oversight

Audit of FHFA's Fiscal Year 2017 Government Purchase Card Program Found Several Deficiencies with Leased Holiday Decorations, and the Need for Greater Attention by Cardholders and Approving Officials to Program Requirements

Published by the Federal Housing Finance Agency, Office of Inspector General on 2018-09-06.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

          Federal Housing Finance Agency
              Office of Inspector General




 Audit of FHFA’s Fiscal Year 2017
    Government Purchase Card
Program Found Several Deficiencies
 with Leased Holiday Decorations,
and the Need for Greater Attention
  by Cardholders and Approving
Officials to Program Requirements




Audit Report • AUD-2018-011 • September 6, 2018
               Executive Summary
               The Federal Housing Finance Agency (FHFA or Agency), like other
               federal agencies, uses government purchase cards to make micro-purchases
               (purchases of $5,000 or less, as defined by FHFA) to acquire goods and
               services for its operations, although use of the government purchase card
               is not limited to micro-purchases. For fiscal year 2017, FHFA made 1,194
AUD-2018-011   purchase card transactions, totaling $1,144,313.

September 6,   Last year, pursuant to the Government Charge Card Abuse Prevention Act
    2018       of 2012 (Charge Card Act) and Office of Management and Budget (OMB)
               instructions, we completed a risk assessment of FHFA covering fiscal years
               2015 and 2016. As reported, we concluded that based on FHFA’s internal
               control and other factors, the risk of illegal, improper, or erroneous purchases
               and payments through its purchase card program during those two fiscal years
               was low (see Risk Assessment of FHFA’s Fiscal Years 2016 and 2015
               Government Purchase Card and Travel Card Programs (March 27, 2017)
               (OIG-RA-2017-001) (online at www.fhfaoig.gov/reports/RiskAssessments)).

               Because it has been four years since we last audited FHFA’s government
               purchase card program, we audited the program as it was carried out during
               fiscal year 2017. Our objectives were to determine whether (1) the Agency’s
               existing controls over the program provide reasonable assurance that improper
               payments will not occur or will be detected in the normal course of business
               and (2) payments for purchase card transactions were properly supported as a
               valid use of Agency funds.

               We found that FHFA has adequate written policies and procedures for the
               purchase card program. However, those policies and procedures were not
               always followed. One purchase card transaction, for $5,000 of leased seasonal
               decorations for the Agency’s headquarters space lacked prior approval, was
               not posted timely to the cardholder’s purchase card log, and did not result in
               the vendor receiving payment on time in compliance with Prompt Payment
               Act regulations. The continual use of the same vendor for leased seasonal
               decorations year-after-year is contrary to micro-purchase requirements that
               call for such purchases to be equitably distributed among qualified vendors
               (to the extent practicable), and FHFA lacked a policy governing the use of
               funds for seasonal decorations. We also found that FHFA personnel did not
               consistently document the receipt of goods and services nor obtain prior
               written approval by an approving official before making purchases.

               We make two recommendations to FHFA to address the shortcomings
               identified in this audit. In a written management response, FHFA disagreed
               with our recommendation to pay a vendor interest penalties owed under the
               Prompt Payment Act regulations for the late payment of the leased seasonal
               decorations. FHFA agreed with our other recommendation to reinforce,
               through periodic reminders and staff training, various policies and procedures
               for the purchase card program. FHFA’s management comments and our
               response are provided in the body of this report.

               This report was prepared by Heath Wolfe, Director of Audit Operations, with
AUD-2018-011   the assistance of: Bob Taylor, Assistant Inspector General for Audits; April
               Ellison, Auditor; and Marco Uribe, Auditor. We appreciate the cooperation
September 6,   of FHFA staff, as well as the assistance of all those who contributed to the
    2018       preparation of this report.

               This report has been distributed to Congress, OMB, and others, and will be
               posted on our website, www.fhfaoig.gov.



               Marla A. Freedman, Deputy Inspector General for Audits /s/
TABLE OF CONTENTS ................................................................
EXECUTIVE SUMMARY .............................................................................................................2

ABBREVIATIONS .........................................................................................................................6

BACKGROUND .............................................................................................................................7
      OMB Requirements ..................................................................................................................7
      FHFA Maintains that it Follows the Federal Acquisition Regulation with Some
      Exceptions.................................................................................................................................9
      OIG’s Prior Purchase Card Audit and Risk Assessment ........................................................10
      Prompt Payment Act ...............................................................................................................11

FACTS AND ANALYSIS.............................................................................................................11
      FHFA Has Adequate Written Policies and Procedures for the Purchase Card
      Program; However, They Were Not Always Followed During Fiscal Year 2017 .................11
             Lease of Seasonal Decorations for FHFA’s Headquarters Space Lacked Prior
             Approval and Was Not Timely Logged, and the Vendor Was Paid Late Without
             Receiving Interest for the Late Payment; FHFA’s Continual Use of the Same
             Vendor for Seasonal Decorations Is Contrary to the FAR, and FHFA Lacked a
             Policy for Seasonal Decorations .....................................................................................13
             FHFA Did Not Consistently Document the Receipt of Goods and Services
             Purchased (Six Transactions)..........................................................................................16
             FHFA’s Cardholders Made Purchases Without Prior Written Approval by an
             Approving Official (Nine Transactions) .........................................................................17
             Other Deficiencies (Two Transactions) ..........................................................................17

