oversight

FHFA's Use of Government Purchase Cards

Published by the Federal Housing Finance Agency, Office of Inspector General on 2014-01-31.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

         Federal Housing Finance Agency
             Office of Inspector General




   FHFA’s Use of Government
       Purchase Cards




Audit Report  AUD-2014-006  January 31, 2014
                                            January 31, 2014


TO:                Mark Kinsey, Chief Financial Officer

FROM:              Russell A. Rau, Deputy Inspector General for Audits


SUBJECT:           Audit of FHFA’s Use of Government Purchase Cards


Summary

On October 5, 2012, the President signed into law the Government Charge Card Abuse
Prevention Act of 2012 (Charge Card Act), Public Law 112-194. The Charge Card Act requires
all executive branch agencies to establish and maintain safeguards and internal controls for
charge cards. The Office of Management and Budget (OMB) provided supplemental guidance
through Memorandum M-13-21, Implementation of the Government Charge Card Abuse
Prevention Act of 2012, dated September 6, 2013. The guidance requires each agency head to
provide an annual certification that the appropriate policies and controls are in place or that
corrective actions have been taken to mitigate the risk of fraud and inappropriate charge card
practices. The annual certification should be included as part of the existing annual assurance
statement under the Federal Managers’ Financial Integrity Act of 1982 (31 U.S.C. §
3512(d)(2)).

Under the Charge Card Act, Inspectors General (IGs) are required to conduct periodic risk
assessments of agency purchase card programs to analyze the risks of illegal, improper, or
erroneous purchases.1 Status reports on the IGs’ purchase and travel card audit
recommendations, if any, must be submitted to OMB by January 31, 2014, for compilation and
transmission to Congress and the Comptroller General of the United States. This audit report
supports Federal Housing Finance Agency (FHFA or Agency) Office of Inspector General (OIG)
efforts to fulfill these requirements.




1
    41 U.S.C. § 1909(d)(1).


       Federal Housing Finance Agency Office of Inspector General • AUD-2014-006 • January 31, 2014
                                                    1
Background

OIG’s Activity Pursuant to the Charge Card Act

The Charge Card Act requires each agency with more than $10 million in purchase card
spending during the prior fiscal year to jointly report with its OIG to OMB on a semi-annual
basis regarding employee violations of agency policies on card use, as well as certain other
actions taken by the agency’s employees.2 OIG conducted a periodic risk assessment as required,
and found that FHFA’s purchase and travel card spending in FY 2013 did not exceed $10
million. Additionally, the Government Accountability Office (GAO) provides audit coverage of
FHFA’s purchase and travel card transactions as part of its annual audit of FHFA’s financial
statements required by the Housing and Economic Recovery Act of 2008. Nonetheless, OIG’s
periodic risk assessment determined that audits of FHFA’s purchase card spending and travel
card spending were warranted due to the absence of targeted OIG audit coverage. Therefore,
OIG conducted this audit to assess FHFA compliance with laws and regulations related to use of
purchase cards with particular emphasis on mitigation of the risk of fraud and inappropriate
charge card practices. OIG will report separately on the results of its audit of travel card
spending.

Purchase Card Program

FHFA participates in the government-wide GSA SmartPay program. There are a number
of stated benefits associated with the use of the SmartPay program including estimated
administrative savings of $70 per transaction when a purchase card is used in place of a written
purchase order. Other benefits include Agency refunds, such as:

          Productivity refunds—Based on the timeliness and/or frequency of payments to the
           bank (faster payments mean higher refunds);
          Sales refunds—Based on the dollar or spend volume during a specified time period;
           and
          Corrective refunds—Payments made to the Agency to correct improper or erroneous
           payments on an invoice.

Under the GSA SmartPay2 master contract, Citibank is a provider of commercial charge card
payment solutions to federal agencies. Since July 1, 2009, Treasury’s Bureau of Fiscal Service’s,
Administrative Resource Center (ARC) has provided purchase card administrative services to
FHFA. FHFA participates in the GSA SmartPay program through Treasury’s master contract
with Citibank. FHFA’s Office of Budget and Financial Management (OBFM) is responsible for
managing the purchase card program and ensuring that the program complies with applicable
laws, regulations, policies, and procedures.



