OFFICE OF INSPECTOR GENERAL InspecƟon Report Farm Credit AdministraƟon’s Process in Developing and UpdaƟng Policies and Procedures I‐16‐01 Inspector Ava Bell Issued March 31, 2016 FARM CREDIT ADMINISTRATION Farm Credit Administration Office of Inspector General 1501 Farm Credit Drive McLean, Virginia 22102-5090 March 31, 2016 The Honorable Kenneth A. Spearman, Board Chairman The Honorable Dallas P. Tonsager, Board Member The Honorable Jeffery S. Hall, Board Member Farm Credit Administration 1501 Farm Credit Drive McLean, Virginia 22102-5090 Dear Board Chairman Spearman and FCA Board Members Tonsager and Hall: The Office of Inspector General (OIG) completed an inspection of the Farm Credit Administration’s (FCA or Agency) Process in Developing and Updating Agency Policies and Procedures (PPMs). The objective of this inspection was to determine the effectiveness and efficiency of FCA’s process in developing and updating PPMs. We found the Agency is generally consistent in preparing and formatting new PPMs and routing for approvals. The Agency also consistently posts and communicates new and modified PPMs. We identified opportunities to improve the PPM processes. The Agency agreed to the following actions: 1. Publish procedures for developing, updating, formatting, approving and communicating PPMs. 2. Periodically review PPMs to certify whether policies and procedures are current, need updating, or should be rescinded. 3. Consider automating the review and approvals process. We appreciate the courtesies and professionalism extended by FCA personnel to the OIG staff. If you have any questions about this inspection, I would be pleased to meet with you at your convenience. Respectfully, Elizabeth M. Dean Inspector General Enclosure RESULTS: The Agency uses a consistent Inspection of Farm Credit Administration’s process for developing new Process in Developing and Updating or updating existing policies and procedures (PPMs). The Agency Policies and Procedures Agency also generally communicates new and The Farm Credit Administration (FCA or Agency) maintains an online library updated information about of Agency policies and procedures (PPMs). The PPM library serves as a PPMs to its employees. central repository for PPMs and is a valued resource to FCA employees for information on Agency programs. We identified opportunities for improvement in the The inspection objective was to determine the effectiveness and efficiency of following areas: FCA’s process in developing and updating Agency policies and procedures. • The processes for developing and updating We found the Agency is generally consistent in the following processes: policies and procedures are not formalized in a • Preparing and formatting new PPMs; written document. Such • Routing PPMs for approvals; a document might include: responsibilities • Posting new PPMs or modifications; and associated with • Communicating PPM information to employees. developing and updating PPMs; oversight of the We identified opportunities to improve the PPM processes and the Agency PPM library; methods for agreed to take the following actions. approvals; and guidance on content. 1. Publish procedures for developing, updating, formatting, approving • Many PPMs have older and communicating PPMs. publication dates and contain outdated 2. Periodically review PPMs to certify whether policies and procedures information about are current, need updating, or should be rescinded. Agency policies and programs. 3. Consider automating the review and approvals process. • The process to determine when a new, The Agency agreed to complete specific tasks to improve the PPM process. updated or rescinded PPM should be These tasks include creating a PPM to document the PPM process, and communicated to documenting how and when PPMs are reviewed. The Agency stated it will employees is not also consider automating the review and approvals process. documented. TABLE OF CONTENTS BACKGROUND _______________________________________________________ 1 Prior Review ______________________________________________________________________ 1 INSPECTION RESULTS ________________________________________________ 2 Developing or Updating a PPM ________________________________________________________ 2 Basic PPM Process________________________________________________________________ 2 Routing and Approvals ____________________________________________________________ 2 Routing Process__________________________________________________________________ 3 SharePoint Access ________________________________________________________________ 3 PPM Template Elements ___________________________________________________________ 3 Outdated Policies and Procedures _____________________________________________________ 4 Communication ____________________________________________________________________ 6 Agreed-Upon Actions _______________________________________________________________ 6 OBJECTIVE, SCOPE, AND METHODOLOGY _______________________________ 7 