FINDINGS .....................................................................................................................................18

CONCLUSIONS............................................................................................................................18

RECOMMENDATIONS ...............................................................................................................19

FHFA COMMENTS AND OIG RESPONSE ...............................................................................19
             FHFA Comments to Recommendation 1........................................................................19
             FHFA Comments to Recommendation 2........................................................................20

OBJECTIVES, SCOPE, AND METHODOLOGY .......................................................................20


                                         OIG • AUD-2018-011 • September 6, 2018                                                                4
APPENDIX: FHFA MANAGEMENT RESPONSE ....................................................................23

ADDITIONAL INFORMATION AND COPIES .........................................................................25




                               OIG • AUD-2018-011 • September 6, 2018                                      5
ABBREVIATIONS .......................................................................

APM                   Acquisition Procedures Manual

A/OPC                 Agency/Organization Program Coordinator

ARC                   Department of the Treasury, Bureau of the Fiscal Service’s
                      Administrative Resource Center

Charge Card Act       Government Charge Card Abuse Prevention Act of 2012

Charge Card Plan      Charge Card Management Plan

Circular A-123,       OMB Circular No. A-123, Appendix B (Revised January 15, 2009),
Appendix B            Improving the Management of Government Charge Card Programs

FAR                   Federal Acquisition Regulation

FHFA or Agency        Federal Housing Finance Agency

GAO                   Government Accountability Office

MCC                   Merchant Category Code

OIG                   Federal Housing Finance Agency Office of Inspector General

OMB                   Office of Management and Budget

OMB M-13-21           Office of Management and Budget Memorandum M-13-21,
                      Implementation of the Government Charge Card Abuse Prevention Act
                      of 2012




                        OIG • AUD-2018-011 • September 6, 2018                         6
BACKGROUND ..........................................................................

Within FHFA, the Office of Budget and Financial Management manages the Agency’s
government purchase card program. This office is also responsible for ensuring that FHFA’s
purchase card program complies with the Charge Card Act 1 and applicable OMB requirements.
Those requirements include OMB Circular No. A-123, Appendix B (Revised January 15, 2009),
Improving the Management of Government Charge Card Programs (Circular A-123,
Appendix B); and OMB M-13-21, Implementation of the Government Charge Card Abuse
Prevention Act of 2012.

In July 2009, FHFA entered into an interagency agreement with the Department of the Treasury,
Bureau of the Fiscal Service’s Administrative Resource Center (ARC) for services related to the
Agency’s government purchase card program. ARC uses the CitiDirect® Card Management
System to manage FHFA’s purchase card program.

OMB Requirements

FHFA, as required by Circular A-123, Appendix B, is to maintain and annually submit to
OMB a Charge Card Management Plan (Charge Card Plan) no later than January 31. The
Charge Card Plan is to include the following elements:

      •   Identification of key management officials and their responsibilities for the
          purchase card program. These officials will include, but are not limited to, the
          agency/organization program coordinator (A/OPC), 2 approving officials or other
          equivalent officials, and other accountable/billing officials;

      •   Establishment of a process for formal appointment of cardholders and approving
          officials, where applicable;

      •   Description of agency training requirements;

      •   Management controls, policies, and practices for ensuring appropriate purchase card
          and convenience check usage and oversight of payment delinquencies, fraud, misuse,
          or abuse;

      •   Establishment of appropriate authorization controls;



1
    See Public Law No. 112-194.
2
    FHFA’s Financial Management Operations and Systems Manager serves as A/OPC for the Agency.



                                  OIG • AUD-2018-011 • September 6, 2018                         7
   •   Implementation of policies and practices to ensure strategic sourcing;

   •   Explanation of how available reports and data are used for monitoring delinquency,
       misuse, performance metrics, spend analysis, and other relevant transactions and
       program management issues;

   •   Documentation and record retention requirements;

   •   Recovery of purchase cards and other documentation when employees terminate
       employment and, if applicable, when an employee moves to a different organization;
       and

   •   Description of how the agency will ensure the ongoing effectiveness of the actions
       taken pursuant to this guidance, including, but not limited to, evaluating the
       effectiveness of training, risk management controls, refund management controls,
       strategic sourcing policies, and tax recovery efforts.

Circular A-123, Appendix B also prescribes policies and procedures to agencies regarding
how to maintain internal controls that reduce the risk of fraud, waste, and error in government
charge card programs.

FHFA, as required by OMB M-13-21, is to review and update its Charge Card Plan, as
necessary, to reflect the following internal control activities:

   •   To deter employee misuse of government cards, FHFA must implement penalties for
       card violations that are jointly developed by Agency card management and human
       resources components. These penalties must include salary offset, for instances of
       personal liability, and disciplinary actions for a cardholder or approving official’s
       illegal, improper, or erroneous purchases made with a purchase card, convenience
       check, integrated card, or travel card. Disciplinary actions should include dismissal, as
       appropriate. FHFA’s Charge Card Plan must define and apply appropriate and
       consistent employee disciplinary procedures, and comply with joint external reporting
       required of the FHFA Office of Inspector General (OIG) and Agency management;
       and

   •   To provide a summary of FHFA’s efforts to assess its internal controls, FHFA must
       summarize its overall results in completed compliance summaries and internal control
       assurance assessments in its annual Charge Card Plan.




