oversight

Risk Assessment of FHFA's Fiscal Years 2016 and 2015 Government Purchase Card and Travel Card Programs

Published by the Federal Housing Finance Agency, Office of Inspector General on 2017-03-27.

Below is a raw (and likely hideous) rendition of the original report. (PDF)

              Federal Housing Finance Agency
                  Office of Inspector General




        Risk Assessment of
  FHFA’s Fiscal Years 2016 and 2015
   Government Purchase Card and
       Travel Card Programs




OIG Risk Assessment • OIG-RA-2017-001 • March 27, 2017
                Executive Summary
                The Government Charge Card Abuse Prevention Act of 2012 (Charge
                Card Act), as implemented by Office of Management and Budget (OMB)
                Memorandum M-13-21 (OMB M-13-21), Implementation of the Government
                Charge Card Abuse Prevention Act of 2012, requires among other things,
                that the Inspector General of each executive agency conduct periodic risk
OIG-RA-2017-    assessments of agency purchase card (including convenience checks) and
    0XX         travel card programs to identify and analyze the risks of illegal, improper,
                or erroneous purchases and payments to guide analyses or audits of these
Date XX, 2017   programs as necessary. Where annual travel card spending for an agency
                exceeds $10 million, the Charge Card Act and OMB M-13-21 require periodic
                audits or reviews of the agency’s travel card program.

                For fiscal years 2016 and 2015, the Federal Housing Finance Agency (FHFA
                or Agency) reported to OMB that its purchase card expenditures were
                $1,129,161 and $970,916, respectively, and travel card expenditures were
                $1,938,859 and $1,824,252, respectively. Because travel card expenditures in
                each of those two fiscal years were significantly less than $10 million, no audit
                of FHFA’s travel card program is required.

                We conducted a risk assessment of FHFA’s purchase and travel card programs
                for fiscal years 2016 and 2015 to assess the risks of illegal, improper, or
                erroneous purchases and payments to determine whether an audit of either
                program would be prudent. We looked at the annual amount of purchase
                and travel card spending during those two fiscal years, the number of FHFA
                cardholders, FHFA’s internal control over its purchase and travel card
                programs, the results of internal and external purchase and travel card-related
                activities and reviews, and the results of prior financial audits of FHFA
                performed by the Government Accountability Office (GAO). Based on our
                risk assessment, we concluded that the risk of illegal, improper, or erroneous
                purchases and payments through FHFA’s purchase and travel card programs
                during the prior two fiscal years was low and, accordingly, an audit of these
                programs would not be warranted during fiscal year 2017.

                While our risk assessment for FHFA’s purchase and travel card programs
                determined that the risk of illegal, improper, or erroneous activity in either
                program was low, we recognize that an audit of one or both programs could
                potentially identify improper activity or failure of an internal control. We
                caution that our risk assessment should not be interpreted to mean that the risk
                level will remain low for the indefinite future because the possibility exists
                that existing internal controls could become inadequate due to change in
                conditions and/or degree of compliance with the policies or procedures. We
                intend to regularly conduct risk assessments of FHFA’s purchase and travel
                card programs to determine whether an audit is necessary.

                This report was prepared by Robert Taylor, Assistant Inspector General for
                Audits, and Heath Wolfe, Director of Audit Operations. We appreciate the
                cooperation of FHFA staff, as well as the assistance of all those who
                contributed to the preparation of this report.
OIG-RA-2017-
    0XX         This report has been distributed to FHFA, Congress, OMB, and others and will
                be posted on our website, www.fhfaoig.gov.
Date XX, 2017

                Marla A. Freedman /s/
                Deputy Inspector General for Audits
TABLE OF CONTENTS ................................................................
EXECUTIVE SUMMARY .............................................................................................................2

ABBREVIATIONS .........................................................................................................................5

BACKGROUND .............................................................................................................................6

FACTS AND ANALYSIS...............................................................................................................9
      FHFA’s Spending for its Purchase and Travel Card Programs, and Number of FHFA
      Cardholders, for Fiscal Years 2016 and 2015 ..........................................................................9
      FHFA’s Internal Controls over its Purchase and Travel Card Programs .................................9
      Efficacy of Existing FHFA Internal Control for Purchase and Travel Card Programs ..........10
      Results of Prior Financial Audits of FHFA by GAO .............................................................11

CONCLUSION ..............................................................................................................................11

OBJECTIVE, SCOPE, AND METHODOLOGY .........................................................................12

ADDITIONAL INFORMATION AND COPIES .........................................................................14




                                        OIG • OIG-RA-2017-001 • March 27, 2017                                                           4
ABBREVIATIONS .......................................................................