ACRONYMS _________________________________________________________ 8 BACKGROUND The Farm Credit Administration (FCA or Agency) is an independent federal agency responsible for regulating, examining, and supervising the Farm Credit System and the Federal Agricultural Mortgage Corporation. The core mission of the Agency is to ensure a safe, sound, and dependable source of credit and related services for agriculture and rural America. FCA maintains a library of Agency policies and procedures (PPMs) to ensure processes are documented and communicated to employees. The online library of PPMs is housed in the Policies and Procedures site in SharePoint. All FCA employees have read-only access to the library. Since 2012, when the PPMs were moved to SharePoint, a former document providing guidance to all staff on the responsibilities for use and oversight of the PPMs, was not transferred to the SharePoint library. The Standards for Internal Control in the Federal Government, also known as the “Green Book,” state that management should implement control activities through policies and the following attributes 1 contribute to the effective design, implementation, and operation of internal controls: • Documentation of responsibilities through policies, • Periodic review of control activities, and • Communication throughout the entity with appropriate methods of communication. Prior Review Although not exactly on point, the Office of Inspector General conducted an inspection of the FCA Board Policy Statements (I-03-05) to determine if they were consistent with sound business practices in terms of relevancy, timeliness, coverage, and key elements. The inspection found the Agency did not have an established methodology for developing Policy Statements and there was inconsistency in subjects covered and level of detail provided. Additionally, several statements were outdated and documented practices and operations no longer in existence, or missing key elements for sound policy. The inspection resulted in three recommendations, with all action items closed in 2005. The recommendations related to: 1) establishing a methodology for the policies, including distinguishing between FCA operations policy and philosophy statements as guidance for the Farm Credit System; 2) regular review of the policies and updating when appropriate; and 3) a content review of the policies to ensure oversight of critical FCA operations. 1 Based on Principle 12, Implement Control Activities, and Principle 14, Communicate Internally, Standards for Internal Control in the Federal Government (Green Book). 1 INSPECTION RESULTS The objective of this inspection was to determine the effectiveness and efficiency of FCA’s process in developing and updating Agency policies and procedures. The Agency is generally consistent in its process for initiating a new PPM or updating an existing PPM. However, this process is not formally documented in a format that is readily accessible and communicated to FCA staff. We identified opportunities to improve the PPM processes as described in the following sections. Developing or Updating a PPM The Agency has a process for developing and updating FCA’s policies and procedures in practice, but the process is not available to personnel and stakeholders in a written document. A new PPM may be developed for a variety of reasons: Executive Order or Presidential Memorandum, Office of Management and Budget or Office of Personnel Management requirement, Congressional request or mandate, Office of General Counsel requirement or suggestion, staff suggestion, or result of an audit finding. When the PPMs were housed in Lotus Notes, an “About Document” provided guidance on definitions, responsibilities and various procedures relating to preparation, formatting, approvals, classification, publication and distribution of PPMs. The About Document was not transferred to SharePoint with the PPMs; therefore, this written guidance is not readily available to employees. Documenting the Agency’s PPM process in a format that is accessible to all employees will ensure the procedures are consistently and efficiently followed, and the required approvals are obtained. Basic PPM Process The Agency’s general process for initiating a new PPM or updating an existing PPM consists of: drafting and finalizing a new or updated PPM; routing the PPM for approvals; loading the approved PPM into SharePoint; and notifying employees of the change through FCA Today or other means of communication. Documenting this process will provide a resource for staff to follow when initiating a new PPM or updating an existing PPM. Routing and Approvals The Agency’s routing of PPMs for approval generally includes approval by the: Office of General Counsel (OGC), Chief Operating Officer (COO), Executive Assistant to the Chairman, and Chairman. If the PPM is specific to an office, it is also approved by that Office Director. By practice, if the PPM contains procedures, it is approved by the COO; if the PPM contains a policy, it is approved by the Chairman. OGC approval is sometimes requested and sometimes required. Documenting the routing process and defining when approvals are required, and by which offices, will ensure appropriate approvals are obtained. 