senior Executive Service (SES) or Excepted Service (ES)). The grade level of employees associated with the 199 incidents ranged from GS-12 to GS/GM-15. • Poor internal controls also allow personnel to change the routing chain for travel approval without notification of their supervisor of record. EPA travel procedures require personnel to route travel requests through authorizing officials. However, personnel can circumvent this requirement by requesting a change through the Agency's GovTrip helpdesk, or by making the change electronically through the GovTrip system. The routing change allows the requestor to "pick" who approves the travel authorization. Consequently, through collusion or compromise of an approving official's account, it is possible for an individual to use government funds for unauthorized travel. Analysis of Delegation of Authority for Travel EPA's travel policy establishes authority for certain Agency officials to approve their own travel authorizations and travel vouchers for domestic travel. Such authority is delegated to the Deputy Administrator, the Chief of Staff, Assistant Administrators and Deputy Chief of Staff, the Chief Financial Officer, the General Counsel, the Inspector General, and EPA Regional Administrators. Further re-delegation of this authority is not permitted for international travel. However, the current domestic travel policy does not include requirements for a mandatory independent review of the travel authorizations submitted by the officials stated above (presumably employees at the SES and ES level) prior to travel to determine whether intended travel is in the best interest of the Agency. Consequently, abusive or fraudulent travel and/or travel payments may occur without independent Agency review. We identified 27 SES/ES employees who approved their own travel authorizations and travel vouchers since September 2008. We plan to review travel records corresponding to travel taken by these 27 employees to determine what procedures, if any, were followed to perform an independent review of their travel justifications and whether the travel was in the best interest of the Agency. Analysis of Re-delegation Authority for Travel EPA's travel policy states the re-delegation of authority for the self-authorization of travel is not permitted below the level of Office Directors, Laboratory Directors, or their equivalent. This would indicate that only selected SES/ES personnel are intended to be eligible for this authority. We advised OCFO managers that some GS-12/13 personnel appeared to have this authority. These OCFO managers responded that the title of Office Director varies within individual program and regional offices because the delegation of authority is related to position and not grade level. Consequently, various interpretations of the Agency's travel policy may be resulting in situations where persons below the 4 ------- 10-P-0078 intended responsibilities of "Office Director" (or equivalent) may be granted the authority to authorize their own travel. In our opinion, we do not believe that any personnel, including SES/ES personnel, should be allowed to approve their own travel. Self-approval results in no segregation of duties over this process as required by Office of Management and Budget Circular A-123.2 As a result, EPA's re-delegation of authority allowing individuals self-approval of travel is a control weakness in the Agency's travel process. We identified 199 travel documents successfully authorized by EPA employees whose grade levels ranged from GS-12 to GS/GM-15. Figures 2 and 3 represent the results of our analysis regarding these incidents. Figure 2: Incidents by Organization Organizational Office Number of Incidents Administrator 1 Assistant Administrator for International Affairs 1 Assistant Administrator for Research and Development 20 Assistant Administrator for Enforcement and Compliance Assurance 49 Assistant Administrator for Administration and Resources Management 6 Assistant Administrator for Air and Radiation 18 Assistant Administrator for Prevention, Pesticides and Toxic Substances 4 Assistant Administrator for Solid Waste and Emergency Response 7 Assistant Administrator for Water 12 Office of Environmental Information 2 Office of General Counsel 2 Office of Inspector General 6 Region 2 New York 1 Region 3 Philadelphia 9 Region 4 Atlanta 16 Region 5 Chicago 18 Region 6 Dallas 14 Region 7 Kansas City 2 Region 10 Seattle 7 Organization not shown 4 Total 199 Source: OIG analysis of Agency travel documents extracted from the Financial Data Warehouse, April 2009. 2 Office of Management and Budget Circular A-123, Section III, Assessing Internal Control over Financial Reporting discusses the significance of the control environment and control activity on financial reporting. Section III, Part 3 identifies segregation of duties as a key control activity for management's assertions that its financial reporting is valid. 