ARC                Department of the Treasury, Bureau of the Fiscal Service’s Administrative
                   Resource Center

FHFA or Agency     Federal Housing Finance Agency

Charge Card Act    Government Charge Card Abuse Prevention Act of 2012

GAO                Government Accountability Office

OIG                Federal Housing Finance Agency Office of Inspector General

OMB                Office of Management and Budget

OMB M-13-21        Office of Management and Budget Memorandum M-13-21,
                   Implementation of the Government Charge Card Abuse Prevention Act of
                   2012

Plan               Charge Card Management Plan




                        OIG • OIG-RA-2017-001 • March 27, 2017                            5
BACKGROUND ..........................................................................

Within FHFA, the Office of Budget and Financial Management manages the Agency’s
purchase and travel card programs. This office is also responsible for ensuring that FHFA’s
card programs comply with the Charge Card Act 1 and applicable OMB requirements. The
applicable OMB requirements include OMB Circular No. A-123, Appendix B (Revised
January 15, 2009), Improving the Management of Government Charge Card Programs
(OMB A-123, Appendix B); OMB Memorandum M-12-12, Promoting Efficient Spending
to Support Agency Operations; and OMB M-13-21.

FHFA uses the Department of the Treasury, Bureau of the Fiscal Service’s Administrative
Resource Center (ARC) for the following services related to the Agency’s purchase and travel
card programs:

      •   Accounting services and Oracle system;

      •   Travel services and system (travel card program); and

      •   CitiDirect (purchase and fleet card programs).

FHFA entered into an interagency agreement in July 2009 with ARC to service its purchase
and travel card programs. ARC uses CitiBank’s CitiDirect Card Management System for the
management of FHFA’s card programs.

FHFA, as required by OMB A-123, Appendix B, is to maintain and annually submit to OMB
a Charge Card Management Plan (Plan) no later than January 31. The Plan is to include the
following elements:

      •   Identification of key management officials and their responsibilities for each card
          program. These officials will include, but are not limited to, agency/organization
          program coordinator, approving officials or other equivalent officials, and other
          accountable/billing officials;

      •   Establishment of a process for formal appointment of cardholders and approving
          officials, where applicable;

      •   Implementation of a process to ensure the credit worthiness of new card applicants;

      •   Description of agency training requirements;


1
    See Public Law No. 112-194.



                                  OIG • OIG-RA-2017-001 • March 27, 2017                        6
   •   Management controls, policies, and practices for ensuring appropriate purchase card
       and convenience check usage and oversight of payment delinquencies, fraud, misuse,
       or abuse;

   •   Establishment of appropriate authorization controls;

   •   Implementation of policies and practices to ensure strategic sourcing;

   •   Explanation of how available reports and data are used for monitoring delinquency,
       misuse, performance metrics, spend analysis, and other relevant transactions and
       program management issues;

   •   Documentation and record retention requirements;

   •   Recovery of cards and other documentation when employees terminate employment
       and, if applicable, when an employee moves to a different organization; and

   •   Description of how the agency will ensure the ongoing effectiveness of the actions
       taken pursuant to this guidance, including, but not limited to, evaluating the
       effectiveness of training, risk management controls, refund management controls,
       strategic sourcing policies, and tax recovery efforts.

FHFA, as required by OMB M-13-21, is to review and update its Plan, as necessary, to reflect
the following internal control activities:

   •   To prevent an individual from being reimbursed for a bill already paid by the
       government, Agency officials who approve or settle official travel must verify that
       charges paid directly by FHFA to CitiBank are not also reimbursed to an employee or
       an employee’s individually billed account;

   •   To prevent FHFA from spending money on unused tickets, the Agency (travel
       management center or service or commercial travel office) must submit requests to
       servicing common carriers for refunds of fully or partially unused tickets and track the
       status of these tickets to ensure resolution;