                            OIG • AUD-2018-011 • September 6, 2018                                 8
FHFA Maintains that it Follows the Federal Acquisition Regulation with Some
Exceptions

As an independent federal agency, FHFA is not subject to the Federal Acquisition Regulation
(FAR). However, FHFA states, in its written policy, that it follows the FAR on a voluntary
basis, except for flexibilities set forth in its Acquisition Procedures Manual (APM). 3 For
example, FHFA maintains that it follows the FAR’s requirements for micro-purchases made
by government purchase cards, but enlarges the micro-purchase threshold from $3,500 to
$5,000. 4

Among other things, the FAR requires:

      •   To the extent practicable, micro-purchases shall be distributed equitably among
          qualified suppliers; and

      •   Micro-purchases may be awarded without soliciting competitive quotations if the
          contracting officer or individual appointed (e.g., an individual who will be using the
          supplies and services being purchased) considers the price to be reasonable. 5

FHFA has supplemented these requirements with additional procedures, which are codified in
FHFA Micro-purchase Procedures and Supplemental Purchase Cardholder Guidance.
Among other things, these procedures require cardholders to:

      •   Obtain prior, written approval from their approving official before making purchases;

      •   Document proof of product delivery or completion of service performance;

      •   Ensure that merchants do not charge sales taxes for any purchases; and

      •   Immediately record transactions to their purchase card log upon making a purchase.

Another control over FHFA’s purchase card program is ARC’s monitoring of the use of those
cards. For example, ARC random sampling procedures for the purchase card program state
that it will conduct annual compliance reviews of FHFA’s purchase cardholders and the
related transactions using a statistical sampling plan with a 90 percent confidence level and a
precision error rate of 15 to 25 percent. For the two most recent compliance reviews, ARC

3
    FHFA Policy No. 503, Acquisition Policy (June 27, 2011).
4
 FAR 2.101, “Definitions,” a micro-purchase is an acquisition of supplies or services using simplified
acquisition procedures, the aggregate amount of which does not exceed the micro-purchase threshold of $3,500
(with certain exceptions that are not applicable for the purposes of this report).
5
    FAR, 13.203, “Purchase Guidelines,” and 1.603-3, “Appointment.”



                                  OIG • AUD-2018-011 • September 6, 2018                                       9
reviewed 150 of the 1,377 purchase card transactions made by FHFA cardholders between
April 1, 2016, and March 31, 2017, and 138 of the 1,316 transactions made between April 1,
2017, and March 31, 2018. Neither review by ARC noted any issues of noncompliance.

For purchases of supplies and services in excess of $5,000, FHFA’s Acquisition Policy states
that it follows the Simplified Acquisition Procedures prescribed in FAR Part 13, but FHFA
enlarges the lower end of the threshold from the $3,500 in the FAR to $5,000. The purpose of
the simplified procedures is to, among other things, reduce costs and improve opportunities
for certain businesses (e.g., small disadvantaged, women-owned, veteran-owned, etc.). For the
purposes of this report, Simplified Acquisition Procedures are for the acquisition of supplies
or services that have an anticipated dollar value exceeding $5,000, but not exceeding
$150,000.

OIG’s Prior Purchase Card Audit and Risk Assessment

In 2014, we issued an audit report on FHFA’s purchase card program. In that report, FHFA’s
Use of Government Purchase Cards (January 31, 2014) (AUD-2014-006), we reported that
overall FHFA had sound internal control to ensure compliance with purchase card laws and
regulations, but that certain controls could be strengthened to further enhance FHFA’s
purchase card management. FHFA management took corrective actions to address the prior
audit recommendations.

In 2017, pursuant to the Charge Card Act, 6 we issued a risk assessment. In that assessment,
Risk Assessment of FHFA’s Fiscal Years 2016 and 2015 Government Purchase Card and
Travel Card Programs (March 27, 2017) (OIG-RA-2017-001), we determined that the risk of
illegal, improper, or erroneous activity in either program was low and that an audit of one or
both programs could potentially identify improper activity or failure of an internal control.
We cautioned that our risk assessment should not be interpreted to mean that the risk level
would remain low for the indefinite future because of the possibility that existing internal
controls could become inadequate due to change in conditions and/or degree of compliance
with the policies or procedures.




6
  The Charge Card Act, as implemented by OMB M-13-21, requires among other things, that the Inspector
General of each executive agency conduct periodic risk assessments of agency purchase card (including
convenience checks) and travel card programs to identify and analyze the risks of illegal, improper, or
erroneous purchases and payments to guide analyses or audits of these programs as necessary.



                                OIG • AUD-2018-011 • September 6, 2018                                    10
Prompt Payment Act

FHFA is subject to the Prompt Payment Act. 7 Among other things, under the Prompt Payment
Act and the implementing regulations at 5 CFR Part 1315, agencies are to pay vendors within
30 days after receipt of proper invoice for the amount of the payment due, 8 if a specific date
on which payment is due is not established by contract.

The Act imposes an interest penalty (to be paid to the vendor) against agencies that fail to
make a timely invoice payment.

