OFFICE OF INSPECTOR GENERAL Audit Report Farm Credit Administration’s Travel Card Program A-14-03 Auditor-in-Charge Sonya Cerne Issued August 19, 2014 FARM CREDIT ADMINISTRATION Farm Credit Administration Office of Inspector General 1501 Farm Credit Drive McLean, Virginia 22102-5090 August 19, 2014 The Honorable Jill Long Thompson, Board Chair The Honorable Kenneth A. Spearman, Board Member The Honorable Leland A. Strom, Board Member Farm Credit Administration 1501 Farm Credit Drive McLean, Virginia 22102‐5090 Dear Board Chair Long Thompson and FCA Board Members Spearman and Strom: The Office of Inspector General (OIG) completed an audit of the FCA’s Travel Card Program. The objective of this audit was to determine whether FCA’s oversight of the travel card program is effective. During our review, we found that FCA’s oversight is generally effective. FCA established and implemented controls over the travel cards. FCA conducted reviews of travel transactions, distributed delinquency reports to management, and placed reasonable spending limitations on the travel cards. We would like to highlight the responsive actions Office of Management Services (OMS) plans to take to address the issues identified during the audit. OMS agreed to the following actions to improve the travel card program: 1. Provide education to cardholders, at least annually, regarding agency policies on cash withdrawals, personal use, procedures for when a credit is on an account, charging expenses related to other individuals, and mandatory use of the travel card for official travel. 2. Determine a process to distribute quarterly transaction activity reports such that appropriate managers have the information and require a response on whether any transactions need further review. 3. Document procedures on placing or removing an account in restricted status and changes to travel card limits. 4. Incorporate and document a reconciliation of open status accounts on a quarterly basis to ensure accounts of departed employees are closed. 5. Evaluate the sufficiency of existing check out procedures to ensure travel cards are closed as employees depart and update the Charge Card Management Plan to correspond with procedures. 6. Update PPM 711 to include steps to be initiated regarding delinquent accounts and potential disciplinary actions, including dismissal, resulting from illegal, improper, and erroneous purchases. 7. Update PPM 826 to include: disciplinary and adverse action steps related to illegal, improper, and erroneous travel card purchases; account delinquency actions; and, definitions of travel card misuse. 8. Update the Charge Card Management Plan to correspond with PPM 711 on cash advances and delinquency notifications. We appreciate the courtesies and professionalism extended to OIG staff by FCA personnel. If you have any questions about this audit, I would be pleased to meet with you at your convenience. Respectfully, Elizabeth M. Dean Inspector General Enclosure OBJECTIVE: To determine whether FCA’s oversight of the travel card program is effective. During our review, we found that the Farm Credit Administration’s (FCA) oversight BACKGROUND: is generally effective. FCA established and implemented controls over the travel FCA participates in the card program. Specifically, FCA placed a reasonable spending limitation, generally government-wide General $8,000, on travel cards and lowered limitations on cards with little to no activity. Services Administration’s We also found FCA performs monthly audits on travel transactions and distributes (GSA) SmartPay Travel Card monthly delinquency reports to management documenting overdue accounts. Program and currently contracts with the Bureau of Additional changes will improve the travel card program. During our review, we the Fiscal Service (BFS) for found unauthorized transactions on 16 employees’ government travel cards. We travel administration and identified areas needing improvement in account management and the need to services. BFS uses Citibank strengthen policies and procedures. Specifically: as the contractor under the GSA Master Contract. OMS • 48 of the 347 transactions reviewed contained unauthorized transactions is responsible for the overall that included: cash advances outside authorized timeframes, expenses administration of the travel charged outside of official travel, and improper hotel charges. We also card programs at FCA. identified one employee who had not used a government travel card for official travel, as required. The Government Charge Card Abuse Prevention Act • Travel card account management can be improved. Two employees of 2012 and the Office of identified as having restricted accounts did not have lower limits on their Management and Budget’s travel cards as directed in FCA policy. We noted 27 instances of delinquent Memorandum M-13-21, accounts that went into presuspension status and 4 accounts with a Implementation of the suspension status due to nonpayment. We also found two employees who Government Charge Card left FCA and yet remained on the open status report for travel cards. Abuse Prevention Act of 2012, mandated that each • FCA’s policies and procedures should be updated. FCA’s policies on travel Inspector General perform, cards and disciplinary and adverse actions do