2
    Id. § 1909(c)(3).


       Federal Housing Finance Agency Office of Inspector General • AUD-2014-006 • January 31, 2014
                                                    2
When a cardholder receives approval for a purchase request, the authorized cardholder will
process the purchase. After authorizing the purchase, the cardholder logs the transaction into the
purchase card log. After the statement cycle closes, the cardholder submits the statement and
supporting documentation to the Statement Reviewer and Approving Official for payment
approval of the outstanding card balance. As of November 11, 2013, a total of 25 FHFA
employees were authorized purchase cardholders. During 2013, FHFA purchase cardholders
executed approximately 1,500 purchase card transactions totaling approximately $1.4 million.
Of these 1,500 transactions, 16 exceeded FHFA’s micro-purchase threshold of $5,000.

OMB A-123, the Charge Card Act of 2012, and OMB Memorandum M-13-21

OMB Circular A-123, Management’s Responsibility for Internal Control, dated December 21,
2004, provides the specific requirements for assessing and reporting on controls.3 The Circular
defines control standards, including a standard related to control activities that, among other
things, requires that internal controls be documented. The circular also requires that internal
controls be monitored and that deficiencies found should be reported to responsible management
officials.4

Appendix B of OMB Circular A-123, “Improving the Management of Government Charge Card
Programs,” originally issued in 2005, prescribes policies and procedures to agencies regarding
how to maintain internal controls that reduce the risk of fraud, waste, and error in government
charge card programs. FHFA issues an annual Charge Card Management Plan to comply with
OMB Circular A-123. The Agency’s Charge Card Management Plan summarizes key charge
card data and outlines policies and procedures critical to the management of FHFA’s charge card
program to ensure that FHFA follows a system of internal controls and mitigates the potential for
fraud, misuse, and/or delinquency.

OMB Memorandum M-13-21 provides supplemental guidance to OMB Circular A-123
Appendix B related to implementation of the Charge Card Act, including requirements for:
       Federal agencies to establish certain safeguards and internal controls for the
        government charge card program; and
       Reports on purchase card violations and penalties for violators, including removal
        when circumstances warrant.
Objective

The overall objective of the audit was to assess FHFA’s use of government purchase cards. The
specific objective was to determine whether FHFA complied with applicable purchase card laws


3
  Internal control is an integral component of an organization’s management that provides reasonable assurance that
the following objectives are being achieved: effectiveness and efficiency of operations, reliability of financial
reporting, and compliance with applicable laws and regulations.
4
 Internal control standards and the definitions of internal control are based on GAO’s Standards for Internal
Control in the Federal Government (November 1999).


    Federal Housing Finance Agency Office of Inspector General • AUD-2014-006 • January 31, 2014
                                                         3
and regulations and whether the Agency has implemented adequate purchase card internal
controls to help avoid fraud and inappropriate charge card practices.

Finding: FHFA Can Further Strengthen Purchase Card Program Policies and Procedures

OIG did not identify any instances of noncompliance with applicable laws and regulations or
fraudulent or inappropriate charge card practices. With limited exceptions, FHFA implemented
adequate purchase card internal controls. OIG noted that FHFA could improve existing controls
by documenting policies and procedures regarding the:
        Solicitation of multiple bids and/or completion of sole-source justifications in
         conjunction with the purchase of employee training costing in excess of $5,000;
        Execution of Continued Service Agreements for high-cost employee training;
        Approval of temporary increases in dollar limits on cardholder purchase authority; and
        Granting and removing of exceptions for card purchases in Merchant Category Codes
         (MCCs) not otherwise authorized.5

Strengthening controls in these areas will help ensure that purchase cards are used in an efficient,
effective, and economical manner and not for illegal, improper, or erroneous purchases.