                                                    *****

Because four years had passed since we last audited FHFA’s purchase card program, we
determined that an audit of the program during fiscal year 2018, to include testing of purchase
card transactions, was warranted. Our audit objectives were to determine whether (1) FHFA’s
existing controls over the purchase card program provide reasonable assurance that improper
payments will not occur or will be detected in the normal course of business and (2) payments
for purchase card transactions are properly supported as a valid use of Agency funds.


FACTS AND ANALYSIS ...............................................................

FHFA Has Adequate Written Policies and Procedures for the Purchase Card Program;
However, They Were Not Always Followed During Fiscal Year 2017

We found that FHFA’s Acquisition Policy and FHFA Micro-purchase Procedures and
Supplemental Purchase Cardholder Guidance, if fully implemented as described, prescribe a
control regime that provides reasonable assurance that improper payments would not occur or
would be detected in the normal course of business. However, our tests found shortcomings in
implementation that require heightened management attention.

For fiscal year 2017, we determined that FHFA had a universe of 1,194 purchase card
transactions, totaling $1,144,313. We selected and reviewed three samples from this universe:



7
  In 1982, Congress enacted the Prompt Payment Act (Pub. L. 97–177) to require Federal agencies to pay their
bills on a timely basis, to pay interest penalties when payments are made late, and to take discounts only when
payments are made by the discount date. The Act, as amended, is found at 31 U.S.C. Chapter 39.
8
  If an agency fails to annotate the invoice with the actual date of receipt at the time of receipt, the invoice
payment due date is the 30th day after the date of the vendor’s invoice, provided the agency receives a proper
invoice and there is no disagreement over the goods and services received.



                                  OIG • AUD-2018-011 • September 6, 2018                                           11
     •   All 27 purchase card transactions exceeding $4,500, which included 4 purchase card
         transactions that exceeded the micro-purchase threshold of $5,000. The total of the 27
         purchase card transactions was $147,348. The total of the 4 purchase card transactions
         that exceeded the micro-purchase threshold of $5,000 was $35,041.

     •   5 purchase card transactions that we considered unusual based on the transactions’
         associated Merchant Category Code (MCC). 9 The total of these purchase card
         transactions was $9,657.

     •   64 purchase card transactions statistically selected from the universe of purchase
         card transactions that were less than or equal to $4,500. This universe consisted of
         1,167 purchase card transactions totaling $996,965. The 64 selected purchase card
         transactions totaled $112,014. The statistical sample size was the minimum required
         for a 10 percent margin of error and a 90 percent confidence level.

In all, we tested 96 purchase card transactions, totaling $269,019 (23.5% of the total amount
of fiscal year 2017 card purchases), for compliance with provisions of FHFA’s purchase
card policies and procedures to include, but not limited to, requirements for: (1) proper
authorization of purchases; (2) allowability of purchases made; and (3) review, posting,
and approval of the transactions.

For 81 of the 96 purchase card transactions tested totaling $233,487, we found that the
transactions complied with the applicable FHFA purchase card policies and procedures and
were properly supported as a valid use of Agency funds. The shortcomings we identified with
the other 15 purchase card transactions totaling $35,531 are discussed below. 10




9
  An MCC is a four-digit code used to identify the type of business a merchant conducts (e.g., gas stations,
restaurants, airlines).
10
  Two tested purchase card transactions had more than one deficiency. We provided the details of the
deficiencies found with the 15 transactions separately to FHFA’s A/OPC during our audit fieldwork.



                                  OIG • AUD-2018-011 • September 6, 2018                                       12
     Lease of Seasonal Decorations for FHFA’s Headquarters Space Lacked Prior Approval
     and Was Not Timely Logged, and the Vendor Was Paid Late Without Receiving
     Interest for the Late Payment; FHFA’s Continual Use of the Same Vendor for Seasonal
     Decorations Is Contrary to the FAR, and FHFA Lacked a Policy for Seasonal
     Decorations

One fiscal year 2017 purchase card transaction we tested, for $5,000 charged in April 2017,
was for seasonal decorations provided by the vendor in November 2016 for FHFA’s space in
Constitution Center. 11 We found several shortcomings with this transaction:

     •   FHFA’s cardholder did not obtain the approving official’s approval until after the
         cardholder had signed the vendor’s proposal for the seasonal decorations. Specifically,
         the cardholder signed the vendor’s proposal on October 12, 2016, before the
         approving official approved the purchase on November 3, 2016.

     •   The cardholder did not record the order in her purchase card log as required when the
         seasonal decorations were ordered on October 12, 2016. Instead, the entry for this
         purchase was not recorded until April 17, 2017, six months later, and well after the
         goods and services were received.

     •   The documents provided by FHFA for this lease show that the Agency did not comply
         with the Prompt Payment Act regulations (5 CFR Part 1315). Those regulations
         require that for this purchase, payment was to be made by December 30, 2016, unless
         the failure of the payment to occur earlier was the fault of the vendor; if the vendor
         was not at fault for the delay and the vendor was paid after that date, FHFA would
         be required to pay the vendor an interest penalty (without regard to whether the
         vendor requested such payment). In this instance, the vendor’s invoice was dated
         November 30, 2016, but the documentation provided by FHFA showed that the
         vendor was only paid the invoice amount, $5,000, on April 14, 2017. The vendor,




11
  According to the vendor’s invoice, dated November 30, 2016, the seasonal decorations included, among
other things, one “9.5’ Artificial Holiday Tree, Golden Bliss” priced at $1,165; seven “Custom Glitter Sticks
and Garland Display” priced at a total of $1,750; seven “Stockton Planter: Black Executive Director’s Office”
priced at a total of $1,225; “Holiday Install.Labor.Delivery” priced at $1,400; and removal of leased materials
after January 1, 2017. The total of the individual items and services listed on the invoice was $7,500 but a
“Holiday Material Discount” of $2,500 reduced the invoice cost to $5,000.