not identify consequences, at least annually, an including removal in appropriate circumstances, following an employee’s assessment of charge card failure to comply with applicable travel charge card terms and conditions programs. Therefore, we and applicable agency regulations. Further, there are inconsistencies completed a risk assessment between the Charge Card Management Plan and other FCA policies and and initiated this audit as procedures. part of our ongoing efforts in this area. There are eight agreed-upon actions to improve oversight of the travel card program. The Office of Management Services (OMS) agreed with the report and provided specific tasks to be completed to strengthen FCA’s travel card program. Table of Contents BACKGROUND ______________________________________________________________________ 1 Prior OIG Inspection ________________________________________________________________ 2 OBJECTIVE, SCOPE, AND METHODOLOGY _________________________________________________ 2 AUDIT RESULTS ______________________________________________________________________ 4 Transactional Review _______________________________________________________________ 4 Agreed-Upon Actions 1-2 ____________________________________________________________ 6 Account Management_______________________________________________________________ 6 Agreed-Upon Actions 3-5 ____________________________________________________________ 8 Policies and Procedures _____________________________________________________________ 8 Agreed-Upon Actions 6-8 ____________________________________________________________ 9 ACRONYMS ________________________________________________________________________ 10 BACKGROUND The Farm Credit Administration (FCA) participates in the General Services Administration’s (GSA) SmartPay Program and uses charge card programs for official purchases related to the mission of the organization. FCA currently uses three charge card programs: purchase, travel, and fleet. Purchase card programs provide cards to Federal employees to make official Government purchases for supplies, goods, and services under the micro-purchase threshold of $3,000. Cardholders can purchase any commercially available supply or service within the spending limits and not prohibited by either Federal or agency-specific procurement regulations. Travel cards are used only for official travel and travel- related expenses to include transportation, lodging, meals, and incidentals. Fleet cards are used for fuel, maintenance and repair of government owned/operated motor vehicles, aircraft, boats, and motorized equipment. For travel, FCA participates in the government-wide GSA SmartPay Travel Card Program and currently contracts with the Bureau of the Fiscal Service (BFS) for travel administration and services. BFS uses Citibank as the contractor under the GSA Master Contract. FCA’s travel card program includes two types of charge accounts for travel: individually- billed accounts and the centrally-billed account. For the individually-billed accounts, each designated cardholder is responsible for account payments. For the centrally-billed account, travel expenses are paid by the agency directly. FCA’s Office of Management Services (OMS) is responsible for the overall administration of the charge card programs and management of the centrally-billed account. For purposes of this report, we refer to the official government travel card as “travel card.” Each government agency must adhere to the requirements set forth in the Office of Management and Budget (OMB) Circular A-123, Appendix B, Improving the Management of Government Charge Card Programs. The circular stipulates that agencies must develop and maintain written policies and procedures related to charge card programs. This includes an annual submission of the agency’s Charge Card Management Plan that outlines the agency’s system of internal controls over the charge card programs. In addition, the Government Charge Card Abuse Prevention Act of 2012 (Charge Card Act) supplemented OMB Circular A-123, Appendix B with reporting and audit requirements and augmentation of existing controls. The Charge Card Act and OMB Memorandum M-13-21, Implementation of the Government Charge Card Abuse Prevention Act of 2012, also mandated that each Inspector General perform, at least annually, an assessment of charge card programs 1. Therefore, the Office of Inspector General completed a risk assessment and initiated this audit as part of our ongoing efforts in this area. 1 FCA does not meet the threshold for a required travel audit set forth in the Charge Card Act. However, the Charge Card Act did not establish a threshold for purchase card programs; therefore, Inspector Generals must perform an annual assessment of purchase cards. As part of our ongoing efforts, the FCA OIG performed an assessment of all charge card programs. 