FHFA Voluntarily Complies with the Federal Acquisition Regulation

As an independent federal agency, FHFA is not subject to the Federal Acquisition Regulation
(FAR). However, as a matter of administrative convenience, FHFA generally follows the FAR
on a voluntary basis with the exception of flexibilities identified within the Agency’s Acquisition
Procedures Manual. For example, while the FAR micro-purchase threshold is $3,000, FHFA has
adopted a micro-purchase threshold of $5,000.6

Training Purchases in Excess of $5,000

OIG noted that FHFA did not have documented policies and procedures regarding the purchase
and approval of employee training above the $5,000 micro-purchase threshold. In a sample of 16
purchase card transactions that exceeded the $5,000 threshold, 8 were for purchases of FHFA
employee training. While purchases above the $5,000 FHFA micro-purchase threshold typically
require multiple bids or sole source justifications, OIG noted that FHFA policies and procedures
do not exempt training purchases above the $5,000 threshold from the solicitation of multiple


5
  A Merchant Category Code (MCC) is a four-digit code used to identify the type of business a merchant conducts
(e.g., gas stations, restaurants, airlines). The merchant selects its MCC with its bank based on its primary business.
The code helps agencies control where purchases are allowable and may determine if the item is centrally or
individually billed.
6
 FAR 2.101, “Definitions,” defines a micro-purchase as an acquisition of supplies or services using simplified
acquisition procedures, the aggregate amount of which does not exceed the micro-purchase threshold of $3,000
unless one or more exceptions applies; none are applicable here.


    Federal Housing Finance Agency Office of Inspector General • AUD-2014-006 • January 31, 2014
                                                           4
bids or sole source justifications, nor did FHFA obtain bids or complete sole source justifications
for any of the eight training purchases above $5,000.

While FHFA has implemented procurement guidance for the purchase of training below $5,000,
there is no documented guidance to follow when the cost of training exceeds the $5,000
threshold. FHFA officials referred to the FAR as their guidance for procurements above $5,000.
The FAR requires the solicitation of a “reasonable number of bids” or completion of a sole
source justification for any purchases above the micro-purchase threshold.

While FHFA does not have documented guidance related to the purchase of training in excess
of the $5,000 micro-purchase threshold, the Agency has relied on a September 27, 2012, legal
opinion, “Contracting for Training,” as the authority for its practice of purchasing training in
excess of the threshold without obtaining multiple bids or preparing sole source justifications.
Regardless, this method of purchasing training in excess of the threshold was not documented in
the Agency’s purchase card policies and procedures. Documenting controls related to exceptions
in the purchase card policies and procedures for purchasing training in excess of $5,000 will
further strengthen Agency compliance with laws and regulations and help avoid potentially
wasteful spending practices.

Inconsistent Use of Continued Service Agreements for High-Cost Training

Controls can also be strengthened to help ensure the consistent use of Continued Service
Agreements for employees obtaining high-cost training in excess of $5,000. Of the eight training
purchases that exceeded the $5,000 threshold, only one required the employee who received the
training to sign a Continued Service Agreement. FHFA did not require Continued Service
Agreements for the other seven training purchases.

OIG identified that FHFA had no policies or procedures in place regarding Continued Service
Agreements for training costing over $5,000. The total value of training purchases over $5,000
for which Continued Service Agreements were not obtained was $51,722. The lack of a
documented Agency policy concerning the use of Continued Service Agreements could
potentially lead to inconsistent employee treatment and wasteful training expenditures, such as
an employee separating from the federal government shortly after completion of high-cost
training. Documenting the use of Continued Service Agreements for employee training in excess
of an appropriate dollar threshold will help ensure that training funds are expended in the most
efficient and effective manner. The use of such agreements will also help ensure that the Agency
as well as the employee benefits from the investment made in the training provided.

Temporary Increases to Cardholder Approval Limits

FHFA program officials approved temporary transaction limit authority increases on multiple
occasions. For example, when purchases above a purchase cardholder’s $6,000 limit were
required, FHFA program officials approved temporary increases in cardholder transaction limits
to facilitate specific purchases. Specifically, FHFA program officials increased the single
transaction limit for a purchaser cardholder with a $6,000 limit to a limit of $7,000 on March 13,
2013, to facilitate a transaction for $6,900. The limit was subsequently and promptly reduced
back to $6,000 on March 19, 2013. OIG found that FHFA (in coordination with ARC) reset

    Federal Housing Finance Agency Office of Inspector General • AUD-2014-006 • January 31, 2014
                                                 5
cardholder limits in a timely manner; however, FHFA did not have policies and procedures
governing approvals to ensure the temporarily higher limits were appropriate and allowable.
Transaction limits are an important control in the purchase card program and the absence of
procedures regarding increases hinders the effectiveness of these controls.