5 ------- 10-P-0078 Figure 3: Incidents by Grade Grade Number of Incidents GS-12 1 GS-13 11 GM/GS-14 80 GM/GS-15 107 Total 199 Source: OIG analysis of Agency travel documents extracted from the Financial Data Warehouse, April 2009. We briefed OCFO management in July 2009 regarding these incidents. OCFO managers stated that the data we used from the FDW were unreliable; however, OCFO urges the OIG to use this data in support of Agency financial transactions and thus the Agency's financial statements. Further, these OCFO managers agreed that the Agency's policy could be revised pending further confirmation of the OIG's preliminary research results. According to these managers, the current travel policy was a collection of several older travel manuals, and OCFO had not recently reviewed its overall content. The most recent date of the Agency's Delegation of Authority for domestic travel is July 24, 2008. We intend to assess the reliability of the GovTrip data in the FDW as part of our field work review. Further, we will review the determining factors used to re-delegate authority to individuals to self-authorize and self-approve travel, and determine whether these actions adhere to the intent of Agency's travel policy. Analysis of the Routing for Travel Documents According to the GovTrip Document Processing Manual,3 through GovTrip, Federal Agency Travel Administrators are able to establish document routing based on organization and type of action, and automatically verify compliance with travel policy. GovTrip procedures require that travel authorizations and travel vouchers be routed to officials with the authority to authorize travel. However, based on tests conducted by the OIG, we found that routing changes could be made through the Agency's GovTrip helpdesk or electronically through the GovTrip system without the consent or knowledge of the supervisor of record. We conducted two tests to determine the effectiveness of management controls over the routing of travel documents. One test involved an OIG employee submitting an e-mail to the Agency's GovTrip helpdesk requesting a routing change for the processing of that employee's travel documents. A second test conducted using the GovTrip system involved an employee changing the name of the designated authorizing official for the routing of the employee's travel documents. Both tests resulted in successfully changing the routing for these individuals' travel documents to someone other than their designated authorizing officials without the consent or notification of their supervisors of record. 3 GovTrip Document Processing Manual, Version 3.0, updated March 6, 2009. 6 ------- 10-P-0078 We were told by an OCFO manager familiar with the Agency's travel process that it is the responsibility of individual program and regional offices to maintain the accuracy of their routing chains for travel document processing. This manager stated that it is impossible for the GovTrip helpdesk to verify these established routing chains because of the frequency with which the names of authorizing officials change. Further, this manager stated the Agency has no formal written procedures for this process. Rather, most EPA program and regional offices continue to rely on routing chains established under the old Travel Manager system. These procedures allow personnel to change the routing chain for travel approval without notification of the supervisor of record. Consequently, through collusion or compromise of an approving official's account, an individual could use government funds for unauthorized or personal travel. We plan to evaluate this issue further during our field work phase. Conclusion • The EPA travel program, which comprises EPA policies and GovTrip, lacks necessary control procedures to assure all travel authorizations were necessary and in the best interest of the government. • Agency implementation of GovTrip allows some individuals authority to authorize their own travel. Of 949 travel documents reviewed since GovTrip was implemented in September 2008, we noted 199 incidents where travel appeared to be self-approved by persons below the intended responsibilities of "Office Director" (or equivalent). • EPA personnel can change the routing of their travel documents without the consent or knowledge of their supervisor of record. We make no recommendations in this interim report and no response is necessary. We are providing our preliminary findings for information purposes only given the potential significance of the areas of vulnerabilities identified. We plan to conduct further field work concerning these travel controls to determine whether (1) necessary control procedures are in place to help ensure that all travel authorizations were necessary and in the best interest of the government, (2) EPA's travel policy governing the re-delegation of authority for self-approval of travel was carried out consistently Agency-wide, and (3) program and regional offices had control procedures to help ensure that supervisors approved all routing changes. 7 ------- 10-P-0078 Status of Recommendations and Potential Monetary Benefits RECOMMENDATIONS POTENTIAL MONETARY BENEFITS (In $000s) Rec. No. Page No. Subject Status1 Action Official Planned Completion Date No recommendations Claimed Amount Agreed To Amount 1 0 = recommendation is open with agreed-to corrective actions pending C = recommendation is closed with all agreed-to actions completed U = recommendation is undecided with resolution efforts in progress 8 ------- 10-P-0078 Appendix A Distribution Office of the Administrator Chief Financial Officer Deputy Chief Financial Officer Acting Director, Office of Financial Services, Office of the Chief Financial Officer Acting Director, Office of Financial Management, Office of the Chief Financial Officer Associate Staff Director, Office of Financial Management, Office of the Chief Financial Officer Agency Follow-up Official (the CFO) Agency Follow-up Coordinator General Counsel Associate Administrator for Congressional and Intergovernmental Relations Associate Administrator for Public Affairs Audit Follow-up Coordinator, Office of the Chief Financial Officer Acting Inspector General 9 ------- |