   •   To deter employee misuse of government cards, FHFA must implement penalties for
       card violations that are jointly developed by Agency card management and human
       resources components. These penalties should include salary offset, for instances of
       personal liability, and disciplinary actions for a cardholder or approving official’s
       illegal, improper, or erroneous purchases made with a purchase card, convenience
       check, integrated card, or travel card. Disciplinary actions should include dismissal, as
       appropriate. FHFA’s Plan must define and apply appropriate and consistent employee



                            OIG • OIG-RA-2017-001 • March 27, 2017                                 7
        disciplinary procedures, and comply with joint external reporting required of OIG and
        Agency management; and

    •   To provide a summary of FHFA’s efforts to assess its internal controls, FHFA must
        summarize its overall results in completed compliance summaries and internal control
        assurance assessments in its annual Plan. 2

Pursuant to the Charge Card Act and OMB M-13-21, an Inspector General of a federal
agency must conduct periodic audits or reviews of its travel card program where that program
exceeds $10 million in travel card spending for a fiscal year and must report its findings and
recommendations to OMB and Congress. Similarly, an Inspector General of a federal agency
and the head of that agency must jointly report to OMB semiannually all confirmed violations
involving misuse of a purchase card and actions taken for each violation, where the agency’s
purchase card program exceeds $10 million in spending for a fiscal year.

In 2014, we performed separate audits of FHFA’s purchase and travel card programs. In our
audit, FHFA’s Use of Government Purchase Cards (January 31, 2014) (AUD-2014-006), we
reported no instances of noncompliance with applicable laws and regulations or fraudulent or
inappropriate purchase card practices and that FHFA’s internal controls for its purchase card
program were adequate, with limited exceptions. Similarly, in our audit, FHFA’s Use of
Government Travel Cards (March 20, 2014) (AUD-2014-10), we reported no instances of
misuse or fraudulent travel card transactions and that FHFA’s safeguards and internal controls
for its travel card program were adequate, with limited exceptions. Management took
corrective actions to address the exceptions identified in both audits.




2
 This requirement applied to FHFA’s annual Plan submitted to OMB on January 31, 2014, and subsequent
annual submissions.



                               OIG • OIG-RA-2017-001 • March 27, 2017                                  8
FACTS AND ANALYSIS ...............................................................

FHFA’s Spending for its Purchase and Travel Card Programs, and Number of FHFA
Cardholders, for Fiscal Years 2016 and 2015

Historically, FHFA purchase and travel card transactions have been well below the
$10 million threshold, which continued during fiscal years 2016 and 2015. For each of those
fiscal years, FHFA reported to OMB that its purchase card spending was $1,129,161, and
$970,916, respectively. 3 FHFA reported to OMB that its travel card expenditures during each
of those years were $1,938,859, and $1,824,252, respectively.

For fiscal years 2016 and 2015, the number of active purchase cards reported by FHFA to
OMB ranged from 22 to 25, roughly 4 percent of all FHFA employees. During the same
period, FHFA reported to OMB that the number of active travel cards ranged from 164 to 184,
held by 29 to 33 percent of its employees.

FHFA’s Internal Controls over its Purchase and Travel Card Programs

As discussed in the Background section of this report, OMB A-123, Appendix B, requires
each federal agency to prepare a Plan that includes specifically enumerated elements and
submit that Plan to OMB no later than January 31 of each year. In addition, OMB M-13-21
requires that FHFA review and update its Plan, as necessary, to reflect certain control
activities and provide other semiannual and annual submissions and certifications.

We reviewed FHFA’s Plan submitted to OMB in January 2016 and found that the Plan
included all of the elements required by OMB A-123, Appendix B, except for one. FHFA’s
Plan included:

      •    An outline of the policies and procedures FHFA considers critical to manage its
           purchase and travel card programs;

      •    Controls and reports (e.g., delinquency reports, travel overpayment reports, open travel
           advance reports, and annual usage reports) that, if implemented and used as described,
           would provide FHFA with the tools necessary to effectively carry out and monitor its
           card programs;

      •    Key management roles and responsibilities;



3
    FHFA did not issue any convenience checks during the two fiscal years.



                                   OIG • OIG-RA-2017-001 • March 27, 2017                             9
    •   A process for appointing cardholders and approving officials;

    •   A procedure to follow when a cardholder is terminated or transferred; and

    •   Requirements for mandatory annual training, administration and recordkeeping, and
        disciplinary action.