MCC Exceptions Not Subsequently Removed in a Timely Manner

FHFA program officials granted purchase cardholders MCC exceptions that were not
subsequently removed in a timely manner. For example, the audit identified that of 29 MCC
exceptions available to different purchase cardholders as of October 2013, 27 of those MCCs had
not been used as a purchase source for over 6 months. While OIG found that FHFA obtained
appropriate approvals for these otherwise blocked MCCs, policies and procedures governing
MCC exceptions were not in place, including monitoring controls to terminate the exception
when no longer needed. The absence of documented policies and procedures regarding MCC
exceptions reduces the effectiveness of an important purchase card program control that is
intended to ensure that purchases are made with authorized merchants and only for required
products and services. While an MCC exception is allowable, procedures should be in place to
ensure that an MCC exception is allowable only on a case-by-case basis and that there is a
process in place to remove the exception in a timely manner after the allowed purchase is
transacted. Such controls will help decrease the risk that inappropriate purchases will be made
with FHFA purchase cards.

Conclusion

While overall FHFA had sound internal control to ensure compliance with purchase card laws
and regulations, certain controls can be strengthened to further enhance FHFA’s purchase card
management.

Recommendations

OIG recommends that FHFA document purchase card policies and procedures related to:

   1. Purchase of training above the $5,000 micro-purchase threshold.

   2. Use of employee Continued Service Agreements for high-cost training.

   3. Approval and resetting of temporary increases in transactions limits in a cardholder’s
      purchase authority.

   4. Management of MCC exceptions, which should be allowed only on a case-by-case basis
      and removed in a timely manner after the allowed purchase is transacted.

FHFA provided comments (see Attachment A) agreeing with OIG’s recommendations.
Attachments B and C contain OIG’s evaluation of FHFA’s comments.




   Federal Housing Finance Agency Office of Inspector General • AUD-2014-006 • January 31, 2014
                                                6
Scope and Methodology

In order to accomplish its objective, OIG:
         Obtained relevant policies, procedures, and data related to FHFA’s purchase card
          program;
         Interviewed FHFA officials and reviewed relevant guidance; and
         Analyzed FHFA’s purchase card transactions for compliance with laws, regulations,
          and FHFA policies and procedures.

OIG conducted its fieldwork at FHFA’s offices in Washington, DC. The scope of the audit was
October 2012 through September 2013.

OIG assessed the reliability of data received for this audit as determined necessary by
corroborating the information with other source data. OIG considered the risk of fraud as it
relates to the audit objective.

OIG assessed the internal controls related to the audit objective. Specifically, OIG evaluated
the control standards that were significant to the audit objective, including control activities and
monitoring.

OIG performed fieldwork for this audit from October 2013 through December 2013 in
accordance with generally accepted government auditing standards. Those standards require
that audits be planned and performed to obtain sufficient, appropriate evidence to provide a
reasonable basis for the findings and conclusions based on the audit objective. OIG believes
that the evidence obtained provides a reasonable basis for the findings and conclusions included
herein, based on the audit objective.

OIG appreciates the cooperation of FHFA staff in completing the audit. This audit was led by
Kevin Carson, Audit Director, and Theodore Kirby, Auditor-in-Charge, who was assisted by
Anya Maffei-Philbert, Auditor.

cc:       Melvin L. Watt, Director
          Edward DeMarco, Senior Deputy Director
          Eric Stein, Special Advisor and Acting Chief of Staff
          Richard Hornsby, Chief Operating Officer
          John Major, Internal Controls and Audit Follow-up Manager


Attachments:
      Attachment A: FHFA’s Comments
      Attachment B: OIG’s Response to FHFA’s Comments
      Attachment C: Summary of Management’s Comments on the Recommendations




      Federal Housing Finance Agency Office of Inspector General • AUD-2014-006 • January 31, 2014
                                                   7
Attachment A