                                 OIG • AUD-2018-011 • September 6, 2018                                           13
         therefore, is entitled to an interest penalty for the period of December 31, 2016, to
         April 14, 2017. 12

         When we discussed this matter with FHFA during our audit, FHFA asserted that an
         interest penalty did not apply in this instance because “[the] vendor did not charge
         a cardholder until three months after the cardholder provided the vendor with the
         [government purchase card] GPC number and made the purchase.” This argument,
         however, is not supported by the documentation FHFA provided, consisting of the
         cardholder’s purchase card log that showed the order was recorded on April 17, 2017
         (the sequential log did not show any prior recordings for the order), the charge card
         monthly statement that showed the charge was made April 14, 2017, and the invoice
         that was marked paid on April 14, 2017. The cardholder responsible for this
         transaction no longer worked for FHFA at the time of our audit. We interviewed a
         representative of the vendor in May 2018 who confirmed payment was recorded in
         the vendor’s accounting records on April 14, 2017.

         During the interview, the vendor-representative also said that the vendor did not
         receive payment for seasonal decorations ordered by FHFA for the 2017 holiday
         season (in the amount of $5,000) and which were invoiced on December 6, 2017,
         until May 17, 2018. As a result of our inquiries with FHFA and the vendor, we found
         a similar instance occurred with seasonal decorations ordered from the same vendor
         for the 2015 holiday season. The seasonal decorations were invoiced (in the amount of
         $5,000) on November 30, 2015, and paid on April 13, 2016. 13 The same cardholder
         who handled the seasonal decorations for the 2016 and 2017 holiday seasons also
         handled the seasonal decorations for 2015. According to FHFA and vendor records,
         the payments for prior years (by a different cardholder) were made on or close to the
         invoice date (at the time the seasonal decorations were received).

         In its technical comments to a draft of the report, FHFA continued to maintain that the
         Prompt Payment Act did not apply to purchase cards as Citibank pays the vendors and
         FHFA pays Citibank. In this regard, the Prompt Payment Act applies when ARC
         receives the credit card statement from Citibank, and those statements are paid.

12
   Under the Prompt Payment Act regulations, as they apply to this purchase, we determined the payment was
due 30 days after the invoice date (the payment period). There are several factors that affect the start of the
payment period, such as the date the goods and services were received, the date the Agency received a
“proper” invoice, and others. For this purchase, the cardholder documented on the invoice that the seasonal
decorations were received on November 30, 2016, the same date as the invoice. FHFA did not record on the
invoice the date the invoice was received by FHFA; accordingly, under the regulations, the vendor’s invoice
date became the 30-day payment period start date. FHFA has not provided any affirmative, contemporaneous
documentation showing that the Agency provided purchase card information to the vendor on a timely basis.
13
  The order date recorded in the cardholder’s purchase card log for the 2015 seasonal decorations was
April 14, 2016.



                                 OIG • AUD-2018-011 • September 6, 2018                                           14
          According to FHFA, it confirmed with ARC that the Prompt Pay Act does not apply
          to the cardholder making the purchase with the merchant. Furthermore, FHFA’s legal
          counsel issued a legal opinion (provided to OIG’s Office of Counsel during the audit)
          that “In accordance with applicable guidance, the Prompt Payment Act applies to the
          consolidated invoice, or billing statement, received at the end of each billing cycle.”

          The technical comments did not raise any new points that we had not considered
          previously in our audit fieldwork. We acknowledge the FHFA legal counsel’s legal
          opinion. That legal opinion, however, was premised on a situation where the vendor
          was provided the purchase card information, but did not “run” the purchase card
          until months later. As discussed above, this argument is not supported by the
          contemporaneous documentation FHFA provided, consisting of the cardholder’s
          purchase card log that showed the order was recorded on April 17, 2017, the charge
          card monthly statement that showed the charge was made April 14, 2017, and the
          invoice that was marked paid on April 14, 2017. 14

      •   As indicated above, FHFA used the same vendor for seasonal decorations from 2015
          to 2017. Upon further inquiry, we learned that the same vendor had been used to
          provide seasonal decorations since FHFA was created in 2008. FHFA provided us
          documentation for its payments to this vendor only for the last four years, beginning
          with December 2013. FHFA’s documentation for this four-year period shows that
          FHFA paid this vendor between $4,975 to $5,000, for each of the four years, for a
          total of $19,968. 15 This strikes us as a questionable practice because according to the
          FAR, micro-purchases are to be distributed equitably among qualified suppliers “to
          the extent practicable.” 16 We recognize that FHFA has agreed to follow the FAR on
          a voluntary basis, save for the identified flexibilities in FHFA’s APM and its Micro-
          purchase Procedures and Supplemental Purchase Cardholder Guidance. However,
          neither authorize the repetitive use of the same vendor as a “flexibility.”