We identified one element required by OMB M-13-21 that was missing from FHFA’s Plan—
the Agency’s overall results in completed compliance summaries and internal assurance
assessments. 4

Efficacy of Existing FHFA Internal Control for Purchase and Travel Card Programs

For fiscal years 2016 and 2015, we found that no complaints of alleged fraud or misuse of
purchase or travel cards were made to OIG, and FHFA referred no matters involving potential
misuse of purchase or travel cards to OIG. We also learned that FHFA reported no confirmed
violations of purchase or travel cards to OMB during these two fiscal years and took no
administrative or disciplinary actions against its employees for card misuse.

One of FHFA’s internal controls over its purchase and travel card programs is the receipt of
regular reports from its purchase and travel card service provider, ARC, relating to ARC’s
ongoing monitoring of the use of those cards. For example, FHFA receives a monthly
delinquency report from ARC that identifies delinquent travel card accounts—accounts 30
days or more past due. From the monthly delinquency reports received for fiscal years 2016
and 2015, we reviewed all 13 travel card accounts that were 60 days or more delinquent to
determine what action, if any, FHFA took in response. We found that FHFA notified the 13
cardholders in writing about the past due amount and instructed them to remit payment in full
as soon as possible. As of September 30, 2016, there were no travel card accounts 60 days or
more past due.

Further, ARC conducts annual compliance reviews of FHFA’s purchase card holders and the
related transactions using a statistical sampling plan with a 90 percent confidence level and
a precision error rate of 15 to 25 percent. ARC reviewed 158 of the 1,318 purchase card
transactions made by FHFA cardholders between April 1, 2015, and March 31, 2016, and
noted only one issue of noncompliance. Specifically, one sampled FHFA purchase card
transaction lacked evidence of supervisory approval prior to the purchase being made. It

4
  When advised of this omission, an FHFA official stated that she was aware of the OMB requirement and the
omission was an oversight. She also stated she would include the completed compliance summaries and an
internal assurance assessment in FHFA’s January 2017 Plan. After completion of our risk assessment
fieldwork, FHFA provided us its January 2017 Plan, which was submitted to OMB on January 24, 2017. We
reviewed the Plan and found that FHFA included an “Internal Compliance Assessment” section that outlined
FHFA’s compliance assessment tool and an assurance assessment statement.



                                OIG • OIG-RA-2017-001 • March 27, 2017                                       10
should be noted that FHFA had already self-identified that transaction and had taken
corrective action regarding that issue of noncompliance prior to ARC’s review.

Results of Prior Financial Audits of FHFA by GAO

In its 2016 and 2015 financial audit reports, 5 GAO identified deficiencies in FHFA’s
internal control over financial reporting that it did not consider to be material weaknesses
or significant deficiencies. 6 GAO reported to us that these deficiencies were not related to
FHFA’s purchase and travel card programs. GAO confirmed that its audit work included
testing of the adequacy of FHFA’s internal controls over its purchase and travel card
programs for fiscal years 2016 and 2015. For its fiscal year 2016 audit, GAO’s testing did not
identify any issues related to FHFA’s purchase card or travel card programs. In its fiscal year
2015 audit, GAO’s testing identified one exception relating to an FHFA travel voucher that
GAO did not consider significant.


CONCLUSION ............................................................................

Based on our risk assessment, we concluded that the risk of illegal, improper, or erroneous
purchases and payments through FHFA’s purchase and travel card programs during fiscal
years 2016 and 2015 was low and, accordingly, an audit of these programs would not be
warranted during fiscal year 2017. We intend to regularly conduct risk assessments of
FHFA’s purchase and travel card programs to determine whether an audit is necessary.