2 Routing Process To obtain the various approvals, the Agency uses a paper routing sheet to submit a new or updated PPM. This sheet lists the names of those to approve and dates when the PPM package is received and action taken by each staff member. Based on our review of the PPM files, a new or updated PPM generally takes one to two weeks for final review and approvals. File documentation showed that occasionally a routing sheet was not used. We also found inconsistency in the documentation of the PPM routing packages. Only a few packages included background documentation explaining what gave rise to developing or updating the PPM, such as an Executive Order or change in regulations. Automating the review and approvals process will ensure a consistent routing mechanism is used. It would also provide a central storage location for background documentation, as well as a cumulative review of edits and comments. SharePoint Access All employees have read-only access to the SharePoint PPM library. The Agency limits contributor access to the SharePoint PPM library to two employees (in addition to the Office of Information Technology’s SharePoint administrators). This provides reasonable controls for access to the Agency Policies and Procedures site. PPM Template Elements The Agency was consistent with the formatting of the two new PPMs we reviewed that were developed in Fiscal Years (FY) 2014 and 2015. These two PPMs both include the following elements in their respective policy and procedures sections. Policy section includes: • Policy • References • Delegations • Reporting Procedures section includes (in addition to sections specific to each PPM): • Implementing Procedures • General Agency Guidance • Definitions • Accountability Defining required section elements through use of formal templates will continue to ensure consistency in the formatting of new or updated PPMs. 3 Outdated Policies and Procedures Our inspection included a review of the SharePoint library of PPMs to determine how current they are. It appears many PPMs have not been updated for a number of years. Of the 92 PPMs the Agency has published in SharePoint as of January 20, 2016, we found: No. of PPMs with a publication date… 31 January 1, 2011 to January 20, 2016 14 January 1, 2006 to December 31, 2010 47 prior to January 1, 2006 We found no documentation in the records we inspected that indicated whether the PPMs had been reviewed since their publication date in SharePoint. Latest PPM Publication Date 34% 51% within last more 5 years than 10 years ago 15% 5-10 years ago 4 We also reviewed PPM titles, publication dates and limited content. We noted several PPMs with outdated information or potentially obsolete information. The chart below identifies information in these PPMs that needs further review. PPMs with Information in Need of Review Publication Issuing PPM No. PPM Title Date Unit Information in Need of Review 861 Domestic Partner Health 3/5/2015 OMS Update for Supreme Court ruling Insurance Subsidy Program 804 FCA Compensation Program 1/17/2014 OMS Compensation 2016 821 Hours of Duty and Alternative 9/13/2006 OMS PPM states: OMS reviews and Work Schedule Program revises or modifies these implementing procedures at least every 2 years 700 Telephone System 9/10/2003 OMS Update for iPhones, iPads—PPM refers to Blackberries 707 Telephone Credit Cards 8/5/2003 OMS Obsolete 853 Supervisory Development 6/19/2003 OMS Date missing Program 900 IRM Planning 3/14/2003 OMS Signature and date missing 833 Health Benefits 3/7/2003 OMS Update Agency contribution; Update for Supreme Court ruling; Update for dependent children coverage to age 26 832 Group Life Insurance 3/7/2003 OMS Update for Supreme Court ruling 829 AIDS 3/7/2003 OMS Consider rescinding or broaden to cover other diseases 851 Property Management 11/8/2002 OMS Update for electronic certification Program forms; Refers to obsolete Board Policy Statement 69 840 Role and Responsibility of the 9/30/2002 OMS Signature and date missing Contracting Officer’s Technical Representative 852 Student Loan Program 9/4/2002 OMS Update for new student loan program 1006 Audit Follow-up Policies and 6/28/2002 OCEO PPM states: This directive will Procedures expire on June 30, 2005 unless reissued by the CEO. 823 Voluntary Leave Bank 1/28/2002 OMS Update publication date—signed Program 10/28/2010 901 Publications Group 11/15/1999 OMS Obsolete 805 Mail Procedures 8/19/1998 OMS Outdated procedures 800 Farm Credit Administration 6/30/1998 OMS Organization chart dated Sept 2011 Organization 806 Procedures for Acquiring FCA 6/30/1998 OMS Outdated procedures Stock Items 811 Upward Mobility Program 10/9/1990 OMS PPM states: This PPM is being reviewed for possible revisions. (10/15/98) 