14
  The legal opinion states that the question put forward was “At what point in the Government Purchase Card
(GPC) process of a centrally-billed account does the Prompt Payment Act apply?” In its analysis to answer this
question, FHFA’s legal counsel states:
          It is the Office of General Counsel’s understanding that the question related to the Prompt
          Payment Act application to the GPC program arose because a Federal Housing Finance Agency
          (FHFA) vendor did not charge a cardholder until three months after the cardholder provided the
          GPC number and made the purchase.
15
   According to the A/OPC, FHFA’s accounting system could not produce the amounts paid prior to 2013 for
seasonal decorations. Based on documentation provided by the vendor, for the period December 2008 to May
2018, FHFA paid the same vendor a total of $40,919 for seasonal decorations.
16
     FAR 13.203(a)(1).



                                  OIG • AUD-2018-011 • September 6, 2018                                         15
In addition to these contracting considerations, we recognize that the Government
Accountability Office (GAO), in a November 1987 decision, determined that an agency’s
expenditure for seasonal decorations as necessary expenses may be properly payable
where the purchase is consistent with work-related objectives, agency or other applicable
regulations, and the agency mission, and is not primarily for the personal convenience or
satisfaction of a government employee. 17 GAO cautioned in that decision that the agency
must also determine that seasonal decorations are appropriate in light of constitutional
considerations (with regard to the display of certain seasonal decorations that are primarily
religious in character). GAO urged federal agencies to establish administrative guidelines to
prevent abuse of their discretion to purchase seasonal decorations. Such guidelines, according
to GAO, should address issues such as: (1) the purchase of seasonal decorations for private
office areas, (2) the purchase of religiously significant seasonal decorations, and (3) any other
purchase that is inconsistent with the agency’s primary authority to enhance the work
environment. Upon inquiry, FHFA’s A/OPC told us that FHFA had no policy for the purchase
of seasonal decorations. The A/OPC noted that such policy is not mandatory, only “urged” by
GAO. In light of the money spent by FHFA over the years to lease seasonal decorations and
the constitutional and other considerations cited by GAO, it would be prudent for FHFA to
consider establishing a policy on seasonal decorations.

     FHFA Did Not Consistently Document the Receipt of Goods and Services Purchased (Six
     Transactions)

From our test samples, FHFA could not provide documentation to support whether the
goods or services were received for six purchase card transactions totaling $16,438. The six
transactions included training, training material and books, a user license, and accounting
research services. For example, FHFA paid $4,862 for CCH’s accounting research services on
October 12, 2016. The period of the research services was October 12, 2016, to October 11,
2017. FHFA staff were not requested to confirm whether the research services were received
until December 28, 2017 (78 days after the services expired) and only after we requested the
documentation.

As previously mentioned, we statistically sampled and reviewed 64 purchase card transactions
from the universe of 1,167 transactions, of which each transaction was for less than or equal
to $4,500. The 64 selected transactions totaled $112,014. Of the six purchase card transactions
where FHFA did not document the receipt of goods and services, four were in our statistical
sample. Based on our statistical sample, we project that 6.2% ($62,310) of all purchase card
transactions for fiscal year 2017 purchase card transactions with a value less than or equal to


17
  See GAO, [Decision Concerning State and GSA Payment for Seasonal Decorations] 67 Comp. Gen. 87
(1987); B-226011, B-226900; Nov 17, 1987 (online at www.gao.gov/products/134450).



                              OIG • AUD-2018-011 • September 6, 2018                                16
$4,500 lacked documentation to support the receipt of the goods and services. At the 90
percent confidence level, this projection has a margin of error of +/-4.88% (+/-$48,625).

There were an additional eight transactions where FHFA provided documentation to OIG
dated after OIG’s initial testing results. While late, we did not include these eight transactions
in our projection.

     FHFA’s Cardholders Made Purchases Without Prior Written Approval by an Approving
     Official (Nine Transactions)

From our test samples, we found that FHFA cardholders made nine purchase card transactions
totaling $19,093 prior to receipt of written approval from an authorized approving official.
The nine purchase card transactions primarily included training services and included the
purchase card transaction for seasonal decorations discussed above. 18

Of the nine purchase card transactions where FHFA cardholders made purchases before they
received written approval from the approving officials, seven were in our statistical sample.
Based on our statistical sample, we project that 10.9% ($109,043) of all fiscal year 2017
purchase card transactions less than or equal to $4,500 lacked written approval from an
approving official when the purchases were made. At the 90 percent confidence level, this
projection has a margin of error of +/-6.29% (+/-$62,696).

     Other Deficiencies (Two Transactions)

Our tests revealed deficiencies with two tested purchase card transactions that were single
instances of non-compliance. FHFA corrected both deficiencies during our fieldwork.

     •   FHFA improperly paid sales tax for one tested purchase card transaction. The
         purchase totaled $698 and included $40 in sales tax for training material. After we
         informed FHFA’s A/OPC of this issue, FHFA sought and received a refund of the
         sales tax on March 26, 2018.