5
  GAO, Financial Audit: Federal Housing Finance Agency’s Fiscal Years 2016 and 2015 Financial
Statements (Nov. 15, 2016) (GAO-17-139R) (online at www.gao.gov/products/GAO-17-139R) and GAO,
Financial Audit: Federal Housing Finance Agency’s Fiscal Years 2015 and 2014 Financial Statements (Nov.
16, 2015) (GAO-16-95R) (online at www.gao.gov/products/GAO-16-95R). In those reports, GAO rendered
unmodified (clean) opinions on FHFA’s financial statements and internal control over financial reporting for
the periods audited, and stated that they found no reportable noncompliance for fiscal years 2016 and 2015
with provisions of applicable laws, regulations, contracts, and grant agreements tested.
6
  A material weakness is a deficiency, or combination of deficiencies, in internal control over financial
reporting, such that there is a reasonable possibility that a material misstatement of the entity’s financial
statements will not be prevented, or detected and corrected, on a timely basis. A deficiency in internal control
exists when the design or operation of a control does not allow management or employees, in the normal
course of performing their assigned functions, to prevent, or detect and correct, misstatements on a timely
basis. A significant deficiency is a deficiency, or combination of deficiencies, in internal control that is less
severe than a material weakness, yet important enough to merit attention by those charged with governance.



                                   OIG • OIG-RA-2017-001 • March 27, 2017                                           11
OBJECTIVE, SCOPE, AND METHODOLOGY .................................

The objective of this risk assessment was to use the assessment for planning future audits
of FHFA’s purchase card and travel card programs, as appropriate. The scope of the risk
assessment focused on FHFA’s fiscal years 2016 and 2015 policies and procedures over its
card programs.

We conducted this risk assessment in August 2016 plus November 2016 through January
2017.

To accomplish the risk assessment objective, we:

   •   Reviewed the Charge Card Act and OMB M-13-21 regarding requirements that apply
       to FHFA;

   •   Reviewed the FHFA Director’s Federal Managers’ Financial Integrity Act of 1982
       Statement of Assurance for fiscal years 2016 and 2015 for any mention of internal
       control matters related to FHFA’s purchase and travel card programs;

   •   Determined whether FHFA maintained and annually submitted its Plan no later than
       January 31 for the assessment period. We also obtained and reviewed the most recent
       Plan for conformance with applicable requirements;

   •   Determined whether FHFA summarized its overall results in completed compliance
       summaries and internal assurance assessments in its annual Plans;

   •   Determined the dollar amounts and other relevant statistical information for FHFA’s
       purchase and travel card programs for fiscal years 2016 and 2015;

   •   Interviewed FHFA’s Chief Financial Officer and other appropriate officials
       responsible for FHFA’s card programs about (a) whether they had knowledge of any
       fraud or suspected fraud affecting those programs, (b) whether they were aware of any
       allegations of fraud or suspected fraud affecting those programs, (c) the nature and
       extent of monitoring they performed over the programs, and (d) whether and how
       management communicated to cardholders and approving officials its views on the
       proper use of purchase cards and travel cards;

   •   Determined whether FHFA and/or ARC conducted any compliance testing of FHFA’s
       card programs. This included obtaining (a) an understanding of the compliance testing
       program in place during the assessment period and (b) the results of the compliance
       testing performed, including any findings and recommendations to FHFA;



                           OIG • OIG-RA-2017-001 • March 27, 2017                              12
•   Determined whether FHFA implemented its Plan to receive on a monthly basis during
    the assessment period a report identifying delinquent travel card accounts;

•   Determined whether FHFA implemented its Plan to prepare an annual performance
    metrics report for purchase and travel cards during the assessment period using
    Appendix B of OMB Circular A-123; and

•   Reviewed GAO’s reports on its audits of FHFA’s financial statements for fiscal years
    2016 and 2015 to determine whether any deficiencies were reported related to FHFA’s
    purchase and travel card programs. We also inquired of GAO’s staff about the scope
    and results of any testing of the card programs done for the review period of FHFA’s
    financial statements.




                        OIG • OIG-RA-2017-001 • March 27, 2017                             13
ADDITIONAL INFORMATION AND COPIES .................................


For additional copies of this report:

   •   Call: 202-730-0880

   •   Fax: 202-318-0239

   •   Visit: www.fhfaoig.gov



To report potential fraud, waste, abuse, mismanagement, or any other kind of criminal or
noncriminal misconduct relative to FHFA’s programs or operations:

   •   Call: 1-800-793-7724

   •   Fax: 202-318-0358

   •   Visit: www.fhfaoig.gov/ReportFraud

   •   Write:

                FHFA Office of Inspector General
                Attn: Office of Investigations – Hotline
                400 Seventh Street SW
                Washington, DC 20219




                             OIG • OIG-RA-2017-001 • March 27, 2017                        14