5 Additionally, there are 37 PPMs that reference one (or more) other PPMs. At least 17 of these PPMs reference obsolete or outdated PPMs. If PPMs are not kept current, employees may have inaccurate information on Agency programs and follow outdated procedures. The Agency does not have a schedule to periodically review current PPMs and certify the status of each PPM as: current, needs revising, or should be rescinded. Periodic review of the PPMs will ensure management and employees have access to current operational policies and procedures. Communication The Agency generally communicates new PPMs or modifications to PPMs to employees through FCA Today (a collection of articles emailed to all employees on a daily basis) in a timely manner. During FY 2013 through 2015, we found most new PPM information was communicated through FCA Today to all employees or alternatively, through other means directed to the specific stakeholders (e.g., to office directors). However, we found no written guidance describing the Agency’s communication process for new PPM content. Because the Agency does not have a documented process for determining when a new, updated or rescinded PPM should be communicated to employees, responsibility for deciding when and how to communicate updates to PPMs lies with the PPM author. Formalizing guidance on publishing new or updated PPM information will ensure employees are notified of new or modified PPMs. Agreed-Upon Actions 1. Publish procedures for developing, updating, formatting, approving and communicating PPMs. 2. Periodically review PPMs to certify whether policies and procedures are current, need updating, or should be rescinded. 3. Consider automating the review and approvals process. The Office of Management Services agreed to complete the following specific tasks to improve the PPM process: 1. Create an Agency PPM that documents the PPM process, including developing, updating, formatting, approving and communicating PPMs. 2. Provide written documentation demonstrating when and how PPMs are reviewed. 3. Provide written documentation demonstrating that automating the PPM process was considered. 6 OBJECTIVE, SCOPE, AND METHODOLOGY The objective of the inspection was to determine the effectiveness and efficiency of FCA’s process in developing and updating Agency policies and procedures. We conducted fieldwork at FCA’s headquarters in McLean, Virginia from December 2015 to March 2016. We limited our scope to FY 2013 through 2015. We completed the following steps to accomplish the inspection objective: • Reviewed applicable laws and regulations relating to the inspection objective, including Standards for Internal Control in the Federal Government (Green Book); • Considered prior reviews related to the inspection objective; • Reviewed current Agency policies and procedures (PPMs); • Conducted interviews with key personnel involved in the PPM process; • Obtained background information on policymaking procedures; • Identified internal controls over the PPM process; • Reviewed the processes for developing, updating and communicating PPMs, including required approvals and controls; and • Analyzed relevancy, timeliness and coverage of subject matter. This inspection was performed in accordance with the Council of the Inspectors General on Integrity and Efficiency’s Quality Standards for Inspection and Evaluation. Those standards require that we plan and perform the inspection to obtain sufficient, competent and relevant evidence that supports a reasonable basis for our findings, conclusions and recommendations. We assessed internal controls and compliance with laws and regulations to the extent necessary to satisfy the objective. Because our review was limited, it would not necessarily have disclosed all internal control deficiencies that may have existed at the time of our inspection. We assessed the information and data collected during the inspection and determined it was sufficiently reliable and valid for use in meeting the inspection objectives. We assessed the risk of fraud related to our inspection objective in the course of evaluating evidence. Overall, we believe the evidence obtained is sufficient to provide a reasonable basis for our findings and conclusions based on the inspection objective. 7 ACRONYMS COO Chief Operating Officer FCA Farm Credit Administration FY Fiscal Year OGC Office of General Counsel OMS Office of Management Services PPM Policies and Procedures 8 R E P O R T Fraud | Waste | Abuse | Mismanagement FARM CREDIT ADMINISTRATION OFFICE OF INSPECTOR GENERAL Phone: Toll Free (800) 437-7322; (703) 883-4316 Fax: (703) 883-4059 E-mail: firstname.lastname@example.org Mail: Farm Credit Administration Office of Inspector General 1501 Farm Credit Drive McLean, VA 22102-5090
FCA's Process in Developing and Updating Policies and Procedures
Published by the Farm Credit Administration, Office of Inspector General on 2016-03-31.
Below is a raw (and likely hideous) rendition of the original report. (PDF)