     •   FHFA’s Training Policy requires that an employee sign a continued service
         agreement, before training begins, when the training involves 80 or more duty hours.
         FHFA did not execute a continued service agreement for one tested training purchase
         that totaled $3,199 and involved 88 duty hours of training for the employee. After we
         informed FHFA’s A/OPC of this matter, FHFA executed an agreement with the
         employee in March 2018.

18
   For six of these nine purchases, the cardholder sought and obtained prior approval from an FHFA official,
but that official was not an authorized approving official. Accordingly, we considered these six purchases to
lack prior approval.



                                 OIG • AUD-2018-011 • September 6, 2018                                         17
FINDINGS .................................................................................

As part of our audit, we reviewed FHFA’s Charge Card Plan that the Agency submitted
to OMB on January 24, 2017, and found that it included the elements required by Circular
A-123, Appendix B and OMB M-13-21. FHFA also has adequate written policies and
procedures for the purchase card program, but they were not always followed. Specifically,
we found the following for the tested fiscal year 2017 purchase card transactions:

   •   For the leased seasonal decorations transaction in the amount of $5,000, among other
       things, the cardholder making the purchase did not timely record the transaction in her
       purchase card log; FHFA did not comply with Prompt Payment Act regulations to pay
       the vendor timely and failed to pay an interest penalty for the late payment; FHFA
       used the same vendor for seasonal decorations multiple years which runs afoul of the
       FAR instruction to equitably distribute micro-purchases among qualified suppliers (to
       the extent practicable); and FHFA lacked a policy guiding the purchase of seasonal
       decorations despite the urging by GAO that agencies have such a policy.

   •   FHFA’s cardholders did not consistently document the receipt of goods and services.

   •   FHFA’s cardholders did not always obtain prior written approval by an approving
       official, including the $5,000 purchase card transaction for seasonal decorations.


CONCLUSIONS ..........................................................................

We found that during fiscal year 2017, FHFA policies and procedures for the use of purchase
cards, if fully implemented as described, prescribe a control regime that provides reasonable
assurance that improper payments would not occur or would be detected in the normal course
of business. This is consistent with our prior risk assessment of FHFA’s government purchase
card program. However, our tests found shortcomings with FHFA’s acquisition of seasonal
decorations, and other shortcomings (failures to document the receipt of goods and services
and to obtain prior written approval by approving officials) that occurred with a frequency
that warrants heightened management attention to these program requirements. For the most
part, we believe that the shortcomings can be addressed through reinforcement of the policies
and procedures by the A/OPC and supervisors, as well as through training provided to
FHFA’s cardholders and approving officials. In light of the money spent by FHFA over the
years to lease seasonal decorations and the constitutional and other considerations with such
acquisitions, we believe this is an area that warrants FHFA consideration of establishing a
policy on seasonal decorations.



                           OIG • AUD-2018-011 • September 6, 2018                                18
RECOMMENDATIONS ...............................................................

We recommend that FHFA:

   1. Determine and pay the vendor the interest penalties owed under the Prompt Payment
      Act regulations for the late payments of the leased seasonal decorations received by
      FHFA for the 2015, 2016, and 2017 holiday seasons.

   2. Reinforce FHFA’s government purchase card policies and procedures through
      periodic reminders to, and training of, FHFA cardholders and approving officials,
      including requirements to:

           •   Distribute micro-purchases equitably among qualified suppliers (to the extent
               practicable),

           •   Document receipt of goods and services, and

           •   Obtain prior written approval from an approving official before purchases are
               made.


FHFA COMMENTS AND OIG RESPONSE .....................................

OIG provided FHFA an opportunity to respond to a draft report of this audit. In its
management response, which is provided as an Appendix to this report, FHFA disagreed with
recommendation 1 and agreed with recommendation 2. FHFA’s comments and our responses
are below.

   FHFA Comments to Recommendation 1

FHFA maintains that the consolidated invoices from the centrally billed account were paid
within 30 days of receipt of those invoices. FHFA’s Office of General Counsel provided a
legal opinion that the Department of the Treasury confirmed that initiation of prompt payment
begins once the consolidated statement is received from the credit card company. Per the legal
opinion, the cardholder cannot process a payment based on a charge that has not yet posted to
the account.

Going forward, FHFA will procure seasonal decorations through contract rather than purchase
card, following applicable acquisition procedures. The Statement of Work in the contract will
delineate the requirements for the purchase of seasonal decorations. Additionally, FHFA will
consider whether a policy on seasonal decorations is needed.


                           OIG • AUD-2018-011 • September 6, 2018                                19
OIG Response. As discussed in this report, the legal opinion referenced in the management
response was premised on a situation where the vendor was provided the purchase card
information, but did not “run” the purchase card until months later. This argument is not
supported by the contemporaneous documentation provided to us by FHFA; which consisted
of the cardholder’s purchase card log that showed the order recorded on April 17, 2017, the
charge card monthly statement that showed the charge made on April 14, 2017, and the
invoice that was marked paid on April 14, 2017.

We consider this recommendation to be closed, rejected. We encourage FHFA to reconsider
its position on this recommendation and pay the vendor the appropriate interest penalties
under the Prompt Payment Act regulations.

   FHFA Comments to Recommendation 2

FHFA will send out purchase card reminders to cardholders and approving officials by
September 30, 2018, on the requirements. Additionally, FHFA will conduct its annual
purchase card training by December 31, 2018, emphasizing the requirements.