FHFA’s Comments on OIG’s Findings and Recommendations




   Federal Housing Finance Agency Office of Inspector General • AUD-2014-006 • January 31, 2014
                                                8
Federal Housing Finance Agency Office of Inspector General • AUD-2014-006 • January 31, 2014
                                             9
Federal Housing Finance Agency Office of Inspector General • AUD-2014-006 • January 31, 2014
                                            10
Attachment B

OIG’s Response to FHFA’s Comments

On January 23, 2013, FHFA provided comments to a draft of this report, agreeing with OIG’s
recommendations and identifying specific actions it would take to address the recommendations.
FHFA agreed to revise purchase card procedures by June 30, 2014, to include guidance to follow
when the cost of training exceeds $5,000. FHFA also agreed to issue a training policy, currently
in draft form, addressing Continued Service Agreement requirements and thresholds. The
Agency will issue the Training Policy by August 31, 2014, and incorporate references to the
policy into purchase card procedures by September 30, 2014. In addition, FHFA agreed to revise
purchase card program procedures to include guidance on requests for temporary increases in
purchase cardholder limits and requests for temporary MCC exceptions and periodic MCC
template reviews by June 30, 2014.7

OIG considers the planned actions sufficient to resolve the recommendations, which will remain
open until OIG determines that the agreed-upon actions are completed and responsive to the
recommendations. OIG considered the Agency’s full response (attached as Appendix A) in
finalizing this report. Appendix C provides a summary of management’s comments on the
recommendations and the status of agreed-upon actions.




7
 An MCC template is a grouping of MCCs that is assigned to each purchase cardholder’s account based on the
cardholder’s anticipated purchasing activity. MCC templates are an element of the system of internal controls for the
Purchase Card Program, helping to reduce the potential for inappropriate use of a purchase card.


    Federal Housing Finance Agency Office of Inspector General • AUD-2014-006 • January 31, 2014
                                                         11
Attachment C

Summary of FHFA’s Comments on the Recommendations

This table presents management’s response to the recommendations in OIG’s report and the
status of the recommendations as of when the report was issued.


                                                       Expected
Rec.                                                  Completion      Monetary      Resolved:       Open or
No.          Corrective Action: Taken or Planned         Date         Benefits      Yes or No a     Closed b
           FHFA will revise purchase card
           procedures to include guidance to
    1.                                                6/30/2014           $0            Yes          Open
           follow when the cost of training
           exceeds $5,000.
           FHFA will issue a Training Policy
           addressing Continued Service
           Agreement requirements and
    2.                                                9/30/2014           $0            Yes          Open
           thresholds. FHFA will revise purchase
           card procedures to include references
           to the newly issued Training Policy.
           FHFA will revise purchase card
           procedures to include guidance on
    3.                                                6/30/2014           $0            Yes          Open
           requests for temporary increases in
           purchase cardholder transaction limits.
           FHFA will revise purchase card
           procedures to include guidance on
    4.     requests for temporary MCC                 6/30/2014           $0            Yes          Open
           exceptions and periodic reviews of
           MCC templates.

a
 Resolved means: (1) Management concurs with the recommendation, and the planned, ongoing, and completed
corrective action is consistent with the recommendation; (2) Management does not concur with the recommendation,
but alternative action meets the intent of the recommendation; or (3) Management agrees to the OIG monetary
benefits, a different amount, or no amount ($0). Monetary benefits are considered resolved as long as management
provides an amount.
b
  Once OIG determines that the agreed-upon corrective actions have been completed and are responsive, the
recommendations can be closed.




         Federal Housing Finance Agency Office of Inspector General • AUD-2014-006 • January 31, 2014
                                                       12
Additional Information and Copies

For additional copies of this report:

      Call: 202–730–0880
      Fax: 202–318–0239
      Visit: www.fhfaoig.gov


To report potential fraud, waste, abuse, mismanagement, or any other kind of criminal or
noncriminal misconduct relative to FHFA’s programs or operations:

      Call: 1–800–793–7724
      Fax: 202–318–0358
      Visit: www.fhfaoig.gov/ReportFraud
      Write:
                FHFA Office of Inspector General
                Attn: Office of Investigation – Hotline
                400 Seventh Street, S.W.
                Washington, DC 20024




    Federal Housing Finance Agency Office of Inspector General • AUD-2014-006 • January 31, 2014
                                                13