1 Prior OIG Inspection The Office of Inspector General previously performed an inspection, Distribution, Usage and Control of Purchase and Travel Cards at the Farm Credit Administration (I-09-01). The objective was to determine the effectiveness and efficiency of the implementation of government purchase and travel cards at FCA. For travel cards, the inspection found that FCA had adequate controls over the program and there were no delinquencies over 60 days. However, the inspection found that FCA needed to improve the travel card program. During our review of the previous inspection’s resolution process, we found that FCA addressed the findings within the travel card program. The following chart shows the inspection findings and actions taken: PPM 711 addresses steps FCA's policy on taken to assess government travel cards, creditworthiness and PPM 711, needed to be documents the role of updated. BFS and Citibank. Travel reports were not OMS distributes issued to Office quarterly activity reports Directors. to Office Directors. FCA reviews accounts for No restrictive limitations little to no activity and were set for travel reduces the spending cardholders with limited limitations on those to no travel activity. accounts. OBJECTIVE, SCOPE, AND METHODOLOGY The objective of this audit was to determine whether FCA’s oversight of the travel card program is effective. We conducted field work at FCA’s headquarters in McLean, VA from May through July 2014. We limited our scope to Fiscal Year 2013 and the October - April months of Fiscal Year 2014. We completed the following steps to accomplish the objective: • Reviewed applicable laws and regulations and relevant guidance related to charge card programs and travel. • Reviewed FCA policies and procedures related to charge card programs. 2 • Obtained background information for the GSA SmartPay programs. • Interviewed FCA officials on internal policies and procedures. • Requested and reviewed the listing of all active travel card accounts and limitations as of May 2014. • Analyzed FCA’s travel card transactions for compliance with laws, regulations and FCA policies and procedures. We judgmentally sampled 347 transactions based on: activity, type, location, and number of charges; cash withdrawal periods; and travel timeframes. Because our sample was judgmental and not statistically sampled, we cannot project our findings to the entire population. • Interviewed selected employees about sampled transactions. • Reviewed travel authorizations, vouchers, and documentation in Govtrip and Concur Travel Systems. For the period reviewed, FCA used Govtrip as the travel system for Fiscal Year 2013 and October-March of Fiscal Year 2014 and Concur since April 2014. • Reviewed and analyzed delinquency reports for accounts in past due, presuspension, or suspension status. This audit was performed in accordance with Generally Accepted Government Auditing Standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objective. We assessed internal controls and compliance with laws and regulations to the extent necessary to satisfy the objective. Our review would not necessarily have disclosed all internal control deficiencies that may have existed at the time of our audit. We assessed the computer-processed data relevant to our audit objective and determined that the data was sufficiently reliable. Overall, we believe the evidence obtained provides a reasonable basis for our conclusions based on our audit objective. 3 AUDIT RESULTS During our review, we found that FCA’s oversight is generally effective. FCA established and implemented controls over the travel card program. Specifically, FCA placed a reasonable spending limitation on travel cards. In general, FCA had placed an $8,000 limit on travel cards, with the exception of two board members. FCA also lowered limits on cards with little to no activity. We found no instances of employees taking cash advances in excess of the authorized daily and weekly amounts. We also found FCA performed monthly audits on travel transactions. An OMS official reviews 10 percent of randomly selected employees’ travel transactions each month for misuse, cash withdrawals, and verification of authorizations. Monthly delinquency reports are distributed to management documenting overdue accounts. Lastly, we found established and effective controls, practices and procedures in place related to the travel centrally-billed account. However, additional changes will improve the travel card program. We found unauthorized transactions on employees’ travel cards. FCA can also strengthen account management and policies and procedures. Transactional Review For the audit, we reviewed FCA’s travel activity for Fiscal Year 2013 and the October through April months of Fiscal Year 2014. We judgmentally sampled 347 transactions for further review. From our judgmental sample, we found that 48 of the 347 transactions sampled contained unauthorized transactions that included: cash advances outside authorized timeframes, expenses charged outside of official travel, and improper hotel charges. We also identified one employee who had not used a government travel card for official travel, as required. We identified 4 employees that had taken 10 cash advances outside the Daily authorized timeframe. The cash advances totaled about $1,800, with one Limitation: employee accounting for about $1,300 of the $1,800. FCA’s policies on $210 government travel cards state that employees may obtain cash advances for official travel related expenses through an automated teller machine up to $210 per day and $1,050 per week. Employees can withdraw cash from the travel Weekly card only after official travel has been authorized