We consider FHFA’s planned corrective actions responsive to the recommendation.


OBJECTIVES, SCOPE, AND METHODOLOGY ...............................

The objectives of our audit were to determine whether (1) FHFA’s existing controls over the
purchase card program provide reasonable assurance that improper payments will not occur or
will be detected in the normal course of business and (2) payments for purchase card
transactions were properly supported as a valid use of Agency funds. The scope of the audit
focused on FHFA’s policies and procedures over its purchase card program and FHFA’s
purchase card transactions between October 1, 2016, and September 30, 2017 (i.e., fiscal year
2017).

To address our objectives, we:

   •   Researched applicable laws, regulations, policies, and procedures applicable to
       FHFA’s government purchase card program;

   •   Reviewed the Charge Card Act, OMB M-13-21, the FAR, and the Prompt Payment
       Act regarding requirements that apply to FHFA;

   •   Reviewed the FHFA Director’s Federal Managers’ Financial Integrity Act of 1982
       Statement of Assurance for fiscal year 2017 for any mention of internal control
       matters related to FHFA’s purchase card program;


                           OIG • AUD-2018-011 • September 6, 2018                               20
•   Determined whether FHFA maintained and annually submitted its Charge Card Plan
    no later than January 31 for the audit period;

•   Determined whether FHFA summarized its overall results in completed compliance
    summaries and internal assurance assessments in its annual Charge Card Plan;

•   Determined the dollar amounts and other relevant statistical information for FHFA’s
    purchase card program for fiscal year 2017;

•   Interviewed FHFA’s Deputy Chief Financial Officer and other appropriate officials
    responsible for FHFA’s purchase card program about (a) whether they had knowledge
    of any fraud or suspected fraud affecting the program, (b) whether they were aware of
    any allegations of fraud or suspected fraud affecting the program, (c) the nature and
    extent of monitoring they performed over the program, and (d) whether and how
    management communicated to cardholders and approving officials its views on the
    proper use of purchase cards;

•   Determined whether FHFA and/or ARC conducted any compliance testing of
    FHFA’s purchase card program. This included obtaining (a) an understanding of the
    compliance testing program in place during the audit period and (b) the results of the
    compliance testing performed, including any findings and recommendations;

•   Reviewed FHFA’s purchase card training material provided to cardholders and
    approving officials during fiscal year 2017;

•   Reviewed the GAO’s report on its audit of FHFA’s financial statements for fiscal year
    2017 to determine whether any deficiencies were reported related to FHFA’s purchase
    card program. We also inquired of GAO’s staff about the scope and results of any
    testing of the program done for the review period of FHFA’s financial statements;

•   Selected a statistical sample of 64 purchase transactions totaling $112,014 from the
    universe of 1,167 transactions totaling $996,965, each of which were less than or
    equal in value to $4,500 and were performed by FHFA during fiscal year 2017. The
    statistical sample size was the minimum required for a 10 percent margin of error for
    a 90 percent confidence level. We projected the results derived from the statistical
    sample to the total population of transactions valued at less than or equal to $4,500
    for fiscal year 2017. Additionally, we selected all 27 purchase transactions totaling
    $147,348, each of which were greater in value than $4,500, and 5 transactions totaling
    $9,657 where the MCC description appeared to be unrelated to the Agency’s mission.
    For the 96 purchase card transactions, we tested for compliance with provisions of the
    FAR and FHFA’s policies and procedures to include requirements for the proper



                        OIG • AUD-2018-011 • September 6, 2018                               21
       authorization of purchases, allowability of purchases made, and the review, posting,
       and approval of purchase card transactions;

   •   Assessed the reliability of data received for this audit as determined necessary by
       corroborating the information with other source data; and

   •   Assessed the Agency’s internal controls related to the purchase card program.
       Specifically, we evaluated the program’s control standards, including control activities
       and monitoring.

We conducted this performance audit between December 2017 and September 2018 in
accordance with generally accepted government auditing standards. Those standards require
that audits be planned and performed to obtain sufficient, appropriate evidence to provide a
reasonable basis for our findings and conclusions based on our audit objectives. We believe
that the evidence obtained provides a reasonable basis for our findings and conclusions, based
on our audit objectives.




                            OIG • AUD-2018-011 • September 6, 2018                                22
APPENDIX: FHFA MANAGEMENT RESPONSE .............................




                  OIG • AUD-2018-011 • September 6, 2018      23
OIG • AUD-2018-011 • September 6, 2018   24
ADDITIONAL INFORMATION AND COPIES .................................


For additional copies of this report:

   •   Call: 202-730-0880

   •   Fax: 202-318-0239

   •   Visit: www.fhfaoig.gov



To report potential fraud, waste, abuse, mismanagement, or any other kind of criminal or
noncriminal misconduct relative to FHFA’s programs or operations:

   •   Call: 1-800-793-7724

   •   Fax: 202-318-0358

   •   Visit: www.fhfaoig.gov/ReportFraud

   •   Write:

                FHFA Office of Inspector General
                Attn: Office of Investigations – Hotline
                400 Seventh Street SW
                Washington, DC 20219




                             OIG • AUD-2018-011 • September 6, 2018                        25