and no more than five days Limitation: prior to the beginning of travel. However, the four individuals’ cash advances $1,050 occurred outside the allowable timeframe. One individual stated there was an account credit for the month and withdrew the money for personal use because of the credit. Two individuals completed travel and withdrew cash after official travel, although one was local travel only. In both cases, the employees stated they needed to take the advance after travel to cover expenses incurred during travel status. The fourth employee is a frequent traveler and withdrew cash on seven occasions before or after trips, but not within the authorized period. We also found employees had used the travel card for expenses while not on official travel. Federal Travel Regulations, agency policies, and cardholder agreements prohibit the use of the travel card for personal expenses and state that the card is to be used only for authorized travel expenses. We identified 22 transactions for 7 different employees, not corresponding to authorized travel. For example, one employee charged fuel, groceries, and dry cleaning expenses in a month where no travel was authorized. The employee stated they had a credit on the account and therefore used the travel 4 card for personal expenses to use up this credit, although this is not allowed according to FCA policy. Another employee, who is now retired, used the travel card at a gas station and a shopping center in two different months with no authorized travel. One employee used the travel card at a general store and another used the travel card at a restaurant on two occasions and for parking expenses. Both employees were not on official travel at the time of their transactions. One other former employee’s transactions showed a charge for tolls and to a rental car company outside of authorized travel. Because of the circumstances related to expenses charged on the travel card by two other employees, we referred these cases for further evaluation. We also identified 12 transactions where hotel expenses were incorrectly charged to employees’ accounts. FCA’s Policies and Procedures Manual (PPM) 711, Government Travel Charge Card, specifically states the travel card is nontransferable and that no charges may be made on behalf of another employee. However, we found that employees reserved rooms for a group of travelers for official business, and in each of the four employee’s selected transactions, their accounts were incorrectly charged or refunded for other employees’ expenses. For example, one individual reserved three different rooms. When the individual checked out of the hotel, the hotel charged the individual for three rooms even though the employee stated they told the hotel to charge the other rooms to the other FCA travelers individually. The employee had not realized this occurred until our audit. In addition, we found one individual who had not used the government travel card for official expenses, as required. The individual traveled on 11 occasions and failed to use a government travel card despite Federal Travel Regulations and agency policy requiring the individual to do so. The individual stated the travel card had been misplaced and the individual, therefore, used a personal credit card for official travel expenses for an extended period. After more than a year of consistently not using the travel card, the individual requested a new card and began using the government travel card as required. We found these unauthorized transactions occurred, in part, from a lack of understanding of policies and a weakness in the reporting process. Although employees are required to have training on travel card use, many of the employees we interviewed could not remember taking the training or noted that the training was vague. Cardholders sign an agreement at issuance of the travel card stating the overall requirements and personal use restrictions. In addition, refresher training is required every three years. FCA and BFS consider re-signing the one-page statement of cardholder responsibility to be the refresher training. However, FCA has not provided any updates, reminders, or distributions of information beyond the original agreement and re-signing of the statement of cardholder responsibility every three years. We also noted FCA could improve the reporting process to help identify unauthorized charges. OMS provides quarterly reports to FCA senior management showing all charges made to the travel cards by each employee. High-level supervisors receive the reports, but OMS has not always distributed information down to managers directly responsible for authorizing travel and supervising employees. This is especially important because OMS notifies first level managers if an employee has a delinquent account or questionable transactions. These reports have been identified as a tool to verify charges related to official government travel. FCA’s PPM 711 states that supervisors will take appropriate actions for improper transactions based on the quarterly report. However, supervisors cannot take appropriate action if they are not receiving the reports. 5 Agreed-Upon Actions 1-2 To improve processes that reduce unauthorized use of the travel cards, OMS will: 1. Provide education to cardholders, at least annually, regarding agency policies on cash withdrawals, personal use, procedures for when a credit is on an account, charging expenses related to other individuals, and mandatory use of the travel card for official travel. 2. Determine a process to distribute quarterly transaction activity reports such that appropriate managers have the information and require a response on whether any transactions need further review. Management Response OMS distributed an article on August 14, 2014, to FCA employees on travel card policies and agreed to update the Charge Card Management Plan to include annual education on travel card policies. OMS also agreed to update policies and procedures on the distribution of quarterly transaction activity reports. The most recent reports would also be distributed to managers to familiarize the individuals with the process. Account Management We also found that FCA could improve travel card account management. Two employees had been identified as having restricted accounts; however, their set limits were not lowered. Citibank performs a credit assessment on applications, and employees with a credit score of 659 or less receive a restricted card. The Charge Card Management Plan states that if Citibank identifies an employee for a restricted card, then a reduced spending limit will be put in place. The standard limit for FCA’s travel cards is $8,000. FCA currently has 15 travel Restricted Accounts cardholders with restricted accounts. Of the restricted 2 accounts, 1 account has a $1,000 $1,000 Limitation 1 Cardholder limit and 12 accounts have a $5,000 Cardholders $5,000 Limitation limit. However, 2 of the 15 restricted accounts have the $8,000 Limitation standard limit of $8,000. One 12 employee had prior travel card Cardholders misuse, and OMS designated the travel card as restricted. Although OMS noticed the misuse, risk mitigation was not realized because the individual’s limit was not lowered. OMS did, however, monitor the employee’s transactions for an additional three months after the misuse was found. Another employee requested a higher limit, which OMS approved even though the individual had a restricted status. 6 During our review over the 19-month period, we found that employees had not always made payments for travel card expenses within the authorized timeframes. If a cardholder’s account is not paid by the due date, the account can go into delinquency status. Agency policy and user agreements state that travel cards must be paid in full by the due date. FCA’s monthly delinquency reports sort cardholder accounts into categories of 30-day increments. For example, the listing shows cardholder accounts 0-30 days past due and 31-60 days past due up to over 180 days. During our review of the delinquency reports, we found 27 instances of accounts that went into the presuspension status annotated as 31-60 days past due and 4 accounts that went into suspension status annotated as 61-90 days past due. The following chart shows all delinquent accounts for the period of our review: 30 25 0-30 DAYS PAST DUE 20 31-60 DAYS Number of 15 PAST DUE Employees 61-90 DAYS 10 PAST DUE 5 0 Dec-12 May-13 Apr-13 Dec-13 Oct-12 Nov-12 Jan-13 Mar-13 Jun-13 Aug-13 Apr-14 Oct-13 Nov-13 Jan-14 Mar-14 Feb-13 Jul-13 Sep-13 Feb-14 We also identified two employees listed as current travel card holders that were no longer with FCA. One individual retired in December 2013 and the other employee left the agency in April 2014. The open travel card listing as of May 2014 contained both cardholders. Agency officials had not completed the individuals’ clearance documents in a timely manner. Before an employee’s departure, the employee must have the FCA Form 302, Employee Check Out Record, completed and submitted before the last day of work. To complete the form, OMS officials must sign the signature block for travel card clearance. The employee then receives final clearance before separation. However, the retired individual noted above received travel card clearance 34 days after the last day at the agency. OMS cleared the other employee for the travel card about 7 days after the separation date. OMS officials stated the check out record often arrives late and the timeframes do not allow for completion in time for most employees exiting FCA. Therefore, OMS officials run a different report to verify employees that are exiting and initiate actions based on that information. OMS provided verification that BFS was informed that both employees were leaving the agency through this process. However, OMS did not document this process in the Charge Card Management Plan and had not verified the accounts were closed. We found the account management weaknesses occurred for various reasons. Neither the Charge Card Management Plan nor the agency travel policy, PPM 711, identified steps to be taken if misuse was 7 detected, such as a process for restricting the limitation on travel cards. The Charge Card Management Plan and travel policy also did not address when and how to remove or add an individual from a restricted status. Regarding the delinquent accounts, OMS generally issued the notifications to cardholders and their supervisors. However, the agency has not fully defined actions to be taken on delinquent accounts. For example, the travel card policy states the accounts may be suspended, but does not address the consequences of a suspension. Neither the PPM 711 nor the Charge Card Management Plan address how supervisors are to handle delinquent accounts or a cardholder with a history of delinquency. The Charge Card Management Plan also specifically states that FCA notifies BFS to close out accounts. However, the plan does not address confirming closures or reconciling the open status report to verify the closures. For the two individuals remaining on the open status listing, FCA had established but not followed the travel card check out procedures and had not documented the current process for clearing employees’ travel cards. Further, although FCA had a travel card check out process, it was ineffective in clearing employees in a timely manner. Agreed-Upon Actions 3-5 To improve travel card account management, OMS will: 3. Document procedures on placing or removing an account in restricted status and changes to travel card limits. 4. Incorporate and document a reconciliation of open status accounts on a quarterly basis to ensure accounts of departed employees are closed. 5. Evaluate the sufficiency of existing check out procedures to ensure travel cards are closed as employees depart and update the Charge Card Management Plan to correspond with procedures. Management Response OMS agreed to document procedures on placing or removing an account in restricted status and changes to travel card limits in the Charge Card Management Plan. OMS also agreed to review all open travel card accounts each quarter to ensure accounts are closed and to document the review in the travel card report. OMS agreed to update the Charge Card Management Plan to correspond with current check out procedures Policies and Procedures We also found that FCA should update the travel card policies and procedures. The Government Charge Card Abuse Prevention Act of 2012 mandated that agencies provide for appropriate adverse personnel actions to be imposed when employees fail to comply with travel card terms and conditions or agency regulations or commit fraud with respect to a travel card, including removal in appropriate cases. Further, Federal Travel Regulations state that internal agency policies and procedures should define what the agency considers misuse of the travel card. PPM 711 states that if a cardholder uses the travel card for purposes other than official travel, FCA may take disciplinary action. However, infractions and corresponding actions leading to removal had not been defined. Further, FCA’s PPM 826, Disciplinary and Adverse Actions, specifically addresses misuse of agency purchase cards but not travel cards. 8 Although the listing is not all-inclusive, the PPM contains a table of penalties that identifies significant offenses for which disciplinary action is appropriate and provides recommended action guidelines. The PPM and table of penalties do not address travel cards. Lastly, PPM 711, PPM 826, and the Charge Card Management Plan do not include specific definitions of what is considered travel card misuse. We also identified inconsistencies between PPM 711 and the Charge Card Management Plan. FCA’s PPM 711 states that employees may obtain cash advances five days before the beginning of travel, and the Charge Card Management Plan states it is seven days. PPM 711 states that cardholders and their supervisors are notified of delinquencies that are 31-60 days past due. However, the Charge Card Management Plan states this will occur when accounts are more than 60 days past due. Agreed-Upon Actions 6-8 To address the updates needed to the travel card policies and procedures, OMS will: 6. Update PPM 711 to include steps to be initiated regarding delinquent accounts and potential disciplinary actions, including dismissal, resulting from illegal, improper, and erroneous purchases. 7. Update PPM 826 to include: disciplinary and adverse action steps related to illegal, improper, and erroneous travel card purchases; account delinquency actions; and, definitions of travel card misuse. 8. Update the Charge Card Management Plan to correspond with PPM 711 on cash advances and delinquency notifications. Management Response OMS agreed to update the policies and procedures. The specific tasks to be completed include revising PPM 711 and PPM 826 and updating the Charge Card Management Plan to correspond with PPM 711. Overall, OMS agreed with the report and did not provide any comments. An exit conference was held with management on July 31, 2014. 9 ACRONYMS BFS Bureau of the Fiscal Service FCA Farm Credit Administration GSA General Services Administration OIG Office of Inspector General OMB Office of Management and Budget OMS Office of Management Services PPM Policies and Procedures Manual 10 R E P O R T Fraud | Waste | Abuse | Mismanagement FARM CREDIT ADMINISTRATION OFFICE OF INSPECTOR GENERAL • Phone: Toll Free (800) 437-7322; (703) 883-4316 • Fax: (703) 883-4059 • E-mail: email@example.com • Mail: Farm Credit Administration Office of Inspector General 1501 Farm Credit Drive McLean, VA 22102-5090
Travel Card Program
Published by the Farm Credit Administration, Office of Inspector General on 2014-08-19.
Below is a raw (and likely hideous) rendition of the original report. (PDF)